skysight-inc/HackerNews huggingface dataset:
Not only for chat apps and email services, literally all user data on servers should be encrypted with the decryption key only on the user's devices. It should basically be impossible to identify a user based on the data that a service provider has.

The idea is similar to that of ZeroDB, but it extends beyond databases to everything related to a user such as files related to a user.
I agree, but my point is the people who hired the developers probably don't even know what a pentester is.
Would they be required to publish this story if they "were in the business of journalism"?

This is not about whether they are legally required to do anything, but whether what they are doing is responsible behavior.
Still we shouldn't need a full optimized build when on the development loop.
> Delphi is not much safer than C; it's not surprising it compiles quickly.

That is a funny one....
From the article:

7. I have, prior to publication, submitted all URLs and malware samples to Google’s Safe Browsing team. They have since only acted upon a small portion of the sites.
Well there is Frantech / BuyVM. We had a VM we used as a proxy for about $15 a year + the $3 IP DDoS filtering. We had several proxies on top of our Limestone Networks server (they didn't offer protection at the time - still this is cheaper).

Game servers become hot targets by kids who just don't care and do anything to get your server taken down, whether it be competition or a user got banned or just about any reason they can sum up to try and find any given approach to take your service down.

Edit:

Forgot to mention the free CloudFlare option as well (unless they stopped doing this, haven't had to deal with these things in a few years, but I have a feeling it's still about the same, there's likely even more offers now out there).
I doubt the veracity of this list. As an example, a flat in Belgrade, Serbia would run you 400 euros a month if you're lucky. That's almost 14 eur/day. Food alone can be over the $12 daily limit.

I'd caution anyone from taking this list seriously because it is based on reported income alone. There is a combination of credit purchasing and unreported income (cash exchange), each of which means cost of living is higher.

According to this [0] cost of living is $400+ without rent, which is a bit steep but much closer to the actual cost.

[0] https://www.numbeo.com/cost-of-living/in/Belgrade?seeThePric...
Most professional PHP developers I've anecdotally worked with use a Model-View-Controller pattern these days, where the SQL is abstracted away in the model under something like Doctrine2-DBAL, Propel2 or PDO. If I was hiring for a developer and they suggested putting raw SQL in the view layer, I would reject them. If I received a pull request from my team which did the same, I would reject it.

You seem unnecessarily argumentative about this, almost like you're angry and I really don't understand why. There really isn't that much difference between languages like Ruby and PHP to warrant this and almost anything can be expressed in almost the same way, the only real differences are syntactic sugars and the "flexible" type system.
Alan Cooper's About Face. It's quite old - the latest ed is from 2007 - but it is still very good at introducing goal-oriented design and lots of practical design concepts.
https://news.ycombinator.com/item?id=12149515
Debug builds shouldn't need to be fully optimized release builds, every time something needs to be compiled on the edit-compiled-debug loop.
> It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong.

They are putting their users at risk through negligence. Many would argue that's wrong.
I don't know anything about tensor flow except the very tip of the iceberg.

Can you know nothing about ml, ai, data analysis, and stats then give tensor flow some input and it will give you some input and pretty much apply it to your app?

Or do you have to know these subjects before even starting tensor flow?
Social Media Manager Jobs Work from Home – Make $27 per Hour
> They aren't treated as estimates. People turn them into deadlines. Or try to negotiate with the estimate.

I wish I had more than a single upvote to give, because that is absolute gold.

In my previous life I had the dubious pleasure of occasionally doing project estimates. I followed a fairly simple sequence which worked for that particular company and their projects. Please - do not try to blindly use this method, it will give you misleading estimates.

First I checked how much proper knowledge of the problem domain we had in house. Then I estimated (in man-weeks) how long it would take for a single senior engineer to cover a given subtopic, if everything worked the first time. Then, I multiplied that estimate by 2.5 - this covered pretty well the time it _actually_ took them. Then I added a 15% "fuzz factor" to cover for still unexpected surprises.

Multiply that by the number of engineers really needed for the project, and you get a reasonable ballpark estimate of how long in walltime the project would take, as well as how much effort it would require.

And because every single client was always haggling with the estimates, trying to turn them into hard deadlines... I added another +30% on top. We all knew that was the haggling headroom, and expected the salespople and clients to eventually carve that one out.

Our projects were mostly on time and within budget. Yup - mostly.

TL;DR: please do not try the above at home or at work. Those figures worked for a very specific company, for their highly specific projects.
I don't understand how this leads to a root exploit - I assume c-ares is running in userland inside a user's host process (a web-browser) - or if there is a systemwide daemon for DNS or other network services hosting c-ares then it should run under limited privilege. Which component is already running at root that allows this to happen?
It is, but since Borland lost their vision how to sell software and the tools division changed hands a few times, they lost most of the customers.

