skysight-inc/HackerNews huggingface dataset:
Various eastern philosophies have a somewhat different solution to this whole problem.

Consciousness -- as in the sheer fact of experience -- is itself the base "reality," out of which everything is made. If you examine everything you're calling "the universe," all you will ever discover is sights, sounds, thoughts about sights and sounds, belief (or certainty) that those sights and sounds are caused by something external, etc. What are all of those made of? Consciousness, of course.

In this reality, "brains" are the entities that consciousness has dreamed up to demonstrate correlations with conscious properties. In our reality, we therefore say that "the brain causes consciousness."

If you investigate your experience closely, you'll discover that the epiphanies "I exist," "I am conscious," "I am alive", "a world exists" all point to the same ineffable "miracle" of existence, the one "substance" of which all realities are made.

Upon hearing this, perhaps the mind thinks "just as there are realities that exist without time and space, why can't there be some without consciousness?" There's a very interesting answer to that question, but it won't come in the form of thoughts.

Of course, there's no reason to believe any of that. On the other hand, as the Buddha said, don't believe me....
Certainly yes, this is why he created new account at HN
For those that may have read this comment and found it strangely familiar, I'll save you the trouble googling. It appears oxide regularly comments on opiate related threads, so his above anecdote isn't a copy of someone else's comment - it is just him re-stating his experiences he has posted before.

I mean no criticism of your story oxide; merely commenting for those who thought something might be awry.
According to the article, the stores were running malicious javascript which grabs people's credit card info. This obviously means they are vulnerable in some kind of way, but I fail to see how this is reasonably likely to be exploited. Even if it was, you also have to consider the benefit of warning the users.

I am not a security expert though, and I might be missing out on something.
Back to the original problem of skimming.

I think the fastest way to get sites fixed is to run a script that crawls sites in the list, parses their Twitter and posts a warning there with link to original article.

Can someone help with that?
Nicholas Merrill describes how his NSL arrived here around 1:20 in:

https://www.youtube.com/watch?v=eU2wAu4qE60
KID GONE VIRAL – SINGING SAY YOU WON'T LET GO
But my subsequent comment was solely about Snowden...

It seems strange to rebut my comment with unrelated commentary.
What about the consumers who are being put at risk of being defrauded? Do they not have a right to protection? Malware infected ecommerce sites could be stealing credit card info and robbing consumers. Merchants who endanger consumers by failing to provide a secure platform for digital transactions do not have any right to be protected from having their negligence exposed.
So it seems the real bug here is that a site that is hosting malware is doing so because its actually vulnerable to being hacked, was hacked, and malware was installed. So posting the site name identifies a vulnerable site (which is wrong) and stops informing people that those sites have malware on them (which is an issue as well).

That is quite the catch 22. And of course many of the sites owners are clueless and don't even know how to patch or fix their systems.

My isn't that that a mess?
It's been quite a while (the ole 2500 is in storage) but it seems like a person could change directories without the "CD" command. Just type the path in the CLI, hit return, and you moved to that directory. edit: Likely thinking of the "implied CD" mentioned in the link.
A Simple Trojan Virus
I thought the article would be about THIS Levi Strauss :) https://en.wikipedia.org/wiki/Levi_Strauss
So true.

Some years ago, I changed my career from Linux System Engineer to Web Developer (Rails and JS). I know that the fact that I was building HA clusters some back then has 0 relevance with the job I am doing now, but it is hard for me to just delete this from my résumé, to leave more room to explain what I am doing now.
It's not wrong to expose negligence which endangers others.
it is amazing to me that this guy earned 20k euros in finland as a developer and went on to be a bus driver where he earned more. He also talked about how he got fired for not handing in weekly reports..Someone with his skills should be able to work anywhere and make a really good living. Anyway, youtube seems like a good way for him to express himself, i hope he will find success.
I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed. Most of the owners probably barely know the Googles from the Facebooks, so even if you email them saying 'you have this JavaScript thing that's bad' they won't understand and will blow you off.

OP doesn't go into details of how they check the stores, but I'd assume they have some sort of script as they checked 255k. If that's the case it would be trivial to send an automated email if malware is detected, and include links explaining how to fix it.

It won't resolve everything but it's a lot nicer than naming&shaming businesses who have effectively done nothing wrong. What I mean is they probably hired a developer or team to build their website, and assumed that they would build a secure website - they didn't go out purposely and find someone to build them a site that would be hacked.
If anyone, like me, prefers non-pdf arxiv links, here's the paper linked by the parent: https://arxiv.org/abs/1602.01528

Edit @protomok thanks for the link, it is an interesting paper!
Thank you for the detailed response - much appreciated. You have tempted me to look into Flynn further.

