skysight-inc/HackerNews huggingface dataset:
You interpret it to be referring to the following sentence. In a court, a lawyer could extremely easily say this was not referring to the accusation in the previous sentence. It stands alone.

Each statement can be proved to be correct individually. They do not have to refer to each other from a legal standpoint.

"are consistent with the methods and motivations of Russian-directed efforts"

The methods can be anything referring to hacking. Anyone who hacked the DNC would have been using methods (hacking) consistent with previous Russian hacking attempts.

Motivations? Motivations can be defined as someone wanting to take private information and making it public.

Read it like a lawyer. There is a reason why these statements are carefully crafter.
Have you seen Baremetrics (Subscription Analytics & Insights for Stripe, Braintree and Recurly). They started off only supporting Stripe for a long time. Their current MRR[1] is hovering around $59,000, so I'd say that works.

[1] https://demo.baremetrics.com/
Please don't post like this on Hacker News.
To add to your sentiment, I have a Sony camera that can:

* Wirelessly transfer images to my phone.

* Do so with a tap, as it has an embedded NFC tag. (Sets up a wifi-direct connection.)

* Be remotely controlled by my phone, including a laggy but usable viewfinder display on my phone screen.

Cameras that are phone accessories already exist, and they're pretty cool.
Having horsepower doesn't hurt, no matter how much Nintendo PR will try to spin it that way.
> It's IP transit and a DC from HE, which means it's possibly not BGP peering through other transit providers?

The gigabit transit that comes with the cabinet is HE-only, yep. You can however buy transit and an interconnect from any other carrier in the datacenter (there are quite a few in FMT2 at least).

> They only provide a 15A circuit for a 42U rack, which is pretty ridiculous.

Yeah, it's pretty shitty. I ended up going with Xeon D for the power efficiency. Works pretty well.
Your mocks look really nice! If you're interested in the fraud problem, you might try some of the other fraud detection startups, like Sift Science (which you mention), Forter, Riskified, or Signifyd. I'll bet you'd bring a unique perspective, having built parts of Charge Control.
In this theoretical scenario, my vote is the legitimate one, and your rule would accept the known fraudulent vote instead of mine just because that one was cast first.
It may not be a bad idea to position your product as "Stripe Radar for the rest of us." Basically, companies that can't use Stripe for whatever reason can still get Radar-like protection through your product. This will be a lot more integration work for you, though.
Huh, so phishing, eh? Underwhelming. I don't understand the Russian connection. Is it because the ultimate "account.google.com-security..." domain is associated with Russia?

Also, from the article:

> It’s unclear why the hackers used the encoded strings, which effectively reveal their targets to anyone. Kyle Ehmke, a threat intelligence researcher at security firm ThreatConnect, argued that “the strings might help them keep track of or better organize their operations, tailor credential harvesting pages to specific victims, monitor the effectiveness of their operations, or diffuse their operations against various targets across several URLs to facilitate continuity should one of the URLs be discovered.”

It seems like because with the email encoded in the URL you can prefill the "someone logged into your Google Account: XYZ", right? That way you could send out millions of these things to harvest email/password combinations. I don't understand how or why they would do it any way but that way.
Eventually will set Gmail addresses to forward, but didn't want to rush that so I remember to just make stuff not go to Gmail.

When I did this (from @gmail to @mydoman on google apps), I set up a filter to star/label anything forwarded from the old address, so I'd see an update was needed at the sending service/person. Perhaps the same could be done with FastMail.
...until the moment where you don't anymore.
That 1 TFLOPS on the Tegra is for 16-bit floats I believe while the TFLOPS on the Xbox One and PS4 are for 32-bit floats.
When acting on their own behalf? Of course.

When advocating for a company? No, of course not.
Hey pdx6...feel free to give me an email if you need help pressing this issue with city hall. I'm already a member of SF Transit Riders and would love to get involved. My email is in my hn bio.
This uses Nashorn to execute the Javascript.
I think you don't know what Google does and make an empty claim, unsupported by the screens displayed. They actually have such kind of protections, I've seen them.

