_cbsz

> What I meant, however, is that the problem has been solved in practice. When you ask Google how to drive from SF to NY, it'll give pretty good answer in milliseconds. Is it an optimal answer? It might be, it might be not, but it's a very good answer. Getting slightly better answer is not worth the computational time because it won't make a difference in practice in your trip.

That's not the traveling salesman problem, it's the shortest path problem, for which polynomial-time algorithms are well-known and taught to first-year computer-science students. (To be fair, driving directions do require coming up with good edge weights on the graph composed of the American highway system, but once you've got weights, you can run Dijkstra's algorithm and you're done. That's probably not how GMaps driving directions work, but the point is that driving directions are not TSP.)

Had you checked the first google result for United States debt, you would have found where the confusion is coming from: the national debt is 14.5 trillion, and the total debt is 54 trillion (Source: http://www.usdebtclock.org/). I'm guessing "total debt" according to the debt clock includes things like state governments and private citizens, although Wikipedia claims that the 14.5 trillion figure is total debt (http://en.wikipedia.org/wiki/United_States_public_debt).

Or every Python object's backing dictionary needs to use the special threadsafe implementation.

> if i put a computer on the defcon wifi, it'll probably be say, modern linux (ubuntu, debian, or redhat) running either a minimal subset of services (ssh) or perhaps nothing, with firewall policy applied, or a modern windows (windows7) with the firewall on. i'll be using a modern, fully patched web browser, also perhaps with some additional mitigation technology (thought nothing out of the ordinary) think perhaps noscript and EMET.

The first time I went to DEFCON, I got to hear Roger Dingledine complain about how Ubuntu had been shipping a version of Tor with a known remote root vulnerability for months. Modern Linux distribution != magical instant application of all patches.

That struck me as odd too -- is this a normal use case for airbnb?

They called it a battery firmware update, but they meant the pages of settings you can change in flash. I was able to dump raw memory from the chip, but I could never figure out which generic microcontroller the battery controller had been built on top of (at least I assumed it had been built that way), so running code was a nonstarter.

Can't seem to jump while holding down the run key, which is usually my method of playing mario...

I was actually working on this exact problem in grad school, but gave up when we couldn't start fires (and so did Barnaby Jack, according to Forbes -- http://blogs.forbes.com/andygreenberg/2011/07/22/apple-lapto...). What put the nail in the coffin for us was finally discovering the PTC devices on the individual cells -- they make a rather loud click and shut off if you short the cell. We also found evidence of them on cylindrical cells pulled from a PC battery.

It's not limited to Macs, but Apple's the only company I could find that released battery firmware updates. Other machines do seem to use the bq20z80, but it was easiest by far to play with battery firmware on Macs (i.e. I never got anything working on any other kind of machine).

A semi-plausible fraud threat is that you can buy old batteries off ebay that have disabled themselves in hardware due to undervoltage, re-enable them, recharge them, and resell them as "like new." They'll work for a few days and then bulge.

(I am one of the authors on the Telex paper.)

> * The participating entry-nodes (proxies?) could be systematically determined with a scanner for future blacklisting or investigation by someone trying to stop this circumvention of censorship.

The "entry nodes" are positioned at ISPs outside the censoring country. By assumption, they are on-path from the censor's network to popular Internet destinations that the censor has left untouched.

> * You have to trust the people running the entry nodes, if they have the key to decrypt your traffic. This sounds like a design that governments can use for monitoring.

This came up in our discussions pre-release, and we think it's an interesting feature of Telex. You're effectively able to select which government's Internet policy you'd like to live under.

There was malicious firmware for Apple keyboards back in 2009 -- http://www.blackhat.com/presentations/bh-usa-09/CHEN/BHUSA09...

There's a practical (for some value of practical) defense against this attack: "Countering Trusting Trust through Diverse Double Compiling." It's fairly clever. http://arxiv.org/pdf/1004.5548

If I recall correctly, here it is in short: 1) Invent a new virtual machine ISA. 2) Write a trusted compiler that targets that ISA. It is totally OK if this compiler is crap as long as it is correct. 3) Build the original compiler with the new compiler. The result is a cross compiler, running on your new VM-ISA and targeting your host architecture (e.g., x86). 4) Build the original compiler again with the output of step 3. The result is an x86-hosted compiler targeting x86. The abstract seems to imply the last step: 5) Diff the output of step 4 with the untrusted compiler.

The author, David A. Wheeler, apparently expanded on this paper for his 2009 dissertation: http://www.dwheeler.com/trusting-trust/

I don't think that "mind control" is the most PR-friendly term for the tech in question.

