skysight-inc/HackerNews huggingface dataset:
If the flattening a list is taken seriously, then it might. Or it might not. Taking the exercise seriously might be a better gauge of a person's long term professional potential than if that person treats the question as frivolous because there is a whole lot of things like testing and error handling and refactoring that might be discarded by a programmer who treats their craft frivolously.
Damn that didn't take long to go from $100K to carry out this attack to a single day to offer a website for SHA1 collision as a service...
Does anyone with a strong understanding of internetworking, peering and transit not see the difference between QOS for technical reasons and things like zero rating?

It seems a lot of people are invested in muddying the difference.
I think the difference is just in status: being an excellent chess player gets you respect from a more respectable-looking crowd than being excellent at Street Fighter. Neither gets you quite as much widespread adulation as being good at golf or Formula 1 car driving, while both get you more than being good at Candy Crush. But ultimately they're all just games.
> The problem is what it does to YouTube's competitors: they now suffer because YT can afford to ask T-Mobile to make their traffic more important.

But simply by virtue of YouTube's market share, an economic incentive exists to install backbone links that help route YouTube's traffic (as opposed to others'). In other words, if two backbone links might be installed, the one whose outcome makes access to Youtube more reliable is more likely to be installed than one that makes unknown startup's service more reliable.

In other words, network topology adapts to traffic demand (albeit more slowly than traffic shaping).
Yeah, I think that's pretty much the case. The first 320 bytes of the two PDFs released by Google result in the same SHA-1 state. Once you're at that point as long as you append identical data to each of the files you're going to get identical hashes. This is just taking those same 320 bytes and appending the combined images of your choice.

edit: as versteegen points out it's 320 bytes, not 304.
Totally off topic - why does O2 UK block this without adult verification?

On mobile so cannot read article
I thought Steve wanted to put a "dent" in the universe. Not a "ding".
It seems so. I can add the same arbitrary data at the end of two pdfs generated by this tool, and they are still a collision. I didn't know SHA-1 is so susceptible to length extension. Is there no internal state in the algorithm that would be different even if the hash output is identical?
Why 4 and not 2 (512/256)?
Backbone capacity is a separate issue from last-mile connectivity. Only one is truly a natural monopoly.

I don't care whether YouTube directly builds out backbone capacity or whether they outsource that to Level 3.

Incumbent last-mile providers enjoy a privileged position that gives them unfair bargaining power over end users. They should not be allowed to decide which content providers and applications get to have a successful business model. If anybody gets to pick winners and losers like that, it should be a democratically elected government, but it would be far better to just prohibit last-mile providers from imposing unfair artificial limits or costs.

If T-Mobile wants to make a deal with YouTube to provide a subsidized video streaming service with dedicated bandwidth to guarantee a certain level of video quality, then that service should be billed and provisioned separately from their common-carrier Internet and phone services. If they want this YouTube streaming service to be wireless, then they should have to acquire a separate spectrum license from the FCC and convince the FCC why a dedicated YouTube service deserves a slice of the public's limited RF spectrum when there are other video providers on the public Internet that would be disadvantaged.
Cool, thanks for the info!
How is the Amazon affiliate commission compared to other online affiliate ecommerce websites?
Fasting Diet Promotes Ngn3-Driven Β-Cell Regeneration to Reverse Diabetes
Holy pasted press release, Batman.
We need to switch dump pipes to be dumb content-addressable p2p pipes with maidsafe, ipfs, dat, or anything like that, and most problems that CDNs are trying to solve would disapear.
Can Calvin scale beyond the OP claim?

I've personally seen a Cassandra ring go to more than 2M ops/sec.
Related: my immediate thought was that this totally ignores basic aesthetics and readability. This is partly a matter of taste, but to say that the only virtue of Markdown is popularity ignores why Markdown became so popular, when ReST, Textile, and others were varyingly widespread in all of Markdown's current niches before Markdown existed. Markdown was designed above all to be pleasant to write and read in the common case of relatively simple structure and markup, and it mostly succeeds. This is a huge advantage in practice.
I think it is worth noting that the quotes in your comment are from 12 years ago: http://www.gelato.unsw.edu.au/archives/git/0504/0885.html

I don't mean this to say that you are being inaccurate, just that his current position seems a little different now:

"Again, I'm not arguing that people shouldn't work on extending git to
a new (and bigger) hash. I think that's a no-brainer, and we do want
to have a path to eventually move towards SHA3-256 or whatever"
http://marc.info/?l=git&m=148787457024610&w=2
The price good people pay for indifference to public affairs (ie populism, corruption and Electoral College ineptitude) is to be ruled by evil simians.

-Plato
That's terrible... he may as well say "As a representative of the company, I want it to be made clear that I don't treat security seriously".

In trying to downplay it, he's making the matter even worse.
Sure but Street Fighter is a very specific type of game.

