skysight-inc/HackerNews huggingface dataset:
Is 17 days an acceptable TAT here? I know investigation and fixes can be a challenge, but with the severity of this exploit+PayPal being a serious financial service, I kind of would hope for a faster fix. Maybe I'm off base...I really don't know; curious what others think.

How much time would've had to pass (without PayPal doing anything) before the author is ethically obligated to post to HN/media/etc about the hack? I believe publicizing an (unpatched) exploit like this crosses into criminality, but it would be essential to demonstrate some kind of proof, for credence and gravity. I'm guessing the community has some standardized guidelines for this sort of thing, but I'm not aware of them.
You're worrying too much. A big differerence in China is that people will take this kind of things much less seriously. Even the impact of credit scores are close to zero.
> But it's creeping into US with the Smile-or-die push everywhere.

Including Hacker News.

"Speak the truth to power!"

"Oh, and be polite."

...

Then it comes to the point you don't know if anybody agrees with you or not because they're being so coy.
OCaml and Lisp come to mind as possible examples.

Also note that for me personally, I don't see any value in using scripting languages for anything other than system administration instead of the more cryptic shell variants.
Sciatica SOS Review
Next up: Attach it to "basic income".
17 days is fast, relatively speaking.

Security questions are hardly really that great of 2FA protection anyways.
Next up: Attach the score to "basic income".
Assuming you mean this seriously and not just as a tongue-in-cheek dig at internet carriers...

Even if every refrigerator were on a pay-as-you-go plan, handling all of the data may ruin throughput for other customers, especially at peak usage.
Thank you to the author for reporting this big in a responsible way. They are a credit to our profession.
Hopefully not, but I've seen worse.

def validate_security_questions():
if not question_0 or not question_1:
raise AuthException('Invalid security questions')

try:
validate_security_questions(question_0, question_1)
except AuthException as ex:
# Todo: Present error to user
pass
That's not what I said. I said that if you don't pay for the news, then you being manipulated is the product. That's not the same thing as simply forking over money magically removing bias. The latter is a ridiculous notion and that equates to your straw-man argument.

Do you really think a trusted news source with corporate overlords is able operate with unlimited autonomy? I would have no issue if there was a large diversity of ownership with conflicting issues. But I don't really see sufficient conflict in corporate America.
This would be a nice improvement, but as others point out, more flaws will exist and be exploited.

Really this is about incentives: manufactures and users have little incentive to worry about security if the losers are third-party the targets of a DDOS.

Things will only improve when there is liability: either the manufacturers or the users get fined when their stuff becomes an attack vector. Fining users will probably never be politically possible, but I suspect it would be the better option.
Indeed,

The US may have many real privacy violations but you have at least an ostensible right to privacy.

That authority figures don't have to pretend fair even if they aren't actually fair is worth something. That surveillance isn't official is worth something. Sure, solid guarantees to privacy would be better but one really shouldn't claim unofficial surveillance is the same as official surveillance since the move from one to the other needs to be resisted also.
Rich athletes? It's literally true that they work hard for their money.
Hey I have a related question: so with IPFS we all host bits of the internet, and with IPv6 our machines are all directly world-accessible, right? So how do we prevent this from turning into a huge pwn-fest? If routers aren't doing NAT and a bit of firewalling along with that, would each machine be completely responsible for its own security?
Why Are We Still Using Cash? [podcast]
that's if there is one open. argument made is that people that have rent controlled apartments don't leave for economic reasons. this would mean it lessens the supply of rent controlled apartment in the area.

the competition for a place is high in the bay area, so even if they find and apply for an apartment doesn't mean they'll get it. my personal situation is worse due to me finding rooms instead of entire apartments. lived in 4-5 different places in last 4 years. I would get a response rate of ~5% from craiglist when looking in SF, percentage better in the peninsula. Usually competing against 10+ people viable applicants each time.
Yes. This sort of cheating is mitigated in DOTA 2 by not sending players' locations until they actually leave the fog of war.
It got a little better a while ago, where they only distribute player locations to clients that have to be aware of that player due to either line of sight or being able to hear them. Faceit has a more aggressive system where player locations are only sent once you see them, which sometimes, in high-latency scenarios mean you suddenly see then appear somewhere without having them seen moving there. It's all a trade-off, I guess.
My account is older than yours.
Good to know.

