skysight-inc/HackerNews huggingface dataset:
Hackers have started to use insecure Internet of Things devices, especially internet connected video cameras, to produce DDoS attacks larger than have ever been seen before. The KrebsonSecurity website was hit by a DDoS that was twice as large as the previous largest attack seen by Akemai, and there have been larger attacks since.

The problem will continue, and may get even worse, since many of the insecure internet attached video cameras are insecure because of passwords hard-coded into the devices; they can't be easily made more secure.
I think the answer is surprisingly simple: The attack was just huge.

The unfortunate truth is that with the Internet of Things the amount of devices that can easily be taken over has grown so fast that we see DDoS attacks of unprecedented size. Even more unfortunate is that there is no sign whatsoever that this is going down again.
Garbage data is not a problem since the length is known.
I'm going to use this as an opportunity to yet again rail against the idea of indexing. It's a good thing in theory, but like most things, when it's taken to extremes, it's horrible.

Passive investments wherein the investor takes zero interest in these investments are and have always been a terrible idea, and nothing in modern history has facilitated this more than index funds. When you give a friend of a friend $10,000 to start a company, do you just hand it over no questions asked and with no follow-up? Or do you try to get engaged with your investment? Make sure the CEO isn't sitting on his ass collecting a paycheck? Scrutinize it for potential frauds?

Well, that's what you do in an index fund. Except it's not even a friend of a friend that you're trusting. It's some group of people who likely live thousands of miles away who may or may not have an opiate or alcohol addiction or are complete sociopaths or are just regular humans who know how to legally take advantage of you when you aren't paying attention.

You want to know why CEO pay is so high? It's because CEOs have no accountability for raising their pay when investors aren't paying attention to what they're doing. You want to know why CEOs are taking short-term action to boost stock prices at the expense of long-term viability? It's because they care about the short, you care about the long, and you have no voice when you're in an index fund. You want to know why CEOs are issuing debt to do stock buybacks? To empire build by paying too much for their competitors? To play accounting games to boost short-term earnings?

Index funds are the tail that's wagging the dog, and they are going to be a disaster. And unlike derivatives, which can mess with stock prices but largely leave the fundamental structure of the company untouched, the dog that's being wagged here is the viability of globally important corporations that we depend on.

They were fine when 5% of the market just piggy backed onto the other passive (though attentive) investors. But now passive and inattentive investors are a massive proportion of the market.
The best way is to upload your records to two+ providers. That might be Dyn + Route53, or your hosting-company AND dnsmadesimple, etc.

I wrap Route53 via git at https://dns-api.com/ and I'm in the process of supporting other back-ends to help automate this process.
I would also like to know what exactly are "a lot of resources to prevent."?
>We say "black lives matter" not because white lives don't, but because it is a defacto truth of our system that black lives are treated as mattering much less.

And you really think that people protesting police shootings in general, and e.g. shouting "all lives matter", whether the victim is black, latino, asian, white or whatever would harm things?

It's the NON PROTESTING that's the problem, not the change of angle from "black lives" to "all lives". If anything insisting on "black lives" is only just addressing a narrow part of the problem and alienates people from the more general cause to boot.
NY governor approves fines for some rental ads–hours later, Airbnb sues
Smart Contracts Don’t Have To Be Dumb
To spin the fuckery in a positive light: https://www.destroyallsoftware.com/talks/wat
Seems that you know what she actually thought better than she that said it.
OVH DDoS late last month was over 1.5Tbps:
https://twitter.com/olesovhcom/status/779297257199964160

I believe the Dyn attack was via Mirai also.
Ah, the good old days. I ran a BBS in Sweden with ProBoard. Anyone else used that for BBS'es here?
Walmart IBM Tsinghua U to use blockchain to track food supply chain in China
Google has gradually become more and more aggressive. Boiling a frog alive comes to my mind.

My general recommendation is: do not use Google products unless you really have to. Do not recommend Google products to your friends and relatives.

This is minimum you can do.

