idupree

According to the article, a paltry 2% of your net revenue goes to uncompensated care (that's the California average).

"Though hospitals’ nonprofit status allows them to reap tens or hundreds of millions of dollars in tax benefits, California Pacific Medical Center’s main campuses spent 1.27 percent of their more than $1.1 billion in net patient revenues in 2011 on free care for indigent or uninsured patients, lower than the state average of 2.07 percent, according to statistics compiled by the San Francisco Department of Public Health. The far smaller St. Luke’s branch spent 5.32 percent that year."

I prepay for many services that are still able to list prices in real currency:

https://www.fastmail.fm/

https://www.tarsnap.com/

https://www.nearlyfreespeech.net/

The latter two do keep track of fractional charges. They deduct $0.01 from prepaid credits once that much is owed. Since you accept multiple currencies, this becomes a bit more complex but still doable. For example, let the user choose the currency to display, or pick a single standard currency (euros?) and use it as your units.

Tarsnap and NFSn choose to refund your prepaid credits if and only if you close your account with them. Not every prepaid system lets you get your prepayments back at all. I am fine with this: I am willing to pay a bit more (prepayment without refund) in order to limit my liability to the amount I intend to pay.

For me, the trivial C program appears to run faster than the empty file:

    $ touch empty
    $ chmod +x empty
    $ time ./empty

    real    0m0.002s
    user    0m0.000s
    sys     0m0.000s

    $ echo "int main(){return 0;}" > trivial.c
    $ gcc trivial.c -o trivial
    $ time ./trivial

    real    0m0.001s
    user    0m0.000s
    sys     0m0.000s

Timing results are consistent over several repetitions (provided everything's in cache from disk). Linux x86_64. `mov` takes ten thousand to a million times less than a millisecond ( https://gist.github.com/jboner/2841832 ), so I can't find out this way whether removing 'return 0' changes anything.

(If I use my default zsh shell to execute ./empty, it gives me

    zsh: exec format error: ./empty
    ./empty  0.00s user 0.00s system 0% cpu 0.008 total

So I used bash for this.)

I can get a good USB2 enclosure for $10-15. My 6.5 year old laptop hard drive is 120GB (and couldn't read/write data via SATA much faster than it can via USB2 anyway).

A 128GB flash drive costs around 5 times as much as that enclosure. Yes, it's better, but it's quite more expensive. A more comparably priced 32GB flash drive stores several times less data (which might matter to you) and may have write speed that can't even saturate USB2 (ditto; I installed Fedora on a 16GB flash drive that has max 3MB/s write speed and it takes amusingly long to install updates, though its read speed is decent and doesn't suffer seek time).

Flash drives will get cheaper, but the meaning of "5 years ago" will change just as quickly (given current trends).

Yay! You should have have a section on installing from source too. This is part of doing open-source well.

The Arch Linux instructions are still wrong; they say that aufs3 is required but it isn't anymore. http://docs.docker.io/en/master/installation/archlinux/

Is the warning "This is a community contributed installation path. The only ‘official’ installation is using the Ubuntu installation path. This version may be out of date because it depends on some binaries to be updated and published." still true? Fedora also has this warning (and no instructions). The "Look for your favorite distro in our installation docs!" link does not give me up-to-date instructions for any of my favorite Linux distros. I can't even see where in that installation documentation it says how to install from source code on generic Linux. What am I missing? (Of course I can get the source code and build it, but I want the documentation to be great :-D)

My point applies in the same way to a laptop you buy, use, then incinerate. Even after you incinerate it, you are still bound by the terms you agreed to (to the debatable extent to which [1] is enforcable at all, anyway).

[1] The download page states "By clicking the "Download now" button, you acknowledge that you have read and agree to the Adobe Software Licensing Agreement.". That statement is hundreds of pixels away from the actual download button.

So, I decided to take a look. It used to be that Flash's terms forbade you from ever working on a competing Flash implementation.

English is on page 87: http://wwwimages.adobe.com/www.adobe.com/content/dam/Adobe/e...

Heh, it might be forbidden to spin it up in cloud VMs, though local VMs are okay as long as you don't run nginx on your laptop? "3.2 Server Use. This agreement does not permit you to install or Use the Software on a computer file server." "4.1 Adobe Runtime Restrictions. You will not Use any Adobe Runtime on any non-PC device or with any embedded or device version of any operating system" ...

This provision is really broad: "9.5 Indemnity. You agree to hold Adobe and any applicable Certification Authority (except as expressly provided in its terms and conditions) harmless from any and all liabilities, losses, actions, damages, or claims (including all reasonable expenses, costs, and attorneys fees) arising out of or relating to any use of, or reliance on, by you or any third party that receives a document from you with a digital certificate, any service of such authority ..."

If you are acting on behalf of a business, you might not want to authorize Adobe to occupy your business's time telling them your business secrets: "15. Compliance with Licenses. If you are a business or organization, you agree that upon request from Adobe or Adobe’s authorized representative, you will, within thirty (30) days, fully document and certify that use of any and all Software at the time of the request is in conformity with your valid licenses from Adobe."

