skysight-inc/HackerNews huggingface dataset:
1. As others said, the private key proves how you voted. If you can verify it with the private key, you can show the proof to someone else. And if it's a single-use private key, there's no reason for me not to share the private key once I voted.

You need to have deniability; I need to be able to revoke my ability to prove how I voted, and moreover I need to be required to revoke it (otherwise I can be compelled not to revoke it). Right now, I am unable to leave the voting booth with any receipt of how I voted, even if I wanted to (i.e, even if someone else wanted me to). I can see my vote, and election monitors prevent anyone else from seeing it until it leaves my hands. In most places in the US, I can't even take a cell phone photo of my votes, and that's a good thing because nobody can ask me to take a cell phone photo of my votes.

2. If they're pre-known, anonymous, single-use keys, nothing prevents a corrupt election official from keeping a copy of the key and voting before the voter gets home. The voter has no way to prove that they didn't vote and that someone stole their key.
It's always expensive to chase the hot thing. If you're an average joe, SFO is that thing that is best avoided.

I'm living in a median cost market in an expensive state and live like a king in comparison to someone in my job (senior tech role) in SFO, although my salary is 50% less. I won't be working for Google anytime soon, but I don't need $500k to live in the lifestyle that I want for my family.

If you want the northern CA lifestyle, wait for the real estate cycle to bust and save some money in a normal place.
The Idea of Lisp
> some people don't like how MS Code doesn't have a tabbed doc UI

VS Code has had tabs for over half a year now, since the 1.3 release in June. Beforehand, the "active documents" acted more or less as nerfed tabs, but I agree the real tab support was desperately needed before 1.3.

> they have been pushing out features very fast for years now.

WebStorm gets major updates 2-3 times a year, VS Code gets major updates 12 times a year. I'm pretty sure you can't really call WebStorm "very fast" on that front given that metric.

I've never used WebStorm so I can't really comment on the other points, but you're also being very vague. What are some examples of more functionality and less rough edges?
They should release the interior video of the incident, then. It's their car and their employee (not one of their contractors) and with no passenger there's no privacy concern either.
> you can't allow just any driverless car on the road

In San Francisco, no less! I'm a huge fan of self-driving cars. I think they should already be legal in the dead of night in Cupertino and Wyoming. But a high-density urban space is not where you experiment with cars.
VA and MD both have one small patch of pink amidst vast swaths of blue. They seem to be doing great.
> More and more are migrating to cloud these days, I expect more and more epidemic leakage will come.

Why? Couldn't isn't relevant to security.

If anything, it makes it easier to configure firewalls and rights, so it's easier to put security in place.
Yes, 'offshore' is a race. Every critique is a racism.

Coming from said 'offshore' (at least in regards to the US), I see that 'quality' people work remotely for monies comparable to the onsite workers, launch startups, et cetera. If you outsource to the offshore for the costs, guess what, you get lesser quality for the said cost. Nothing racist in that, but I understand your position - a SJW to every household!
Most people here don't seem to understand the difference between collision and preimage attacks. So they're overreacting to the fact Yahoo used MD5.

Storing unsalted passwords, however, would be a huge mistake, if Yahoo did so as someone here claimed.

There are precomputed lookup tables for the unsalted hashes of many, many passwords (both MD5 and more secure hashes) and cracking unsalted passwords is simply a database lookup.
If the car was driving autonomous or not, there was a driver sat in the drivers seat which is fully responsible for the actions of the car.

If the self-driving capability missed the red light, then it is the drivers responsibility to have intervened and stop the car.

If I did this in a Tesla with autopilot enabled, would all Tesla's be banned in California? I should be punished as the driver in command of the vehicle.

If I did this in an old banged out SUV, would the car be banned? No, i'd received a citation for the offence of running a red.

Which is exactly how this incident should have been handled.
Android emulator exposed to vnc server and streamed in browser and websocket
I wouldn't recommend ebay to anyone at all. This article probably will help potential scammers to actually cheat more people.
The book "Turing's Cathedral" is a well-written account of IAS's early years, focusing on the events leading up to development of the first computers there by Von Neumann.
Exactly.

