skysight-inc/HackerNews huggingface dataset:
I'd argue that asbestos is a great example, because it shows that in reality it's not the unknowns that harm us, but willfully ignoring the knowns. It's like smoking--the harms were known for a long time. Smoking was considered unhealthy even in the 19th century. Rather, it was the culture that chose to ignore and discount the evidence.

What's different about EM exposure is that it has been heavily studied, yet from theory to experiment there's scant evidence of significant harms. Certainly not at the scale of asbestos, smoking, or other historic or current risks.

I think lesson is that most real risks are knowable and right in front of us. But the way fear works, we tend to think it's hiding around the corner, hidden. So we obsesses over EM emissions rather than regularly testing for lead in our houses or, as a community, our food supply.
> And I don't think this makes us any more of a surveillance state than other countries, because the government is supposed to retain official records of all these things anyway.

England has a frustrating situation where the government collects all this stuff, and stores it all on computers, but in separate data centres in different databases and in incompatible formats.

So anytime I need to interact with them I have to fill out bizarrely long paper forms.

I work a bit in suicide prevention, and the length and complexity of the disability benefits forms[1] are implicated in some deaths by suicide, as well as some attempts.

[1] as well the brutality of the system. They have a lot of rules, and fiercely enforce those rules, but the first two lines of advice workers often don't what those rules are.
Is there any real reason to believe the attacks were connected to wikileaks in any way, or is this an attempt to stay politically relevant?
Well, you're where you should be all the time

And when you're not, you're with some underworld spy

Or the wife of a close friend,

Wife of a close friend...

https://www.youtube.com/watch?v=mQZmCJUSC6g
Thiel seems pretty dangerous on his own, regardless of Trump support. A really smart billionaire who seems to have taken against the idea of democracy sounds like a comic book villain.
I'm in the Netherlands, where I pay a similar amount (€54, I believe) for 60/60 fiber with TV (two tuners, actually) and landline phone. I actually measured around 70/70 during speed tests.
Totally OT but if you're in the area ever, Halted is a candy store for anyone with even a vague interest in electronics. I recently put together a burning man solar power box from parts there. It would have been cheaper on Amazon but it was great to be able to feel the switches I was looking at and get just the stuff I needed instead of 10 packs from China.
TIL the Internet is actually controlled by 14 people who hold 7 secret keys
Man, watching wikileaks circle the drain sure has been fun, but it's starting to get sad. Can we wrap this thing up now?
It's an excellent way to make sure several US TLAs are looking at WikiLeaks supporters closely.
The limited term franchises are a far greater limitation than the unusual organisation, as it near guarantees short-termism over improving capacity or rolling stock.

Though I do agree that returning to the earlier regional railways, along with additional mainline and freight train operators, would have been a better way to organise.
No, it means that if you store your data there that there is a .000000001% chance that you will lose all of it.
Thanks for the great video! Between the three you recommended I ended up going with Django, largely because I've been meaning to get a grasp on Python for a while (I do a fair amount of bioinformatics work in R, and Python should be a useful complement for statistics tasks). Also, the Django project website has great tutorials for beginners to follow!
"post-" usually means after, so I initially thought you were saying the internet is over. Maybe you could say "internet native" or something. I don't think it's true, by the way (the CPAN folks would have a word with you, just to mention one that comes to mind).

In response to your point, eventually, most of us who build software just want to use tools we know to get things done. There's a tremendous benefit to having few and highly trusted dependencies. Imagine civil engineering if every week there was a new flavor of concrete with different construction methods and structural properties.

Not too many people with a decade or more of development experience think that "downloading other people's random packages" is a fantastic or a confidence-inspiring idea. Ideally, those line-of-business CRUD apps that the modern world runs on should be write-and-forget, not rewritten continuously. This is why "churn" is a bad word to some. And yes, writing CRUD apps is pretty much solved, that is, it hasn't gotten that much more efficient in the last ten years if you look at the best tools.
If you read the PDF, it seems the FPGAs can be used in a number of ways:

1) As a local co-processor, they have been deployed to accelerate selected Bing search ranking operations. This is described a little bit in the white paper, but I think the most interesting parts are going to be proprietary.