I'm not sure whether this persists: "4.5 No Modification or Reverse Engineering. You shall not modify, adapt, translate, or create derivative works based upon the Software. You shall not reverse engineer, decompile, disassemble, or otherwise attempt to discover the source code of the Software.", where "“Software” means (a) all of the contents of the files (delivered electronically or on physical media), or disk(s) or other media with which this agreement is provided". I'm not sure whether "Software" includes bit-for-bit identical copies of the software obtained by other means at other times (see http://ansuz.sooke.bc.ca/entry/23 ).

I imagine it's sketchy enough to be illegal, but what specific laws were they accused of violating? I read the consent judgment to find out:

"3. Defendants' conduct constitutes deceptive and unconscionable commercial practices pursuant to the New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq. ("CFA") and unauthorized access pursuant to the New Jersey Computer Related Offenses Act, N.J.S.A. 2A:38A-1 et seq. ("CROA"). The Attorney General and Director (collectively, "Plaintiffs") submit this Complaint seeking equitable relief, to prevent any more consumers from being victimized by Defendants' practices, as well as penalties, restitution, investigative costs, and attorneys' fees." - p.2 http://nj.gov/oag/newsreleases13/E-Sports_Complaint_Consent-...

p.9 (item 38) lists the alleged "unconscionable business practices and deceptions".

Also: ESEA is a New York company (p.3 / item 6). The laws are New Jersey laws. "Venue is proper in Essex County [, New Jersey], pursuant to R. 4:3-2, because it is a county in which defendants have otherwise conducted business." (p.3 / item 5)

That works for technical reasons but not legal reasons. You can't "virtually" agree to the terms&conditions and then delete your agree-ment along with the VM. (Unless the terms or the law let you do so. Sometimes they do.)

I use FastMail. They seem competent. (This is a high compliment.)

Thankfully, "A JSON-LD document is always a valid JSON document.". Section 2, http://www.w3.org/TR/2013/PR-json-ld-20131105/

Similarly (but freer), http://www.citybik.es/ is an API for bike sharing systems around the world.

Wikipedia's citation in that section[1] says that Swedes are more likely to report crimes, but have a similar actual amount of crimes.

"Sweden stands out within the entire area of crimes against the person in particular, because the registration of crime is more extensive than in the majority of other countries in Europe. This forms the background to, for example, the fact that ten times as many cases of assault are registered in Sweden as in Greece."

"But in the victim survey that exists that permits basic comparison between levels of exposure to sex crimes in ten European countries, Sweden does not top the list, as in the reporting statistics. Instead, Sweden is around the average mark, which is also the case for assaults and threats, despite the fact that compared to other countries, we have many such crimes reported. However, the fact that we are not any worse than many other countries does not mean that the situation is good. If any rape is committed, the level is too high."

[1] http://www.bra.se/bra/bra-in-english/home/news-from-bra/arch...

Well, maybe people will clean their own toilets and empty their own trash then. I do those at home (as do my housemates) because I like having a moderately clean home. If nobody else was cleaning the office I worked in, I'd clean it too, because it's basically a home.

If "moving" includes "rotating": We can tell the Earth is rotating because its shape approximates an oblate spheroid, not a sphere.

No, because you can't access that hash from https://sourceforge.net/ ( https://sourceforge.net/ is just a redirect to http).

It's slightly more of a nuisance for the attacker to modify the hash as well as the file, but if they can modify the .zip you get, then they'll surely have no trouble doing "s/the original zip's hash/their malicious zip's hash/" on all your unauthenticated web traffic too. It's a simpler modification than Upside-Down-Ternet.

In this case, they do need to create a compromised version of the zip before you view the hash, but that can be arranged with good probability by tracking the web pages you visit, pre-computing compromises of popular downloads, and/or slowing down your page load speed to give them enough time to compute and serve you compromised hashes. It wouldn't be too hard for an accomplished Web villain to have a good shot at compromising your computer if you are using public WiFi or they have ISP or NSA level access, provided you download software insecurely. ( My unfortunately ranty blog post on the matter: http://idupree.dreamwidth.org/3233.html )

HTTPS isn't perfect, but it (and/or other cryptographic signing) is the minimum we should accept for downloads of code that can quietly pwn your user account when you run 'make'.

It's hard to download from Sourceforge using HTTPS. (Or even to use HTTPS to get the SHA hash of a download.) Can you tell me how to do it, so I can download from Sourceforge without risk of a man-in-the-middle modifying the download to, say, contain malicious code?

IANAL.

Their letter isn't very good writing. Their only stated claim is that the word "ManyFish" infringes their trademarks on "PLENTYOFFISH", "PLENTY OF FISH" or "PLENTY OF". They say they can ask IANA to take your domain, but an app is not a domain. Also, if I understand correctly, your uses of "PlentyOfFish" in the app description are nominative.

However, if they don't like unofficial clients for their website, they can also block you by technical means, and doing so likely puts the law on their side even if it wasn't before (cf. Craigslist/Padmapper/3Taps). So fighting the C&D letter might be pointless, if they care enough about you to follow up on the letter.

