skysight-inc/HackerNews huggingface dataset:
"Absolutely no way"? I'm sorry to be impolite about it, but that's a bit of an exaggeration: one could jailbreak their phone, pull the binary into their computer, decompile it, and inspect it for implementation structures that would be coherent with how the two or three most popular encryption algorithms are commonly implemented. The expertise to be able to accomplish it doesn't come cheap, but it's certainly in the realm for anyone willing to invest the time.

If anyone out there does it, feel free to post your findings to http://imfreedom.org/.

I'd be willing to bet that WhatsApp has some competent programmers, and looks very similar to how Apple's built iMessage. I think everyone is entitled to the most security possible, but unfortunately when you're at the scale of WhatsApp, perfect security would make all that ultra-tantalizing data pretty hard to analyze. They're a business, they have a responsibility to their investors to grow the business, and data right now is a _big_ business.
Check out http://adam.chlipala.net/cpdt/
And not only your information - that 21.5 million figure given for the clearance database is 1 in 15 people in the entire United States population.

What I'd like to know is how this information failed to warrant even the level of protection mandated for medical records - according to at least one major news source, the data wasn't even encrypted. The standard criteria in the US for "top secret" classification is described as material having the potential to cause "exceptionally grave damage" to the national security of the nation. A database of information pertaining to a process designed to collect all information potentially usable for coercion (blackmail, social ties, etc) of all the individuals in the most sensitive positions of the government, should have been classified and protected at the Top Secret level.

Frankly, the outrage I've seen so far is not nearly enough for the scale of the irresponsibility here. I firmly believe the director and CIO of the OPM should not only be removed from office, they should be subject to criminal charges for mishandling information that clearly _should_ have been classified.
"I really would like to just start/try with something, but I'm worried that could end up being a "death sentence" in the future where I find out I just wasted a few months learning something that doesn't work or help me succeed."

I'm assuming you're building a web app. Both Rails and Django work. There's plenty of evidence that they work, and that people can learn either of them as they build. Just toss a coin: heads->Rails, tails->Django.

If you chose Rails, start with 'Learn Ruby the Hard Way', and then progress to Hartl's Rails Tutorial.

If you chose Django, start with 'Learn Python the Hard Way', and then progress to the official Django Tutorial, and then to the book 'Two Scoops of Django'.

You don't need to worry that you're wasting time. It's the worrying itself that is wasting time. Just toss a coin and get started.

(Many of us have been where you are.)
I don't see why they'd be obsoleted. If I have infrastructure already setup on say, Azure, and Azure comes out with something like this, I'm going to use that instead of AWS, simply because it's familiar territory (not to mention LAN-level latencies between the gateway and my other API servers)
I actually have had one user take me seriously with that one. It's been a while, but I believe I also attributed her problem to the phase of the moon as well.
The spec is not the user manual, so it's okay ;)
Sometimes? It's been done for TrueCrypt https://madiba.encs.concordia.ca/~x_decarn/truecrypt-binarie...
A reference is a brief reminder and links to primary sources. We don't hate cars because they aren't boats.
Ansible works well for us, although we use it in a somewhat different way than most folks. We previously wrote about our approach here, if you're curious: https://nylas.com/blog/graduating-past-playbooks
> Well, I imagine there's a lot of commonality between the Dutch and American logistics software stack. I would hope that securing America's ports falls within the NSA's purview.

If the Dutch logistics companies were running unpatched versions of Windows (for example) that seems more like an operations failure than anything else. Not necessarily something that is a broken part of the "stack."
Why Product Thinking is the next big thing in UX Design
I remember being in an applied crypto class with you at CMU taught by Virgil Gligor if I am not mistaken and was thoroughly impressed with your knowledge of cryptosystems. I am happy for you! Way to go.
A well-met insult. The government is putting itself into a corner with their current policies on hiring criteria. If you have an idea on how to change that, I'd support you however I could. If it matters, I really admire your apology, not many people have the "balls/vagina/both/neither" to admit, at the very least, a mis-interpretation of a comment.
Using a native package gives so much more power - you define that the package relies on python, and maybe a mysql or postgres client, redis, whatever it needs, and then just install the one package, and let apt/dpkg handle the dependencies.

