skysight-inc/HackerNews huggingface dataset:
I was curious and went to look up lamian on Wikipedia. Found a link on the page for chow mein, which I followed out of curiosity. It was fascinating to see the way Minnesota chow mein was singled out as particularly bad. Unfortunately in my experience it's absolutely true. That was my introduction to Chinese food as a kid, so sometimes I'll have a little for nostalgia, but in the end it disappoints. I think if I had some that was well prepared I would be in heaven, as in the movie Ratatouille.
I have no idea what I'm actually worth. I'm an employee, so, of course, I know how much I get paid, but I have no real idea how much value I'm creating, nor do I really know how to measure or find that out.
> Also... since no one else has mentioned it yet and it's not really worth its own comment... this is a wildly better name than "Wii". The Wii was a success, but I'd say in spite of the name.

Swiitch? ;)
The specific attack vector isn't the only IOC they're working from for these incidents; there are probably dozens of IOCs associated with each attack, some of which are extremely specific to just one or two threat actors. Many of those IOC signatures are non-public; you only get them by being in intelligence or law enforcement, or by being one of the handful of threat intelligence companies deployed at enough giant enterprises to see enough of a cross-section of attackers.

So when people say things like "anyone could have carried out this attack" or "these systems are so insecure it could have been anybody who did it", they're not actually addressing the argument.
I'll have 2 tickets to the dick concert thanks.
Can someone explain to my why I shouldn't be worried about Google becoming a monopoly? I think they make some fantastic products and they have been expanding their reach to hardware, DNS, web hosting, and storage.
Zeronet
I'll recommend you to read Cixin Liu Death's End about the desires and rationality of electorate.
Really, your main argument is that it's ugly? At least address the design concerns outlined by your parent post.

Also, I believe SF buses are generally electric except to cover excess load.

In any case, how do you expect people in the suburbs to get to the light rail? It's just not realistic to entirely discard busses on aesthetic(!!) bases.

Also, I'm not sure why you're quoting Steve Jobs that way. I'm enjoying using a stylus with my iPad now. It is a perfect example of pragmatism clearly displacing... whatever it was that irked Jobs about a stylus.
>assume that code execution on your Linux systems equates to privesc

Tell this to the container community. They would have you believe containers are as secure as VMs.
From the "department of trying way too hard", I'd like to mention that you can pull subtitle information and often massage that into a transcript, either with the DOM [0] or by looking at the traffic and downloading it. [1] However, in this case those are subtitles from speech-recognition, so it's only really useful for skimming broadly.

Pasting the whole thing would probably not be useful, but here's a sample from the downloaded XML:

> if you think about it like tiny
components one of the best things about
say a tiny method when you look at a
tiny micro service is it allows you to
consider replacing it but you can change
it you can understand it really quickly
but even if you can't if it's small
enough and it's named well enough and
it's decoupled well enough microservices
tend to be you can throw it away and
just restart if you have to

[0] Example: https://gist.github.com/DHager/2e01f0b82e5d3f5a39e6

[1] Look for accesses of https://www.youtube.com/api/timedtext
This may be a good idea, but I think the DNI would be rather embarrassed if the true magnitude of the 'homework' problem were revealed.
It really sounds like it was some guy who weighs 400 pounds in his bedroom, rather than some elite nation-state-level Russian attack.
A parcel tax is a very imperfect cousin of a Land Value Tax-- assessing all parcels the same regardless of land value is extremely inefficient and inegalitarian.
USB C connector Alternate Mode can be used to carry PCIe signals (without Thunderbolt). Switching GPUs is a well solved problem for nVidia, they call it Optimus. By now this is a technically solved problem, no problems.
\incidental Use quotes (") for exact match, not apostrophes (').
I don't get it. How do you go from "there is no evidence here" to "conspiracy"?

It's fine to explain how malware works and turn it into a PR piece with fancy pictures of minified JavaScript, but none of that is proof of some Russian connection. Neither are professional sounding statements like "we have medium confidence the attackers are Russian actors" or similar baloney.

