skysight-inc/HackerNews huggingface dataset:
"the attackers can choose from any of the existing file formats, most of which are extremely complex both structurally and semantically, making it very difficult to get them 100% right in implementation. If we also consider that a majority of the parsers were in a large part developed in C/C++ several decades ago, that they are easily reachable via numerous channels (websites, documents, USB sticks etc.), and that they support extensive, turing-complete virtual machine environments for running untrusted TTF/PostScript Charstring programs, it becomes clear that fonts are one of the best imaginable attack vectors..."

Would it be technically feasible to just throw out the old font formats and make a new, more limited format that's just a list of Bezier curves without all the Turing-complete stuff and rarely used features, then convert all the most widely used fonts, and finally schedule TTF for deprecation?
LoL alright fair point, but they don't have to learn to code, just find something instead of zoning out.
But will your university pay for a better solution? Most small universities, public or private, won't shell out the cash to solve that particular problem. Same thing goes with small hospitals, high schools and probably dozens of other public and private institutions.
markets dont self-regulate to normal distributions they seek monopols
I'd +1 shadowing.

A couple years back, I had an idea and wanted to understand the business/industry a bit deeper first. I got an intro to a friend of a friend, asked to shadow him for the day, added a $100 Ruth Chris gift card to sweeten it, and then spent the day wit him.

Here are some of my questions:
- What keeps you up at night?
- What drives you nuts?
- Where do you lose the most money?
- Where do you make the most money? (careful with this one, might be considered suspicious)
- When he took a call and ended up chewing out the other end, I asked what the guy should have done instead, how much that might cost him, whether that would risk customers, projects, etc, and some related things.

I ended up trying some basic ideas in the space - none worked out - but I learned a ton about an industry, a business, and a genuinely good guy. It was well worth $100.
A gateway in the city-Do you think about the simple joy of watching a paint?
Any links to how to do this? My google-fu seems to be failing me. I'm assuming you somehow set things up so it automatically detects the page / content (based on the environment name or instance tags??) and changes the background?
>Technically, no. I doubt Amazon would risk the publicity

No? There is a big difference between "Technically no" and "uh they probably won't" - especially when it comes to legal matters.

Remember the home repossession was an example - I don't even fall under US law. The house thing was code for "legally the can wipe you off the map".
I also grew up in Redmond, but probably a little earlier than you. Your comment made me wonder why it took Microsoft so long to get into the schools -- from 1982 to 1990, it was all Commodore PETs and Apple IIs. In Microsofts own backyard!
How to name a startup?
Are there any tricks or rules to follow when coming up with a name?
> I have a 50/50 fiber connection now and even with multiple people watching HD video streams, torrents and other files I don't believe I come close to saturating it.

Unless you've throttled your torrents, or you're connected to a really slow swarm, you have almost certainly saturated your download. I have -er- 100/10 or 100/15 service from Comcast. If I'm downloading anything >= 100MB, and a member of the household is going to start a new Netflix stream, I need to pause the download, or else the stream will be degraded for a long time.

Also, unless you're using a decent router, it's very possible that your router can't route and/or NAT at 50mbit or faster. I know that Apple Airports can and Ubiquiti EdgeRouters[0] can. I would also expect that an ISP-provided router would route fast enough.

[0] If you're in the market for a new router and are somewhat network savvy, or are comfortable with running OpenWRT on your router, I strongly recommend the Ubiquiti EdgeRouter Lite. It routes and firewalls at ~1Gbit/sec (when offloading is enabled) and costs right around $100. Check out the Newegg reviews that aren't "It's slower than I expected" or "It's totally broken" for an idea of what you'll be getting in to. I've had mine for nearly a year and -other than the eventually dodgy external power supply[1] it shipped with- it has been rock solid.

[1] The unit I got had been sitting in a box in a warehouse in Florida for ~two years before it arrived on my doorstep. The failing power supply presented as infrequent spontaneous reboots with nothing unusual in syslog, which became more and more frequent until the power supply just stopped providing power entirely. Replaced it with a wall wart that I had on hand and have had no trouble since.
Yeah I agree. I'm a software engineer but I'm also an amateur jazz pianist (or I guess semi-pro since I sometimes get paid for it). I occasionally get the chance to play with professional musicians and I sometimes feel like an imposter around them, even though if I listen back to recordings or, as you said, try to look at myself through the eyes of others and be objective about it, I'm actually better than I imagine.
I've recently setup Glacier with a Vault policy that prevents deletions.

I really like that layer of protection, but I'm under no illusion as to what a disaster it would still be if the main pass was compromised.
Perhaps some git pre-commit hooks that could easily be installed via homebrew?
> and/or data destroyed right during an excitingly busy period

The idea that service providers destroy data when a cap is reached is just plain weird. Usually your access to the data is simply blocked - then you can pony up some more $$ if you want access to it.

