skysight-inc/HackerNews huggingface dataset:
Does this attack still work if "Automatically fill login information" was disabled in preferences?
Minio Cloud Storage
Dear Ideal Collaborator
If one manufacturer keeps selling 85 of every new devices produced and another sells only 15 and this trend continues for 3 years now, I can say assured that one's share is increasing fast, while other's declining. That's statistics and I'm not going down with "iOS vs Android" fanboys fight (I don't belong to either) which one is better. We can only talk about competition in selected few markets (though lucrative ones), but worldwide trend is clear.
The real issue is how many latent errors remain. You have described the software industry approach, but there is also the aerospace industry's way, which is more appropriate for cars (note that aerospace software, almost uniquely for software, is given the aerospace treatment.)

If only the drivers of the test cars were at risk, I would have no objection to what Tesla is doing - in fact, I would try it myself, given the opportunity.
You're more than welcome to continue to be fascinated... and ineffective. Sometimes you need to come down from your moral highground to meet the enemy.
I used to hold an opinion of hippies similar to yours. Then 1. I watched the documentary on Woodstock and saw the disaster they made out of that place and 2. Spent a lot of time around my cousin and her friends when she was in art school. My conclusion was that hippies aren't any better or worse than other people. They suffer the same flaws as everyone else. The downside is that they seem to put forward this air of high-mindedness that rings pretty false to me.

And they have worse hygiene :)
(non native speaker here)

I parse "less" as "less code" and not "fewer lines".
I'm all for nuclear in the short-term, but in the long-term it's just substituting one problem for another.

I don't see how we can possibly break out of this cycle without revisiting the notion of an infinite-growth economy. Until we curb human population and energy consumption, we'll continue sprinting from dead-end to dead-end.
> I really am happier as a result of what I'm doing.

I'm sincerely glad for you, but how much of your current happiness comes from the challenge that you posed yourself and you won? In other terms, how much effort are you putting every day in your (fully respectable) cause?

> Can everybody be as happy as me with as little as me? I'm not sure.

Me neither. It looks to me as you chose to be happier via ecology. Most people have already chosen how they wish to be happier, and giving up cheap energy is just a huge roadblock for them.
I think the key thing is data interchange so you can get off of product X when you have business reasons to do so without running into a huge data migration project.

Standard SQL databases you can use pretty much the same tooling as if you were running it yourself. Cloud storage, you can download/upload to a new thing, but it may take some time and cost some bandwidth. BigQuery/Redshift you should be storing your data as .json.gz on S3/GCS as a backup anyway, so an export shouldn't be needed -- you'd just import the cloud storage data into another system.

I did a smallish BigTable dump a couple months ago -- kinda a PITA to do -- I don't recommend it; maybe I was doing it wrong, I'm not that familiar with hbase and it was a one-off thing.

I also did a rather small scale data migration out of app engine (~100GB) awhile back -- total PITA -- datastore dumps are protobuf, so you need to build special tooling to import the data into another database.

And generally, I don't use the other services to avoid lock-in. DNS round-robin+nginx for load balancing and ssl termination, Saltstack/Ansible deploying to Ubuntu VMs for config management and deployment. I run the databases myself so I can run it on any cloud I want -- or localhost; having a full dev environment you can create and destroy on your own machine using the same tools that you deploy to is really nice. This also enables doing things like running dev workloads on cheaper clouds (Linode) while running production in a VPC on AWS.
I wish this was true. I am locked-in with Firebase and would love to self-host now that I have resources. Sadly I will have to rewrite the API.
It's not that Firebase is not great, I just want to take control back.
I have tried Powershell recently. While the language itself is nice enough (if a bit verbose), getting a script to run is such a hassle. The security model is both overzealous and unpredictable. I finally get it running without questions for a while, but then it starts throwing up security prompts at random.
They’ve been through two technology changes, rebuilding basically from scratch every time. This (Plasma 5 and KDE Frameworks 5) feels like the final evolution stage.