All there is is Stratfor style analysis along the lines of "we think NATO countries X, Y, Z got exploited so it must be Russia" when in reality that's probably just because all their customers are NATO countries X, Y, Z.
I'll definitely do that! I guess I'm just looking for places to get inspiration from.
"Nokia tried the "photography first" smart camera - it did't fly"

That was a while ago. Nokia did a horrid job marketing that 40 megapixel phone. Plus, it was a point in history where, people including myself, thought it was just a marketing ploy.

I'm still not sure I would trade any phone for my Canon, with L primes, but the pictures off my IPhone 4 astonish me, especially the macro pictures. (That phone isn't even active. I just use it to take pictures.)

I used to be one of those guys who thought the good pictures off any phone camera were just luck. I'm changing my opinion yearly.
"As mentioned already, Nokia tried the "photography first" smartphonecamera - it didn't fly."

It didn't fly largely because it was running a 3rd rate OS that no one really wanted.
WE GOT a STAR WARS BB-8 ROBOT
Because self diagnosed PTSD sufferers on Tumblr made a mockery of it.

The word has uses outside of the PTSD context though, like gun or database triggers.
Am I missing them? All I see is a landing page. The screenshot of the rules is actually from Radar.
Not too surprising. Consider how flight simulators have changed flying. Any activity that is expensive/dangerous that can be simulated means the edit/compile/debug loop can be made much faster and cheaper, and thus more highly developed.
Thanks Boris, this makes more sense.

So the risk is that an add-on would inject angular 1.x into an external web site, this web site being malicious, it modifies its own DOM, so that angular would eval expressions from this DOM within the scripting environment running at a higher privilege.

What if the malicious web site does something like <script src="resource://dumb-addon/angular.min.js"></script> ? On Firefox, i verified this loads angular into the web site, but what about the privilege level ? Will it be the original one from the page or higher ?

As a side note, doing the Chrome equivalent <script src="chrome-extension://dumb-addon/angular.min.js"></script>, the loading fails with an exception saying "chrome-extension://" is not an allowed source.

In my extension, i modified the angular.min.js file to insert this as the first line:

(typeof window!=="undefined" && window.location && window.location.href && window.location.href.startsWith("resource://my-extension/")) || (function() { throw "Library loading not allowed" })();

Basically, it throws an exception if the library is not loaded from a local "resource://" page (hopefully considered as safe since it is part of the add-on code). I verified this prevented loading angular using the <script src="resource://..."> trick or if angular was inadvertently injected using a Firefox frame-script (nsIFrameScriptLoader.loadFrameScript) and add-on sdk/page-mod or sdk/content/worker modules.

Can we consider it is safe to use angular 1.x only from local add-on panels to run the user interface ?
You're right, I'm sure they tested the message "but...but...the Russians".

I think HRC wins this easily, but these scandals won't just go away. There's enough meat in them to fuel 1-2 years of republican attacks. I fear she'll be the most ineffective President of my time.
a fair point.
Back up. I never transmitted any credit card details. All the inputs were heuristics about the end-user (ip address, GeoIP location, user-agent, referer, language, etc) or transaction meta-data (price, etc). Card number, expiration, CVV were NOT part of the inputs in Charge Control.
>either the website has to be sanitized/projected into a harmless dom abstraction

Should Firefox contain code to recognize text that looks like Angular templates and then break it somehow? That'd be extremely specific.

Eval isn't an inherently unsafe feature, and it doesn't have a monopoly on insecurity: Angular doesn't even require eval. It can run without eval in a CSP-supporting mode that's equally vulnerable.
The duplicate detection software allows reposts when the original story didn't get much attention, which is the case here.
By all indications, use of this provision is extremely rare, nothing like the number of NSLs issued in the US. So it would be a big ask, but it could happen if the consequences of wide disclosure were 'extremely grave'.

