skysight-inc/HackerNews huggingface dataset:
We've starting on-boarding more companies outside of YC. We're working with some larger companies (Facebook, Apple) and also curating a list of exciting earlier stage startups too.
A.I. isn’t about to invade your life – it already has
Consistency vs. availability (wat?)
Browsers have been adding checks (like pinning) that catch some of the faulty certs, whereas before this was much harder to detect.
Not fully understanding TCP/IP, but could routers installed at ISPs disallow direct traffic to mid-point infrastructure?

I mean.. only allow traffic from/to leaf nodes.
Until you open up incognito windows to get around the noprocrast. ;) It's still a good hurdle and a tiny reminder even when I bypass it, though.

> I don't think tech is bad, just a lot of it is designed as a feedback loop of addiction.

Totally agree with this. I turn off all most notifications on my phone and tell people that if they really want to reach me, a phone call or SMS is still the best. I've also been calling people more because generally we can arrive at solutions in a minute of talking instead of 10 minutes of half-minded replies.

Sometimes I feel like the best balance of technology/attention was around the early 2000s when things weren't totally vying for our attention. When there was a clear distinction being being online and offline. When you would type "afk", then go do other stuff uninterrupted.

Of course it's easy to romanticize as that's also the era when I personally started surfing the information superhighway.
So mostly this seems like they are still looking into it and the problem appears to be difficult to find.

What was with the blurb at the end where it commented that Republicans want an independent probe? I thought Republicans like the private business and the space program?! Wouldn't you only want an independent probe if you thought that there was some kind of cover-up?
Rijndael (which is better known by the name AES) was developed by Belgian cryptographers, working in Europe. I think the same team developed Keccak (SHA-3).
Is this the end of the Internet that news.com predicted back in 1995?
This is just muck-raking. We're talking about a book written in his twenties, which he's previously distanced himself from and publicly retracted views. Never seen this kind of yellow journalism in The Guardian. Sign of the times, I guess.
Well congrats to you.. I'm one such Tech Lead at one of those two co.s and pretty much in the same boat.. but making into th e big 4 at any level is pretty hard...
A guy bootstrapped a company and got rich doing it: the best possible inspiration to future bootstrappers, but you find that a bad thing? What's your problem with someone spending his own money to chase something you think is impossible? Seriously, the amount of hate on HN for people that are actually trying to do hard things is astonishing.
These rules are designed to prevent you mixing codepoints from different languages, so you couldn't register something that looked like gmail but with the English 'a' replaced with a Cyrillic 'a'. However, if the name you're trying to emulate can be reproduced entirely within another language's character set, you can still impersonate an existing domain.

For example, it may surprise you to know that http://www.еа.com and http://www.ea.com are two different websites, despite the URLs appearing identical. Edge at least renders the IDN version in its punycode form, but in Firefox and Chrome the URLs are indistinguishable. It's quite possible that's a result of my messing with the IDN settings in the past, though - I'm curious what others see for those links.
That's irony, right? I can't even tell anymore.
seems like the right thing to do.
however the ip address itself won't respond either
Let's Learn Algorithms: An Intro to Bubble Sort
Mozilla Foundation Security Advisories/Firefox/October 20, 2016
I wonder how much of the numbers reflect that the author seems to be a man with a typically female name (Kelly)?
So we should just quit. Do you actually find the best way to get hard things done to be quitting because others failed?
What I really mean is...
What is this?
What did you do that lead you into your kind of position. You are hitting every thing I want out of a career and as I take a corporate job in the city to validate my self taught skills, I'd like to be able to do what I can to work back out to being a contractor. I assume networking, excelling amongst your peers, and constant learning. Am I missing anything?
Yeah, they really need to knock that off. Formal verification creates hard-to-hack code is still a decent headline. Or "Researchers using formal verification stopped hackers in their tracks." That's entirely accurate plus can be followed by specifics to understand what context it was true and what contexts it might be true elsewhere.