And ya, a security question to bypass a phone 2SV is a joke. Almost entirely defeats the purpose.
heart disease vs. terrorism.

it seems to be an unfortunate emergent behavior of groups of humans.
Mobile Devs, would be grateful for feedback
More likely along the lines of

if ((isset($_POST["SecurityQuestion0"]) && $_POST["SecurityQuestion0"] != $answer0) ||
(isset($_POST["SecurityQuestion1"]) && $_POST["SecurityQuestion1"] != $answer1)
The casino industry knew all about this in 2014.[1]

"Right now there is some scary technology coming out of China that incorporates IR marked cards, concealed cameras and computer analyzers. Combined to create a high-tech card marking system, I must say that this device could do for cheats what silicon did for the cosmetic surgery business. The devices are being marketed as poker analyzers."

"The technology works like this. The long edge of every card in the deck is marked with an invisible IR marking. Each mark identifies an individual card. In collusion with a poker dealer, the special marked deck is swapped into play. The player sits opposite the dealer on the table. He positions a concealed camera on the table (usually disguised as a cell phone). The camera has an IR lens that is used to transmit an image of the edge of the deck of cards to a small computer located in a smart phone (the poker analyzer) in his pocket. The image is transmitted during the period after the dealer has shuffled the cards and the deck is resting in front of the dealer before cards are dealt to the players. The IR snapshot of the cards looks like a barcode. The poker analyzer identifies every card in the order that they will be dealt to the players in less than a second. A computer-generated voice message is sent to the player via a Bluetooth mini earpiece communicating the rankings of all the hands on the table."

And the countermeasures:

"Most surveillance cameras, in their natural state, actually have infrared viewing capabilities. The problem is the picture is not so good, so manufacturers add a cut filter over the CCD chip to block out infrared light.
... A number of major surveillance camera systems provide end users the ability to remotely change the IR status of the camera via the operator’s keyboard. This allows the operator who suspects someone is marking cards at a table to use a PTZ camera assigned to the table to switch to IR mode so the cards can be checked live on the game. If you currently don’t have this feature, speak to your manufacturer."

[1] http://ggbmagazine.com/issue/vol-13-no-2-february-2014/artic...
Is there a better source? The whole article seems sucked out of a single tweet with no link to it.

Also hilarious:

>Anonymous didn't respond to a request for comment via Twitter
His performance in the citation game is considerably weaker since 2011 (when he started at Buffalo).
Click bait. Doing nothing relates to he fund he's managing, i.e. his trading policy is to do nothing.
The specifics of politics aside, I think there's always going to be a segment of the population that has total distaste and disdain for the homo politicus way of doing things. Every organization needs these people in order to counteract group think.
When I went to setup my online account for my old bank, I entered a randomly generated 16 digit key and got an error; "Maximum password length limited to 6 characters...only alpha-numeric"

I called to inform them that their account creation was broken, because obviously that was a bug. They told me that sometimes people have a hard time remembering their password, so they "need to balance between ease of use and security". My jaw dropped and my head rolled off my shoulders.

I didn't setup an online account.
> our machines are all directly world-accessible, right

No. Nothing much will change probably. Home routers still usually block incoming ipv6 traffic unless configured otherwise.
WikiLeaks: Neutral reporter or political player?
The North Koreans already do this, and they did it with bureaucrats, not "big data" https://en.wikipedia.org/wiki/Songbun

http://www.hrnk.org/uploads/pdfs/HRNK_Songbun_Web.pdf (PDF with more details)
What a BS. When you target Russian government you don't test on completely unrelated infrastructure it doesn't use.
Thanks for the info though I can't promise anything on this yet because of other stuff in plate. I am looking for consistent contributors (like I have on `googler`) but still not at that stage. If you are really interested, please feel free to contribute.
Home routers are doing IPv6 firewalling by default, no need for NAT. NAT is strictly inferior to firewalling.