For context, one of the motivating leaks was when there was a planned 5am counter terror raid, and someone in the state police leaked the who/what/where to a major newspaper, who had papers coming off the presses at 3am about people who hadn't been raided yet.
> That's why there are economically valuable DRM systems (BluRay's BD+ is an example here). All you have to do is push attacker cost across a threshold (for instance with BD+, that's keeping titles secure past the new release window) to make a defense in depth control valuable.

A really good example of this is Spyro 3: The developers set up a system of overlapping checksums (which could in turn bet part of the data being checksummed by other, overlapping, checksums) so that it was virtually impossible to change even a single bit without failing the test. It was eventually cracked, as the check only ran at boot time (it required 10 seconds of disk access, and adding 10 seconds to every loading screen in the game would have been unacceptable), which meant it took over two months for pirates to get a crack working (unusual for the time). And since most game sales come in the first two months...

But that's really just me using this as an excuse to share a bit of technical trivia.
Access to arbitrary methods would go against the idea of sandboxing anyway. If something references the global object for example you suddenly would have access to a privileged fetch API or other extension APIs.
Slashdot/Reddit hug of death? Infinitely scalable content delivery on the backs of your site visitors' upload bandwidth.
We're witnessing the beginning of an entirely new form of pornography. I can easily imaging a XYZ Porn website adding an "Artificial" or "Neural Dream" porn section.
Assume it on any system. Even OpenBSD.

Nobody's perfect. Not even Theo.
And all I can think of is stupid greentext about Pepe.
In general, extradition treaties only cover acts considered criminal by both countries. Thus the situation you fear is neatly prevented.
Citation needed.

That's certainly a goal, but I've never heard the claim.
Wait, I just remembered COGENT people did a case study by doing ext2 filesystem in COGENT. They have COGENT on Github. The filesystem source or binary might be in repo(s) of COGENT team allng with other examples. So, Google that.
Who wants to volunteer to acquire and organize a several thousand jpg set of "ebony" category porn and submit it? If training material is required, there's undoubtedly a lot of categorized porn for all possible races in the world already, it's just a matter of getting volunteers to do it.
Time will tell I suppose. Here's a fun one from today: https://i.redd.it/dxedkw7jwosx.png
Snapdocs (YC W14) Is Hiring a UX/Product Designer
We're a 20 person company tackling the absolutely massive mortgage market. We're bringing modern, elegant software to a field that still relies on fax machines and manilla envelopes. We bring security, efficiency and joy to a paper-based pillar of the US economy.

We're looking to hire our second designer to help us expand our product. You would be given a tool or set of tools to spec, design, and make successful. We have talented engineers to get your back and a collaborative atmosphere.

We are still building a culture as well as company. We want someone to help build a place they would want to work at.

Key Traits and Experience:
* User testing (over the phone, IRL, either way)
* Data-driven design. Using metrics such as Mixpanel to test the validity of your work.
* Experience with design iteration. Design, release, measure, repeat.
* We use Sketch and Balsamiq, it'd be cool if you did too.
* We have a highly collaborative process between engineers and designers, from spec through release. It'd be very helpful (but not required) for you to have some experience with Rails.

Please send a resume and some examples of your work to jobs@snapdocs.com
It has phase detection at least. Something sorely missing from these camera phone/phone cameras is an internal optical zoom so that the lens barrel never protrudes from the body - like the Pentax Optio WS80 which uses a prism so that the optics/elements move along the x rather than z axis inside the camera body. Apple filed a patent for such a thing a year or so ago, but they've also filed patents for all kinds of shit that has never seen the light of day.

Calling the 56mm second lens on the iPhone 7 an "optical zoom" is taking things a bit far. I guess calling it a prime portrait lens would leave more than a few people scratching their heads.
Could this be used to insert a "subliminal" touch to an image?

Eg you make an ad that looks innocent, but that would fool your brain into thinking it's sexual if you just scan the page containing it?
That may be the border of my english-understanding, but i can prove non-existence of certain things (are they entities?).

Since this is currently my seminar-research topic: In the Zermelo–Fraenkel set theory there is only one Urelement.

