skysight-inc/HackerNews huggingface dataset:
KittenHub is a new startup in the Elastic Cloud Computing arena that focuses on ease of use, flexibility and personalized customer service. Unlike DigitalOcean or Linode, with KittenHub you can spin up a new server in less than 30 seconds, resize it both up AND DOWN in seconds, live with no downtime and you can also create snapshots without ever stopping your server!
Sure they have other features we miss but don't worry we'll get there soon!

We also personally help every single user setting up their server and configuring the software they need. All things that the big players out there cannot afford to do.

If you're curious check us out here, this voucher will give you enough petrol to test your very personal Kitten for a full month:

https://kittenhub.com/referral/HACKERNEWS

We're eager to hear your opinion and advices on how to improve our platform! Thank you.
No, we're on the same page. I don't have an attack on XTS you are not aware of.

Code (again pretend in hibernate/wake behavior) that deliberately leaks information about important boot blocks on the disk could lead to a full compromise. The attack and back door, of course, would be fairly sophisticated in this instance.

You'll concede that the possibility exists, but that its hard to evaluate. What I'm trying to contribute is not that such a backdoor is currently used (I have no idea) - but that RDRAND/TPM/XTS-leak or other non-Bitlocker backdoor can be used to thwart Bitlocker if we imagine that it hasn't been directly backdoored.
Because there's usually no downside? The same reason people put those goofy "this message is for the intended recipient only..." notes in their sig file. It almost certainly has no legal force ever but it doesn't hurt.
9/11 isn't even close to the beginning of the end of the Westphalian order. The increasing domination of multinational corporations, labor organizations, political movements, terrorist organizations, etc., was widely observed and pointed to as evidence of the progressive decline of the nation-state order for many decades prior to 9/11.
Yes, I do seek to explore the experience of biking. My blog is made up of interviewing cyclists in Minneapolis to explore how they started biking and the way they experience life on two wheels, along with documenting bike events around town, and some opinion pieces.

I mention that I have a degree to point out that I understand how to evaluate research, that doesn't mean that I've read and synthesized all the research out there. Many studies people point to to indicate the efficacy of helmet use are both old and flawed, newer research has been showing a trend of less efficacy. If a compelling, well done meta-analysis came out indicating an incredible beneficial effect of helmets for people who cycle casually, I would probably be swayed by that. The problem is, such research is not currently available.

How is it reckless? I don't see compelling public health evidence that supports helmet use. Additionally, there is evidence that helmet use may increase other risky behaviors (like close motorist passing, and risk-taking among cyclists) and can also make the environment less conducive to cycling safety (fewer bikers on the road = more danger).
As someone who has stolen a lot of Vimscript from his dotfiles, I know that he prefers Mercurial to git (see https://github.com/sjl/dotfiles), and so he's more active on Bitbucket than Github.
William Styron, one of the authors quoted in the article, wrote a fascinating memoir about depression called Darkness Visible. Highly recommended!
> If you are using LastPass without 2FA

There is no 2FA with LastPass.

Don't believe me? Set up a LastPass account and turn on 2FA. Go log in on an untrusted browser. Enter your password. At the 2FA prompt screen, there is a giant red "If you lost your Google Authenticator device, click here to disable Google Authenticator authentication" link.

That's right. They give the attacker the option to disable 2FA for your account.
Nadya is a feminine name meaning "Hope" in Russian.

Not that gender is important online - I prefer not to disclose it. I just find it funny you assumed I am a he, regardless of my username implying otherwise.
A power that's delegated to him by the Constitution. There are very specific guidelines surrounding what a President (or any other member of government) can and cannot do.

You're saying the President should spend more time putting his name behind social initiatives? Something tells me you'd be unimpressed.

Not that he shouldn't do it, but, as you said, he's assembled a 500-person strong startup to rebuild gov't infrastructure and numerous people here find it futile.
Well if I put on my tinfoil hat, then there is no protection from the NSA. So, now I'm only trying to protect my password/identity from criminal elements, I tend to side with Google as knowing what they are doing. It doesn't mean they will also be mistake free, but it is something they deal with and have been dealing with before LastPass was even an idea.
I don't understand why the console Netflix apps have the ability to show you exactly (ish) the quality you're currently streaming at (on PS3, hit 'select' button and it'll say "720p" or whatever it's at), but the PC browser client doesn't.
The TPM doesn't verify that you're booting a trusted OS as such. Each component of the boot process is hashed and that hash copied into the TPM, and the secret is encrypted in a blob that includes the expected hash values. If the hash values differ, the TPM will refuse to decrypt the secret. So booting a different signed OS won't give you the secret - even though you're a trusted OS, the TPM hashes will be different and the secret will remain encrypted.
The passwords themselves are rather secure.