Similarly, it's also weird that people think Amazon doesn't care about 4- and 5-figure accounts. They do. Big accounts bring in money... but so do a lot of small accounts... and there are a hell of a lot more small accounts than big accounts. At my last job our monthly bill was $1-2k, and I'd get regular contacts from the AWS account manager, along with free training days.

I think that the real reason is that AWS is generally not at capacity, and if someone does have a hostile overage event, it's quite short term, and the only money that AWS really loses is from the wattage used by the VMs. There's no extra labour or hardware on their side. Refunding overages is good PR and not all that expensive, as long as it doesn't prevent other paying customers from accessing existing resources.
That was me asking about memory safety, actually. You ever get to Atlanta, GA, I owe you a dinner and a beer.
Imagine that you decide to get a security camera system for some reason. Maybe you have a valuable collection of something or you have a small business with lots of easily moved/sold equipment. You can easy buy or assemble a DVR system with up to a few dozen cameras from a number of sources.

These systems can be very valuable in ways you may not expect. My parent's recently captured video of a car accident in front of their house. This video greatly benefited a long-time neighbor and friend.

Anyway you get a system that has good video coverage of your building's doors and windows and can record say a few days worth of video. You're golden, right? Unfortunately you are vulnerable in a fundamental way. An intruder can find the video recorder box and destroy it. I personally know individuals this has happened to. So you come home from a long week and find your building broken into and the video lost. What can you do about this?

Simple... find a neighbor/AWS/colo box/etc and stream the video there too. It records a few TB of data and provides a backup in case of theft or destruction. This differs from typical backup situations of home users because of the bandwith involved.

Because ideally you would stream the video directly from the cams. If you have 10 cams producing 2 mbps, thats 20mbps. That's a lot of upload for the typical home connection, but for a symmetrical gigabit connection it's a drop in the bucket.

This is just one example. Having the bandwidth available makes so many things easy that were previously very difficult.
As someone who has developed a product that will let you search a Git repository, I can say there is a lot of moving parts. And I can see why Bitbucket, GitHub, and others don't support it. Working at their scale does present a lot of challenges.

The biggest challenge is knowing what to consider and I solve this by enforcing a context for every search. For example, if I know you are looking at 7 different branches, as the image below shows:

http://i.imgur.com/L7aHr2r.png

I will only consider these branches when you do a search.

http://i.imgur.com/JYHgB6I.png

Searching code presents a unique challenge since your code base is constantly changing. And without the user giving you hints about what to consider, you'll just end up generating a lot of noise.

Another example of how context simplifies things, is in the image below, I know you are looking at a tree

http://i.imgur.com/l8Y0oLA.png

so I will only search that tree

http://i.imgur.com/CIxHPjr.png

When searching code, you really can't guess what is important or not since what mattered in the morning may not in the evening. You really need the user to guide you and as you can see in my screenshots, I had to implement a new way of exploring Git. The current way of browsing one repository at a time will not work in a lot of enterprise environments since a product is usually a combination of branches from different repositories from different time lines.
Especially since PE is such a technically simple site. It's login/logout, listing of problems, and confirmation/logging of problem success. It's simpler than the apps that beginning web framework tutorials show how to make.
This is sad news. He was a lover of nature and a true artist. Really such an interesting man. I had setup two aquariums using his products and styling advice, they looked gorgeous in my house. They were freshwater aquariums but were vivid in many ways. Visitors to my home would comment to me that I had a "really nice saltwater tank." His techniques and products made freshwater aquariums special. He also made me notice the subtle beauties in nature a lot more.
Processed foods can be better, in some cases. For instance, frozen vegetables are picked ripe, and packaged very close to harvest, whereas "fresh" vegetables are picked green, and spend weeks in a truck traveling across the country, and you end up eating them long after they were picked. Frozen vegetables are better for you!
Goodbye, Parse
Umm US Gov spending was 30% GDP in 2000, bushes wars and a recession bumped it to 35% but that's hardly a run up.
>I plan to give my kids an old PC

You're on exactly the same wavelength as me on this...but that phrase made me pause. Remember your kids will judge whatever you give them against the latest ipad3000. If that gap is too big they'll lose interest forever & you risk losing the war because you weren't willing to concede a battle.

I grew up exactly as you described - built a dos box with my dad & it was all mine. The internet world is too complicated though - you need an adult to hold your hand.

The above is of course opinion - not fact. To each his own...
It's not a good thing OR a bad thing. It's different. The sad thing is that a culture of real sharing (not 'social media' sharing, but actual sharing of knowledge, life experiences, and ideas) has been traded for a place that anyone can find any piece of information they could ever want, and contact any person they could ever want.