Only thing that will really signal them that they are doing something wrong is loosing the market share.
Rejection can dramatically reduce a person’s IQ and their ability to reason analytically, while increasing their aggression
https://www.newscientist.com/article/dn2051-rejection-massiv...
A conspicuous and large campaign contribution by a key figure associated with this site sure won't encourage women or minorities in tech either.

But it sure seems to have attracted a flurry of disturbing posts (eg my grandparent and sibling post's)
What percentage of the population was actually literate? <1%?
LinkedIn accesses Gmail contacts via ‘auto-authorization’
Geometric Construction Kit
I just put files in tars because everything is already compressed. Really, 99% of formats already have their own compression - you might get a couple % by recompressing them. Maybe a few text files that I have are not compressed but I can probably live with them taking up space.
Indeed, flashpoint (1) confirmed that the botnet attacking Dyn was the same one that attacked Krebs (2), and Krebs has more details as well (3). The previous attack on Krebs was seen to exceed 620Gbps.

1. https://www.flashpoint-intel.com/mirai-botnet-linked-dyn-dns...

2. https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with...

3. https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powe...
I feel this article tries to make plain-old masculinity interesting and complex, but it just isn't. Bullying exists on a spectrum of violence. There is no reason to assume there must be a categorical separation between verbal/text-based bullying and physical aggression. Internet bullying (trolling, whatever, we all know what is being discussed without having to argue semantics) is a manifestation of masculinity, no different from how boys/men bully in person. It's another sort of male violence, socialized in young boys by their slightly older peers and the adult world (something I observed as a boy, growing up). Young girls also bully, but the objectification of human beings is more alien to teenage girls than boys, and I think this explains why women tend to "troll" less, meaning, they tend less to see fellow human beings as toys.

If learned trolling starts early in life, the most efficient strategy to defeat trolls permanently is to donate to organizations with explicit stances against the socialization of masculinity in boys (Feminist Current, Stop Patriarchy, WoLF, etc.)
I didn't raise that, because I felt it was a red herring.

More importantly, with regulation we would at least have a prayer of making a dent. With lawsuits, not a prayer.

It's hard to sue when you don't know what the device is, where it is in the world, whether its IP address is real or not, whether it's behind NAT, who the owner is, who bought it, who distributed it, who the retailer is, who their supplier is, who the manufacturer is, and whether it was even a real device or not. Regulation would be way more effective, relatively speaking.
This immediately reminded me of GIFLink.

It was a layer over protocols like zmodem that rendered images as they downloaded. Think of that for a second. Modems were so slow that you could watch the image line by line render to decide if you wanted to continue on with the download. Yes they were porn images.
Those are fascinating examples. I'm looking forward to applying this in my communication patterns. Correct me if I'm wrong, what I'm seeing here is seeing the person as that person and interacting with them. That in turn, defuses the kind of, detached, bullying that takes place. Am I missing something?

Have you found this to be effective online?
Basically a toggle to turn off character set translation for rlogin sessions, to get past an issue with network connected modems.
For single GPU setups, you could use an external GPU setup such as http://www.razerzone.com/store/razer-core instead of using a large PC meant for high-end GPUs. Or you could use a dedicated ultra small form factor machine such as https://www.youtube.com/watch?v=s2W0Lsf7hec for ~$500 + GPU if you want a dedicated GPU box.

But for the people for whom it makes sense to buy hardware for deep learning instead of using a cloud service, a $4k 4x GTX machine would be better.
We run GitLab via the omnibus package in our data centre on a modest VM and it's no slouch (2 CPU, 8GB RAM with ~15-20 users and about 10 active projects). The hosted option isn't the fastest, though.
Greed. There is always someone who profits from lax standards and will weild political influence to hinder change.