It breaks anonymity. Transactions are public and that static address is public, so anyone can tell how much money that static bitcoin address has received.

node.js isn't interpreted; it uses V8, which is a JIT.

You create a new bitcoin address for every transaction. Some money goes to the actual recipient, and the "change" goes back to your new address. In addition, you can attempt to "launder" bitcoins by executing bogus transactions from yourself to yourself.

Posting a static bitcoin address on your website and saying "send money here" is not considered best practice.

Looks like I was wrong about the redundant loads. They should probably go away (and indeed you say they do if you put BINARY_OP in its own function).

What if you made BINARY_OP a __forceinline (http://msdn.microsoft.com/en-us/library/z8y1yy88.aspx) function instead of a macro?

Things that the function contains that might disable optimization: a lot of gotos, inline assembly in GO_NEXT (this does affect optimization: http://msdn.microsoft.com/en-us/library/5hd5ywk0.aspx)...

It's also not immediately obvious to me that pCurEvalStack is initialized.

Having a look at the architecture optimization manual re: the redundant loads; it's not immediately obvious to me that modern processors won't handle this fine (http://www.intel.com/Assets/PDF/manual/248966.pdf).

  def f(b):
    b[0] = 'Goodbye'
  a = ['Hello', 'world']
  f(a)

It's more efficient to pass function arguments by reference, and it would be fairly baffling if function argument passing did not work like assignment (c.f. C++ copy construction being similar to, but slightly distinct from, assignment).

Less philosophically, everything in Python has pass-by-reference semantics, even ints. The things you might think are passed by value are immutable, so it doesn't really matter whether they are passed by value or by reference. For example:

  a = 1
  a = a + 1

conceptually creates a new integer object and binds the name a to it, and so does

  a = 1
  a += 1

, because ints and longs are immutable in Python.

It was actually (according to the EFF) 1) just last year, 2) the Copyright Office, 3) jailbreaking specifically for the purpose of interoperability with lawfully obtained software or for connecting to different providers with the authorization of said providers, 4) specifically w.r.t. the DMCA rulemaking process. https://www.eff.org/press/archives/2010/07/26

Overcommit seems to have changed somewhat since the "early days," as it's now heuristic. I ran into this once when I couldn't malloc 8 GB on a 64-bit machine because RAM + swap was less than 8 GB. http://www.mjmwired.net/kernel/Documentation/vm/overcommit-a...

The Hex-Rays decompiler is very good, and I've used it for reversing several times. In particular, it was extremely useful for our analysis of the Green Dam censorware system (http://www.cse.umich.edu/~jhalderm/pub/gd/).

Well, Dug Song of Duo Security points out that you can't use Google Authenticator and public key authentication in conjunction with each other over SSH at the bottom of this howto: http://www.mnxsolutions.com/security/two-factor-ssh-with-goo...

Google's doing it too: http://code.google.com/p/google-authenticator/

Howto: http://www.mnxsolutions.com/security/two-factor-ssh-with-goo...

EDIT: per my post in a sibling thread, Dug Song points out in the comments at the Howto that Google Authenticator can't be used as a second factor alongside SSH public key authentication.

I'm a little surprised that no one has mentioned webfsd (http://linux.bytesex.org/misc/webfs.html), which I use to solve this problem (specifically, as webfs -r .).

Caveats:

- I'm sure showoff is better if you're firewalled.

- It's probably slightly easier to share just one file in a directory with showoff, but this could be remedied with a script that made a temporary webfs root and symlinked the shared files thither.

pg: "Notice: Experimenting with HN"

http://news.ycombinator.com/item?id=2434333

> The word "justice" is never used in law school.

What about when referring to judges?

I looked at the list of platforms, and I did not want Greplin to have access to any of them. For example, GMail already has search, Facebook has confidential personal stuff, and Dropbox has confidential work stuff.

I just can't trust a service like this with the data they want to search. Google and Facebook are already weak points for privacy; giving one company access to both is a complete nightmare for me. I could do it in theory, but not without an extremely compelling use case.

For the sake of completeness, cos is the x value, because of the identity sin(x)^2 + cos(x)^2 = 1. You should find a good unit circle trigonometry picture if your class isn't giving it to you.

Wikipedia's picture is frightening (http://en.wikipedia.org/wiki/Unit_circle), but perhaps http://www.themathpage.com/atrig/unit-circle.htm or http://www.snow.edu/jonathanb/Courses/Math1060/unit_circ_tri... will help.

Could you make an argument for bothering to fund 401k + IRA/Roth at 20-something? If I'm trying to get fuck-you money by 40, don't I need every dime in order to get there? My nest egg is in plain old savings right now because I view it as personal runway.