Nowadays most of them are enterprise customers with big maintenance contracts.

Also for shops focusing on Windows only customers, Delphi cannot compete with .NET.
Are Wet Wipes Wrecking the World's Sewers?
Yes. A lot of them also respond with threats when you try to contact them to tell them about vulnerabilities. It's not really up to the author to shoulder that kind of responsibility.

https://news.ycombinator.com/item?id=12309035 is informative. For what it's worth, it changed my mind on the matter.
I read the first edition (haven't read the 2nd yet) in 2000, and it really shaped the way I've written code since then, even though I work primarily in untyped web languages like Ruby and CFML.
You imply twice in your post that you assume there is a base reality, but why?

I could argue it makes just as much sense that every layer is simulated by the layer "above". That could continue ad infinitum or perhaps create a cycle, so eventually it's simulating itself. These may be what we refer to as simulations, like what's running on my PC, or some kind of emergent behavior. Either case seems to work.

It's natural to define the universe / all of reality / all layers as that which is self-defining, which is hard to describe without circular reasoning.
China Has Overtaken the U.S. In AI Research
As soon as I read this I assumed it was as a libel prevention method.

I'd be curious whether Gitlab/hub could be held responsible for proving the accuracy of the claims? (That was my initial assumption as to the reason they were taken down.)
You should comment more.

I have found people are just not honest with themselfs. It's more than denial? I've never quite figured it out.

In graduate school, I saw students going along with whatever the instructor spewed out. Even when I knew they didn't believe what they were being taught.

And the unethical things I have seen people do in the name of making a buck. Wow--that's a fat book.

I have seen people exaggerate what they did in order to get that comfortable job. The truth is so hard to pull out of most people. And I get it--a lot of you don't want to rock the boat, but this is an annoymous site?

The truth should come out here? And, I know, a lot of you are geniuses. Some of us just want to cut to the meat. No BS.
Rails vs. Node.js- the comparison
It's probably worth mentioning that the regex-dna test time is kind of incorrect and provides an inaccurate view of what's happening.

Java-8 is using java.util.regex which is written in Java, PHP is passing the regex requests to it's own regex process which is actually a C package and performs a lot faster.

What we're actually comparing here is:

time(java.util.regex) > time(php compilation + c regex package)
Whenever a business hires a contractor to do something for them, the customers will blame the business first if anything is wrong in their product or service. It is up to the business to take the damages in reputation and lost business opportunities to the contractor. Why should we handle this differently for software running online shops?
That compilation speed tends to be common on the Wirth family of languages, since Algol days.

Hence why many of us, Wirth fans, enjoy but aren't that much impressed by Go compilation speed novelty.

Still it is good that they do pursue this goal, for newer generations not to assume C and C++ compilation speeds are normal and to be expected.

Also C++ compilation can improve when moving away from its #include model. When VC++ "15" gets release we will get an improved linker with DB support and experimental module support.
What would you do instead? Add a padding byte in case of a buffer overflow? If you write code with lots of what-if-this-happened cases instead of just concentrating on creating correct code then you're most likely going to create an even bigger mess.
Yes, you can use TensorFlow directly and not know much, here are more examples https://github.com/aymericdamien/TensorFlow-Examples

It's OK to jump in and try it without having background information. See how far you get and start researching when you hit a wall or find sudden interest.
http://gogsys33repvmfz5.onion/ Free gog git server in Tor.

Also, it will ask for an email on registration, but it isn't verified and no email is sent.
How much does it cost to convert to UTC?

iirc it's should be 20:30.
The claim was that it was readily repeatable. So not rare once you have the attack code.
Dubai just started building the world’s tallest tower
It's gotten a lot easier to learn and practice ops over the years.

No longer do you need access to a university or government lab to get your hands on Unix. Nor do you have to scour obscure corners of university libraries to get your hands on some wizard manual that finally makes sense of some bit of it for you.

Tons of free, quality tutorials are available online, and you can get help on forums and in chat groups. Online book stores are overflowing with books on just about everything you'd want to know.

Unix (or Linux) has become a lot easier to use in many ways, you can practice on VMs, and anyone who wants it can have root on their own machine. The tools have gotten a lot better too (though both the tools and the OS's have increased in complexity, layers, and interaction with other systems). Cloud providers make spinning up machines, network infrastructure, and various services easier than ever.

Computer literacy has become many orders of magnitude more common than it once was, and a lot of devs grow up being admins of their own Linux systems.

In many ways, it's never been easier to learn ops, to some extent. The same could be said for development, with languages, tools and training being far more available than they once were.

That does definitely reduce the need for a dedicated ops team or a dedicated dev team to some degree. But just as in medicine sometimes you need a specialist who's had the training and a lifetime of practice in that speciality, and when a generalist's knowledge is not enough, I think there'll always be roles for ops and roles for devs.

