skysight-inc/HackerNews huggingface dataset:
People are focusing too much on the exact specific attack shown here: Deduplication, modifying a public key, etc. (And proposing solutions like turning off deduplicaiton, checksum, etc.)

But that's just this attack - the fact that they have that much control over memory means there are FAR FAR FAR more possible attacks.

If you can control memory to that level then you are limited only by your imagination.

The only mitigation I can think of at the moment is ECC memory. And shame on Intel for only supporting that on Xeon.
Agreed, I wasn't contending that they are used in an emergency context.
LastPass does this. I actually used it about a year ago to automatically change the passwords on about three dozen sites. It failed on two pages that had recently been updated. It's a very useful feature though.
Those are great suggestions, especially the speeches.
Thank god someone finally said it.
I'm still not sure what your point is and I think you're off topic. What's your point about "direct neural stimulation"?

First off, what does that even mean? Surely your own eyes directly stimulate your optic nerves which directly stimulate your visual cortex. Is there a different kind of stimulation you had in mind?

I'm not sure what you mean by "a stroke can do things without influencing memory or triggering anything you can detect". Do you mean that people sometimes become unconscious during a stroke? Maybe. So what? The effects of a stroke are most certainly detectable afterwards though. I'm really just not sure what you're trying to get at.
> France could reasonably respond with "work allows people to build a better life - we promote a quality of life philosophy. we are OK with that"

I wonder if all those unemployed people in France would agree with that.
Yes, it's old. Just found it randomly.
This is an abomination. Schedule I, for a plant that is far less addictive and harmful that traditional opioids, and is used in treatment for opioids, while the country is in the midst of a full blown opioid addiction crisis? Sounds about right. Let's put some more people in jail. That'll solve the problem.
If additional proof was needed that the DEA is at a complete disconnect from reality, this would be it.
Twine Labs | http://twinelabs.com | Philadelphia or REMOTE | INTERNS

Twine builds software that helps companies connect the right employees. We create internal mobility and mentorship programs to improve retention of top talent. Powering our software is a predictive engine for successful professional relationships.

We're a bootstrapped HR analytics startup, early but with revenue. We're hiring for two roles for this fall (part-time or internship):

== Data Scientist ==

We have access to unique data sets on people and how they interact inside organizations. You’ll be responsible for exploring this data for insights, working with (and helping to build) an analytics framework that evaluates our matching algorithms. We use Python and R.

== Front-End Engineer ==

You’ll design and build components of our web application, including improvements to our admin analytics dashboard. We use Django and D3.js.

Email us at team@twinelabs.com with a brief (1 paragraph) description of your interest.
That used to be true, these days most newspaper inks are soy based, so its probably safe.
It's old (2015).

It's an interesting point of view, but generalizing everything is always dangerous.

It will be nice if the OP removes the anonymity.
This is a duplicate but still it amazes me how a story with no actual facts substantiating the claims made can make it to NYTimes front page. This is at best a conspiracy theory and if anything these leaks strengthen our Democracy
Second that. Check yerself before wrecking said self.
Developers don't usually pay, but you don't have to make money off of that project directly.

In internet/affiliate marketing this is what we called a "lead in" to the back-end offer (typically training or a consulting gig).

We would typically write an ebook and give it away for an email address, then over the coming weeks send tips and tricks leading into a soft sale of a product or training that would completely automate everything they just learned in the ebook.
This was from @pmarca's old blog, so I am not sure the date on the post is correct.

No idea.
Ask HN: Do you use CSRF protection in your forms?
With the popularity of Slack I have noticed that many IT related communities provide a 3rd-party website to receive an invitation to join their channel. However, the majority lack a CSRF protection allowing a malicious user to send spam to random email addresses on behalf of the admin of the channel. This has led communities like Gophers [1] to include a captcha [2] to prevent automated requests, and also modified their Slackin [3] installation to consider duplicated emails — even with the plus sign modifier [4]. I also experienced websites with CSRF tokens via HTTP headers that actually work, or not really because once you remove the header the request stops being blocked.