Why would the phishers inform the victim that they got his password? It's against their goals.

Edit: Fascinatingly, the google.com/amp does the redirection, but the google.com is contacted first. Why would google.com do this? Ah, yes... the Google validated AMP cache. Nice.

Edit2: Dude in the reply to this, the fascinating thing is, the google.com is actually contacted from that address first. Mind blown. The phishing using the actual, real google.com. Really, really, nice. That is for me the most fascinating detail from this whole story. It is actually the real www.google.com who made that thing possible. Wow.
We ask that you comment civilly and substantively or not at all.
What I find hilarious about this is there is no functional difference between the fake columns on mcmansions, and the fake columns on an architect designed neo classical building built on the properly proportioned 9 square palladian grid. Both are pastiche of someone else's stylistic ideas, painted onto a cheap timber and steel hybrid structure. Both are designed to evoke wealth. One is just more successful..
Some of the more abstract images at the beginning really remind me of Beksiński's paintings. (some NSFW, but good, dark art overall) https://art.vniz.net/en/beksinski/ There's just enough of abstract ideas and randomly included genitalia.

(now I really wish someone did a Beksiński + photos mixer... there's ~240 samples just on that site)
The scammers here [0] used a .tk domain as well. Might be because there's hardly any identification needed for the registration if I see it correctly.

[0] http://motherboard.vice.com/read/how-hackers-broke-into-john...
That's a very clickbait title.

What you mean to say is "Someone beat me to the punch".
You can't run code that depends on variables in the page context though. If all the input values are serializable, then you can postMessage them into the iframe too, but you can't serialize objects with arbitrary methods, etc. The code you run in the sandbox can't return back a rich object with arbitrary methods because that has to get serialized back out. You can't use getters and setters to transparently proxy all accesses because postMessage is asynchronous. Even if you restrict everything to only dealing with objects with promise-returning functions, I'm not entirely sure if you can get this all to play nicely with garbage collection (say you have an object outside of the iframe which is only referenced -- through the proxy system -- by an object inside the iframe which is only referenced by that object outside of the iframe)...

Iframe-sandboxing is far from a drop-in solution to this type of problem into an existing codebase.
> Business model

> Pricing was to be charged per successful request (accept) > and similar to Sift Science in terms of a handful of cents > per request. Reject requests were to be free.

That strikes me as a weird way of doing the pricing. If a request was successful but should really have been rejected, the user is paying. If the request was denied but should really have been successful, the user of the service (of the fraud detection service) is loosing.

Also, this part sounds really scary when you're dealing with payments:

> . It essentially just monkey patches Stripe.card.createToken() to call our api first

Would probably brake the payment as well if Stripe is updating the script (and since the script HAS to be loaded from their domain, nothing you can "guard" against)
Ask HN: Cross platform enterprise development on Steam?
If you wanted to develop a visualization-intensive native application for multiple platforms, which would actually be used by Enterprise users, would it make any sense to publish it on Steam?
I find myself siding with the article that I _want_ the protocol logo to win, but you gotta understand where your biases land if you're going to be critical of what the consumers picked.

If you want a data-driven decision, you trust the data, not your gut.

Here's the thing though -- they wanted people to get the visual pun in the typography, but they didn't. That's okay, because a part of a branding strategy is to educate the public about what your brand means.

You're surveying people on these abstract emotions associated with abstract shapes and letter headings, but really it's up to the organization to make itself known for those values. As you do work in the name of Mozilla, you remind people of the values of the org and the good that it does.

Spirals and fonts don't buy you trust, deeds do.
Same happens to me. I have the original creation email, my email is (was?) the backup email originally created. I know the date and time of creation of the account, and they still reject it.
Leanpub starts charging $99 to create a book
We don't attack other users like this on Hacker News, no matter how politely you package it up.
Halo 5 drops local multiplayer altogether
The idea that a company can have values is absurd. A company isn't a person. It cannot have values any more than it can have a religion.