I'm a big fan of using the config-package-dev package from DebAthena to build config packages, which allow for about 99.9% of Debian server setup to be defined in Debian packages.
> Is thst possible, in general?

(Deterministic|reproducible) (compilation|builds) are a fairly recent endeavor; though they're not yet common they are technically feasible. The two efforts I'm aware of are Debian[1] and Chromium[2], though I'm not sure what state they're currently in. From their site, Chromium appears to include Android builds.

There may be Android-specific concerts w.r.t the JVM's JIT, but if you can't trust the onboard runtime, you've already lost IMO.

--

[1] https://wiki.debian.org/ReproducibleBuilds

[2] https://www.chromium.org/developers/testing/isolated-testing...
You're incorrect. I personally know two retirees who sell off stock regularly as part of their retirement income who do it by hand.
Coq: Certified Programming with Dependent Types
Fortunately, tax law has been made so complex that the Supreme Court eventually decided that ignorance is a defense: https://en.wikipedia.org/wiki/Cheek_v._United_States

So you may end up with penalties and interest, but you have a high probability of avoiding prison absent doing something stupid like trading emails with your broker on how you plan to evade taxes.
Exactly this.

If a company wants to use Docker that's their choice, but I don't think its at all reasonable to insist on or only support that environment as a software vendor. If it works on Debian, give me a .deb or even better an Apt Repo to use.
Browsing Stackoverflow for Interesting Crashes: Microsoft Internet Explorer 11
> (not wanting to upgrade a kernel) is terrible considering that they'll eventually be upgrading it anyways.

If they're running ubuntu 12.04 LTS they can keep the 3.2 kernel until late 2017. That's 2 more years. And they wrote "did not", so it was likely the situation months ago, not yesterday.

> (not wanting to learn and convert to a new infrastructure paradigm) is the most legitimate, but ultimately misguided

It depends on the amount of stuff they deploy. If they handle everything using Ansible (and from the list it looks like they do), then it's months of work to migrate to something else. They may need the right users / logging / secret management in the app itself, not outside of it.
If you read the rest of my comment you'd see that I already mentioned people like you exist. For as long as advertising has existed, the people doing it have understood that not 100% of people seeing it will "convert". Regardless of whether you want someone to click online or if it's a TV ad or whatever, the fact that most views of it are going to be wasted views is known and built into the expectations.

The point is there are lots of people who block adverts because of how obtrusive they often are online, but who if they didn't block them, would be of value to the advertisers. (Keep in mind value doesn't have to be a click, there's also brand awareness, (sub/)conscious retention of information about an advertised product, etc.) Maybe you're not one of those people.
Also (and IMO this one is a little more well-structured) the Software Foundations course[0]. Especially when supplemented by Pierce's excellent lectures, available on youtube.

[0]: http://www.cis.upenn.edu/~bcpierce/sf/current/index.html
I think it does support multiple versions of a package, as long as the package supports multiple versions of a package. The problem is if a package registers some global name, and another copy of the package also registers the same global name, that could cause an error.

The name conflict is a compiler error message, not anything to do with vendoring.

Having a package.json file is a separate issue, but there is a proposal for that here: https://groups.google.com/forum/#!msg/golang-dev/nMWoEAG55v8...

Having a file like that doesn't solve the vendoring issues though. This new vendoring scheme seems almost identical to NPM's node_modules.
A Garbage Collector for C and C++
Prior discussion: https://news.ycombinator.com/item?id=9856330
What are remote packages?
I like it. Would be cool to apply the concept to more ideas, like free speech, religious/atheist freedom, gun rights, economic freedom/protections.
This link should really be to the following

https://github.com/hackedteam/rcs-common/blob/38290d4eab2b2c...

