skysight-inc/HackerNews huggingface dataset:
Well, I agree that AV most likely wouldn't protect you against targeted attacks - but most of the attacks that we investigated were targeted quite broadly - phishing email campaigns targeting financial organizations (with address lists based on some hacked legitimate resources for accountants, for example).
And usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine), and lack of AV software.
So to do that it's going to stop the users browsing session, redirect them to a local web page and then present something to let them make a decision about carrying on? not the best user experience in the world..

But remember like I said that's just one example of why it's a bad idea, there's others, e.g. what do you do about EV-SSL certificates? You can't fake the browser element for them (remember this is the case where the A-V product hasn't hooked the browser), so where you want to MITM a EV-SSL connection you have to downgrade it to Non-EV.

Also what do you do with certificate pinning (either browser in-built or HPKP headers?)
Wow, the "Stamper" by Matthew Richardson is still running!
http://www.itconsult.co.uk/stamper/stampinf.htm
This is pretty close to what you need. Getting an email with SHA256's of an archive of scrapes signed would do the trick.
The US Navy plans to fire laser weapons off of ships within a year
Not the GP, but it looks like significant number of Android vulnerabilities [1] are local privilege escalation (as in: install an app from a questionable source, app use vulnerability to silently gain root, app siphons off your data and/or wrecks havoc on the phone).

Hefty fraction of local privilege escalation vulnerabilities are in the Linux kernel, and pretty much every single Android device out there ships with its own, unique, outdated out-of-tree kernel with dependencies on a number of version-specific binary-only blobs. End result of all that is - even if underlying vulnerability is fixed in mainline kernel, phone's vendor still needs to repeat this exercise for each and every phone. Moreover, because of binary blobs, phone vendor oftentimes has to contact their SoC vendor, SoC vendor has to contact the vendor for that IP block they've shipped binary blob for, etc... All this process is extremely fragile, costly, and lengthy. Not exactly something you want to have in place for security updates. Google somehow manages to do half-decent job updating their Nexus/Pixel phones for few years after hardware hitting the market. Most other vendors drop the ball to some degree here, often completely.

Replicant took on a Sisyphean task of enabling blob-free (a.k.a. 100% free and open-source) firmware to some Android devices. Among other things, this could eventually enable one to use mainline kernel and do security updates much more quickly and efficiently.

Current status however is far from that ideal. Latest "stable" Replicant (4.2) uses various versions of 5-year-old kernel 3.0.x branch [2,3], and didn't achieve fully blob-free status either. That said, you can run blob-free, as long as you can do without 3D, WiFi, bluetooth, hardware-accelerated video and (depending on the hardware) without camera, GPS and NFC too [4].

[1] https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

[2] https://git.replicant.us/replicant/kernel_samsung_smdk4412/b...

[3] https://git.replicant.us/replicant/kernel_samsung_espresso10...

[4] http://redmine.replicant.us/projects/replicant/wiki/Replican...
What does Bitcoin have to do with this? That seems like abuse of its blockchain.
Anti-virus software is an anti-pattern in general. Having more bugs and backdoors than the rest of the applications combined. I havent been using anti-virus for the last 5-10 years I have just a simple rule set for using internet and it proved to be sufficient for me. However, I have many friends with anti-virus softwares and they still got viruses on their systems. I guess this is anecdotal evidence but I would like to see a comprehensive study on how effective anti-virus systems are.

