skysight-inc/HackerNews huggingface dataset:
EDIT: As kbenson points out below, it's not just red teams but people wanting to tinker with their own equipment: Get data out of a proprietary app, install a 3rd party OS, unlock their phone, etc. That seems like a very difficult problem.

> It's hard to imagine a scheme under which exploits could be regulated in the US that wouldn't set precedents for whether code was protected speech

Yeah, I was thinking about that too ... and fully support freedom-to-tinker, etc. ...

First, no right is absolute. We can't slander people despite free speech rights, or commit human sacrifice despite freedom of religion, or own a fully automatic machine gun despite a right to bear arms (in the U.S.).

We'd want to create exceptions for research, etc (see below) but I don't think the line is prohibitively hard to draw. The big problem I see is open source security bug reporting: There should be a way to openly notify the vendor and public without releasing the exploit into the wild, but it is a little tricky.

> exploits are more widely used in industry (for testing and red-teaming) than they are by governments

Good point, but I don't think that's a big challenge. Exceptions could be made as they are for other 'munitions' and other illegal products (e.g., drugs used for research).
+1 me too, of course.

The problem, unfortunately, as we learned through some of Tesla's struggles, is that car dealerships are deeply embedded in a bunch of localities through legislation. There are literally written into law as the way consumers needs to buy cars.

So the tough part here is that we consumers would LOVE a better way, but it's going to be a while before this takes nationwide. A few progressive municipalities will, I'm sure, adopt (and make it legal to buy via Amazon Cars), but don't hold your breath for the death of car dealerships in the next ~10 years.

(PS - I deeply hope I'm wrong.)
Its not tough at all. So called trigger warnings never existed until recently and very few people had problems. I never heard of anyone breaking down in class due to difficult subject matters in my 5 years at university (or after).
Yeah, the constant motion made it hard to focus on the text. The only way I could finish the article was by running this command in Chrome web dev tools:

$$('img').forEach((i) => i.hidden = true)
Further, presumably professional medicine recognizes fireworks as a common trigger for war-induced PTSD.
Fair enough, but I don't see a clearly better solution. Do you?

Since this is a bit meta I've detached the subthread from https://news.ycombinator.com/item?id=12361031 and marked it off-topic.
Code Climate (in GitHub UI) Browser Extension
This was a great explanation. Thank you. I wonder if similar technique can be used for lane following robot that would understand stop signs, traffic lights and avoid collisions.

I've been thinking of creating a simulator game for driving, however have absolutely no idea how to program the AI side of things.
Slippery slope arguments are too easy to make. Let's start with being considerate towards veterans with PTSD and see how that goes.
An alternative to Scrapinghub: PhantomJsCloud.com

It's a bit more "raw" than Scrapinghub but full featured and cheap.

Disclaimer: I'm the author!
Boot on Bare Metal with PXE
> Personally I don't think the government has the right to bar anyone from getting any kind of education.

Not sure how you got that from the linked article.

Here is the issue:

ITT is under threat of having its accreditation revoked, which could lead its 137 campuses to close and result in tens of thousands of students seeking loan forgiveness.

The federal government stands to lose millions of dollars in student loan repayments if ITT loses accreditation. Same thing happened with Corinthian Colleges last year - https://studentaid.ed.gov/sa/about/announcements/corinthian
Interesting... Just last week I started building a much simpler/smaller setup based also on ZFS for personal use:

- rpi 3 (running debian testing)
- 2x1Tb disks (with usb docking)
- zfs (raidz) on the disks
- ssh through tor for tunneling purposes

I can backup my personal computers and run some extra stuff on the rpi. Yes, it's only USB2, but I don't care. I mostly send incremental snapshots from my computer and it's fast enough. (e.g. zfs send -i yesterday home/user@today | ssh rpi zfs recv home/user)

I'm tempted on building a small recv server that can allow partial transfers, but so far it works for me. Also, as soon as encryption is enabled on zfs-linux, I'm turning that on :)

Total budget: ~$180 (the most expensive part were obviously the HDDs)
you realize TAILS is just debian with TOR, and non persistent storage?

I'm sure you can find a way to spear phish somebody and send them a Linux ELF binary that they will then execute, but accomplishing that is considerably harder than on Windows/OSX/Android/iOS.
How I Could Have Hacked Multiple Facebook Accounts
Is there something like this for buying new cars online? I thought I something a while back about a company like this working directly with dealerships selling new cars but I can't find it now.