And in Slovenia (potentially elsewhere in Europe) I have to do a bunch of bureaucracy to get a sole proprietorship. In the US, I don't.

Hence why it's one of my fav things about moving to the US.
There are already 20 companies that have been granted permits. Uber might have been granted one too, but they didn't even apply. https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/testi...
This Yahoo company seems pretty cavalier.
Very nice. Thanks for that. So yes, this is likely the thing to do in this situation.
> "Passing the password through MD5 reduces the complexity to 128 bits, you can't get that back."

Assuming that the new hash is secure (and sha512 is generally agreed to be secure), then, given a specific sha512 hash, the original MD5 hash can only be determined via rainbow tables, which is a Big-O operation. Even though entropy is reduced, it's still a significant work to determine the original MD5 hash (significant in this instance being longer than the heat-death of the Sun, given current extrapolations of computing performance).

Attacks against MD5 are based around knowing the original MD5 hash. In this instance, the original MD5 hash is unknown, so there is no mathematical shortcut to finding a collision.
Seems like a reckless statement on a couple of fronts. For one, it's openly disrespectful to the human drivers upon whom they've relied to this point--seemingly regarding them as nuisances which must be discarded post-haste.

And, of course, it begs the question: what would their response have been if it was due to a technical glitch, which may yet happen? Their statement could easily be used against them.
Why on earth should we believe them?
I've done it before on a 1 billion word / password list and didn't get any collisions.
Show HN: 2wk build. The dark ages of gifts are over. Never get a bad gift again
Given the context, you know damn well what he means - it's coded speech and I refuse to believe that you're that naive.
> The problem was that the security team had to go head-to-head with the budget team. //

Wouldn't engineers at such a big corp whistle-blow such incompetent decision making?

Apparently [1] they had a $1.37B net income in 2013. Given using bcrypt with a Blowfish hash and salting was pretty much a de facto standard by that point (I think that's what Wordpress were doing, hardly revolutionary security work) it seems the relative cost for Yahoo was approximately zero.

All I can imagine is that those in control were asked to leave the system open for government snooping? Why else would engineers working there not [anonymously] bring this to press attention - "hey, Yahoo security amounts to a piece of sticky tape holding a bank-vault shut".

- - -

[1] http://www.marketwatch.com/investing/stock/yhoo/financials#
> This incident was due to human error. This is why we believe so much in making the roads safer by building self-driving Ubers.

My new side project is a The Aristrocrats joke, except it ends with "The Gig Economy!"
Uber exemplifies the libertarian / anarchist subculture in tech. It seems to be a winning strategy for them so far.

Edit: to clarify my position. This is why software will never be regarded as an engineering profession. There is a complete disregard for everything that would make us a profession. I'm saddened with the way the world has gone in 2016. It's like we rebelled against adulthood on a global scale.
"Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with a broader set of user accounts, including yours. "

"The stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers. "

I'm a paid premium member for Yahoo's service for many years, I would like to join somebody else to sue the hell out of Yahoo.
VR videos, VR videogames, VR [insert other here].

Being able to watch a 360 degree video in the browser. Optionally hit a button and put on a headset and use head tracking to look instead of click+drag.

Playing VR games using something like daydream, oculus, etc... All within the browser.

The idea being it keeps the same cross-platform, cross-device, cross-"viewer" (VR headset, phone screen, computer screen, KB+mouse, touchscreen, etc...) that the web is built on.

You probably won't be making the next AAA title in the browser just yet, but it's more than capable of games, videos, and other VR "experiences".
Really?! Ugh, wow... I'm not going to own any Apple products a year from now, am I?
Apparently San Francisco disagrees.

https://techcrunch.com/2016/12/14/uber-ordered-to-stop-self-...
Does it matter who was driving? An Uber company car, involved in testing, ran a red light. That is a demerit to the operation overall.
CA law says every autonomous car in testing needs to have an operator in charge, so technically all incidents are due to human error.