Mostly, it takes a massive disaster that hits home to overcome this.
The irony of course is that Buffett became one of the world's richest people by being an active investor.
Wow! They were able to dig a well down to magma without having magma pouring out of it? That's the ideal trashbin! Start pouring in nuclear waste and other non-recyclable garbage, now!
I've been waiting for some announcement around the Gbps of the DDOS similar to this Cloudflare announcement:

https://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-amplification-ddos-attack/

Does DYN routinely deal with very large DDOS which would past this attack in a new category? Can someone who attends security conferences with DYN personnel comment?
> Go has a lot of very polished tooling (eg. gocode) that is supported in multiple editors

Have you tried racer? It seems quite similar, and apparently it does more (see [1]).

I mean, I agree in the abstract that yes, having tooling and a bigger library ecosystem matters a lot. But the things you've cited so far (code completion and an AWS library) are things that Rust does have. I'd be more interested in hearing specific problems with those.

[1]: https://github.com/nsf/gocode/issues/307#issuecomment-155080...
Is this the same period cited by Julian Jaynes in his theory of the bicameral mind?

http://www.meltingasphalt.com/hallucinated-gods/
I've wondered for a long time what the translation of "Who trolls the trolls?" would be.
I disagree.

For one thing, there are still plenty of active investors around. The fact that the less active investors around, the easier it is for them to make returns, will help the market stable and full of "enough" investors.

It is absurd to worry right now about not having enough finance professionals, considering just how many people are in the market.

In terms of what's best for a single person deciding where to invest money right now, indexing seems to provide the best opportunity. It's clear that most investors will not spend the requisite time tracking companies, nor should they considering the benefit of specialization.
Schneier:
"I have received a gazillion press requests, but I am traveling in Australia and Asia and have had to decline most of them. That's okay, really, because we don't know anything much of anything about the attacks.

If I had to guess, though, I don't think it's China. I think it's more likely related to the DDoS attacks against Brian Krebs than the probing attacks against the Internet infrastructure, despite how prescient that essay seems right now. And, no, I don't think China is going to launch a preemptive attack on the Internet."

[1] https://www.schneier.com/blog/archives/2016/10/ddos_attacks_...
is it really recommended to mess around fault lines like that? I guess we'll find out
Speaking of UX, would you consider improving the look of Markdown rendered text (usually README.md) in the repo browser? On GitHub they look great and it's a pleasure reading Markdown formatted text there. In GitLab it's however not very appealing. Headers, spacing between them and paragraphs doesn't look very good IMO.

Coming from a previous job where we used GitHub and TeamCity, something I miss with GitLab is the ability to create a pipeline that's not connected to a specific Git branch. I'd like to be able to create a pipeline that can be triggered manually, without first having to create a dummy branch to put a .gitlab-ci.yml there. Is that something that's on your roadmap?
It definitely does: https://github.com/golang/go/blob/b851ded09a300033849b60ab47...

I should look into those benchmarks if you think there might be string problems. To be frank, I've never looked too closely at anything except for regex-dna.
Well, that's a pretty common reason why people oppose market prices, isn't it: "I have done this thing in the past, therefore I have a right to do it indefinitely."
It's still hard to match the convenience of moving files to and from a server with RZ/SZ.

If your terminal emulator supports it, it will see the trigger sequence emitted and start the modem protocol over your ssh connection and save the file.

Since it runs over your current ssh connection it's perfectly secure.

It's so much easier then switching to a local terminal to use scp to get or put a local file. Sure, I know it's not the most efficient protocol but with the speed of todays networks the kind of files you're dealing with when doing administration or development are more quickly transferred by not having to do the context switch.

If there's a mac terminal that will do scp that has shell integration on the host. I'd switch to that, but I haven't found one. Is there?
Because distance reduces disaster's cost, and in every industry the guys who operate on luck can deliver cheaper and faster than the guys who do it right. One of those groups will kill someone eventually, but until they do they'll out compete everyone.

Everything that can go wrong will go right, and you'll take more risks every time, winning every time, until you experience catastrophic failure.
I'm pretty sure there are videos on YouTube of chimpanzees playing with tigers in the forest. Swinging down from trees just to smack them over the head and back up into cover...
Clinton is a normal politician.

