skysight-inc/HackerNews huggingface dataset:
> If you were to mandate a key rotation across all employees and mandate all employees use a keypair prepared for work and no other purpose I would rate those mandates as not being excessive.

A better mandate would be to use ssh-agent. Using separate key pairs without an agent doesn't prevent key theft due to memory disclosure vulnerabilities like this one; it merely compartmentalizes the damage. But if you use an agent, the client never loads the private key, so it's safe from memory disclosure vulnerabilities. Stealing a private key would require filesystem access or remote code execution, at which point all of your private keys are at risk, so you might as well just use a single private key per device.

For the best security, store your private key on a smartcard, so even an attacker with filesystem access or remote code execution can't steal it.
Your link says 31% of women in STEM were harassed. 60% is some distance from that, don't you think?
I wish some politicians would take note: Right now is a perfect alignments of the planets for a carbon tax. Get on it before the window closes.
Meaning of ASAP
Turns out, there is not. No way to get over OpenGL 4.1 on OSX, sorry...
Thank you both for the helpful replies.
When I saw the title, my first thought was:

"Because fossil fuels won't always be cheap, and will be gone in a couple hundred years"

It seems pretty obvious that renewable energy is going to be the way of the future, so of course there will be large investments in it.

This really isn't surprising either, because "clean energy" doesn't usually pollute the air (as the article pointed out).
For the single other ChromeOS user (how many of us are there?), note your SSH client is also based on OpenSSH. Add '-o UseRoaming=no' to your arguments.

Watch this repo for updates (or submit a PR?)
https://chromium.googlesource.com/chromiumos/platform/assets...
This is client-only vulnerability:

The matching server code has never been shipped, but the client
code was enabled by default and could be tricked by a malicious
server into leaking client memory to the server, including private
client user keys.[1]

[1] https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-Ja...
TFA says:

>60% of women in Tech reported unwanted sexual advances.

>

> -- 65% of women who report unwanted sexual advances had received advances from a superior, with half receiving advances more than once

> -- 1 in 3 have felt afraid of their personal safety because of work related circumstances

(emphasis mine)

Power-imbalanced? Yes, for 39% of them, and 30% had some multiple times.

I agree that "unwanted advance" could mean someone asked me out and I didn't like them. I'll be honest, I don't deal with that problem myself because men aren't asked by women in our society, but I think you should define what you think draws the line between unwanted and inappropriate.
To clarify from source[1]

TO BE ELIGIBLE TO RECEIVE WEBSCOPE DATA, UNLESS SPECIFIED IN A PARTICULAR DATASET, YOU MUST:
Be a faculty member, research employee or student from an accredited university
Send the data request from an accredited university .edu or domain name (for international universities) email address

UNLESS SPECIFIED IN A PARTICULAR DATASET, WE ARE NOT ABLE TO SHARE DATA WITH:
Commercial entities
Employees of commercial entities with university appointment
Research institutions not affiliated with a research university

--

[1] http://webscope.sandbox.yahoo.com/
I recently started playing with lisp in ubuntu and decided to go with slime for it. So i installed slime through ubuntu software manager, couldn't find it, couldn't start it (i'm totally new to emacs and slime). After that I read some manuals, made changes to .emacs config and eventually installed slime using emacs and its package manager. Now i'm wondering if i have 2 versions of slime where are they located, which one is being actually used etc.
Does anyone know how this interacts with ProxyCommand? If I fix this in ~/.ssh/config on my laptop, and I ssh to hostB through hostA using

Host hostB
...
ProxyCommand ssh hostA -W %h:%p

in the config on my laptop, do I also need to fix it on hostA?
Malicious, compromised, or new servers. Because really, how many people check the host key for a newly spun up EC2 instance?
This was a good example for finance noobs like myself -- what does the last sentence mean, though?
ES2015 just added the class keyword to make it look like java last year. IIRC the new keyword wasn't part of javascript in those first two weeks when javascript was released.

