skysight-inc/HackerNews huggingface dataset:
> The obfuscation used in the russian PHP shells looked awfully familiar

I have seen similar obfusaction many times before. Generally most PHP backdoors look like eval($_POST['something']) and here eval is replaced with create_function (by the way I know several other functions that can be used instead of eval). This method of obfuscation (eval + gzip/base64_decode and other functions) is also sometimes used in legitimate scripts.
> we've got lots of tablets lying around and would hack it into plenty of different use cases if it were up and running.

Please stop using the word hack The word you are looking for is incorporate. It does not make you appear cool and cutting edge. In fact, it indicates the opposite.
A Message from RMS: Support the FSF
Instrumenting your Go app with Tgres
That the RNC was also hacked seems to be a popular, but probably false, meme.

http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hac...
What he's trying to imply is that the place people live is affected by more than simple economics. There are differing historical and cultural reasons why blacks and Asians might live in different cities, regardless of their economic power.

So controlling for their environment, Asians stand out less than they do just by looking at raw numbers. Compared to where they live, they stop outperforming whites, they just tend not to live in poor areas where whites also populate.
I'm sorry but NO DUH
Perhaps they made the right decision with int, short and long, but there's one case where they absolutely made the wrong decision: byte.

Having signed bytes is extremely obnoxious. Doing any sort of bit- flipping/shifting requires you to add a ton of "& 0xFF" operations that would be completely unnecessary if byte was unsigned. The main use case for bytes is to represent data, not integers and bytes shouldn't have been treated that way.
It has to be noted that Asian people still drastically out-earn black people and are roughly "equal" with white people by city. Really the data shows that discrimination is more anti-black than it is pro-white (I think it would be helpful if Hispanics could be stratified by generation).

It's also revealing of the author's personal biases that he considers living in expensive coastal cities to be a disadvantage. In nearly every other context it's considered an advantage, despite the cost of living; imported goods and travel are cheaper, and infrastructure is nicer. The education system also tends to be better in rich cities, although it is worse in California due to Proposition 13. Having tenure in growing cities (and therefore owning property) is also a significant advantage in terms of wealth. Someone who bought a $200,000 house in Indianapolis in 1980 is doing a lot worse than someone who bought a $200,000 house in LA in 1980.

Of course the really old money everywhere is dominated by white people, but most white people don't have access to that.
Has the Internet Killed Curly Quotes?
> He's starting something he won't be able to finish.

Pretty much every Presidency has some things started late that are known to carry over into the next administration; quite often (especially when there is a change of parties) this something the incoming President would have handled differently.

That's sort of inherent in the nature of having a crisp point-in-time transfer of power.
> The mistake in dismissing the thinking is in believing that complex problems are irreducible complex, they are not.

This is almost certainly false. Current state of the art in complexity theory is that some complex problems are irreducible. The expectation is that P != NP and that means there are irreducible problems. Assuming that P=NP is almost, but not quite, like assuming perpetual motion.
This game is one of my favorite classics.
Thats not what I was saying.

I was saying the fact that the living conditions are increasing in the developing world (which is a good thing) is a trivial fact. I.e. it's true and not really disputed.

What is more disputed is that it's also increasing for the developed world.

I hope that clears up any misunderstanding here.
American intelligence agencies were definitely involved in Russian election in 1996.

Also the link you posted shows the campaign manager connection to Yanukovich - since when is ex-president of Ukraine considered as "Russian officials"? Do you call ex-president of Canada or France - US Officials too?
The "evidence" boils down to:

The Hackers drove a truck.

Russians drive trucks.

The Russians did the hacking.

While its insulting that our government would try to pass off this drivel as "evidence", I'm much more dismayed that so many of my fellow Americans will uncritically accept it as such.
People aren't a commodity. Bread can't collectively bargain, improve it's own flavor to increase it's value, or start it's own granary. Comparing commodities to software engineers or what have you is be it's very nature an oversimplification and isn't very useful.
> It's easy and cheap to virtue-signal your care for this difficult problem, but the elephants in the room here are IQ and culture

I don't care about IQ, but supposedly you can't tell black people to just open a book (or two, or three) and to spend more time on studying because that's racist. It is their culture to sing and care only about Italian hyper-cars and jewels (we've come a long way since the days of Public Enemy) and that's about it. Doing anything else as a black person supposedly means that you're "acting white".
I don't have an exact idea of what my colleague is doing during boot, but it appears that he needs to press the button on every boot. I think (given his background) he'd have investigated the available options by now, but I don't know...
The amount of hype Rust is getting is not going to end well for Rust. This reminds me of Ruby during 2007-2010 where it went from Patron Saint to Scapegoat for every startup that failed using it. Ruby survived it, and I'm sure Rust will too, but that doesn't make it obnoxious for everyone else who inevitably gets swept up in the craze and crash.

