skysight-inc/HackerNews huggingface dataset:
I am not security pro, but I wonder if server-side installations of PDF.js are exploitable? WordPress plugins using PDF.js, can these become a new vector to attack webservers? Case, site uses PDF.js plugin to render pDFs for users. Is it possible to access server filesystem through PDF.js?
I think it depends on whether you think justice should seek truth or some sort of malleable truth theater. Causing an actual criminal go unpunished when extremely convincing evidence of guilt is known (but concealed from the jury) only further harms the victims.
Which leaves criminals where?
Ryan Stewart’s Content Marketing Dashboard
>> I'm not sure who makes me more cranky: Apple for apparently sitting on the fix, or Stefan Esser for flinging the vulnerability into the breeze for anyone to catch.

> One party makes billions off their users, and will most likely continue their practice of not supporting 3 year old systems even if they are still in wide use for the next time. This should pretty much clear up who is worse.

I don't agree. I have a six year old Macbook. In those six years I've updated to a new OS about three or four times. One time it has cost me 20 euros, the others were free. Not only that, but updating is a breeze, it's painless and never was a problem. I never had to do a complete reinstall. My mother could have done this. It's clicking a few buttons and that's it.

On top of that, there is no serious degradation in speed. They claim it's even faster, but that probably isn't true for the older hardware. So even if they don't support their three year old OS, you can update your six year old system to the most current one without problem. They could have served these updates as minor ones, but that wouldn't be fun, nothing to show, no new names, no big shows.

Now tell me - what is it that they don't support?
4. How are "text files" in "text files with “pass” and “access” in the names" identified? "file" command? Extension?

5. Can we get a full list of all the "usual global configuration files" to aid in looking for a pattern in atimes?
3 Essential Takeaways from the MIT-Microsoft Bitcoin Talk
Thanks, that's some very nice feedback.

We're thinking about improving the navigation to / between projects and groups. We'll probably do something similar to your suggestion in the coming months.

We're trying to move as many things from gitlab.rb to the admin interface. We add more every release and intent to make (almost) everything available through the UI.
Code crap
BLAKE(2) is not open to length-extension attacks---in fact resistance to those was a requirement of any SHA-3 submission. Its design does not have much in common with MD5 and SHA-1 beyond the usage of the compression function building block, instead of a public permutation as sponges do. The mode of operation of BLAKE is not Merkle-Damgard, but a variant of HAIFA.

As far as security goes, Keccak and BLAKE are mostly in equal standing both in security margin (number of rounds attacked vs total number of rounds) and cryptanalytic attention received.
ICANN Resets Passwords After Breach (VIDEO)
Great article! This gives an excellent overview of NP-complete problems, the difficulty of constructing hard instances, the critical ratio in determining the solution count, and the analogy to physical systems' phase transitions. Also gives some intuition on why the greedy algorithms can be good enough in pracitce and when they wouldn't be.
When I see the approximations needed to count the 7 billions humans actually living on earth, I smile at the 110 billions number.

The honest answer would be : we have no actual clue on how many people ever lived on earth, and we can only guesstimate how many are living on it right now.

Census only register people that let themselves be registered. It's probably mildly inaccurate in rich countries and terribly inaccurate in poor or chaotic countries.
Free trade unfortunately also leads to what is called a "branch plant economy" where policy decisions are made by foreigners with much less interest in your national or regional success.

Trade makes everyone better off, in general, but is risky, because policies can change. Free trade in particular gets even riskier as it means the populace has fewer levers of influence against the corporations. Canada is experiencing this with auto manufacturers - many Japanese and American (some German) companies build cars in Canada and Mexico for the broader North American market because of North American free trade and lower labour costs in both countries (the exchange rate, single payer health care in Canada, more reasonable unions, etc). But now so many jobs depend on these companies, the Regional Governments can't let them leave in economic downturns. So they subsidize. Is this all a net positive? Probably, but it's hard to know.

When you accept the upside of trade you need to accept the downsides - but most don't. "Let the free market choose" isn't an answer because we live in a Democracy, one feature of which is to prevent the market from getting what it wants when the people don't like it.