The headline feature that attracts me is HA postgresql - that has instant relevance. My greatest concern is stability - I'm not seeing many success stories but lots of problems. I want to hear that Flynn is "the one bit of my stack I don't have to worry about". I hope you can publish some case-studies (both successes and post-mortems) including discussion of the attempted architectures.

A fundamental philosophical worry I have is that it is a "wrapper tech". I increasingly stay away from these - the promise is that they make the underlying tech easier/quicker to use but they make assumptions that don't hold for you in the long-term, they serve too many unrelated use cases so become bloated and poorly fitted to your own needs and they reduce the features, flexibility and stability of the tech they wrap. The cost in fixing & working-around the wrapper can quickly exceed the cost/value of building your own glue based on the underlying tech because it also gives you a greater depth of knowledge in the fundamentals and more power.
Ask HN: How to get started with machine learning?
How should a software engineer with no machine learning background get started on the subject?
Do you think that getting started by learning a framework like TensorFlow is a good idea or should I gain a background knowledge first?
So, you don't think that if you operate something that is a risk to other people, it's your obligation to reduce the risk? You can just say that you are incompetent at what you are doing, and therefore you shouldn't be shamed for putting other people at risk?
Daniel Shiffman (Coding Rainbow) - https://www.youtube.com/user/shiffman

He is a very funny and a great teacher!
Do this kind of thing on your own domain.

I have a list of major sites with currently active phishing pages.[1] This is basically a join of PhishTank and DMOZ. Nobody seems to be upset by that.

Google is at the top of the list because of their hosting business. It's not just Google Sites. You can put a web site in a Google Spreadsheet cell, which Google doesn't seem to check as a possible phishing site.

If you host for others, or offer a URL shortening service, you need automated checking against all available phishing lists or you will be exploited.

[1] http://sitetruth.com/reports/phishes.html
Looks like a decent question, I upvoted.

I think the main motivation compared to IAAS is to run on your own choice of machine e.g. on-premise or dedicated from OVH/Hetzner, or across different cloud providers while not incurring the full admin overhead of baremetal. The reasons can be portability, control, performance, privacy or the potential for 1-2 orders of magnitude cost-savings.

And yes, scale, high availability, self-healing, auto-scaling & load balancing is where the admin pain comes in.
> I think those books have a specific time in people's careers.

Agreed. Code Complete gave me a huge boost as a liberal arts refugee in computing. Having given away my copy, I bought the second edition, thinking it would be worth a reread. Not so much. Pragmatic Programmer didn't do much for me either, probably because I read it too late.

On the flip side, plodding through TAOCP just because? Better to read the relevant chapters when you've got an actual project to chew on.
Doctors much bettter than internet or app-based symptoms checkers
Okay, so assume he hosted the list himself and is now DDoS'd.

Now what? I'll give you a budget of $100 a year.
BASIC in the old times, maybe?
This is completely unacceptable. You're treating this as though the author was publishing a list of vulnerabilities about sites. That's not what the author did. The author published a list of sites that are already infected with malware and thus are dangerous for users to visit. This is a public service and there is zero expectation of "responsible disclosure" to the sites. The only thing that disclosing to the sites without telling the public does is protect the reputation of the site, but there's no expectation for anyone to try and protect the reputation of sites that are serving malware.

> We did not feel comfortable hosting information that could be construed as an open invitation for malicious users to exploit.

The sites were already exploited. That's the thing. At best I can see the argument you're making being "we don't want the sites to get exploited a second time", but that really shouldn't be a concern. The sites were already exploited, there's nothing left to protect. And publishing a list saying "this site has malware on it" doesn't actually tell anybody how the site was vulnerable anyway, unlike disclosing security vulnerabilities which by their very nature informs people how to take advantage of them.
Federated Cloud File System Framework (FedFS) – A Technical Overview
Money talks. Uness it's consumers' money being stolen, it seems.
Did you ask them for permission to publish a private communication? Probably not, bad of you! -

Github/-lab is for projects imho and not a publishing platform. Why don't you publish it on your blog or something? All power to Github/-lab, kick out such stuff!
> I'm kind of with Gitlab on this one, just publishing a list of broken sites isn't going to help them get fixed.

So the malware should be allowed to continue stealing credit card numbers just because the site owners don't know any better?

Is that really a position you wish to defend?
Celebrating open standards around the world
KBK karma butt kissing
Wow I've read many more of the books in the second list.

The second list should also include Structure and Interpretation of Computer Programs.
hmm... good project for learning purpose
It feels to me like title-centric corporate culture might be a part of the problem here. Are you an SRE? An SWE? Do you Build? Or do you Run? Are you a Software Developer or a Software Engineer? They're interchangeable to the author, but she includes both on the off chance that you the reader are sensitive to some fine splitting / quantum structure...

I for one welcome the blurring boundaries. It feels weird to say, sure, I wrote this code with pathological runtime behavior, but it's your problem now, Ops Person. How do you learn to avoid that mistake if someone else absorbs the pain for you (ie learns your lesson)? Personally I feel a bit cheated when this happens.