Hacker-proof is just going to hurt branding of formal methods the second a hacker takes out a high-assurance system. Whereas, the formal methods and high-assurance literature written by anyone with sense acknowledges plenty of assumptions that might be targeted plus just human error. Even the people they quote in the article don't say it's hacker-proof!
This is what I meant. No for a first hire, but sure after you have a team of 5-7 and you start needing more people. Not I don't see it before
Don't even bother. This is Coldfusion. Irrelevant for a decade if not more.
> And while individuality is reduced. There are still subtle differences between individuals and smaller groups.

Exactly. General symmetry breakup process guarantees that uniformity in highly interconnected environment wouldn't be a stable state, ie. it means the necessary emergence of non-uniformity, basically individuality, at different scales - personal, group/team, cube, ... It is just that such individuality would look different as it will be driven by emerging non-uniformity instead of just physical barriers of our skulls.
We seem to be needing more concerted action on what is a consumer minimum standard for an internet connected device.

Consumer devices have to be more secure because if the low user skill level - and interest.

I am always reluctant to say "there should be a law against it" but frankly if we cannot mandate minimum standards of uogradbility and security for devices we will just keep handing over our devices to the first person to scan them.
Dell's XPS line of laptops have fantastic trackpads, for instance.
It would be a lot more terrifying if it somehow tried to merge the photos skulls and other traditional horror imagery (the taj mahal photo refection could easily be a skull).
Schneier wrote about related attacks just over a month ago in a post titled "Someone Is Learning How to Take Down the Internet" (https://www.schneier.com/blog/archives/2016/09/someone_is_le...)
App that extracts a unique pattern on your phone's cameras sensor. It's for a study.
This is completely incorrect. Every unregulated monopoly catastrophically chokes an economy over time and those that are regulated are almost as disastrous.

Your own example, Bell System, is an example of an sub-optimal but obviously adequate regulated monopoly that worked moderately well over a century.

And US Steel certainly did _not_ have competition when anti-trust was brought against it. By 1907 there were no longer any competitors and anti-trust attempts only started in 1911.

What you do have today, for adopting pro-monopoly policies for decades is, among other things, the highest bandwidth prices in the developed world. Higher even than the comically inept regulated monopoly Telefonica. Which btw has phone plans and per minute charges a fraction of the US and where the idea for charging for an incoming call is unthinkable. And a food supply monopolies that inflates the price of food to stunning levels. The list is endless but my typing patience is not. So here's a link.

http://www.economist.com/news/briefing/21695385-profits-are-...
I've a few friends move down to the said big co.s .. Just the talent of the folks in those big cos is alone worth it to take a risk; if you end up working in a good group; it will be very intellectually satisfying; loss of social status is something you'll need to bite.. but its a good risk to take in my opinion.
No, not irony. Our infrastructure is under attack. Why not fight back?
I wonder if the embeds break when a tweet gets deleted. That was always one of my biggest concerns when using them: that someone else can change / break your article in the future.
Do you mean by that to say I write like a pretentious ass? Because if so, well spotted! I'm absolutely a pretentious ass. Like any such, I thrive best well away from others of my ilk, because we can't help striking sparks off one another; based on what I've seen of Eng lit academia, I tend therefore to think it is the wrong hothouse for me.
170 companies?! At what point does a resume become spam?
Oddly enough, the applicable quote is from The Martian:

"We built a lunar lander from scratch in seven years."

Hard things get done by people who try to do them. Seriously, it's his own money.
One can go even further and install DNSCrypt:

https://dnscrypt.org/
Ask HN: What would it take to end up in a DDoS-free internet?
After the recent DDoS on Dyn, I started to wonder - what mechanisms would we have to implement and deploy to make it more complicated to perform DDoSes? Would for example adding some crypto, e.g. some kind of proof-of-work on TCP actually help here? How helpful would it be if all ISPs stopped allowing IP spoofing? How could we get there?
It's astonishing, given that we're all communicating via a technology that would essentially be considered magic as little as 50 years ago.
No mass-produced item is exactly identically manufactured. Phone camera devices will be very subtly different. Apparently, it affects the image slightly, to the point you can “fingerprint” an individual camera just from the image data alone.
Hey, that's better than my initial reaction, I thought the title was talking about Ruby on Rails developers
Likely none, but plenty of us seem to live in apartment buildings in appealing areas of cities.
Let's build a botnet to DDoS the DDoS botnet. /s /kinda
Lack of interest on behalf of the author, lack of interest on behalf of the standards body, implicit political pride, lack of internationally-recognized, systemic cryptanalysis.

