skysight-inc/HackerNews huggingface dataset:
Forgive my stupidity but can someone explain why this is so neat?

I see examples that appear to be a links from a Tweet to a product buying page. Is that what's new?

I'm obviously missing something or maybe just not clever enough to get it... Thanks in advance.
If they were so great they wouldn't have to force themselves onto consumers by bundling their crapware into carrier sponsored phones.

Not to mention $10B is probably less than the amount Google alone has spent developing and promoting Android. Please explain how their direct competitor should be entitled to piggy back on that work for free.

Edit: apparently they even have their own 'Yandex Browser' based on Chromium. Shameless.
CSS Scroll Snapping explained
black page with white text...WHY?? *headache
I was not aware of this, so thanks for bringing it up.

It's a pretty amazing technical feat that this works at all, but I have a hard time imagining this would work well in practice for changes to anything other than maybe method bodies and templates though. Java's style of object orientation generally means there's plenty of tight-coupling between application state and operations on the application state, which would probably make life very difficult for any hot-reload implementation.

But regardless, it does exist and apparently works well for a lot of people. It looks like I was just ignorant when it comes to native tooling.
Actually I'd rather use lastpass after they fix the issues than 1pass now. Lastpass just got a serious security review. For all we know 1pass has just as many issues.
This attack appears to require compromise of the client machine running LastPass. If the target were not using a password manager, it would be relatively simple to use the same vector to deliver a keystroke logger, so it's unclear that there is an actual security disadvantage here.
Read some other comments. It is only if you check the store password option and lastpass has been very responsive in fixing the issues since they disclosed them privately.
RIAA sent 100,000 takedown requests to a single website. It's unlikely a human did much scrutiny of that. http://arstechnica.com/tech-policy/2015/09/sharebeast-the-la...

And there are sites that routinely get clearly bogus takedown requests.

Google deleted 200million search results in 2013. https://torrentfreak.com/google-deleted-200-million-pirate-s...
No problem :-) I actually noticed the link was HTTPS (presumably after you changed it) and thought I was taking crazy pills.
> At least they apparently need access to a local machine.

In addition to everyone in the building, the individuals in your IT department have access to your work machine, and can install key loggers easily. It may even be SOP at some places.
It's a bootstrapping process, I don't think they can be accepted as a root certificate until they have proved their automated issuing system it working.

One way to prove that their automated issuing system is working, is to turn it on.

Looks like they have set it up to only issue certificates for white-listed domains in the beta program, and they will switch to General availability in the Week of November 16th.
We changed the URL from http://www.vice.com/read/this-historian-just-found-the-oldes.... The story came up a couple times over the weekend and (strange as this may sound) the Daily Mail version seems to be the best source.
This is a huge ruling for copyright holders because it'll make it much more difficult to use automated software to send out DMCA takedown notices.

That said, it's clearly the right answer. DMCA takedowns should be filed in good faith, a mental state requirement automated software cannot meet. Nobody said protecting your IP rights must be easy.
Well that's bad timing but really, this sort of news is a good thing. No software is perfect and now they can improve upon these findings. Password Managers are still a very valid technology. Better then Firefox/Chromes integrated plain text login stores or using the same password everywhere.

Though, IMO, a password manager which uploads all your password onto a central location with thousands upon thousands of other peoples password is just a really damn stupid idea to begin with.. Even if it's encrypted or whatever.
They bought a product (bootcamp) in the pursuit of a career in software engineering. Odds are they aren't equipped for more than a series of jobs doing webdev scut work.

"Suckers" might be a bit strong, but their expectations may suffer a certain misalignment with reality.
> This not a big deal when pushing layout around a webpage,
> but it can be crippling for app development as the app
> grows in complexity and you crave native-quality
> interactions

Even on the fastest phones, web-based (including wrapped web components) simply don't offer the native experience. They come close, but there's always a slight but perceptible performance difference; and often a visual difference depending on what you're using.

I realize people really like the theoretical write-once behavior that you get for simple apps when using a javascript platform, but I've been waiting for years for web-based interactions to provide native quality - and I begin to suspect we'll never get there.

If you want native-quality interactions, the only solution is a native application and not common tooling via a javascript layer that runs atop the already not-as-performant-for-UI browser level. This makes your life harder as a developer, but gives your users the best possible experience for their platform.

Alternatively, if you're willing to give your users a good-but-less-than-native-quality experience, that's the niche filled by those tools.
I don't understand your point in comparing this work to normative decision theories. The work is explicitly modeling experimental results that have been hard to model with existing probabilistic approaches.