Programming is hard. Programming will always be hard. Better/newer tools (and sometimes influences from the old finally making it mainstream, like Standard ML) make programming easier but not fool proof. It's misleading and harmful to hype the crap out of any language.

Unfortunately this stupidity is never going to end as long as language creators measure language success in adoption numbers and TIOBE scores rather than the warm fuzzy feeling of handling certain people's needs really, really well.
Not to be rude, but it's pique, not peak. Just thought you might want to know
I looked at a few.

"itoa" is clearly premature optimization. That uses an old hack appropriate to machines where integer divide was really expensive, like an Arduino-class CPU. It's unlikely to help much on anything with a modern divide unit.

"httpparse", "idna", "serde-json", and "inflate" should be made 100% safe - they all take external input, are used in web-facing programs, and are classic attack vectors.

Not much use of number-crunching libraries; that reflects what you do.

I'll look at some more later. How to deal effectively with incoming UTF-8, especially bad UTF-8, may need some thinking.
And, from most indications, incorrect. I think it's beat one C program on Alloth's benchmark game in processing time, but has been beat in the others.

It performs on par with C++, on the other hand, for what that's worth.
Could you elaborate? Once you have a password shouldn't it be as easy as just downloading all the emails? Any email client should have the functionality built in.

edit: seeing some reports they used "sophisticated" SQL injection... okay...I mean for a lay person it seems sophisticated, sure. But for anyone in the industry it's one of the oldest and easiest tricks in the book.

I really suspect news sources are knowingly exaggerating about the sophistication of this "hack" in order to make up-play Russia's role and downplay the DNC's culpability.
Not sure why marketing Rust implies that the community is trying to defend it. Honestly, I enjoy sharing with my experience with Rust because I personally enjoy writing in code with Rust and want to share that with others! Nobody is saying Rust is perfect or doesn't have tradeoffs.
I expect the rebuttal "Rust is Software's Doom" soon.
Really fascinating stuff. I guess an AGI has to skirt the boundary between the purely rational (i.e. evaluating statements of propositional logic), and irrational (i.e. intuition).
"there may be various HBAs, raid controllers, etc., in between ZFS and the actual disks."

Or in the case if EBS - NFS and a network stack. EBS is "Emulated Block Storage" despite what AWS may like you to think.
"If Microsoft forced either SmartScreen OR AppLocker"

Meh, just add a button or clickable link that allows the sysadmin to swiftly disable such warnings. Just make sure to put a scary-enough disclaimer that doing so can expose you to very bad, malicious stuff, from ill-intentioned people. It might get more application publishers to implement signing, just as Vista and 7 got rid of the "run everything as administrator" mentality through the use of UAC warnings.
That's a thing he did, how can it be seen as sabotage?
>I have seen similar obfusaction many times before.

If you look at it carefully you'll very quickly realize that you haven't. This isn't at all like your typical base64 silliness, and it's certainly very uncommon.

This actually uses a cookie to decrypt the encrypted shell before executing it. Pretty obvious, but very few things actually do it.
Sure but thats not what we are discussing here. We are discussing things in everyday live not mathematical complexity.

The claim was that the interesting problems are much more complex and thus can't be solved easily by machine learning.My point is that most of these complex problems aren't really anything but simpler problems gaining complexity by connection of simpler problems not by being irreducible.

Any engineer will tell you thats exactly how you solve complex problem, by breaking them into smaller ones.
Try out Proxmox (Debian). This works quite well for root ZFS
I think it is rather the problem of poorly designed software. It is impossible to make millions of users to set up some secure configuration, install firewalls etc.

The software should have secure default settings, if a user is not a computer engineer he should not be able to execute files from email attachments.
Yeah, you are completely right, and I completely agree, as I imply later in the post. Such mistakes are extremely common across the spectrum, at companies large and small alike (remember when American Express accidentally exposed an internal debugging application? [0] :O). Cybersecurity is still very difficult for everyone, and I don't mean to imply any differently.

My quip was meant to emphasize that the security breaches described are basic, and likely could've been blocked if the DNC had, at the time, been following good security practice. Many corporations withstand such attacks routinely (and as you note, many don't).

The penetration of the DNC was not something that required professional-level skill, let alone the resources of a nation-state.

[0] http://www.securityweek.com/amex-developers-leave-debug-tool...
Thanks for sharing. This is really helpful. Has anyone else done this before? If so, I would love to hear other methods.
A file with the following text would activate the rule:

<?php
='base'.(16*4).'_de'.'code'
(str_replace(
.substr(md5(strrev(
gzinflate
_COOKIE _COOKIE
isset isset isset
(additional text, such that the total filesize is between 20kb and 22kb)

Basically, in the filesize must be between 20bk and 22kb, all of the defined strings must be found, and the cookie and isset strings must occur exactly 2 and 3 times respectively.
Also the report doesn't say anything about not having your password literally be password!
http://www.sixthtone.com/news/china-says-no-%E2%80%98silent-...
http://www.forbes.com/sites/wadeshepard/2016/05/18/as-china-...
http://www.scmp.com/news/china/society/article/1952218/traff...