2) As a network accelerator, because they are inline with the server network interface. In the white paper using the FPGA for crypto acceleration is described. This is cool. The CPU overhead of encrypting 40Gbps is significant and managing keys for this many hosts is probably non trivial. Moving encryption to another layer would simplify things significantly I think, let app developers not think about it and let datacenter peeps manage keys independently of whatever is going on in the host.

3) As a large scale distributed processing grid. Because the FPGAs have their own network interfaces, they can be used independent of the host. Regular host network traffic gets passed through unaffected while the FPGA is simultaneously running distributed compute tasks from the grid. The white paper described training a DNN, but also describes their Hardware As A Service delivery model, meaning developers I guess have access to the grid and can deploy whatever they want. I would guess there is a lot of machine learning and map reduce type tasks going here, but who knows. The whitepaper also tantalizingly contains the phrase "cross-datacenter" which implies a globally distributed network of these things. Rad.

So that's a long way to say that I think there are very many use cases for this kind of thing. Coupling the FPGAs with regular compute nodes is operationally beneficial I think - they can be co-processors or they can be part of the grid. Microsoft is doing some pretty cool shit.

Edit: This whole thing is called Project Catapult. There are some other good papers here https://www.microsoft.com/en-us/research/project/project-cat...
This isn't just small manufacturers either. I bought a new Samsung tablet for my kid two weeks ago. It is running a three year old version of Android with no updates available. Pretty shocking.
"Additionally, with around 1/3 the gravity, launches and landings are even easier."

Launches, yes, but landings? Athmosphere is your enemy during launches, but your friend in landing.

Mars has an atmospheric pressure less than one percent of that of earth. That makes losing speed other than with rockets a problem, and that requires bringing lots of fuel.

In addition, the athmosphere that's there can be windy and turbulent. That can directly affect a spacecraft, but also causes dust storms that can make it hard to measure distance to ground.
How a Bunch of Hacked DVR Machines Took Down Twitter and Reddit
Wait so any company can look up where you live? Sounds like a nightmare with debt collectors , stalkers, and spammy services.
Wikileaks is apparently on a mission to destroy whatever credibility they had left. They seem to be taking a leaf out of the IS playbook here, any random attack that is moderately successful gets claimed as one of theirs.

It isn't a week since they were extremely economical with the truth regarding Assange's internet access ('state actor cut off their internet' -> 'Ecuador has pulled the plug on Assange's laptop').

The best way to deal with this would have been to distance themselves from anybody doing this, the very worst is to suggest they have the ability to issue orders to those perpetrating these attacks.

With supporters like these they wouldn't need enemies to begin with, it's a very negative association and they're purposefully aligning themselves with these so called hackers.

What will replace wikileaks?
I cannot wait for some type of top-down pressure to force IoT developers to take security seriously. The movement has been pushed into overdrive thanks to insane levels of competition where you either crush your R&D into the smallest breakneck period or you live to see your creation being sold for half of what your budget can allow by other firms lifting your efforts while you're still at the workbench.[1]

I've been getting cozy with Shenzhen-based hardware accelerators for the past year as part of a personal side-venture and I have not seen a group so pressured to deliver a product as fast as possible with security being a casual afterthought. To get a decent taste of what it's like, I wholeheartedly recommend WIRED's Future Cities documentary on Shenzhen and the companies that dwell there.[2] Their struggles for ephemeral market-share are endemic of the entire community that's taken over embedded hardware for the past few years.

The saddest aspect of it all is that this market competition isn't benefiting the consumer. IoT devices are coming out of the factories poorly engineered, badly maintained for far too short of a time, and as we've learned from this attack, being used as vectors for network intrusion and distributed censorship. Even arduino founder Massimo Banzi's widely-lauded IoT Manifesto[3] fails to approach any comprehensive statement regarding a dev's responsibility to build in some level of security to their devices.