What the term really means is more like "the CEO's values" or "values as defined by consensus of the people in a subcommittee."
Of course you care about this sort of flaw: you need as many lines of defense as possible. But if anybody can exploit it in the first place, you've already got a major security hole.
This is the commit that seems to address the issue: https://github.com/kubernetes/kubernetes/commit/6d2bd8d38a06...
I've posted this idea before on HN, but: if you believe you have a better way to detect fraud, put your money where you mouth is, and price and sell insurance on a per-charge basis. If a chargeback is made for for fraud, you would cover the loss.

What stripe has done is great, but is really a rules engine, and the challenge will be keeping those rules up to date and making the business decisions to feed into the rules. If you price and take-on the risk, it becomes a very simple business decision for your customers: "am I still making a profit?"

This is of course a much harder business ... but don't give up just yet!
What’s Missing from Mark Zuckerberg’s Memo on Peter Thiel
You mind sharing what you remember of the good ones?
Does anyone else think the controller stick on the right looks like a problem? I can't help thinking that I will keep bumping the analog stick if I attempt to use my thumb to press the buttons at the top.
"heavily armed, accumulating 10 weapons", and gasp, an AR-15!

Ha ha, here in flyover country, 10 guns is just a start. I have a 1911 on my hip as I type this.
I dont have those. They're used for custom jobs by people who know the language. Im not in that category. ;)
Better that than the shitshow egalitarian democratic companies would be.
He definitely is, it's just that "rg" is the binary that compiling ripgrep produces.
I think one follows from the other: in central planning, someone can negatively affect your prospects without much immediate adverse effect, and for possibly trivial reasons. Because of this implied threat, conformance to the party line becomes mandatory.

Fortunately, when this happens in a company, you can find another job relatively easily (when it is) as your prospects were only curtailed within the scope of the firm. Finding another citizenship is a good deal harder.
Yeah, it seems to be a pretty high-end but otherwise standard smartphone camera. Almost all of the features they advertise are of the software or related peripherals, but not of the lens or sensor itself.
Same here; support on google cloud was stellar indeed.
That's an additional cost.
Roughly as you described it. For debugging I am using pudb though, beats any IDE for me. Template debugging is a useful feature though (Pycharm can do this).
Expose, not solve.
Woe is me, poor little billionaire, unable to work because I managed to find more money than most people will see in their lives burning a hole in my pocket and, in my billionaire wisdom, thought it was worth trying to elect the closest thing the US has seen to Benito Mussolini.

Look, I didn't like GW Bush, I didn't like Mitt Romney, but I would not shun folks who voted for them, or donated to their campaigns. Donald Trump is running on a platform centered around the belief that certain people deserve fewer rights than others. Donating to the Prop 8 campaign was taking an explicit position that certain people deserve fewer rights than others.
If this is true, I suspect (anecdotally) that it is only true for solving small problems that don't require serious thought, patience or diligence.

In that experiment, the problems required 10-15 seconds of thought to solve.

Programming well can take 10-15 minutes just to rebuild a fresh mental model of the system you're working on.

It even mentions that drinking boosts creativity but not working memory. Coding is far more dependent on working memory than creativity.
Sure, but I'd expect high-profile people to have _someone_ telling them to enable it!
Georgia O'Keefe has already contacted her attorneys...
So if I hear you correctly, you are essentially claiming that the 4 security companies CrowdStrike, SecureWorks, Fidelis and ThreatConnect all conspired together to manufacture evidence in order to mislead the DNC & USGOVT in this investigation because it would be good advertising for their industry?

