skysight-inc/HackerNews huggingface dataset:
IIRC The pin must contain at least one key that's in the current chain and at least one key that's not in the current chain.

Then the malware could call out to let's encrypt to issue a certificate, then load the certificate into nginx/apache/whatever, then remove the let's encrypt private key from the file system. That allows the webserver to continue serving traffic with LE's key + ransomware key until it's restarted.

1.) Infect webserver

2.) Generate public/private key pair for the purposes of the ransom on the CC server, then send back the public key back to the compromised server.

3.) Use webserver to issue LE SSL certificate. Delete the private key once it's loaded into the webserver process.

4.) Serve traffic with the hashes of the LE key and the ransomware key.

If the sysadmin restarts the webserver process, they are screwed since that's the only process that contains the LE private key.
Yes, Coke that's kosher for Passover can't contain grain, including corn, so they use sugar.

Some history: http://time.com/3769657/coke-passover-kosher/
"I'll bite" is a pretty common response when someone says something without elaboration that you sense they really want to follow up on. Maybe its a regional thing, but I'm having a bit of a problem thinking of another phrase.
Simple Core Data Full Text Search with Swift and SQLite
it was a good read, but a better title would have been,

"how quitting my dreadful corporate job for my startup dream lead me to a happy life of self-employed consulting."
Windows 10 Memory Leak Fixed
Multiple people have sought to rewrite coreutils, whether it be for fun, exercise, or out of frustration with the current utils. I know folk on 4chan's /g/ were rewriting them once, and the people at suckless are trying to do the same, only with a lot of options and features stripped out due to "bloat" (my word not theirs).

Your second question presumes that just because something is old means it is the best. Traditional things can indeed work out well, but challenging tradition is how progress is made. And you can't know if the coreutils can be improved if you don't try, right?
"Arbitrary" might be good as it collects snowflakes as a hobby.
On the question of whether GoDaddy is reliable; well AFAIK they are the biggest domain name registrar, so they should be reliable. And they seem to apply the .NET Framework quite successfully on their website.
Yup. I'm in the UK though where devs are paid shit by comparison, and in the North West where it's definitely on the lower-end of the scale.
A growing number of European students are opting to pay for their education
And also get a very, very good insurance. Bugs in such an app can kill people.
I learned how to program without an IDE, and I'm a pretty big fan of it. And strongly typed functional languages with type inference tend to be really easy to write and refactor without needing specialized IDE tasks for the job.

That being said, nowadays I use an IDE because it is extremely helpful to have autocomplete (which is okay with Racer+Vim, but kinda hacky) as well as the hover for type information (name of types, type signature, etc.). Without the hover information, I usually end up doing ridiculous things like writing bogus explicit types to see what type an undocumented function from a library will return after compiling (Is it Option? or Result?). That is really annoying.

I didn't downvote you BTW.
Nice hack!
I built [another] blogging platform
I'm hugely excited by this.
Branding works
Top Post Apocalyptic Movies Like MAD MAX
Well they might compress more, but if so they should publish ;)
Ah I didn't know Tunisia and Turkey had civil wars. I was in both 6 months back, must have happened recently.
>Unless you know what it is, it's really not obvious at all.

You either know what it means or you don't. Did you know what a flag at half-mast meant the first time you saw it too? You learn what it means and move on.
Whoever wrote the POSIX spec was too conservative. -n should mean no newline(s). Anything else is wrong.
Ask HN: Why are threads about the Major Event today being shadow-banned?
I get that this is not a technical thing, but neither was the highly-discussed article on drug legalization:

https://news.ycombinator.com/item?id=11330587

I believe there was a thread on the U.S. and Paris attacks. Is there a reason that there isn't one on this attack?
Here’s Uber’s most vulnerable code just waiting to be hacked
When US devs talk about their wage it always seems absurdly high to me as someone from the north-west of the UK, but I know you have to factor in health insurance and living costs (particularly if you live in the Valley or Bay areas).

