skysight-inc/HackerNews huggingface dataset:
That's a good point. Any product of significance that runs in software on untrusted users computers can be compromised by determined attackers, NSA or not. Even hardware-protected secrets have been bypassed. Hence, the security argument must rest on something that works regardless of whether enemies know the mechanism.
I didn't say start a Kickstarter. That was used as an example of how crowd funding is used to raise a lot of money. Anyway, it was only meant to start the conversation.

You weren't suppose to tell me what was wrong with my straw man but offer a solution that's much better.

Anyway, we aren't going to change the world today so let's end this and just wait until the Elon Musk of medical research appears.
they made a number of specific points about why they don't think it's a bubble. Now, they could be wrong, but at least they are coherent

This is a great comment. The grandparent is being pointlessly dismissive with zero evidence presented. That makes it an incredibly low-value comment.
My personal favorite is alice:

https://github.com/justinas/alice

It's not very much code (only ~90 lines inc. comments), but I think it establishes a pattern that makes everything very straightforward from authentication to logging to runtime analysis. Plays very nicely with gorilla. I think the more you let net/http shine, the better.
> What does javascript have to do with it? It's trivial to display images inline through data URLs.

My point applies to that too. Images, text, CSS, video, etc. I'm saying I don't have a problem with requesting an HTML file, receiving it, and then choosing to not render/execute/display certain parts of it.

> Re: text only browsing, that still allows for advertising, and it's up to the content provider to either take advantage of the mediums available to the client or take steps to attempt to block that access.

I agree, but that doesn't sound like your previous position.

> Re: cURL, now we are getting more into scraping, and I think it's event more clear cut that it's not the intent of the provider for their content to be used that way, and there are much more often AUPs that specifically cover this in a non-ambiguous way.

I'm not talking about programmatically requesting large amounts of content. I just meant a single individual running a single cURL command.

> My argument has never been "do not run ad-blockers", it's always been just to point out what I see as a set of troubling behavior that I see, which I also contribute to.

I guess I'm arguing that you don't need to be a hypocrite, because it's not troubling behavior.
I've done this and it works for normal typing. The downside is key combinations do not work across the keyboards (at least on Mac OS X). Example, pressing cmd on the left keyboard and p on the right keyboard will not trigger cmd-p.
> To locate a file by name in the current directory, find -iname something . (or similar). To find a file anywhere by name, use locate something (but bear in mind updatedb my not have indexed recently created files).

I think this will glob unless you escape the asterisks. Also on my system (debian 8) I need to put the directory to search first, or not at all:

find . -iname \something\

find -iname \something\

edit: hackernews ate all my asterisks
But the sock has revenues, even if it's a red sock that has no hope of turning black.
Scroll up - we aren't discussing possible approaches to a hypothetical world with zero jobs at all. We are discussing the actual outcome of globalization so far, which is more goods and services with less work required on our part.

Not even close. That's your current redefintion of the argument. Scroll up. The thread started off as a set of defensive/offensive prescriptions given the current macro state of affairs, which led to the labor implications of free trade, which led to your utopian exposition of the only possible configuration of free labor. You were asked about other possible configurations of this state, and no apocalypse was mentioned at all.

In addition, you ended with the only way this could happen would be if the chinese and robots take care of everything, and nothing could possibly ever go wrong along that direction of displacement of the workforce...because...because...I dunno...libertarianism. So, asking again, do we have evidence of the robot/Chinese paradise being the only end-game, or are there other paths that things can evolve into?
Is it for SEO?
Zynga Acquires Mark Pincus’s Incubator, Superlabs
A good posture, focusing on the moment, the sensations, the breathing, accepting the thoughts but not feeding them. Do that every day and be patient. It is best to practice with other people as more experienced people can guide you. Some people start right away with a retreat. It is also a good way to start.
+1.

My favorite notebook right now is a Rhodia No 18 dot pad. Staple bound is far superior to wire.
That's nice, but it only affects the command line.