Take something like Civilization that requires tons of research, planning and critical thinking. Those types of skills are more applicable to other things outside of the game.
All Nearshoring Is Not Created Equal: Buyer Beware
> intellectually lazy

EXACTLY! It's so easy to use "I want to be neutral" as an excuse for not weighing the evidence.

Thank you for saying that!
Well, the answer for an array of all negative numbers is to choose no elements, or if you must choose one, to choose the maximum single element. But presumably you solve it with the normal algorithm but with one level of look-behind. Something like,

function maxsum(arr)
local max2 = function(a, b) if a > b then return a else return b end end
local max3 =
function(a, b, c)
if a > b and a > c then return a
elseif b > c then return b
else return c end end
local best = 0
local best_here = 0
local i = 2
while i <= table.maxn(arr) do
best_here = max3(0, best_here + arr[i], best_here + arr[i-1])
best = max2(best, best_here)
if arr[i] > arr[i-1] then i = i + 2 else i = i + 1 end
end
return best
end

print(maxsum{1, -1, 2, -2, 3, -3, -4, 4, -5})

Assuming this algorithm is correct (it worked for my couple of test cases), the main trickiness is that you have to skip two elements if you choose the current one, to make sure that you don't double-choose.
Do you know what Apple is using it for, and at what scale?
> This is an unnecessary step, and is highly over-rated

Given the volume of traffic HN sees, and given their desire to not be DDoS'ed, it seems to be a necessary step, that is not over-rated.

To be clear, you'd see similar results with any CDN sitting in front of HN... The benefits really start to show (from an end-user's perspective) when you're on poor connections or are far away from their (HN's, in this case) server/cluster. HN sees immediate benefits for the things above, plus it saves them a lot of bandwidth.
I suspect that their phone recovery service's capacity is overloaded right now with everybody else trying the same thing.
Interesting. When the guy ringing up the order at Microcenter mentioned that they price match Amazon, I felt stupid even checking the price on my phone, but sure enough it was $20 more.

I hadn't thought it possible that Amazon could sustain that large a price premium on a relatively hot item. I suppose this bias is why Amazon could get away with it.

On the other hand, Microcenter might be selling it at cost to provoke exactly the reaction that I had (telling others about it).
Yes, for purposes of issuing certificates I'm sure they are OK wrt auditing (I was just establishing my "credentials" with the CA comment).

The threat models targeting anti-Google malicious actions obviously worked since they have traces of the Otto guy's activities. What I am asserting is that these forensics logs they use as evidence can be attacked in court as not being sufficiently protected from tampering by an internal Google party interested in fabricating evidence.
agreed. being excluded from one is also different from being excluded from all.

there's also 6+ other news organizations in there -- not all trump friendly. I just don't see how CNN being excluded equates to the end of freedom of the press. The reach of those included is far greater than those explicitly excluded.
If the person flattens a list with the:

Google
Copy
Paste

Algorithm, are they a programmer? Are they more or less of a programmer if instead they use racket or clojure's built-in =flatten=?
Yes. Humans.
FCC to halt rule that protects your private data from security breaches
Thanks for that link. https://lists.opensource.org/pipermail/license-review/2012-J... provided more details.

Has the Open Source Initiative otherwise tried to find a solution such that software works of the United States government would have a clean path to be compatible with Open Source?

CC0 may be better if you are looking for international agreement, though it seems like the patent related clause resulted in the review by opensource.org to be abandoned.

"CC0 was not explicitly rejected, but the License Review Committee was unable to reach consensus that it should be approved, and Creative Commons eventually withdrew the application. The most serious of the concerns raised had to do with the effects of clause 4(a), which reads: "No ... patent rights held by Affirmer are waived, abandoned, surrendered, licensed or otherwise affected by this document.". While many open source licenses simply do not mention patents, it is exceedingly rare for open source licenses to explicitly disclaim any conveyance of patent rights, and the Committee felt that approving such a license would set a dangerous precedent, and possibly even weaken patent infringement defenses available to users of software released under CC0."
https://opensource.org/faq#cc-zero
I didn't get a chance to make this point in that other thread, because the thread [1] of its follow-ups quickly morphed from promising [2] to meandering, but the combination of lax formats (PDF and JPEG in this instance) makes this style of collision particularly reductive, and in a sense, a cheapshot, if still devastatingly damaging given both PDF's and JPEG's ubiquity -- both separately and together -- in document storage and archival.

This shows the importance of techniques like canonicalization and determinism, which ensure that given a particular knowledge set, that result could only have been arrived at given exactly one input. For general-purpose programming languages like PostScript, of which PDF is a subset, this is essentially an unfulfillable requirement, as any number of input "source code" can produce observationally "same" results. Constrained formats, and formats where the set of 'essential information' can be canonicalized into a particular representation should be the norm, rather than the exotic exception, especially in situations where minute inessential differences can be cascaded to drastically alter the result.