Why is this? Are developers depending too much on package managers to install 3rd-party library to add things like this without checking if they actually work? Do companies prefer to take the risk of getting bombarded with spam instead of adding an inconvenient steps to their legitimate users with a captcha? Are people taking web security for granted with mainstream frameworks?

[1] https://invite.slack.golangbridge.org/

[2] And ironically opened another bug (which is already fixed) where you could send an underscore as the value for the captcha and take down the Heroku instance with the second request, something that I never understood until they (somehow) fixed it.

[3] https://github.com/rauchg/slackin

[4] echo 'noreply+slack@example.com' | sed 's/\+.*@/@/'
Methadone itself also sounds like a huge racket. I'm not sure that once you've spiraled into addiction enough to need methadone, that you can eliminate that, rather than replace one substance with another.
Sharing pages seems a big price risk to pay for saving a little memory.

Why not turn it off entirely?
It's actually much less safe in most places. The speed differential between bikes and pedestrians is too high, and drivers can't see cyclists as easily when making turns or pulling into/out of driveways.

Writing as a cyclist who rides in the street, and used to ride on the sidewalk occasionally.
Sounds like a Jerry Springer episode.

Baby you're bad for me but I need you!

"Coming up next BBQ Brush nearly killed him but he still wants her back. And forth."
I've been watching like a hawk for the past couple of weeks and not found anything that does it, so I assumed it was just made up. However, the only app I use is Microsoft Health.
Ask HN: Where Are the Cheap Remote Desktop Services?
I want a service that would let me remote from anywhere in the world and have the same desktop. It would be $50 to $75 a year. At the very least, a desktop where I would run a specific app remotely that maintains its state. But I have not found one that's cheap. Yes, AWS has a service but it's not cheap.

I would love to buy a Chromebook and have it connect to a full app like Paintshop or whatever and never have to deal with a full desktop again.

We are getting to the point where a full desktop is less and less needed but it would be nice to have a service like that now. I figured by now it would be all over the place. Where are they?
Apollo had 17 missions and at least four failures or near failures that come to mind:

* The Apollo 1 launch-pad fire, during a training session, using a 100% pressurised oxygen atomosphere. Three dead. Grissom, White, and Chaffee. I can list them from memory.

* Apollo 11 suffered a lunar lander computer crash in the final seconds before landing, was programmed to land on what would have been unsurvivable terrain, and had fewer than 30 seconds of fuel left when it finally touched down.

* Apollo 12 was struck by lightning as it left the launch pad, knocking out much of the electrical system, which had to be reset. Fortunately they built things robustly.

* Apollo 13 had an oxygen tank explode as it was en route to the moon. The mission was aborted, though orbital mechanics meant that the astronauts still had to orbit the Moon, then return to Earth.

Any of 11, 12, or 13 could have ended with fatalities. One scenario for the command module pilot (Michael Collins in Apollo 11) was, if needs be, to leave his two crew members on the lunar surface and to return to Earth alone.
Did you get any feedback. Might just be they want high volume public facing experience rather than enterprise. Given what you said you should have got a bit further though IMO.
This would be perfect https://www.youtube.com/watch?v=WcvcEg0xGYY

And only about $250,000 each.
ECC RAM has been around for a long time and may reduce, but not eliminate the risk. The problem is that the RAM is fundamentally defective.
I don't agree, there is software that is designed to run on faulty hardware. This is often in high radiation environments (see: outer space). I agree this is not an area that much hardening has been done in conventional security models, but in other environments, it is common to use CRC error detection, parity information or other means to ensure that even if data is partially corrupted, that the original can be restored.

I see no reason to prevent someone from implementing this sort of error correction for GPG and other important cryptography.
CaptureCast Chrome Screen Recording
Show HN: Chrome extension to navigate to the source code of Node.js modules
I'll second the comment about On-boarding, follow up templated emails just serve to annoy me. I'll try out the product when I get a chance to. Maybe a simple 24 hour later email introducing support and asking if I've got questions and another follow up 2 weeks later. Nothing more.

