oakenshield

I heard various DARPA PMs including Mudge Zatko speak yesterday at DC; looks like DARPA has finally realized that organized government money hoggers aren't doing squat to actually advance the state of the art in cyber defense. I found their policy on funding even offensive research very refreshing.

I believe that follows from what he said above:

> zero global state -- Make your library threads-aware, but not thread-safe!

His point is that even if you have global state and try to protect that using locks, there may be code unknown to your application that works on the same global variables and you may not be able to predict the order of locking.

He specifically mentions the example of NSS (name service switch), which allows you to optionally create and plug in shared libraries that will be invoked without the application or the core C library being modified. So for example, an admin could change /etc/nsswitch.conf to set up LDAP user logins but your application could still use getpwnam(3) without caring about whether the pw retrieved is local, NIS, or LDAP.

Perfect. And the password will be shared over Google talk, I bet.

It's best done at Google or at your email client. Anything elsewhere (e.g., at a browser) will suffer the same fate as FireGPG. I don't see Google ever doing it for Gmail -- normal people don't care about encrypting their emails, and Google will not want to risk losing the ability to show context-sensitive ads.

Amazon recently announced their Virtual Private Clouds (http://aws.amazon.com/vpc/) for enterprises that will not keep a customer on multi-tenant infrastructure if they wish otherwise.

In any case, except for Google/Facebook-scale data and content providers, having your own datacenter for 25m users sounds premature. Many large enterprises use private clouds hosted and managed by service providers like IBM or Verizon; this makes sense when their core business is their service, not the infrastructure itself.

I fail to see the point of posts such as these. If you are using someone else's services and communicating without e2e encryption, you either do not care about being spied upon, or are willfully ignoring it. The problem isn't that G+ adds a small amount more detail on your life that you've already mostly surrendered to Google; it's that you (i.e., citizens and elected representatives) passed the Patriot Act, condone wiretapping, and are allowing corporations to mine your data in return for "free" services.

As an immigrant, I have little choice but to surrender much of this information anyway to stay "legal", but I don't think it's very different even for a citizen. Until most of the country is ready to act against the bigger invasions of privacy, staying away from Google+ citing "privacy reasons" sounds somewhat pointless.

Yet, it did not stop them from trying _really hard_, for example, with the Clipper chip and export restrictions on software that used crypto. Even now, foreigners who come to the US to work or study face extra scrutiny (whatever that means) if they work in crypto.

Here is a pretty nice (and informative) article based on the research behind the Dual N-back game.

http://www.scientificamerican.com/blog/post.cfm?id=you-can-i...

Knowing nothing more than what I've read in articles elsewhere, to someone who's not going to have a child immediately, these kits provide information that is of limited use. For example, they might tell you that you have a 10% higher chance of developing a type of cancer which has an incidence of 1 in 10 (10%). Implying you're now told that you have an 11% chance of getting the cancer than the general population. Mostly, this is just going to get you stressed and not "prepare" you to face the slightly-more-likely cancer.

I suppose this might be useful to figure out potential genetic defects, but as adults, wouldn't most defects have manifested already (I'm speculating here, correct me if I'm wrong).

Those are people's opinions and should be treated as such. Here's an article with some research behind it:

http://nymag.com/print/?/news/features/27840/

Apart from one valid point (low attention span), this article reeks of confirmation bias. Certainly, if you google "cell phones and brain tumor" and go to the FUD sites, you will get enough fodder to peddle that viewpoint. Here's a reliable source:

http://www.cancer.gov/cancertopics/factsheet/Risk/cellphones

Who says you have to truncate? Split it into four 4 byte chunks and xor them.

It's an abuse of the standard (c90 and c99). main is supposed to return int and take either no arg or two args, but I think a lot of legacy code violates this, so most compilers let you off with a warning. That said, "-Wall -Werror" are two useful things to always add to your gcc invokation.

IMO, Android isn't generally applicable. The reason Android works is because you have a (fairly) limited set of devices with more or less the same hardware and capabilities (e.g., touchscreen, GPS, radios, gyroscope etc.) So application writers have a fixed number of events they need to access, and a VM + software stack would be able to provide that while making development and security relatively easier.

Real operating systems have to run on a myriad of hardware and potentially interface with tons of devices and protocols, so you would need to allow programmers to go to the hardware level and read and write bytes by hand.

They speak about bunch of (seemingly) toy OSes but do not mention Plan 9? It's a well-designed OS that takes the UNIX "everything is a file" abstraction to its logical conclusion. http://en.wikipedia.org/wiki/Plan_9_from_Bell_Labs

Very interesting; thanks. I had only taken a cursory look at the KDD cup page.

I didn't know the dataset was crippled, because I doubt the netflix attack would work with music.. there's no IMDB for music that acts as an independent dataset. Unless they intersect the set with last.fm, of course :)

But then he mentioned the SUNDR system which addresses storing data on untrusted (not unreliable) servers, which confused me.

> I also think you miss the point of academic papers. The goal is not to build a product, but rather to understand algorithms.

I actually don't, being a researcher myself (not in ML, but in a field that uses a lot of it). I'm just saying that real-world datasets in the industry are nothing like the toy datasets that a lot of papers from universities are written with... there's a lot more noise, and you'd never be able to get a good classification (for example) using just one coherent set of techniques.

On the other hand, KDD/WWW/ICML and other data mining conferences are increasingly dominated by industry folks now, so my experience may not be as common anymore.

Yes, I worked on quite a few boosting / bagging / random forests classifiers. The key thing I learned, though, was that it wasn't possible to take the _entire_ dataset for some problem, throw even an ensemble method at it, and expect high detection and low FP rates. As you noted, one has to filter and prune using domain knowledge or hand-verified heuristics before you'd see decent performance.