https://googleprojectzero.blogspot.hu/2016/06/how-to-comprom...
This is the first time in my life that I don't feel safe in my own country. There is literally no difference between me (someone born in the US whose parents came here from Iran in the 90s), and people my age living in Iran right now who want to come to the US for a better education.
So a draft standard that's implemented in the current beta (alpha?) versions of Chrome and Firefox. So the end for the hack is nigh ... in about 5 years, I guess.
That's not how Security works at all. Its not about adding layers of security. That would imply installing 10 AntiVirus would be even better. But instead you're just increasing the attack surface, and slow your system down.
Could we have this 3d in the downloadable binary?
Thanks! I took a look at the Wiki page https://en.wikipedia.org/wiki/Curry%E2%80%93Howard_correspon... but didn't see any Deltas there.
Luxbar: Featherweight, Responsive, CSS Only Navigation Bar
Run webrecorder yourself, MITM yourself, tamper however you like. Verifiability depends on a trusted authority first.
Marketing and ads companies?!
The yamanote line usually has seats during the day after peak hours but many other likes stay relatively packed even during the day lIke the chuosen.
It's unclear what Trump is trying to accomplish here. It seems stupid and I feel bad for the people whose lives it diverts or puts in hold. But the Nazi comparison either trivializes the Holocaust or unfairly hitlerizes Donald Trump for what may be a legitimate concern over technology transfer to a country that actively opposes US interests. There are plenty of countries that suspend student visas without going on to murder millions of people, and indeed we did exactly that under Jimmy Carter for much longer than thirty days. Standing up for students and education and science is an important duty for a professor, and I hope he'll continue with it, but this kind of hyperbole doesn't seem helpful.
Windows 8/10 with the MS built-in protection or Linux + clamav

Sometimes I used CClenaer and/or Spybot to deal with something really nasty, but the MS stuff really does a good job (Someone checked if the hell is frozen now ?)
Do you have a citation for your assertions - perhaps one with more specifics than unnamed "toxins"?
A Bad Day for the Environment, with Many More to Come
If you want to know more about the creators of these viruses I'd highly suggest reading Krebs on Security [1] as he often not only covers the viruses but also some of the authors.

[1]: http://krebsonsecurity.com/
> We will continue to do everything we can to fight this policy and others like it.

You say that, but I'm afraid the implication might be "short of doing anything that matters". Where are the protests? Why aren't people in the streets? Don't make the same mistake Germans did under Hitler. The government relies on each step affecting few enough people that nobody will be bothered enough to march, and after a thousand little steps, you have a totalitarian government.
"Thursday's unscheduled update effectively blocks highly sensitive secure sockets layer (SSL) certificates covering 45 domains that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India. That's an intermediate certificate authority (CA) whose certificates were automatically trusted by all supported versions of Windows"

I'd argue that's a problem in CA trust model, not MS. If you trust a certain CA, of course you trust their issued certificates by design. Currently, if some high tier CA f*cks up, there's no other way to invalidate their issued certificates than propagating CRLs and removing its certificate from the root CA stores manually (or by updates, as in MS case).
Of course there are lots of what-ifs, but how do you tamper with HTTPS traffic if you don't MITM?
Ask HN: Revenue possibility from Chatbots
Let me start this on very simple note which is - there is no defined way to make money out of anything new (Chatbots are relatively new space), so the only thing is to try and experiment with couple of good ideas on making money from Chatbots.

Advertisement is obviously not the only way of earning money in the chat bot space. There are multiple other ways like — affiliate marketing, cross-selling, up-selling, etc. I believe that these channels too will help developers sustain their development efforts and build great products on chat bots.

I have few things in my mind which I would like to share on how Chatbots will help serving the needs of people and thereby making room for other services to loop in and charge for their services.

Just to give an idea, if a bot helps you on how to do your simple daily tasks like sending mails, then bot can also tell you that - hey, many other people are using this gmail service, would you like to use it?

So this way, it will behave like a personal opinion for end user which he might opt for, if information by Chatbot is good enough for him.

Now, you can think of more ideas on how to add more services to Chatbots which are not necessarily chat intensive initially (like simple tasks via account linking etc.) but will become chat intensive later on when bots could have personal opinions about the service/product when more people start using services on bots.