His facts all seem in order. In China, ebikes are unregulated but popular and there's a clear need to regulate e-bikes to ensure that they obey traffic laws. In the US, e-bikes are over-regulated and rare, but the laws aren't strictly enforced either. I think his point is that there's room for improvement in both cases, some form of happier middle ground, wherein (a) laws are sane and enforced (b) bikes are cheap and plentiful.

Also just the general complaint that Chinese tech is cheaper & better quality than American tech.
Yeah I also glanced at that earlier , but didn't read through it fully. This does seem to echo alot of the reasons why I don't follow through with things - ie. build too many features when I originally start off with 1 straigtforward goal. I think at this point, most of what's holding me back is psychological. I'm going to make a very strong attempt at figuring out how I can best focus on not act all ADD on my ideas.
I would agree with this. Several years ago we were averaging $50k/mo with me and one employee, and we are now bigger in terms of both revenue and people. However I consider myself a profitable bootstrapped startup, not a side project or anything of that nature.
It's hardly post-hoc. There was no evidence revealed in the emails that revealed anything more damning than that DWS, and the DNC, preferred Clinton (the Democrat) to Sanders (not a Democrat).

She stepped down early, and was replaced with DB, an even bigger Clinton fan.

By July 22nd, the entire party was in unity mode, and Sanders was actively being courted for his endorsement. DWS resigned as a sacrifice play.

As for the email question, it wasn't making an excuse for it, so much as it was pointing out it had no effect on the proceedings.

Either way, I believe this thread shows how little the DNC hack revealed.
Does it sync?
I appreciate your self-awareness that you may be "splitting hairs". That sort of nuance is unfortunately absent in the thread you kicked off.

I'm really lost as to how this all-out hatred of "mainstream" media started. But even more so I'm left wondering what kind of media these critics would appreciate? Infowars and Breitbart? <somename>.blogspot.com? Does anybody honestly believe they'd be better informed in a world without professional journalism? I'm not just talking about Trump vs. Clinton, but also "the town council's plans for xxx".

I mean, you see these comments glorifying "the press used to be", or saying the NYT "lost all credibility when they endorsed HC" which just leaves me wondering if they're just repeating their side's talking points or if public education has completely failed, possibly beyond the point of no return.
I'll take the bait, people have been doing that for thousands of years and call it prayer.
Is it really surprising that a Presidential election is a juicier press coverage topic than the Office of Personnel Management? The House released a comprehensive and scathing report on the OPM hack:

https://oversight.house.gov/wp-content/uploads/2016/09/The-O...

Countries gather intelligence about each other all the time, the interesting part of the hacks surrounding the elections is that the information was made public in an attempt to influence the results. If you recall form the 2008 election both the Obama and McCain campaigns were hacked by China, but it was a conventional information gathering operation. It was in the news, but fell off quickly because nothing was released to try and influence the election.
Can confirm. I did tech at the DNC in 2012. We pushed to get senior staff using 2FA and ran internal phishing drills. Obviously didn't take.
> It'll look a lot worse for him to do so.

Do you really think Donald Trump cares if it will look worse for him?
Sure, but not all languages are equally bad. Will Rust become dominant? Unlikely. Will Rust's popularity continue to grow? For the foreseeable future, I'd say yes, mostly based on its merits.
https://github.com/hackndev/zinc is one effort in that vein. I'm not sure what else exists though.
Both the FBI and CIA have publicly stated they believe the hacks came from Russia. Whether they'll release their evidence publicly remains to be seen, however, even GOP senators acknowledge it was likely Russia. We can assume they were briefed.
Option 1's problem is far less anyone in the new administration is in the pay of Russia, but that the GOP for more than a decade has been claiming government is totally incompetent, cannot be trusted to do anything, should not be trusted, and could not investigate itself. This is hardly any different than the surveillance state, creating that infrastructure puts it right into the hands of political adversaries when the political winds change, and now creating distrust in government generally rather than just political enemies means the distrust is inherited when political winds change. It's deeply damaging to have this concept of "saying things makes them true/untrue" rather than appeal to facts.
For me, it comes off as tremendously callous. Many billions of people still face issues of food, health, safety, security that even poor Americans/Europeans trivially avoid. But, "The real question is what do we do with the richest half billion?"
A Sad Announcement
Huh, that would raise the interesting question of whether it's also able to "fingerprint" individual spoken words if they're distinctive enough. Admittedly this is probablymaybeperhaps only happening while you're writing a status update, but even so it's not that unlikely that some words/brands could be recognizable.

