skysight-inc/HackerNews huggingface dataset:
True, I really don't know the exact entropy and perhaps an attacker will have access to large amounts of my previous writing, which might help them guess how I would connect different domains. We know the relationship between horses and batteries, but what's the weight of the relationship between snails and purple? But 30 billion hashes a second is quite a hashing rig, and even if they could reduce the entropy by a 2 orders of magnitude, they're still looking at nearly a hundred years. With a hard algorithm, like bcrypt, or without access to my writings, that password is impregnable.
I tried sending you an email, but it bounced.
If someone running iOS could provide screenshots then this article would get a whole lot more interesting
All that stuff - bittorrent, soulseek, calibre etc - lives in a vm, with access to the host only via samba shares. I'll decide what you see and where you can write. Yes, it's great you download stuff. No, you can't write to the stuff I'm sharing. Yes, having a web-server serving up books to the outside world is great. No, you can't serve up anything from my filesystem to anyone who feels like it.

When you can't (be bothered to) vet the source code, stick it in a vm. On a sensible machine with an ssd it's only 10 seconds away. Why risk it. Especially if the software you want/need to run only works under windows.
I think it's the other way around: by restricting who can service the car, they are artificially keeping the resale value up, which works out to cheaper financing (after all, you finance the difference between purchase price and resale price).
Coroutines != Multithreading. Also as I understand it, GIL places limitations on Python multithreading. Please correct me if I'm wrong.
Side topic: probably not a good idea to expose Jenkins externally, especially if you don't keep Jenkins up-to-date all the time (for transmission bt it is up-to-date right now). This Jenkins probably contain the key to the svn server, so if someone finds a hole...
The usual warning sign here.

Be careful when SSHing into hosts you do not know with an unpatched version of OpenSSH:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0777

edit: @Ao7bei3s comment below gives more information on how to protect yourself.
Hotels also have things like "furnishings" and "maid service" and other labor and capital expenditures that don't apply to apartments.
I uninstalled the app, but is there a way I can check if i've been affected?
Social Media Follow Buttons for Websites, Twitter and Facebook
(reply to noondip): if anyones got a better suggestion I'd love to hear it :)
I guess it's the same situation as when the warranty goes out, it's open bar on the internals but there is no documentation.
Not because of the fact that it's open source, but because of the distribution models used.

SourceForge has been linked to bundled malware and hijacked projects like GIMP and FileZilla.
In Debian and Ubuntu at least, all published files containing binary executable files (ISOs, .deb packages, etc.) are hashed and the hash signed by a well-known system pre-installed PGP key.

Given trust in the protection of the private key used to sign the hash list file the integrity of the executable content can be proved (assuming useful SHA1 collision creation is prohibitively expensive).

Coincidentally I was writing a Bash script this weekend to auto-install (Ubuntu) releases into LVM volumes and it includes the following code to verify the download:

set -e
# ...
ISO="${NEW_DIST}-desktop-${ARCH}.iso"
for F in SHA1SUMS SHA1SUMS.gpg ${ISO}; do
if [ ! -r $F ]; then
wget http://cdimage.ubuntu.com/${FLAVOUR}/daily-live/current/$F
fi
done

if ! gpg --verify --keyring /etc/apt/trusted.gpg SHA1SUMS.gpg SHA1SUMS; then
echo "Error: failed to verify the hash file list signature; files may have been tampered with"
exit 2
fi
if ! grep ${ISO} SHA1SUMS | sha1sum -c; then
echo "${ISO} is corrupted; please try again"
exit 1
fi
You are so much more optimistic about the motivations of these "providers" than I that I am struggling to find any common ground where we could have a discussion. All I see are new opportunities for exploitation and control driven by rent-seeking behavior.
Rather than post the equivalent of "Ignore this Show HN," you should post the steps people can take to protect themselves.
Thanks, that's some good readin'
Beware that VMs are not necessarily secure. They can be escaped!
> Open source software is especially vulnerable to this kind
> of stuff.

