skysight-inc/HackerNews huggingface dataset:
On the flip side - now that this product, and it's code base, is presumably under such close inspection by Juniper, perhaps Juniper's product is more secure than others that aren't going through such close review.
Robotic Kitchen coming 2017
And if uptime is that important, you can just buy a server that supports PCIe hotswap.
That's a really good question. Why did they store the plaintext instead of a hash? Doesn't feel like the sort of thing an attacker with any sophistication would do. Also doesn't feel like the sort of thing that underwent any code review. I'm starting to wonder about the "intern" theory again.
Science slowed down in the 50s right when government got involved in a massive way in the grant process. Eisenhower even bemoaned this fact, along with the military/industrial complex in his final speech:

"In this revolution, research has become central; it also becomes more formalized, complex, and costly. A steadily increasing share is conducted for, by, or at the direction of, the Federal government.
Today, the solitary inventor, tinkering in his shop, has been overshadowed by task forces of scientists in laboratories and testing fields. In the same fashion, the free university, historically the fountainhead of free ideas and scientific discovery, has experienced a revolution in the conduct of research. Partly because of the huge costs involved, a government contract becomes virtually a substitute for intellectual curiosity. For every old blackboard there are now hundreds of new electronic computers.
The prospect of domination of the nation's scholars by Federal employment, project allocations, and the power of money is ever present
and is gravely to be regarded.
Yet, in holding scientific research and discovery in respect, as we should, we must also be alert to the equal and opposite danger that public policy could itself become the captive of a scientifictechnological elite."
If starting from scratch, yes, it could be very different and requires much more work. However, in many cases, I highly doubt this is what happened.
I don't understand -- we've spend trillions on wars, lost trillions because of poor policies that line the pockets of pharma and wall street, hundreds of billions on sports and entertainment (which is not a waste but is not contributing to technology either...), and you have an objection to spending a few billion on producing knowledge?
I am cheating and getting more or less the same availability properties by using multi-AZ RDS i.e. postgresql with AWS managing the synchronous block replication and standby promotion.
'Either a green unicorn just raced across the lab, or I accidentally took some LSD.', Dr. Walter Bishop
From the post:

On December 18th, 2015 Juniper issued an advisory indicating that they had discovered unauthorized code in the ScreenOS software that powers their Netscreen firewalls. This advisory covered two distinct issues; a backdoor in the VPN implementation that allows a passive eavesdropper to decrypt traffic and a second backdoor that allows an attacker to bypass authentication in the SSH and Telnet daemons. Shortly after Juniper posted the advisory, an employee of FoxIT stated that they were able to identify the backdoor password in six hours. A quick Shodan search identified approximately 26,000 internet-facing Netscreen devices with SSH open. Given the severity of this issue, we decided to investigate.

Did you read that paragraph (It's the first one)? I think the downvoting occured because it didn't even appear that you clicked on the article. Presumably anybody reading HN on a regular basis would have had little difficulty understanding the content of that paragraph.
No. Not a chance.
GTD has some useful parts and advice, for sure, but it also has a lot of bookkeeping that just gets cumbersome once you lose enthusiasm. Like, why do I need to tag all my todo items with a context? Just make different todo lists according to category, who cares if there's overlap? But the advice to start each todo item with a verb is great.
How can you be sure Cisco (or whomever) is any safer?
Real World OCaml
https://realworldocaml.org

The Functional Approach to Programming (Cousineau)
>It took 2040 years before science/math could answer Zeno's paradoxes.

And that's only if we assume calculus answered them. Which is not the absolute consensus of logicians/mathematicians.

Many seem to believe they are simply about limits and that's all, but they may also point to a more fundamental aspect of reality. E.g. from Wiki:

A suggested problem with using calculus to try to solve Zeno's paradoxes is that this only addresses the geometry of the situation, and not its dynamics. It has been argued that the core of Zeno's paradoxes is the idea that one cannot finish the act of sequentially going through an infinite sequence, and while calculus shows that the sum of an infinite number of terms can be finite, calculus does not explain how one is able to finish going through an infinite number of points, if one has to go through these points one by one. Zeno's paradox points out that in order for Achilles to catch up with the Tortoise, Achilles must first perform an infinite number of acts, which seems to be impossible in and of itself, independent of how much time such an act would require.

Another way of putting this is as follows: If Zeno's paradox would say that "adding an infinite number of time intervals together would amount to an infinite amount of time", then the calculus-solution is perfectly correct in pointing out that adding an infinite number of intervals can add up to a finite amount of time. However, any descriptions of Zeno's paradox that talk about time make the paradox into a straw man: a weak (and indeed invalid) caricature of the much stronger and much simpler inherent paradox that does not at all consider any quantifications of time. Rather, this much simpler paradox simply states that: "for Achilles to capture the tortoise will require him to go beyond, and hence to finish, going through a series that has no finish, which is logically impossible". The calculus-based solution offers no insight into this much simpler, much more stinging, paradox.

