skysight-inc/HackerNews huggingface dataset:
For apache:

- Disallow writes to /etc

- Disallow reads of .htpasswd (this would require Apache to rely on a helper to do authentication out-of-process, so not that simple.

- Disallow writes of .htpasswd and .htaccess.

- Disallow writes to all config files evaluated by Apache (if they happens to be outside of /etc)

- Disallow writes to /bin, /sbin/, /usr

- By default disallow network connections to most ports (and yes, you can't prevent connections to the users databases, but preventing an attacker from port-scanning your internal network and trying to connect to other services that may not be sufficiently secured too would be helpful).

- Prevent inbound connections (e.g. lets say someone gets local code execution as the Apache user, and the server isn't sufficiently firewalled; congratulations, you're now running a remote shell that the attacker can use to do more indepth probes for other holes).

- By default disallow writes outside of document roots and a reasonably permissive set of scratch directories (this would probably need a switch to disable, but most won't need it).

Apache could also easily read its config before applying the rules, so adapting the rules to the config files is possible.

(some of the above will hit things like panel applications etc., but the vast majority of users won't run into them and so won't have a reason to disable them; unlike SELinux, the app developers also have the option of not providing a way to blanket disable the security, but instead provide config directives to whitelist directories that fits cleanly into the existing config system).

But for a very specific example of where pledge could have helped and where it'd have been much easier, here's a report of a remote root exploit in exim [1].

This root exploit consisted of using a buffer overflow to overwrite a config file that would then be evaluated, including macro definitions, as root.

If exim had been able to deny the inbound SMTP part to write anywhere but the mail spool this buffer overflow wouldn't have been exploitable (and yes, this case is simple enough that it would have been achievable with chroot() too, so it's more of a generic example of where voluntary restrictions are useful, not just pledge in particular)

[1] http://blog.iweb.com/en/2010/12/security-exploit-identified-...
Bullshit article
Sorry I missed one thing you can get notification of profile pic update of any one be it your friend or not
"Jeff Dean's resume lists the things he hasn't done; it's shorter that way."
Love the grim reaper slowly moving when your deadline is almost due!
> For how good Chinese manufacturing can be just look at your apple computer.

The difference between Apple and FAA? Apple has nearly unlimited resources, so they can be present on site to make sure quality is top notch. FAA does not. Oversight makes all the difference.
No no you got it little different, you can get notification of profile pic of anyone ( you have choose ) be it your friend or not
> I spent hours and hours in 2007/08 watching Obama with the hope that change is real this time. And now, it's painful just to hear his name. With the current candidates on either side, just bracing for worse.

# Don't tell me that some power can corrupt a person; You haven't had enough to know what it's like!
This article is based on a premise that is either incorrect or has not been defined or settled in law.

The data protection law exists for the protection of personal data, defined as "data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller"[1]

If the airport authority is not gathering any other information beyond the device MAC address, and is not connecting that information to other information sources (such as MAC addresses gathered from WiFi registrations) then the MAC address cannot be used to identify a living individual.

Now, we all know that there is a correspondence between such a MAC address and a single individual, just as there is with DNA or fingerprints or footfall pattern or voice analysis or facial recognition, or car registration numbers or any of a number of other identifying characteristics. However, the law does not concern the gathering of data (however unique), merely the gathering of personal data that identifies someone in conjunction with other data in the possession of the data controller.

Just because that data could be used to identify someone (in a different system) does not mean that it is covered under data protection obligations in this system.

[1] https://www.dataprotection.ie/docs/What-is-Personal-Data-/21...
Is it illegal in the US to build your own railgun? I know that in Germany there is a limit on the Joules you can put in a projectile without a licence, I think something like 8 Joules. This gun would violate that, I guess.
The guy who sells me ram suggested I don't buy two of the same 4gb modules but the 8GB(2x4) kit of the same brand for £1 more as they're tested together. Read into that what you will.
>I read this same refrain over and over, and if I peer just a little bit between the lines I think I perceive a common pattern. A lot of these people are just not up to keeping up.

Yeah, but should they be tossed aside for that? And should everybody be expected to keep up against fresh-out-of college people?

Maybe the speed of technology change can be a problem, especially if it starts putting out of a job more people than it employees, and no counter-measures (e.g. citizen's income, etc) are in place.