(Of course you shouldn't put things on your internet-connected network that need the firewall, just look at it as a porous defense-in-depth element, just like with IPv4)
I'm happy to see that the article doesn't have any BS that I have to ignore. It's a simple page that only tells the 'required' story. As a reader, I want more people to cut the crap about 'blah blah blah' and get to the subject.
Technical deflation to fund Basic Income
It is distributed. The website should have a copy at /ipfs/QmRaS4AZriMzw9nekub7hojTnvQYsVTDqkYG7BggQsexNt (check TXT record).
You just need to access it over the right protocol.
> Culture of heavy drinking and partying

Nowhere does the poster imply that it's a bad thing or tend to dismiss English people as lesser mortals. It's just a matter of fact comment and is a barrier for him to socialize.
To start, I agree with what you're saying.

What I struggle to reconcile in my own life is the difference between this logic, and the logic of a businessman who believes he cannot compete without polluting.

Do we accept "well, my business is unlikely to success, and so my family will starve" as a reason for shitting in the world the rest of us live in?

Or do we say, "there are alternatives, and yes, while your business may fail, we'll all be better off"?
Overwatch isn't really meant to catch those cheats where your unsure at all. It is really only for the blatant cases which presumably make up most of the cheats players encounter in games as well. Things like slightly better aim would be pretty impossible to prove even with the same tick rate as the game. Look at the reddit witch hunts against professional players when they are thought to be cheating. Those accusations are usually false, and also often based on the raw replay data from the game.

Besides, it can already be hard to detect certain forms of cheating, e.g. if one player wallhacks and just relays info to their team. Even when watching the whole team in overwatch, instead of only a single player, this sort of thing is hard to see. Tick rate won't change that either.
Τι απέγιναν τα κορίτσια από το next top model; – Sex Escort News
This is scarily simple. Profit indeed for a black hat. Coupled with a recent post about Gmail on how phone carriers are the weakest link, I just don't feel safe with anything but a dongle based 2fa these days.
>> "The music industry is vicious."

That hits the nail on the head.
Adding to that, it's an issue that goes both ways. For indie artists, it sucks even worse than for small-time programmers, if you can believe that. They get all the problems the big boys have on top of the lack of resources to produce, pay licensing fees, pay assistants, make up for other losses. Stepping on toes is alot easier given how subjective music recording law can be.

Now here's the $1M question: How can we help the little guy? You seem to suggest it's not possible (in that last sentence), but do we really want to let the system devolve into purely RIAA vs BitTorrent?
The attack was surely not mitigated by 1 PM ET. We were experiencing issues until well after 3.
Does anybody know how to activate 2FA for PayPal?

In the security section I don't even have that option.
If said companies cannot afford to test or provide patches, maybe they shouldn't be in the game of creating unpatchable internet-facing devices.

IoT companies have been pushing crappy proprietary solutions for a while now; mobile phones and computers are exempt from this primarily because they run a few major OSes, which can be relatively easily patched. IoT devices are a shithole of poorly written code that doesn't even work properly, let alone securely.
That's exactly what the haptic feedback accessories mentioned are.
But then you are back to the problem where companies require new hires to know React, AngularJS, Karma, Mocha, NodeJS, etc..
it's such a letdown when one realizes that universities are not this ideal utopia where everyone's a straight talker, where there is zero politics, where the people care about research and not the money it brings etc.

