skysight-inc/HackerNews huggingface dataset:
It saddens me greatly to know that the majority of people in this world would rather let people die from overdose than allow them to get high... Is it really such a big deal? So they like doing drugs. In the grand scheme of things, isn't the more humane thing to do just allowing them to use while pursuing more humane options for getting them off drugs (rehab and education)?
>I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.

It's not easy to deal with but it is the best remediation available to you, given the exceptionally broad scope and months-long period where data was apparently leaking (the cloudflare blog post lists 2016-09-22 as the first date when leaks were possible)
So, I guess now these same developers will commit two keys into their repos? :D
Exactly! Btw, the specific term of art for "actual things" that are subject to theft is "rivalrous" (adj): a good whose consumption by one consumer prevents simultaneous consumption by other consumers.

You can commit theft of a rivalrous good, like an apple or a computer. You cannot, however, do the same to a file or a song or an idea. I wish more people understood this difference. Society would be better for it.
There’s a lightweight clone written in Go, Journey [1], which uses Ghost themes. It got a fair amount of attention at one point, but development doesn’t look very active at the moment.

[1]: https://github.com/kabukky/journey
Proof That India’s Growth Mostly Benefits India’s Rich
Connecting some dots, I'm wondering if the "well-known chat service" is Slack:

http://www.computing.co.uk/ctg/news/2462266/whatsapp-reddit-...
As for the SHA-1 collision mentioned by jgrahamc[1] earlier today:

How am I going to explain this to my wife?

Actually a serious question. How do we communicate something like this to the general public?

[1] https://news.ycombinator.com/item?id=13713826
No, nothing is fixed. The leak has been plugged, but the water damage (and partly the water itself) is still there.
Are you guys planning to release the list so we can all change our passwords on affected services? Or are you planning on letting those services handle the communication?
"All plans comes with a free 14-days trial. No credit card required."

You might want to correct your main headline grammar on your pricing page if you want to be taken seriously.
Yeah politics has had this issue for a while too.
You're right in 99+% of cases. But I suspect that the needs of cloudflare for this use case aren't typical of what's expected of an html parser. I'm not certain that there isn't an existing parser that would work for them, but I'm equally not certain that there is.
Private fiber in other people's datacenters. Better I suppose, but not much.
You are from the expats, aren't you? You sound very bitter, as if you hate almost all people around you. But why is that so? I can understand the antipathy towards some tourists to some extend, like for example it bothers me, that people come there, they see all the poverty and how much they do not fit in there, but they ignore it and they are able to enjoy themselves nevertheless. So for some reason it's hard for me to accept this indifference. Could you tell me more about your story? What made you think all this?
> Asteroid mining on any sort of commercial scale is far future, not near future. Even with fully reusable rockets, asteroid mining wouldn't be profitable; anything we need can be obtained cheaper on Earth.

It's certainly in the future, it just all depends on what is far to you. Many companies who want to get in on this are hoping to attempt within the next 10-15 years (obviously commercial mining would come some years later after a successful attempt). If it can be successfully navigated it would have the potential to be crazy profitable!

It's too expensive to bring materials up but if you can mine materials in space and deliver them to the various space companies / government departments is where you'd make your money. Mining water, in theory, should be crazy cheaper as long as you can capture the asteroid efficiently enough. NASA has already said they would love to see more work in this space so they can purchase materials cheaper while in space and they're even hoping to capture an asteroid in the mid 2020s as a type of test for this scenario.

> Satellites are generally easier targets to hit than ballistic missiles.

This misses my entire point: in order to destroy the kinetic projectile you would have to launch a preemptive strike against the satellite. There is no way around it. You won't be able to defend yourself against a large projective being precision dropped onto your location without a lot of energy (so depending on what country you are maybe you can knock several into a few direction or vaporize with a high enough yield but you only get one chance at destroying it). Meanwhile a ballistic missile, while faster, can be destroyed with a hot enough laser.