I would also like to mention that ChatterOn platform has started givings advertisement on messenger bots ,which might be a good start on monetization but certainly not future.
Not only a compromise of practicality. Mob rule and dictatorship of the majority are not pretty.
Supposedly Ford even did that to a recent version of their F-series.
Given how they often MITM the connection they would be able to do things like reorder Google search results. This would be a huge revenue stream. Can also sell browsing data to advertisers to target specific people.
Interestingly, searching HN comments for http://lmgtfy.com
returns only 420 results

https://hn.algolia.com/?query=http:%2F%2Flmgtfy.com&sort=byP...
I think that TFA is underplaying the cost of setting up CI/CD pipelines with any manual review step, as well as simply orchestrating application/service settings between micro services.

Docker and docker tooling in the big clouds has come a long way, but are isolated to that cloud platform. Docker Cloud, imho is one of the nicer options, that allows for multi-cloud and on-prem deployments, but even then doesn't take care of a few issues.

In my mind, there are several things that are needed for a successful microservice stack, beyond the micro services themselves.

PKI - some means of having a microservice deployment
request it's own private key cert securely. Not
embedded in the deployment asset. Inter-service
api requests using signed jwt including a request id
not to be reused.

Configuration - environment configuration, A/B testing,
and other services in the system. This may need a
service registry (maybe backed by etcd or similar).

In-memory cache - something like Redis/memcache on each
node for local caching of near-term data (IP request
counts, error counts, other memory cache)

Persistent cache - kv store backed by db for cached
records that exceed memory, but can avoid more costly
lookups. C*, RethinkDB, Mongo may be good choices
here.

Authentication service... something to manage user
auth separately from the apps/services and act as
an SSO end point. OAuth/jwt, etc.

Auto-updating load balancer... blue/green deploy
process combined with a load balancer that will detect
changes and upate itself.

Just getting those details right... not counting other application databases, and the ci/cd is huge. It starts with a secure means of getting one's security context, using that to request other configurations/services to communicate with (not discounting dns-based structures), having those services available to authenticate users, and the ability to securely make requests.

None of the options offers all of this in the box, there are parts, and depending on where/how you deploy this is complex to very complex in terms of getting these underpinnings in place.
I'd like to agree. But I can't. Even if disregard detection scores, Defender/Security Essentials is slow. It uses humongous amounts of CPU time, which slows down slower PCs (like Celeron N3150) a lot. It also tends to saturate disk I/O.

In short: It sucks so bad it's virtually unusable.
Where do I start...Right now at work one problem is: How to quickly and accurately gauge if a job applicant is a fast learner. A solution that included how fast of a learner compared to other applicants, and if possible compared to a broader population too.

Being a fast learner is not the only hiring criteria obviously, but many roles really do need it. Also, while I respect those students who may not be a fast learner but work harder and longer to make up for it - totally commendable and very relevant in school - however once in the workplace some jobs just don't have that extra time.

I could see it having other uses outside the workplace, likewise this might be topic specific eg some people pick up languages very fast (still, a tool for anyone to gauge how quickly it will take them to learn a new language could be helpful before getting fully into it).

Apologies if this exists. If so, please let me know. If not, I know this is a problem many hiring managers have and I think a solution is feasible.I would be willing to pay for it if it does exist. Btw happy to complain more if you're still looking for problems ;)
It's a pretty standard journalistic anecdote to focus the narrative of the story. If you want the hard data, read the medical literature. He does refer abstractly to studies, but doesn't provide any links (though again, unfortunately, this is pretty standard).
If local production capacity is too low, why not import them?
Not all controllers run on batteries. You can get wired Xbox controllers for example.
Sounds like the 21700's have 50% more volume, likely slightly less than 50% more energy, but lower peak power output because of heat issues caused by a higher volume to surface ratio.

Telsa seems to be selling the new battery factory as a prerequisite for the model 3. Both for the volume of batteries and the cost.

However the model 3 is smaller, less air drag, less rolling resistance, weighs substantially less, and (from what little telsa has said) will be much slower to accelerate.

The 21700s should be cheaper to build a battery pack out of, less temp sensors, less connections, less monitoring circuits, and less labor.

