skysight-inc/HackerNews huggingface dataset:
A bunch of thoughts:

1. It's not true that there's broad agreement among experts about how the government ought to handle vulnerabilities. In fact, that's close to the opposite of the truth. On the question of regulation, the field is riven over Wassenaar and the prospect of vuln research regulation. It's also divided between people with operational knowledge of how zero-day is used by the IC and people looking from the outside in, and also between privacy activists and security researchers, which is a Venn diagram with only partial overlap.

2. Schneier is showily beating up on the USG "vulnerability equities process", which supposedly determines whether or not the USG will publish vulnerabilities. It's fair game. But something that there is broad agreement on among practitioners is that the VEP is a PR farce. Nobody needed "Shadow Brokers" to confirm this; you can't have been paying attention over the last 10 years and not see that SIGINT roflstomps IAD. Read between the lines: even without specific NSA disclosures, to believe that NSA was serious about VEP, you'd have to believe that NSA is unique among all global intelligence agencies about protecting industry from vulnerabilities.

3. Schneier's perspective on whether, why, and how vulnerabilities should be disclosed is probably naive. The best account I've read on this so far is Aitel's Vulnerability Equities post on Lawfare. For a simple example: NSA SIGINT cannot necessarily disclose old vulnerabilities, even for products that have been discontinued, without revealing to its opponents a catalog of every machine they've compromised over the lifespan of the vulnerability. Take for instance the Cisco SNMP vulnerability: SNMP is so low-volume that even mid-sized US corporations maintain full packet logs of every SNMP request sent on their network. To premise operation decisions on the idea that FSB doesn't do that would be extremely poor tradecraft.

That's not dispositive! It could be the case that the USG should simply give up on computer-based SIGINT, unilaterally disarming and working instead to help industry defend against foreign SIGINT. That would be a radical change and it would come with tradeoffs, but it's a coherent position.

A far more straightforward argument to make is that NSA SIGINT should be entirely exempt from any equities process, but that NSA should be stripped of its IAD mission, and a separately funded and operated IAD capability should be spun up under DHS, with clear directives to disclose immediately to vendors.

4. I'm a little biased on this, not because I'm a vuln researcher (I am, but I don't do the kind of work that gets marketed to government, nor have I or will I ever work with governments) but because I think Bruce Schneier's track record on this subject is both bad and inconsistent, dating back to his use of his popular newsletter to vilify eEye for disclosing to the public vulnerabilities later used to build worms.
But UAVs don't fly that high. So they kinda have to poison the air for that 300% range increase
For just viewing system information, I usually prefer glances to htop, although it can't signal. It has a curses interface and also includes network traffic, docker containers, disk IO, and it's nicely pluggable for both output formats (it can dump to CSV at interval as a daemon or while you're running it interactively (or something like graphite/influxdb if you have those)) as well as collection mechanisms (you write some python).
I'm not sure how this is answerable.

Best case is essentially unlimited, e.g., $200-500 USD/hr. If you go on a project basis, the hourly rate could end up being very, very high. Or mediocre. Or even low.

Average? We have no idea what your capabilities are, so we can't factor that into the equation. Average is probably closer to $50-125 USD.
ditto. customer in 2001-2003. Definitely 50% more than competitors back then for just a basic dedicated unix box. But founder and chief evangelist paid us a visit at our dinky little office in Manhattan, so that was a treat. :)
I would love to use this when it runs on data from a longer time period.
The problem is that your top-tier book for one person isn't a top-tier book for another, and then there's different kinds of top-tier books, ones that focus on depth vs ones that focus on context. I think it should be possible though to identify these books, classify them based on depth vs breadth vs context, and then put them in sub-tiers (eg layman, motivated amateur, budding specialist, master).