All other things being equal, a dev who mostly does development and dabbles in ops just isn't going to get the level of professional skill in ops as someone who focuses mostly on ops does.. just as someone who focuses mostly on ops and dabbles in development is probably not going to be able to achieve the same level of development skill that someone who does a lot of development day in and day out will.

It's like someone being both a brilliant brain surgeon and a brilliant hand surgeon. They do have something in common: they're both medical specialities that treat the human body and they both require going to medical school, but being great at both is still rare, and if I ever have hand surgery I'd usually prefer to be treated by someone who's done thousands of hand surgeries and specializes in that, not one who's mostly a brain surgeon who's occasionally operated on hands.

Some people are able to straddle both specialities and do an excellent job at both, but those are relatively rare, because the amount of knowledge and experience you need to do really master both is still quite large, despite everything. This knowledge also changes quite rapidly, so you have to spend a lot of time keeping up with new languages, frameworks, tools, services, etc. That's a lot to ask for even for one speciality, never mind two.
I'm not sure if responsible disclosure applies here. This isn't an unannounced 0-day that could in theory be in the hands of criminal elements. Responsible disclosure only works because there is a reasonable chance that an exploit is not already widespread.

> an open invitation for malicious users to exploit.

Malicious entities have already exploited these websites. This problem is widespread - over 1000 merchants. The author has not put the cart before the horse.

If I wanted to protect my family against this by installing uBlock Origin on their machines, could uBlock possibly be hosted somewhere where they wouldn't face this censorship? They have in the past temporarily blocked websites (e.g. Sourceforge adware) but have rapidly unblocked them when the issue is resolved; this has saved my bacon on numerous occasions.

I really appreciate the transparency here - kudos. You have your facts wrong.
AutoCAD 2016 Crack and Keygen Full Version Free Download
تور ارزان کیش در هتل سان رایز و ستاره طلایی – ورود ۲۵ مهر ۹۵
Reading your comment just now cause an amusing thought.

Software Developer, it makes it sound like the software is already there, you just need to pour the right sequence of chemicals on it in the correct order, and rinse. In a dimly lit room.
Pebble cert revoked
Lots of people google the name of a webshop to check if it's legit.

Not all, but some non-tech people do that..
And lots of webshop owners google their own shop. Shaming sites that are hosting malware seems perfectly reasonable.

On topic: I assume github/gitlab both completely misunderstood what is going on, and thought this was a disclosure of security holes that could be exploited.
I wouldn't be surprised if they do a lot of these.

Perhaps try to throw it up on a few different CDNs where you pay for the service and can contact support. Like S3 or dreamhost (they have decent support too). Arguably github/gitlab isn't the best hosting platform for misunderstood journalists.
This should on the top of every page here.
It's worth it to analyse how much that server costs vs how it costs to rearchitect the application. Those 64 cores are probably cheaper then 2 months of a senior engineer's salary.
A strategy to mitigate that kind of exploit would be to re-validate any passwords passed to the system against the rules for entering the password in the first place (for instance: minimum password length).

Then you might still get some mileage out of it (you'd be able to shorten the password).

You'd also hope that in all production systems live at the moment the passwords stored would not be in plaintext but properly hashed so writing random nuls into either one of the hashes would simply result in a mismatch.
GOTO 2016 • the Verification of a Distributed System • Caitie McCaffrey
I wonder how google acts, if you dump the list here:

https://www.google.com/safebrowsing/report_badware/
Odd... https://news.ycombinator.com/item?id=12709995
> the word "Introduction" leads one to believe that the book is a good choice for beginning programmers. It isn't. The book is as comprehensive a guide to algorithms as you are likely to find anywhere. Please stop recommending it to beginners.

Reminds me of the Caltech required 3rd year math course "AMa95 Introductory Methods in Applied Mathematics", that came with the dry comment that "Introductory does not mean elementary." It had a reputation as one of the toughest classes.
Github/-lab is for files.
That's covered in the article:

> I have, prior to publication, submitted all URLs and malware samples to Google’s Safe Browsing team. They have since only acted upon a small portion of the sites.
Broken link.

Unfortunately, without more bidets, wet wipes are the only acceptable option for many people -- use them a while and you won't want to go back to dry toilet paper. We'll need to develop better sewage treatment options.
The surprising link between science fiction and economic history
As C. A. R. Hoare would put it:

The first principle was security: The principle that every syntactically incorrect program should be
rejected by the compiler and that every syntactically correct program should give a result or an
error message that was predictable and comprehensible in terms of the source language program
itself. Thus no core dumps should ever be necessary. It was logically impossible for any source
language program to cause the computer to run wild, either at compile time or at run time. A
consequence of this principle is that every occurrence of every subscript of every subscripted
variable was on every occasion checked at run time against both the upper and the lower declared
bounds of the array. Many years later we asked our customers whether they wished us to provide
an option to switch off these checks in the interests of efficiency on production runs.
Unanimously, they urged us not to - they already knew how frequently subscript errors occur on
production runs where failure to detect them could be disastrous. I note with fear and horror that
even in 1980, language designers and users have not learned this lesson. In any respectable branch
of engineering, failure to observe such elementary precautions would have long been against the
law.