The USA dominates technology with only a few counter-examples in Europe (SAP, Amadeus, ASOS) - but LOTS in China. If the future is going to be these companies diversifying into every other market ("software is eating the world") you can bet there's justifiable anger at the U.S. (At beating them in a new area of knowledge and practice) and a desire to put up barriers while they get their shit together as China did.

This isn't war, it's competition. There's a big difference.
How the US Military Helped Invent Cheetos
Why Ice Delays Recovery
Are content and inbound links the only way a new startup can get some SEO creds?
We should be able to make "Security Groups" where we can apply less-restrictive settings (JS on, cookies) to trusted sites.

The Internet Explorer security model has 4 levels (Internet, Local Intranet, Trusted Sites, Restricted Sites) and you can choose a preset security settings package, or build your own, for each level.

Maybe Chrome/FF/Safari need something more similar to that, where we can specify different groups or levels, and then assign those to websites we visit.

The biggest problem with the IE method is that the UI is more tedious to add a site to a zone in IE11, than to add a site to the JS whitelist on Mobile Chrome.
Did Virtual Reality Just Have Its Google Glass “Shower” Moment?
Photos free to use anyway you choose
JavaScript and ML couldn't be further apart.
And software licenses must be protected in some way even though they strike me as intangible and 'mingled' with a third party system. Unless the actual sticker with a bar code is material enough. Interesting.
So if suddenly facebook didn't let you delete your posts that would be ok?
Embedding a Polymer (JavaScript) App in a Go Binary
The exploit basically uploaded the contents of a bunch of sensitive files to some server. Besides uploading the full list of files in the User directory (not the contents of the files) it uploaded the contents of the following files:

Linux:
/etc/passwd,
/etc/hosts,
/etc/hostname,
/etc/issue,
.bash_history,
.mysql_history,
.pgsql_history,
.ssh/known_hosts,
.ssh/authorized_keys,
.ssh/id_sa,
.remmina/.remmina,
.remmina/.pref,
.config/filezilla/.xml,
.filezilla/.xml,
pass.txt,
access.txt,
.sh,
.config/psi+/profiles/default/accounts.xml

Windows (in the User directories AppData/Roaming and Application Data):
Subversion: config, servers, auth/svn.simple/* , auth/svn.simple/* .*
SmartFTP: Client 2.0/Favorites/Quick Connect/* .xml
Psi+: profiles/default/accounts.xml
Notepad++: plugins/config/NppFTP/NppFTP.xml
.purple: accounts.xml
s3browser: * .xml, * .settings
FileZilla: filezilla.xml, sitemanager.xml, recentservers.xml
FTP Explorer: profiles.xml
FTPRush: RushSite.xml
FTPGetter: servers.xml
FTP Now: sites.xml
FTPInfo: ServerList.cfg, ServerList.xml
GHISLER: wcx_ftp.ini
Ipswitch: WS_FTP/Sites/ws_ftp.ini
VanDyke: Config/Sessions/* .ini
Here's a nice example of a regional success story from MN. The area around Winona (a town on the Mississippi river between the Twin Cities and Rochester) has a growing cluster of businesses that work with composites.
http://www.mprnews.org/story/2015/08/07/composites-winona

Kansas wants this kind of development but doesn't want to put priority on environmental protection, outdoor recreation or the arts. All are important to the Winona story - as is the presence of a state university in the town.

I'm an 'expat' Kansan who now lives in MN so I have a deep appreciation for the difference between the two.
A beautiful aspect of our lives reduced to narcisistic, transactional, dehumanizing consumption.

I realize the article was exaggerated, but I have run into people like that in real life.

Depressing.
The advantage of touch typing is on a good keyboard/desk/etc you can do it 10 hours a day for 30 years without wrecking your hands. That said, most programmers don't actually type that much so it's not nearly as important.
The sum of 90 numbers in this context is considered to be easy (esp relative to finding the sum of many possible subsets).
This is amazing, thank you!

I'll start working through it and see what we can do. I'll follow up by email!
There are plenty of reasons anti-American sentiment is growing in Europe and it goes much, much further than a few tech companies.
> Puma is great if you have a Ruby implementation without a GIL

Puma is also great if you have blocking IO like database queries or file uploads which most ruby/rails apps do. The GIL is released when Ruby does IO so it can context switch and run other threads.

