skysight-inc/HackerNews huggingface dataset:
That's only true if Java's signature validation isn't vulnerable (or at least is no more vulnerable than the signature verification for a normal OS).

Searching around, it looks like there was at least one vulnerability like this, in which Java failed to check certificates for revocation, and at least one exploit was found in the wild signed with a stolen, revoked certificate that Java still accepted.

This is especially fun because Java at least tries to sandbox unsigned applets, but signed applets get a lot more privileges.
Wow that's wildly aggressive. I know people say 'push for the sale' but that seems counterproductive. It seems like they would have got further if they listened more.
I am not at all surprised that oracle would memory hole something that escapes PR control.
> Its more like selling someone a meal in a restaurant, and refusing to let them see the kitchen.

I don't see it that way.

The kitchen is like a development area. By looking at just the program code (not source or anything), I'm not stepping into Oracle's engineering labs or "cubicle land"---their kitchen, so to speak. I'm rather doing the equivalent of cutting into the meat pie on my plate and guessing the ingredients.

If I figure out what is in it and how it was prepared, I'm free to make that at home, or even serve it to the public in my own restaurant.

"Do not reverse engineer" is like "eat this meat loaf with your eyes closed, and do not share any hypotheses about what is in it or how it was made with anyone else".

> open kitchens, where the ingredient list and their source is available on demand?

That sounds like an analogy to open source, which is a different topic from license agreements in proprietary software against reverse engineering.

I'm saying that if you sell me some writing, I have a right to read it. Just because that writing was written for an ARM CPU doesn't mean I'm doing anything wrong by reading it anyway.

If you don't want people to know how a piece of language is interpreted to evoke its meaning, then don't sell it. Use it in-house or run it on a server and have clients to connect to it.
Other article: https://news.ycombinator.com/item?id=10042807 (theverge.com)

---

The hack requires the car have an OnBoard Diagnostics (OBD) probe installed.

The specific dongle in question is made by French company Mobile Devices and distributed by a San Francisco insurance startup called Metromile, the latter of which has a partnership with Uber.

After that it's an SMS attack to root the dongle. The dongle lets them into the CAN bus, which is how the Jeep and other cars have been attacked.

“If you put this into a Prius, there are libraries of attacks ready to use online."

---

Think you're safe if you just don't use one of these dongles? You're only as safe as the other cars on the road:

An executive order from the White House in March called for federal agencies with fleets of more than 20 vehicles to use telematics systems whenever possible to improve vehicle efficiencies. That could mean many thousands more government-owned cars and trucks using Internet-connected dongles in the near future.
Other article: https://news.ycombinator.com/item?id=10042834 (wired.com)

---

The hack requires the car have an OnBoard Diagnostics (OBD) probe installed.

The specific dongle in question is made by French company Mobile Devices and distributed by a San Francisco insurance startup called Metromile, the latter of which has a partnership with Uber.

After that it's an SMS attack to root the dongle. The dongle lets them into the CAN bus, which is how the Jeep and other cars have been attacked.

“If you put this into a Prius, there are libraries of attacks ready to use online."

---

Think you're safe if you just don't use one of these dongles? You're only as safe as the other cars on the road:

An executive order from the White House in March called for federal agencies with fleets of more than 20 vehicles to use telematics systems whenever possible to improve vehicle efficiencies. That could mean many thousands more government-owned cars and trucks using Internet-connected dongles in the near future.
A few months ago I noticed there was not a novice user step-by-step guide for installing WordPress on AWS, so I threw together https://howtoinstallonaws.com. Bitnami really makes it quite painless.
Who wants malware affecting all of the naive users on the internet? I don't. I think you can all put your pitchforks away and take a deep breath knowing that Firefox is trying to improve the experience for people who are not like yourselves. The process is automated and takes little time. Stop acting so entitled.
Mostly trying to better understand clojure constructs and their edge cases. I guess I was expecting a more lisp-y setup where high-level concepts were implemented in terms of a small number of clojure primitives, but it didn't seem to work that way. Probably made it perform better, but it also makes it harder to do anything about the endless Java stack traces.
Indeed, their developer tools are some of the best, though the do tend to try locking you in their environment.
I think the message molecule is trying to convey is that hitting a pillow is an unhealthy way of releasing anger because doing so conditions you to...hit things out of anger. Maybe next time your pillow isn't around but your wife is and you're more angry than usual to the point that you can't cordon it off until you find a suitable pillow.

On the other hand of your response, exercise would be a healthy response but may not be possible in all situations. If you're angry at work for some reason, you can't exactly go for a jog in a business suit. The best response would be whatever calms you down and lowers your blood pressure and is something you could do in all situations.