Perhaps you could try to contact someone other than Legal at PlentyOfFish and see how they feel about it... sometimes legal departments are more aggressive than the company intends to be (I have no inside info about PlentyOfFish).

Sadly, Intel's integrated-GPU OpenCL still doesn't support Linux, and only just started supporting OS X in 10.9 Mavericks[1]. Usually Intel's Linux GPU support is great; I don't know why this is different.

(Intel do have a Linux OpenCL implementation for Xeon CPU cores and Xeon Phi coprocessor[2], which doesn't help me much. On-CPU OpenCL is fine but hardly faster than regular CPU code, and Phi coprocessors aren't very common currently.)

[1] http://forums.macrumors.com/showthread.php?t=1620203 [2] http://software.intel.com/en-us/vcsource/tools/opencl

Compose key, currently. ( https://en.wikipedia.org/wiki/Compose_key )

I typed in https://news.ycombinator.com/ and it removed the https:// from my query. http and https are not the same URL, and in particular may have different "blocked" statuses!

Also FYI: it gave an error when I entered this HN submission, https://news.ycombinator.com/item?id=6666214

Every one of those websites has a horizontal scroll bar in my current browser window, so I can't really recommend them. I voted for "fluid" hoping for websites that are more fluid than those. (My current browser window is 845 CSS pixels wide.)

I'm not worried about NSA here: they can track my packets even if I use secure VPN software. I'm worried about the coffee-shop-WiFi variety of attacks.

You're right that PPTP is fine for your purpose.

In case you don't know: Don't rely on the integrity or security of PPTP. https://en.wikipedia.org/wiki/PPTP#Security

The paper: http://arxiv.org/pdf/1310.1137v1.pdf

Its thesis: "We introduce GOTCHAs (Generating panOptic Turing Tests to Tell Computers and Humans Apart) as a way of preventing automated offline dictionary attacks against user selected passwords."

It cites http://eprint.iacr.org/2006/276.pdf which it is an improvement upon.

As far as I can tell from reading the papers, though it does not state this, the purpose is to make offline dictionary attacks harder by helping the users create/remember a higher amount of entropy than they do with a password.[1] Given ten images to be matched up with phrases, there are 10! matchings, providing at most log2(10!) = 21.8 bits of entropy (fewer bits if computers can make even a really bad guess at which phrases go with which pictures). That is about as much entropy as in four randomly-generated lowercase-letter-or-digit characters (log2(36^4) = 20.7): a great improvement for bad passwords, but modest for good passwords. The authors are hoping that its easiness-to-remember per bit of entropy is significantly greater than that of passwords (randomly generated and human chosen passwords).

[1] Once the attacker has gained all server data, there's no stopping brute-forcing. Even with SRP ( http://srp.stanford.edu/ ) in which the server never sees the plaintext password, if the attacker gains a password's verifier that's stored on the server then they can offline-brute-force it. In this case, a brute-forcer would brute-force {password + which picture goes with which phrase}.

Google is smart enough to write an equation that says what usage patterns are too much to be fair usage of their network for $70/month. Then they could (in theory) publish it as part of their Terms and Conditions rather than have a "non-commercial" clause. I wonder how that would work in practice...

Historical note: Launchd might have caught on if Apple had open-sourced it sooner.

The author of the Upstart init system, Scott James Remnant, wrote in 2006,

"How does [Upstart] differ from launchd?

launchd is the replacement init system used in MacOS X developed as an “Open Source” project by Apple. For much of its life so far, the licence has actually been entirely non-free and thus it has only become recently interesting with the licence change.

[...]

Had the licence been sufficiently free at the point we began development of our own system, we would probably have extended launchd rather than implement our own. At the point Apple changed the licence, our own system was already more suitable for our purposes."

http://netsplit.com/2006/08/26/upstart-in-universe/

Unless I've misunderstood their policy, they also forbid individuals using Class 1 certificates commercially. For example, if you run a blog with "Support my blog! Buy my T-shirt swag from swag-selling-site.com[link]!" then your blog is commercial (per legal definition of commercial; IANAL); thus StartCom's policy forbids you to use their free certificate for that site.

The first sentence and a half of this paragraph[1] from https://startssl.com/policy.pdf expressly forbid it. Its final "when" clause might be trying to limit what is forbidden, but, grammatically, it has no power to restrict the first sentence, and doesn't properly restrict the second sentence either.

[1] "Class 1 certificates are limited to client and server certificates, whereas the later is restricted in its usage for non-commercial purpose only. Subscribers MUST upgrade to Class 2 or higher level for any domain and site of commercial nature, when using high-profile brands and names or if involved in obtaining or relaying sensitive information such as health records, financial details, personal information etc."

(Naturally, I hope I've misunderstood their policy.)

From the 2011 kernel summit, "The attack turns out to have been part of a widespread credential-stealing network that has been operating for some years now; it is clear that the site had been owned by this network for some time before it was discovered. What also seems to be clear is that this was not a targeted attack; kernel.org was just another on a long list of broken machines."

- Jon Corbet reporting on a talk by H. Peter Anvin, https://lwn.net/Articles/464233/