I think both have very high merit, and can't really be compared. It's not a 'good thing' that we've transitioned from one to the other, it's just a change that the old guard has to deal with.
ok, i'm convinced. Adobe is a front for the NSA.

there is no other explanation. 9 out of 10 exploits exists because of adobe code.
Not OP, but I'd like to chime in here. Getting good with computers is often best done by spending a large amount of time on computers. For many of "us" that involved teenage years playing MMORPGs, general programming, IRC, etc.

Despite a certain illusion of sociality involved in these activities, I am of the opinion that they are uniquely anti-social, and thus were in one way or another a deprivation of my childhood.

Sure I now have a much higher earnings potential. But was it worth it? I don't know. And thus I'm in no position to recommend it for anyone else.

Theirs probably a balance in it somewhere. And you can be damned sure if I'm ever a parent I'm going to tread lightly between "my child should learn to program, go to college, etc." and "my child needs to live a happy, normal, life".

That why it's a "for better or for worse" mentality in my opinion. We don't really know which is best do we?
"If someone gets access to your AWS access credentials, you’re in trouble."

I know we're not supposed to post negative comments that don't "add value" to a discussion, but the only thing that comes to mind is "really?". Your setup is as secure as you make it. How you use your API access is up to you. Putting all your eggs in one basket is not insecure. This article doesn't actually bring to light anything important. There is no risk involved so long as you pay attention to what you are doing.

Any set of credentials, if leaked, destroys security. So... don't set yourself up to leak your credentials? I mean, come on, seriously?

*edit: I unfairly used the word "incompetent". Change to a phrase about paying attention to what you are doing.
GitHub is just a host of the repo, the owner has ultimate responsibility to insure they are not uploading their private keys, as other Git code repo hosts and software providers would also need to accommodate the enhanced security requirements. If they took on this task then they would also need to insure people are not uploading other private information (e.g. database passwords, API keys, etc.). Yes, it may be better for the entire Github community in the long run but becoming a source code security company may not be something that GitHub wants to get into at this point.

It would be nice if there were pre-checks client side on git status, diffs, branches, checkout, merges, init, add and commit that could quickly be checked to warn the user about the potential issue. Something like this would be a nice addition for helping user's audit their code for vulnerabilities that they may not have known about. Though this would turn Git into a security product too.

Creating the extensions required for this might be a little complicated for the average user but if something were created, secured, reviewed and regularly updated this might be something that can be matured into easy to use git extensions or something officially supported by Git or GitHub.
It's always Bitcoin mining. The attacker spins up a bunch of GPU EC2 instances and mines as long as they can. I don't think the profit ends up being very large (those GPU instances put out a puny amount of hashing power compared to modern mining ASICs)...
Here's another one:

Modern games are huge and SSDs are small. Buy all your games on steam. When you want to play a game just tell steam to get it and it downloads at 50+ megabytes / second. Play your 20GB game in less than 7 minutes. When you're done just delete it.

There is no reason why games couldn't be designed for this use case and be playble immediately, downloading in the background.
The ERL-3, ER-X, etc, run a Vyatta fork, not OpenWRT. I love mine.
Yeah, so? You're travelling in a foreign country. I get that some people want McDonald's wherever they go, and some people stay at Disney resorts, but again, show a little grit, I say.
I do not remember where exactly I have heard this, maybe from my friend who created his startup couple of years ago. Anyways - the name may bring more attention if it contains three syllables with emphasis on the last one and if it sounds similar to this nonsense phrase: 'sellerdoor'
This is absolutely brilliant, thank you so much Tom - I've been wanting exactly this for so long.

Suggestion: Why not get in contact with iTerm and see if you can work together to make it part of the official build?
i think the only advantage is that binding books back then was expensive as hell... so maybe this crazy 6-way binding could have cost 2x or 3x and it would still be cheaper then paying the normal 6x.

not to mention you save the weight of extra 10 front and back covers.

now, why they didn't simply make the 6 volumes in the same book and put some tabs protruding from the pages, i will never know. there is a russian book binder faux anecdote there...
Bookmarked! I know a few getting into linux that could take advantage of this.
The economic systems are over-simplified, poorly automated, and disconnected from real physical and social science and measurements.

Money is a very useful technology but the 'economy' really encompasses everything, and expecting some interest rate changes to save a sick economy is like a doctor who is only aware of the existence of the cardiovascular system and has one move -- rapid chest thrusts to get more blood pumping.