It’s gaining polish with every point release. Desktop search is finally quick. The UI stack (QML) is nimble and powerful. Breeze is the best looking flat design, both beautiful and clean. Even the default desktop wallpapers are gorgeous.

The only thing remaining is the Akonadi legacy, which is being replaced. The rest is details. KDE is the best desktop Linux has to offer now, and it’s the best platform to build upon in the future.
Theres 'building castle from our minds' developing and then there's 'get shit done' developing.

I'm kind of sick of so many devs fighting to try and outsmart each other. I'm looking at legacy code basses where people wanted to have a go at a technology and it just became an unmanageable abortion because they move on, support picks up the gig and then rot. Now I'm learning obscure technologies not in use by the majority of the bell curve because someone had a thought bubble. -- end rant.

I'm all for the middle ground. Money flows to those who deliver.
Why windows? Won't that add to the price?
Why not a linux "version" for 100$ less?
They authorize you to pry into their systems if, and only if, you report security bugs back to them. If you don't, they don't authorize you to pry into their systems, and it's illegal.
Very simply, I have a password stored for "login.example.com". LastPass knows that companies like to change URLs - so next week it might be "userlogin.example.com" or "secure.example.com/login" or "www2.uk.vpn1.example.com" etc.

Essentially, LastPass made the mistake of writing code which said "If you see `example.com` anywhere in the URL - assume that you're on the right site.

LastPass will allow you to automatically fill in the username and password as soon as you visit a site (I think this is an optional feature).

An attacker convinces you to visit "badsite.wtf/@example.com/". LastPass sees the "example.com" and autofills the password field. The site has some JavaScript to detect the filled in details - and steals them.
The only viable, realistic solution is for people to stop having as many children as they currently do. The population of the planet is beyond carrying capacity at current levels of consumption.
Lastpass also only syncs data after it's encrypted locally, so the threat model is the same.
But the information is not sent to the server, it's simply pasted in the text field.
I'm not sure what kind of developer can't cope with switching operating systems.

I actually have a harder time using OSX than Windows, but that just because I spend far more time using Windows.

Is silly to just condemn something blindly just because it isn't OSX.
Revisiting the VCR’s Origins (1988)
yes, the tweet is still live: (but the linked url is taken down so I don't see any reason not to share this tweet)

https://twitter.com/wikileaks/status/756147693802643456

I think the misunderstanding (if there is any) is that they share this link by calling it 'theirs'. So I suppose that would be the reason the author was referring to them.
I've been using Redmi 2. It's only around 75$, It has good support and roms and the MIUI os itself is beautiful too. They are doing the right thing, I can't care much about privacy stuff till I am getting my things done.
Making the "save the world for my kids" argument particularly ironic.
Android to report location with 999/112 calls
climate change is one of those few issues where an alarmist attitude is actually needed. Still need to get more media outlets to change from saying "save the planet" to "save humanity".
you can't complain after the fact for earning the maximum payout

Why not? Sure, you can't accuse them of being dishonest, but why would simply announcing an action make it beyond reproach?
Great catch and everyone should know there is an easy way to parse URLs in JS. Just create an anchor element and let the browser parse it for you. Like so:

var parser = document.createElement('a');

parser.href = "http://example.com:3000/pathname/?search=test#hash";

parser.protocol; // => "http:"

parser.hostname; // => "example.com"

parser.port; // => "3000"

parser.pathname; // => "/pathname/"

parser.search; // => "?search=test"

parser.hash; // => "#hash"

parser.host; // => "example.com:3000"
It isn't a choice between "bother to submit or not", it's a case of a white-hat might be encouraged to look into this product rather than another product because of the bounty.

So the end effect is more bugs found by "white hats" rather than "black hats" because the bounty has focused the "white hat" efforts on your program. (Or encouraged them to look at all.)