It'd be an entirely different matter if NIST posted a new competition and someone entered an algorithm that just happened to be an existing Russian standard.

Altogether, this isn't an unpleasant status quo. These algos are standards in their sphere of influence; other spheres of influence (like NIST) aren't showing much interest in evaluating their fitness for use because it's not necessary for them -- they already have comparable standards.

However, it's more of an issue for someone like IETF who tries to promulgate standards with a global reach. They are simultaneously trying to be accommodating while trying not to make recommendations that are objectively bad (e.g. recommending a broken algorithm, despite it being a national standard). There is a now-expired draft RFC for some GOST algos in TLS [1], and there's an RFC for supporting the Japanese-origin Camellia block cipher in TLS [2], although all major browsers have since removed support for it, mostly born out of a blog post about reducing supported TLS ciphersuites but also citing lack of use [3].

[1] https://tools.ietf.org/html/draft-chudov-cryptopro-cptls-04

[2] https://tools.ietf.org/html/rfc5932

[3] https://news.ycombinator.com/item?id=12360557
You most likely meant "Eternal September".
Stop building stuff on sand – The Internet's DNS and Linux
On behalf of Saito Game Team,
I most humbly apologize.
If you are 2-3 on your team and you feel you need someone to care about all those things, something is wrong in your company (for most companies). You probably receive a phone call and a couple of emails a day for customer support or other things, and probably don't have so many bills to pay. So you don't need someone full time or part time for this, unless you are a special case that need 4-5 meetings a day with different people.
I think perhaps portage simply stopped winking ;-) at you while validating package sources on a per-algorithm basis. Typical Manifest file:

DIST <filename> <size> SHA256 <sha256_checksum> SHA512 <sha512_checksum> WHIRLPOOL <whirlpool_checksum>

Looks like SHA256, SHA512 + Whirlpool to me. Apparently the SHA algorithms have FIPS (US) and NESSIE (EU) certification. Whirlpool has NESSIE (EU) certification. Streebog has GOST (Russian) certification.

Added https://bugs.gentoo.org/show_bug.cgi?id=597736 for discussion.
You're basically describing static analysis but with Prolog and a weaponize option. I haven't looked up bug-to-attack research in ages but last I did it was generating exploits from patches. That one was pretty evil if one is aware of why delaying patches often makes sense for mission-critical apps. They need testing as they can do damage themselves. So, instantly turning even a chunk of patches into exploits can give an attacker an advantage in that windows between release and application.

Example:

http://bitblaze.cs.berkeley.edu/papers/apeg.pdf
Yeah. One of the promising things about the internet, very early on, is that it gave people communities that they couldn't have in the real world because they lived in areas hostile to gays, or trans people, or... It's hard not to wonder if we're going backwards sometimes.
Please forgive my bluntness, but my takeaway is that you're simply being outcompeted. If the company pays less than others and its candidates are taking better offers, why should that mean it's a job-seeker's market?

Whether one particular employer can find workers at some arbitrary rate is not the same as whether there's a shortage, especially if that employer's rate is not in fact competitive.

If having trouble hiring while paying less than others indicates a seeker's market, what would an employer's market look like?
Why Corporate America’s Debt Is a ‘Major Risk’
The visibility of the DDoS matters. It successfully took down parts of the internet used by the general consumer. An attack of that scale, that someone who has never heard of Spamhaus or Cloudflare actually noticed, is notable simply because it happened.
or Jen just dropped the internet.
IANAL, but the DMCA Safe Harbor is for hosting providers that want to keep their hands clean of their user's uploaded content. If you're hosting your own content, the whole procedure doesn't apply to you (though if your content really is infringing, keeping it up after receiving the takedown could be used as evidence of willful infringement).
Reminds me of https://panopticlick.eff.org/

"Your browser fingerprint appears to be unique among the 159,551 tested so far."
I thought his anecdote was the conventional wisdom?