> there is actually no deployment configuration of Puma which makes sense under MRI

I disagree, puma makes lots of sense on MRI but it is app specific. By this same argument Sidekiq would be worthless on MRI but it's the dominant work queueing library even though it is solely threaded. In my experience Puma with MRI using "hybrid" with clusters and threads is faster than Unicorn (or rather you can get more throughput and less queueing). However it's app specific. If your app is mostly doing number crunching in Ruby code and not touching IO, then the GIL never gets released and you don't gain much by using threads. Again most Ruby apps use a lot of IO.

> anything that's computationally heavy will cause the other requests in that process to run slowly.

Exactly.

One of the main reasons I pulled recommendation for Unicorn was it's lack of slow client handling, it doesn't help to have a fast webserver, if all your workers are...waiting...on...bytes...and...can't...do...anything...else. Nginx handles slow clients for you so nginx + unicorn is good, it's a harder deployment configuration and it's easier to tell our customers to configure one thing instead of 2, especially if that 1 thing yields better results for the majority of use cases.

I'm glad you got things working with nginx + unicorn. I'm a big fan of loading up PX dynos with lots of workers :) I hope some of the above helps clear up a few points for future readers. I always encourage people to try different options and take our recommendations with a grain of salt. It's also why we've kept our Unicorn article so that anyone not happy with puma performance can try another webserver. Thanks for sharing!
It's certainly a factor for many people. But frankly the way you've phrased it is pretty offensive to me - a non-obese person with severe central and obstructive SA.

You're also forgetting the confound that being chronically fatigued and having a screwed up cortisol, blood oxygenation and glycemic index (all due to lack of sleep), makes losing weight extremely difficult.
Primarily because other then some open source ROMs, I've never seen a AOSP build that wasn't hacked to oblivion by our friends at the chip companies with little glue logic that doesn't fit. Systemd would natively support all of these things and there would be less hackery at the vendor levels let alone the strange way things are inherited from system to vendor to product levels.

To understand the android property system would be somewhat trivial, getprop, setprop, watchprop. Again, I see so many hacked properties by hardware vendor to manage hardware state like wifi on or what not.

I've never met a person with a good understanding of the Android init system and thought "oh this is nice" or even close when compared to upstart, launchd or systemd (SysV init bash madness is dead thank god).

Besdies, the world could better with a little less fragmentation. Imagine a world where you could develop Android product and then re-use a fair chunk of the init system for your hardware development/validation/burn-in test platform.
I find the first sentence fascinating, "Yesterday morning, August 5, a Firefox user informed us...".

I'd love to know more about this person and their skill set. How was the exploit detected and isolated? How did this issue get reported and resolved in s day?

Assuming the Mozilla way, I wonder what the bugzilla report will read when it comes out of embargo.
It's only as cumbersome as you choose to make it.
"Opportunistic attitude" looks too much like "confirmation bias" to me to be comfortable with it.
Previously: https://news.ycombinator.com/item?id=8599640
But choosing a different default PDF viewer does not necessarily “disable” pdf.js, or does it? Does the exploit just show a malicious PDF file and then relies on Firefox using pdf.js to display that file, or does it somehow “request” pdf.js be used?
>kick out the Americans!

Anytime someone wants to kick me out I take offense. He's talking about kicking out all American companies and making their own tools as a replacement. How is that not Anti-American?
If I'm understanding this correctly and it is just a package shipment being re-directed 7 times, I would say that the title is misleading. At first I thought that a (flying?) robot was actually crossing the ocean 7 times by itself, with some sort of AI that was "trying to get home". That's a far more interesting story.
This is a bad way to be clever. Just feed your cat.

Do you think the cat enjoys having to learn and then implement your arbitrary rules everyday in order to eat?

Just imagine making your child go on an easter egg hunt every time they were hungry. How long would the fun last?
> Bus routes are not supposed to replace train routes. It is by design that bus routes are longer, buses are meant to service areas not accessible by train.