Getting back to the individual though, it's very hard to know how big of an inference gap there is for the model(s) you're trying to convey and how much the person "knows" already. Some books are masterful if you've read precursor books a, b, f, and p. Some books are masterful if you're coming from the right cultural context. And then there's tightly held biases that can get in the way of some core assumption of the book, ruining the whole effort.
There's no black market for cigarettes or alcohol though. Tax heroin at 50% and it'll still be cheaper than it is on the street. The fact that these goods are cheap to produce but highly inelastic means that the government can make a killing taxing them without introducing a black market.
Show HN: Rebooted my (fashion) weather app, now worldwide AND Android!
Fairness is a tricky concept. What is fair? Did you have the same exact environment, opportunities, choices, genetics, and everything else exactly the same as the addicts? Upon inspection, fairness is a terrible metric to measure anything by. It should be replaced by utility.

I imagine you have made mistakes in your life, small or big. When you did so, did you forgive yourself? Did you punish yourself? You have probably done both at times as it is natural to explore such things. Which one led to a better long term outcome?

Emotional blame of yourself or others rarely leads to good outcomes. Acknowledgement of the problems and help towards a better outcome is what is useful.

You can think of other people as aliens and live a nasty life. Or you can, on some level, accept others as part of you. Would you not want to help yourself?

As for what society ought to do, it should do what is in its long term best interest. All evidence I have seen is that the drug war has had a negative impact on our country and the world. Allowing the free use of drugs will still have problems, but we can focus on actual problems instead of creating more problems, ones with extreme violence and corruption at its heart.

But I do think there needs to be some serious thought about restricting advertisements of drugs, any drugs.
It's the price of living in a society. When we do not adequately help people, we end up with ballooning homelessness as it exists in SF and elsewhere, poverty, and crime that make your and my lives less safe. Where you draw the line between helping people in need and paying taxes might be different than mine, but helping people - despite their crimes - is a fundamental requirement of living in a stable society.

Prisoners have access to free drug rehabilitation. How is it that we don't offer that before we arrest people and throw them in prison?
IEEE 1588 violates the ethernet specification
> How is this different from every other fly by wire system?

In a fly-by-wire system, low-voltage electricity is used to carry information. Batteries and redundant lines can handle almost any conceivable fault.

In a plasma wing, high-voltage electricity is used to alter the airfoil. Battery backups may be infeasible (or too heavy) for the voltages required. Or the ion generator itself may fail.

> I rather have a solid state system that merely requires voltage to operate than the complex system of moving parts, linear actuators, hydraulic actuators, and fly by wire electronics that is currently required.

The current systems also have millions/billions of hours of proven flight time, as well as the knowledge gleaned from thousands of crash investigations. I'd rather fly on a current system. Also, a plasma aircraft could certainly have a fly-by-wire control also.
Interview with VideoLAN President and Lead VLC Developer Jean-Baptiste Kempf
"For the iPhone, there are four different radio interfaces that could potentially be used for malicious purposes: the cellular modem, Wi-Fi, GPS, and NFC"

Well, GPS only receives... so how is it going to detect that?
Eating too much is not illegal. The actual state of being addicted is not illegal. If someone broke the law trying to get their next meal they would be prosecuted.

The US doesn't treat obesity or addiction, or we can say they treat obesity and addiction exactly the same.

Also, "the US don't ... (and persecute) obese people," in just a few moments I can find plenty of people claiming otherwise.
Using runtime-compiled C++ code as a scripting language
I'm glad this title mentioned Bunnie, when the smartphone case was first announced most news outlets reported it as "a smartphone case that prevents spying by Edward Snowden and some hacker"
Sounds like Paxos could be implemented on top of UDP whereas AllConcur requires TCP?
Thanks, will try to hack the weekend away.
No, it's not. I believe Schneier is simply abusing the term. As I've seen it deployed, "NOBUS" usually refers to capabilities protected cryptographically, not by kernel reference monitors that hide keys, but by actual secret keys.

I don't believe zero-day vulnerabilities are considered "NOBUS" by NSA. That would be silly, because every time they're used on public-sector IP networks (which is usually where they're used!), they're disclosed.
I don't think that you are being completely illogical. One thing about the Docker stack, though, is that it is supported by every major vendor, and you may well be getting your server installations through a vendor (Red Hat, AWS etc.), so in that case you are insulated from problems. As other commenters have discussed, the vendors test and patch their Docker distributions themselves already, as well as contributing to development.