That said, if we find that cognition can be well described by some fairly clean math, we should take a hard look at "normative" models that say it should be different. Up to now the descriptions have mostly had to use a pile of heuristics that could be (handwavingly) justified as "cheaper". But this work suggests a very different picture.
I agree whole-heartedly with the point about post-validation. I work in the field (EC) and the first dozen results you get are usually instances of the algorithm finding where your model or your assumptions are broken. For that reason the "On the Origins of Circuits" link posted in another comment is a really bad example. The results are total garbage because there was no model at all, just an actual physical FPGA. Models are great because they abstract away the effects that you really shouldn't rely on in your design. With out a model, the FPGA optimization gives us an answer that's only valid for one particular FPGA, at a particular point in its lifecycle. In fact, this might be why software optimization breaks --- nobody's figured out how to abstract away the irrelevant effects.
>A marketing manager with assistants and a secretary? Oh how things have changed.

(Assuming that description is accurate) it really wasn't typical for the time. That said, compared to today, there were still a lot more secretaries and assistants floating around given the (mostly) lack of email/calendaring, web-based information of any kind, and general friction associated with just about everything. I sometimes half-joke that if I went back to my product manager job starting in 1986, I'd quit in a week out of complete frustration at the lack of tools and information to do my job.
I've tried out https://www.grammarly.com/, but I didn't find its suggestions helpful, and often it had no suggestions. The latter was disappointing because I know I'm not that skilled in grammar.
There is a sentence near the end which suggests this puts limits on "theory of everything"-- I'm not sure I believe the result is that strong-- it seems that we could come to understand all the rules of the universe, but could never make a precise prediction due to the limits on what we can measure about its state.

Also, more than to the uncertainty principle, this seems connected to the Halting Problem and Goedel's Incompleteness theorem.
ZeroCater is hiring a Head of Product
I'd say mainly that you don't have to wait around for the user to go to the sites you are interested and look for passwords in a long string of keys.
Does anyone know how well F* interacts with the .NET framework, if at all? Or unverified code in general? Can you "wall off" the unverified code by stating a bunch of assumptions about how it works?
I dropped all plugins. I open the app each time I need a password. Slightly inconvenient, especially at presentations where I had to type the master password and noticed attendees dripping off since it was too long, but this is a situation I am not keen on optimizing on.
This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive.

The only thing that regular-style certificates verify (this is what current CAs do, you can also grab a free one with automatic validation at https://www.startssl.com/) is that the person who controls the domain name has requested the certificate. This is usually done by serving a specific file over HTTP once, setting a TXT DNS record or responding to mail to postmaster@yourdomain.tld
Don't use the browser plugin "Store My Password" functionality and you're fine. They offer the feature as a tradeoff: lose some security in exchange for convenience. It's very plain and always has been that the master password is the "key to the kingdom" and the only place it should exist is in your head. Anywhere else and you've opened yourself up to attack of those secondary locations - your wallet, your home, your spouse, your browser, your phone, etc. Evaluate for yourself which of these you think is secure and which isn't.

LastPass is so much of a win for the average user that even with this feature enabled, you are still better off than using the same username/password for every website which is the norm. This thread will be full of people recommending alternatives and there will be solid choices. I will keep using and recommending LastPass.
Wide-area multicast is usually one-way, which is much easier: each router only needs to know each which streams are to be fanned out to which of its nearest downstream neighbours, and where to forward upstream multicast group join requests.
I wish it offered using symmetric crypto - so I won't have to find ways to secure a GPG key...
Press the raw button and it should download.
After reviewing this service for password sharing among coworkers (yes it it still necessary for a few parts on a server) I have big doubt in security of Lastpass. Turning on 2FA did not worked most of the times and user experience without their browser plugin is very bad. So I analyzed their page sourcecode and saw everywhere PHP which was also failing sometimes (see the 2FA). Sorry but I will never give trust to a password manager written in PHP (no offense against PHP, but please not for my 100% secure passwords!)
That's a great example, I'll have to keep it in mind. I'd never thought of such a great example that clarifies how strong the security is, and how it's orthogonal to the trust model.
Full Disclosure. I am a former LastPass employee.

This guy's research, and most research regarding password managers is way overblown. Every lp product has a big popup that says "WHAT YOU ARE DOING IS INSECURE" when you click "Remember Password". Having secure defaults are something they are very mindful of.

All password managers are toast if you have someone else on your box. It's baked in to the threat model.
It's a pushed to get more users to rely on iCloud. This still sucks though because you can't store apps in the cloud and it nice to have music locally (though Apple Music seems to cache) when riding on the subway / dealing with AT&Ts poor connections.
True, but this is sort of academic when we're talking about protecting secrets on an already compromised machine.

I don't think this is a reason to not use LastPass.
That's only one possible interpretation of computing. The field of semiotics applied to programming has interesting uses where a program needs not be unambiguous to be useful.