I understand they're not practical and if you want to use an asteroid itself that's even more awkward. But when we start mining asteroids, in my opinion, it's going to become crazy practical and cheap.
I think we're in the dark ages of user interface currently. It feels like we've mastered skeuomorphism and moving away is fine, but we're in the infancy of whatever's next.
"now serves as a top ranking Uber executive"
This is awesome. Webpack and yarn are incredibly powerful tools. There's a learning curve with webpack, but once you pick it up, it's easy to make it do anything you need. If you actually dig into the internals, you quickly realize that everything is incredibly modular and you can pretty much hook into everything.

If you're not already using yarn, go check it out right now. Migrating literally took our team less than 5 minutes, and we haven't had a single problem so far. Its default behavior is much more sensible than npm.

Writing a SPA that handles every edge-case is really challenging, so it's actually incredibly refreshing to write a fully server-side rendered app. Especially after spending a lot of time working on SPAs. It's pretty mind-bending how easily you can wire up a meaningful prototype, just by sticking to rails' guidelines. Even though my love for ruby has diminished after having tried other languages, I'll still happily reach for rails in many situations.

I think for many apps you'd strike the best balanced in complexity by mixing both server-side rendering and having some pages which are small javascript applications, instead of going for a full-blown SPA. Depending on what the app does, somewhere between 5k and 10k SLOC seems to be a sweet spot for an app to be useful while still being trivially easy to change and keep track of everything. Once you pass ~20k SLOC, I've found it starts to get harder to follow everything, and changes start to require a bit more effort. It's worth noting that those numbers are pretty arbitrary and are probably wrong :). Again, it depends on the application.

In my job we had a period where everything was handled by a SPA, and it was pretty painful. If you have a password-gated app, consider doing all the auth views with server-side rendering, and only load the SPA for logged-in users. This lets you drastically simplify how you handle things like resource caching and routing. Leverage the server more, stop trying to handle everything on the client! That's gotta be one of the most important lessons I've learned.

My really big complaint with rails is that it works so well until it grows enough, and then it gradually starts to fight you. How do you transition beyond rails MVC? I've looked at stuff like Trailblazer [0], but I'm uncertain if that's really the direction a growing rails app should take.

[0] http://trailblazer.to/
I get this argument. I have made it in the past.

But CF doesn't want to play Internet cop. Everyone who manages a service gets a constant barrage of "someone using your site did something offensive, I want you to kick them off your service!"

CF has decided they are just not going to play the game, at all. Because once they start, then all the piranha come to feast.

I'm not saying this means they aren't a racket, which is charging people money to solve a problem you made. But they do have some good reasons for simply refusing to censor what they offer.
It's always fairly safe to enter credit card details, you can chargeback that shit, type it wherever you feel like and just claim ignorance when it goes poorly. That's basically the whole point of using a credit card and not your bank account where you're liable for at least some of the money taken.

No company is likely to handle your payment details completely securely. You're relying on it working out on sheer luck most of the time and chargebacks on the rest.
Proof I'm paranoid. My greater point, however, is that they have done some really shady stuff, and stealing competitor's IP is part of their culture, so their behavior itself promotes and justifies paranoia on my part and on the part of anyone looking to work for or do business with Uber.

Reputation is everything.
You didn't ask why?
You can check IP whois records, but it'll be very hard to be 100% sure about any of them. For example, one of the examples from the bug report is Uber, which doesn't use Cloudflare for its home page but apparently does for one of its internal API endpoints.
I was stopped and asked for ID years ago when I was walking in an area where the police were looking for a suspect.

No idea what would have happened if I had refused, but I doubt it would have been "Ok, you're free to go."
Unfortunately their (ICE/CBP) identification of people is so poor that it appears to often be no more than a name match. My brother-in-law has a name that's very common in both Mexico and the US and as a result, he regularly gets stopped when flying so they can confirm he's not one of the people with that name who happens to have outstanding warrants.
In other words, Baidu are currently sitting on a treasure trove of keys and passwords.
Hey! The about says 'no databases', but how do you store the text then?
"Facebook is its Users. No amount of AI can sell advertising the way Users can. And, last time I checked, it's still the User clicking around and having experiences."