Not to mention that a lot of this "technology change" is just changes in fads, and there were perfectly good technologies 20 and 30 years ago that are even better than the latest BS du jour at what we do now. Just ask pjmlp!
True Story of How a Chairman at McKinsey Made Millions of Dollars Off His Maid
Maybe touching to lips gesture is a body language sign of not telling the exact truth:

https://youtu.be/90-S1M7Ny_o?t=2043

He says "I don't have anything to announce" so technically not lying.
One thing I do at least once every 6 months is freshen up my CV and apply for jobs. The process of looking at job postings, talking to recruiters and noting what you're getting the most calls/emails about can help you decide where to focus your energies in the next 1-3 years and/or spot trends early.
“Write a ton of code. Don’t watch TV. ”
Just get the additional RAM from the same vendor (or Crucial or Kingston). Your mainboard will automatically change the settings to the lowest common detominator so it will work just fine.
A bit of a misleading title, in the end he had a 32bit installation of Windows... he upgraded to the 64bit version and everything was fine. No RAM to blame.
The Drone Center’s Weekly Roundup: 11/9/15
Sacrifice three less-important spies per week? From 1964 to 1989? That must have been some amazingly amazing things they guarded if they were worth that sacrifice.
Agreed.

Odds probably the RAM was mismatched, and the BIOS did not choose conservative settings. Also could be voltage mismatch, and then your low voltage modules could fry (unlikely though).
Why is this on HN? Seriously a blog post made up of reaction images with no concrete facts and the strangest conclusion.
This is always impressive to me, I didn't realize a thing until "tlaknig"!
Although I suppose you could specifically train an AI to recogize this.
Swansea Accountants and Tax Advisors
Ask HN: Any open source filepickers similar to Filepicker.io?
Are there any good open source filepickers that are similar to that of Filepicker.io, but opensource - mainly usability/thumbnails etc... as features?
The "traditional" way of achieving something like this on Unix-like systems is indeed to fork and use the various available mechanisms (different uid's, chroot etc.) to reduce the attack surface but the problem is that it's a lot of work and the classic API's leave you with relatively limited opportunities to relinquish privileges.

Qmail is a good example of this philosophy: Many small binaries that isolate different functionality and are run as different users and mostly communicate via command line and pipes. It makes the attack surface small. But pledge() could have made it even smaller.
Actually they do. This is why what you enter in CAPTCHAs appears to be house numbers - it is from Google Streetview.
In other words, social darwinism, the thing civilized society was developed to contain.
It seems a modern camera-phone (my Samsung S4, and the S4 before it, takes crystal clear photos of text) and some clever mounting could easily replace the hardware setup: The software seems to be the interesting component here -- does it or something like it exist alone?
Having more than two parties also helps a lot, btw.

By which I mean, at least five, with realistic odds.

The chance of that happening is only slightly more likely than hoping for a perfect enlightened despot unicorn to step up.
No support for Amazon.uk?
20M Lose Sensitive Data to Sloppy Practices
Clearly my remark was

> ... one approach is just a statistical hypothesis test ...

So we have no disagreement.

E.g., is this JPG an image of a human face? So, for some variables, extract data on those variables from known (supervised?) human faces and do an hypothesis test with null hypothesis that the JPG is of a human face.

Or, are these human faces like those human faces (unsupervised)? Then get data on the variables and do a two sample test with null
hypothesis that the two collections
of faces are the same, i.e., from
the same distribution.
Pattern-Based Vulnerability Discovery
One of my favorite math-related scenes in The Simpsons is where Prof. Frink is standing on stage in front of a group of scientists and not getting attention.

Prof. Frink: "Looking for some order. Some order please with the eyes forward and the hands neatly folded."

(Audience not paying attention.)

Prof. Frink: "Hrm..."

Prof. Frink: "Pi is exactly three!"

(Collective gasp from the audience. Prof. Frink now has their attention.)

---

Edit: Went looking for part of the quote which I couldn't catch, found a book which seems interesting. Simon Singh, 2013. The Simpsons and Their Mathematical Secrets [1]. Singh is also known for his 1997 book Fermat's Enigma [2] and his 1999 book The Code Book [3]. The former of the books I've heard is interesting and the latter of which I enjoyed very much back when I read it.

[1]: http://www.goodreads.com/book/show/17287021-the-simpsons-and...

[2]: http://www.goodreads.com/book/show/38412.Fermat_s_Enigma

[3]: http://www.goodreads.com/book/show/17994.The_Code_Book
Wtickle – test a web server for exceptions
The more I examine it, the more I realise that at this point in time, the programming profession is a trap.

I'll try to explain it.

1.
20 years ago we were called "computer geeks". Young people fond of computers.
This term does not apply anymore. Now everyone under 20 is a computer geek.

My daughter is 5. You know what 5-yo kids draw in school ? User interfaces. That's right. Checkboxes and buttons and sliders. They don't know what they are called, but they know how to use them. Every day they draw UIs and computers and they play with them at school, then they come home and interact with their tablets.

But that is the coming generation. Today, even if you've never seen a computer, you can catch on pretty quickly, because:

2.
There is almost no entry barrier into the profession.
After a month of tutorials and interview training you can get a job as a junior developer.
In fact, there're so many learning opportunities right now that it doesn't seem fair.
Anyone anywhere can learn to do what you do - and better, because he can learn from the best.
And they can produce better code faster, because:

3.
Services like Github have trivialised code sharing and reuse.

Each library solves some kind of problem. Before, it required days or even months of work and research.
Now, it's just a 'pod install' or 'npm install' .