Personally, I would consider that a somewhat extraordinary claim. Is there anyone familiar with this sector who can comment on this?
The Constitution also says that Senators are elected by State legislatures. This isn't true any more, thanks to the 18th Amendment. All these things can be changed.
The downvote button isn't a disagree or dislike button. If I disagree (and care enough), I use the other button, reply, to try to understand their point of view and try to get them to understand mine.
Iconic not Ionic. It's is an icon, as it is recognizable as a representative symbol of a modern office chair.
Is it correct to say that this is like JRuby, but with JavaScript in place of Ruby?
Lessons of coworking with a pioneer in Japan
I think with centralization comes control, arbitary rules, surveillance, potential for abuse of power and loss of end user control.

The fact that it keeps on becoming more and more difficult for individuals to run mailservers cannot be a coincidence.

The solution is decentralization at least for things like reddit, mail, search, social and other similar services. Multiple discrete 'old style' forums, search services, email providers and individual servers with dispersed control cannot be easily silenced, surveilled or subject to arbitary rules.

I think the usual response is people don't care but I think that's because they don't know and may not have stopped to consider the consequences. And perhaps more important before they didn't have to care. Now increasing creepiness from centralized providers means sooner or later users will wisen up.

If parents for instance become concerned about privacy issues they will go out of their way to protect their children and this can lead to new more privacy aware services, rules, and distributed applications. It also makes centralized unicorns based out of SV less of a desirable thing.
Remind me of the paintings of H. R. Giger, the designer of the creature in the Alien franchise.

Google "giger nsfw" if you want to see his more sexual creations.
We are going to need free open software for our cars...
They've figured out how to synthesize OMNI magazine covers.
I really wish AWS would introduce domain verification for 'domain-shaped' bucket names.
When you release a patch, anyone who gets it can see what you changed and figure out an exploit from that. Because it's good for people to be patched /before/ that happens, some vendors give certain major customers early access to patches - so long as they maintain a proven track record of not disclosing anything about them.

For example, Xen has a 'pre-disclosure list' [1] so if they have a critical security patch, Amazon, Google, Linode, Oracle, Rackspace, and several Linux distro developers [2] get the patches early.

Obviously, we can debate the morality and wisdom of this policy - personally as I haven't discovered any critical security bugs, I've never faced this particular moral conundrum.

[1] https://www.xenproject.org/security-policy.html
[2] http://www.securityweek.com/several-flaws-patched-xen-hyperv...
Another issue with sending Google verification reset codes over SMS is that a lot of "Google Phones" allow for viewing text messages/headers while the phone is "locked." Therefore if you leave your phone (even for just a few seconds), someone could quickly gain access to the reset vectors. In looking at the DNC leaks for example, if an attacker had the phone number of a high-profile target, locates them in person, and then execute a reset "event", they're now in very serious jeopardy, assuming attacker gets physical access to the target's phone for just a few seconds. (Edit: Attacker might have the ability to also view their phone through a high-resolution camera(s) as the target pulls up the text message. Thus allowing attacker access to codes without physical access to device.)
It's off-topic because it doesn't relate to the topic.
ah ... so it doesn't dream of doggies then .....
And so was the PSP, but you don't see anyone discussing the legacy of that console.
If I take your meaning, that sort of leaves off the IV bit of IVF...
There are dozens of sites that let me buy these kind of domain names... I'd like to see a service that will reach out to an existing site and broker a price for me, without a commitment to buy it. I just want to know how much they'll sell for.
A Conceptual Introduction to React Components [tutorial]
If I wanted to replicate this, I'd try to get a machine to make the strands and then lay them by hand. Laying pasta that thin in an accurate way with a robotic arm requires amazing computer vision and such, but pulling dough in exactly this certain way is machineworthy.
This is absolutely fascinating.

It's mesmerizing to see this NSFW detection applied in reverse, and it's even more interesting to observe your mind react to the generated images. You can see the sort-of-mons pubis patterns, the maybe-pubic hair, the perhaps-breasts and the suspiciously phallic appendages, complete with realistic colors.