Give it 2 or 3 years and stories will come trickling out about how most OS apps have had commits from hackers, governments etc. So far most source checking - to the extent that it happens at all - is all about buffer overruns and the like; micro stuff that's easily catchable. Well, you say that, but, you know, heartbleed etc. But what about whole modules designed with two purposes in mind?
This is a discussion that has happened here before and has generated its share of sparks, but I'll risk it :-). It is hardly a problem in the context of a userspace TCP/IP stack (I don't think Linux runs on any machine with non 8-bit bytes); it's just a good illustration about the kind of pitfalls that programming at this level sometimes poses.

I would suggest being a little more careful with this:

> unsigned char dmac[6];

because there are several platforms, all of them high-performance, non-legacy processors, where unsigned char is not 8 bits :-). E.g. on AD's SHARC, it's 32. You're declaring the struct with __attribute__((packed)), so I assume you're going to want to fill it automatically through DMA at some point in the future. On such a platform, it won't have the expected results. A colleague got bit by this, on a device that's sitting on my desk right now, and it's not a vintage piece of equipment from the 60s.

I would suggest using uint8_t instead, just like you're using uint16_t a few lines below.
Exactly, it's like saying I want OnStar but I don't want my car to connect to them. Or I want a mobile phone but I don't want cellular network to track what cell I'm in so it can actually route calls to my phone.
Who will care for us in the future? Watch out for the rise of the robots
Let me provide you with a little bit of feedback for your future projects.

You had a great launch that showed a lot of interest from the community. I still think there's room in the ecosystem for an open competitor to PH's closed model. But what did you do to capture that initial surge of visitors and bring them back? What were your plans to keep user engagement strong?

Here's an example:

When you posted this on HN 78 days ago, I asked if you had a daily summary email [0] like Product Hunt did. This is primarily how I interact with Product Hunt. An informal survey of my coworkers shows the same thing. We all read the daily email. It keeps us coming back to PH. This, IMHO, essential feature that Product Hunt had Open Hunt lacked on launch day.

For some reason I think you may have added it later, and I seem to recall I may have signed up for it. But looking through my emails I never received a single email from Open Hunt and, after awhile, I forgot it existed at all. Until today, when you announced you were shutting it down.

Engage your users. Capture visitors. Give them a reason to keep coming back and engaging with your product, or they'll forget it exists.

[0] https://news.ycombinator.com/item?id=10762614
I like the part where they point out how unskilled they are, but still managed to get the job done.
The problem is the students, obviously. If they cared about their work and their future, they would try harder. But they don't, they just think life is all about gangs and money and bitches and music videos and facebook.

I guess if you hire some high octane teachers, you can psych the kids into acting white. Like some sort of jedi mind trick. Next thing you know they'll be talking about tea and crumpets.

You know, we joke about the end of Western Civilization, but it really isn't a joke at all. If students actually put in the effort and just swallowed their pride and acted white, then we could all get along and be shiny happy (fake white) people holding hands.

I mean really, when you look at the way our society is structured today, the only thing better than being a white person is being a fake white person. I really think this whole fake whiteness can be a thing.
Meet a new way to track the world around you
ssh -o "PreferredAuthentications=password,keyboard-interactive" -o "UseRoaming=no" root@sshtron.zachlatta.com

Explanation:

Use a recent ssh version (if you've updated in February you're safe), or put in your .ssh/config file:

# CVE-2016-0777
UseRoaming no

Additionally, while you are at it, you can take care of some privacy problems. These are really not a big deal though.

Don't hand your SSH public key to the server:

# Makes SSH not try other keys than ~/.ssh/id_{dsa/ecdsa/rsa}.
IdentitiesOnly yes

# And move ~/.ssh/id_{dsa/ecdsa/rsa}{,.pub} somewhere else,
# including it on a per host basis:
Host *.example.com example.com
IdentityFile ~/.ssh/my_id_rsa

Or you could just disable pubkey authentication for this one connection with ssh -o "PreferredAuthentications=password,keyboard-interactive".