I can prove the non-existence of another Urelement not equal to the Urelement.

Since i only care about Zermelo–Fraenkel, i can define Urelemente as things inside the Zermelo–Fraenkel set theory that are not sets themselves but elements of a set. And there is only one element that satisfies this definition. Every other thing is not a Urelement, since it does not satisfy the definition.
So I've heard, that it's difficult to get a human involved if you have a problem with Google's free products. The article says "Eventually, with the help of Google’s customer support and some ex-colleagues who still work at Google, Bob was able to get his account back." For the average person who doesn't have ex-colleagues who still work at Google, or who's name isn't Linus Torvalds, it will be far more difficult.
I do rather wonder just how hard these situations really are for machines. Watching videos taken at the Arc de Triomphe actually leave me thinking the google car could possibly be fine already.

It knows where it is, it knows where it needs to go and they already have an "aggression" where they'll pull out a bit to signal to other drivers they're going.

The really complex part for us is that we can't easily keep track of all the things around us and have very slow reactions. The computer knows the distance of all things around it accurately and can respond in milliseconds and doesn't get flustered or angry. Or am I missing something, is there a lot of complex reasoning?
How is search in FastMail?
And mobile clients?
I also said "pretty sure". I'm not ruling out a freak occurrence that got the helicopter there (or a genuinely phsyco kid), but odds are there is blame to be placed.
It all depends where you want to submit your resume.

If you want to attract headhunters from job sites (i.e cv-library in London) then you need to remember they browse through CV's as you would browse over internet with google. Key words count a lot and they must appear early enough since (like with google) what you see on first page will most likely win you a job. From the other perspective talking about what you have done is quite important (I think you already have that, though try to reduce number of jargon-words)

If you want to apply some specific - that's different story. You will have to build your CV each time you pick your target and heavily adjust to that target. So if you know company XYZ works with PHP you will definitely want to mention you have experience with that (and you won't go too much into details if you also was an expert in, say, C++). Sure, some people will say it's good to show how good you are with other technologies but CV should be centred around topics important to that company. In this case you, as a developer, can treat yourself as a startup - try to find a pain the company have and you will be able to show value you can bring.
I don't think that prevents this error. This exploit is all about gaining read-write access to a read-only page of memory. Mounting as read-only Might prevent the error, but only through extra checks of the dirty bit before pages are used (IE. The kernel would have to check the dirty bit on every page of a read-only file to ensure the contents were not changed through an exploit).

The state of the disk and mounting of the disk generally wouldn't matter because the page is already being forced from read to read/write, and that has no barring on the mounting of or data on the actual disk. It doesn't matter if this data is actually flushed to the disk as long as the kernel uses it from cache without noticing it has been changed (Which it probably doesn't check regardless of read-only status).
An easy way to reject that hypothesis is to consider the utter load of shovelware that Nintendo consoles attract, because top-tier studios stay away in droves.
That sounds like an unfair advantage over smaller competitors to me.
> I never transmitted any credit card details.

PCI compliance is only partially concerned with transmitting CC details, and is very much concerned with "YOU SHALL FOLLOW THE RULES".

The rules say you are not allowed to do what you were doing. It's completely irrelevant if what you were doing is not a security or data transmission issue, it's simply against the rules.

PCI compliance is an absolute nightmare, and is not something to be reasoned with, trust me. Logical thought and analysis has no place in PCI compliance. Follow the rules or else.
I'm actually really curious whether nudes of dark-skinned people pass the default model at all. Luckily, detector can be seeded to work with a different model, so we can have several of them; but this would be a useful pull-request.
In my opinion their secure communication acts as a double-edge sword for WebRTC. Now one-to-many streaming is complicated since you cannot easily add a man-in-the-middle streaming server like you'd do in a normal setup. Trying to broadcast to >5 users on a Chrome tab really heats up my laptop.
Dude. Look at the caption underneath those screenshots. They say, "A screenshot of the phishing email received by ..."

The fact that Google actually sends out emails that look like that is what makes the phishing attack so effective. The email looks like it is from Google, and therefore trustworthy.