Interestingly, all exposed skin suggests that the training dataset for the NSFW detection was skewed towards caucasians, given how the synthesized images are near-completely devoid of skin tones other than light pink. Perhaps this is a good visual indication of unintentional 'bias' in datasets?
This is completely correct. It's one more reason that the cure for our ills is not hoping for local governance to overcome NIMBYism but rather for reform in land-use policies which will achieve more fairness.
It's no problem since they introduced actual accounts (Nintendo ID). But you still lose your 3DS friends list, and games can only be installed on one system at a time.
I fully agree with the above. Maintaining a live streaming website which still uses Flash unfortunately, I was really excited over this about a year ago until I saw that I can barely use our beta with my remote co-workers, different network setups are a pain. I stopped and sworn I ll never touch it until I see one of our bigger competitors adopting it. Seems not much has changed since.
Visualizing a Job Search Or: How to Find a Job as a Software Engineer
More people want to live in specific cities than there is space in those cities. There are plenty of cities with available real estate at reasonable prices.
See https://news.ycombinator.com/item?id=12645210
It is very unlikely that Crowdstrike is making things up.

I think very few people on HN understand how Crowdstrike works. Know how every Fortune-1000 company in the world has McAfee or Norton Antivirus installed (or at least used to)? Crowdstrike is like that, except they hoover up all the malware detection stuff they do on endpoints to a central data center and correlate it across customers.
I wrote a book [1] using Leanpub, and their Dropbox-to-PDF workflow helped me seeing what the final result would look like while writing Markdown files.

I was a little frustrated with the loss of control over formatting, but Leanpub was still worth to keep using. I wouldn't have used it if I had to pay $99 upfront to create a book, even if backed by a 45-days money back guarantee: I would have been comfortable with something in the order of $5-$10, non-refundable.

I'm investigating alternative toolchains for creating ebooks, for the moment Softcover looks like the best candidate.

[1]: https://www.hostingforappdevelopers.com/
Scalable Blockchain Fabric: Proof-Of-Work vs. BFT Replication [pdf]
> Google customer support is totally another pair of shoes

Pair of shoes! Nice. I tend to say "why the face" a lot in our internal chat at work. Now I have another one (POS)
> charge-control.js was the front-end JavaScript that users add into their existing checkout page. It essentially just monkey patches

You can't do that. Essentially you advocated using a man-in-the-middle library. Running that running javascript client-side would completely break PCI compliance. Stripe literally couldn't stop you from operating, but they could break integration with you (i.e. not allow you to collect money via their own API). They could also refuse services to anyone who used your middle-man application.

What you should have done instead is have a backend application that operates after the token is created. Once you have a token, do fraud scrubbing and throw away the token if it fails.

You can't break PCI compliance, if you do, then you open yourself, your clients, and everyone else on the chain who knew you existed and did nothing to litigation----or worse, simply being banned by VISA, thus dying completely as a company. I've known a few payment processing companies who inadvertently went against a regulation, and VISA banned them for life. It's a monetary death sentence, and VISA tends to track everyone associated with building the company and refusing to work with them in the future too because it is seen as risky.

I don't really blame Stripe for seeing "client side javascript" then immediately burning any bridges.
What are you looking for in terms of evidence? Please bear in mind that we're very unlikely to find something signed "PUTIN WUZ HERE" anywhere.
You have to applaud Kodak for taking a risk.

If the camera functionality is that much better, some customer segment might be compelled. It's hard to say until the product is available.

Future iPhone customers will benefit from this product release. If it's at all better, you better believe this will only push Apple's camera engineering team harder.
Why exactly are you using JavaScript here and not a simple HTML table or list?
Unable to read the full article, but...

>> easily outsmarted government efforts to protect secrets

But we've all seen government website that stored and enforced passwords in plaintext Javascript.

>> possessed an advanced understanding of how to encrypt messages

So adding this, we now might just be talking about a guy who can 'View Source' in his browser, and use GPG.

Presented like a cybernetic superspy, but might just be a dude with an IT degree.