Furthermore, it would help to be cognizant of what makes you angry so you can avoid those situations and/or just force yourself into them often so you become acclimated. YMMV
Telling someone to shut up because they're being abusive is still speaking up and taking responsibility. You have all the right to say what you want. Nobody has the right to listen to you, and they have as much right to tell you to shut your hole.
Why do frameworks need to innovate? I'd much rather have a framework that releases fixes than one that "innovates often". Frameworks should start out innovative and slow down. Things change too fast to expect an "innovative framework" to be backwards compatable.
I used to run WP on $5 plan but the memory soon runs out (with the recommended swap config). The next tier seems to be working fine for the past few months.
Excited for this. Now we just need an RSA implementation for OpenSSH which doesn't require OpenSSL for the RSA.
Interesting. I haven't used ClojureScript.
The Economics of Suicide Terrorism
For what it's worth, there's also a componentWillUpdate, which I find better than componentDidUpdate and comparing with the previous state.
The Art of Nomography I: Geometric Design (2008)
And that's the real problem. Heck, it doesn't even need to be an NPE, it just needs to be one of the patent holders they're "avoiding" who wants to fire up some litigation.

They don't even need to be able to win. An existing "legit" patent holder might choose to simply throw lawyers at as a tactic to delay or defeat a potential competitor. In that case, it comes down to a cost/benefit analysis for the would-be litigator.
Amazon's growth is a systemic risk to Seattle
It comes with the most popular tools for penetration testing.

Personally, I try to steer people away from it until they've learned how to do things the hard way (i.e. you have Python and Bash installed, write your own simple tools and hack this network) and then Kali is easy mode.
The Oracle blog post already has an extensive ongoing discussion at https://news.ycombinator.com/item?id=10039202, and several people have already posted Pastebin archives of Oracle's deleted post in that thread.
Dec 6, 2001. Bomb Kills Three U.S. Soldiers; 20 Are Injured 'Friendly Fire'

http://pqasb.pqarchiver.com/washingtonpost/doc/409215373.htm...

Feb 2, 2002. U.S. Soldiers Recount Smart Bomb's Blunder

http://pqasb.pqarchiver.com/washingtonpost/doc/409315969.htm...

Mar 24, 2002. 'Friendly Fire' Deaths Traced to Dead Battery; Taliban Targeted, but U.S. Forces Killed

http://pqasb.pqarchiver.com/washingtonpost/doc/409245838.htm...
Wordpress is awful on a self-managed VPS, this has nothing to do with DO.
License? Seems hard to find online. Not looking for anything unusual for the existing raspi community, just what do I have to do to make a project on it then distribute a bootable sdcard image to users around the world for free. I'm guessing its a total non-starter but if I were surprised by it being BSD/GPL that would be interesting.

The hardware compatibility part of the release notes look like a bad linux install from 1995, which is pretty funny.
Server side, have you looked at sympy?
"They spend so much time on it that they do not have time to govern effectively."

Not really. A bit like saying "if I don't let my kid watch football they will have more time to study!".

If they didn't spend time fundraising they would spend time on some equally worthless (for the public) activity. Like marching in parades and kissing babies, or giving out stupid medals, or attending events so that they can get more votes in the next election or attending events that will get others elected that will then owe them a favor.

Obama after he was elected made a point of visiting his kids school (iirc the week after he was in office or close to that) in order to show that a father should be interested in his kid's education presumably or something like that. What is ironic is that with a father like the former President (not to mention a mother in attendance who went to Harvard as well and is quite educated) Obama's kids are the least likely to have to ever worry about their education and school studies.

I would imagine that half the things that Obama or any President does in White House events involves some favor or another for a politician that helped them in the past in some way. (In addition to donors of course) Otherwise hard to justify why such an important guy should take the time from his important work for so many photo ops.

Question for anyone running a business startup or otherwise. Do you spend your time doing silly stuff like that w/o a clear business purpose? Of course not.
Google's Alphabet Soup Is Too Thin
Life Sciences breaks out of Google X
http://docs.syncthing.net/users/faq.html#what-if-there-is-a-...

> When a file has been modified on two devices
> simultaneously, one of the files will be renamed to
> <filename>.sync- conflict-<date>-<time>.<ext>.
I love Syncthing. I used to use Dropbox and then ownCloud on a VPS, but so far Syncthing has been the perfect replacement to regain complete control of my data.
figure1.com
I disagree. The author implies several times that the main issue, and the reason for the ban on reverse engineering in the agreement, is protection of intellectual property (source code). People may do other types of vulnerability testing, but the piece that Oracle is concerned about is trying to discover their source code (for example, by using static analysis tools...which analyze some version of source code).
smallpdf.com
I haven't had too many. About the same as Dropbox, I think. From memory, I believe it appends -conflicted-BLABLA's-copy or some such to the filename.

Conveniently, it has a built-in backup system you can enable that keeps the last 'n' copies of files. I've got mine set to 5 so even if something goes horribly wrong, I can fetch from the backup.
> Well that will take longer than two terms.