But if somebody got their hands on one or two of your passwords, they could probably figure out the rest.
I don't know if that's what he's referring to, but I will comment that KSL is a pain. It's a bloated error filled site, and I really wish the local communities would stick to CL.
1) Your scheme is open for all sites where you use it. So they can analyze it and get all of your passwords to other sites by this scheme.

2) You can forget "Key", especially unique keys for important sites. I have few hundreds records in KeePass, I can't imagine how to remember all of them or "keys" to them.

3) TLD can be changed and some secrets doesn't have TLD (databases, for example).

4) You can't remember all digits of all your credit cards. If you can - or you don't have credit cards or you kidding.

5) Sometimes you need to store very long license keys. No, license.txt is not the most safe way :)
As an example of a use case that fails with the 50MB limit, I'd love to be running Clojure code on Lambda that depends on the Stanford NLP toolkit[1], the minimal form of which is 260MB. (To examine student writing and make useful suggestions to teachers, if you're curious.)

[1] http://nlp.stanford.edu/software/corenlp.shtml
You still have your loops in CFG, identifying back edges and extracting loop induction variables is mechanical. And you can lower any amount of debugging information out of your high level AST structures. No need to stay in AST to have it all.
When I use a (Lechtrum) moleskine, I feel like I am creating an artisan product that is an extension of my thoughts- something to be kept as a remnant of my mind.

I fill up the table of contents section with close attention. The page numbers remind me of my progress more clearly. Filling in the date section is a simple feature that reminds me how long it has been since I last used the respective notebook, as I have graph paper moleskines and lined paper moleskines.

These simple features make my notes feel more important, and as a result I take much greater care with the clarity and explanation of my notes. Personally, after having spent about a year using moleskines, my productivity and enjoyment with taking notes has increased significantly.
^ What he said, the only relevant patents expired long ago.
Consistent Ruby Code Style
> That means one compromised password - your master password - compromises all your sites.

I agree, but it's hard to see how it could be compromised, since it is never entered anywhere public-facing. You can, but need not, have the Firefox extension store it, but only in memory. It is also possible to use the PasswordMaker website (once loaded) without an Internet connection, in case you are worried about it leaking data.
> Yet another team that seems to think the programmers should QA their own code.

That phrasing is a bit different than what I think they meant. Programmers familiar with the problem domain should QA the code of other programmers is how I took it.

I've never seen the value in "pure" QA people largely because you need to be a developer to be an effective QA person [writing automated, repeatable tests] at which point you are just looking to use the developers that are more meticulous than the others to write those tests.

They are still ultimately software developers / programmers / whatever. Its just the problem domain they spend half their time on is QA instead of Ops or whatever else.

Maybe I'm just used to being part of an IT department embedded in a larger company where we tend to mix a couple things in a single position. :P
Blimey, I am genuinely unsure if this is a parody comment or not.
Forget where that photo was captured? This site can help remind you
PasswordMaker allows you to tune the length and character set. You have to remember your site's password requirements, which is not so easy to do (usually they are only made available when you try, and fail, to change your password; in particular, only when you are logged in); but, in practice, I've found that using the default settings, and then using restricted settings (shorter length and A-Za-z0-9 character set) if that fails, works on every site I've ever used. This means that, if you are willing to endure the occasional inconvenience of having to re-enter a password, you don't have to remember anything per-site.
I'm honestly still not following the XTS leak you're talking about. The deterministic leak I'm talking about happens because XTS isn't randomized: as you write and rewrite the same sector, you're doing so against the same set of "tweaks". I think that's a meaningful problem --- particularly if you're using XTS to encrypt something other than a disk, particularly in a cloud setting --- but as a backdoor, it's a pretty crappy one, because it requires your computer not only to be on and "unlocked", but also for you to continuously update the targeted blocks.

It's an especially dumb backdoor for Microsoft, who could literally backdoor the Comic Sans TTFs to greater affect. Why would they tamper with the most sensitive code on the entire system, to get a fifth-rate backdoor, when they could get a first-rate remote backdoor out of virtually any code on the whole system?

Subtextually: I just generally dislike FDE, as anything more than a "my computer got stolen out of the back of my car" mitigation.

If you are worried about attackers with continuous high-touch access to your computer, no FDE system helps you. Reliance on FDE more or less made the DOJ's case against Ross Ulbricht, for instance.
It doesn't require that replaceable components are always replaced with non-replaceable ones. The point is that over time, a replaceable component is likely to be swapped out multiple times, until, probably by accident, it is replaced with a component that is no easily replaceable, as which point it becomes stuck (e.g. glue code is written specifically to interface with that component and would be difficult to rewrite for a replacement).