Must have been depressing for this guy to realize that universities nowadays are just massive hedge funds that sponsor football programs that are bigger than computer science departments.
Here's a similar blog post from 3 years ago, with similar HN comments...

https://blogs.scientificamerican.com/guest-blog/the-awesomes...

https://news.ycombinator.com/item?id=6081501
Every player could use the same pseudo random number generators with the same seed and predict the same random result instead of downloading it from the server.
It't a really powerful perspective, but when you do it, make sure that you actually do respect the people around you. And that you can remain true to yourself in the process. Empathy changes a person (if you're doing it right); make sure that you're changing in a way that you want to change.
There are several hidden assumption I made to get to the conclusion. But now that I'm thinking about it, this is interesting because while we establish (loosely speaking) how union shouldn't be, we didn't say specifically how our newly improved union would be. And hence each of us would have our own idea of what a programmer union would be -- similarities or otherwise with factory union. I guess a more productive question would be to specific how should our "union", or "professional organization" would be, in more details instead of the loaded "union" term.

Anyway, here is the some of the assumptions I made to go to said conclusion in the previous post:

- Difference in programmers' ability will necessitate difference in pay grade. Vastly so, in the case of programmers. This causes issue in different members of the union. Couple with issues of "how to determine someone is a good programmers", I can see resentment or stupid rule being put up. Assuming that union has certain power in compensation negotiation, their interest doesn't align with any SINGLE programmer either. Everyone want THEIR compensation to be as high as possible, the union doesn't have their incentives in caring for a single individual member (this is the same dynamic as recruiter/job seeker right now in term of salary).

- Programming is more of a creative jobs, and like-minded interest could be a more questionable notion than in older times.
old/new money suffices without an indicating your opinion whether people worked hard, or not.
You know it seems obvious to you but I spend the last 10 years on the job knowing absolutely nothing about this. I'm a programmer and I have good social skills. As a trainer, talking in public comes naturally, as a team leader, I'm also quite good in conducting meetings and driving the team efforts.

But I have ZERO political skills, and I couldn't understand why.

Reading your comment is like finally getting the missing link. I never realized this was the basics of politics. I mean, I knew good politician did it, I saw them doing it among other things, but I could not comprehend it was the essence of it. No joking. Now I understand many things much better.

It may seems nothing to you, but you actually made my day.

And this is something that should be explained to more technical minded people, because otherwise, you can get very frustrated when you can't manage to influence things with good intentions in mind and a detrimental approach, while others seems to make it happen naturally.

Well, I guess now I have to practice a lot to get better at it. Seems a lot of work.
The cron.weekly newsletter
Counting cards is not actually cheating.
Wow. I've done research on smart-locks and their poor security models before, but this is news to me. I hear people bemoaning introducing govt. regulation, but I honestly cannot see another way out of this; these manufacturers clearly do not care!
Perhaps this should be the source link instead of CBC.

Worth noting:

>we are in Russia

Also their website default page looks like DDoS UI.
I feel you. I came back to Europe, but staying so long in an Asian country changed me already. Now it's sometimes really hard to reintegrate. Also because of the cultural stigma that was attached. And I am already thinking in terms of that cultural stigma.
If you want to tamper with content on the web, the idea that content is fingerprinted in IPFS is a huge deal.

IPNS (the name service) then becomes the vulnerability, but that is also distributed.
Note that Dvorak was optimized for standard mid-20th-century typewriters. (Just as QWERTY was optimized for the original late-19th century Sholes/Remington typewriter design.)

In that context, it’s a very significant improvement over QWERTY, in particular by avoiding the bottom row, which on a typewriter is slow and awkward to reach. 15-20 WPM advantage sounds pretty plausible to me.

On a “modern” mostly flat keyboard, some other layout would be better than either QWERTY or Dvorak (personally I don’t think any of the popular layouts are properly optimized for common current keyboards, but to be fair the modern keyboard is a pretty terrible design). Dvorak is still a significant improvement over QWERTY though.
>It is worth noting that we are unlikely to share all details of the attack and our mitigation efforts to preserve future defenses.