Oh and please please please, put some effort into multi-account detection (if not a side project). It's really annoying / unprofessional to trigger off a new series of On-boarding emails just because I added a new org.

Also, price appropriately, just because your unlimited plan is stupidly priced wont make people thing the solo plan is reasonable if it's not. Ask your early customers what they're using and what features they'd use/pay for if individually offered to them.
Thats's what the explosive bolts are for.
They have all failed. OnLive Desktop was a great example of this.

http://www.pcworld.com/article/253628/onlive_desktop_virtual...
Mobile games are hard, especially since one will make a billion dollars, but a billion of them wont make even a single dollar. And the app store ecosystem makes gathering personal information to attempt to sell them something in the future even harder.

For monetization, I would probably stick with the shitty micro payments. Or use them as resume fodder to pitch consulting gigs.

That said, I only recently got into mobile development and have been doing only enterprise distribution, so I don't have to worry about what Apple/Google allows or not.
Ask HN: Good resources for new immigrants on how to settle?
Hey everyone,

I'm an immigrant seeking information on how to get started in the US. Apart of the obligations of signing up with Selective Service, getting a SSN, setup a bank account, etc. I'm especially interested in the best ways of finding a job, house, friends, etc. and in terms of financial security, what to look out for when searching for a job. My background is Computer Science/Economics (M.Sc.) with 5+ years experience in IT consultancy and software engineering (iOS/Android).

Thanks for the help.
>Stress? Give me a break.

I think that's the point.
A while ago I came across this thread[0] in which Tom Lane brings up the fact that statistics are kept on functional indexes. I can't remember why, but for some reason I couldn't get the planner to do what I specifically wanted. It may have been a weird detail about composite types.

Separately, the big downside I see with this approach is that it requires indexes on every field you would ever query by. If we were to create expression indexes on each field in the jsonb blob, that would effectively double the amount of space being used as well as dramatically increase the write cost.

[0] https://www.postgresql.org/message-id/6668.1351105908%40sss....
An extreme example of a dev abandoning an app would be the Monster Hunter app by Capcom. Back when iOS 9 dropped, it introduced a bug where Monster Hunter just wouldn't launch at all. Unfortunately, I can't find an archived version of their release notes (the only one thats been archived is from 2014 [0]), but Capcom basically said "This app does not, and will never work, on iOS 9". Under Apples old rules, this was cool. No worries. But under the new rules, this app would be removed immediately.

I don't think apps should be removed for having non-retina assets, or not supporting 4.7" or 5.5" displays. But if the app truly doesn't work anymore, and hasn't for a while, then I would consider that being abandoned. Even then, Apple will be working with devs to try and get the issues sorted

>"We are implementing an ongoing process of evaluating apps for these issues, notifying their developers, and removing problematic and abandoned apps from the App Store. " (from the email sent to developers)

[0]https://web.archive.org/web/20140923001007/https://itunes.ap...
Another problem of using hardware beeper is that when you are using a terminal, you may not hear the beep from the motherboard (which may be located in the next room or even miles away)
Not really. I used all of this on my 20% projects. Granted my entire job was 20% projects, just 5 of them at a time.
Do you not have any sort of fixed object in the general vicinity with a straight, perpendicular edge? Picnic table edges, grill lips, random boards and pieces of wood, the eye socket or tooth of an Enlish soccer hooligan?
Numeric | https://www.numeric.com | Full time | Onsite | Boston, MA

Managing $19.7 billion of other people's money presents interesting technology challenges. At Numeric, we're looking for Python people to help build, test and deploy the whole trading pipeline.

If you have experience in building systematic trading systems, or if you're interested in learning, we'd love to hear from you. We do friendly code review for knowledge sharing, and we also support staff in getting qualifications.

We have all the benefits of being an established, successful hedge fund but the developer team is still small enough to do a single standup in the morning. We have the best of both worlds.

Interested? Drop me an email at wilfred.hughes@man.com, and mention HN.
Ubuntu (or a similar OS) Desktop on a VPS? You won't get it for $75 a year most likely, but it wouldn't be all that much more.