I'm likely to poke around a site with a bug bounty even with small sums just because it hints at a more formal process and also likely means they have a sensible policy about not going after testers.

Bug bounties are as much about signalling than encouraging "black hats" to suddenly turn to the light side.
But surely the purpose of the manifesto is to skew that curve to the right.
So, what can be done? I posted this question on Reddit ages ago with no replys, would be interesting to hear anyone on heres opinion on it...

> Hi all,
Im sure there are many reasons why this would not work but thought would be good to get some input.
I came across this article about creating carbon fibre from atmospheric carbon https://www.technologyreview.com/s/540706/researcher-demonst... and as carbon fibre utilising 3d printers now exist like https://markforged.com/product/mark-one-composite-3d-printer... this seems like something with amazing potential.
Of course one of the main challenges is the energy needed to operated such a machine - but in the right places (which im guessing is windy as the carbon pulling machine needs high air exposure anyway) renewable forms of energy could maybe be used?
In a daydream I thought it would be amazing to replace steels and plastics with atmospheric carbon. Reduce oil dependency, lower carbon footprint (even thought its not putting it back in the ground it seems like a good second), created a fantastic building element.
Anyhow - would be great to hear why this wont (or would!) work from someone who knows more than me about this stuff. :)
My Philosophy on Testing
Linux (as in Linux/glibc/X/whatever) doesn't have a lot of native apps.

Android though would rock.
> "Cost in terms of lifestyle" compared to what? there're studies (that shows that inaction is actually more expensive

Please, keep in mind that renouncing to your car will not prevent you from breathing smoke, unless many people around you do the same. Reducing to the bare minimum your electricity consumption will not lower the slice of your taxes devoted to dealing with global warming, unless many people around you do the same. Et cetera...
Real-world coding interview [comic]
> I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad.

This was a client-side bug and so surely doesn't depend on the fact that your passwords are 'stored in someone else's cloud'?

i.e. If there was only local storage of passwords this vulnerability would still be there.

(Also worth noting that lastpass encrypts your remote and local store with a key which is presumably only stored hashed and salted on their side)
The battery claim may be for the smaller model, which uses a Core M (similar to the new Macbook). That wouldn't be comparable to the Thinkpad or Macbook Air at all.
Safe ECC curves for HTTPS are coming sooner than you think
Part of the problem is that there's a certain group of people who are more interested in pushing their pet solutions than they are in pushing effective solutions. Most of the analyses I've read say that stuff like nuclear and geothermal aren't going to be major components of the fight against climate change.

For nuclear specifically, a mass roll out of nuclear plants is simply too difficult - cost, production bottlenecks, public opposition, production time and delays, etc. Almost no new plants are being built in the U.S. currently - you can't easily go from that to replacing a large percentage of the power system with nuclear plants.

I'm not sure how any reasonable person could see nuclear as being one of the more viable or effective solutions (particularly when compared to low-hanging fruit like increased energy efficiency).
We all know by now CO2 and CH4 leads to a warmer planet. We also know what's driving greenhouse gas levels to rise across Earth. Contributors are deforestation, intensive animal farming, and primarily the combustion of carbon fossil fuels like coal, tar sands, oil, natural gas etc. But here is the underlying problem, despite us knowing how bad things are, (97+% of scientists who study this field agree we are causing the planet's climate to shift away from the temperate climate we thrived in) not enough is being done at present to truly solve the problem.

What really is disheartening and what no one in the media and government is talking about is how in 2015 CO2 levels rose by the largest amount in human recorded history. 3.05 PPM
http://www.esrl.noaa.gov/gmd/ccgg/trends/gr.html
We are being lied to and mislead by our governments that uniform actions are being performed to save the planet for the future of man. Vested interests in the fossil fuel industry continue to drive climate change. Yes, solar and wind energy is starting to become incredibly efficient and cheap but not enough of it is coming online in proportion to fossil fuel burning that persists and is also installed annually. If we do not rally against it, our ability to live on this planet is at stake. The lives of our posterity are also at risk because of the burning. It will not be until we take extreme actions not on a country level but as humanity together that we will slow the burning and save ourselves.

