randombit

> Also he is a public figure and a CEO you cannot expect the CEO to start ranting on random crap which could potentially poorly reflect on his company.

Ie, don't say anything on Facebook, ever, that you wouldn't mind your bosses, clients, competitors, suppliers, mom, local newspaper or local law enforcement all knowing about. Probably a good rule to follow for all of us.

Certainly not restricted entirely to sciences - my Mom got her BS around 1969; when she applied to law school, the secretary actually threw out her application because "Honey, if you want to meet lawyers [ie, to marry], just hang out in the law library, you don't actually have to go to the school." (She ended up getting an MLS instead, and loves being a librarian, so at least there's a happy ending to it)

> When I say large, I mean about 6 gigs or so. Because your company's source tree is probably that large.

GCC's SVN repo is north of 17 gigs (ref - http://gcc.gnu.org/rsync.html) and yet neither svn nor git nor hg (when imported into them) seemed to have managed to blow up on it yet.

Scalable means different things to different people, I expect. Size of the repo is one, but the number of highly distributed users is another and for many projects is much more relevant and one better served by git or hg or darcs. And a license fee of $740 per person per year is another form of non-scalability, again depending on the context.

What I am finding really absurd about this whole thing is, the photocopier companies knew about this (obviously), and a number actually had services/software available to wipe the drives - but failed utterly in actually telling anyone who might care about them.

My gf works at a hospital and there are many panties in a twist about this right now. She contacted one of their major photocopier providers and asked about what happened to the ones they had on lease that were returned in the last few years. "Oh, they were sold, or scrapped, or given away... couldn't really tell you for certain though." So the obvious question: "Did you wipe the drives first?" "A: No, that wasn't included in our contract with you." - because nobody knew about this 'feature' when the contracts were written!

Massive fail both security wise and from the sales side on missing easy upselling. Very likely any hospital or police dept would gladly have paid for these services had they know it was necessary.

Recently some cities and certain addresses have been actually moving, as well. There were a couple of months where it decided my house was actually about 5 miles from where it is, which made giving directions more complicated. (I had to specifically tell workmen and visitors to make sure they used Yahoo Maps or some other map source to avoid misdirections).

More amusing, for the last couple of weeks Google Maps has placed Randolph Vt right in the middle of Lake Champlain.

"At the MIT Media Lab in April 2008..."

Specifically, on April 1st.

I don't use Buzz, so the problems mentioned in the article aren't an issue for me, but I was getting frustrated with Google Reader for plain usability reasons, and also have unrelated privacy concerns with it, in the sense that at some point I assume Google is going to start doing user tracking to see what you read, how long you look at particular items, and so forth (not for any malicious reason but purely because they can probably somehow make money from it (ala http://www.newsweek.com/id/233773)).

I tried a bunch of different RSS readers for Linux and disliked all of them, so I ended up writing a RSS to email script that pulls down my feeds and sends me mail for new entries. I actually find this much more usable than Reader or any standalone reader - mutt (or sup if you prefer) is already is built for handling lots of information, and especially handy for sites like hacker news where I can just scan titles in the index and delete-delete-delete and pull up the occasional interesting story. Also reduces random 'wonder if anything good is new on reddit/hn' polling, so I'm finding it to be a big productivity win.

My script is at http://www.randombit.net/code/grab_rss/

And there is of course also rss2email which is basically the same thing - http://www.allthingsrss.com/rss2email/

The term "open source intelligence" predates open source (software) as a name, or even as a concept.

It's worth considering that industrial index he cites includes some things that most people might not consider manufacturing per-se, including construction, mining, and utilities. According to http://www.federalreserve.gov/releases/g17/Current/default.h... the only sectors in the index that have seen growth over 2% compared to 2002 levels are utilities (electric and gas) and business equipment (which seems to consist of "industrial and other", "transit", and "information processing"). Unfortunately there is no breakdown among them.

It was pulled even before the FBI request. The original pull text said something along the lines of "This page has been removed in light of the events in Texas earlier today". Later it was changed to mention the FBI request and gave the link to the smoking gun mirror.

This is why when asked I just tell people I'm a hobo. Usually shuts down any followup questions.

So your objection here actually has nothing to do with HMAC at all, but with doing password hashing without iterations?

PBKDF2 uses HMAC. What's the issue here? A PRF seems the right tool for this particular problem, and HMAC happens to be a PRF that has well understood properties.

Learning new languages makes you a better programmer. It really has very little to do with C or Lisp specifically.

The more different the language you are learning is from ones you have used in the past, the more new approaches you learn. For instance if you already know C++, you'll learn a lot less from learning Java than you would if you learned Lisp (or ML, or Haskell, or Smalltalk) - purely because the delta is much larger. Similarly, if you already knew Ruby you'd probably learn fewer new techniques learning Smalltalk than Haskell, and if you already grok Scheme you'll learn very little from Common Lisp.

If you are a C hacker, and especially if C is your first and primary language, Lisp just happens to be on the far other side of the wheel of languages, so you'll learn a heck of a lot from it. I would wager that learning C would make a Lisp hacker better at Lisp, too, though I don't know anyone for whom Lisp was a first language.