I'm planning on buying an EV car this year for the tax benefits, but I'm dreading the dealership.
tends to be much older articles that had that perception, pre userns, seccomp, extended cgroup support etc.
Please be careful about rationalisation of things. Its easy to build up argument for why you need to have Facebook. We all know how dark the waters of Facebook are (with all the tech knowledge, monetising schemes and smelly dark patterns). Yet very few actualy at least try to do something about it. Its part addiction, part fear and well i dont know what. I think that least everyone here should do is to think about the problem hard and try to be honest with yourself. I bet you believe in net neutrality and open-source. Well Facebook is in direct opposition of that. It realy is, we all know it. Even though they make open-source software they would love to see world where Facebook is the net (look at India and Facebook net).

Who else should stop using the Facebook than the people who actualy understands how it works.

I am saying this becuase over a year ago i deleted FB. It was more for the fact that i started to measure how i use FB and i realized i was giving it quite bit of my focus. It wasnt taking much of my time but it was constant distraction. So i stopped. After 14 days i never felt urge or need to use facebook again. Seriously it was like some spell. And outcome? All the worries about not being able to reach foreing friends or see what are my friends up to. Well the interesting people luckily found another way to contact me and since then all the important stuff was much more focused. Other people started to talk with me, they had a reason to talk with me in a pub because they got something new i didnt know about. And leaving fb became theme for conversations because people wondered why i did it.

And its not only me, there are 4 people i know around me who came to the same conclusion. None of us came back.

Btw when you will try to actualy delete your fb account, its a minefield of dark patterns. First you need special link, because you can only deactivate from settings. Then you will have to go through pile of emotionaly draining photos of friends with claims that they will mis you and you wont be able to see what they are doing with their lives. Then few traps with agreeing about deletion with switched meanings of buttons. In the end you wont actualy be deleted. You will be put to deactivate mode for 14 days, if your browser accidentaly auto logins then you have to do it again. After 14 days you are sent email and if you miss it and wont acept it in certain time - you wont be deleted. Of course since 1. 1. 2014 it realy doesnt matter because facebook keeps your data even if you delete account. (i deleted it just before 1. 1. 2014 and i still think they kept all the shit, because how would anyone know).
What am I supposed to be looking at? I just see:

> The page cannot be found

> Sorry, that address doesn't exist at this site. Please check the url and try again.

I'm in the UK. I checked in Firefox and Chrome.
Likely. Then again, good opsec would imply that you don't join untrusted networks, period.
The XMPP ecosystem doesn't have security anywhere comparable to what we're talking about (well-implemented, end-to-end, forward-secure, multi-device messaging).
Installing bluehydra on raspeberrypi
It also has an invalid website certificate. Kind of a shame that it's so neglected, but it's a pretty good example of what happens to sites when they're allowed to sit for too long.
Consensus without Trust: Cryptographic Enforcement of Distributed Protocols
It's just sealing their fate somewhere down the line really, in a part of the world where people have famously good memories for wrongs committed against them. Like the Saudi's, they're fine while the world desperately needs them, and the day after they don't, they'll all be dead.
> I might conceivably want to use an Android or iOS exploit to liberate some of my data from my phone if some apps are less forthcoming with that data than I would like.

A great point that I should have thought of. I wish I could edit my original post and add that consideration.

I can draw a conceptual line: Ban using exploits on other people's equipment. But practically, I don't see how to stop that without criminalizing distribution, in which case I can't get my data from my phone (or install a 3rd party OS) without the vendor's permission.
If a person cannot read a piece of literature without having a panic attack then perhaps they are not physically able to take a course in, say, English. It is up to the university to decide what it does with this kind of student: do they choose to not admit or graduate students who are incapable of completing the degree requirements? Do they tailor the degrees to students with special needs and make exceptions? Do they insist these students take a leave of absence and receive treatment before they continue?

All of these responses seem reasonable. If a student has such a unique life experience that they are not capable of completing standard university coursework, then the onus is on them to make that known to professors or administrators and come to some compromise. It is not the responsibility of the university to label and restructure its courses to acknowledge that there is a tiny fraction of the population that cannot participate in their education without severe distress.

Anything could be a trigger. Anything involving criminal justice could be a trigger for someone falsely (or rightfully!) imprisoned. A rape scene could be a trigger for a rape victim. Certain feminist literature could be a trigger for someone whose life was ruined through a false rape accusation. Someone who was recently dumped or cheated on could be triggered by discussing relationships. Perhaps a physics class triggers someone afflicted by severe existential angst -- entropy always increases? Domestic violence, child abuse, war, general violence, bullying, racism, torture -- many of these, things every college student should consider and think about before graduating -- are all triggers for someone.

So we should really put a trigger warning on every course. Better, let's make that trigger warning describe roughly what's going to be in the course and what students can expect out of it. Better yet, maybe put the grading scheme, reading list, and the rest of the administrative information about the course in it. We could call it some kind of nonsense word so as not to offend the people who hate trigger warnings or the people who love them. How about "syllabus".

Course syllabi already have a generally accurate description of course content so students may choose whether or not to expose themselves to any given material or prepare themselves.