Where are you getting this stuff?
Multi-gigabit cable modems ready to help you blow past your data cap
I don't think pixel level customization is a major factor in bloat or performance. Doing it on top of a browser is what adds the majority of the overhead IMO.
Proposed New York Law bans encrypted smartphones
It is very relevant. I want more women in tech. (I think the problem is they don't want to do the job, but let's put that aside.) Studies like this only reinforce the already existing negative stereotypes about "nerds in tech", in both sexes.

You claim this is a problem. Here's a simple solution: Make tech companies segregated by gender. What about that? The thing is, I presume, people who did the study don't want to solve a problem of "unwanted sex advances" in the workplace. They want to solve a problem of not enough women in tech. And this is not the way to go about it.

It is also an interesting question, and I am genuinely curious. I also doubt women actually choose the career based on amount of unwanted sexual advances, and having the numbers could finally put that stupid theory to rest (if it's false, of course, maybe it's not, I dunno; but based on the above provided link, it probably is false).
I've heard nothing about JunOS moving to Linux. That would be a truly bizarre move on their part, both in terms of technical quality of Linux vs FreeBSD, and licensing headaches with the GPL.

Do you have a source?
The thing is, if the site doesn't make it easy for me to accomplish what I want, then my emotional response is frustration. It doesn't matter how nice or pretty your site is if I get frustrated before I have the chance to appreciate the design.

I think trying to evoke a certain emotional response can really only be effective if it's not getting in the way.
> "you can make people agree with any position you want by changing the wording on the questions." So precisely what you ask is super important for knowing what to do with the conclusion.

This. Also: any other questions asked which got less news-worthy results. https://en.wikipedia.org/wiki/Publication_bias

I wish there was was something like a wikipedia page which listed every paper / survey with a conclusion on a topic out there. Kind of like examine.com but for social science results rather than nutrition.
It's probably not the main reason (technology improvements in oil extraction is), but it sure doesn't hurt!
"nobody gets fired for buying IBM"

https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt

Everyone who says anything like "blame the vendor", have just drank too much marketing cool-aid.
His reading of "The Return of the Native" on audiobook is amazing. I just happened to finish it recently.
I don't know a single online source worthy of recommendation, so I'm afraid you'll have to do your own searching. But in a nutshell, at least under US law:

1. The permission language "deal in the Software without restriction" is very broad.

2. Of the more specific, enumerated permissions "use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of" the terms "copy", "modify", "publish", "distribute", and "copies" speak to the exclusive rights of copyright owners per United States Code title 17, section 106. The terms "use" and "sell" speak to things you can sue for under a patent per United States Code title 35, section 271. The term "sublicense" is generic to licenses of all kinds, including copyright licenses and patent licenses.

3. There is also a legal idea called "estoppel" that prevents, broadly speaking, leading people to believe they can violate your rights freely and then suing them, or taking back or shrinking permission that you've already granted. State Contracting and Engineering Corporation v. Florida, decided by the United States Court of Appeals for the Federal Circuit, is an interesting case in the patent context. You might find a summary online, if you haven't time to trawl through the court's written opinion.

To quote Larry Rosen, from his book Open Source Licensing:

> Be careful about implied licenses. An implied license is necessarily vague and incomplete. The terms and conditions of an implied license may not be clear to either the licensor or the licensee. Reliance on an implied license is particularly risk when important property interests are at stake.

If you're worried about an implied license for a specific reason, please talk to your company's legal or engage an attorney. It's going to require a judgment call, and you want someone on your side who will consider a lot more than what I've mentioned here in coming up with good advice.
I think the underlying problem here is the expectation that you, the user, should be able to find stuff by looking "in" particular places. This is perfectly reasonable if you're dealing with a fairly limited set of files or executables, but that era has been slipping away for the last 5 years or more.