Also: Uber is not listed in the CA DMV list of companies allowed to test autonomous vehicles?
https://www.dmv.ca.gov/portal/dmv/detail/vr/autonomous/testi...
bcrypt(md5(password)) is what Yahoo! did when they switched.
BTW everybody knows about mortgage payments/rent but many forget about property taxes you have to pay as a homeowner. That's about 1.5% of your house purchase cost every year. Of course, there are tax deductions for that but even after them it's still non-negligible chunk of cash on homes approaching $1M.
No that was handwritten by Tobias the original author and I shared it on Twitter a few weeks back. We do have a lot of abstraction and complexity internally. But we like the direction and way it has allowed us to pivot toward and away new/old features.
Speak of the devil... couldn't get a single Slack voice or video call to work all day due to VPN issues... we all have to use a VPN... and it just flat out doesn't work when you connect to one. Not one call all day. So... we just used Google Hangouts.
This is not my work, but will show you how it's done: https://nicschrading.com/project/Intro-to-NLP-with-spaCy/
This is technically true, which is the best kind of true. Swap in nationalist, chauvinist. It's utterly clear what was meant by racism above, in spite of your semantics.
Absolutely love this! There's no one better than Patrick to talk about starting a "real" business and being a solo entrepreneur. Really looking forward to learning as much as I can from his guides.

On a personal note, Patrick is an awesome guy. I'm still super thankful he took time out of his busy schedule to do our little podcast: http://startupcto.io/podcast/0-23-cross-training-with-sales-...
The Mensa tests are generally done in a room with an experienced practitioner. The "take home" tests are just used as a marketing tactic and/or as a way to decide if you should even bother with a formal test.
Single person $150k gross pay (salary, stock, bonus). $94k net pay according to this:
http://www.paycheckcity.com/calculator/salary

Not being very frugal:

- rents $2000K/mo 1BR apartment (single but wants some comfort in the Peninsula, no hellish commutes from East Bay)
- transportation $200/mo
- free lunch (and possibly dinner) at the company - eating out and groceries $300/mo
- entertainment $200/mo

That's $2700/mo. Let's round it up to $3000/mo because you're a well paid software engineer and can spend $300/mo on top of what I listed whenever you feel like it.

So far, $36k expenses + $50k savings and you still have $8k left to go on ski trips to Tahoe, Outside Lands and other non-frugal lifestyle expenses.
In this case an attacker isn't looking for a collision (which would mean creating two passwords with the same hash, and what hash that is doesn't matter).

The attacker needs a password with a specific hash, and the best reported attack for that is around 2^128.
Then we are better off driving for real because `not driving, meaning not being in control, but being ready to take the helm at any time` must be more exhausting (because you have to focus on everything not under your control vs focus on everything that you don't have control minus what you actually control) and increase our reaction time (since some time will pass between the moment you notice you have to take the helm and the moment when you actually are in control) than just driving.
That's gotta be a separate system which just reads data and displays it right?

right?
While the fitness community has already empirically identified that diet is 90% of success

Are there any papers / data-sets that demonstrate this? If so, could you share here or at my email (see profile)? Would be greatly appreciated it. It's been my hunch this is true, but haven't seen the evidence for it.
If you google the buyer's address, it's home to a package forwarding service. Do not ever do business with a buyer using such a service. 100% guarantee it's a scam.

https://www.google.com/maps/place/78+McCullough+Dr,+New+Cast...
Well, yeah. It's about AI because it's about cognition and the basis of self. Bit of a wider scope :p
Looks like the video was taken by a dash cam from a police car - am I reading that right?