It's true that the underlying hardware platform will necessarily work as a deterministic sequence of steps executing a small set of primitives - but building that sequence by hand in an unambiguous language is not necessarily the only way to control the hardware; learning methods and evolutive processes, vaguely directed from high-level goals stated in an ambiguous model, is a possible alternative to the current industrial paradigm and might become common in the future.
I know web devs who have taught themselves CS fundamentals and the stuff you mentioned, but they started with boot camp doing Rails. And why not? They were able to teach themselves this stuff while working for a good salary and getting experience for their resume.
We've had two separate repos for iOS and Android and we're merging to a common one. It's much easier to manage, especially when sharing C++ and now React Native JS code between iOS and Android apps (e.g. the Ads Manager).
You are testing and returning, and responsible for propagating the error in your example, and have a chance to forget to do that. That is what IMO keeps this from being a general purpose exception. That you could correctly check the error return in one subroutine, but forget to in it's parent is the issue. Each approach has it's benefits and drawbacks. Automatically jumping to a cleanup routine means you can't forget to handle it, but also obfuscates control flow. In any case, I view it as an integral feature of exception handling.
Can't help with the question, but I have to ask: you're not a native english speaker?? You have zero grammar problems in this post (and only one spelling error: extend for extent). Where are you from? What would you consider your primary languages, and why don't you include english? Unless you had someone write your comment for you, I wouldn't worry about this at all.
I've posted this before, but as the subject keeps coming up:

(defun cc () "Secrets File" (interactive) (find-file "/home/ajross/.cc.gpg"))

Launch with "M-x cc" and edit/copy as needed. Your Linux distro's GPG integration is going to cache the credentials appropriately even if you delete the buffer (which I usually do just out of irrational paranoia), so you can use a nice long pass phrase without hassle.
https://defuse.ca/audits/encfs.htm is an EncFS security audit, that didn't come out too clean. If you install encfs on debian it pops up a warning screen telling you to not use it for anything too sensitive atm.
It's probably worth noting, this exploit requires the user to save their master password locally.

While it's not obvious from the blackhat blurb, it's stated by the author in their more detailed blog post [1]

Additionally, this behavior is something that LastPass advises against:

"Are you sure you want to have LastPass remember your password? This will significantly decrease the security of your LastPass account!"

[1] http://www.martinvigo.com/a-look-into-lastpass/
>>Presented here are pages from the highly sought after, but never published for sale, 1982 DC Comics Style Guide. These images were used for marketing and licensing while also serving as reference material for other artists.

It's not so obvious to me he's breaking any law. Yeah, he doesn't have rights to publish detailed character drawings, yadda yadda. But is that what he's doing? He's posting digitized excerpts from a freely distributed, 33 year old style guide. Is that the same thing?

Those are sincere questions. You seem to know a lot more about this than I do. I honestly don't know what terms would come with that style guide in 1982. I know some modern "style guides", say mobile HCI guidelines, are copyrighted but can be redistributed.
agreed. some people still think that you should get out of college and be ready to make 90k in the exact area you studied. That's just not the case with so many areas of study. You can make your way into some sort of company or agency or partner up with a fellow student and start to consult. You might only make 35k for a while but that's how it works. If people know that going in, they probably would budget how they will spend on college in the first place a little better. Maybe they woulnd't accumulate 100k of debt if they knew they'd only be making 32k for the first couple years and have to buy a vechicle on top of that.
So Apple is selling a pink iPhone, which has "cautionary indications for our current moment...marked by overheated, precarious global economies; injudicious, unsustainable disparities of wealth; and a metastatic consumer culture."

I didn't know colors had that much effect on society.
Your approach sounds interesting. Ever write about it?

The undo / redo gains of ImmutableJS quickly vanish when you're working with remote data and the leaked getters aren't fun. A little UUID juggling is worth it if it allows my components/reducers to work with plain old javascript objects and still get fast shouldComponentUpdates.
A google search did not return meaningful results, so pardon the dumb question: What does the store password feature does exactly? Is that a way to remember the password like usual browsers do? I use 1Password and I don't think it has this feature?
I don't see a problem with remasters if they're done right (The Last of Us and GTA 5 on PS4 are a couple such ones that comes to mind). Unfortunately, a lot of the time they're just handed over to second-rate developers and/or not given them enough resources to do them correctly.
http://savannah.gnu.org/bugs/?group=grep: "48 matching items - Items 1 to 48"

https://bugs.freebsd.org/bugzilla/buglist.cgi?quicksearch=bs...: "15 bugs found."

Not all of these are bugs, but there definitely are bugs in populair implementations of grep.
Neither did the layout work when transferred to an identical FPGA.

