eliteraspberrie

For context, Ontario has no natural resources. We have always been an export economy. With globalization and automation, manufacturing is mostly gone, and it's creating social problems. We have a fundamentally different view of the role of government here, we believe government should promote quality of life and happiness. Yes it is socialism and we don't apologize.

Xen is worse than Linux in terms of quality, and therefore security. That Linux is much bigger doesn't make Xen any better.

What de Raadt means to say is, generally speaking, you can't build security on top of bad code. No amount of patching, sandboxing, or whatever will help. Security comes from quality and Xen (like Linux) is very lacking in quality.

Beautiful! So the dot pattern here is "face centered cubic," right? Would you get a better density with a "hexagonal close-packed" pattern? It may make a difference visually. I would love to see a comparison.

https://en.wikipedia.org/wiki/Close-packing_of_equal_spheres (We memorized this stuff in chemistry class and I never saw it again so I may be completely wrong.)

This is such a self-inflicted problem.

Europe could decide to open their borders, and they would be fine. The US deals with much larger migrations every year. Or they could decide to close the borders, and they would be fine too.

Instead they do some schizophrenic dance in between. Some borders open, some closed. Broadcast to the world that people are welcome, and greet them with fences...

Decide and do. Stop talking about how it makes you feel.

This is how we got sound to play on the TI graphing calculators. It sounded bad and drained the batteries but it was fun. Another fun thing was getting grayscale graphics on those screens. They had only black and white pixels but flipping them on and off at different frequencies made them gray.

Here's an example in a getline implementation: https://github.com/eliteraspberries/ttyprompt/blob/master/ge...

        /*@ loop invariant i;
            loop invariant j >= 0;
            loop assigns j, eol;
         */
        for (j = 0; j < (size_t) i; j++) {
            if (read_buffer[j] == '\n') {
                eol = 1;
                j++;
                break;
            }
        }

Loop invariants are part of the ACSL specification language, and they can be verified automatically with Frama-C. http://frama-c.com/acsl.html

That's an important difference. Christians believe good is from God and evil is from Satan. (Forgive me if I'm mistaken, I know that's a gross oversimplification.) Muslims believe good and evil are both creations of God. So most things have both good and evil in them, including alcohol:

They ask you about wine and gambling. Say, "In them is great sin and [yet, some] benefit for people. But their sin is greater than their benefit."

-- 2:219 http://quran.com/2/219

Keep in mind that the Quran was revealed piece by piece over two decades. The later parts add to the earlier parts. That can be a source of ambiguity to Western readers (not to mention that the chapters are not in chronological order), which is why it's important to understand it as a whole rather than its individual verses or chapters.

Venture capitalists are interested in a particular kind of person who can provide them with a quick profit: young people who are naive enough to prioritize business over their own life. If you are willing to spend a few years sleeping under a desk, drinking Soylent, then you are a good candidate for venture capital. If you have your head on your shoulders, you probably want to start a lifestyle business, and that is no good for venture capital.

People here defend VC because they think they too will get rich quick, but they won't, and in the meantime they will be very stressed and nasty on the Internet. Welcome to HN.

Thank goodness. Knowing NSA spies on Iranian drones, my civil liberties have been restored.

The bug is in the compiler, not OpenSSH. The OpenSSH developers explicitly erased memory with memset. GCC decided to remove those lines without any warning. There's the bug. (Here come the language lawyers...)

What's the difference between GCC deleting parts of your code, and an attacker hacking into the source code repository and deleting those parts of the code?

The C standards committee addressed the problem in 2009 with memset_s. [0] The GNU developers reject patches and state they hope this feature is never implemented. [1]

The bug fix is to stop using GCC for sensitive code. Use CompCert instead. https://github.com/AbsInt/CompCert

[0] http://www.open-std.org/jtc1/sc22/wg14/www/docs/n1381.pdf

[1] https://sourceware.org/ml/libc-alpha/2014-12/threads.html#00...

It uses the PyCrypto package to generate random numbers. The Random class is a Fortuna generator seeded with 8 bytes from the system RNG, the PID, and time: https://github.com/dlitz/pycrypto/blob/master/lib/Crypto/Ran...

