skysight-inc/HackerNews huggingface dataset:
I can get up to 500/500 (bumping up to 750/750 later this year) and I live in a Chesapeake Bay community that until two years ago didn't even have public water/sewer. That doesn't count the Comcast 2 gig I could also get.

But then again, my fiber hangs down from a teetering utility pole and is held in place by a single, bent rusty nail. Unlike in SV, it's cheap and easy to build here.
Launching on Product Hunt: what works and what doesn’t [guide and case study]
Palm oil is one of the healthiest oils.

Peanut oil is one of the worst oils (arachidonic acid).

You're correct about palm oil production hurting the environment.
It's not supposed to be used as a security feature, but I think some tools use it as such. Dependency management tools that reference by SHA-1 hash come to mind. Of course they should have used other primitives all along, but we know how it is..
It's not practical to safely work with non-ASCII strings in Python 2. There are too many "arbitrarily mangle my string" functions available (both in the language proper and in libraries), and the only way to avoid them is constant vigilance, which doesn't scale.
Excellent.

More generally, there is this fantastic repo on github that lists a bunch of such things that can be tweaked in about:config (mostly from a security/privacy standpoint):
https://github.com/pyllyukko/user.js
The glib-sounding, but basically true answer is: If you're planning to do it every day for 5-6 months, you ease into it, and do it at a level you can maintain for the next 5-6 months. And if you're feeling sore, ease back off a bit. Your body will mostly tell you what it needs.

The conventional wisdom among thru-hikers is that the only way to get in shape for a hike is to start hiking and get in shape as you do it. This seems to be largely true. In 2010 on the AT, down south, a number of people who started out in good shape from e.g. running, pushed too hard early on, had various health problems and dropped off. People also take far, far more Ibuprofen (I.B. Broken) than they ought to so they can continue pushing out long days.

For something like a thru-hike, you adjust your level of exertion to what you can sustain for the time you expect to take, which for practical purposes is "indefinitely" when you're talking about a 5 month walk.

The above applies to a "normal", unsupported thru-hike. People shooting for the speed record are a whole different case.
Bo Burlingham on Being Great Instead of Big
My experience is different than most people apparently: Books put you on the fast lane IMO. Of course it takes practice to master something, anything. Books represent a form of compressed, structured knowledge that is very difficult for someone to find on his own.

It is really nice to play around with mentos and coca-cola but without reading something like the McMurry (Chemistry 8th/7th/6th or 9th Edition) you'll never understand organic chemistry's basics. You might get a long way on your own if you're Ramanujan-level, but otherwise I think you'll learn, but way more slowly and in a possibly unstructured way.
No, they are also claiming it extends to Alexa's responses.
Airbnb Management Service Hostmaker Secures $6.5M
John Chambers to Join Pindrop's Board
Docker in Production: An Update
Box: A Next-Generation Builder for Docker Images (with Mruby)
That's not an issue with the torrent. That would be with the magnet link format.

Also, and more importantly, this isn't a preimage attack so replacing an existing torrent's SHA-1 hash with a malicious one isn't computational possible.
[2012] Schneier - When Will We See Collisions for SHA-1?

https://www.schneier.com/blog/archives/2012/10/when_will_we_...

Pretty close in his estimation.
When I read those posts I am really happy not to live in US. I am struggling to work even 40 hours week since my junior days (my typical week would be 35 - 37h). When I feel drained I just go home and don't sit in the office doing nothing. I am not doing less work or lower quality work than others (even if I compare myself to US team members). I also have some time to study new stuff at work so this is not problem with short hours too. I probably earn less money but I would not have time to spent US salary anyway with such working hours.
The larger the battery market becomes, the more competition it will attract. Tesla is certainly starting off with a nice lead, but it would be foolish to underestimate the capabilities of other players who might just not be interested enough in this market yet, and who'll -- for the moment -- happily have Tesla serve as a canary.
> "10 years after of SHA-1 was first introduced"

wasn't SHA-1 introduced in the 90's?
Why Are Shootings Deadlier in Some Cities Than Others?
This isn't really an HN quality comment. It's dismissive, you don't make a strong point, and it's not really interesting - this is just a rehashing of a common political opinion/disagreement with Citizens United.