If thats true I wonder why the cop didn't pull the uber over.

edit: This also leads to another question - how does a cop pull a self driving car over? Does the car know to respond to police lights? And if it does pull over then who does the cop talk to?
Introduction to the 8-Point Grid System
Why can't they just go with a year based version number like Ubuntu and Windows? $year.$month-$patch so LLVM 5.0 would be LLVM 17.09 (September 2017).
They probably didn't want to feed into Google's reputation for abandoning their stuff, so they kept the same name to make it seem like a continuation of the framework that's been around since 2010. It gives the illusion of stability, even though it's actually the opposite.

"How can you not choose Angular? It's backed by Google and it's been around longer than both Ember and React."
Been watching too many Muni busses.
libdivide (http://libdivide.com) implements similar logic at runtime
I find it telling that they do not actually say whether the car was in autonomous mode when it ran the red light, only that it was "due to human error". Was the human error that they didn't assume manual control and stop the car?
Erich Gamma (Gang of Four - Design patterns) is part of the team.
I'm sure they meant to say xenophobic.
I don't think that's true. You definitely don't need a private key, you create a symmetric key from whatever randomness source you have, held in memory while you are using it to encrypt the data. The first thing you do is encrypt the symmetric key with the public key, then the rest of the data is encrypted as you go using the symmetric key.

If you want to decrypt the data, you need the private key corresponding to the public key that this was encrypted with, but that can be left at home, but you never need it before that, so you can leave it at home if you want and you won't be able to access it until you get home.
Hi, yes I know backend development. I have worked with many databases such as Oracle, Netezza, DB2, MySQL. I have been working on hadoop ecosystem for massive data processing for last 3 years. It is just front-end development I never picked up.
This is really worrying for Uber. It's supposedly burning 2 billion dollars a year. It doesn't own any fleet of vehicles or it's drivers. Neither is there a sustainable cost savings that doesn't involve lighting pile of cash on fire. It desperately needs driverless cars before Tesla and Google kills their business off.

Now Uber has finally hit a regulatory wall which it won't be able to pay off. It's likely to hit more such obstacles until it realizes it's not really in the business of taxi but a business of acquiring market share with low interest rate capital.

We won't see an Uber IPO anytime soon.
I'm willing to accept that perhaps that was not how my account was compromised but the time frame when this happened was well in line for when this breach supposedly occurred.

Regardless, it was some sort of automated spam/phishing emails that were sent from Yahoo's network using my account to contacts on my list. I analyzed the headers of multiple bounced messages that were sent to email addresses no longer in use and confirmed the origin of the traffic.

I'm not going to fall for a phishing attack and I only access email from devices I personally control. Could one of them had some sort of malware infection? I guess it is possible but I am security conscious and it is highly unlikely. I also would expect a hacker that has compromised one of my devices would be far more interested in using my banking credentials than using my Yahoo account to send spam.
I just attempted to log in to an old @yahoo.com account that I haven't used in probably five years or more.

On the login screen, there was a short notice about this breach (with a link to more details), and after logging in I was prompted to create a new password, and update recovery emails / phone numbers.

That doesn't negate any of this shit that happened, obviously, but maybe they're at least gonna try to make things better (we can hope, anyways).
Well thank you for always being candid and honest with your feedback to us. We really rely on feedback from the community who is ultimately in charge of the direction of this incredibly humbling project.

This goes to more than just you, but please always feel welcome to reach out.
If it uses Uber drivers for training, heaven help us: I’ve seen illegal U-turns, constant double parking, reversing down 1-way streets, moving right turns through red lights, sudden stops, speeding 25+ mph over the legal limit, lane changes in intersections, lots of turning without signals, lack of proper yielding to obvious pedestrians, cyclists nearly side-swiped, etc. (Some subset of) Uber drivers are one of the worst hazards on the road.
Old as in "published in 1876". It's still widely used.

https://en.wikipedia.org/wiki/Parliamentary_authority
It was a taxi.
I have a giant folder hierarchy in my gmail, so I assure you this can work.

In your case it sounds like you're taking a message with the "Inbox" label and adding the "some/folder" label, which will indeed still show it in both places. If you move the message, which removes "Inbox" and adds "some/folder" it will no longer show up in the Inbox.
Thanks for sharing your numbers.