Even so, after factoring in living costs and all the other differences, they're probably still making two or three times what I am, with less experience.
For fun and education? I am not a fan of the idea from a practical point of view, but it seems like implementing these things could be a nice learning experience.
This is a terrific project idea, but I agree that it should likely be under the GPL. Even if it is not legally derivative, it would be nice to preserve the GPL.
What is the primary danger of bugs in coreutils? Are there any setuid programs in there that could be used to elevate? Or is it the ability to exploit shell scripts using them? Or files that when you manually process them with coreutils install a trojan?
Most Windows applications don't know, since it's handled transparently by the filesystem driver, and a mounted volume need not have a drive letter at all.
Good point. Instead, I'd like to nominate "The Seaward".
I don't know how many dozens of these off-topic stories about old girlfriends you've posted, but we've asked you before to stop, and enough is enough. Really, please stop. This is not what HN is for.

Once or twice would have been fine, obviously, but you exceeded that a long time ago.
Ask HN: How does Groupon make their coupons to such a wide variety of retailers?
So, as you all know Groupon offers coupons to all kinds of online and offline retailers. Each have different software, and hardware (in some cases) for accepting payments and orders. how Groupon makes integration accessible on business' side, on a technical level. How does a business incorporate the Groupon sale into their bookeeping and inventory management. And what does Groupon do to facilitate this?
It has a very similar look and feel to Gremlin (http://tinkerpop.apache.org).

(->> ($alice) (assoc $friends) (assoc $friends) (filter (> age 20)) (count))

...in Gremlin is:

g.V(alice).out("friends").out("friends").has("age",gt(20)).count()
The OP is "luring" people with a small amount of information i.e. "bait," and other people will "bite," as a fish would, to learn the rest of the info.
"Maybe glance" might well make it derivative.
>The only stuff I eat these days is homemade, typically gruyère-based

Bravo.
I worked on an idea/project a couple years ago to OCR prices off of shelves in grocery stores. Basically you could scan an isle in Safeway and have a geo-based price list of grocery goods.

After talking to people about it though, it became apparent that most grocery shoppers already have an idea of where they are going to buy groceries, making location more important than price. It's a razor thin industry, and even the price-sensitive coupon-using folks almost always just go to the closest Safeway equivalent.
At that point, you may as well make the cheese sauce yourself.
Well, if you want to go full Culture you have ship names like (in this case a warship):

Mistake Not My Current State Of Joshing Gentle Peevishness For The Awesome And Terrible Majesty Of The Towering Seas Of Ire That Are Themselves The Milquetoast Shallows Fringing My Vast Oceans Of Wrath
The first problem is not specific to Scrapy; it is the same if you're using inlineCallbacks from twisted, tornado.gen or async def: there is no way to serialize tasks inside coroutine and save them to disk, e.g. to be able to stop the process and then restart it from the same point, or to avoid keeping the whole request queue in memory.

Stream processing could fix the second problem, but it is not a practical solution: in most cases one needs to build HTML tree in memory to do further processing (e.g. extract links). I'm also not aware of streaming regex libraries.
Apple's target customers tarted to switch to PC for video editing because editing 4K> even on an Mac Pro is a nightmare because the GPU is weak as hell.

Rendering also takes considerably longer because the GPU performance is fairly limited.
I'm surprised the article doesn't mention Anaconda, which is Python with all the things he lists pre-installed for you. I've been a fan for some time now: https://www.continuum.io/why-anaconda
Well, that would be a statically linked Rust version vs a dynamically linked C version. Either of those languages can produce binaries of either size. Statically link a MUSL libc and it'll be bigger than 6kb, dynamically link the rust code and use the system allocator instead of jemalloc and it'll be smaller than 2MB. (Or rather, it should be, I haven't literally tried it. The smallest known Rust executable is 151 bytes.)
It could be covered in the TOS.
Wrong question. This is like asking "As a carpenter, how would you use this shoe to hammer in a nail?"