Including root@ prevents leaking your local username.

If in doubt, man ssh + man ssh_config (they contain other useful things like "CanonicalizeHostname yes / CanonicalDomains ycombinator.com" / example: ssh root@news).

(I don't know what's wrong with the internet that we need "how to SSH" posts now, though. But here it is.)
I just filled up for $ 1.39/gallon in Houston, Texas
> (unless the main site is secure but the downloads aren't
> which is idiotic by 2016 standards anyway), the site
> getting hacked, etc.

It's not idiotic at all. You let anyone who wants to spread the load by providing downloads, but you use checksums - behind https - to ensure they can be trusted.
So super-liberal-progressive Vermont doesn't have a "right to repair" law?

Interesting Mass. is the first.

Should be a federal law.
Url changed from https://omarmetwally.wordpress.com/2016/03/05/conceptualizin..., which points to this.
It seems the most recent version is 2.84 on ubuntu 15.10. The last update to the package was on July 2015.
nah but tuning carbs makes me all bothered. like debugging bothered.
I get my kids to help with things that require holding small objects, my fingers just can't grip them well. When I'm teaching pottery I find men can manage to work the clay (needs muscle) but women are much better where more dexterity is needed.

Perhaps it served the purposes of factory owners to emphasise it but I'd assumed that was why factories globally [seemingly] have more women doing soldering of components and placing of electronics in to casings and such. I spend a good deal of time looking at other people's hands (pottery workshops) and find as a generality that women do have more nimble fingers and less upper body strength (of course it's a distribution that overlaps); nimbleness might be down to other activities rather than being inherent in females but that wouldn't stop more females having roles that favour nimbleness.

Using a sewing machine for large items like car upholstery I can't see hand-size being terribly important; I've moderately large hands and never had a problem with using a sewing machine - I can't manage needle and thread too well though. That said your link seems to concern the general idea of paying women less conflated with a specific job being degraded in value rather than the idea of men/womens general body sizes being pertinent to suitability for certain jobs.
> If it helps, the server is in SF right now (though I'm able to get a solid connection that's playable from NY).

I don't think your audience is 99% silicon valley, or even 99% United States of American. Having multiple servers might be more advisable than moving it somewhere ;)
Voicemails Reveal Donald Trump’s Cozy Relationship with the Liberal Media
And the information they used to decide to contact you wasn't available, ever, through any other means? Even a referral from a friend or former colleague?
As opposed to variable declarations scattered everywhere in the function?
That piece of code does come directly from the Linux kernel docs: https://www.kernel.org/doc/Documentation/networking/tuntap.t...
Can you please clarify where your numbers are coming from and what they are referencing
Here's an analysis of the malware - http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-...
I've served on a jury in one criminal case, and watched the beginning of another case without being on the jury. One thing that stood out was how few objections ever included a reason, and the ones that did were usually described in one word: attorney: "objection," judge: "sustained"/attorney: "objection, speculation," judge: "overruled." It felt mechanical. Based on how quickly the judges ruled, it was obvious they knew what the objection would be before the attorneys opened their mouths. I would be OK if the judge were to accept responsibility of allowing only acceptable questions, especially since the judge decides what's acceptable. Please note, I have no idea if a judge can accept that responsibility in an immigration hearing; but if they could, I would be fine with it.

The obvious danger, in a criminal hearing, would be for the accused to say something that they weren't required to say, and that hurt their case. That is one obvious reason people have a right to an attorney. I don't know enough about immigration law to say whether that's a possibility. In a criminal case, you have a right to remain silent. You don't have that right in a civil case (you can punished for contempt, and the judge is allowed to assume the reason you want to remain silent is that the truth would hurt your case ( https://en.m.wikipedia.org/wiki/Fifth_Amendment_to_the_Unite... )). I have no idea if you have the right to remain silent in an immigration hearing, but it wouldn't surprise me if the right is severely limited. If you have a right to remain silent in an immigration hearing, then it would be impossible to guarantee a fair hearing without providing an attorney.
> This is most noticeable when writing objects to disk or sending them across the network. As soon as the process needs to communicate the scheme breaks down.