[1] https://news.ycombinator.com/item?id=13715761
[2] https://news.ycombinator.com/item?id=13718772
Probably. I shouldn't stick my nose in a subject I have no business to comment on. I'll keep on programming. :)
That's a good start but looking up discrete facts is far less useful that looking up deep answers or articles about very specific subjects. I wish Google taught that.
You can't get Fibre in your part of SF?
It's needed because CDNs are presently 'protection rackets' for the Internet.

Instead of having a mechanism by which a website under attack (or simply un-monitored heavy load) from a host or number of hosts can direct the ISPs of those hosts to not send it traffic the CDNs instead use the present lopsided nature of peering agreements to simply sink the hits.

In the above mentioned solution either the direct ISP would filter out the requests before they hit a higher tier ISP/backbone, or an ISP that does not provide said filtering would (possibly blacklisting the entire client ISP for sufficient bad behavior).
The profit margin on this has to be bonkers. Maybe not on the first one, but now that they've got the process down? Yikes.
My Namecheap hosting is incredibly cheap, their support is decent, and it's pretty sweet to have my domains and sites all on the same account.
We don't use the L word in polite company anymore - they're called "alternate facts" now.
I genuinely believe that we are entering the "disinformation age".
> To those so-called "IA" people who don't understand that open source software is a key aspect of software development today: welcome to the 21st century, perhaps you'd like to try living here.

For good talent, it's easier just to leave, get paid more, have a better life, than spend your work life arguing with irrational sandbaggers.
> In other words, network topology adapts to traffic demand (albeit more slowly than traffic shaping).

A fair traffic management policy would allow for YouTube users to consume bandwidth in exact proportion to their share of overall demand for bandwidth. Traffic shaping on top of that could only have the effect of meaning that a YouTube user will get more bandwidth than their Netflix-using neighbor even if they're both paying for the same service and both content providers have CDN nodes at the same local peering point. That's not adapting to demand, that's artificially distorting the market.
>I've started ordering two (or more) of everything I buy from Aliexpress

I ordered 2x the batch of an item (which was low enough cost that even though I only needed a few it was worth paying for several more) from eBay once in order to try and decrease the risk of loss in transit and also because I figured that even if both batches turn up eventually, one would arrive before the other. Even though it was two separate sellers, it turned out that the originating address was the same and they did combined shipping of the order so I got all of them together and at the same time. Now I had ordered these items well in advance of the latest date at which I would require them but still, having them combined, I felt a bit... cheated. What has been your experience in this on Ali? Do you frequently get the items shipped together?
These days, you can not have Pub Quizes with at least a few teams cheating by using a phone to Google the answers. Knowing trivia of the top of your head seems to have become as useful a skill as calligraphy.

A friend of mine was about to fall for a hoax/scam. And even though they changed the words and meaning of quite a few elements, I was able to pinpoint the exact scam using carefully crafted Google queries.

With Google there is just no way to bullshit people anymore. Someone would tell a strong story in the 90s during a birthday, and you'd have to go to library the next day to verify or discard it. Not anymore.

Someone asked why those old modems made noise, and instead of giving an answer right away, it took all of 15 seconds to find the answer online, much better than I ever could answer it.

I remember my first job skill test. It was multiple choice and you were allowed to use the internet. I answered all questions by Googling keywords from the question, in combination with keywords from each answer, and looking which combination gave the most results. Answering this way I got a near perfect score. There were questions about programming languages I hadn't even written a "Hello World"-example for.

With all this goodness, comes of course the danger of relying on Google for all your answers. If it is not on the first page of the results it is not true. Especially younger people believe a lot of facts they find online. Another danger is using Google for confirming a bias: With so many pages online, there is bound to be a page in the results that agrees with your initial hunch, however incorrect it is.

I participated in the pilot for Google Answers. There were people there that, if the answer was to be found anywhere online, could answer it, no matter their expertise on the subject. Googling well is a valuable skill.
New Employee Policy:

Employees are not authorized to access any company computer resources unless the following conditions are met:

1. Toilet seats must be in the down position following restroom use, as requested by HR.

2. Coffee area must be clean, with all spills and sugar wiped from the counter.

3. Refrigerator must be clean and free from week-old goods.

Any attempt to access the network while the above conditions are not met will be considered an unauthorized access of the network.
I have been looking for a developer position since 2013. I am still looking. I currently work as a test Engineer and have a steady income, but life is genuinely getting worse and worse as time goes by.

Contrast that with blog posts of 20 somethings telling you how to be happy and be productive on medium as they enjoy their Facebook job is quite frustrating and can make things worse. On top of that, I get banned here for trying to get real questions while other hide behind logic so I don't ever really get advice and guidance from people.