So maybe the 21700 based battery packs will be used across the different teslas and provide the cheapest way to hit a given range. Then the 18650 based packs (that can deliver a high peak power because of better cooling) will be more expensive, but provide better 0-60 times.
That's not what he said, though.

Here's what he did say (his full post is here [1], if anyone's curious), which I think indicate culture, area, and distance from where he considers home as the factors affecting his health:

But what I've realized is that the last few years of living in such a singular environment have taken a huge toll on my life and started affecting my health. My friends, what I consider to be my home, and my life are back in Silicon Valley, which is also much closer to my family. Seeing how much I've left behind these past few years, it is clear to me that the time has come to return.

Specifics or misquotes aside, if you meant that the offer from Facebook was his primary reason for leaving, I can see that too, so won't disagree with the notion.

[1] https://www.facebook.com/hbarra76/posts/10154010035641612
I like to throw in the first chapter of "Statistical Inference for everyone" for a little bit more explanation for these rules (https://github.com/bblais/Statistical-Inference-for-Everyone).

It looks to me like an easier approach to the heavy weight "Probability Theory: The Logic of Science" by E.T. Jaynes
A whole country a cancer to humanity?

I suspect this sort of generalization is what caused the student visa problem in the first place.
Hi everyone! I'm the developer of the Freeciv-web WebGL version. I'm very interested in hearing your feedback on this version, so I can improve it. I'm always interested in hearing what you think is the most important thing to improve in the game. (I'm so happy my side-project has reached the frontpage of HN again :)

It is using the Three.js 3D engine. Currently it works nicely on modern computers and laptops with decent 3D hardware, and there could be some issues on some mobile devices. For example, old iPhone devices have very poor 3D hardware.

This is an open source project, so we're always looking for developers to help improve the game: https://github.com/freeciv/freeciv-web/
I use wired Xbox controllers on pc.
The first thing you should do with a PC is to delete all partitions and install a fresh OS. Even if you aren't installing Linux, you should download untampered Windows 10 (the same edition that the PC came licensed for) from Microsoft and do a fresh install without OEMware.
Running the benchmark in the game settings, I got these results on my wholly-unsuitable-for-any-gaming 2012 Retina MacBook Pro (GeForce GT 650M).

Highest Gfx settings (default). 2800x1700px window. Best out of 2 runs:

Chrome 56: 33 fps

Safari 10.0.3: 29 fps

Firefox 51: 13 fps
What's wrong with avoiding Microsoft anti-virus, too? Or os he giving this advice only because most people can't disable Microsoft's antivirus anymore, anyway?
> Try getting high on protein or fat though.

Just give me a really juicy steak and I'll show you how to do that.
> "We are living in humbling times. People are humbled all over the place. Lately it’s pro forma (...) for politicians, athletes, celebrities and other public figures to be vocally and vigorously humbled by every honor awarded, prize won, job offered, record broken, pound lost, shout-out received, “like” copped and thumb upped.

Everything that becomes a commonplace looses it's strength. Be it "honored", "humble", "didn't expect", "didn't think I would deserve it" and so on.
I have the impression (maybe mistaken) that the scriptable module story in apache is much more mature than with nginx. Apache has had mod_python, mod_php, mod_perl, mod_lua, etc for ages. If you're using nginx, then you're most likely proxying to a backend. I've used mod_lua and apache for an application server and infrastructure tasks to great effect. This is anecdotal of course.
I see the article talking about a „interpersonal variability in post-meal glucose levels“.

But there is no mention of the parent-comments main point „When I eat carbs, I put on weight“ .... which might be an indirect effect of a higher blood glucose level (more hungry) ...but definitely not a direct effect.
It's cute signaling. It won't happen. Even if it would, he'd settle in nicely into his new professorship at Technion.
"This time, it’s taken just five days, since the hostile takeover of the US by its worst elements"

Really? This is they way you see it?
Handy WordPress shortcodes – a few prebuilt shortcodes that may be of some use
I can't speak for anyone else but in my case, an excess of calories usually results in me being an awful lot hotter as my body burns off the extra energy. I'm not a biologist but I was under the impression that a release of insulin was required to store excess energy as fat? That would suggest it's more related to blood sugar spikes than actual energy consumed.
> But the Nazi comparison either trivializes the Holocaust or unfairly hitlerizes Donald Trump for what may be a legitimate concern over technology transfer to a country that actively opposes US interests.