Instead of that, create the following file:

~/.inputrc (tilde slash dot-inputrc)

And in that file put at least this:

set editing-mode vi

Now every program that you run that a) has its own command line, and b) uses the readline library (there are a lot) has vi commandline editing. psql, mysql, telnet, lftp, and many more.

man bash has a section on READLINE. For example, in man bash search for

editing-mode
D'oh! You're right of course, I apologize for such a lazy mistake.
I can't tell the difference between sudo and polkit, except that the latter comes with some XML based presets and can be talked to via RPC (dbus).
Is the loss of reputation really worth less than the value of the externalised testing?
“Great Fucking Startup Advice”
Also Maracon (https://github.com/Unknwon/macaron), Negroni (https://github.com/codegangsta/negroni), and Goji (https://github.com/zenazn/goji). Negroni is from the creator of Martini, Goji is apparently high in antioxidants, but I'm partial to Macaron. I also use a homegrown Gorilla-based library at work...there's more than one way to skin this cat, that's for sure.
> Punish ? .... BSD is extremely user friendly. It just seems to be picky at who it calls friends.

I seem to recall the same line being used about (GNU/)Linux at one point.
This is a very long source from 2000 that says in 6500 words what 'geofft said in just ~300: that this is a code signing key for crypto libraries. If Microsoft wanted to backdoor your Windows machine, they already have complete control over Windows code signing. They do not need a special key literally labeled "NSA_KEY" to do that.

It's not "lower concern". It's not a concern at all. Microsoft's code is comprehensively reverse engineered. People have reversed the most boring, tedious libraries on the system looking for memory corruption bugs. You posit that maybe they just forgot to look into this "NSA_KEY" business.

For a software security professional, you really come loaded for bear with a lot of weird advice:

* Avoid elliptic curve and use conventional Diffie Hellman and RSA because the NSA controls the ECC patents (?!).

* Use Blowfish because it has a long security track record (?!).

* Watch out for Google because they don't understand endpoint security (?!).

* NSAKEY isn't a high-priority issue but it's something that people should be concerned about (?!).

* Here's an unencrypted HTTP website that you can cut-and-paste GPG commands from instead of reading the manual (?!).

* Firewalls are just some made-up crap that don't actually provide any security (?!).

* Use MatrixSSL and PolarSSL instead of OpenSSL because OpenSSL's code quality is crap (?!).

I get the feeling that we do very different kinds of security. You talk a bit about formal verification and EAL levels. I had the misfortune of losing a couple months of my life in the early 2000s to Common Criteria work. If you're coming from a CCTL background, some of the very weird perspectives you have on this stuff start to make sense to me.
What's on the back of the whiteboard? Can you flip it over and paint it with blackboard paint?
> I trust them that they wouldn't be actively spying on their customers, because that's a good way to kill your company.

Many, many companies actively spy on their customers, including some of the most successful companies in the world.
The blockchain is everything including hard forks. Bitcoin is whatever fork the bitcoin miner's have a consensus on.

These are very different things. You are wrong again.
Prior discussion: https://news.ycombinator.com/item?id=9719639
A broker explains how a real-life Jurassic World would get insurance coverage
You have an attack on them? One that works with a Top 500 supercomputer? With a IBM Bluegene? With a FPGA? With Intel hardware most black hats have?

IDEA particularly was a thorn in the side for NSA via the most famous app using it. Academics gave it plenty of beatdown. It's still secure in practice. So is Blowfish if working around weak keys and rotating frequently. My motto in high security is "tried and true beats novel and new." An new thing shows up with new methods, new proofs, and a few years later new attacks. I'll take the thing that works despite tons of effort to make it not work.

That said, remember a cascade is my usage case. AES finalists received enormous peer review. At least one of them is always used. The weaker ciphers are in the middle. Then, there's stream ciphers such as Salsa20. Ciphers that are the same can't be used in a row (meet in middle). Any pro looking at the construction hasn't identified a realistic risk in years far as the crypto goes. Protocol implementation, RNG's, parsers, etc were the usual worry areas.