You must admit that $40k bonus after tax is a huge, atypical amount of money. It makes your effective yearly income to be about $156k.

It reminds me of the mrmoneymustache.com guy, saying "anyone can retire early! Just look at me, all I had to do was get $1M in stock from Cisco!"

No disrespect intended for you; I'm sure compared to some of your friends you lived frugally. The point I'm making is that to duplicate your living standard today, very few comparable developers would be able approach your level of savings.
> I hate that. I've actually put off doing breaking changes simply because I didn't want to bump the major version number

Get over it? It's a number. If you want to base it off a consistent semantic reasoning then do so. Otherwise don't do it at all.
The update reboot thing in win7 could at least be continuously postponed for 4 hours at a time, instead of 'now or in 15 minutes, that's it'. I'd also never come back to a update-force-rebooted PC on six years of win7, whereas I have several times in the 11 months I have had win10. Win10 is qualitatively worse in this area, even if the same tickbox exists on both versions.

Fair point on the theming, but the telemetry thing is much more pervasive in 10 than in 7.
It's a taxi, actually. I'm sure they were delighted to get this video.
It's not 100% clear from the article that the permit applied to Uber. And the incident in question of a car running a red light was apparently being driven by a human.

> "This vehicle was not part of the pilot and was not carrying customers. The driver involved has been suspended while we continue to investigate."

If their self-driving tech is still driver-assisted, then shouldn't Tesla cars also be ordered to stop driving? Or did Tesla also require a permit?

From the DMV legislation:

> (a) “Autonomous mode” means an autonomous vehicle, as defined by this article, that is
operated or driven without active physical control by a natural person sitting in the vehicle’s
driver’s seat. An autonomous vehicle is operating or driving in autonomous mode when it is
operated or driven with the autonomous technology engaged.

To me that sounds like it would cover what Tesla and Uber is doing if the driver is entirely hands-off. But this part is less clear:

> (b)(d) “Autonomous vehicle” means any vehicle equipped with technology that has the
capability of operating or driving the vehicle without the active physical control or monitoring of
a natural person, whether or not the technology is engaged, excluding vehicles equipped with one
or more systems that enhance safety or provide driver assistance but are not capable of driving or
operating the vehicle without the active physical control or monitoring of a natural person

https://www.dmv.ca.gov/portal/wcm/connect/211897ae-c58a-4f28...
IIRC some "wifi" SD cards run some form of linux, so it might be possible to hack in some encryption.
It's one way to do it, which is okay sometimes.

The other way is to add a new empty column for bcrypt. The next time the user logs in, you save the bcrypt hash and you remove the MD5 hash.

Over time, the active users will be migrated to the new scheme. The only issue is the abandoned accounts, they'll keep the old weak scheme.
I'm guessing it detected an @ symbol?
As usual in this industry there is a whole new generation of devs coming up that have forgotten stuff that has been standard for a long time. Then somebody implements this old stuff for the new tech and people think it's major innovation. I am sure soon somebody will create a node profiler.
Also, if you find a plugin or a loader who is struggling to support or catch up, just drop us a message on github or tweet me at @thelarkinn, and myself or one of the other maintainers will offer to help or take over the plugin. We have a whole contrib team dedicated to helping maintain our core org loaders and we are always wanting to keep the ecosystem strong and up to date.
I don't think Uber exemplifies any sort of anarchist culture except perhaps anarchocapitalism which is an instance of the red herring principle [1].

https://ncatlab.org/nlab/show/red+herring+principle
> Irrelevant. Cloud doesn't impact security.

I disagree. The larger the congregation of value by a single target, the higher value the target. Saying it doesn't impact security is like saying whether a building is a bank or a house doesn't impact security.

(It should also probably be noted that I assume the OP was referring to "cloud" as in centralized data services as opposed to "cloud" as in hosted servers/VMs)
The pedestrian was at fault for not installing Uber's app. This gives new meaning to the term "god mode"... "Install our app, or DIE!"