That...depends. If Lessig could get elected President with a platform of very specific reforms of the type he is talking about and a pledge to resign in favor of his VP when that package was complete, it would almost certainly mean that his campaign was significant in mobilizing popular attention on those issues in a way which affect the composition of the next Congress and change the political prospects for those reforms. (Particularly in the House.

> Congress doesn't even play along with the people who are incahoots in rigging the system. It's beyond ridiculous to believe they will play along with their own destruction.

Lessig's proposed reforms won't destroy Congress (arguably, it would free Congress.)
Fast build turnaround time is essential
Hackers who breached corporate wires made millions off insider trading
Net neutrality is about third parties treating all net traffic equally.

I am not treating all net traffic equally, I'm not visiting at least 99.99% of global websites - and that is perfectly consistent with net neutrality.

In that sense, an ad blocking or extra-ad-adding service that is implemented against my wishes by any third party (no matter if it's ISP, software vendor or someone who hacked my computer) violates that neutrality, but the exact same ad blocking or ad adding done by me or the content provider is acceptable.
Personally, I had never heard of Kiehls, Spanx, Lululemon, Zara, Jiffy muffin mix, or NO-AD sunscreen. However, I don't know if advertising would help me remember these brands better, as I don't buy their class of products often.
Coming from vanilla JS to ExtJS to Ember to React I can also say, that the frameworks also improved development speed. So reimplementing an app isn't that big of a problem.
This is diametrically the opposite of my experience with source code scanners.

I think the impedance mismatch here might be that you're a software developer, and we're talking about security teams.

I don't know that anyone is arguing that static analysis is useless for developers. If you're intimately familiar with the code you're working on, there are probably a lot of ways to make static analysis results both valuable in every edit/compile/debug cycle, and an important part of your team's release process.

But when you're close to the code, it's easy to forget how much of the tool's output you're ignoring (either literally, by just skimming past findings you know don't matter, or implicitly, by configuring the tool to match your environment or subtly changing your coding style to conform to Coverity's expectations).

Security teams can't generally do this. They're stuck with the raw output of the barely-configured tool. The results of static analysis in these circumstances is nonsensical: memory leaks, uninitialized variables, race conditions, tainted inputs reaching SQL queries, improper cleanup of sensitive variables, 99.9% of which aren't valid findings, but all of which look super important, especially if you're consultant with 6 months of experience charging $150/hr to run Fortify on someone else's code, then petulantly demanding a response for every fucking issue the scanner generates.

They're fine dev tools, but they are terrible tools for adversarial inspection, which is what Davidson is talking about.
hey, looks a bit like quickinstall at hostgator
> If I take 10% completion rate, it is still higher than AdSense CPM rates and at par with other food blogging ad networks. For providing an ad free experience, it still seems worthwhile.

This is the much more interesting bit. It would still be super interesting to follow through and find out what the actual completion rate was.
Wow, I would have killed to have just that list last weekend. I spent ~4 hours figuring most of it out myself.
We need a patio11 person dedicated to donation-based software ;) Does it work better if the software is open-source, but the donation is mandatory in the original version of the binaries?
Centripetal Acceleration: An Effective Mechanism for Flapping Flight in Insects
Instant and complete access to every historical public Tweet
if Oracle bans showing its product(s) in benchmarks does this mean that it is slow?

No necessarily. It's really easy to do bad benchmarking in good faith, especially for a serious database. Now imagine Company I doing benchmarks of Databases O and D, and they subtly cripple O, perhaps by failing to change one or two defaults....
It's math and realpolitik. The US is set to have a majority of minorities relatively soon after a long period of time on the horizon. Minorities are poorer, and don't vote for Republicans when they do vote, which isn't that frequently. Thus, they need to be prevented from voting if they seem as though they are inclined to vote, because they will not vote for right wing candidates in the way that poor whites will. The Hispanic population inclined to vote Republican due to religion does defy the paradigm I outlined, but they're an outlier. This is why we see all sorts of "Voter ID" initiatives coming out of red states. Getting an ID that costs $25 is easy for whites, who are more likely to have the money to do so, and more likely to vote Republican as well.

You say gerrymandering doesn't help the GOP, then link an article which describes how gerrymandering has allowed for the complete and uncontested domination of half of the legislature by the GOP for over a decade. There's only two houses in Congress, and three presidential elections and numerous mid-terms is a long time for half of congress to be safely locked down. Then there's the fact that the lockdown of the House has occurred during a very protracted time of endless GOP fumblings, failings, catastrophes, and unprecedented low approval ratings. Without gerrymandering, the House GOP would have been ghosts in 2008, then again in 2012, then again in 2014...