Please, please don't let HN become Reddit.
Just make sure it's not vegetable oil (safflower, grapeseed, soybean, sunflower, corn, etc). It's full of Omega-6, which is very inflammatory.
I feel like you shouldn't be downvoted (is that what lighter grey comments mean on HN?). Although this is a rather negative outlook, this actually gives a different perspective that's helpful to people who have no knowledge at all of the area (like myself). I would say I learned something, having this along with the linked article talking about the more positive aspects.
The sql executes they are using build queries with "%s" instead of using ? parameters. I guess they foresee that those scripts only see friendly data but it's better to be safe than sorry and protect against sql injection from day 1.

Example https://github.com/dropbox/securitybot/blob/master/plugins/s...
Blockchain Solutions in the Financial Industry
To be honest this is a lovely evil plan. cough MPAA cough
Yes, and anything you say to that corporate electronic service can be used in the courts. (The murder in this case is disturbing though)

Cloud AI and comm services are sure convenient, but private they are not. Although that's the Internet world we live in now...
Yeah, that's what I have been using, but there's no obvious native choice.
Malware in a video? Is that possible? How does it work?
You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change.

Then join the torrent with a client that doesn't download but only upload that block (there will be some that will pick it from you). Many legit copies, except for those that were so unlucky to fetch the block from you.

If you manage to build such a block based on one in recurring content (eg. a distributor's logo at the beginning of the file), it could be reused, too.
It seems that commit object contains metadata and sha1 hash of the commit tree. In other words, signing comment object is not detecting if data is altered somewhere in the tree and creates identical sha1 hash.
A nit I'd like to pick.

No, AI didn't write code. A program explicitly built and trained to write code, wrote code.

A bit too pedantic, perhaps, but there isn't some singular program out there which first learned to play chess, then see and catalog pictures, create creepy art, play Go, drive cars, and now write code. Which is what "AI learns to X" seems to imply.

Of course, that's not as interesting of a headline.
You haven't seen my collection of cat pics torrent ;)

Also from a more serious stance the danger is the malware vector or the destruction of the ability to have integrity and not the data in the torrent itself.
So much for the rhetoric of the malicious company that's putting 1984 devices into living rooms for the government.
why isn't alexa scrubbing the data or anonymising it? presumably amazon is fighting this hard because they don't want it known that the government/amazon effectively has a listening device in your home
maybe they should secure their f*ing routers!
You can statically analyze CommonJS modules (and they are most often used in a statically optimizable way), they just aren't statically optimizable in the general case.
Try some earplugs next time?
The Real Reason Dystopian Fiction Is Roaring Back
You read past the part where I described receiving mails. It sounds like you have never used the service, so have no idea what I'm talking about, so have no idea what you're talking about.
This indeed, and I'm still learning. I had an exchange with another veteran that was anti 2nd amendment and I got really heated about it (because I am a huge constitutionalist), and I got in trouble with dang who chastised me in a way I felt was unfair (the guy made fun of my ptsd and got no rebuke from him), but after stepping away and coming back I realized dang was right, I was being overly aggressive and emotional, and in doing so I ruined the level of discourse.

That incident really has stuck in my mind, in that even on topics of passion, a calm more detached approach can eek out information and points of view we wouldn't otherwise get.

That's a hard but important lesson for even the best of us to learn. Especially for myself being a combat vet type of alpha male who learned the contrarian and abrasive style of debate from Christopher Hitchens. (Though I think that method still has a time in place, I think there are less situations where it's appropriate)
this isn't quite true, bittorrent have checksums for each piece in the torrent, I not saying its impossible to do but its significantly harder than just finding 2 files with the same hash.
I never said mutating a variable is confusing. I said repurposing the equality operator is potentially confusing, especially for children. Pascal used ":=" to mean assignment, long before Python existed.
"There is nothing inherently valuable about human life from a non-human perspective."