Note that you can press "y" after clicking a line to expand the link. This just includes the commit hash so that if this file is modified in the future the link will still point to the same place.
Why do you think e-mail is broken? Could you elaborate please?
Stewaard: Turn Support into a Recurring Business
Depends on your environment, number of hosts, etc. really. You probably don't want to stick it into the same install script because:

- your app user doesn't need rights to modify the schema

- you need to handle concurrency of schema upgrades (what if two hosts upgrade at the same time?)

- if your migration fails it may leave you in the weird installation state and not restart the service

Ideal solution: deploy code which can cope with both pre-migration and post-migration schema -> upgrade schema -> deploy code with new features.
The mysterious "plugin" package does not yet exist, and won't be in the 1.5 release. I would encourage you to try to implement it and send in the changes. The ideas in the execution modes doc are being steadily filled in by people who need them.
Shame is an industry, the more shame the more click
For entertainment apps such as social networking, games and music, there are no specific goals to achieve, and more time spent the better. I don't know whether that applies to the app in this article, though.
> If they handle everything using Ansible (and from the list it looks like they do), then it's months of work to migrate to something else.

It's not. It would be months of work if they wanted to convert all their Ansible code to Docker, but that's by no means required.

Docker and Ansible can easily coexist peacefully.
..and they should have gone even further with javascript on mobile; web static pages and native apps for everything ( like it is even now ) - would be _absolutely_ fine
no javascript on restricted platform - world would be even better as it is there without flash

i am _mostly_ backend developer by trade, so I can imagine half of the internets would be broken without JS on mobile and I can imagine that some problems would not be overcome-able , but as it is now it's like plugging desktop platform there - exactly as flash was
Just glancing over this (super cool, John!), but what's going on here:

Notation "f <~ g" := (f ~> g) (at level 70).

Seems likely to cause confusion... what's the reasoning/explanation behind this? I might imagine a law such as Notation "f <~ g" := (g ~> f), but...?

It's been too long since I wrote some Coq! Gotta get back into it :)
Ask HN: Does anyone know how Asana is doing?
El Niño weather event is biggest since 1997, may trigger soaking winter storms
Google Glass is Alive
> curl “https://artifacts.nylas.net/sync-engine-3k48dls.deb” -o $temp ; dpkg -i $temp

It's really not hard to deploy a package repository. Either a "proper" one with a tool like `reprepro`, or a stripped one which is basically just .deb files in one directory. There's really no need for curl+dpkg. And a proper repository gives you dependency handling for free.
Napkin math but by the time you're spending enough on transaction fees to be pushing people into the >$10 per tx range to beat you, you'd be over $1m/day. I think at that point you're better off going with my "buy the miners" plan if destruction is your plan.
Let's not jump to conclusions. What is more likely? That this is generating test data for a forensics tool, or that this is planting child porn on a dissident's computer (with fixed file names and directories)?

I think it is rather cheeky (and dangerous) to accuse companies of doing such horrible stuff, when all we have is a few leaks (without context) to go on.

See for instance: https://github.com/hackedteam/rcs-common/blob/master/lib/rcs... which generates test keystrokes, test users and test programs for chat. The file names of the "planted" evidence is far too obvious, and they generate a hash for it. In short there is nothing in this code that implies this is used to plant evidence.
It's not a crime to create many small transactions...
While having Signal is great, one thing I don't like is the use of phone numbers as identifiers. Why can't we have the option of using a random string?
How are categories equivalent to group representations?
Well, modern wallets create new addresses for every transaction. So it's like having a new credit card number for every transaction in your analogy. It's pretty much anonymous.
So it's not "restricted to 100 mails per day". It's limited to 20,000 per day, and that's only until you sign up for support.
India's PSLV Mission Profile
On the other end, as a user, I greatly prefer desktop apps, because I don't "lose" them as much. It's easy to lose a chat tab between lots of browser windows+tabs. A single IM window is harder to lose.