Isn't it problematic that being directly involved in the destruction of Irak, Libya, and probably Syria is considered normalcy?
I practice mindfulness, and yet I find myself creating those very same walls with my wife. In the past two and a half years, some of our arguments have gotten intense. I could see it escalating, worse and worse. It's only in the past month or so that we are both figuring out better communication patterns.

It's why I'm so arrested by this article and @rustynail's examples. I don't know what it is, but I feel like I'm on the verge of grokking something here.
Tapping supercritical steam directly seems awesome, specially if it can be replicated in other areas. And if they avoid awakening a Balrog, of course.
BCP38 – Network filtering you can enact to help stop DDOS
I do not understand the xz format enough to evaluate that claim myself, but TFA explicitly claims that garbage data is a problem.
Thank you. So what you are saying is that let people push content/send email to some staging area, and you'll pull from there whenever you want. I guess I see it the same way, I see the app as the staging zone, it sends me notification when I want and not when it receives any content/email.

I don't understand how other channels are any different. We are still hooked to content being pushed to us right ? Be it Slack or any other social app. What am I missing ?
This feels like the beginning of a horror film: how long until the demons start crawling out from the centre of the earth?
i guess i don't know how to engineer for that without some sort of overwhelming economic incentive. just curious, how would you rate the effort spent trying to make the v6 transition painless. clearly it wasn't perfect, but they tried pretty hard.
Except they were never open. You could download the code, but you were not allowed to distribute modifications to it.

The project was cancelled in 2011, and according to the web page it's open source now, and I think that the open sourcing didn't happen until then.
Considering neither lzip nor xz is a commercial product, I don't think your final point stands. To me, it only makes sense that the person who wrote a "competing" file format would have a strong negative opinion of xz
How much parity data (%) do you have?

What's the oldest disc you've tested?

What do you think about PAR3?
Thanks. I wonder if somebody has a good comparison of the Lodash vs Ramda written up. Probably, but I haven't done the google and evaluation yet :-(
I would say so -- US foreign policy horrifies me time and time again.
أهداف مباراة برشلونة وفالنسيا اليوم يلا شوت فالنسيا vs. برشلونة
The pressure head will likely fall off very rapidly with the number of gates.
Plenty of work is being done in terms of performance improvements, and almost every release features a large set of improvements. A list of all performance related merge requests that have been merged can be found at https://gitlab.com/gitlab-org/gitlab-ce/merge_requests?scope....

If you'd like to help out you can read up on the contributing guidelines at https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBU....

Alternatively, any issues with data on what is slow and how these patterns can be reproduced is also greatly appreciated!
The only archival formats that are known to work over the long term are stone tablets, cave paintings and parchment.
> ton of traffic

This comes with assumptions. Depending on the magnitude of the traffic you need very different architectures. For example, see Pokemon Go https://cloudplatform.googleblog.com/2016/09/bringing-Pokemo...

> an API

How flexible should the API be? For example, do you need multiple representations (JSON, YAML, XML, etc)? Maybe it makes sense to build it representation-agnostic, but maybe it is over engineering.
Looking b ack at stuff like Zmodem, it's instructive to compare the computing culture then and now. Back then, everything was so cryptic.
Documentation was hard to find printed books, code and config was extremely abbreviated ( sometimes for legitimate technical reasons of storage capacity). It was all very off-putting unless you put w lot of effort into research, or ran in the social circles that already had data and knowledge.

Nowadays we have an embarassment of riches of information and community and expressiveness and usability (when the APIs aren't locked down by DRM and trade secrets)
Don't open source license all include disclaimers?
> This should be obvious because pure reference counting requires modifying counts whenever locals are assigned, which happen orders of magnitude more often than main memory updates, and now each local assignment requires touching main memory too.

I guess so, but it's worth noting that this isn't the case in Rust, because Rc benefits from move semantics. Most assignments don't touch the reference counts at all.
We're working hard on making GitLab.com faster (where I also made the gifs) [0]. If you're running your own instance, it should be fast.