Security through obscurity.
I wonder why they test DDoSed US and EU infrastructure if they were planning to target Russia from the beginning. This is plain silly and suggests script kiddies are involved. Or someone claiming to be the perpetrators spreading FUD.
Cheating is prevalent in some kinds of games precisely because you cannot send everything over the network and have the server be the only truth of the game. For things like Civilization is trivial to have the server verify everything every player does, since latency is fairly irrelevant. For shooters where you get only 16 ms of processing (and data sending) time per frame, or even less (for 128 tick), this approach couldn't work. So they kinda already assume no one cheats because they have to. CSGO validates bullet hits server-side but that's about it (which means the client cannot just say 'the bullet hit there', something which in the past allowed cheaters to ignore bullet spread and recoil).
If you lose power on an RPi, it'll sometimes put everything in a state where it won't boot again. I've had this happen often enough at my parents' place in India (the power goes out unpredictably there) that I just imaged a bunch of SD cards and left them there so they can just swap it out when the time comes.
But I thought ipfs-js would make it run today within the browser...?
That sort of engineering problem would also be a great opportunity to do some really cool science, would it not?
Russia to re-open 'drunk tanks' for World Cup
The WSJ is not currently in the business of clickbait. This is a substantive article related to the superior passive investment strategy of a state's pension manager.
Didn't he keep a copy of his own employment contract? If it's the only copy, shouldn't that be the one that has legal force?
تور مشهد نوروز ۹۶
A close family member faced the same issue when moved to UK for work. Being an athlete since the childhood (== not having a strong skill to handle alcohol + saving all time for training), he tried to avoid as much as he could - to the point where his manager made a "friendly remark" about how he should participate.

I think he now more or less secretly switches to juice after first couple of glasses (and I guess counts minutes till the end).
Weekends and 40 hour work week and no children working and health insurance aren't progress? But seriously this isn't about unions, this is about how money influences processes. Those with money get to make the rules because they can afford to go to court when others can't. You want progress, I'll take either a liberal or a libertarian solution to that BS.
For those unfamiliar, a geeky etymology [1] of Hanlon's Razor.

[1] https://en.m.wikipedia.org/wiki/Hanlon%27s_razor#Origins_and...
Unless the master key is compromised allowing anyone to generate authenticator codes, as I seem to recall happened a few years ago with a major provider.
No it doesn't make sense at all. The vast majority of natural evolution works through composability and shuffling of already evolved structures. So through sexual recombination. Many tardigrades can also selectively vegetatively reproduce fixating any mutation in the population. This means the rate of evolution has no reason to slow at all. It could even be quite fast as beneficial mutations have a mechanism to become widespread in the population straight away, unlike many other animals. Even more interesting is the level of possible horizontal gene transfer seen in the Tardigrade genome. So there is plenty of injection from other lineages to keep up diversity.
If you want the genetic algorithms perspective on how that works check out Richard Watson's work https://mitpress.mit.edu/books/compositional-evolution But in general it's really quite foolish to imagine because you know something about GAs you have even a hint of what natural evolution is like. The two are very different. GAs are super simplistic and essentially only cover some basic concepts from 100yol evolutionary theory and mostly ignore essentially everything we know from modern molecular biology. Island GAs and Richard Watson's concepts of compositional evolution actually capture a lot of what happens. The reason is fairly simple if you put it in context of how molecular structures evolve, a good starting place is knowing what a protein domain is https://en.wikipedia.org/wiki/Protein_domain
Most employers, especially large ones, are extremely risk-averse. They don't want to hire people who might be disruptive or badmouth them later, and they usually have other candidates without those risky qualities.
Xtreme Download Manager for Linux – Get 5x Faster Download Speed
I would really like it if Dyn could give some credence to the 1.2Tpbs number or if it was higher.

As these attacks grow in scale, it becomes more and more important to know if this was an attack at record capacity or if it was just that Dyn had lower capacity hardware/links in place. If we're already facing, for example, 2Tbps attacks, a lot has to be done to make mitigating these attacks easier, either through hardware or strategic upgrades.