As far as Massachusetts goes, we have a history of picking centrists when the left's candidate is weak. This happened in recent memory with Baker, Romney, and also Scott Brown. That being said, MA is also strongly left/European, so you wouldn't even see the start of anti-voter campaigns against either side here.
This risk is there for pretty much any engineering you might want to do. The point here is to make a royalty-free codec, with as much IPR defense as possible.
You're brutally truthful.
It's not "hatred" you're seeing. It's exasperation after repeated disappointment, so much of it totally unnecessary.

Many of us have been using software from Mozilla, and Netscape before them, for decades now. Generally we've been happy with the software. We were more than happy with earlier versions of Firefox, in fact. But lately we've seen changes made that have not benefited the users of Mozilla's software.

Your comment actually describes some of the problems we're talking about. Users and developers now have to jump through one hoop after another just to get a basic installation of Firefox working.

It wasn't always like that. We used to be able to download a sub-10 MB installer, run it, and have a usable installation of Firefox ready for use.

Now we have to choose from the "correct" stream, download a 40 MB or larger installer, run it, change numerous about:config options to allow us to install our own custom unsigned extensions and to disable unwanted functionality that Mozilla has added, manually remove unwanted toolbar buttons, install a number of third-party extensions that also fix additional problems introduced by Mozilla, and in the end we're still stuck with a user interface and a user experience that isn't very good.

Now if we're developing extensions, we'll have to also jump through more hoops thanks to this signing process. You say it "takes only seconds", but I've seen enough comments here from other developers saying they've been waiting months for reviews. That's not acceptable.

Firefox used to get better with each release. A new release of Firefox was something we'd look forward to. But lately, each new release of Firefox has brought us new problems to deal with, without bringing any notable improvements.

Repeatedly disappointed people will express their disappointment. Don't misinterpret it as "hatred". See it for what it is: disappointment!
To me, the really-interesting question here is "How can we find such issues in the design before they hit".

In the article, I explain why this is going to be a bigger problem in the near future, and speculate that some simulation-based could, perhaps, do the trick. But I am not sure.

Any thoughts about that?
I wouldn't say surprising. India's the only one of those you mentioned that has a significant English-speaking population - and connections to the English-speaking West as a result of being a British colony.
Internet 0 protocol
That's really interesting, thanks.
Looking for internship
This is an embarrassing subthread. I'm sorry to spoil an opportunity for people to feel like they're smarter than an executive that just wrote a lot of dumb things in a blog post, but not only does Mary Ann Davidson know about Veracode, she's semi-famous for hating on them.

Meanwhile: a huge portion of everything Oracle ships is Java, and consultants absolutely do run Java security scanners on decompiled jar files from Oracle products.
`sudo -i` sort of solves the lack of su in Ubuntu and derivatives.
I don't know what "old world" you're talking about. When the web was first a thing, it was written in C and PHP and Perl. All the Java crap was layered on top later, temporarily, and unsatisfactorily. The enterprise repeatedly misunderstands what the internet is and how to use it, but that is the enterprise's problem, no one else's.
Is there any evidence of political advertising helping the country in any way? I've had limited exposure, but every one I've seen is either content free (smiling face, vague promise), or sounds manipulative.

Why not completely ban political advertising, requiring information on the parties to be released via their own website plus a master list. As well as equal airtime on news channels if coverage is actually that important to have.

That'd also provide a slight chance of breaking this terrible 2 party system the US is stuck in, which seems to prevent any possibility of actual change.
Irish teenagers launching hardware startup
I think it is important to remember that the $250 is only the Kickstarter reward price. The actual retail price is $399 ($150 higher than what you discussed).
You can find our Launchpad for VMware vCloud Air here at https://vmware.bitnami.com/. Check out https://bitnami.com/cloud to find out about some of the other cloud platforms we've partnered with.
I showered with it, and it convinced me.

It does lack the mechanical blasting action of regular showers, which is good for removing caked mud. But that doesn't come up often in my life. I found it more pleasant and just as fast for normal feel-good, smell-good showering purposes.
This isn't entirely accurate. There are restrictions on the legality of decompilation in Europe. The main one being that "...decompilation must be necessary to achieve interoperability with the target program or other programs. Interoperability information should therefore not be readily available, such as through manuals or API documentation."

So, decompilation in order to check for security vulnerabilities or to modify the function of the software for non-interoperability reasons do not appear to be covered.

disclaimer: I don't live in Europe and am not familiar with the most up-to-date software laws there. This is from the following source: https://en.wikipedia.org/wiki/Decompiler#Legality
Deep Dreaming with Video
The obvious follow-up question is, given their limited resources, why were they spending some of it on closed-source code based on other people's commercial code?
I completely agree with you on knockout. All versions are backwards compatible, just change the version number and you can enjoy the new features, I'm very happy I went with ko over angular (of course angular does more things so it's not a fair comparison, but things I do not need).
$11M a year startup and then–poof–it folded. Is there a better way to go out?