A thought experiment used against the calculus-based solution is as follows. Imagine that Achilles notes the position occupied by the tortoise, and calls it first; after reaching that position, he once again notes the position the turtle has moved to, calling it second, and so on. If he catches up with the turtle in finite time, the counting process will be complete, and we could ask Achilles what the greatest number he counted to was. Here we encounter another paradox: while there is no "largest" number in the sequence, as for every finite number the turtle is still ahead of Achilles, there must be such a number because Achilles did stop counting.
Despite glut of original scripted series, TV guest actor pay squeeze
The solution is making work asynchronous
According to the whoishiring account at https://news.ycombinator.com/submitted?id=whoishiring, it posts about once a month on the first. Just create a cron job on a personal dev server you use with postfix installed and running and own to email yourself a reminder on the first. I've posted once before but nothing that made me want to change possitions resulted from it.
Really, downvoter asshole, really?! Let's walk through it, shall we?

I'm not sure how many days are in November. Or any month, for that matter.

Ok, no problem, no one knows everything.

Let's go look this up.

This takes a few seconds. We look it up.

Oh hey, November has 30 days. Cool.

I'll go write the correct code. It won't take any longer than writing the wrong code, nor will it cost me or my company any more.

Tell me why this is too hard, or too much work, or too expensive, or WHATEVER. Tell me. Really. Go ahead, I'm waiting.
Brutal. From conversations with other engineers, this is a very common network operating system with banks in Europe.

Would not be surprised if urgent code reviews and security audits are taking place at the campuses of other large network software/hardware vendors.
What's the (an) alternative?
I tried making a replacement for Fluid using Electron. CPU usage isn't ideal, context menus wouldn't work, keyboard focus was an issue. And even with those issues I still use it because SSB apps are that useful. Excited to check this out.
Why would a binary file be better than its source? Seems like a lot more work (you'd need to format and store for each display size) in exchange for less capability (can't search, probably a larger overall file).
PCI Council delays SSL abandonment date by two very risky years
The good news is that presumably the introduction of this bug means that they needlessly rewrote the RTC for this generation of chips, which means they might meaninglessly rewrite it again and the bug will be fixed!
I think high level theory is wandering aimlessly through a field blindfolded with little guidance or where to look. This is because our current theories are so good, we have no idea where to look. So it begins conjecturing and conjecturing. What it ends up with is nonsensical garbage that does little to advance physics.

But yet, there isn't a crisis in physics at all since these theorists are so far removed from reality, I don't really care what they think. They don't really tell use anything useful or interesting so I tend to ignore them. Instead, I focus on things we do know exist but cannot explain, say astrophysical jets, pulsars, or supernovas. We know they exist and we can see them, yet we understand them very little. We have models that are getting better and better over time, but they all exist within the current understanding of physics. This is where physics really is. Whatever garbage the theorists put up on the arxiv can be ignored with little loss.

Instead, those of us "in the trenches" can continue our work trying to explain observed phenomena with our current theories. There is no need to add in extra dimensions or cohomology. Maybe, when we've done really understanding our current theories can we talk to those theorists again.

Incidentally, since I started my PhD in physics doing numerical relativity, my views on science have changed completely. I used to be interested in stuff like string theory, but actually sitting down and trying to do it left me feeling empty inside. Now that I work in an area that is very closely related to observations, I feel like I am actually learning something about the universe. It's hard to explain philosophically, but I really believe in experiments as the guiding principle of science. In my case, we see pulsars (2500+ of them) and we have yet to provide a full explanation of their nature. To me there is something more real and scientific about this then trying to explain multiverse theory but I don't know the words to describe it.
Ssshh! Don't let my mom hear that. She framed the first appointment letter that I received as an adjunct and gained great book club credibility by being able to refer to "my son, the Ivy League professor." Don't tell the deans, but I would happily teach for free as long as I can keep making her that happy.
If code was added to leak the state of the PRNG, then whether or not Dual EC is used becomes a non-issue. The person who created the backdoor could leak the state regardless of which PRNG was used.
> But this zooming in demands evermore energy, and the difficulty and cost of building new machines increases exponentially relative to the energy requirement, Gross said.

Part of the problem is, as Gross points out, that the cost of experimental research at extreme scales is far out of sync with the cost of theoretical research.

The cost of the LHC and the annual budget of NASA are, for example, are around O($10B).

Compared with the value of the US economy (just for comparison), which is O($10000B) or so, this doesn't seem all that high. Of course the problem is that no direct economic output stems from constructing machines for experimental research. In addition to cost, there are the problems of time (how long experimental work takes) and engineering manpower that might be better spent elsewhere.