After all, low-impact recognition of specific phrases is the core of a variety of things - "OK Google," "Hey Siri," "Hey Cortana"
> "We have some cleanup to do on the code before we’re ready to share the sample app"

Has this been shared now?
He asserted that, yes. He didn't really do much to explain his view, other than just repeating that it was "revenge" and "pique". Do you agree with his assessment, and can you provide reasoning for it?
No, I haven't done any skydiving. After writing my comment, I suspected my analogy might not hold up if I knew more about skydiving. I guess just imagine an abstract form of skydiving where you just need to have fun in the sky and then open your chute at the right altitude, and you'd like to wait as long as you can before opening it.

I still think the point is valid, though, even if the analogy isn't.
After perusing his Twitter I'd say he has escaped basic software development.
I think there should be a separate UI for installing or running a downloaded program (with a huge red warning) so the users cannot accidentally run anything.
See the world clearly part 1: business
You can read about the backdoors they used here:

https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

The summary: One used Powershell modules and Windows Scheduler to run scripts. Another used a combination of Twitter and public sites like Github/Dropbox for command and control.

In my opinion, neither is impressively sophisticated, and a skilled application developer could whip up something similar in a week or two. Using popular sites like Twitter/Dropbox for C&C has been common for years, and you can purchase similar backdoors/RATs for less than $100.

edit: Another interesting point from the link above: the two exploits stole exactly the same info once inside the DNC network. This would obviously be a big no-no for a sophisticated state actor as it doubles your chance of being compromised, but the author explains it away by claiming that Russia's intelligence agencies are disorganized and adversarial.
The thing you want to see Twitter improve or create in 2017? - Jack
How Does Your Kindergarten Classroom Affect Your Earnings?
Nice article! Good breath of fresh air from the fluffy blogs out there.
This report merely points the finger at Russia; it does not purport to substantiate that allegation.

Previous JARs have not attributed malicious cyber activity to specific
countries or threat actors. However, public attribution of these activities
to RIS is supported by technical indicators from the U.S. Intelligence
Community, DHS, FBI, the private sector, and other entities.

The report then discusses when the attackers did and mitigation strategies.
Rewriting TeX in Brianfuck would be masterful too. That doesn't make it a good idea.
I really want to love Rust, and while I understand the Rust borrow checker in theory, actually using it in practice has been a major headache. I tried Rust on a simple terminal-based project, and after a week of feeling that I was getting nowhere I switched to Go and had a proof of concept in several hours.

With that said, can you recommend a good source to really understand best practices and patterns for ownership and borrowing? I feel that's the biggest hurdle to using Rust (at least in my case).
There is also this, by the same author: https://www.washingtonpost.com/news/wonk/wp/2016/11/19/the-r...

Basically, when you control for education level, Asians come out just behind whites while black and Hispanic minorities still get shafted. And that this didn't used to be the case, that Asians used to have a similar gap, which indicates that Americans have simply gotten less racist towards them. Presumably on such a large scale there shouldn't be a significant discrepancy of income for the same level of education.
Does it load the doc with Javascript to a site? It seems like that because the page mentions an x number of requests and OAuth (that's bizarre, you have to sign in to view the website?).
Are you kidding? Getting the inside scoop on a very large chunk of the federal workforce has "nothing to do with the fundamentals of our democracy"? This is nothing short of an act of war. What do you think will happen to the US if suddenly a large number of people in the federal workforce wake up to no money in the bank? Do you think the government will be able to respond effectively to whatever crisis (likely involving China) is going on?

If you have some evidence that Obama did something then present it. If not, just wishful thinking.
I disagree. Popularity is everything. Grab the developers you can get first. Once you have a popular language with ready-to-be-hired developers big hardware companies will be far more willing to entertain using the language.

When choosing languages people look at community, libraries, existing in-house expertise and availability of programmers. All these require popularity.
Belief in this will likely depend on who someone trusts more, spokespersons for the RNC, or the New York Times and the Washington Post.
Best Glowing 1000 Degree Knife Compilation 2016 – 2017
> Really the data shows that discrimination is more anti-black than it is pro-white

Or it shows that there is something about the statistically average black person that makes them less successful than the statistically average asian person. I don't claim to know what the difference is, but this is a fairly obvious inference to make. I'd actually say this is, a priori, a lot more likely than "everyone coincidentally discriminates against these particular racial groups but not any of these other ones".

My suspicion (not based on any hard evidence) is that much of this difference is accounted for by the vast and obvious cultural differences between the average asian person in the US and the average black person in the US. Most Asian (South or East) immigrant cultures in the US aggressively push for educational and professional success. Black culture in the US doesn't.
If you charge $150/hr and work a 2 week blitz for 100 hours/week.

It's possible.
Basically you're embedding Google Docs in webpages, but in a more fancy way with Javascript?
looks up at banner to realize parent is fine