Twitter, as it has evolved (or been driven depending how much you trust the vision of its management) is not a lucrative platform. It needs either to change how it connects payers, payees, and audiences drastically (and not just be pitched differently), or it needs the industry to change underneath it. The latter option is not actually that unlikely at the moment.
Can we get a layperson's explanation of the use-cases or applicability?
> I like your idea of the duress fingerprint since the police can demand that you supply a fingerprint to unlock a device (but can't demand a passphrase).

There are cases where a judge can force you to supply a password.

https://www.eff.org/issues/know-your-rights#17
Electric/self-driving cars are not proven technologies.
The iPod, iPhone, and iPad redefined (you might even say created) their categories. People have argued that tablets are fairly useless in the end, but the iPad still made tablets mainstream and is arguably still the best tablet.

The watch did none of those things. I saw lukewarm reviews at best, and I've never met anyone who raved about having one. Capturing 70+% of the smart watch market is probably more a function of demographics, since a smart watch is a huge luxury, than of the quality of the product.

How much better would Apple have to do? It would have to make smart watches mainstream. For VR, it would have to make VR mainstream. That's the bar that they set in the past.

(Note that I despise Apple and am certainly not just being nostalgic.)
I feel like every developer in the UK is underpaid when compared to US devs lol.
The fallacy in the "terror kills statistically insignificant numbers of people compared to driving" type of argument is that the intent of the perpetrators is to cause as much damage as possible, unlike the average text reading driver, and they are prevented from doing so by the police and spy agencies. Left to act freely, the perps would kill thousands or millions gladly.
Wasn't trying to imply that your issue was your fault.
I think one of the most important things that we can do when faced with these types of events, but which usually fails to happens, is for us to humbly drop our assumptions, and to dig in to try understand the deeply complex histories and motivations that led to the attacks. If we don't understand why something is happening (and no, it's not because "ISIS is evil incarnate", as some try to proclaim), how we can ever hope to stop it, or more importantly, prevent similar/analogous conditions that result in this type of outcome from arising again? Due to the complex cultural, historical, economic, and psychological factors at play, there is no "easy fix" that actually solves the problem in the long run.

Edit: I don't claim to have a rich understanding of the issue, but I appreciated the nuanced analysis in this article:

http://www.theatlantic.com/magazine/archive/2015/03/what-isi...
I think that there is a good explanation for that emotional reaction.

We have not evolved in an environment where you interact with "complete strangers you don't see and will never meet". So, you can't allow others take the upper hand on you too much. That is even more true if third parties are observing the interaction.

You can see the same, for instance, in how pub fights start for the most stupid reasons. Even if is a big city and they will never meet again, they can't just leave it alone because when our brain was programmed it was not going to be only an interaction. And if your friends, or god forbid, attractive women are present, then the contenders are trapped in the situation.
>You will get much better results out of Brotli if you restructure your data to be more compressible, and that will also improve your lzma and gzip (especially gzip) compression ratios, to a tremendous degree.

This sounds interesting, I'd like to read some examples/links/explanations.
He is probably referring to this: https://news.ycombinator.com/item?id=11334597 -- discussion on CoreUtils in Javascript!
Learning from the programmers who built your tools
It might. I'm hedging because I can't even asset that I've _never_ looked at it, I've been doing C off and on for a very long time. But regardless, my two or three patches aren't the worry here. Or rather, every patch is, but if it came into question, they'd be easily removed.
Usually it's other way around: patches are released on the day of the disclosure.
Without firm date, companies have little to no incentive to fix the bug sooner (cough Adobe cough).
Sure, how much does that system cost and does it actually taste good to drink? I've heard distilled water tastes horrible.
Server Security: Indicators of Compromised Behavior with OSSEC
Glad to hear it. That was my hope :)
Heartbleed was the first one to do that: they gave it a suitably scary name, dedicated website, and logo. The result is that the media went wild over it, and people have been trying to replicate that reaction ever since.
You could always use ClojureScript :)
I've never been all that impressed by Annies (weirdly enough, I remember this being a view bordering on heresy when I was in college...), it struck me as being too expensive and too fussy to make. Adult-Kraft dinner is too easy to make - substitute real macaroni, and cheddar instead of the florescent orange cheese dust, same milk and butter. I mix in some American slices or Velveeta-esque process cheese, since I think that gives it a little better consistency, but you can leave that out if you have an abhorrence for tasty, jello-like cheese products.