The fact that a course is a college course and discusses human interaction at all should serve as enough as a trigger warning for anyone -- there could be triggering material in it. Period. Even if a class is about cold war economics, a student could bring up rape or racism in discussion.
It does seem that way. It's kind of how a few people have food allergies, but a larger number of people have foods they refuse to eat despite not having allergies. It's not uncommon to find out that someone who merely has a preference to avoid an ingredient has been fibbing and calling it an "allergy" just to smooth things over socially.

This is really frustrating for someone with a genuine allergy because you feel drowned out by all the "fake" allergies that are just preferences and as a result sometimes people take allergies less seriously because they assume your "allergy" is just a preference, or just generally take it less seriously. For example, if someone asks you if something contains gluten, knowing nothing else, what would you estimate are the chances they are actually seriously allergic to it? These days, with the popularity of avoiding gluten in the west, maybe below 50%. This is a scary situation for anyone with a genuine allergy.

I'm sure it's just as frustrating for people with genuine PTSD or other situations where real mental health trauma could occur, to be drowned out and lumped in with all these folks who merely experience mild discomfort at discussing a topic.

So, a plea -- if you don't genuinely suffer from a serious physical or mental health response to a situation, but merely mild discomfort, be honest and just say you don't like something. You're making it worse for people with genuine problems when you lie and call it a genuine medical problem.

If you're not sure, a good rule of thumb is if you haven't been to or plan to soon go to a doctor (or really want to, but can't for some reason eg financial) to discuss the problem, it must not be disturbing your life enough to count as a real malady.
While a generally agree that dealerships are awful I think the service they provide is the test drive. Car companies don't want to spend money managing "drive centers" all over the world. Since dealerships provide this "service" to them they must in turn ensure that the dealerships can survive by keeping them the most common place to buy a car. If they did all of their sales online the dealerships would go out of business.
The chart will be a bit old now coming from a white paper that was published 4 months back and was in the works for some time before that. (disclaimer - I work for NCC but didn't work on that paper)

One of the big challenges with the containerization landscape is keeping up with changing product capabilities as there's a lot of movement all over the place.
It was the Intel 8080 not the Z80 for which the V20/V30 had an emulation mode (just looked it up).

To do some nitpicking on this great example: The Intel 8086/8088 was designed to be assembly source compatible (up to search & replace) to the Intel 8080 (source: https://en.wikipedia.org/w/index.php?title=Intel_8086&oldid=...). People like legulere would thus clearly nitpick that the criterion "instruction sets that have been developed independently" is not satisfied here.
Do you have any links of reporting on this? To be honest, it's a bit of a funny idea, given how banal the cement industry seems.

I could see something like this being an interesting This American Life story.
It's not even a web app. It's a CHROME app. A web app would be accessible via any browser. But nice to see the Google propaganda working.
This is incremental progress, it's just one school. But a crazy step in the right direction. For-Profit institutions are a plague on our nation (high-cost low-value educations) allowed to rise up out of the failings of our strained public institutions (not enough capacity to meet demand).

What really blows my mind is that this seems to come after the justice department discontinues for profit federal prisons. It's like all that "change" we were hoping for with Obama seems to be coming at once.
> Malware can't unlock it against my will without a jailbreak.

By jailbreak, you really mean "vulnerability" and unfortunately those are quite common in the Android hardware/software/bootloader realms.
Even worse, he tries to deny people their legal right to build their own clients to services they have the right to use.

Which is a legal right in the EU (and even allows you to reverse engineer proprietary code for the purpose of writing your own system that interoperates with a proprietary one), so this is very sketchy.

Moxie seems like a Google-employee.
When you will try to actualy delete your fb account (at least when i did it some time ago). Its a minefield of dark patterns. First you need special link, because you can only deactivate from settings. Then you will have to go through pile of emotionaly draining photos of friends with claims that they will mis you and you wont be able to see what they are doing with their lives. Then few traps with agreeing about deletion with switched meanings of buttons. In the end you wont actualy be deleted. You will be put to deactivate mode for 14 days, if your browser accidentaly auto logins then you have to do it again. After 14 days you are sent email and if you miss it and wont acept it in certain time - you wont be deleted. Of course since 1. 1. 2014 it realy doesnt matter because facebook keeps your data even if you delete account. (i deleted it just before 1. 1. 2014 and i still think they kept all the shit, because how would anyone know).
> We certainly didn't. Most French folks who missed the Minitel just ended up subscribing to one of the major online services of the time, namely CompuServe and Prodigy.

People might not realise just how eye-wateringly expensive these services were.

In 1988 Compuserve charged $11 per hour. (Very roughly, that's $22 today).