I think you might be over reacting to this language, I believe the intent of the original article was to say that "the current Facebook USER EXPERIENCE cannot exist without AI" - clearly there are other things (users, user engagement) that make up integral parts of Facebook. No one is saying the product is AI.
I'm not saying "at any time they please". I'm saying "when they have probable cause to believe the person they're looking for is on the plane".
There isn't an automated system that can tell you whether it's safe to give data to a website, just like there's no automated system which can tell you a given vendor/service provider in general is reputable. All you've got is regulations, human-based reputation ranking, and public shaming.
From the medium post "downloaded additional highly confidential information pertaining to our custom-built LiDAR including supplier lists, manufacturing details and statements of work with highly technical information."
Downpour is my preference right now. The clouds are dumping everything they got
Yeah, that's part of the problem, they say the checkpoint is for one reason, but really they do it to try to catch anything going on.

For a DUI roadblock yeah they'll ask you for ID, but not all the people in the car. Also, for secondary at these border patrol checkpoints, I think it's pretty shaky legal ground, although they will try.
I've never consciously done this but looking back I've definitely been the most productive when I didn't have anything better to do. Thanks for spelling it out!
U.S. reverses Obama-era move to phase out private prisons
I agree it's not unusual and I doubt this has anything to do with Trump.

That doesn't change the fact that it's unconstitutional to require ID.

"Dragnets" are not a good thing. There's a reason people often use them as a synonym for invasive and authoritarian tactics.
Few algorithms recognize text re-ordering.

WinMerge[1] does. Unfortunately it's no longer under development. (I've been looking for an equally-capable tool for Macs but have found nothing...)

Do you know which algorithms recognize reordering?

[1] http://winmerge.org/
Intensive mining indeed, if it's true that it requires 3.3M requests to get a page leak.

With a fixed 100Mbps connection and assuming 2kB per HTTP request-response, you can hope to get one leak every 11 minutes and 6.6GB of traffic, which is a constant 5k requests/s.

Maybe if Google reassigns all its SHAterred ressources to doing that...

... and then I realize that we were talking about cloudflare and my mining bot a capcha.

---

edit: correction. The bug was affecting only some pages with some content filtering options enabled, and was more prominent under some specific circumstances.

Hence why it only happens 1/3.3M in average. An attacker could allegedly leak data much more reliably if he was able to identify the patterns that are more likely to trigger leaks.
The thesis of that blog seems to be that Cloudflare should be censoring content and deciding who gets to have websites on the internet.
No, because sexual harassment is illegal. That's probably why they'll be sued into oblivion.

But given that the legal system has failed them so far at least this is putting obvious pressure on them. This is only happening because the legal system has failed them.
So, Republicans go crazy over Roe v. Wade and the supreme court decision on gay marriage, citing 'activist' judges going against the will of the people. Now, recreational marijuana has been put to the people, and in those states where the majority approved, Republicans want the feds to come in and enforce prohibition. What happened to the party of small government and states' rights? The hypocrisy really never ends with the Republican party.
Too bad it's not open source. The downloads and GitHub repo only host binaries + a C header file.
Lol, yeah my bad. My God. What a waste of talent of him, and waste of time/energy for everyone involved.

I wonder if Uber accepted the stolen files from Google knowing they were stolen.
You're absolutely right. Cloudflare is a "global active adversary"[1] and has done irreparable harm to the internet at large. This is just a small taste of what's surely to come from CloudFlare's massive influence. They've shown that they cannot be trusted with everyone's data.

[1] https://trac.torproject.org/projects/tor/ticket/18361
Any references to what "they" say about it?