But it's good, right ? It's so much easier to develop software now...
That's true, however, given the way things are evolving:
3.1. If it has any 'general-purpose' value, what you're working on right now is (or will soon be) obsolete, because someone else will release it as an
open source lib. Good for everyone, not as good for all the programmers who would have been paid to develop their version of it.

Of course, we can ride the wave and try to keep current with all that's happening, right ? Well, turns out that's not so trivial anymore, because:

4.
The field has become extremely wide and each area is an ocean in itself. Take 'the backend' : there are dozens of languages and frameworks, each of them being updated weekly. Or iOS Development. Machine learning ? Computer vision ? Sound engineering ? ....
You did notice this didn't you ?

And if that isn't enough food for thought, then

5.
AI will eat our lunch pretty soon. Maybe 5, maybe 10 years from now, there will be no 'programmers', because everyone will be a programmer.
The tools, libraries and techniques will be sufficiently advanced for anyone to speak the requirements and design ideas and the AI will write all the underlying code.

AI combined with the 5 year olds of today who are already doing UX design.

Note that this wasn't the case 5-10 years ago. Before the iPhone, Github, Khan academy and Coding Bootcamps, the industry was a different beast.
What the future holds is of course unknown, but the signs are that 'programming' is not a skill that will feed you for the rest of your life. Time to think about other things you're good ;).
... not stunnel?

Also, FWIW, I use systemd service for an ssh tunnel instead of autossh. Works brilliantly.
I don't get it. What caused the problems? The bad ram or the 32 bit windows? It makes no sense that a 32 bit windows only acts up after trying bad RAM.
Or never
Seeing the USA tech sector from the very skewed point of view of Hacker News stories, I'm horrified by the apparent abundance of women like Ellen Pao or Julie Ann Horvath, or much worse, and by the terrifying threat they represent even for men who don't make the mistake of hiring them. It's like camping in a forest that is home to a man-eating tiger, completely unarmed.

When hiring, or even contacting, a woman is more dangerous than a bad business decision, any uncomfortably immature and sexist "boys' club" becomes better, in all practical and moral senses, than attempting to be nice to predators and sociopaths and being punished for that.

Socially responsible people would try to avoid driving the "enemy" into justified paranoia, because (as the linked article argues) everybody loses. I'm afraid there's not enough social pressure to behave normally.
Blockchain as a Service Now on Azure
You are right, if your webapp requires database connection, the OS has to allow it. That is where application-level security comes in. The OS can not be responsible for everything, the application has to be written securely as well.

This is complementary (and a bit orthogonal) to pledge().
Colour me a cynic, but I doubt this will curb their activities.
Details:

[Unit]
Description=SSH remote forwarding to here
After=network-online.target
Requires=network-online.target

[Service]
User=autossh
ExecStart=/bin/ssh -v -N -o PasswordAuthentication=no -o "ServerAliveInterval 60" -o "ServerAliveCountMax 3" -R 2222:localhost:22 -o TCPKeepAlive=yes -p 222 -i /home/autossh/.ssh/autossh autossh@some-hostname-redacted.com
Restart=on-failure
RestartSec=1200

[Install]
WantedBy=multi-user.target
Tasktic – A new Task Manager for iOS
Why incumbency breeds tone-deaf social media – #YourTaxis and #CoalisAmazing
I wouldn't read this expecting a condemnation of (or evidence against) installing using RAM. It's a comedy of errors brought about by the hero's hubris (and tiredness). The author is not really suggesting that you should never install used RAM.

Consider it a longform version of https://xkcd.com/349/ .
UK gov’t promises all homes will have legal right to 10Mbps broadband by 2020
I wonder how many years it will be before a real AI can compete with Facebook's AI?

I guess by the time that's possible Facebook's pretend AI will already have cornered the market.

The public will only be able to see that you were the late entrant and that while your AI is faster it's occasionally incorrect in peculiar ways...

This seems like a fairly solid plan by Facebook to crown themselves the winners of a race that hasn't yet finished.
First of all this discussion was about the mother of the person I replied to, not the FAA. Secondly this is not a question of money as it is a question of volume and communication. Manufacturing is not plane maintenance, it's about making a profit from margins. If you are willing to sacrifice a bit of your profit for a higher quality product and you have a large enough volume that producing in China even makes sense then you will be able to perform basic quality control.

Any outsourcing only makes sense if you have a high volume of goods. I can have a better quality control producing something here locally than to outsource it to the other side of the pond, even if the country is technologically more advanced than my own just because I lose the ability to oversee the process.