And then there's the integration: both look&feel and functionality can make a huge difference.
even if an Android application would communicate with others 100% securely, Google has wireless administrator privileges and can be served secret letters that can order Google to do anything, so technically they could log the data before it's encrypted.
The problem with these tabs is that closing that window, the tab is gone forever (on both chromium and firefox).

It's also easy to lose track of which window they were in quite fast. A separate app is faster to find on almost any WM/OS.
When you run `go get` and import packages from a remote Git or Mercurial repository. At least that's what Go docs call it[1].

[1]: https://golang.org/doc/code.html#remote
Rather than such a blunt tool like fpm, if you're deploying only python, look to something like py2deb: https://github.com/paylogic/py2deb
That would help, but in the chunk of the thread I read, most of the debate was about what to do after that: specifically (a) avoiding the cost of starting up a new interpreter, especially module import work, and (b) possibly taking advantage of the shared address space to be able to share some immutable objects somehow, rather than copying.
I'd have noted the demographics altering mass slaughter of innocents first and foremost. The legacy is really mostly a brief interval of charred cities and libraries, and enormous mass graves. The whole empire unraveled pretty quickly after his death with petty squabbling. To take in the big picture and make special note of the fact that the Mongols happened to be a bit more egalitarian than many of the peoples they conquered is frankly a weird perspective.
Lola offers safer tampon subscription service
That's more or less how Tcl does it. They have had this support since ever. One coordinated by passing messages to the different Tcl interpreters, each running in their own thread.
Stash, in my opinion, is the best git tool out there. Sadly it's sometimes tough to convince people to switch when Github is 'good enough'. Anyway, keep up the good work!
V8 has an odd habit of not releasing memory back to the OS after mark-and-sweeps. It's a minor performance boost to let it roll up memory and it isn't uncommon for it to hog up as much memory until a heuristic (or an OS signal) tells it to knock it off.
I'm being a little poetic and talking a little limitedly about calculus. Obviously it's got big connections elsewhere, but my perspective on it has shifted a lot.
I'd say it surely depends on what the "app" is supposed to do. I like to run Firefox natively rather than as a web app. On the other hand I'll be thrilled when the local tax office convert their Windows/MacOS software to a web app so that I can use it on Linux.
A great talk by William Byrd
A Cartography of Chocolate
Do you even want to change it? It doesn't sound like it to me but you have no moral obligation to change the world or save it or start a business, be a leader, etc.

Being "great" is hard work, not all its cracked up to be and may not make you any happier than you are now and its not for everyone. Not to mention that "great" is a normative concept and who's standards are we talking here, yours or others? Do you want to be perceived as great in the eyes of others? Many people do and they "succeed" but it doesn't make them happy. At some level maybe you know that you are talented enough to be good but not talented enough to be great even if you applied yourself 100%. Perhaps you hold back for ego-protection and don't apply yourself lest you discover this fact.

You can see that your question is a bit complex and ultimately can only be answered by you. Nevertheless, I think I can help you in your quest by sharing an observation I've made about others. There are at least two types of fundamentally unhappy people as far as I can tell. The first type (I mentioned above in my first paragraph) are people who have no real self, no standards and just seek, in various ways, the approval of others. It is sad but I know many outwardly successful doctors, lawyers, business leaders, etc that are miserable because they thought being successful in the eyes others would make them happy.

The other unhappy class that I observe are people who ended up in jobs or situations that are significantly below their ability. These are talented people who never applied themselves, coasted through school and early life and then one day found themselves trapped by their poor decisions. They failed to apply their talent, to define who they are and what they would be and make an effort to achieve it. This is the auto mechanic who could have been an engineer or the grocery store clerk who could have been an electrician or a businessman or the plumber who could have been a writer, etc. It is a special kind of hell to be more talented than your job requires and many of these types resort to alcohol or weed to ease the pain.
(The unhappy doctors and lawyers do too but the requirements of their jobs tends to limit the extent of their drug use)

My advice is to find a career commensurate with your talents in a field that you enjoy and don't worry about what others think. These are the happiest types in my experience.
Spotify Connect security issue ignored by Spotify Support?
I've reported an ongoing issue multiple times to Spotify support regarding complete strangers showing up on my connect feed. Their only response was to use their sign out of all devices feature. Of course this only temporarily fixes the issue until Spotify screws up and shows the same people.