It just isn't part of the fast-and-loose culture that has been bred by trend-setting companies with unlimited budgets making bad decisions from the very start.[4] In addition, the if-you-can't-beat-'em-join-'em attitude the West has taken towards churning out hardware devices as fast as they can before jumping to the next IoT piece of junk before the ripoffs can hurt them is really disappointing as it prevents any considerable effort from going into a device pre-and-post release.

All in all, the IoT community is not going to change their priorities unless someone very powerful forces them to and it can't happen soon enough.

[1] http://qz.com/771727/chinas-factories-in-shenzhen-can-copy-p...

[2] https://www.youtube.com/watch?v=SGJ5cZnoodY (This is over an hour long but very worth it)

[3] https://create.arduino.cc/iot/manifesto/

[4] https://techcrunch.com/2014/01/06/nest-4-0-firmware-battery-... & again in 2016 http://www.nytimes.com/2016/01/14/fashion/nest-thermostat-gl... I'm not going to even touch the dropcam and IoT smoke detector.
UPnP is enabled on lots of routers by default and enables devices and services behind NAT to forward traffic for specific ports to their internal IP address to allow direct connections from the internet.
I wonder what the goal of these guys is. Several high profile attacks with little impact, source code and attack vectors leaked, users and vendors scrambling to set up defenses.

Is this some "look what could happen" scenario or is someone using it to show off the skills of his other botnet?
What's up with 7ujMko? That one seems really secure.
Sounds like the premise for the strangest Viagra ad ever.
For oft, when on my couch I lie

In vacant or in pensive mood,

They flash upon that inward eye

Which is the bliss of solitude;

And then my heart with pleasure fills,

And dances with the daffodils.

- Wordsworth
Is MIT for fun?
I can't answer because I'm not sure about which mechanism you're thinking about. Would you mind elaborating the concept?

But as any mechanism: who's operating it, who's paying for it, what it's going to do, etc.

An idea is a state owned crawler that tries to get into any device inside the country and tells people that their device X is insecure because of Y and Z. I think there are already many of those crawlers around, but they don't warn people. Quite the opposite ;-)
پکیج تور لحظه آخری کیش ورود ۲ آبان ۹۵
Hardcoded in some "firmware example" supplied by the vendor, someone REd the firmware and published the password on his blog, and then it was discovered by the author(s) of this malware.
Just do a quick shodan search for port 23, there are millions of devices directly attached to the web.

Some are intentional, but my guess is the most are just badly configured by people not caring for security. Add all the cheap vendors for IoT devices and "I need to be able to check my lights at home while on the road" and you get an amazingly huge attack surface
It's just a swing.
The use case I had in mind specifically was initial configuration, mainly transferring wlan configuration data to the device. So this would not replace radio interfaces, but instead complement them.
A loaded pistol was found in his car.. the same car which had documents stashed. The majority of weapons were unregistered.
Austria has the same basically. The interior ministry runs a few central registries for these things. You have a unique number hat follows you around and your records are linked through it. It's very convenient.

Not only does it simolify tings, it also has some other advantages. For instance becayse your car license olate is through that system linked to your home adress that automatically updates people with Austrian licdnse placea typically do not get clamped.
Dirty Cows POCs
ExpertKnowledge – Transfer Knowledge into Workforce Learning
A design methodology for reliable software systems
I’m not running BIND. I got tired of that program. Right now I’m using PowerDNS. Quite a bit overkill, but that server is extremely lightly loaded.

I’m not using CloudFlare, either. That’s the point. If I use CloudFlare CDN, then I depend on CloudFlare’s DNS servers.

The way it works is that DNS servers often have a master/slave relationship. The master sends all the records to the slave once in a while. What you’re supposed to do is list your own server and another server as two separate NS records, and then any client can contact either server for any record. What I’m doing is a hidden master setup. Neither NS record refers to the master, but both point to separate slaves.