What are these actions you might ask that will actually be effective? These can range from banning fossil fuels entirely, global carbon pricing system, banning deforestation, changing human diets, extreme uniform investment in renewable energy and potentially fourth generation nuclear reactors, more funding for developing nations to install alternative energy sources, and to shift the transportation grid towards sustainability.
I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?
I admittedly missed it up until "Never write technical requirements or functional ones." Then I started to re-read, and caught it throughout. Then again, I'm usually not even awake this early.
If Google built a city, it might look like this
Discussion of news: https://news.ycombinator.com/item?id=12171547
There is a difference between having a linux underneath and Being The "Linux" of xyz. Android is not open and doesn't allow you full system control or full insight into all their source code. At least the last time I checked.
Another regex bug what a surprise. Do not store whole password in LastPass. To mitigate this kind of attack I store only part of it on LastPass. The full password is <last_pass_generated_password> + <few_char_nonce_that_I_know_how to_generate_in_my_head> + <short_password_stored_in_my_head>

It's just a tiny overhead to my workflow.
I know how you feel.

Apple design their UX for majority. I worked on MacOS for a few weeks and it was nightmare. Like someone removed most of features that was useful to me and added a lot of garbage.
While the debate over cost is really still not settled by default their inaccessibility from simply flying reduces cost by reducing the theft opportunity. However to keep that advantage they must not rely on the same flight paths else they become even easier and more valuable targets of opportunity.

Enforcement opportunities can also be abused as well. A repressive government can just as well use the video and near silent operation of many drones to enforce draconian restrictions. Hopefully most of the uses will be done to enforce protection of threatened wildlife but lets not kid ourselves
The difference is that Lenovo and Acer sell to US market whereas Xiaomi does not. This means that they have something to loose. Xiaomi will be in big trouble if they ever try to break into a market outside of China (and other places with weak IP laws).
Raising awareness of climate change is probably one of the most important things we can do right now.

An incredibly large percentage of the world's population simply doesn't believe that climate change is a real problem, and then they vote for leaders who are also climate change deniers (or leaders who call it a Chinese conspiracy).

It's a real problem.
I have become a bit of a skeptic -- we know that a problem like this existed in the code-base and is now fixed. So, should we then conclude that LastPass is now "more secure" because of it, or is the existence of this face-palm bug in production code actually evidence that LassPass is "less secure"? Certainly I would not go so far as to claim that this bugfix somehow makes LassPass a better option than its rivals.

I put more/less secure in scare quotes, because my point is really that fixing one particular bug certainly closes that one particular attack vector, but security is not a progress bar that goes from 0 to 100.

What this write-up does in my mind is really highlight the risks that come along with using a complex piece of software to manage your passwords. We tell users they can use password managers to safeguard their passwords and increase their security. We talk a lot about the usability trade-offs which password managers entail, but perhaps not as much about the security trade-offs!
The Napkin Project
I mean, I guess that's one way to interpret what he's saying... I interpret it as "have an eye for design and creativity to solve your problems, don't just be mindless and glue together frameworks and libraries". I personally think this is compatible with working on a team.

I've far too often seen code that does look like it's just a bunch of libraries glued together and if you really teased it apart you'd end up with something that's a lot less code and a lot fewer dependencies. And I definitely know people who wouldn't think twice about just adding another dependency to a codebase just so they could use one function. Sometimes that's justified, sometimes it's the result of lazy thinking.
Yeah it can be something else. Doesn't have to be a Linux literally, but the spirit.