As to why the phishers would inform him that they got his password? The reason is that at the time they sent the phishing email, they didn't actually have his password, and wanted him to click on a link that they controlled so he would give them his password.

I'm trying to get through to you. Please tell me it's working.
There's plenty of us. I've met a few in person and there are a lot on YouTube (Chris ray gun is the best example).

Hopefully it's not too late to put the genie back in the bottle.
I see what you are saying. Your initial response was dismissive and unclear as to what you were attempting to communicate. Something along the lines of "I disagree with your claim that this threat actor has been identified as Russian" would have been more helpful.

I believe that the industry's identification of APT28 (active since 2007) as a Russian group is based on both the political identities of their targets, and language and timezone indicators leaked in their work. Here is one such analysis from 2014 from a different security company:

https://www.fireeye.com/blog/threat-research/2014/10/apt28-a...
See also Trireme [1], an implementation of Node.js 0.10.32 on the JVM, using Rhino.

[1] https://github.com/apigee/trireme
Overkill for what was never intended to be a sandbox for untrusted code. The “sandboxing”, like Django templates’, Jinja, Nunjucks, etc. is a well-intended measure to keep logic out of templates, but in practice only really gets in the way and causes mistaken assumptions about security.
Ask HN: Raising in the Valley and then working from the home country?
Has anyone had any experience raising money from angels or VCs, then returning to your home country to work on your startup?

I'm not sure how the paperwork would work here, would you register an LLC in the US?

Obviously there's a trust issue, however I'll be an ex-googler which should help.

I'm aware of the upcoming startup visa, etc, however I'm really just exploring options at this point.
So, jQuery instead of just...

function $(sel) {
switch (sel[0]) {
case '#': return document.getElementById(sel.slice(1));
case '.': return document.getElementsByClassName(sel.slice(1));
default: return document.getElementsByTagName(sel.slice(0));
}
}

I mean... "readability".
A good gift

if priced ok, a disposable camera

a good way to be able to take pics and LEAVE YOUR PHONE AND CONNECTED LIFE.
Send a sinewave outside the human hearing range and check for it on both ends.
No problem, it is public. Just please share the original link so anyone can comment there and we can improve it.
I believe in paychecks.

Everything else ... yeah, that's probably the marketing department with too much free time.
The part about costs was not in the article... the old, lower prices, were already well above our costs. Now they're even higher than our costs.
> Logical thought and analysis has no place in PCI compliance.

Only at a local level.

If you're writing standards that are going to be rolled out to the whole world and are difficult to change, and where the potential downside is people losing a lot of money, then a 'better safe than sorry' heuristic is the correct choice.

Monkey-patching into your payments library at runtime certainly doesn't seem like a 'safe' practice that PCI ought to endorse at all.

It's essentially impossible to write a standard that perfectly anticipates every edge case. And if it were possible, the list of rules would be even longer and more difficult to follow.
Price aside, it's actually easy. Just buy a micro-SD card and the right "accessory" (there are maybe only two worth buying) and it takes a few minutes. With the most popular accessory, you can also run any home brew .3ds files very easily.

It only gets hard if you want to play online, which means you need to do .CIA files, which becomes difficult (it also requires a new SD card). But if playing online isn't a priority, it's not even an issue.
This seems like the expected behavior. If allowing for writing didn't actually allow you to write anything, that would be pretty strange, wouldn't it? Or do I misunderstand?
I'm fine with that as long as the proceeds are also distributed in a manner consistent with communism (the utopian version, not the failed socialist state experiments)
>And Bitly links ain't it.

And why aren't they? Too damning I presume.
The humans brains processing power for visual and spatial stuff is amazing. We may get there for computers one day - but we are not even close yet.
I dunno, but you weren't banned for not having a phone number attached to your account, because I and many others have accounts without phone numbers and are not banned.
It's built on top of Nashorn[1].

[1] https://github.com/purplejs/purplejs/search?utf8=%E2%9C%93&q...