Now that is quite fascinating. (The article goes into possible explanations, for those who care.)
It's perfectly acceptable in print. This article was probably written with print in mind.
The 1password keychain is of course encrypted[1] (I think[3] that dropbox syncing uses the older agile keychain format?). I personally sync my 1password keychain with icloud. Apple claims[2] that iCloud data is encrypted during transfer, as well as encrypted at rest. If I was more concerned about that aspect of it, I would probably just sync with wifi.

I do not use the browser plugin (personal preference).

[1]: https://support.1password.com/opvault-overview/

[2]: https://support.apple.com/en-us/HT202303

[3]: https://support.1password.com/switch-to-opvault/
It seems dubious that there is a real vulnerability here.

The authors talk a lot about how you can get everything if you compromise the client machine, but of course if you compromise the client you can compromise everything.

Just install a keylogger to get all typed passwords, send the decrypted hard drive image over the network and run it in a VM proxying network traffic via the compromised machine, no need for any targeted attack.

The fact that they focus on that rather than on an actual interesting attack makes me believe that there is no real vulnerability whatsoever.

"We also found how it is possible to abuse account recovery to ultimately obtain the encryption key for the vault" is really scary, but if it were accurate they would be talking solely about that, so maybe it's just a phishing attack.
Yeh computers never have problems.
who the fuck upvoted this back up from being negative?

mahouse, I recommend growing up. running around writing crap like this and saying "TRIGGERED" as if you're some genius hilarious douchebag just makes you look like an ignorant loudmouthed child.
Do you really believe the facebook production app is built 100% with React Native ?
I used 1password before, but several times I lost access to all my passwords after upgrading the software. On the bright side, I was always able to restore access to it by manually downloading 1password and reinstalling 1password. Besides, 1password does not officially support Linux. That's why I wanted to try Lastpass. I also find the yubikey support interesting.

Well, I guess, it's time to reinstall keepass2 again.
Can we stop with this fucking "ninja" shit already? I'm a professional. I have to study constantly to stay informed of improvements in software development methodologies. A successful software engineer has to engage in continuing education on the same level as a doctor or lawyer.

Do you search for legal representation by googling "law ninja"?
As far as I can see the question being addressed is which models best explain experimental results (at equivalent model complexity). If quantum(-like) probabilities pay off let's use them.

Up to now the models have mostly been a heap of heuristics but those produce models with lots of degrees of freedom that don't generalize well.
That doesn't even sound like a datapoint on the theoretical/vocational line, it sounds like just a shit CS department that doesn't deserve accreditation.
Its definitely hard, but JRebel has had 7 years to figure this stuff out and so far seems to work just as well on Android.

Only one way to find out tho :) Trying it out for oneself.
Eh. Science can't even make a good sugar substitute...
Well, it has `go get foo` which I'd consider a kind of installer/package manager. That's what I'm referring to since I've seen a good chunk of Go software distributed this way. The README usually says "install Go, then run `go get foo`".

Edit: in fact https://golang.org/doc/code.html refers to this as "Remote packages".
The New Peter Principle
An nvALT (and more) status report
You should read back over their blog to see how much planning has gone into this so far. This isn't a single-file LAMP app running on a VPS, they're setting up a CA trustworthy enough to have its roots in all the major browsers
> This is not what regular style certificates verify. That is what Extended Validation certificates verify and they're not issued by letsencrypt.org and generally are a lot more expensive.

I'd like to see LetsEncrypt move into this territory though. What current private business providers are charging for this service is border-line extortion.
He's represented by law students? This puts the image in my head of Amanda Seyfried arguing in open court that a teddy bear has rights. I'm actually surprised his case got anywhere, never mind to this level of victory.

No disrespect to any law students, but if you're going to step to the national security state, your law game had better be "A".
The weakest spot against targeted attacks is probably the fact that a 0-day in your browser compromises everything.
Agreed. I use lastpass and don't plan on stopping unless something major (that isn't fixed quickly) comes out.
> because of how they're created (i.e. you generate the keyset yourself locally, they sign the public part), it should be secure.

Note that if the CA has the authority to sign certificates, they don't need your private key. They can just locally create a CSR for your domain, sign it, and have their own equivalently valid certificate for your domain.

Moreover, in the absence of HPKP, any CA can do this for any domain.
Yes, you do. Facebook wrote an example GraphQL server[0] on top of Express.

[0]: https://github.com/graphql/express-graphql
According to TFA, Firefox already trusts this cert.
People are still creating new interactive fiction on range of old to modern engines. See "The Interactive Fiction Competition" http://www.ifcomp.org/ and look at past winners for a taste.