It is no surprise that the question comes from 2011. I believe that was near when Unity came out and Ubuntu did away with mouse menus to find "Programs" in favor of just searching for what you have. A lot of folks did not like it at first but I think its no longer an issue.
> undocumented "UseRoaming no"

Come on Theo, this isn't Linux
They pull similar tricks with college sexual assault statistics too. They don't ask "Have you been sexually assaulted?" Instead, they ask about a laundry list of scenarios. If you say that one of them happened, you're now a sexual assault victim, even if you don't agree and even if that incident never reached the threshold of illegality. A good analogy is regular assault, which legally includes verbal threatening language. Who hasn't had a heated argument with a friend or family member? But imagine if a survey counted you as an assault victim just for agreeing to the statement "someone has threatened me during a verbal altercation". The law is intentionally defined broadly but applied narrowly. Collecting statistics that count people as victims of violence, when they wouldn't even count themselves, is deceptive and dishonest. It's being done to justify kangaroo courts in colleges, and government mandates in private business.

Disclaimer: Just to preempt the easily offended, I obviously acknowledge that sexual and regular assaults are real crimes that happen way too often, but the statistics being thrown around are ridiculous.
I'm like that, and I'd hire myself.

A full stack developer "could" be considered a jack of all trades - someone that can handle server administration as well as frontend / backend development - you'd be surprised how many people are afraid or don't know anything about servers. I've worked with many that only know mainframe programming or only know frontend development. Theres nothing wrong with that and in certain situations, it's a good thing. But if / when shit hits the fan (as it often does) it's good to have someone that can look at an apache config and relate it to why feature x doesn't work.

Keep looking - pick a skill and get good at that, while maintaining / expanding knowledge in other areas. You'll find something.
But first impressions aren't used to make the decision for whether you should have a baby with someone. They are used as an initial-filter to reduce the number of people that one should invest more time in.

It's obviously impractical to put the same amount of effort into every potential partner to determine if they're the person you want to spend 20 years with. You need a way to filter from an incredibly large number of potential partners down to a shorter set that you can invest more time in and get to know really well.

If there were a lot of people dating for a couple years and then giving into first impressions your point would have more traction for me. But I don't see a way to manage the "top of the dating funnel" without giving into first impressions.
OpenSSH server doesn't support roaming. This is a client only issue. The problem is that your connection could be MITM'd by someone looking to exploit this bug.
ah, nobody ever forgets their first lock file.
Just curious, what kinds of tools are essential for you to switch?
Perhaps this is an exception to it, but what if information comes to light that completely invalidates their case and proves that you're innocent?
The winter scene actually gives me a lot of anxiety (norther climate dweller here). All I see are icy roads and cars in ditches.

Everything else is definitely beautiful.
The roaming thing occurs post negotiation, so the connection is already fully encrypted.
When a computer can generate instructions to automatically fabricate the artifact, there is no client. There's simply a user. Autodesk's business is selling to people whose business requires the expert-client relationship.

That step is as necessary as an 80 column punch card entry team.
You seem to be experiencing a thought disorder called derailment [1]. This can be indicative of serious mental illness, have you ever talked to a doctor about that?

Do you ever feel like ideas or sentences that you are talking about need to be talked about urgently or are you ever annoyed by others telling you to calm down or talk slower?

[1]: https://en.wikipedia.org/wiki/Derailment_(thought_disorder)
Amazing...did not know that. Thanks.
It's unfortunate Yahoo assumes only those with .edu email addresses make up "the research community".
> The usability of what?
> why would you want to muddy that up with a nav bar?

Typically people are looking for information when the visit a brand new site. If the user can't figure out how to get that information, chances are they're going to be frustrated, and have no interest in clicking the button.
Using a control group here doesn't make sense because we're not trying to benchmark SV against other places, nor are we doing an experiment. This is a survey.

Furthermore, if there are 400,000 tech workers in Silicon Valley, then 200 gives us a less than 8% margin of error (95% confidence level). This still gives us a result of at least 50%.