So, I call FUD on this stuff. It's one of the things cryptographers always bring up without evidence of any practical risk. I'm confident that, accounting for weaknesses, certain algorithms are strong after still being secure for 10+ years of significant use and cryptanalysis. That's a good track record without a break in INFOSEC, right?
Curious. Have you used systems that provide fibres ? The idea is that blocks of code exchange control whenever a fibre is written to or read through. I have not used Erlang or Go so am far from being an expert in these things.

You might find this interesting http://felix-lang.org/share/src/web/tut/fibres_index.fdoc the site is undergoing reorganization so expect (and pardon) broken links. BTW I am not the one who develops Felix.
The Sunday Times sends DMCA notice to critics of Snowden hacking story
Yeah I'm definitely not claiming novelty (http://ohbah.com/mods/chairkey/images/cat.jpg). Over the past year I've tried a number of different solutions, and actually alternate among this, a mechanical keyboard and various (optimized) desks (standing and not).

The idea with this is that your arms will be pulled down (as you noted) but into the cushy arm rests, as opposed to your arms supporting themselves (if you are in the proper typing position). And they are tilted so that you end up resting your wrists on the side, as opposed to the bottom of your wrist where your tendons/nerves are most exposed. I don't know much about the science of ergonomics, but my arms do feel more relaxed in this position :).

But yes typing too hard has also been an issue for me in the past, the mechanical keyboard has been a huge help for that. Thanks for the comment!
Crazy close call original video broxroxz
Pope Francis Calls for Climate Action in Draft of Encyclical
'Dope' Becomes First Movie to Accept Bitcoin for Tickets
Ask HN: What email client do you use on OS X?
That remains to be seen. I really hope not.

With Samsungs finished-forms walling the company already tells Linux users to not expect any support, at all. So, that is consisting with the testbed-theory.
It doesn't mean anything because it's a standard move to reduce legal risk. No comment is almost always the safest answer. This applies to individuals too:

https://www.youtube.com/watch?v=6wXkI4t7nuc
But you don't work for the government, you work for the public, which happens to be a government job. And this changes everything (go ask a Marine about it). "Being patriotic for the government" has no meaning in a free country with individual rights. And it is not because others are getting pork from taxpayer money that it is a good thing that should be praised and encouraged.

The government is composed of citizen who represent all other citizen's interests and have been hired to manage them. It is not a standalone entity and, at least in the United States, is (technically, if not in practice) subordinate to the people, not owning them like a feudal lord his serfs.

Government service is what allows Silicon Valley jobs paying fortunes to exist - both through the maintenance of individual rights (justice, police, defence) and through seeding it with vast amounts of defence research funding half a century ago. Going ostrich on that simple fact of life today in a first world country is a luxury afforded by those who do not and spend their own life dedicated to making yours possible. Regardless of Snowden's status as a traitor or hero, for example, it is pretty clear that he was not motivated by financial gain or the ideological concerns of the enemy (the traditional reasons for moving to Russia in the 20th century). He did it because he thought that risking his prosperity, quality of life and, well, actual life was worth it for the prospect of improving government and defending his fellow citizen's rights.

As a citizen, you have the power to change the way government operates through your representatives (without doing a Snowden); the question becomes, to those who complain of pork, how many of you did bring it up with your elected representatives? How many of you took some action instead of thinking "that slice looks tasty, maybe I should have some"?

This is a separate debate to the idea of civil servants being paid "market rate" salaries or simply enough to have a middle class life (i.e. sacrificing earning capability for the sake of public service). What I am particularly objecting to is your idea that because some people have managed to steal from the taxpayers, your fellow citizen and neighbours, that it is OK for you to do so as well. If I have misunderstood you I apologise.
I think the wide price options cover all your potential customers' price ranges, so you will certainly gain paying customers in each category. I might change the word "Checks" to "Check types" or something, to avoid suggesting that each connection event costs ~$1 but rather each monitor configuration.