There are some downsides. You must assume that any record is public, not private. DNSSEC white lies[0] (and black lies[1]) are not available. And it’s more difficult to use a CDN. But I’m not running a web site right now, so that doesn’t matter to me.

[0] https://blog.cloudflare.com/dnssec-complexities-and-consider...

[1] https://blog.cloudflare.com/black-lies/
Look at the response to the adler... things are different down under ..
Some people already use App Engine as a free CDN (http://www.digitalistic.com/2008/06/09/10-easy-steps-to-use-...) , I imagine it would be totally possible to use it as a proxy.
> a company with the sole purpose of building hardware and software to augment human intelligence

Human intelligence, while fallible and easy to turn off, is arguably our best feature. It's also very versatile.

Bryan Johnson can spend his money any way he likes of course, but one has to wonder why there aren't more initiatives to augment our senses instead of working on intelligence (our own or the intelligence of machines).

I would love to gain a permanent ability to see in the dark, hear ultrasounds, know where North is at all times, etc.

And "all" one has to do with a new sensor is plug it in: the brain is very good at making sense of any new signal, and using it, without prompting or training.

The plugin-in part is non-trivial, of course (although there are shortcuts, such as using the tongue as a crude V0); but one can imagine that once we're able to build a general API to the human brain, many gadgets could be developed for it.
Please keep HN’s guidelines in mind when you comment here: https://news.ycombinator.com/newsguidelines.html
The Importance of Testing in Instructional Design
How to log a timestamp
Ats Rhapsody Greater Noida West, Ats Rhapsody Noida Extension Sector-1
It's a simple pattern on a QWERTY keyboard. 7UJM and MKO are each on a diagonal path.
That last part is madness. You better believe as a citizen i‘d care about the ethnic religious and racial makeup statistics of my country.
Hawelia Valencia Homes in Greater Noida West, Noida Extension
They don't need to. Millions of devices have their telnet port open to the Internet (just check Shodan), after infecting those, Mirai has a beach head to scan and attack the rest of the network.
Koseki is the root of Burakumin http://www.economist.com/blogs/lexington/2009/09/farewell_to...
"And "all" one has to do with a new sensor is plug it in: the brain is very good at making sense of any new signal, and using it, without prompting or training."

That doesn't sound right. E.g. see stories of blind people who have gotten sight at a late age - I think the tendency is for them not to be able to really utilize sight the way sighted-from-birth people do.
The body of the shell script should be wrapped in a function which is invoked at the end. If you do not trust them to get this incredibly basic thing right, how can you possibly trust any of the other code they have written?
There are a few Rust hosted dynamic languages already, see: https://github.com/ruse-lang/langs-in-rust

Dyon in particular sounds interesting for realtime apps as it uses a lifetime checker instead of GC.
malicious javascript can only send packets on your rfc1918 network via a DNS rebinding attack, which is not trivial to pull off and is not very reliable

all of these iot devices use upnp to bypass the nat 'firewall'
Unexpected traffic on Port 23 tcp as well as 48101 tcp is a good indicator
Good (free) stuff for API developers
And yet, they can't help it, hence NSA. I doubt that anywhere in continental Europe there is a full-scale surveillance program like administered by NSA or GCHQ (or maybe we are unusually good at keeping secrets -- really doubt it, though).
The legal database structure reflecting cultural norms thing is quite interesting. Reminded me of https://qntm.org/gay
Hydrazine is extremely unstable right? Would much of it remain after slamming in to the ground?
So...you wanted to have authentication and it has authentication...I must be missing something

You missed that you could SSH into it with a default password that is easy to find on a web search.
try logging in from the WAN, not the LAN. Mirai has no method of attacking lan interfaces unless a upnp rule was already set up
sandstorm.io said: «If the connection dies mid-line, bash will execute the incomplete line – however, this can be mitigated by wrapping the whole script in a bash function executed on the last line, as we do.» (Source: https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...)
What would you do if you had full authority of DevOps?
Does HN even support a blockquote?
We are using in Actor.im double encryption of all our traffic with AES+Kuznechik and SHA256+Streebog. We are modified Signal protocol to handle such encryption. While keeping curve25519-only for public key cryptography as russia doesn't have any kind of standart for pki.