But we're not surveying the entire tech industry, we're surveying women in Silicon Valley, which is a number much closer to 100,000 (although that doesn't radically change our margin of error).
Why bike lanes make people mad
The Rise of the Digital Middle Class
Living in Montréal, I'm happy to see this article. The highways / traffic situation is horrible here, but I will point to one example in particular.

Getting to the airport: there is no way to get to the airport easily. There is a dedicated bus line that might get stuck in traffic for 10$, or you pay 35$ for Uber, or 50$ for a normal cab (which also might both get stuck in traffic). You need to plan at least 2 hours from your house to get there, often 3 hours in advance for your flight. I've taken the bus dozens of time, and you can see the faces of the poor passengers, realizing they thought 1h to get 20KM away would be enough.

I go back and forth to Amsterdam and the difference is embarrassing. I get to Schiphol, hop on a train (every 5 mins), it costs 5 euros and I'm at Central Station in 15 minutes.

Light train? metro extension? How hard can it be?
So can we finally compare ARM64 and x86_64 apples to apples using this fabric?
Well if your conclusion is that Chicago is a significantly less safe place to live than other densely populated cities, then yes, you'd need that data.
CVE-2016-0777 doesn't interact with ProxyCommand in any special way. That said, after connecting to hostB with your example config above you will have 2 ssh sessions:

1) from your client to hostA

2) from your client to hostB

So to answer your question - no, vulnerable client on hostA is not a problem (or at least not in this particular use-case).
Oh yeah—I guess this isn't just me. I tweeted to them about the issue: https://twitter.com/seligerj/status/687682195964735488.
I couldn't find that info despite clicking around in "TFA". Thanks.

"24% of women in Tech reported inappropriate sexual advances" is a less scary headline.

It's still way too high, but when you also factor in the selection bias and poor methodology, I have a very hard time taking these numbers at face value.

As for "afraid of their personal safety", that's subjective enough -- and introduces significant response bias in the already selective audience -- to be useless.
> They don't ask "Have you been sexually assaulted?"

People have different definitions of sexual assault. Asking about specific scenarios is a way to control for those varying definitions, and it's a standard requirement of good survey design.

There may be problems with those surveys, but the solution is not to just ask, "Have you been sexually assaulted?"
Funnily enough my first thought was "how nice - it's not cluttered with awful curly braces!" ;-)

I'm a Python guy so that's probably half the reason - but the syntax looks nice and clean to me.
> But imagine if a survey counted you as an assault victim just for agreeing to the statement "someone has threatened me during a verbal altercation".

In England that could meet the threshold for common assault, which is an arrestable offence.
No, the two are disconnected.

Oil is getting cheaper because the House of Saud is attempting to drive out frackers in the US. Jokes on them though: That oil is always going to be profitable around $50-60/barrel. Once the Sauds lower production to raise the price of oil back up, frackers will fire right back up. It'll take 12-18 months, but it'll still happen. Almost no one burns petroleum for electricity mind you (nat gas, yes, but not oil) except Hawaii and parts of Alaska, and they're moving as fast as possible to renewables because of price spikes that occur occasionally.

So you're going to see this seesaw effect. Oil shoots up, more oil comes onto the market, oil goes back down, etc.

Renewables. Oh how I love me some renewables. There's this legislation, the production tax credit [1]. It generously subsidizes the installation of renewables in the US. There's always been this quagmire though, as Congress would only extend it 1 year at a time (hard to plan capital expenditures worth billions when the legislation you're relying on is always up in the air).

But things changed in December of last year. At the end of 2015, in a landmark deal, Congress extended it for 5 years, and in return, the US lifted export restrictions on crude oil. That means that solar and wind is going to roll out faster than ever. Natural gas will push out the remaining 30% of coal fired generation in the US, and wind and solar will fill the gaps (this is good; natural gas is cleaner, and produces much less CO2 per MWH produced). As more wind and solar comes online, along with utility scale battery storage, we'll reduce our reliance on natural gas (protip: don't invest long-term in generators who own substantial nat gas generation assets).