I agree! I only mean that, when making a map of public transit coverage in a city, it might make sense to recognize that bus transportation is, in many cases, very inconvenient to avoid the impression that everyone is served equally.

I left New York before Bus Time was introduced, but I'm glad to hear it has improved the experience of waiting for a bus.
Litegl grew as the requirements of webglstudio grew. I encourage my students to do not use lubraries so they have full control of ehat they do. Thanks for the compliment :)
It would appear Consumer 3D Printing is still in the 'Trough of Disillusionment' phase of the Hype Cycle.

https://i.imgur.com/tx3c3Pz.png

https://en.wikipedia.org/wiki/Hype_cycle

https://www.gartner.com/doc/3100228
I wonder if Firefox is going to disable itself.
How much does ECMAScript 2015 cost?
Interestingly, based on the fastest crossing of the Atlantic by ship, the same feat would take just over 24 days by sea using a transatlantic liner (which don't really exist anymore as they were obsoleted by the 747 and replaced by cruise ships). Of course it's not in any way a direct comparison because one flight across would take <8 hours, but I just figured the crossing by sea would take much longer. By sail it would depend on the boat - 19 days for a small vessel averaging 5 knots a day, a week for a larger one averaging 12 knots, and 3.5 days for a racing trimaran doing 30 knots.
Nop. But i have done 2D editors in flash before
CHIP on HN:

https://news.ycombinator.com/item?id=9513850

https://news.ycombinator.com/item?id=9933226

https://news.ycombinator.com/item?id=9505807

https://news.ycombinator.com/item?id=9831293
> Which is why Apple introduced developer certs and gatekeeper.

Yeah that is a really neat feature from a security standpoint.
Ask HN: Where can I find “unsolved problems” for various industries?
As a developer, I'm interested in working on a problem in my spare time. However, most of the problems I've thought of over the years have already been addressed in my field. I'd like to consider other fields that have problems needing solving, but I'm not really sure where to start other than doing pretty generic Google searches.
Even metalworking isn't so hard to get into. You can get the tools anywhere, used or new, and there's an enormous number of books on the subject. The only power tool you really need at the start is an electric drill. Hacksaw, files, punches, chisels, etc.. all powered by you. No software needed either, cover your part with a fat sharpie (or better yet, blue dye) and use a scribe and punches to mark out what you want to cut and drill.

If anyone is interested in this sort of stuff, check out Adam Savage's "One Day Builds" videos on youtube, they are great examples of the sorts of things you can do with basic tools and ingenuity.
Open data initiative to give true picture of election process
Is there a clear winner in this ranking ? Broadcom have released some documentation on the RPi's GPU while AllWinner have used 3rd party IP that they can't document ({Mali,PowerVR} and Ethernet).
Although not really similar this reminded me of Core War - https://en.wikipedia.org/wiki/Core_War
Hahah those names also came to my mind, as frame, glow, lux. But havent decided. Thanks!
Ok, I guess that I misread the tone of your post (i.e. we largely agree).

I don't however think that the web it that broken without those features (javascript being the harder one to police).
Judging from the browsing habits of my family members, they don't spend nearly as much time inside web applications as the HN news cycle would lead me to believe: some news sites, some webmail (and even there, when presented with a decent looking mail application they happily switched), the most basic functions of facebook, and "utilities" i.e. web banking, traveling, university websites.

None of these uses requires the ability to play quake3 inside firefox, or are really applications inside a webpage. Same probably goes for all the browsers in the workplace, for instance.

I'll agree with you that few sites will do progressive-enhancement (and decent accessibiliy), I'm just disappointed in the defeatist attitude of browser vendors and expert users: the idea of having a browser safe mode that you can lock down doesn't strike me as such an impossiblity and it would give some incentive to developers to put their act together.
Too long!
Really needs tab completion in the editor :P
That's true. However, it is also easy to estimate that sum rather than calculating it exactly, so I adjusted my proof accordingly.
I can't see how it's just a temporary marketing ploy, as your link suggests.

Nobody wants CHIP, they want the "$9 computer". I can't see how they can ever sell it for $39.