We also already have a functional replacement with rkt. It can use Docker images, and Kubernetes can use rkt as a run-time in place of Docker, so Docker is not irreplaceable.

I think that the most valuable bits of Docker today are the developer tooling - easy Windows and Mac installers, Docker Compose, the online documentation, and the Hub for grabbing ready-made images. None of which, AFAIK, makes much money for Docker Inc.
"we'd really like" is a different thing than "You will be terminated if". The first probably achieves nothing and the second is a form of censorship.
23andMe has just 76 Koreans in its data set
Drug companies spend millions to keep charging high prices
I don't think Schneier established that NSA does consider zero-days NOBUS. I think he's conflating things like Dual_EC, which are cryptographically protected NOBUS capabilities, with zero-day vulnerabilities.
WebDriver Support in Safari 10
> resources in public health, which seems to be overly politicized in the US and therefore not likely to happen.

The US spends a ton of money on public health. If you look here [1], fully a quarter of all federal spending is on healthcare.

Remember that discussion and news is always biased towards things that get attention, and that's always the problems. No one writes news articles about stuff that's continually working. "Medicare Seems to Be OK This Year So Far" isn't exactly great click bait.

The US does have serious problems around healthcare. I think the main ones are:

1. Because healthcare providers are private instead of being direct public institutions, there's a lot of financial overhead when you have federally-provided healthcare funds (insurance) that goes to the patient, and which then makes its way through the insurance system and finally to private healthcare providers.

2. Federally funding for healthcare currently takes care of old people (Medicare) and poor people (Medicaid), but everyone else is left to fend for themselves.

The Affordable Care Act is a step in the right direction, and we're gradually chipping away at the problem. But when you're talking about something where the US is already spending close to a trillion dollars every year, it's a little naive to expect us to fix it overnight.

Ships that big don't turn fast.

[1]: https://en.wikipedia.org/wiki/File:U.S._Federal_Spending.png
Not Dead containers (which failed their post-shutdown cleanup).
I am allergic to bee stings, myself and, to be honest, I don't agree with you.

The best solution is the one you can actually carry with you – if you can't afford the EpiPen, this system would be far, far better than nothing.

Further, while anaphylaxis is a life threatening situation, it isn't a situation where, if recognized in a timely manner, 10 seconds more to pull out the second or even 3rd home-brew auto-injector would kill the patient.

Next, the widespread existence and feasibility of a home-brew option would itself exert significant pricing pressure on the original EpiPen thereby making it more affordable for everyone and thus less likely that I would even need to actually make one.

Lastly, I would, in fact, use the above hypothesized home-brew option for my kids or wife (if they were alergic), if we couldn't afford an EpiPen or as a way of making sure we always had one available.

As I argued, having multiple devices cheaply on hand makes failure of one an okay thing. If they have a 10% failure rate (which itself is a high failure rate even for this scenario), having 3 on hand would mean you'd have one-tenth of one percent odds of all three failing. Add a 4th and you get down to 0.01% – get the individual reliability down to 5% failure rate and 3 devices would give you 0.0125% odds of failure. Those are actually pretty good odds. Moreover, I'm not sure what the traditional EpiPen's reliability is, but I'd bet it's not that much better than a 0.000125 failure rate.
It would still be useful to thwart passive eavesdropping.
God those moving graphs are annoying. Does anybody like those?
>Also: Nokia

If not for your comment, I probably would not have noticed the favicon.

I Google'd Nokia Bell Labs and found that Nokia Bell Labs is now the name of Bell Labs. Apparently, according to the Wikipedia article on Bell Labs [0], Bell Labs was acquired by Nokia some time in 2016. This is news to me.