None of that is relevant to the FAA though. The FAA has a funding problem. It should play absolutely no role where planes are maintained. This is a general problem in the US where governmental oversight is traditionally badly funded. Even the IRS has not nearly enough employees for the job they do.
> "The opinion is split as to whether or not it’s a real AI, and there seems to be no way of proving its nature on way or the other."

Clearly, the author didn't even do the most basic fact checking. Since, Facebook clearly told everyone that M was going to be AI that was assisted by humans.

It's literally in the announcement post:
https://www.facebook.com/Davemarcus/posts/10156070660595195

> "It's powered by artificial intelligence that's trained and supervised by people."
I dunno, reads like a tabloid smear piece to me, and I suspect I used to speak with more representatives of aircraft MRO facilities per week than the author has managed in their life...
What Is TV White Space?
The ultimate cost driver in developed countries is low salaries and low to zero costs of real estate, which are of course interlinked.

There's nothing especially odd about Angola. It's cheap to live in... if you're happy with an Angolan standard of living and the unusually high probability of being subject to violent crime in most parts. A risk which means that the minority of comfortable and safe places to live in and shops which import luxuries local people can't afford (like many basic foodstuffs...) can charge what they like to expats that don't have a lot of choice and do have cost-of-living adjustments and danger money added to their already high-by-Western-standards oil-worker salaries.
Applied strictly, this probably means that some Olympic sports require a license (hammer throw, discus throw, shot put and javelin)
Hotel boss slams Airbnb for unfair taxes
Same with kids too. Men are already scared to enter professions like teaching, hesitant to help when they find a kid lost in a shopping mall etc. Some airlines have a "policy" of not allowing single men to sit next to kids in their planes, some parks don't allow single men - as if the entire male population is criminal. Ridiculous.
DistBelief: Large Scale Distributed Deep Networks (2012) [pdf]
the first usb thumb drive i ever got had a capacity of 64mb. it went through multiple wash cycles after accidentally leaving it in my pockets many times over the first couple of years of its life.

recently when i was doing some cable spring cleaning i found it hiding in a box with usb and ethernet cable. I plugged it in and surprisingly its still working and the data on it are intact.
ThoughtWorks Technology Radar Nov 15
https://duckduckgo.com/?q=Tihs+is+uslulay+how+I+tset - responds with:

Did you mean this is usually how i test?
Landfill gas recovery and utilization
LEVIT8: The Flat Folding Portable Standing Desk
Why nobody can catch up with Amazon
This is a new angle on the app-outsourcing-to-low-paid-contractors "technology": it's so dehumanising that you have to pretend to be a computer while you work!

It's also strikingly similar to the original "mechanical turk".
I parsed the title as:

> Most powerful mobile railgun was built by a non-government (i.e. this is the most powerful mobile railgun)

when in reality it probably is:

> Most powerful mobile railgun that was built by a non-government (i.e. there are more powerful mobile railguns)

Is the title ambiguous or is it just me?
Magic Methods in C#
"I'm AI but humans help train me"

The implication to me is that the chat is with a human, who is using an AI tool with the intention of training that tool. What better way to train a new service than to launch it, then answer all the weird, unexpected questions with humans? Gradually more of the questions get answered, the AI gets better trained, and the human-AI becomes increasing more AI.

Further, as the AI gets better, the human working with it has to do less, so they can roll out the service to more users without requiring more staff. Perhaps eventually, no human is needed.
is brett going to put the metadata in as well? (phone location, who's being email, contacted, GET and PUT)
Empirical dynamic modeling
Once upon a time I bought a new laptop and all's well. Several months later, however, it developed a problem: Within 10 minutes of connecting to the internet using the onboard modem (this was really a while ago) the OS will crash after ~10 minutes of normal operation. Various software patches and driver updates were promptly applied but to no avail, once connected no matter what actions you take it will consistently throw a BSoD without any hint of trouble after a few minutes. Considering the fact that the system was 100% stable offline it seemed fair to conclude that the modem was faulty.

Except that when I procured an external modem it reproduced the exact same issue.

A lot of time was wasted trying to figure out what happened. Several fruitless rounds of OS reinstalls later I started to swap test any removable component out of desperation (there really wasn't many on a laptop) and voila the problem went away once a particular stick of RAM had been removed. Later tests found that it will pass most tests in MemTest86+ except this a copy operation over repeated runs.

I have no idea why the symptoms were so peculiar, perhaps when using dial-up connections the OS had been repeatedly loading the network stack in the memory address close to the affected blocks and after a while it will inevitably encounter a IO error and crash. This is just one personal anecdote, but with a complex system it is certainly possible for RAM issues to appear like other kinds of failure.
You might want to look at using spiped for this. It's much simpler (aka. more secure) than any ssh implementation, and because it uses one TCP connection per TCP connection, it avoids reconnection and multiplexing issues.