In fact Linux and Unix were developed specifically how computers work. Maybe it would be even better if someone develops an OS specifically for how smartphones work.
Thanks for the kind words. We have bit of known unknowns and I am sure plenty of unknown unknowns. What we are trying to implement is a rank based on "personality cluster" of the person querying. So in your example Pablo Picasso searching would get slightly different results compared to Kanye West (because they are different personality clusters)
Upthere is out of beta, releases pricing
We can all agree that real programmers don't eat quiche though, right?
> over the next 10 years you expect to make $2M (after taxes)

That would be $300K per year pre-tax (assuming current 2016 tax rate of 33% for the 200-400K bracket). Is that really a normal mid-career salary?

I need to change jobs if that's the case...
One might as well try to skew global IQ stats to the right. And please, don't call me shirley.
Tbh I know what he is saying. Software that is speced up by BA's and driven by their requirements tends to end up being really bad software.

The best software is built up over time as demand arises for those features. Create the feature requests as they are required and implement the requests.

I think one of the major causes of why this type of thinking ends up building bad software is that BAs include literally every corner case they can think of. Ends up being extremely complicated right from the start. Then they miss other requirements. If you build by evolving software from a simple beginning just to scratch an itch, you learn the true requirements from experience. Learning about the optimal architecture from experience as they go.

Hard to do when your working off a software dev contract. Fairly easy to do if your building a product.

It's cathedral vs bazaar.
One more key contributor (since CH4 aka natural gas is so much worse as a green house gas compared with CO2 when released than burned or kept in the ground):

Human activity, ranging from fossil fuel extraction, to natural gas usage, has massively led to a large amount of natural gas leakage across the network. All this leaking adds up and is an "unseen" but incremental accelerant on these problems (https://www.washingtonpost.com/news/energy-environment/wp/20...)
Yes, but some JavaScript can detect that the text field has been filled, and then send the information back to the attacker's server. An (innocent) example of this is when you type something into Google's search field, and you already see suggestions, even though you haven't clicked anywhere or hit Enter yet.
Given enough time, sure. Or maybe smartphones will be irrelevant by then.

But within the foreseeable future (5-10 years) I doubt it.
Don't forget the Ctrl - Fn key swap.

On some Lenovo models they are the same size (and can be swapped), but not on the Carbon X1.
Please ESA, do not make another of those cute Rosetta & Philae comics for this. :_(
Conspicuous consumption has a legit role in a company's marketing - whether it's a status-symbol impressive office building, helicopter transfers for execs, or luxury cars for senior staff, it's about sending the message "We're successful, and well-funded". Whether that's true or not, sometimes the appearance of success is enough to win the investment necessary to achieve success.

Kim Dotcom in 2000, posing with his model girlfriend in front of a superyacht…a year later he had multimillion euro investments from TÜV and BMP.

Want the company to buy a motorbike or car for "Product testing"? Totally legit - but it belongs to the company. Use it for personal use, and in most countries you'll be hit with a tax bill.

Mixed-purpose trips such as "Customer acquisition in Europe"? There are specific rules governing whether/how it's taxed: http://www.lewis-knopf.com/newsletters/financial-rx-article/...

Pesky taxmen. They thing of everything.
While reading i had to scratch my head and ask myself, is this serious or is someone pulling my leg.
It's all about batteries. An order of magnitude more efficient electric battery technology is the key missing piece to get us away from a fossil based economy.
> ...but people went berserk for them (eeepc).

And how!!! My ex-boss read the press announcement on a flight (sometime in 2011?) and went gung ho. On coming back, he got me to inquire with our regular/local hardware vendors. Turned out nobody (in our small city) had even heard of it, so the inquiry was escalated to the largest city of our state. Still nothing. Finally, he actually got a staffer to fly to Mumbai and get him a piece.

Within the next few weeks, he bought not less than 7 more, to gift them away to family and friends!! Yes, berserk is right. :-)
Yes and so has Spring. Every module is a separate dependency. If you don't need security or DB persistence, don't include them.
Recent discussion: https://news.ycombinator.com/item?id=12164725