[0]: https://en.wikipedia.org/wiki/Bell_Labs
I closed the page as soon as the popup happened and reset my scroll index back to the top of the page. Bad UX there.
OK, but I don't really think that conflicts with anything in my comment? For any level of NASA spending, I suggest 5-10% for popular-level sound/video/etc. (If that would cause you to want 5-10% for NASA funding to keep total science spending constant, fine.) Whether 1% or 100% of the population supports NASA research, it's still true that 99% of supporters cannot understand the cutting-edge science, and will have negligible material benefit.
Startups are a sport, and Silicon Valley is the Olympics
WATCH MOVIE FULL HD Rome / PS3 Gaming
WATCH MOVIE FULL HD Rome / PS3 Gaming
https://www.youtube.com/watch?v=x-ZjPtVBtRY
Absolutely crazy.

Thanks for the write up.
I believe he's referring to the argument Schneier is making, not to the entire notion of NSA's SIGINT mission. Dual EC was indeed an instance of NSA harming everyone's security (less, at least in the US, than is broadly supposed, but clearly and deliberately). But it's not an instance of NSA acquiring zero-day vulnerabilities and then using them to harm everyone's security.
Thank you @nkurz

edit: meant @DanBC in above line but wrote nkurz. Never mind - thanks to both. :)
Shouting Fire in a theater is a nonsense example used in a horrible ruling on the first amendment. [0]

[0]: https://popehat.com/2012/09/19/three-generations-of-a-hackne...
> Drug users aren't victims of the war on drugs

Yes, they are.

> If drugs were legal they would still be hopeless addicts.

Perhaps, but it wouldn't be as likely, since if drugs were legal managing social and personal harms related to addiction would be less complicated, among many other reasons because relapse wouldn't be as likely to involve criminal activity.

> Drug users are victims of their own poor choices.

Even if one agrees this is true, that doesn't mean that they aren't also victims of drug prohibition.
No? Learning about a vulnerability doesn't create the vulnerability, or prevent others from learning it as well.
JSFarm: a distributed raytracer that runs in the browser
I use PC-BSD on my desktop. The reason that I chose it over FreeBSD is due to their upgrade process and their use of ZFS boot environments (beadm). And the fact that X "just worked" with their installer.

In terms of packages and uppdates: The way a pkg update on FreeBSD goes is that you do pkg-update && pkg-upgrade, and it updates your packages in place. In PC-BSD, it makes a new clone of your current root environment, and does the upgrade there. It makes this the new boot environment, and at reboot, you boot into the updated system. This is much cleaner, and allows you to easily roll back in the rare event of something blowing up.

I hope TrueOS keeps this.

Ugh, The name reminds me of Tru64 from DEC in the 90s..
I talk about history with my friends often, history is full of violence. To not be able to talk about violence candidly basically means you don't discuss history/geopolitics at all. I'm just not a 'how the weather' kind of guy, so our interactions might look different.
Well one way is that they are building tools that exploit those vulnerabilities, and leaving the tools on poorly protected "staging servers" where they can be stolen and revealed to the world.

Whoever stole the tools this time announced them to the public -- how many times have the tools been stolen in the past and kept quiet so they could be used?
some (mostly technical) books are mentioned in shorthand (eg. k&r and gof).

how are those accounted for?
Not really fair to compare to Paxos if the network assumption is different.
Remember PoVRay? Those were the days. :)

It's not the fastest, and it's not the most accurate, but it should be fun to play with.

If you link a render, please link the scene as well! You can just copypaste the URL after saving.
Is this the real life? song in code
It's all part of being a good commenter. My irritations, frustrations, and nitpicks ade my problem, not yours, and I'll do my best to ensure it stays that way in the future.
So, microkernel's promise is to have a bigger part of the system in userland. But isn't that what happens around Linux as well, over time? I'm not deep enough into that topic to name reasonable examples but I remember to have heard something like "A can now be savely run in userland." "B can be configured to be run in userland or the kernel." etc. Am I interpreting these kind of statements correctly?

In my opinion software is a fluid thing. No matter what the design decisions where if some change is necessary over time it will happen. So despite being an idealist (and therefore wishing for a more idealistic kernel as well) I don't feel bad about Linux making these decisions early on at all. But of course I may be wrong. Feel free to correct me.
This can't be top... there's so few technical books and a book about Palm OS programming is showing up here.

