calvins

The paper itself: https://bmcmedicine.biomedcentral.com/articles/10.1186/s1291...

What do you mean by 'out of the box'? jsonschema needs to be installed. It's not in the stdlib.

It seems no security audit has been performed, but they plan on it at some point: https://discussion.enpass.io/index.php?/topic/404-security-a...

Their responses in that thread do not inspire confidence in the product for me, to put it mildly.

I think you should put the disclaimer at the top of the github page, and clearly state that it is not secure.

The disclaimer currently is near the end of the document and says only "Purely experimental project. Designed for learning purposes not production use.".

Some people will miss that at the bottom of the page (after how to install, how to use, etc.), or might not realize that textbook RSA is insecure (https://crypto.stanford.edu/~dabo/courses/cs255_winter00/RSA...).

https.cio.gov SSL Labs test result: https://www.ssllabs.com/ssltest/analyze.html?d=https.cio.gov

Of note is that they're using a Let's Encrypt cert and running in AWS.

Not the OP, but I'd really like to be able to run containers with all unnecessary capabilities dropped:

https://github.com/aws/amazon-ecs-agent/issues/223

But doing a 360 doesn't mean doing a 180, and then sometime much later, doing another 180.

Pip has a constraints file now. Running

  $ pip freeze -r requirements.txt > constraints.txt

  $ pip install -r requirements.txt -c constraints.txt

It's easier to disambiguate shapes and colors than just shapes or just colors -- something like a checkmark of one color, and an X of a different color.

if it's _truly_ agent-less why do they care about the python version on the target, I feel that python target code is the agent?

"Agentless" means that it works by pushing to the machine and that there isn't an agent process already running on the target. It doesn't mean that there aren't any requirements on what needs to be installed on the target already.

it should hopefully reduce the FUD around alternatives with better type systems (Scala), if the type system is turing-complete in any case.

Beware of the Turing tar-pit in which everything is possible but nothing of interest is easy.

Alan Perlis

https://en.wikipedia.org/wiki/Turing_tarpit

I'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference at work. And the book gets updates too (http://blog.ivanristic.com/2015/08/bulletproof-maintenance.h...).

Thanks Ivan!

Either you verify from the bottom or you can't verify at all.

So 'curl ... | sudo -' is just fine now because we can't verify from the bottom, so there's no sense in verifying what we're piping to sudo?

There is spamgourmet (https://www.spamgourmet.com/index.pl). It doesn't satisfy 4 exactly, but it's pretty close. If you give out an email like 'foo.20.myusername@spamgourmet.com' (there are other domains too), then it'll forward 20 emails to the configured email for your account, but you can always log in and set it to 0 remaining at any point, regardless of how many emails have been received.

If we were in a simulation and the simulation would fail to realize its purpose if a sufficiently large number of beings in the simulation became aware of the simulation and changed their behavior, how smart would it be to try to get more and more people interested in the issue and look for "smoking gun" evidence? ;=-)

You need to allocate at least 30 minutes per day (1 hour is better) just talking (averaged over the week) and not micromanaging.

What do you talk about for an hour a day, every day, that is so important that it justifies allocating 16% of all development hours to communication? I don't see how this much communication could ever be a net win (or even come close to breaking even).

"It is better to be a human being dissatisfied than a pig satisfied; better to be Socrates dissatisfied than a fool satisfied. And if the fool, or the pig, are of a different opinion, it is because they only know their own side of the question. The other party to the comparison knows both sides."

- John Stuart Mill

Yes, us-west-1 has always seemed a bit of a second-class citizen. For years it has just been two availability zones, but they're named '1b' and '1c', as if there was once a third.

Shane Legg (a DeepMind founder) and Marcus Hutter collected and categorized 70 different definitions of intelligence: http://arxiv.org/abs/0706.3639

Their attempt at a definition that synthesizes all the others is:

Intelligence measures an agent's ability to achieve goals in a wide range of environments. - S. Legg and M. Hutter

Errors when already lost don't mean much.

I wish they would include how many times each password was used. Those top 25 representing 50,000 out of a million passwords means something very different than if they represent just 1,000 out of a million.

Comparing the proportion of the million passwords that are accounted for by the top 25 (and top 100, top 1000, etc.) year to year also gives a much better measure of whether public behavior is improving than just seeing if the top 25 are obviously poor passwords.

Pushed back for another six months yet again. So much for the idea somebody here put forth that it always gets cancelled in the middle of the previous month if it's going to get cancelled. This time it's four days before it would have started.

I know there are quite a few readers of HN that have been waiting for Crypto II for a while, so consider this a public service announcement.

My favorite find so far is "Advances in Crypto" conference proceedings going back to the early eighties:

- http://link.springer.com/search?query=%22advances+in+cryptol...

+1 for Dan's crypto1. I don't think crypto2 has been taught yet via coursera, as I've been waiting to take it and have seen it pushed back several times, and I've seen others say they'd been watching it get delayed for years. It does seem that Dan has been recording videos for part 2 in 2015 though (according to one of his students), so there's reason for hope that it might happen in 2016.

What you're missing is that Bret Victor isn't the author of that web page.

If you want to some of his inspired UX, view https://vimeo.com/67076984

Andrew Wiles said much the same on solving FLT: "Perhaps I can best describe my experience of doing mathematics in terms of a journey through a dark unexplored mansion. You enter the first room of the mansion and it's completely dark. You stumble around bumping into the furniture, but gradually you learn where each piece of furniture is. Finally, after six months or so, you find the light switch, you turn it on, and suddenly it's all illuminated. You can see exactly where you were. Then you move into the next room and spend another six months in the dark. So each of these breakthroughs, while sometimes they're momentary, sometimes over a period of a day or two, they are the culmination of—and couldn't exist without—the many months of stumbling around in the dark that proceed them."

http://www.pbs.org/wgbh/nova/physics/andrew-wiles-fermat.htm...

This is really nice. It's fast and gives good results (I mainly searched for some cryptography topics that I've been learning about recently), and the faceted search (filtering by publication venue, author, etc.) is very well done.

Meeting the rules for inclusion that were known by all parties (and were in fact used for the first debate) should have been all that was needed for Lessig's inclusion.

This last-minute change of the rules to specifically exclude Lessig after it seemed he was going to meet the requirements is a disgrace.

I use ubuntu, and haven't noticed any performance issues. What sorts of things did your friend report?

Edit: I have a model with 8GB RAM and SSD, but some models have less RAM and solid-state drives.