At some point in your career, you might get the nagging suspicion there are important lessons to be learned outside of your current role -- lessons that will make you N times better at your current role. If so, heed the call, take the extra responsibility, and level yourself up. Easier to do at small- to medium-sized companies, but not impossible at large companies either. Take the initiative!
I think so. A lot of the recommendations are based on research and, at the very least, it helps strengthen knowledge that you may already have. I learnt a lot from Code Complete when I read it.

It is also an easy read - its not a hard academic book.
The original Macintosh User Interface Guidelines are still worth a read. Some of them have been forgotten. A good one is "You should never have to tell the computer something it already knows".
A 'normal consumer' won't be helped by such a technical list on github/gitlab. Do you really believe they would look there? If they wanted protection they could have installed Ad-blockers etc. long time ago already. (Or use more reputable shops)
US missiles just made the war in Yemen even more complicated
What I've discovered is that software is craft. Everyone progresses through phases of apprenticeship, journeyman, and master; with the art of "estimation" progressively improving.

Yet when we call it Engineering, we hold ourselves accountable to a different set of expectations.
Bringing the Power of the Internet to the Next Billion and Beyond
I edited my post, but I don't think that's really fair. The business most likely outsourced the development of their site to someone who probably assured them that they would build a secure site. The business probably trusted them (maybe the developer was even recommended) yet here we are. The business didn't know enough about building a secure website, so hired someone they assumed did.

Edit - Poor analogy removed.
I think responsible disclosure would be to the people who would most be affected

businesses who have insurance for things like this, and possibly have software to reduce any issues that they would be directly affected by

or users who could lose a significant (and damaging) amount of money if they arn't careful with checking their statements?

It seems silly to support the scammers in this case?
"Nothing is impossible for the man who doesn't have to do it himself." -- A H Weiler
> platforms with browsers is the only domain they care about supporting.

What? No. It means that platforms with browsers are part of the domain Rust cares about supporting. Not the only domain. You asked for non-outliers, bz gave an example of browsers.

There's plenty of work to make Rust work on embedded platforms where no browsers operate, and some of this is being done by Rust contributors employed by Mozilla. No need to assume that Rust is only focused to the needs of browsers.
Someone who is able to exploit such vulnerabilities already has his very own and much much longer list.
Are they in the business of journalism?

Lots of people are saying "But the sites are already exploited" ... they are probably still exploitable further also, and GH/GL don't want to be at that party.
KiCad: A commitment to freedom
a lot of non-normal consumers can end up making a lot of noise, sometimes its enough to cause change to happen

as was noted, 600 sites have already cleaned up their act

> Update Oct 14: 631 stores have been fixed, good work everybody!

So is it really as useless as you claim?
You mistook "free and accessible" with "public".

You may exercise freedom of speech but not on server that belongs to a private company - it is their right to limit what kind of content they like.

But in an essence you are right - companies should exist to benefit society, but it is not how it exactly works right now.
Couldn't agree more.

I'm not sure if GL is trying to protect themselves against something and are making up some excuse to justify it but the reasons given for taken down the list don't hold water.

GL would be far better stating the real reason for taking the info down (surely there must be one).

So far what they've done is seemingly to protect the merchants reputation and perhaps protect GL from some imagined legal backlash? The backlash would have no basis is court or other services like Google's own SafeBrowing would not be viable.

Are we to assume the GL cares more about that than users/visitors to these sites?

The statement from GP is frankly pathetic.
If you want to jump right in with "hello world" type TensorFlow (a tool for machine learning), see https://news.ycombinator.com/item?id=12465935 (how to fit a straight line using TensorFlow)

If you like to study/read: the famous Coursera Andrew Ng machine learning course: https://www.coursera.org/learn/machine-learning

If you just want course materials from UC Berkeley, here's their 101 course: https://news.ycombinator.com/item?id=11897766

If you want a web based intro to a "simpler" machine learning approach, "decision trees": https://news.ycombinator.com/item?id=12609822

Here's a list of top "deep learning" projects on Github and great HN commentary on some tips on getting started: https://news.ycombinator.com/item?id=12266623

If you just want a high level overview: https://medium.com/@ageitgey/machine-learning-is-fun-80ea3ec...
>They likely offered you an inducement (severance pay) in exchange for you agreeing to a contract that precludes disparagement or other action.

Yes this was the case.
You're saying that because normal consumers wont be helped by a "technical" list on github/gitlab, we shouldn't bother?

What about "technical" users?
It exists you just need to use it:

https://signal.org/

https://protonmail.com/

and many others. Most people are too convenient or careless though to take the (little) extra effort for privacy.
What's even your analogy here? Because sometimes people have bad luck and you can make up a completely unrealistic scenario of how bad luck someone possibly could have, we should not hold anyone responsible for anything?