[0]: https://gitlab.com/gitlab-com/infrastructure/issues/59
Damn, what bank would require a koseki? For that kind of stuff, it's usually based on the residency system (and you can print a 住民票 at any convenience store copy machine in Japan with the proper RFID-equipped ID card). Those still have to be printed within 3 months to be valid.

But yeah, for matters of marriage, birth and residency, it's all based on the koseki, and it's painfully distributed. My wife's koseki is held in the tiny village where her father was born, and where they haven't lived in many decades. "Luckily", since it's within the prefecture they can have it mailed to the central city hall, but it's still a completely pointless paper exercise. Must be kept around as a jobs program in all these dying rural villages...

Meanwhile I can print out my Swedish residency registry information by logging in to the tax office via a 2 factor authentication smartphone app and downloading a PDF.
>* Who is programming a computer to feel emotions? I'm not aware of any significant work in the direction. (If anyone is, please link it!)*

Affectiva is working on reading emotions, and there is some philosophy work on whether or not an AI can feel emotions [1]. A Russian group claims they will release an emotional robot around 2018, but scant details on what that even means [2]. More scholarly work [3] [4] [5] is ongoing, but slow going.

[1] https://en.wikipedia.org/wiki/Philosophy_of_artificial_intel...

[2] http://www.dailymail.co.uk/sciencetech/article-3680874/Scien...

[3] http://www.sciencedirect.com/science/article/pii/S0747563204...

[4] http://link.springer.com/chapter/10.1007/978-94-009-2792-6_1...

[5] https://books.google.com/books?hl=en&lr=&id=OqbMnWDKIJ4C&oi=...
If someone does take these things into consideration, it will supposedly slow them down and cost them money. There's always someone else who is willing to do the job without these hindrances.

Similarly, one of my children hurt themselves climbing a tree and ended up in hospital. Our other child was taking high risks a week later. My second child said "it won't happen to me".
C and Python. Lots of bash scripting. Spare time projects still tend to favour lispy languages. I use Clojure, Chicken Scheme, and others. I'd love to use Hy but having tried it a few times seriously, it's not mature enough yet.
It's not even a year old.

I'm not sure I get your point. Many active funds beat the S&P 500 over 5 or even 10 years.
Oh, interesting. I was inferring that from the Go code out there that uses machine code directly: https://github.com/minio/blake2b-simd/blob/master/compressAv...

I guess it must be a recent addition.
> If it is foreseeable that your defective product would be used to harm another person, you can be held liable. Yes, the intervening actor is behaving illegally. That doesn't matter. You still bear your fair share of responsibility.

That's the point. The unlawful intervening actor has 99% of the responsibility. The security vulnerability doesn't even give them anything inherently malicious or dangerous -- anyone can buy bandwidth and IP addresses on the open market. All the vulnerability does is give them the opportunity to take them without paying.

The traditional rationale for imposing liability on the "wrong person" like that is when the actually responsible party can't be found and someone who could easily do something to prevent it can be found. But the manufacturers of these things can't be found either, and the retailers can't easily do anything about it.
Halley modems and Halley's comet!
I reset Android on my Samsung S5 and was surprised Google's Gallery app requires access to the Contacts app. I denied Gallery access to my Contacts and now I can't see my pictures but I can take pictures.
He writes out a list of places where C++ is undoubtly better and can help write safer code over the alternatives when you question him -- not perfect code, just code that better utilizes modern features, to help reliability -- and your response is... to avoid his question, address nothing, and do some random handwaving with an FQA.

Honestly, the response would be funny if it wasn't just a little bit pathetic. But I've learned not to expect much from people who can only handwave with no actual substance. Programmers are good at that.
I write code using two passes. First pass is WET and full of leaky abstractions, to test which API calls I would be making. Second pass I delete it all and rewrite it DRY and beautiful. If you don't already try incorporate a second pass in your work flow.