A DigitalOcean 1GB RAM VPS ($10/month) likely would be plenty as long as you use xfce.
> Regarding (1), can you give a compelling higher-order example for which Church-Turing fails?

I never said the Church-Turing thesis fails. I only said that it only claims what it claims.

> He asserted that Turing Machines could receive the arguments Gödel encoded but the Lambda Calculus couldn't. I don't see why.

In the lambda calculus, if you have the Gödel number of a Turing machine, you can simulate that Turing machine. But if you have a lambda abstraction, you can't produce the Gödel number of a Turing machine that computes the same (partial) function as the lambda abstraction. The only thing you can do with a lambda abstraction is apply it.
Been there. I feel your pain.
Copy and Paste Text from Images (Chrome/Opera Extension)
This is awesome. I am going to try and hook this up to our geoserver instance via WMS
I would guess if you're a big VM hosting provider and you have thousands of VMs all running the same version of Windows or Linux distro, that it could add up to some real savings to have them share common pages.
> The rowhammer "attack" is successful only because the hardware is just plain broken

I too am of this opinion and am surprised this view isn't widely shared. With DDR4, we should be asking for a refund and/or starting a class-action suit, yet we're putting up with software 'mitigations' instead.

This isn't like the 2008 Phenom TLB bug [1] where the CPU was locking up so AMD released a workaround that kept it from freezing at the expense of a 14% performance penalty. This is like the floating point division bug [2] where the device no longer meets basic operational and accuracy guarantees. RAM cells bleeding into each other ought to be considered a fatal flaw, not some intellectual curiosity.

[1] http://techreport.com/review/13741/phenom-tlb-patch-benchmar...

[2] https://en.wikipedia.org/wiki/Pentium_FDIV_bug
I'm using lastpass and I haven't had to pay for the browser plugin.

I've been using lastpass for the past year or so, and I've had no real issues with it ergonomics-wise. I can't even think of any sites off the top of my head that have given false positives.

It does seem painfully slow and unresponsive sometimes though, which isn't ideal. It's slow enough to disrupt my flow more than just typing in the same password for every website.
I agree with pricing appropriately. The pricing structure was defined for Duet (duetapp.com)
> Almost all of the people I have run across suffer severely from the Dunning-Kruger effect

Sidenote: Is there a name for a phenomenon for people who are aware of the Dunning-Kruger effect to believe themselves to be immune to it? Like a meta-Dunning-Kruger effect?
I guess so.

Seems the savings would be somewhat offset by having your whole business destroyed because its easy to crack.
Huh, that's an interesting correlation. What examples led you to notice it? Have you found a way to make money from this?
I couldn't help but mentally replace the word "Googlers" with "blacks" and find that it makes about as much sense. What if one of the developers he considers good were hired by Google? Would the latter then automatically be turned to junk?
Traderwave – The next-gen trading workflow platform for global retail traders?
Perhaps a server, when running in development mode, should require a custom HTTP header? This would be a non-simple request, and the browser will refuse.
Would this be a reasonable counter-measure?
Are you sure this actually makes a difference? Can't you detect errors when searching the IP space using the POST method, or try and resolve multiple IPs simultaneously through the DNS reminding trick?
Spreemo| Senior Data Scientist | Full-Time | NYC

As a Senior Data Scientist at Spreemo, you will work with a growing multidisciplinary team of talented Data Scientists, Statisticians, Healthcare Economists/Epidemiologists, and Big Data Technology Experts. Together, you will create new and improved methods for assessing and predicting the quality of care delivered by healthcare providers and determining the impact that care quality has on overall patient outcomes and cost. In addition, you will develop related analytics tools for the payers, providers, and patients who use Spreemo’s platform to facilitate and coordinate delivery of care. You will have the opportunity to work with unique healthcare datasets that cover all phases of care delivery (referral, diagnosis, therapy, and outcome/follow-up) from the perspective of all key stakeholders (patients, providers, payers). Your responsibilities will include helping to further build and extend the data analytics environment at Spreemo. You will be implementing data pipelines for ETL, data integration, and data exploration. You will develop regression and machine learning models for classification and prediction. Your responsibilities will also include helping to shape Spreemo’s data analytics strategy by identifying new opportunities and helping to lead and mentor junior members of the analytics team.