In mathematical terms, you can imagine it as a Markov chain describing the component currently slotted in, where non-replaceable components are the absorbing states.
You do not have to do such clumsy things to build from nothing. Split the input by whitespaces, lookup word definitions in a table (linked list is ok), push the addresses of the found words to the output stream as call instructions or execute immediately if marked so. That's it, a minimal direct threaded Forth compiler is done.
While I hate to argue against this and typically suggest the same, it was the state's (Arizona, surprise!) 2 Senators that added (in to the defense spending bill) the selling off of the land to an foreign mining company after years of lobbying (by said company) attempts to pass this legislation (on its own merit) failed. So don't bother writing to McCain or Flake because they are the one's that created this mess in the first place.

You could write to AZ rep's but a majority of them support this or a similar concept as many lobby to get the Federally protected lands back in to the hands of the state so they can do more of the same...all in the name of short term profits (seemingly for foreign corporations that will do little to actually benefit the state).
I've been happy with Mixpanel for event-driven analytics. Straightforward API and good customer service.

And the real killer feature for me is you can get a dump of every event you've ever logged with all their properties. Which means I can do complex analysis on the raw data and it also means I can take my data with me if I ever decide to leave.

I also evaluated keen.io which was very nice, but is geared more towards developers.
> Turning down gifts sends a strong social signal that you don't want whatever relationship the gift implies.

I believe that interpretation is incorrect.

In Chinese culture, it is important to balance social relationship, and the worst is to own someone favor. Owning some others favor means to repay the favor at some point; and you can't simply repay the equal favor later, you have to do something more significant to truly balance -- in fact, I don't think in Chinese culture, a favor can truly be repaid -- therefore, to accept a favor is truly a (lifelong) commitment. With such context, you would not want to accept a gifts easily, you would honestly would like to decline the gift (while noting down the gift givers gracious -- yes, it is all about the gesture). Also the attempt of declining downplays the favor (as the gift is not truly great favor as I could decline it).

In Chinese culture, there is a strong concept of social obligation (balance).

So Chinese do want friendship as in the intention of gift giving in a western culture, but most Chinese would rather other people owning to their favor rather than the other way around -- and Chinese do keep count -- unless the relationship is so close that there is no need to keep count any more; but then exchange gifts at such level is also absurd.

Of course when you don't want the relationship, then you absolutely don't want to accept the gifts.

PS: Actually this is how Chinese corruption works. You try hard to bribe officials with some gifts or dinner even when the official would not value your gifts at all (because he already had too much), but as long as the official accepts your gift (often because you are so sneaky that he cannot easily return your gift), then this official is obligated to help you out (often means to go out of his way). First time is always hard, but second time is much easier.

And that is why to be a Chinese official is difficult, you abide by the rule, then you become socially cold and judged down in culture; or you could be generous accepting bribes and doing favors for everyone -- you become popular, but on the other hand, you have some crimes that some day will become your downfall -- not because of law, but because of power shift (which is inevitable). Greed is just the byproduct.
Chatterfall – Anonymous Real-Time Location-Based Messages
> Not only do I see this issue groby_b rasies as a huge one

I think that it is not actually an issue, since the master password never goes out into the wild (see https://news.ycombinator.com/item?id=9722272).

> Most of them don't display the requirements on the login page (or even on the signup page sometimes) so now I need to remember that on a per-site basis which is just as bad as having to remember different passwords IMHO.

For me, at least, this issue is solveable in practice. See https://news.ycombinator.com/item?id=9722276 .
The original creators of Myst are making a spiritual successor (https://www.kickstarter.com/projects/cyaninc/obduction). The kickstarter got to the Oculus Rift support funding tier. They will probably include a Myst-style movement system since that existed in Myst V which also had free-form movement in a 3D environment. I'm really hoping this game pans out to be good.
I suppose they need to ensure that the person logging into the site, or interacting with the site via the browser extension, actually created the encrypted archive. Without a passphrase-derived authentication token (which they say is something like pbkdf2(encryption_key + passphrase), where encryption_key itself is pbkdf2(email + passphrase)), how could they ensure that?