(I'm investigating various questions including of STWM, ideas, and networks or clusters of ideas.)
I agree that Uber has a net positive social impact, but the Kapors are nevertheless right to try to force change here.

1) They have more direct control over, and responsibility for, Uber corporate behavior.

2) Uber corporate culture might bleed over to the customer experience.

3) The behaviors in practice at Uber are not good for anyone, even the "high-performing" assholes whose behavior is excused. Those behaviors keep talented prospective employees away and make current employees less effective.
I'm just commenting on the media's sudden interest, which I think has everything to do with their opposition to Trump.

I (and many people on both sides) have been opposed to dragnets (including DUI and immigration dragnets) for a long time.

DAE remember when right wingers were mocked for those videos in which they simply responded "Am I being detained?"
It swaps out unused memory to free up space for disk cache in order to improve performance. This is actually a good use of memory.
It honestly probably depends on circumstances you might not be aware of, like the description of the person they are looking for. Obviously if you match the description, then turn and run when you see them, they won't believe you're exercising. But if you don't match the description at all, I see that being a hard sell. I'd be asking the cop: do I match the description of the person you're looking for?
"and even plaintext API requests from a popular password [1Password] manager that were sent over https"

Plaintext?
And decision was unanimous.
1) makes sense if Levandowski did it over the company internet connection. There could be a record of his unusual requests (software download, software update).

> they can infer that he wiped it

For 4), Levandowski reformatted the hard drive before returning it, so there's no inference there.
Uber launched their beta in Pittsburgh just before Otto acquisition. This doesn't explain it. It explains how they quickly wanted to build their own lidar.
Of course they're intelligence partners, perhaps not wittingly, but Cloudflare was designed from ground up to be one of the most interesting targets for every intelligence agency in the world.

After the Snowden leaks it really seems nonsensical to give Cloudflare the benefit of the doubt and assume that they aren't compromised.
So, they know which sites leaked data in responses. It sounds like they can also say categorically that some sites won't have been affected (if they don't share any infrastructure with the sites that could have leaked data).

Will Cloudflare be explicitly notifying customers about whether data from their site could have been leaked by this bug?
FCC lifts transparency requirements for some internet providers
They weren't on my ballot.
> that above statement must be wrong, surely?

Either they believe it's right, which means they're not competent enough to really assess the scope of the leak; or they don't believe it, but they went "fuck it, that's the best we can do".

In either case, it doesn't really inspire trust in their service.
I don't think that's sufficient probable cause. They don't suspect that everyone on the plane is an illegal immigrant

More importantly, they should plenty of less-invasive procedures. The airline should have a passenger manifest of everyone who actually flew, for one thing.
Often times they don't have much of a description and are just hoping to get lucky.

In this case, did they have a description or simply "there's someone on the plane violating immigration law"?
Which is cool, as long as they don't get in the habit of "looking for fugitives" 24/7.
macOS does this aggressively. I'm currently at 8 GB used/16 GB, and still have 5 GB swapped out.
Hm. Not so good. The main website that I log in to that uses CloudFlare is this one.
Attacks on Hash Functions and Applications [pdf]
Yes, they have Goobuntu.

Believe so.

No it isn't.

Lastly, you have to ssh into a workstation to access any files and you aren't allowed to have files downloaded locally for this exact reason. He would have had to have gone through some trouble to even obtain these files locally I would imagine.
I wonder what would the effect be if there was one.
> And so it begins.

It began years ago.
Google maps makes it easy to see the estimated prices of Uber and other services.
Wow.. I didn't even know of the sticky bottle. Thanks.
But if you already control a certificate, then you have no need to try to switch to a fake one

The way previous certificate collision attacks have worked is that you generate two certificate signing requests that are for different domains, yet will hash to the same value once the certificate authority applies their serial number, date &c. You get the certificate request that applies to your own domain minted into a genuine certificate, then transplant the signature into your colliding certificate for the other domain.