As another point in this space, X Windows moves things out - processes can create "ATOMs" registered with the server.
Database: Four-year graduation rates at public and nonprofit colleges
Who the hell was PRAISING the TPP?
If the resale value of an out-of-warranty Tesla ends up being essentially zero, the new ones will start to look like a pretty poor investment. This will impact Tesla's sales. You can be pretty sure that Tesla will rectify this eventually if they want to stay in business in the face of emerging competition from other electric cars.
In future datacenter technology, what will the layers of responsibility be?
It does if that statistic offers a better prior as well. stdbrouw's answer explains why that will often be the case.
The education community has known for some time that there isn't a direct link between education spending and student achievement. That's because student achievement (as measured by international tests like PISA) is pretty much just related to the student's socio-economical background. Spending more on schools has little to no effect on it.

Increasing educational spending, however, will indirectly impact student achievement though being (or not being) able to attract qualified candidates to the teaching profession. This is especially true for STEM fields.

For example, let's say that a school district wants to start a computer science program (Intro to programming in MS, Programming and APCS in HS). Ideally, you want someone that is good at programming, current with the CS field, that has a valid teaching credential, and is willing to work 40-50 hours a week starting at $44,000[1] yearly (pay will cap out at $88,00[2] with 20 years of experience). You can see why not many good CS majors will decide to go into teaching. The school district will then have to ask some of its current teachers to teach these CS classes, usually as an elective in addition to their other "core" classes (usually math). They will have various degrees of understanding and knowledge about programming, different backgrounds and experiences.

Increasing the pay for teachers will allow districts to attract qualified candidates for teaching, the same way that universities have to pay top salaries to attract the best coaches for their football programs. The nations that consistently top the PISA chart have some way to attract their best college students as school teachers.

Teach for America is an example that attracting top college students to the teaching profession can indeed help student achievement in the US and that their 5-year retention rate (~15%) in the teaching profession that these candidates don't stick around teaching for long.

Notes:
[1 and 2] Salary figures come from my local school district's pay scale
This is just a fun project we hacked together in the past day to share with our friends, who are primarily on the west coast. If we were designing it to scale, we'd certainly do that!
No there isn't anything inherent in the way commercial TV happens to work in the US. There are many other models, including, but not limited to:

- Taxpayer funded television (ala BBC)

- Direct viewer funded television (ala PBS)

- Subscription television (ala HBO, Netflix, etc.)

- Television subsidized by some organization that doesn't advertise but wants to produce content (probably doesn't currently exist, but could)

- Community produced television (ala cable access)

- Any other model you'd like.

Just because the current model exists doesn't mean nothing else could work, and doesn't mean that I should assume anything when I turn on the TV. There's nothing inherent about advertising.
As an old person my memory is that this phenomenon used to be relatively commonplace in the US as well, and I remember people abusing it to make prank calls and the like. Not sure if I've thought about it since the 80's.
Sure, in theory. Are there any current exploits for VirtualBox?

The way I see it, they're more secure that running the same apps on bare metal. Ubuntu host running a Fedora VM; the latter (with Transmission etc) only running when I need the apps running - seems an almost entirely painless way of providing a lot of security.
Here's a 2011 guide to modern C: [1] Discussed on YC last year.[2]

The 1970s string functions, such as "strcpy", that don't have a destination length were deprecated years ago, but they've never been removed from libraries. Microsoft's C compiler has warned about this for a decade.[3] This is one of the major causes of buffer overflows in C, and a large number of exploits involve it.. There's a CERT advisory from Homeland Security about "strcpy".[4] Seeing a "strcpy" in new code is a big red flag. If you see that in an interview, don't hire that programmer. They're dangerous.

Since C99, you've been able to write

for (int i = 0; i < 10; ++i) ...

in C code, and that was in C++ from the early years. The trend in programming is strongly towards declaring and initializing variables at the same time. Remember, in C, local variables declared but not initialized have junk values until assigned. The "all variables declared at the top of a function" style is obsolete. Pointer variables declared without initialization are especially bad.