Main ussue is performance. AES and SHA256 usually have hardware optimizations in ARM and x64 processors, but Russian doesn't have such thing.

Second thing is i think that this is not actually required as AES and Kuznechik have very similar ideas in them with just slightly different combination. Also AES is not cracked and it is not going to be in the nearest future.
Not really. The state of the art will get you a self driving car, just not a very safe one. Think more 1995 CMU Navlab and less anything that would ever be approved or marketed to the public. Self-driving car technology is 20 years old. Self-driving car technology I would be willing to trust my life to is... well -2 to -5 years old at best.
That's not really true - a good IDE will have navigable inline docs that pulls from both static type data as well as documentation. However, you can perform the same with static analysis of annotations and doc blocks in dynamic languages, so... it's hardly an advantage of static typing.
Aberfan: The mistake that cost a village its children
We have done double encryption based on same ideas.
I don't get the point, it looks to me like the typical C mentality that memory corruption isn't an issue and every 10x programmer is able to write alone C code without errors.

Meanwhile the CVE database maintainers and black hats appreciate this mentality.
I absolutely agree. What Wikileaks did for peace and democracy cannot be disputed but I could not say I am their supporter any more. I wonder how much of it is Assange's personality and questionable political views and how much is of it is campaign orchestrated by almost all-powerful secret services but it probably doesn't even matter at this point.
Oh, so there is a good reason to accept over engineering.
Swiss here. We have a small red booklet called «Familienbüchlein».
Πως χάσανε οι γνωστές και διάσημες την παρθενιά τους – escorts|
Bouncer picks up guy with his teeth for a bet
SARAH, a Mac OS X speech interaction app
Further offtopic: Chirps include reed-solomon error correction. I'm seeking assistance with reverse engineering it https://math.stackexchange.com/questions/663643/discover-par...
I have a small spy cam that I put on quadcopters. It has WiFi but it has no interface so to configure it you download a phone app and type in wifi credentials then it modules that into sound and plays the sound and the camera picks it up and configures itself and then you can watch the stream live over WiFi.
To get around the DNS attacks, one of the cloud providers I use posted their IP address to Twitter. Of course, when Twitter is down too, it doesn't help much.
Italy has the same, called "anagrafe", you need to update the registry every time you move to another city or even if you change street, since the registry not only tracks the relationships between individuals but the historical movements of single persons, and is also used in order to make you pay taxes about producing trash. Similarly when a child is born, the first thing to do for the parents is to go to the office and register the newborn, with the ability to recognize it, or not, for both the father and mother, as your child. That is, the mother can pretend that the child she just gave birth is not her, legally, if she is not ready to have a family, and this is considered by Italians a fundamental right of women, even if it is rarely used. It's a bit annoying to deal with this registry normally but it's an useful thing.
Content Marketing: Bane or Boon for Business
Li-Fi is one attempt https://en.wikipedia.org/wiki/Li-Fi
Nelson's vision was something like a wiki, where everybody paid to read, and anyone could edit or fork the document. You got paid for how much of your stuff was read. Here's part of his original paper.[1] Towards the end of that paper, you can see him describing something like Github, with all the branching stuff, but with a better UI and intended for text documents, not code. This was in 1974. He was way ahead of his time.

He tried to architect a system to do this, and it was insanely complex. It had strong internal consistency requirements, so it wouldn't scale out or parallelize well. It had explicit links all over the place, which was how people thought about databases back then. They were combining the application logic and the database architecture, which resulted in a horrid mess. Today we know to decouple those. Github is built on top of a key/value store. Wikis are built on an SQL database. Works fine.

Eventually, in 2014, there was a working demo of Xanadu. Here's a view of religion in Xanadu format.[2]

[1] http://www.newmediareader.com/book_samples/nmr-21-nelson.pdf
[2] http://xanadu.com/xanademos/MoeJusteOrigins.html