China is deploying wind at an astonishing rate, faster than even nuclear [2]. They're heavily subsidizing electric vehicles now as well [3]. The price of coal is plummeting (which is good!) [4]. The best case scenario is whatever is left of it is left in the ground.

If you can afford it, elect to get renewables from your utility. The premium should be ~1-3 cents/kwh. If you can afford to get an electric car, and it makes sense for your lifestyle, do so. If it doesn't, use a carshare program.

Collective effort can change the status quo.

[1] http://energy.gov/savings/renewable-electricity-production-t...

[2] http://www.earth-policy.org/data_highlights/2015/highlights5...

[3] http://www.ibtimes.com/chinese-consumers-bought-nearly-300-m...

[4] https://www.quandl.com/collections/markets/coal
So did the article answer the question lithe than a passing remark that they were getting more cost effective?
The response is also abrasive bordering on condescending. The tone is very much along the lines of "what are you, stupid?" Even though they answer the question in quite some detail, that's really not the kind of thing that makes others be willing to open up about what they don't know and get better.

The Filesystem Hierarchy Standard is a very different approach to storing applications on the filesystem than to how MS-DOS/Windows does it. There's a learning curve for Windows users and they do get confused. They conceive of all files for an application residing in a single directory dedicated to that application, whereas the FHS thinks of distributing files for an application according to purpose.

I agree - I find locate to be very useful, and failing that grep/find.
Well there used to be this thing called AOL instant messenger. Then people cloned the protocol. So AOL would just start causing purposeful buffer overflows that would take them to specific parts in their code but mess up the people trying to imitate it. But they figured it out, and now they teach students in class how to overcome it. The other illegal thing they taught us was decrypting a DVD.
AZ is not in the Eastern Time Zone... And why are the links they're showing using the "tel:" attribute for a link address for a date? What is going on here?
I'm so sorry. Giant hugs from me, internet stranger.
Using any sort of hardware security module, such as a smartcard (which some YubiKey devices can operate as) will not allow your private key to be compromised because you have no access to your private key -- it's on a whole separate computer (the HSM) and your only access to it is by sending APDUs to that computer. For a typical smartcard the only thing you can ask it to do with your private key is to perform cryptographic operations on data with it. Many smartcard applets require that you authenticate yourself to the smartcard before they will even do that.

I use a smartcard with a NIST SP 800-73 applet on it for all my SSH (and TLS) sessions and do not have any other SSH keys.
Maybe something P2P. Users in different countries co-operate and run an app. (humm, that sounds like Tor)
I think they want to solve the problem of harassment in tech. "Not enough women in tech" is a trailing indicator for a number of factors, that being one of them.

Yes, "How are other fields doing" is a question that can be asked - but it is one of the least interesting ones. Suppose that every other industry is at 40%. Or suppose they are all at 60%. It doesn't change the fact that ours needs to seriously deal with it. (And as seen by ~1/3rd of the comments in this thread, is more interested in splitting hairs.)
With new deal in place, Sweden asks to question Assange at embassy
So costs get socialised in three ways I can think of; firstly the direct increase in insurance charges to those who avail of flight insurance (this is the case which you mentioned) - but it doesn't stop there - this increases the "cost of business" and these costs are passed on. By the time these increased costs reach individuals the effect is negligible but it does affect the broader (Malaysian) economy. The second is through insurance companies increasing charges across the board. Insurance is a marketplace just like any other and in order to stay competitive in one market costs can be spread to another. The final is direct regulatory intervention where the wider customer base is directly charged a percentage (google "insurance levies").

So I opened with "I don't know what the story is in Malaysia but .." because the relative influence of each of these factors is profoundly regional, related to regulatory and government policy . But now that I think of it, even in a libertarian paradise the effect of the second one alone would be fairly significant.
The conclusion is just that SV has a problem. That's why it's called "Elephant in the Valley". It isn't called, "Elephant in the Valley that doesn't exist in other places".