I doubt eight bytes is enough for cryptography...

If you need random bytes in Python, use os.urandom:

    secret = os.urandom(32)

https://docs.python.org/2/library/os.html#os.urandom

I don't think they valued Tor specifically. They did value scientific research, which is what Tor was at the time. Like most research work, it got dropped once they had a working proof of concept. The State Department picked it up years later.

Keep an eye on this graph to see when it goes online: https://metrics.torproject.org/userstats-relay-country.html?...

Canadian companies doing business with foreign governments get help from the Canadian Commercial Corporation and probably consular personnel too. The Canadian government is very much involved.

I use Frama-C without the GUI. The annotations do take some effort, but once you get it, it's very intuitive. Start with adding assertions, for example checking that array indices don't go out of bound. Then start with simple function specifications, and improve on them over time.

I wouldn't use it everywhere, but in small, important functions, it's well worth it.

Here's the classic example of reading into a buffer: https://github.com/eliteraspberries/ttyprompt/blob/master/ge... From those few annotations, Frama-C is able to determine that there are no buffer overflows there.

I don't like the typical definition-theorem-proof approach of most textbook in mathematics, including these. It's great for a classroom, no good for self-study. As an alternative, I highly recommend A Book of Abstract Algebra by Pinter. If you work through that first, you may actually enjoy these two later.

It can play NerdWars: http://www.ticalc.org/archives/files/fileinfo/220/22036.html

In Canada too. In Ontario, any death involving police automatically triggers an investigation by a police of police (Special Investigations Unit). Really shocking cases can lead to a public inquiry in parliament.

He said on Twitter that police beat him up once, and then a second time after following him home. I hope there is a real investigation, this is enraging.

Matrices and Linear Transformations by Cullen (Dover Books on Mathematics) will answer all your questions and more. It's written in plain English, doesn't require a mathematical background, and you really only need the first three chapters.

I don't think it was Anonymous. During the operation against ISIS on social media, Anonymous tried to DOS one of the ISIS propaganda websites (Isdarat). They couldn't muster more than a few Mbps.

This attack on Turkey is an example of Russian "active measures."

Edit: By the way, the entire tr TLD is managed by a single DNS server at METU. That was the target of the attack.

Yaks and camels too, depending on the environment.

It exists. It's called CompCert.

https://github.com/AbsInt/CompCert

It's free for non-commercial use. I've used it for several months now to build things like Tor. I haven't noticed any disadvantage compared to GCC or Clang.

I'm the average Javascript programmer. I'm writing some web app and I need to do some cryptography. Let's see, there's Math.random and Crypto.getRandomValues. Let's go with Math.random, for shiggles. I'm probably copy-pasting from Stack Overflow.

Will renaming a function or two fix my bad behaviour?

The answer to "Should I use Math.random or X" is neither! I should be using a cryptography library like SJCL or tweetnacl-js:

http://bitwiseshiftleft.github.io/sjcl/

http://dchest.github.io/tweetnacl-js/

Not just Johnny, I've been using GPG for a decade and I have to rummage through the 2000 line manual page almost every time.

It's a good question. But I think the contents of their users' communications are less important for their revenues than the metadata.

WhatsApp encryption is broken.

WhatsApp can just turn off encryption when they want, without users knowing:

http://heise.de/-2630361

That's probably what happened in June:

"Investigators said earlier they had detained 16 people in the anti-terror raids after working with U.S. authorities to monitor suspects' communications on WhatsApp Inc.'s messaging service."

http://www.bloomberg.com/news/articles/2015-06-08/belgium-ar...

Do you mean something like "compound assignment operators"? Apparently you can define custom operators like:

    func += (inout left: Vector2D, right: Vector2D) {
        left = left + right
    }

https://developer.apple.com/library/ios/documentation/Swift/...

Does the Paddle checkout use Stripe?

Even if I don't use Waterfox, I'm glad it exists. Browsers are very close to including DRM content and advertisements. When that happens I don't want to be stuck without an alternative. Thank you (if the developer is reading) for the effort and I hope you continue with this.