Is there an 'all time' list that would be better? This contains a lot of garbage that got referenced once in an argument (and often a bad one at that).
The Ballad of Johnny France (1985)
Learnings from Coursera's Learning How to Learn
I don't understand what kind of malware this is supposed to detect? This only seems relevant when you're using airplane mode, and why wouldn't malware just wait until you went back online before transmitting the data?
WATCH MOVIE FULL HD Rome / PS3 Gaming https://www.youtube.com/watch?v=x-ZjPtVBtRY
You want seq?

user=> (type (cons 1 '(2 3)))
#<Class@bc57b40 clojure.lang.Cons>
user=> (type (conj '(2 3) 1))
#<Class@6137cf6e clojure.lang.PersistentList>
user=> (seq? (cons 1 '(2 3)))
true
user=> (seq? (conj '(2 3) 1))
true
> It makes this the new boot environment, and at reboot, you boot into the updated system.

So you have to reboot to apply the changes? Sounds familiar :)
Category Theory 1.1 by Bartosz Milewski [video]
How long till it's forked and prefixed with "TheOne"?
> The argument Woods heard more than any other
> from his colleagues was: yes, the war on drugs
> is hard to win, but just because lots of people
> burgle houses that’s no reason to legalise
> burglary, so we shouldn’t legalise drugs just
> because so many people take them.

The counter-argument to this is simple: Outlawing burglary works because people aren't addicted to burglary. (Well, except for a small number of actual kleptomaniacs.) Criminalization is not an effective treatment for addiction, but it's perfectly fine for dissuading other non-addictive behaviors.
PoS Malware Hits Millennium, Noble House Hotel Chains
A GAN would be helpful more for its latent space abilities than for any text-to-image capability. If you look at the GAN papers, you can see that they demonstrate how you can warp an image across multiple semantic dimensions like adding/remove eyeglasses, darkening hair, turning frowns into smiles etc. This would be great for sketches because you can have the victim walk through the latent space by recognizing which version looks more like the attacker, since people can recognize faces far better than they can verbalize detailed descriptions.
> France is at its "fifth repupblic"

What does it prove exactly ? The Fourth republic was a total mess with extreme political unstability, despite being "new" at the time.

Newness is hardly any indication of good.
Negative comments here seem to be a gross overreaction. This is primarily a code release. Code is always going to keep moving. I have used swarm and it's nowhere close to unstable as people say it is. Is it production ready? Probably not. But which software is production ready in every big release?

Unnecessary fear mongering by people who have an outside agenda.
Welcoming International Entrepreneurs
The assumption on Hacker News is that a buyout/acquisition === failing. This is sometimes true and sometimes not true.
They didn't abandon the desktop focus. That's "TrueOS Desktop."
React-Music 1.0: Make even doper beats with React
sorry I miss read. The income tax in the US works out to about 1/3
https://news.ycombinator.com/news
Duplicated and lost messages will happen in practice - TCP attempts to build reliable communication on an unreliable medium. Not clear from the paper if this matters.

I think the larger misunderstanding of the paper is the requirement that paxos have a leader - lamport's synod algorithm does not require a leader, the leader is an optimization!
Rackspace to go private again
When the GPS antenna is on, it gives off RF interference? Just a guess. GPS draws quite a bit of power when turned on.
The government already admitted that they are hoarding vulnerabilities:

...the Obama administration announced, in early 2014, that the NSA must disclose flaws in common software so they can be patched (unless there is "a clear national security or law enforcement" use)...

Obviously any valuable zero-day flaw has clear national security use to a national security agency that's tasked with breaking into "enemy" systems.
Huh? That's exactly what I was refuting. He was saying working 35 hours a week (7 hour days with lunch being paid) is "the old standard". My whole life I don't think I've ever known someone who got a paid lunch. Almost everyone I know works 40 hours a week outside of their lunch hours (at a minimum).
There is no proper ecosystem for rkt. All I have seen is marketing hype and I don't know anyone who uses it. Just go to any meetup.
Steam Wallet Hack Money Generator 2017