It lines up pretty perfectly with my experience swapping in Ubuntu for Mac OS. When I have a problem I can troubleshoot it down to a specific line of code or piece of hardware, on windows.... well, I would rather not troubleshoot anything on windows.
A designer.
There is definitely a surplus of engineering work available, regardless of whatever political spin you want to put on it.
Re question #2, Amazon uses UltraDNS as a backup and seemed to be relatively unaffected by today's attack.

Re question #1, check out PagerDuty's reliability page here: https://www.pagerduty.com/features/always-on-reliability/

Namely "Uninterrupted Service at Scale -
Our service is distributed across multiple data centers and hosting providers, so that if one goes down, we stay available."

It seems fair to expect them to have a backup dns too, but I am not an expert.
You know, if this where a paper or article, okay. But this site has nada information about it, it's basically a four page DOWNLOAD button.
> It is too early to determine who was behind Friday’s attacks, but it is this type of DDoS attack that has election officials concerned. They are worried that an attack could keep citizens from submitting votes.

> Thirty-one states and the District of Columbia allow internet voting for overseas military and civilians. Alaska allows any Alaskan citizens to do so.

I had no idea any states allowed voting online. I wonder if the general population will ever get access to that.
It's still a search company. What search engine do you use? Who has built a better web search product than Google? I admire DuckDuckGo and am hopeful for them in the future, but Google is simply still the best search engine out there.
You are 2-3 founders and you move customer support to another person? You have more chances to fail. Founders need to deal with their first customers to understand their needs and find the product-market fit.
Lots of work in that area. Here's an example:

http://www.cse.psu.edu/~dbz5017/pub/pltiming-pldi12.pdf
They don't need them, except for financial gain. They make money off their patents just like the parent said, by licensing them, selling them, etc.
Please Vote for this Chromium Feature to Solve a Problem that everyone Knows
...or simply send a few hackers to Guantanamo!
I wonder, how much electricity do these attacks spend on average? Is it significant for economy?
Matt Stone and Trey Parker perhaps.
Yes. But longer. Because it starts even before the kids get back to school...
Sure they could, it's called disconnecting your internet connection, unless you are arguing for every ISP to implement some sort of proxy, which itself would be mid-point infrastructure.
I've noticed a lot of wifi routers are doing this now. Which is pretty great. All appear to be unique passwords for each router.
The more people hit the download button, the more paper.
It's based on this work: http://www.ws.binghamton.edu/fridrich/Research/EI7254-18.pdf
Maybe not the answer you were looking for, but self-hosting email can be a fun challenge.

Lavabit had a privacy focus and look what happened to them.
"Scroll for more." = Scrolling is broken; thus accessibility for those with disabilities is as well.

Can't highlight text. Keyboard navigation is busted due that as well.

Turning off Javascript results in a blank black page.

Basically a broken web site.
Interesting - I am not signing up with Google but it looks similar to my thinking - grab gmail, LinkedIn etc and store centrally.

I am planning on using the infrastructure for this as the base example for a book - so I am afraid this is going to become a duplicate project - but I hope it will be fun.