To give you an idea of how unrealistic your scenario is: In reality, yes, the owner of the damaged property could force you to pay for the repair, but also, you could force the plumber to reimburse you for that, and they in turn probably will have insurance for that sort of thing that will reimburse them in turn. Noone would be kicked out of anything, except for the plumber by the insurer if they had that happen a bit too often.
PHP engineer of 10 years here - all things being equal, I cannot, in good faith, recommend a person use PHP for anything. General rule of thumb is, if you can, use Python. We still see folks actively choosing it though.. mostly because it's a language we already know and better to create an MVP in something folks know rather than struggle with something "better" that will take a person 5x longer to write while they learn it.

I would bet a donut that Slack is off PHP within 2 years.
> many of my classmates were essentially relying on memorization.

This so much:

Cookbook approach to statistics without insight leads to terrible results, much data effectively thrown away - very costly data $millions worth.

I have some complex medical conditions and it is just terrible to see highly trained specialists who are nothing more than cookbook executors. Once you are off the beaten path they are at a complete loss.

The rampant statistical illiteracy in the medical world from general practitioners to researchers make this era of big data a huge risk.

<Person I know> is a molecular biologist and jokes that her medical practitioner friends know almost nothing about how the human body works.

> Memorisation

> Cookbooks

> Linear regression, maybe
It is also a goal of Go. Glacial C++ builds at Google was a prime motivator in the creation and design of Go.
No I don't agree that it should be allowed to continue, but how is naming&shaming people going to fix anything? Nothing is going to come of this, other than maybe some other hackers will see them as weak targets. Do you expect this list to be read on prime time CNN or something? People who want to buy something online aren't going to search through GitLab to check if the site has been hacked (maybe they should though), they just look for the green padlock and assume it's safe.

As I said, and GitLab suggested, OP should at least contact them. If you contact them and they say they won't do anything, now that's a different story...
A solution to this is to hire a pentester for your site. You can find them for ~$5k, with followup tests for new features being around $2k. A professional, world-class pentest runs around $50k, but a lot of smaller sites can't afford that.

You can't really hire someone with the expectation that they'll develop secure code. Finding flaws in code people thought was secure is a pentester's job, and it's a completely different skillset.
As someone in the hosting industry, you should try pair the average Wordpress "developer" with the customer who wants 1,000 people to hit the site and place an order at the same time. Or just run a site at all.

I'm not sure how these guys survive on your average web host. Our team can (and) do a lot of low level and language level debugging to figure out issues. Most cPanel resellers would send you packing. I can't imagine the frustration the end customers often experience bouncing these issues around for weeks.

In other news, I'm clearly highly over qualified!
And nginx, and apache, and php, and ...
Sites will always continue to carry malware. Naming and shaming without looking at all the parties involved is a crude and ineffective way of changing things.

Change the browser, change the payment system, educate the user by using plugins, propose enhanced security methods in ECMAscript. Write about how easy it is to make missteps on the net. These are all alternatives which might help in a more permanent fashion.
CSS Programming Tutorials – InfoTechSite
I don't believe that gitlab's offered service is "DDoS Protection"
Marriage is an archaic institution. I prefer to not have the government enforce my personal relationships and tax me more because the tax laws are structured to benefit wage disparities in partners not partnership itself.
List of electronic project kits for students
I'm a long time Civ player, and I'm curious to see how the AI compares to the previous versions.

I've been somewhat disappointed in the past, because the challenge of playing on the higher difficulties comes less from a smarter AI opponent and more from the handicaps given to the player. For example, on Deity, your base happiness is lower than the AI's, you start 5 techs behind, you pay up to 2x the price for routes, buildings, units, and so on: (http://civilization.wikia.com/wiki/Difficulty_level_(Civ5)).

It definitely forces you to play smarter, but the AI seems to more or less play the same way on King and up. I'd be really interested to hear some commentary on difficulty level and AI tactics!
We were also quite sure at one point that the earth was flat.
It's the logic of a developer who has otherwise moved onto better things but had also had to maintain legacy PHP webapps.

I enjoy the speed boosts of HHVM or PHP7 as much as anyone else, because I benefit from it, but yeah, I still hate the language.
>send an automated email if malware is detected, and include links explaining how to fix it

Twitter is better. Warned users are the best motivation to fix.
You mistook gitlab for webshops with malware.
That's true (I've actually got an amiga shell window open in an emulator on another workspace right now...) - the CD command is only needed in cases of ambiguity.

I hope you removed the clock battery from your A2500 before storing it. By now it would have started leaking corrosive gunk, a very common cause of death for these old machines.
About that... https://theintercept.com/2016/10/11/in-the-democratic-echo-c...
Have you thought about contacting Adblockers or even Browsers? They might be interested in this data to block the sites for the average Joe.