That is a beautiful website, by the way.
No Man's Sky. A game about exploring an infinite procedurally generated galaxy
So the rich borrow cheaply, invest the money, and profit?
> But this depends on the alternative. If, instead of using a password manager, uses only one (or even two or three) passwords across all the websites they frequent, then you are still, in effect, trusting numerous third parties to keep your password safe in the cloud--if any one of these sites is compromised, then your password for all (or half, or 1/3rd, etc.) is compromised along with it.

Correct me if I'm wrong, I read this as if you're equating hacking a frequented website (and password) as hijacking a % of someone's accounts, if they use the pw there.

Random websites don't know about the other accounts you own, let alone the user ID and password them (if that same pw cracked is workable on the other service).

LastPass, or any cloud password service, has to store the relation between the service, your username for it, along with the password. That is global ownage.

Find my password on some irrelevant site, you may not even be able to link it back to me. If so, that doesn't mean you know which services I'm signed up to, let alone my user ID or password.
Inside a counterfeit Facebook farm
The key it seems to me is by using both a master password and a key file. If a site gets cracked and they find your site specific password that won't help them determine your keepass database master password &/or generated key file that you only store offline and never sync to the cloud.

In order to open the database you need both the correct master password and the correct keyfile. If the attacker doesn't have both, they should not be able to get into the database.
What would be good is an interactive confirmation when a host fingerprint has changed, instead of a flatout abortion and having to edit your `known_host` file. I have to SSH into hundreds/thousands of VM that reuse the same IPs/FQDN sometimes, and the strict host checking is a major PITA. I haven't turned it off tho, I prefer the pain to MITM.
I feel irrationally responsible. I used to steal them out of the stationary cupboard in high school during the 1980s and give them away to anyone who wanted some, and was surprised at how popular they were with other students. At the time I thought that either everyone else liked art class as much as I did, or that perhaps some of them were using them for graffiti, but some years later it dawned on me that they provided a relatively safe way to abuse solvents :-.
Nice job on this. This is a feature that expensive enterprise products have, but almost everyone should use something like this. Keep going!
No, my jobs have been Boston and Chicago.
This is true, as well as enable 2-factor authentication for sites that support it.
Baikonur Cosmodrome – Soviet shuttle program, 23 years after it was shut down
Yeah I alternate between my Apple wireless keyboards and a cooler master mechanical board with cherry browns. I definitely enjoy them both but I find that it's the position of my arms that has the largest effect on wrist fatigue, not the key actions. Ideally I'd like to mount mechanical keyboards on the arm rests instead of Apple keyboards, but I haven't found a wireless one that I like yet...
Considering the fact that most whiteboards are installed vertically and that writing involves the tip being at a higher elevation than the back of the pen, this doesn't seem very sustainable. Yet another reason to prefer blackboards.
Yes, there are real attacks on constructions build from 8-byte blocks. And no, that's not how real-world crypto attacks work; we don't use supercomputers to mount brute-force searches.†

A 2015 recommendation for Blowfish is cryptographic malpractice.

† unless you're crazy enough to prefer DH to ECDH.
Looking at the top comment though, it does not look like these 500 software engineers have much power. If they had, they could effect real change.

Finding budget for 500 programmers is a drop in the ocean of the current Federal budget. They probably could get a few of the drivers moving parts around for the JSF program to drive a little slower for a couple of days and use the fuel savings.
BMW X1 2015: style plus pêchu et partie technique revue
So, it looks like a (non-root) user with write access to any directory can gain root?