Qualifications:
PhD or Master’s degree from elite institution in relevant technical discipline 5+ year’s work experience as a Data Scientist Experience with regression and machine learning models for classification and prediction Experience with methods for feature selection, dimension reduction, and quantifying goodness of fit Experience implementing data pipelines for ETL, data cleaning, and data integration Experience with R and/or Python Experience with SQL and NoSQL databases Experience with unstructured data and NLP Experience with Hadoop, Spark, and related big data analytics tools Experience working with healthcare data

About Spreemo:
Spreemo, a high-growth, venture-backed company headquartered in NY, is on a mission to improve patient outcomes through high-quality care. By establishing broadly accepted quality metrics for physicians and providing transparency of cost over a collaborative platform enabling end-to-end care management, Spreemo is doing just that. Today, the focus is on radiology and other diagnostic tests for occupational injuries – Spreemo connects patients with a nationwide network of over 4,000 diagnostic providers. At the same time, through its Quality Research Institute, Spreemo engages in innovative clinical research to help define best practice, establish a currency of quality, and understand implications for patient outcomes. Spreemo’s vision is to apply the lessons learned in radiology to other areas of medicine with the long-term aim of enabling true collaboration of high quality providers to deliver improved outcomes and reduced costs for America’s most pervasive injuries and illnesses.

https://jobs.lever.co/spreemo.com/77d4ceb6-be11-45b0-885f-81...
Yeah, Aluminium foil is definitely not something you can go generic with.
Earth Just Narrowly Missed Getting Hit by an Asteroid
What can you do to attack other VMs if you don't have shared memory with them?
Isn't the theater in the right here? If you sue a theater because they didn't employ anti-terrorist personnel (and, let's face it, that's a lawsuit designed for a quick buck if I ever saw one), you should have to pay their costs if you lose.
i dunno, i use the netflix and amazon video clients on my ethernet-connected panasonic viera plasma all the time, multiple times per week.

adding titles using my laptop, they just appear in the client and i select and play. the netflix playlist interface is pretty good, i can browse series and titles quite easily.

i've had it for 5 years now, and it still works fine. i'm going to use it until it dies, probably in the next 2-3 years.
Government overreach.
Why HTTP Is Better Than HTTPS
I totally agree, they have no plans to maintain 5 year old TV apps...

I love my 4 year old Sony tv. Sure, none of the pre-built apps work anymore... but our Blu-ray player does all of it and better.. the screen works great so I'll keep it till that part dies.
Organizing your Scholar library
A secret value, whether it's called a 'password', a 'key', a 'token', or comes in an 'Authorization' header or 'X-CustomHeader' is always a good countermeasure.
As a casual and unfit cyclist who doesn't break 10mph i think there should just be a "you can ride on the footpath if you're going at less than running speed" rule.
Your (a) is my example (2), where the dice are the IPs used by the multiple targets and the value 3 is the IP address you test for. It's still not a birthday attack, but it is helpful to the attacker, assuming the goal is "one compromise on any target, I don't care which". (In terms of the formula I gave as the solution to (2), if you make g guesses to attack t targets, your chance of success on at least one target is [1 - ([n-g]/n)^t].) In example (2) itself, there was 1 guess, 3, and 100 targets, the dice.

Your (b) is similar, but even more helpful to the attacker in that the loopback IPs are constrained not to overlap with each other, which makes searching for "any hit, I don't care which" easier.

It's a birthday attack if you generate a lot of values and hope for two of those values -- all of which you generated -- to be equal to each other. If you're generating values and hoping for one of those values to be equal to some externally-defined value, it's not a birthday attack, it's a guessing attack.
But metaphorically, do you want the ink of news running through your blood... Maybe!