In any case, it doesn't seem obvious to me that in a different economic context than the one we live in, which is largely focused on wasteful consumption and war, that far, far more money couldn't be devoted to experimental research.
From the article: 0.015 km^2.
So, did they have time for a git blame yet? It's one thing to say you have found a backdoor, another is to clear up how it got there in the first place.
Wind Power Spreads Through Turbines for Lease
Hey does anyone have experience in designing such stoves (or stoves in general)?
Too bad you felt that way. All the little kids in my life at the time it was released completely loved it and were obsessed with it the way I was with the first three.

At no point did I say the movie was good or bad, only that it was for children and most of the children I know loved it. So I think it was on target.

My original comment was about handling criticism. I think that George Lucas will continue to make movies not caring about what people think about them. I'll let him speak for himself on the subject. [1]

[1] https://thescene.com/watch/vanityfair/george-lucas-on-why-he...
irony here is that parent user's id is the name of the publishing house which is one of the chief competitors to cbse, especially when it comes to high school books.
Valid Forth syntax:

6 8 7 5 4 + * - + .
-49 ok

Tell me that's easier to read than

8+6-(4+5)*7

Parenthesis can make things harder to understand if poorly used. RPN can make things harder to understand if poorly used.

The reverse is also true for both. Forth does not prevent bad code.
Oh, you're such an optimist! Everyone knows firmware developers will only rewrite something needlessly if it's correct.
Terrible reporting. Caroms from one innuendo to another, very stingy with verifiable facts. The goal of the author seems to be rage, not sharing information.
Science is born the day that Socrates says ""I know that I know nothing".

Science dies the moment things that are untestable becomes "a new kind of evidence".

If we can't test something because whatever reason, like we don't have enough energy, the fact that we know we can't test it is in fact valuable. We will have to find methods or ways to get there in the future.

Until that , we can't be sure. Fine. We know we don't know.

But falsifying this fact and believing in evidence that does not exist is believing we know things that are unknown to us.

This is dogma, religion, philosophy, but not science.

Nothing wrong about religion, or philosophy, but it is not science.
Appreciate it, will look into it!
As an alternative to paper textbooks, animations are tough there as well (other than student-drawn flipbook animations in the margin).
Show HN: Transdux – React State management with Transducers and Channels
Who said the experts would be literally murdered?

The expertise would still be around, and companies -- possibly new ones -- could still hire them for any positive contributions they believe could still occur. They'd just have lost (arguably with great karmic and ethical justification) a portion of their fortune and power.
Over the years, I've come to understand that -once you surpass the "comprehensibility/legibility" threshold- "readability" is no less subjective than "beauty", "pleasantness", or "good music".

So. I'm glad that you're not in charge of the IETF's HTML RFC output. :)
This smells like:

- Underhanded C . . . maybe. Seems difficult to just insert a strcmp in the middle of a sensitive piece of the login path

- A compromised toolchain that is inserting the code

Would love to hear what Juniper has to say about it, but I doubt that they will, or will be allowed to say.
One key difference between this and the IO monad or a free monad: There's no continuation.

That is, you can't communicate between the code that produces the command sequence and the code that interprets it. This is either a shortcoming, or a dramatic simplification, depending on your needs. I find that it's often the latter, since it enforces a one-way information flow.
Feeding trolls isn't what makes them stay. Lax moderation makes them stay.
Of course if the compiler can prove from my code that some invariant holds, I want it to optimize out the check. What I resent is the compiler deriving invariants from no other basis than "standard said so".
The Banqiao Reservoir Dam Failure of 1975 (2012)
http://source.winehq.org/git/wine.git/tree/HEAD:/dlls

These are all the system libraries Wine has reimplemented so far, and thats only up to its current near-DX10 support, and these libraries are just the base - most applications can ship their own copies of Windows libraries, but as long as the core libraries everything else depends upon work you can run other libs on top of them.

But a lot of Windows has been reimplemented between the old 3.1 era and now, and not just the kernel - MS has maintained fair backwards compatibility the whole say so new versions of the same API can be dramatically different in implementation.

If Microsoft wanted to support Windows executables on Unix they would need to just pick up where Wine is at now and continue their work, albeit with insider access to code to know all the edge cases of their own implementations of these APIs, since software is written against the bugs.
Sorry - the whole "REST is just like websites" thing drives me nuts.

With the web, it is not the browser doing the navigation; It is very advanced AI wetware.

It is hard to find widespread examples of machine to machine interaction based purely on RESTful discovery.

I think REST is interesting - but at the end of the day, is it really all that different from other communication mechanisms?
> umm, can you cite a RESTful cloud storage API that's consistently implemented between providers?