I don't quite understand what you're trying to get at. Are you saying that cloud providers should provide you some sort of insured access to data in case something catastrophic happens, or are you saying that you should be able to store encrypted data in the cloud so the cloud provider or another authority cannot read it?

As for the former problem, cloud storage providers such as Amazon S3 already provide more redundancy for your data than you could possibly design cost-effectively on your own (in fact, they even offer a _reduced_ redundancy service if you don't want to pay for the S3 redundancy).

The latter "problem" isn't really a problem --- it's entirely up to you to encrypt the data you want to store in the cloud and keep the key to yourself, and you can easily have an encrypted frontend to your S3 block storage or even your Dropbox folder. I don't see the relevance of something like SUNDR... IIRC, it is a way to merely store your data on an untrusted service. However, most business use the cloud for computation (which of course requires storage). So SUNDR won't apply when you have to trust both computation and storage to an untrusted entity?

You could of course run a distribution on your compute node VM that encrypts data going out of the VM to the cloud provider infrastructure, but the benefit is limited because your applications are finally running on the provider's hardware. I suppose we need to wait until that homomorphic encryption stuff becomes real :)

> I get pitched regularly by startups doing “generic machine learning” which is, in all honesty, a pretty ridiculous idea.

Learned this the hard way. As an academic who used to think you could solve a problem (e.g., spam filtering) using a single model --- something we routinely do in academic papers --- I had to wait until I went to an industry internship to realize how "ugly" a real spam filtering algorithm has to be. Large mail providers see so many diverse patterns of spam that they need a complicated mix of ML models, datasets, labels, and sometimes even plain old blacklists to keep their spam under control.

The things I think Last.fm has going for them:

* Charts (of course)

* Recommendations: I use last.fm for two kinds of recommendations: (1) where it uses listener history to figure out similar bands and albums, which in some ways is inferior to feature-based recommender systems like Pandora, and (2) where it uses neighbor listening history (e.g., neighbor radio) -- I can't count the number of times I've been introduced to awesome bands in genres I wasn't looking for just because a neighbor had it on their charts.

* Shoutboxes for each artist, album, and song: I can't count the number of times I've just instantly "loved" a song and needed someplace to shout something out with others who like the song.

Last.fm has a huge user base and should try to be a one-stop shop for music, like Netflix is for video. Here're some tips

* Revamp your business model: copy Grooveshark's business model if you have to, but get anyone who wants to listen to a song come to your site and not go to Youtube for a low-quality version.

* Increase avg. time on site: If you implement the suggestion above (where I can play any song I like), then you have a wealth of _real_ related song/album/artist to offer the user. You may be able to remove annoying audio ads and just rely on click ads. It also helps if you implement a site-wide list like youtube's playlist.

* Improve recommendations: Netflix had a decent algorithm, but conducting the Netflix prize got them a lot of publicity _and_ a much better algorithm. You could do the same with the ton of data that you have. Yahoo! is already ahead of you in this: see this year's KDD cup: http://www.kdd.org/kdd2011/kddcup.shtml

I disagree about middle-click being a "poor" method. Middle-clicking is essential to mouse-based browsing these days, both for opening links in a new tab and for closing tabs. With middle-click, the whole issue of close button placement becomes moot.

Any laptop that doesn't have a separate middle-click button (hint: made by a fruit company laptops) likely provides some multi-touch method for middle-clicking. I also haven't come across a mouse in quite some time that does not have a middle-click (I use a including an 8 year old microsoft mouse).

Care to enlighten us the exact APIs you consider archaic? "Unix/C APIs" isn't exactly precise --- there are the POSIX APIs which are fairly standard that Linux and the BSDs mostly support; in addition, there are the platform-specific APIs that are constantly updated for modern use-cases. I find most of these APIs intuitive and stable.

In contrast, I don't like some of Python's abstractions, the "subprocess" being (IMO) a particularly weird way to abstract a pipe.

Productivity tip: do not put on the "Rumble of Wheels" track and start watching one of those 30 minute videos.

With nearly every country that Assange has ties with being pressured by the US and other mighty powers affected by Wikileaks, do you think the real truth would come out? Justice departments and public prosecutors are run by the state, after all. If they can find two women to accuse Assange for rape, can they not find a jury to convict him?

This case would appeared a little less staged if the alleged rape had occurred in Assange's past. Isn't it the least bit suspicious that the alleged rape occurred soon after the Collateral Damage video leak? Assange doesn't strike me as an idiot... do you really think he would go about raping someone when he expects trouble?

Whatever event actually occurred, the fact remains that governments are making fools of themselves by trying to suppress Wikileaks through these heavy-handed measures to arrest Assange. In that regard alone, I support him.

I hope they get inundated by "information" about this criminal. Here, look, he gave an interview to Forbes just yesterday.

http://blogs.forbes.com/andygreenberg/2010/11/29/an-intervie...

They do great work in many areas, but the best ones (IMHO, as a systems guy) are the systems papers. In non-systems areas, folks from universities could conceivably do the same research, but for OS/Distributed systems, Google research is the state-of-the-art. There's no point even trying to find fault with their evaluations, because papers are usually submitted well after the system is deployed and operational within Google.

Three recent papers at this year's Operating Systems Design and Implementation: http://googleresearch.blogspot.com/2010/10/google-at-usenix-...

Their programming languages will be frighteningly similar to Javascript: http://www.flickr.com/photos/mendhak/2643251456/

I remember back in a Paradigms of Programming class in uni, our professor who lived by Dijkstra's "Gotos considered harmful" mantra tried to get us all to write programs with a single exit point from each function. I argued that short-circuiting errors before going to the logic made sense both nesting-wise and maintainability-wise, but was ridiculed. I wish I'd known about coding styles in the Linux/BSD kernels back then so I could throw it back at him.