As a loss leader, with overpriced accessories - that makes much more sense to me.
Implementations, Simulations, and Abstraction Functions
It's not open source because "open source" is a term with an established definition by the OSI that GitLab Enterprise does not meet.
Thanks for clarifying: I was able to find the vulnerability on the unpatched system with:

$ ls -al /
(etc)
-rw-r--r-- 1 root wheel 0 Aug 6 06:46 this_system_is_vulnerable

So I can a) confirm the vulnerability exists and it can write with root privileges.

and b) the patch works: I ran the patch, deleted the test file, rebooted and the file is no longer able to be written.
Well, the successful ones have a grouo of people (ie: managers) determining what gets added. The others are a mess.
Upcoming Oculus PC SDK 0.7 Compatibility Changes
I'm surprised that hobbyists building their own printer aren't going for the patented laser methods that actually make high quality parts. Surely you can make your own copy of a patented item, just not sell it. Even if you're not allowed to, nobody's going to know.
Classic humans.

We are being overrun by robots! I guess we could build a robot tank to fight the robots...
Finally! It only took 5 years for someone to finally make it. - https://news.ycombinator.com/item?id=1538171
In a way, yes. Other similar language features include traits in Rust and typeclasses in Haskell, in my understanding.
I'm afraid you missed the point.
It's not easy for corporations to give money away; this is why there are often foundations started to handle charitable giving "associated" with a corporation. As a non-profit, it is much easier for The Linux Foundation to give away money.

If OpenBSD (really, Theo de Raadt, the way things are currently structured) could offer a product for sale (e.g. a service contract or something similar), then it would likely be much easier to get money from e.g. Microsoft. Corporations pay for software and services, they do not give money away. Money goes to invoice-senders.
The Web Tools Every Designer Should Use
Just a question
A web-like structure prevents genetic mistakes during the cell division proces
Could this exploit also be used to write to files? I have a feeling that it probably could, and that makes it even scarier.
Show HN: Is it vulnerable? Drag-n-drop your Gemfile.lock to check
Show HN: Rank your engineering management strengths – Steps to improve
Now you mentioned it also passed my mind to scrap DOM and use my own gui, lots of advantages but im worried it will slow down the development. Indeed all the timeline editor is a canvas. Its worthy to consider it.
Bitbucket is awesome. I'm using it for all non-essential repos that I have as a side/small clients projects. I'm paying for 5 private repos on GitHub and whenever I see that I don't use a repo that often I just move it to bitbucket ( I'm such a bastard customer - I know ).

Two examples, why I don't use BitBucket for big projects and essential clients :

1. Interface is not that good - e.g. makes it hard to manipulate issues.
2. Integrations with some CI is not as good as in GitHub.
I don't know, at least if the evil cars turn bright red we'll be able to spot them easily ;-)
Great resource! The scrolling is weird on mobile safari. May be missing some -webkit-overflow: touch to the scrolling element.
CPU

1 core works for under 100 users but the responsiveness might suffer
2 cores is the recommended number of cores and supports up to 100 users
4 cores supports about 1,000 users
8 cores supports up to 10,000 users

Memory

512MB is too little memory, GitLab will be very slow and you will need 250MB of swap
768MB is the minimal memory size but we advise against this
1GB supports up to 100 users (with individual repositories under 250MB, otherwise git memory usage necessitates using swap space)
2GB is the recommended memory size and supports up to 1,000 users
4GB supports up to 10,000 users
'Eric Shit' is the latest tech CEO to get a portrait made out of poop
How do mere mortals become wizards to their peers? They take the time to read documentation and code and really understand the tools that they are working on. What software projects have stood the test of time? The ones that were painstakingly thought out and progressed slowly. Of course there's a balance, and our current system of financing software projects rewards fast and loose, and there will always be a place for fast prototyping to help understand the problem, but to create something truly amazing takes a lot of time.
Yeah, they're not counting AirTrain. You can get to it from the J, the E, and the A, actually.
Music Programming for Java and JVM Languages
That looks like a great list of documentaries. I might watch few of them this weekend. The website could use ngCloak though as the angular expressions flash for a sec or two before the actual data loads.
Unix Toolbox