By harnessing technology we can make our systems much more sophisticated than that.
Maybe I'm a bit confused, but it doesn't seem by your announcement that you are opening up the source, just inviting people to try and hack. Having the source open would make it much easier to spot security problems.
I have a 35/35 connection that I regularly saturate, and unfortunately it's the best available. (Frontier offers better service elsewhere, but not here.) I don't saturate it 24 hours a day, but when I use it, I use all of it. For the download bandwidth, between videos, large packages, and source code, the limiting factor is almost always on my end. And for upload, I use it with VPN, with regular backups, with git, with scp, and with rsync. I would love to have a gigabit connection to see if that connection would still be the limiting factor, and I suspect it still would be sometimes.
In addition I can add that there is an interesting project called "mantis kanban" - look for their project here: https://github.com/cgaspard/mantiskanban

And check the demo here: http://mantiskanban.com/mantisbt/mantiskanban/

This made mantis look very impressive - and even my friend who loves those visual tweaks said he won't use trello anymore having mantis with mantiskanban.
Translations of common web phrases
It seems you are describing how status symbol works
I think small developers are their target customer, as well as big customers. After all, why would the big customer's care about the free tier? Similarly, why open the 'aws pop-up lofts'? https://aws.amazon.com/start-ups/loft/
If you are a big company thinking of using AWS, you probably pay a thousand bucks to send some of your engineers on a course to learn how to use it, or hire a consultant with those skills, you don't shlep down to the pop-up loft for their free 'ask-an-architect' sessions, free coffee and free candy.

It's self-funded startups and folks doing personal projects that those initiatives are aimed at, IMO, and they are the ones who would benefit from this kind of thing. By comparison, Google cloud (or at least appengine) does have billing limits, the daily ones reset each 24 hours, if you hit your billing limit, your instances just don't run until the limits reset.

To be fair though, the AWS customer service are always very quick to allow refunds, for small or large amounts. When I first started, I thought I had switched everything off, but something was still running and I got a couple of bills of around $20 over two months. When I complained, they refunded it, and were very nice about it. The are lots of cases online where they have refunded over $10,000 in fees to people who left their keys on github.

Maybe they figure the refunds are just the cost of doing business? However, I would prefer not to have to rely on the possibility of their post-hoc generosity when I do something equally stupid in future :)
ES6 in Depth: Subclassing
Who exactly wants those laws in your state? If the answer is "nobody", then get your neighbors together and fix the problem. And if there is somebody who wants those laws, at least you'll know who the problem is, and can start raising public awareness of who is needlessly keeping them from having better Internet.
F# exceeds C#'s capabilities in essentially every way. The only time C# does much better is when you need the VS drag n drop GUI tools. Some folks also feel more comfortable doing certain types of very imperative code in C#.

Other than that, sometimes there are problems with libraries that specifically target the C# compiler's exact output. Examples are functions that take an object, then dynamically look at the property names instead of just using a dictionary (F# can do this, just isn't a major focus like in C#). Or poorly written expression tree code that only works with C#'s output. That said, the F# community can often find a fix.

Once you adjust to writing so much less code, it's very hard to enjoy writing C#.
SubToMe makes it easy for people to follow web sites because browsers dont do it
Getting started with ECMAScript 6
Well, no, that is not precisely what you are doing. You are asking for pen-testing. Zajd is saying you need to 1) let the community audit your source code, and/or 2) rewrite the website using modern development practices. An example already mentioned here is that passwords aren't handle with current best practices.

Appears that zajd's original comment has been down-voted a lot, but I'm not sure people know that Project Euler has been struggling with hacking for over a year. Maybe time for more than patches.
>Reflects well on the EU that she was elected.

It would, if hers was an elected position :P

The European Commission is a bit of a strange beast. As is the rest of the EU, to be honest.

The Commission consists of the President of the European Commission, the High Representative of the Union for Foreign Affairs and Security Policy (effectively its foreign minister), and 26 other commissioners.

The President of the European Commission is elected by the European Parliament[0], and the High Representative is then chosen by the European Council[1], with the consent of the Commission President, who cannot be from the same country as the President and will be one of the Commission's Vice Presidents. The other 26 Commissioners are then appointed by the unrepresented Member States, so they each have one Commissioner.

The Commission President then assigns each of the Commissioners (except the High Representative) a portfolio and then the entire body is subject to a confirmation vote by the European Parliament before it can take office.

[0] It can't just vote for anybody, though, the European Council technically has to propose a candidate "taking in to account" the results of the results of the election to the European Parliament, although in 2014 (the first time they had the opportunity since the rule was introduced) Parliament successfully managed to establish the precedent that the Council must nominate the designated candidate ("Spitzenkandidat") of the European Political Party[2] that won the most seats at the election in the first instance.

[1] The European Council is the body consisting of the heads of state and government from the EU Member States, not to be confused with the Council of the European Union, which consists of ministers from Member State governments, and the Council of Europe which is a distinct organisation.

[2] European Political Parties aren't political parties in the same way they are at national levels - they are more coalitions or federations of national political parties - and they are also distinct from political groups in the European Parliament.