Actually, more likely it's a few hundred different automated trading systems all playing off each other. If you're managing a pension fund, volatility is the last thing you're after.

This made me think of a quote which turns out to be from a Clay Shirky essay (http://www.shirky.com/writings/riaa_encryption.html)

"It may be time to dust off that old issue of Wired, because the RIAA is succeeding where 10 years of hectoring by the Cypherpunks failed. [...] Note that the broadening adoption of encryption is not because users have become libertarians, but because they have become criminals; to a first approximation, every PC owner under the age of 35 is now a felon."

If you are interested in secure backups you may want to take a look at the Tahoe Least Authority File System (http://allmydata.org/trac/tahoe), which has a much more useful security model than tarsnaps (for instance, you can share read-only access rights to a particular file with someone else). Tahoe is also entirely open source and the design is well documented, which in my view is two points up for Tahoe.

Does anyone know what exactly Apple did that infringed this patent? Looking at it (to the extent I can parse patent-speak) it appears to be on an optimization in PCI DMA transfers. Does Apple actually make their own PCI controllers? I would think this would be something they would source from chipset manufacturers like Intel, and if so, how could OPTi successfully sue Apple for it? I checked several other articles about the judgement but none had any details on this part of the case.

Probably so. However on Wall Street in general (especially in areas investment banking portfolio management, high frequency trading, etc) programmer salaries in the 100-150k range is the norm. Part of that is simply NYC cost of living, of course, but 60k is really seriously low, even for an entry level gig.

I do sometimes use psuedocode, especially to either work out for myself a complicated algorithm or help provide additional documentation for readers. However one key difference is instead of unstructured natural language, I use Python or Scheme - this is beneficial for me, because it forces me to concretely express what I am trying to do, instead of hand waving, and for a future reader, who will probably have an easier time unambiguously parsing a real language instead of random half-sentences. And it is often succinct - it is amazing and amusing how often (the gist of) hundreds of lines of optimized C/C++ can be expressed in a line or three of Python.

I'm pretty sure the algorithm has not been wholly (publicly) specified yet. Much of the hash tree structure is, as are parts of the compression function, but not the whole thing. Probably it will not be fully described until later this fall, closer to the NIST deadline.

I'm learning Scala as a first JVM language, and it is definitely great to be able to access so many Java libraries so seamlessly (Mina, Apache commons, Hadoop, ...), all the Scala syntax/type inference goodness just works and in some cases make the libraries significantly nicer to use in Scala than in Java (IMO).

The food is actually really good too (at least, assuming you like sauerkraut, venison, sausage, and/or quail)

MacOS X is cited as an example of minimalist software design? It may be many things, but I'm not buying minimalist.

I'm not sure about the derivatives market part, but remember that (in the US, at least) most student loans are administered by the federal government, and are 'guaranteed' by them. That means if you don't pay up, the government will fuck with you in all the various ways a government can (confiscation of tax refunds, wage garnishment, etc - and don't forget student loans are not covered by bankruptcy). That is why my loan interest is less than 2% over the fed funds rate - it's worth it to loan money at that rate, because there is effectively no way to avoid having to pay up, short of dying.

The idea presented in this article that /dev/urandom output is predictable is completely wrong. It is simply not secure from an information theoretic perspective: if an attacker had some amount of previous /dev/urandom data, and no new entropy was introduced into the pool, they could derive future output. However it is still cryptographically strong/computationally strong: actually doing this seems to require knowing how to invert SHA-1, which is apparently a difficult problem (I believe the best anyone has done is to invert 2 of the 3 rounds of MD4, which is a much weaker hash).

For much the same reason, RSA is not information-theoretically secure (if you have the public key, you have all the information you need to get the private key: you 'just' factor the modulus). That does not mean it is insecure, it just means you must make sure that the computational effort required is greater than the expected maximum computational effort anyone might expend (or, preferably, the maximum computational effort that might be feasible within your security lifetime).

A capabilities system in Scheme was done in the 90s, though AFAIK it is now dead. Still the paper describing it is worth reading and may give you some inspiration: http://fare.tunes.org/tmp/emergent/secureos.htm

FTA: "Wait," a third one questioned, "did you do an UPDATE before the COMMIT?"

"Did I what?" the second developer replied. "Oh. Crap."

Thats the real WTF here. Die CVS, die.

$ host paulgraham.com paulgraham.com has address 68.142.205.137 paulgraham.com has address 216.252.126.190 paulgraham.com mail is handled by 10 milter1.store.vip.mud.yahoo.com. paulgraham.com mail is handled by 10 milter1.store.vip.sp1.yahoo.com.

$ host 68.142.205.137 137.205.142.68.in-addr.arpa domain name pointer html1.store.vip.mud.yahoo.com. $ host 216.252.126.190 190.126.252.216.in-addr.arpa domain name pointer html1.store.vip.sp1.yahoo.com.

_What languages can we select?_

Realistically (ie, if you're asking what to learn to get a job at one of these places), C++, Java, and C# because (outside of handful of places like Jane St) it seems like that is what everybody in these parts uses. (It's 'industry standard', after all [sigh])