Anyone seeing this issue or know of a proper way to get support?

Thankfully there are lots of competitors in this space so I guess it's time to switch.
Thank you for http://www.youtube.com/watch?v=unZZCykRa5w. Your notion of 'bundling' was one of my top three most mulled ideas in the past five years. Once I started looking, I see it everywhere.
RebornDB: Next-Generation Distributed Key-Value Store
Multiple times a second, if your pool of hardware is "all the internet connected hardware in the world"! Neat experiment.

Also, FWIW that experiment will include people subject to bit errors in DRAM, not just in the CPU- and I would even guess that bit errors are more common in DRAM than SRAM given their electrical characteristics (a tiny floating capacitor vs. two inverters driving eachother)
If by "same side effects" you mean multiple versions of the same library causing issues, I don't think so. Using "go get" you will end up with only a single version of a library for a given path.
Wow, Python will become the new Perl, how cool is that?!

Not very.
Thank you for your apology. I see how I misunderstood.
Ha. Wait until you need to run a build of shared Perl codebase against unit tests in all of the dependent codebases... but some of those codebases compile and run C (or C++) programs... and some of those codebases depend on conflicting versions of GCC!

"If we hit the bullseye, the rest of the dominos will fall like a house of cards... checkmate!" -- Zap Brannigan

> forget coworkers that scribble droppings all over the filesystem, and assume certain services will never coexist

I think this tends to be less of a problem than the desire to have a build artifact that can be reliably deployed to multiple servers, rather than having the "build" process and "deploy" process hopelessly intertwined with each other.
Any feedback you have on SC4 would be much appreciated.
True hacker.
They can. But depending on how you used Ansible before, it may mean a heavy rewrite of your deployment strategy. I'm not saying it will always take that long. But depending on your app, the requirements may be very complex and not fit into the docker idea.

(it always means some extra work for security updates though - now you're updating both the host and images)
That's an issue as most webviews can ad a bit of js and support that feature. I'd email the dev a bug report.
How Esquire Engineered the Modern Bachelor
> All Python has to do is put all interpreter state into a single struct to allow for completely independent interpreter instances.

But that is not what threading means. If you want "completely independent interpreters" just fork. Threading means you share everything.

> Then the GIL can be discarded altogether

And then you start sharing variables between interpreters, and you gets lots of little baby GILs to contend with! How fun will that be? Not very.
Why would this outperform malloc for multi-threaded programs? Is that a property of GCd programs in general?

Edit: That is, is it typical for GCd programs to outperform manually-memory managed programs in multi-threaded environments?
Pluto image revealed by Nasa offers closest look yet at dwarf planet
I am not an absolute authority on this. But my decade of experience in the defense industry tells me "probably not".
Maybe I miss your meaning but on OS X/chrome: cmd-shift-T to reopen the last window with all tabs. Works even after a chrome restart. Saves me when 40 tabs open and I Cmd-Q for too long instead of Cmd-W.
The company is in that sense a "legal fiction," which seems to confuse people.

https://en.wikipedia.org/wiki/Legal_fiction
>But because of the way that Go interfaces are in essence duck typed, "things that fit that function" are also auto-generated, other than having to specify the interface that must be satisfied. To me, this seems like no more work than specifying the C++ concept. (Or am I still missing something?)

No, you have to write their code (concrete implementation for a new type) manually.

The only thing that's automatic is that the new implementation is "registered" as compatible with the interface without you having to explicitly declare it (e.g. not like Java that needs you to write "extends IFoo").