Without that connection, if they had a totally separate secret S for web logins, anyone with S (and your 2-factor token if you have it enabled) could change your server-stored archive with no knowledge of how to decrypt it. Wouldn't that be a denial of service attack, if the next time you login to lastpass your local encrypted password archive is overwritten? You'd then have to rely on whatever other backup solution you (hopefully) use, to get an old local copy of the encrypted password archive.
Microsoft unveils new $150 Xbox One Elite controller–and we’ve held it
It's not a parody comment. I am a big fan of writing, and products that make my writing feel more valuable make me care more about what I am writing. It's as simple as that.
And you want it to be illegal to stop my TV from phoning home (or to make it phone home false info)? That's nightmarish!
There are multiple problems with this approach. SHA is way too fast, some site is always going to have Auth requirements that won't be the same as the ones you have set (one service wants mandatory special characters, one wants mandatory alphanumeric only), and, most importantly, you can't change the passwords unless you change the master password and remember which you used where.
Is Europe Trending Toward 'Grexit'? Ask Google
Yes dimqua I agree and Retroshare 0.6.0 raises that bar considerably with hidden Node, Darknet Modes and Tor Hidden Service options built into the multi-computer platform directly. Retroshare 0.6.0 across the board GPG key encryption is built directly into the coding. Its wide use of C++,QT also makes this application far more appealing than the resource hungry JAVA based decentralized networks that popup now and then like mushrooms but lack many of the features Retroshare 0.6.0 users take for granted now.
My count differs. France was an empire under Napoleon 1 from 1804 to 1814, again for a few months in 1815 (and that time he took over due to overwhelming popular support), and again under Napoleon III from 1852 to 1870.

Both in 1815 and 1852, the emperor took power with public support. (Napoleon I invited the soldiers sent to stop him to kill him, and they joined him instead. Napoleon III was democratically elected then changed the form of government.)

There were more monarchies as well. When the Revolution happened it first briefly became a constitutional monarchy before the First Republic. It was made a monarchy when Napoleon fell, then the monarchy was restored after Napoleon fell again.

You make a good point about the adoption of the Constitution in the US. Furthermore it is unfair for me to not note that several of France's changes of government were imposed from without.

But still I've noticed a sharp difference of attitude between what people in different countries believe democracy to be.
I can't speak for the parent post, but my problem with GA is that the mechanics of setting up new events and flows and tests and then mining that data is such a chore. Generating enough data for statistical significance is, of course, a problem for all solutions.
Codius: 1 year review
Ask HN: Dell paved my hard drive with Windows, now what?
I sent my Linux laptop in for repairs to Dell. I needed the keyboard and trackpad replaced.

I wrote on the repair description, "Do not under any circumstances clear the hard drive or reinstall Windows" and "Beyond replacing the keyboard and touchpad, do not do anything to this computer" and "If you delete my hard drive or clear the password, I will demand a full refund and bill you for my time to reinstall the OS and data." And yet, I have my laptop back today with Windows 8.1 installed.

This is so infuriating I cannot tell you. What remedies are there for this when I was so crystal clear in writing and on the phone that I did not want this outcome?
Nope, those Married to Catholics are now allowed, but Catholics themselves? Definitely not. And Jews? Muslims? Forget it! "the requirement for the sovereign to be in communion with the Church of England remained"
How do you generate a different password after that one's been found to be stored in plaintext and the admin resets all of the passwords?

Or, and more to the point, having generated a different password how do you remember which sites need a V1 password and which need V2?

When sites introduce silly rules around password structure, how do you make sure your passwords conform?

And even if you could guarantee you'll never hit any of these issues, shouldn't you be using a key-derivation function, rather than a hash?

I entrust my passwords to KeePass, as I trust its authors to have more of a clue than me and it lets me store arbitrary data rather than restricting me to a specific class of generated password. That file can then be replicated to enough of my devices that it's available when I need it, without a third-party having enough access to the data to be able to issue even the kind of security alert we see here.
Ask HN: How can I make a business out of my real life logic skills?
I am pretty good at real life logic problem solving. I think through the situations and gather the data and am very very good at figuring out a solution to that situation. In a way you could say I would like to consult but for me it's more of spending time with the problem, understanding every facet of the issue and then reaching an optimal solution. I want to basically business problems but not at an executional level but an idea/solution level. Do you think this could be turned into a viable business. How?
5 simple ways for the introverted entrepreneur to be more successful
To be honest, the unwillingness to recognise Crimean secession had a lot more to do with geopolitics than Westphalian constitutionalism. The idea of constitutions guaranteeing the indivisibility of nations faced a lot of challenge in liberal political thought, especially over the past century.

It's why the West generally does recognise the secession of Kosovo but doesn't recognise the secession of Abkhazia, and Russia adopts the reverse position. Not to mention the frankly silly policies adopted by different countries on Beijing/Taipei sovereignty...
That will never work because economic returns to a piece of code will not go to the engineer. Both management and company owners will want most of the returns of the code, leaving no profit motive for the engineer to be ultimately responsible for it. The engineer will move on and the owners and management are stuck with rotting code. Or management gets rid of all the engineers because they want to keep all the revenue and discount both cost of maintenance and need for engineers to profit.
Good point. This law is talking about "slots" (a.k.a. jobs in your comment), not the things (or people) that are slotted into them.
Google eyes S.F.’s Hunters Point Shipyard for future office space
You know what would be better? Ditching Silverlight. Fucking thing crashes on me every few minutes. I've been trying to watch the last 6 minutes of an episode of HoC for about 30.