My guilty pleasure is a big bowl of mac and cheese, with cubed fried Spam mixed in.
Parent comment probably refers to [1] submitted earlier today.

[1] https://news.ycombinator.com/item?id=11334597
Allow me to hijack this thread to tell you about my favorite[1] word.

A Korean word "inbun", when followed by a number, means "amount of serving". So "3 inbun" means "serves three", or "a dish for three".

When NOT followed by a number, it is a different word (with exactly the same spelling and sound). It means "human feces".

[1] LOL, not really.
created: 5 minutes ago :-(
I'm starting to think I need to move out of the UK to somewhere that actually pays developers a decent salary.
"Alejandro Nieto was killed by police in the neighbourhood where he spent his whole life. Did he die because a few white newcomers saw him as a menacing outsider?"

No, he died because: a) police officers are inadequately trained and trigger happy. 50 shots fired by officers. 0 from the victim who had no gun. b) structural and deeply rooted racism in our society.
Business of Software Lightning Talk Applications Open
The term ’length’ in GR is pretty complicated and there is no such thing
as a canonical spacial distance between two events. There is no
canonical splitting of space-time into space and time, unless perhaps
for very symmetric space-times. E.g. we use the free falling galaxies
in an isotropic universe as a global clock and call the orthogonal
complement ’space’, aka ’comoving coordinates’.

Using the term ’speed’ in the sense of ’spatial distance per time’
implies some non-trivial conventions. So the most accurate way to
describe light rays would be to say they are “light like curves” (the
ones with zero velocity wrt the Lorentian metric) which are exactly the
geometric entities that describe the causal past and future of events.
So IMHO causality is the real physical property of space-time and the
’speed’ of light is just a convenient way to visualize it.

ℏ is probably best described as fixing the units for angular momentum.
The energy spectrum of QED is continuous. And using the properties of
free particles feels a bit fishy as they are just an approximation.
A 3-step process for naming a project/product
The only VR guys that said that are Valve, which is just a studio in a sea of AAA studios.

How well are they selling those Steam machines?

What about that OpenGL and Vulkan support on the PS4, Wii and XBox?

The games industry cares about delivering game experiences and selling IP, not FOSS APIs.
I understand why you'd use Node.js for I/O intensive tasks like web development and scraping, but for a cross-platform program meant to do everything? None of Node.js's benefits shine.

Sure, Node.js has a big community with lots of (mostly linux-only) packages, but you get a mediocre language and pretty crap cross-platform support. This doesn't matter as a web development language, but seriously gets in the way when you're developing a program designed to do literally everything.

A more useful project might be coreutils in rust, which several projects are already doing.
That's cool, I remember the yen signs. I lived in Japan for a while and studied Japanese but have never used an actual Japanese keyboard (just various IMEs over the years). What keyboard do you use?

[/guy who was just modding NIBBLES.BAS yesterday]
Yes. Exactly. Apple and every one else (company or individual) is required, by law, to comply with valid warrants. When one receives a warrant or any kind of legal request that they feel is invalid, the only way to challenge that potentially illegal or invalid request is to not comply and then let the courts decide. If there is existing precedent then they could be held in contempt. If there isn't precedent then hopefully one will be made by the result of the challenge.

The idea that the Govt can only issue "valid" warrants is flawed. The Government is just people, and like everyday citizens like myself, we're perfectly capable of breaking laws, either unintentionally (eg, giving a lift to a friend who has undisclosed controlled substances on their person (state dependent)) or intentionally (eg, murder).
Niantic Labs – A Google Offshoot
You can get supersonic by having air intake, expansion chamber, blade, high pressure chamber, exhaust port.