It does neither. Warning that "that's how Germany started" doesn't mean that banning visas is as severe as burning people, or saying that trump will burn people. It means that one should be careful because these are warning signs, and one should act cautiously and nip them in the bud.

You don't see doctors saying "you probably have a cold, but it might be pneumonia, but I won't prescribe strong medication because that will trivialize pneumonia or unfairly characterize your cold". Just be careful with what's going on, and protest all these changes that bode ill in addition to writing blog posts.
Map of metabolic pathways and cellular, molecular processes
Sorry, I had to restart the server. Too much traffic! It is back now.
Bangalore like you've never seen before.#BlackOutBangalore
Hashing algorithms have historically been mostly obscurity. It turns out we're really good at coming up with functions we think are one way and later find aren't.

MD4 and SHA0 were both once believed to be good...
"usually these attack succeeded because of insecure infrastructure, poorly trained admins, old, non-updating systems (some people still think using Windows XP on internet-connected computers is fine)"

In this case, there are much bigger problems than the lack of AV.
Ask HN: Is there any GitHub based/supporting gamification service out there?
Such service should have daily, weekly, monthly quests. Some kind of achievement tracking would be nice. Github commit streak counter was funny to check every once in a while but now it's lost too.

Disclaimer: I asked it only for personal use. I strongly discourage using such services at the work place.
This is not really possible at the moment. This 3D version is using WebGL in Javascript running as a web-application, while the downloadable binary is implemented in C.
Compromising TLS is an infection vector. People regularly download programs from trusted websites and run them. Some apps automatically download updates from the vendor's site via TLS.

AV scanners do not have a 100% detection rate. Letting malware be where a trusted program is expected is how you get infected.
3 Ways Creative Designer Can Teach the Ethics of Party Decoration
> Even if you were right, you'd save a hundred times more people by advocating for better road safety.

Just curious, what's that assertion based on?
Relevant comic: http://highexistence.com/amusing-ourselves-to-death-huxley-v...
Best Rap, Dubstep, Hip Hop, House Music Making Software Download 2017
No, you don't have to sign up. Accounts is just for persistent savegames.
I explicitly mentioned Gogland (the Jetbrains IDE).
I'm not a fan of heavyweight editors (including emacs), and I'd gladly just use vim for Go if vim-go had refactoring support beyond the useless gorename.

Gofmt works nicely across the board, but godef needs your entire package to compile as far as I remember. Neither of them gives you refactoring support, and gorename doesn't give you much either.

You seem to think godef/gofmt is enough which is fine, but in this case Scala has the same level of support as Go.
I've written and talked about this a couple of times. Each and every one of these products does some kind of TLS security degredation:

* https://blog.hboeck.de/archives/869-How-Kaspersky-makes-you-...

* https://media.ccc.de/v/camp2015-6833-tls_interception_consid...
US has become a “flawed democracy”
I think there's a bit of a resurgence in recognizing that sometimes functional patterns work better. That doesn't mean excluding objects/classes but recognizing that some bits of control flow are often much easier to understand with functional approaches over class-based events.

Not everything works well in an MV* pattern, and it can often lead to complexities that outweigh doing things the "hard" way, or even having a single state tree. Redux in particular distills this very well imho.

That said, classes do well to encapsulate localized state. There's really room for both, and even in the same application. I think it's nice to see the discussion and options opening up.
aww, you think your GT650M is unsuitable for gaming? you should try my for-development-only first gen core i7 (920!) with a GEFORCE GTX 275 ;P

I can still play Team Fortress 2 at 1080p just fine on this tho ;)
Correction: It's .doc files I've seen the majority of this behaviour in.