There's a long and painful history of classic C bugs, and the newer versions of C help, just a little, to avoid them.

[1] http://icube-icps.unistra.fr/img_auth.php/d/db/ModernC.pdf
[2] https://news.ycombinator.com/item?id=9018247
[3] http://stackoverflow.com/questions/4012222/c-strcpy-gives-a-...
[4] https://buildsecurityin.us-cert.gov/articles/knowledge/codin...
Quantum Crypto Things Happen
Silicon Valley’s Hottest Deal: The Pre-Nup
It's probably less for him and made for family. People will sacrifice a lot for their kids.
I have a motorcycle with a low-tension engine oil ring to keep the upper cylinder lubricated at 10-15k RPM. To stop oil burn-off I recommend slowly increasing oil weight over time and monitoring burn-off. Have you considered Rotella T6?
Old Hollywood's Elite Were the Last to Use LSD for Therapy
I recall reading someone complaining about Apple adding this feature. Unlike normal vendor prefixes, it's not really for an experimental feature that other vendors might implement, it's a final feature that is proprietary.
No, it’s more like as if Tesla would sell mobile phones that would be limited to one cellular network.

You don’t see anyone sell or buy phones like that either – you can just switch the SIM and use it on another network.

If I want to use Apple Music, or Here navigation on my Tesla – instead of Spotify or the integrated navigation – why shouldn’t I be able to?

If I want to replace the firmware with my own (as long as it passes TÜV), why shouldn’t I be able to?

In fact, there are laws that specify I have to be able to disassemble and understand anything I buy, including any software. Any "you may not decompile" or "we will deactivate the car if you decompile the software" clauses are actually illegal in most of the EU.
It was good advice, and I agree with you. We added email about a week later and got a couple hundred signups to it. But by then there wasnt enough traffic or submissions to really make those digests valuable.

We should have had it at launch. It still might not have been enough, but it would have been a much better shot.
It's helvetica font of varying weights/sizes - not at all interesting to look at.

In short - you specify 'apple device headline font' in css and the phone uses whatever the default headline font is for that version of iOS.

Very useful for making web apps look native by matching the system fonts.
More secure than without though.

Lets try to avoid treating security as something binary.
I think what will happen is that as more cars leave warranty Tesla will be increasingly pressured to provide a "jailbreak" option for people who want to keep driving and servicing their Tesla. If they don't capitulate then regulators will eventually force the issue. They can get away with this now because their cars are all high-end and still under warranty, but it will change with the Model 3. Tesla probably knows this, but they'll hold on for as long as they can because there are many advantages to having total control of the life cycle. Things might get ugly at some point, though.
I found your addition very interesting. But I think the "Tesla fans" referred to, are referring to something different.

The Tesla vehicles are "missing" a lot of parts that rust, corrode, and cause engineering challenges. One of the main ones behind the exhaust system. Speak with a series of car mechanics and they'll invariably tell stories of cars that never received an oil change until something fails.
There are videos, pictures, and documentation of Tesla being able to swap drive trains, etc.

Put together, Tesla is able to better protect the frame and body from corrosion by separating it from the same parts that usually "Carry this along". That's a lot of text to say they reduce the surface area and mass of corrosion and failure prone parts.

This isn't to say I agree, but I find the information all fascinating (as a car guy). The best way to make a car, in my mind; more serviceable is to increase the protections from rust and corrosion. Otherwise a simple brake pad ends up being an entire brake system upon repair attempt. In regards to electronics; they can go in sealed compartments and be easily serviced. How awesome. They can also just as easily be replaced by a superior implementation.

Anyways, your post made me ramble a bit but I'm trying to determine if I agree with the original post or not.
Can someone please confirm that the in-app update is not affected by the hack?
My phone and laptop have a much lower price and expected service life than a $100k vehicle.
Just think of it as customer engagement. It's like calling slavery "job assurance".