This relies on finding a certificate authority that is using the vulnerable hash function and being able to predict the serial number that will be applied to the certificate with reasonable probability. Doing the latter tends to imply being able to generate the collision very quickly.
I heard of single municipal installation. Powerwall will make a difference as it enables people to use energy and draw them at different times.
And not to mention other Samsung subsidiaries (that make display, RAM, CPU) were probably crying bloody murder to Samsung Handphone division...
Google employees are probably aware they are being tracked. Keeping such a thing a secret would likely result in more leaks, not fewer.
For starters, not using monospaced fonts for the article copy.
Not quite...

First, Levandowski is far from a junior engineer. He's been described as the tech lead at Waymo and worked on Google Maps and Streetview.

Second, he left Waymo to co-found Otto, a startup which existed for six months before Uber acquired it for several hundred million dollars.

Third, he's now described as a senior executive at Uber.

I'm not sure where Facebook comes from here. Did I miss something??
Why would you ever want to add a second broken hash like MD5 instead of just using a single secure function like SHA2, SHA3, or BLAKE2?
They said the same thing about Obamacare.
Gary Taubes AMA
Lol, Google just purged that search.

EDIT: but there's still plenty of fish: http://webcache.googleusercontent.com/search?q=cache:lw4K9G2...

This will take weeks to clean, and that's just for Google.

EDIT2: found other oauth tokens, lots of fitbit calls... And this just by searching for typical CF internal headers on Google and Bing. There is no way to know what else is out there. What a mess.
Can we start a list of affected right now? I found:

OKCupid

Uber

people claiming 1Password, can't find

Reddit

Lyft

Yelp

Pingdom

Digital Ocean

Montecito Bank and Trust
To be fair to CloudFlare, Google had a heap issue a few years back (maybe like 7 now) where internal flags and copies of argv (which Google use heavily for config) were clearly present in output from their HTTP frontends, including references to Borg before Borg was ever documented publicly.

Over in App Engine land, someone bypassed their JVM sandbox and managed to extract a copy of their JVM image, which included much of their revered base system statically linked into something like a 500mb binary.

Sorry, I'd have to go digging to find references to either of these incidents. At least in either case customer data wasn't leaking, but suffice to say it's a little bit of the pot calling the kettle black

And finally let's not forget the China incident, which rumour has it, resulted in a system compromise at Google right to the heart of their engineering organization. Of course they didn't get roasted like Yahoo recently did over their password leak
I'd be more inclined to ask why it worked for you in that exact version, but not for me in the very same one. (Mine might be 64-bit, but I can't see that making a difference here.)
That's a good point, he seems to be a very petty and vengeful person. Just look at his feud with rosie o'donnell.

https://www.youtube.com/watch?v=NP7Lixcc_jQ
Wow this has got to be the worse single month for a company that I've ever seen.
Stealth startup Privacy Labs raises $4M to give consumers control of their data
Yup, lots of firms using HIDS that gather all sorts of system data. OSSEC is what I've seen rather frequently for this.
Given that the plaintext is cached (or feared to be), is googling/binging one's passwords a bad way to check for pwnage?
[edit: correction]
Sorry for the late reply. Multiplexing is not a panacea, there's still some overhead, and even if there wasn't there's still a point where you start to lose lot of performance by limiting gzip compression (the smaller the file the less efficient the compression is).

You can read more about why we'll always need a bundling step at the following links:

http://engineering.khanacademy.org/posts/js-packaging-http2....

https://medium.com/@asyncmax/the-right-way-to-bundle-your-as...

https://medium.com/webpack/webpack-http-2-7083ec3f3ce6#.74q6...
Weird. I read the Cloudflare blog entry (<https://blog.cloudflare.com/incident-report-on-memory-leak-c...) at the bottom of the linked Chromium bug tracker page and they make it sound like it's fixed (the implication being that now would be the time to change all my passwords…)