I'm not sure what Prodigy charged, but it's amazing how much people used to spend on very slow online connectivity.

http://imgur.com/a/zdoZj
English is such an oddball in the Germanic family that I'd count it an outlier. About 40% of its vocabulary is of Latin origin, and in sum about 60% of its vocabulary is made up of loan words. A couple years ago I submitted the "Uncleftish Behaviour" here [1], which demonstrates English with only germanic words.

[1] https://news.ycombinator.com/item?id=7671549

For the rest of the family, there's a lot of mutual intelligibility. And, a metaphor is a metaphor, no metaphor holds if you dig deep enough.

> A Lisp developer looking at Clojure code will understand very very little.

This is an assumption, not a fact. Java interop code and (recur) are a bit confusing in the first sight, but not undecipherable.

The prog lang that's most like English is C++: too many things are overtly overloaded, see phrasal verbs.
I dunno have you seen the average person take a car for a test drive? Half the times they don't really want to buy it and just want to play with it. I don't know that I would want tens or hundreds of people in my [figurative] Tesla, possibly beating it up only for a chance at some sort of small kickback.

Then again I didn't think Uber could work and now I take them all the time so who knows!
That was my first reaction, then I realized that for $10 I don't actually care to find out or risk anything. I'm sure that it's more a clever ploy by some lawyers to get very rich however.
How to use Sublime Text from the command line
Why not use Conversations.im? https://conversations.im/

It’s actually usable, supports a lot more encryption methods, is more up to date, and actually looks okay.
Now BMW offers Apple CarPlay, might be a reason to buy the upgraded screen. Anyway it's ridiculously expensive for what it is, but it gives them space to negotiate and/or make a profit.
Foreign competition is important, because some things (like oil drilling or sugar farming) are only doable in a few places, so if one company captures those places it'll be tough to compete.

Also, the fact that some companies became very dominant doesn't mean ipso facto that they harmed consumers. If a company becomes huge fair and square (as opposed to via regulatory capture or other coercive means), it may just mean that people like their product the best.
Bringing Together Ansible, Docker and Vagrant
The prometheus core team has been pretty clear on their stance about some of the things that vulcan is focusing on (things like long term storage for example), as such it didn't make sense to fight with them to make them change their mind ;)
Selling it yourself can also get you more money for the old car. If the dealer gets to couple the two deals, they can come down $3000 (say) on the price of the new car, if they can rip you off $3000 on the price they give you for the used one.
I think your description is accurate but your analogy is tragic. What kind of a mess have we got ourselves into that that the University is now comparable with retail?
If the attacker controls the wifi, he doesn't need to put it in the captive portal page; he can intercept any non-secure http page and put his exploit there.

You really shouldn't connect to untrusted networks at all if you want to be safe from this kind of attack.
Is that really shocking? That's the kind of thing that happens when a president is leaving, and doesn't have to worry about another term, or in this case, campaigning for anyone.
The trouble is that nearly every app does "something tricky" because it's so baked into Apple's frameworks. Every UI control calls methods using strings when you interact with it. Key-value coding and observing works extract method names from strings. Core Data uses method names to look stuff up in the underlying storage. And these things are so easy to do that it's pretty common for third-party code to do similar stuff. Reliably figuring out which methods were safe to change would be really tough.
> Has anyone paid money to license the protocol?

As Allo is not GPLv3, they obviously got it under another license.
Databases have been using master/replica lately, which, fortuitously is (usually) actually slightly more precise anyway, and so is strictly better in every way
When the discontinuation of federal prison article came up on hacker news I commented, "Now if we could only outlaw for-profit schools!"
Huge portions of the cost of building a utility are due to local regulations, not the inherent cost of doing it. http://www.wired.com/2013/07/we-need-to-stop-focusing-on-jus...
The government has no right to bar you from traveling.

The government has no constitutional obligation to pay for your plane ticket.
Plaid has callback support and good latency. While I appreciate and have worked with Intuit for a long time, it's difficult not to say plaid has the edge in a modern API design.

The current aggregators are optimized for big businesses and venture backed startups. I used them to sell a startup to capital one, and I named other people doing the same.

You just need to think very long and very hard about your business model.
Recovering Ransomware-encrypted files from packet capture
This is a good explanation thanks.
I will be graduating college this year, just a few days after my 26th birthday. Don't worry about age.
AFAIK, the Raspberry Pi's put their ethernet on the USB bus. That's a huge downside to using a Raspberry Pi as a NAS solution.
It just gave you a random valid phone number, along with a name (yours)? Doesn't that qualify as leaking PII?
That was a delightful read.

Wasn't entirely sure how they knew where to look for the Passport credentials though, unless they'd gleaned that information earlier. From the article the author makes it sound like they had a limited window to mount the disk, pull off what they wanted and shut everything down, did they already know where to look?