Just need to get a few weeks free ...
I wonder what they will do with the data (the fingerprint). Will some three-letter-agency have access? (Of course they can demand access).
Lets avoid giving ISP's more power than they have. Next thing we will see is "oh we thought that person was using a compromised device" for any disagreement.
Except other adversarial technology domains like encryption or spamming where defensive technologies are extremely good when used and 'finding the attackers and taking them out' is ridiculously impractical.
…except they did though, at least if you've sshed into github at some point (which I think nearly everyone has).
Yes. Those are years, plural, when Google the company was not putting advertisements into search results. They may have always monetization via ads when they decided to turn it into a company (Larry and Sergei did not think about ads when they were developing the initial product, but I'll concede that they likely just hadn't ever considered that they'd be able to turn a research product into a company at all), but they inarguably built the product before selling one single advertisement.
Is there a link anywhere to your privacy policy? I notice the app page says not to upload private images such as photos of faces but what happens to the data I do send? Are the images saved? Is my cameras fingerprint saved? Do you collect identifiable information from my phone? etc.
I don't think so. Modern botnets are mostly made of devices that are operating 24/7 already, such as compromised IP cameras, set top boxes, SOHO routers, IoT devices, etc.

The energy spent for TCP/IP stack usage is negligible at best, even when pushing those embedded CPUs to 100%.
Straight to app store on mobile. Hacker News allows this?
Technically, 3) No bugs in your proof checker. A bug-infested theorem prover can still be useful.

As long as I'm well-actuallying, 2) The proven properties establish my own informal goals. If a hacker's goals are also satisfied, well, maybe they want to DDoS the internet but it's Not My Problem.
From your link (emphasis mine): "The suicide rate at Foxconn during 2010 remained lower than that of the general Chinese population at the time as well as all 50 states of the United States."
Agents of influence: How reporters have been “weaponized” by leaks
Hopefully it's not related threats about hacking during the election.

Remember that recently Biden openly threatened cyber attack on Russia if they make any attempt to tamper with the election. Which is completely unprecedented, as is the notion that DOD is openly saying Russia was behind DNC and other attacks.
This reminds me of printer dots.

https://en.wikipedia.org/wiki/Printer_steganography
Keyboard navigation and scrolling are working for me on FF.
Brainstorming: We should make DNS mines like for Bitcoins
AT&T agrees in principle to buy Time Warner for $85B
A good designer is quite important but I'd only suggest making them a 1st hire if said designer manages social media and provides customer support.
If your issue is with the sensationalist headline, I won't argue, but want to make sure to note that reporters almost never have any control whatsoever over the headline of their piece.
The DOJ status hearing is one of the perfect examples of something out of WikiLeaks that was way blown out of proportion by tweeting first, ask questions later.

http://mediamatters.org/research/2016/10/11/nbc-reporter-sug...

http://www.politico.com/blogs/under-the-radar/2016/10/trump-...

On the debate thing, a Bernie senior aide came out and said that she gave guidance to Sanders campaign too.
The most nefarious scenario would be that Brazile gave questions to Clinton to prop her up. The less nefarious scenario would be that Brazile from her DNC position tried to get the best out of both candidates to not embarrass the DNC.

Note that Brazile and CNN are still denying she could have gotten access to the townhall questions. I agree though that networks should not put themselves in these kind of conflict of interests, by hiring a political commentator that is paid by the DNC at the same time, or a former campaign manager that is still on the payroll of said campaign like Corey Lewandowski.

http://www.latimes.com/nation/politics/trailguide/la-na-trai...
Understood, but that's still not correct. Whois is Only used for proving control by whatever contact is mentioned in Whois. The company name in Whois isn't used for EV verification of legal entities at all.
Tape on of these to it: https://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Da...
Yes, but beware, they (at least used to) resolve unknown names to a page filled with ads.
Side-channel attacks, attacks that depend on physical characteristics of the system, are a thing [0] and formal correctness doesn't really prevent them.

Also there's crazy stuff like Row Hammer [1] which depends on escaping the abstraction that memory bytes are independent entities.

While these are maybe crazy or extreme attacks, they are still practical in some cases. Any abstraction can eventually be hacked simply because an abstraction is a simplification of a more complex system which can be manipulated.

Reminds me of the joke of the junior functional programmer convinced that their code is side effects free and who then proceeds to crash the garbage collector because memory allocation is not considered a side effect...

[0]: https://en.wikipedia.org/wiki/Side-channel_attack
[1]: https://en.wikipedia.org/wiki/Row_hammer
Do you intend to make the source available?
Startup Capital Is Ammunition, Not Oxygen