I am starting to build a brand in the hopes that I can make something out of it and never have to worry about finding a development job.

Besides not listening to people on the interwebs, I don't really have any advice. Just wanted to let you know that you are not alone.
i remember a game very similar to this (that i used to participate in and do very poorly) back around mid 90s that people used to play online. except you'd use things like archie and gopher. i don't remember the details but someone(s) would come up with questions and you'd have to find the answers online using these tools (before google).

anyone remember this game? my recollection is hazy but i think the questions were sent out periodically and teams would rush to get them all answered first.
If they have a bug bounty programm, look at it.

Also try to contact the $company's domain Admin (who.is e.x. give it to you) or, if availabel, the Network Abuse Team for further help to get in contact.
I am with you on HuffingtonPost but they also have so much fake news on their site that it is hard for me to know which one is Outbrain and which one is HuffPo. I am also afraid they will go out of business because of these practices.
This works the same way with any Merkle-Damgard-constructed hash function; basically it's just a length extension attack.
They were called "video games" before people started using computers to play them.
... and policy. Because now you can have collisions between sha-1 and whatever else you pick.
ya pretty much
I was called for jury selection. I'd forgotten about the summons and failed to show up the first two days, so I called the clerk who said that as long as I showed up on the third day, I wouldn't suffer any consequences. They had me at the bottom of the list so I sat there all day making small talk with potential jurors. I discovered that the first two days had seen few (if any) selections and there was speculation from both attorneys that they'd probably need to call another round of potential jurors.

I found out in the first ten minutes of waiting that our case would be a murder trial. I expressed my opinion many times throughout the day that I could never give someone the death penalty simply because humans make mistakes. Not the defendant, but those collecting evidence and providing testimony. There'd been recent news at the time about a few cases that had been overturned years later - rape cases with better DNA testing, manslaughter cases with new evidence, that kind of thing. My peers dwindled throughout the day and we heard from the deputies guarding us that selection had picked up and just maybe there wouldn't been the need for another set of potential jurors. I was the last in the room, the deputy received word that the last person before me was selected and completed the jury pool, but I needed to hang around because the judge wanted to speak to me. He arrived with both lawyers in tow, I expressed my apologies and was dismissed.

The defense attorney was a former client of my computer hardware business. (The relationship was known to the court.) Because of my familiarity with the lawyer, and because I'd been there during jury selection, I followed the case in the local news. The accused denied he was the perpetrator and maintained his innocence. His lawyer, my acquaintance, argued that his client was in the wrong place at the wrong time and was mistakenly identified as the assailant. (The details about whether this meant he was indeed near the scene elude me, but it's not important to my point.)

I was disappointed to find out the man was convicted. Perhaps the jury was afraid of releasing a criminal back onto the streets. I was relieved that he was given life in prison instead of the death penalty. Six months later, new evidence came to light, the right man was arrested, and our poor innocent soul was released.

Perhaps even if he'd been given the death penalty, he wouldn't have been executed in six months. But what if it had taken years or decades to discover the new evidence? I feel certain that my discussions with other potential jurors kept this man from receiving the death penalty.
> Instead of having a mechanism by which a website under attack ... from a host or number of hosts can direct the ISPs of those hosts to not send it traffic

How is this any different? You're putting the responsibility of being internet police on the ISP's, which have shown their either do not want that responsibility, or will abuse that responsibility.

Not to mention, this would go squarely against the notion of ISP's as "dumb pipes".
No. The messages differ in their internals.

The length extension attack leverages the weakness that people think HASH(secret + message) is a signature only they can create as long as only they know "secret".
Hits that sweet spot of people who are motivated enough to start a business, but not smart enough to realize this is a blatant scam/money pit. There's a lot of crap out there these poor folks fall for. If only they were a little smarter, or were content playing video games all day, they'd be far better off.
Yes. This isn't near the top end, more like what happens when we run benchmarks on a reasonable web infrastructure class cluster. This is still only 5 machines in each datacenter.
Look at the comment and submission history of the account he responded to. It's a well maintained shill used for propaganda and likely one of many.

This is then kind of thing you see in authoritarian states and rather chilling.
>>but deep down it was guilt- and anxiety-driven.

EXACTLY! There is value in realizing that one is wasting time, but viewing a leisure activity as a waste of time simply because it doesn't result in advancement is not healthy.

Personally speaking, the important thing has been learning to recognize when I'm in a productive mood vs in a gaming mood. These fluctuate all the time depending on various factors. But I no longer feel like I should be working when I play games or vice versa. It's quite refreshing.
I use pass: https://www.passwordstore.org/ - a password manager for the commandline that can be synced with git and stores the passwords encrypted using gpg
I find your ideas intriguing and would like to subscribe to your newsletter.