-- Turing Award lecture 1981

This is why having C on our foundations matters, even if our daily programming languages happen to be safer and not susceptible to memory corruption.
Devs & ops seem to have different mandates.

Devs to create change, new features & build product to meet customer needs.

Ops to resist change. To provide a rate limit. And a sense of perspective. Bc they're tasked with stability & continuity.
For once, the Gitlab employees on HN don't comment on a Gitlab-related story.
Not a padding byte, but a word sized sentinel before and after the allocated block that gets checked upon free. Sentinel gone? -> overwrite bug detected.
That seems like a major roadblock, but hackers could imagine ways around it. Let's make it easier by assuming the creator can only store so many backups before running out of resources. That seems fair if simulations are anything like what we have now and restarting from scratch is unfeasible, perhaps due to lost input data or deadlines.

Then one approach would be to silently and irreversibly corrupt the simulation in a way that will become noticeable. Perhaps you fill every document with secret messages that require AI as smart as the sims to detect and is only revealed years in the future.

By the time it is noticed it's too late and removing all those messages will require more resources than the simulation itself. Trying to catch them on demand will require understanding how the brains of the sims work internally, which may be unfeasible.

That idea is probably preventable, but I'm sure there are exploitable and non-reversible security holes in any imperfect simulation.
Know your auditory impact
SEX FORUM – Athens Escorts Babes
I agree with your points about it's never been easier to learn. But I personally think that needs to be balanced with the notion that I don't think things have ever been this complex before.

The last 5 years or so have seen an explosion (cambrian?) in the number of tools and platforms in use - most of which are immature to put it politely.

By the time failure modes of these new tools are well understood and fixed, the market has moved on to the next new hotness.

The knowledge and experience of old grizzled Unix greybeards of the past might've been harder to gain, but it seemed to have served them for much longer before becoming obsolete.
Span – An abstraction over all types of memory available to .NET programs
There is a great introductory article with examples on how the reasoning behind distributed machine learning works. All in javascript too! It might be "too early" for some people though: http://myrighttocode.org/blog/artificial%20intelligence/part...
Can't vouch for this, just passing along some info I observed: https://stripe.com/atlas/faq
What's really surprising is that arrays never made it to the instruction sets of CPUs where the bounds checking could have been done in hardware and be essentially free.
I have network knowledge, linux knowledge, debugging knowledge, some best practices about logging knowledge and still ( as a developer ) I think dev-ops needs to be separated to a different role.

Indeed, you don't need a dev-ops person for your MVP or small web-app, but once you can afford it and the users you have require you to do `no-downtime-deployment` mechanism or database replication or server cluster, I think it's too much to ask your developers to do that. Anyway they will have to spend months on reading about the latest and greatest practices and in the end will have something half-baked, compared to what a dev-ops engineer can do for the same amount of time.
The players are those lucky few that have an internal voice and their own agency. They can do almost whatever they want, as long as they can figure out how.

NPCs are more like walking zombies and have to fill the role they were born into.
So your recommendation for people who have material that might incite a DDoS is let Github/Gitlab/another free hosting service deal with the expense/inconvenience?
The real reason is almost certainly something along the lines of 'it's possible we could get sued for libel' or 'we have been threatened with a libel suit'. Not that such a case would ever go anywhere, but I imagine they figure that it's more trouble than it's worth.
Why Silicon Valley is pouring money into ending California's death penalty
> There's certainly plenty of evidence that someone has read this book, since otherwise we wouldn't have so many C++ compilers to choose from.

I don't think that's quite true. The only C++ compilers I know of are:

1. cfront C++ (from which many C++ compilers were derived)

2. Digital Mars C++ (the one I wrote)

3. g++

4. clang++

5. EDG C++ (from which many other C++ compilers are derived)

6. Microsoft C++

7. Taumetric C++

It's a pretty thin list for 30 years. (I apologize if I neglected any.) Contrast that with C - at one time in the 1980s I counted over 30 of them (I'm not sure how many were independent creations).

Edit: removed Borland C++ as that was derived from Taumetric.
> Playing with honeypots much safer and more fun than active hacking.

How so?
Any thoughts on what people thing?
What do you use, local storage or cookies?
Only Americans are real people. Others are just foreign statistics. Nobody died at Stalingrad, for instance.
I think the bigger point is that by adding SSDs and increasing CPU/memory all at once, we don't figure out what is actually the bottleneck.
20 to 30k / year times the number of years they are in use would easily get you there.
My World Tour vlog