WebDAV? You can get pretty far with eg davfs and Plone/Zope -- and you can also mix and match servers and clients. Now, lots of WebDAV clients and servers are broken in many sad ways... but it exists.
> what they do isn't philosophy.

It's more philosophical than what most philosophers do, as long as they dismiss people out of hand.

Yudkowsky at least admits others have ideas worth engaging with.
Boltzmann's theories were apparently rejected by some of his influential contemporaries (the philosopher Ernst Mach, for one) partly on the grounds that there was no direct evidence for the existence of atoms and molecules [1]. It has been suggested that this may have been a contributing factor in his suicide. If so, then it is sadly ironic that his suicide occurred between Einstein's publication of his famous paper that cast Brownian motion as evidence for the existence of atoms and molecules, and the experimental verification of his statistical model of the process by Perrin in 1908 [2], which quickly put an end to the doubting of the reality of atoms.

[1] http://jfi.uchicago.edu/~leop/AboutPapers/Boltzman.pdf
[2] https://en.wikipedia.org/wiki/Brownian_motion
If someone is bringing bolt cutters to snatch your package, you have bigger problems. I guarantee most of the people doing these box snatches are looking for quick, easy victims.
Compromised toolchain/Underhanded C perhaps explains why whoever did this didn't take even the slightest bit of effort to compare against a hash.
You're assuming the attackers care if the backdoor is used by others. If a hash would increase the chances of it being found and you don't care if other attackers discover it, only if the vendor does then it's the right choice.
Brother MFC J870DW Driver Download
The Sonic Physics Guide is how I implemented my first (good) platformer physics.

https://info.sonicretro.org/Sonic_Physics_Guide

It's fairly hack free in the abstract. But reality is often a little different, based on the quirks of your collision detection.
My book uses Jupyter Notebook, which uses MathJax for LaTeX generation, and of course Python or any of the other 30 or so kernels available for software. I haven't done JS with it for animation because I also want to support print, but it is trivially possible.

We still have a ways to go before online computer/math texts are seemless, but we are on our way.
Quick Google gives me:

> Ayn Rand's key point: "man does not live in a lifeboat -- in a world in which he must kill innocent men to survive."

> She also observes: "Under a dictatorship -- under force -- there is no such thing as morality. Morality ends where a gun begins.... Moral rules cannot be prescribed for these situations [lifeboats or dictatorships], because only life is the basis on which to establish a moral code."

http://objectivistanswers.com/questions/1892/what-is-the-obj...
Imagining version control for APIs
The article already states:

> This password allows an attacker to bypass authentication
> through SSH and Telnet, as long as they know a valid
> username. If you want to test this issue by hand, telnet or
> ssh to a Netscreen device, specify a valid username, and
> the backdoor password. If the device is vulnerable, you
> should receive an interactive shell with the highest
> privileges.

The fact that you thanked _jomo for explaining something that effectively quotes almost verbatim what the article tells you indicates you probably didn't bother to read the article. Like with asking help on various forums, it's generally appreciated (or expected, depending on the community) that you do some homework yourself to understand things, state your current understanding, and then ask for confirmation or clarification if your understanding is incorrect.

Saying "ELI5 please" comes across as intellectual laziness on your part. If you haven't made any effort to understand an article in plain English (it's no scientific paper we're discussing) then why should others make that effort for you?
It does? The REST thesis came out in 2000, looks like the (and AFAIR) WebDAV came later?

http://www.ics.uci.edu/~fielding/pubs/dissertation/top.htm

http://www.webdav.org/specs/
It is technical.

Show me a general purpose program that can navigate, interpret and comprehend a variety of media types and I will show you an AI.
> If unions could compete with each other for workers' influence

... they might become less corrupt, and more responsive to the wishes of labor, as opposed to union leadership.
Sure.

Or people could just be considerate of each others time.

But I suppose redefining the modern concept of work is another option.
It is obfuscated in a way that will still avoid detection during static code analysis and casual code review.

This looks like debug or logging string builder which no one would give it a second look while glancing over it.

Hashes and binary blobs will look out of place, same thing goes for intentionally obfuscated secure string builder.

When you put in a back door the best one will always be the shortest possible complicating it will only increase the likelihood of it being detected.

The sign of a true high level adversary isn't overly complicated and obfuscated software but one which is remarkably simple and elegant whilst still achieving the desired functionality.

Obfuscation and complexity screams cyber criminals which care more about covering their own trail than ensuring functionality.
All this complaining about wine from this place or that not pairing with the food to me just proves the point that the expectations of the restaurant are too high because of the press. It was not supposed to be a world class restaurant, it was supposed to be a Denny's. You don't expect a similar experience in a Denny's or Olive Garden.