Well, shit.
I use the same scheme but on top of it I hash it so even if site saves my password in plain text, it doesn't reveal my scheme.
I use a portion of hash for sites which have maxlength constraint otherwise full hash.
I'd sort of agre with this, I find I type fastest these days on my bluetooth apple keyboard but my personal favourite is still my TiBook semi-trsnaparent keyboard, it had a comfortable amount of travel and great action.
Hmm that might be a configuration issue, my combinations work as expected. I'm in Vim pretty much the entire day so if key combinations didn't work this would be a non-starter
Towards 2000: Introducing the Amazing Compact Disc
LastPass Hacked, Time to Change Your Master Password
Oh my goodness what a wonderful site. I wanted to make something like this years ago and even registered a domain (buyitwhen.com) but everyone I explained the idea to just laughed at me and I didn't really know how to get started on it. Who's laughing now? Well mostly the people who are monetizing this thing but I am laughing along with them in an I-knew-it-would-work fashion. Thanks for bringing this to my attention.
Virtually every diagram I ever published could've been developed on an iPhone 3S
Get Rid of Bad Relation by Dr Puneet Chawla
Greenspun's_tenth_rule
Man so I guess tcsh/csh lost the shell wars?
> (And actually, this comes down to Z_2 arithmetic, so we could probably use a fourier transform for it... think I feel a blog post coming on.)

Care to elaborate on the teaser. Pretty please.
Raised https://github.com/jlevy/the-art-of-command-line/issues/22
Especially egregious was the episode where he misunderstood the "xkcd password scheme" and lashed out against it in his blog, and then kept on defending his flawed opinion against all explanations.

That did a lot of damage to all attempts to teach password security to laymen.

OTOH he was one of the first "famous" security people to publicly recommend writing down passwords.

So all in all he is certainly a net win.
Doesn't help in this situation-- you need to be able to install the base executable for the browser extensions to function.
You can definitely type without injury on a standard keyboard if you place it relatively low, tilt it to a comfortable angle (the best tilt depends on the height of the table), and bring it in close to your body, especially if you are only typing some of the time. (That is, if you are a writer or programmer rather than a professional transcriptionist or data entry clerk.)

However, having your wrists be less pronated also makes a huge difference. The most neutral position for your forearms/wrists when your arms are in a typical typing position is only pronated slightly compared to a vertical (“handshake”) type orientation. Typing on a standard one-piece keyboard, such that the palms are facing downward, even in the best possible position, still puts a lot of static load on the relevant muscles, and encourages the typist to hold the arms out to the side with the elbows up, as a way of reducing that strain, which causes various other posture problems.
Because it's hard to make an automatic monitoring system that reliably distinguishes between "a failure occurred but everything is fine" and "a failure occurred and now everything is on fire".
Cryptography Engineering is a good book (with some flaws).

Schneier is much less of a factor in real-world crypto than generalist developers think he is.

I feel bad blaming him for it; it's not his fault that people who don't do serious work in cryptography have made him a cryptographic folk hero. On the other hand: there are still people using Blowfish because his name is on it, so maybe I don't feel bad blaming him.
They forgot to look into the subversion, BIOS, peripheral firmware, and covert channel risk despite me repeating those on forums all over going back years. Then the shit ended up in TAO's catalog (including my "amplifying cable" concept aka RAGEMASTER) & most stuff was weak to it. Same argument could applied to widespread open source software that people find "previously unknown" bugs in despite that code existing for years and "widely reviewed." So, I don't have to posit anything given the horrid state of INFOSEC and app review going back years: they should instead prove they did better than usual in the security analysis and show what they found for independent review. This is, coincidentally, a part of the scientific method as well.

You instead could've settled this argument if you linked to a group that reversed engineered all of that, found that it did exactly what they said, and had no conflict of interest with U.S. government. You say you know these exist but still haven't produced them. You instead expected people to take your word for it or comb the Internet looking for the proof you allege. Both a tall order.

Those of us in INFOSEC against highly subversive opponents don't deal in pure faith [esp in similarly evil organizations]. So, where is this evidence that it was totally reverse engineered and proven to be functionally equivalent to claims? I'd like to read it, determine its credibility, pass it onto peer review, and share it widespread if it passes enough of that. As promised, I'll even add it to the Wikipedia article that tops search to this day.

Waiting on you and your evidence.
https://www.goodreads.com/quotes/649893-you-know-the-most-am...