Think something like this: <=|=>

Importantly the air flows through the compression chamber at Subsonic speeds.

PS: While simplified this is the general approach for low mach speeds as burning stuff in a supersonic combustion chamber is much more difficult.
"The people who drop out of PhD programs usually are plenty smart enough, they just don't know how to make things happen."

It's possible that those of us who drop out of PhD programs have, in fact, made quite a few things "happen" in our lives and realized that the job market was terrible, the subject was... just stupid... and that there are other things in life than petty academic squabbles.

Just to disclose, I was about 6 months away from defending my dissertation and didn't want to throw another half a year of my life away working at a minimum wage job so I might (possibly) be able to work at a poorly paying job for the rest of my life.

It was the first really great adult decision that I made in my life.
[this post was wrong]
Without qualification, I'd assume they were quoting historical prices. It would be pretty confusing to present any kind of adjusted figures without clarifying them.
By default Rust statically links the Rust runtime library, so yeah, 2 MB is roughly it. You can get around it by linking dynamically, and uutils also supports busybox style single binary + links installation (that is, check argv[0] (or whatever the equivalent in Rust is) for which code to run).
....versus what? NFS? AFS? sshfs?
Apple May Be Willing to Risk Contempt Charge
What does AD means?
You can buy an emulsifier and add that directly (sodium citrate).

Sodium citrate mac cheese is enough to Google for.
Isn't this the same question as Google copying the API of Oracle's Java libraries?
Howto: Making Unicorn sausage
Yup:

> However, I think you could also view it from the perspective of it often being easy to make a novel contribution in a field when you possess skills from a completely different field (i.e. interdisciplinary research).

A very old story is that field crossing is a powerful aid to innovation.

> Of course you could argue whether mathematics should be treated differently because it is in some sense more fundamental.

Yup, especially for the most respected research, mathematizing a field.
I must recommend the fantastic YouTube series, BoxMac: https://m.youtube.com/watch?v=CLH1Tx2EyXE
You already have a processor too, and something running directly on that is, in fact, more simple.
Twitter is a great product that lacks an effective business model. A similarly influential product that has been used widely for many years (Wikipedia) didn't have to deal with this problem because they are a non-profit.

Maybe the only way to save Twitter the product is to kill Twitter the business.
Sadly, Virginia doesn't have a state-wide merit program. There are some school-run programs, but the achievement level to qualify is generally very high (Jefferson Scholar program at UVA, for example).

The Hope Scholarship looks REALLY nice - it appears available to any student who graduates with a very achievable GPA (3.0/4.0).
Why You Shouldn’t Do What You Love
Just to give an example:

https://github.com/uutils/coreutils/blob/master/src/whoami/p...

looks suspically simmilar to:

http://code.metager.de/source/xref/gnu/coreutils/src/whoami....
Static dictionaries are used frequently in data communications to "break the bounds" of Shannon's theorem.

See static Huffman coding in fax machines.
Apathy is crushing it. Dem votes so far: 14.8m; Repub: 19.8m; no-shows: 106m
Rob Ford has Died
It's not technically necessary for a TLS web server to have unfettered access to the private key. The web server could offload the signing operations to a separate server under the control of the attacker. The web server only has access to premaster and session keys. CloudFlare calls this Keyless SSL.

This would make the attack quite complex, though. It's more likely that the malware will just use the new key for a few hours and then delete it and scrub the disk, which will be enough for the majority of production deployments.
Here are the features I like in an IDE that make be very productive:

- Autocompletion
- Mass rename
- Source formatting
- Integrated debugger interface with breakpoint insertion and overlying of state on source
- Integrated VCS control
- Automated deploy
- Error display
- Automatic importing of modules
- Source cleanup (Automatic loop transformation)
- Automatically building my project

That's just a few things that I like an IDE to have. Some provide even more features that I like.

I understand that there are other tools that do the tasks better, maybe even faster, but that's not what I want. I want to be able to learn one thing, and learn how to use all of it's features well.
Using React and JQuery Together