How would you know?
SHA hashes cannot protect you against the distribution site getting compromised and the hash replaced.
That is why most package manager include a form of cryptographic signatures (e.g. Ed25519 for OpenBSD's).
SHA and MD5 hashes are just used to protect against accidental corruption, not targeted attacks.
If you can switch between the images, you can also switch hashes. Without a signature they serve _only_ for making sure the network didn't barf into your stream.
You could replace the video by an executable probably, I'm sure many users would launch it, especially if the source of the torrent is "reputable" and with positive comments.

Alternatively you could exploit a vulnerability in a codec library or something similar.
Doesn't your dislike of other people also make you dislike public transit, meaning your first point and your second point contradict each other?
How am I going to explain this to my wife?

Actually a serious question. How do we communicate something like this to the general public?
Why is palm oil bad for your health? I always considered it to be one of the better plant-oils, with a low polyunsaturated fat composition similar to coconut, though really actually closer to butter (50% saturated, 40% mono, 10% poly.)

Not saying anything about its environmental impact, which I haven't researched, however.

http://chartsbin.com/view/1961
You could have a buffer overflow attack talking advantage of a specific popular video player out there.

Since video players are usually not very security focused, someone determined could do it.

And since video torrents are unzipped, a single chunk can be replaced with the malicious chunk with the attack code. It can look like a tiny jitter depending on the chunk size/total video size.
Her name is Miss Torrent! ROTFL
No, Git does not hash its internal gzip'd content to produce hashes. It purely hashes the uncompressed content you give it as-is. Any compression like gzip is purely done internally as an optimization and has no impact on hashes.
Would providing multiple SHA-1's from both the whole and N subsections (or defined regions) of the byte stream make this impractical... or at this point is the cost just going to drop and make this not relevant?

Like a NURBS based sudoku multi-hash...
> You could (try to) collide one of the blocks at the end of the tree. The tree of hashes will still be the same since the hash of the block didn't change.

Except you can't do that as this isn't a preimage attack. You can't create an arbitrary bad file matching an existing SHA-1 with this.
Which makes it worse because it opens up the possibility of intermitent bugs, and also those "it works on my machine, I don't know why it does not work on the server"

So it is better to treat them as multithreaded always... which falls back on the original post.
I kind of doubt they have anything on Bangkok when it comes to traffic. After all, a recent study showed Thailand has the world's worst traffic congestion. Nepal wasn't in the top 10. [1]

[1] http://www.bangkokpost.com/news/general/1201869/thailand-has...
Research: Arab Inventors Make the U.S. More Innovative
Nobody's saying it's "good enough". Once we see one attack we expect to start seeing more. What's being pointed out here is that this particular attack does not let you craft custom git repos whose HEAD matches one of an existing repo. Nobody is asserting that to be generically impossible, and this new attack is at least weak evidence that such an attack may eventually be practical.
How do you get OSM to display cafes or restaurants?
The two private keys need not be the same; if their corresponding public keys both hash to the same value, a signature from either private key is acceptable.
We can say with relative certainty that the body fat measurements are incorrect and can be discarded. When you see glaring errors such as the assumption that the author was 5% body fat at the end of his hike,it makes you question the other metrics as well. To the authors credit he points out that bioelectrical impedance is flawed.

Cool hike though!
Nobody will detect if a not important metadata field/asciiart is created/changed randomly, so this is a practical attack.
It amazes me that we don't have better data on something like this.
I may be confusing p2p protocols, but doesn't BitTorrent grab different chunks from different sources, so that if there are different people spreading different versions that are viewed as the same, people are going to mostly get either the original (and initially more common) version or broken junk that is a mix of the two versions?
Seeing an article refer to "AI" as if it's a monolith is a really good indicator of the quality of that article.
You don't really need to talk to anybody about this except people who torrent both illegal and legal torrents.

Torrent poisoning is the most ripe for exploitation and the one with the highest return for a malicious attacker.

So when you talk to someone who torrents, just tell them that the way the torrents verify a file is the correct one is no longer secure, and they have to keep an eye out for the next software update. And if anyone is paranoid, then stop downloading new torrent files, although there is no problem with seeding.

Now that I think about it, I think it is crucial for everyone to keep seeding as much as they can, because it reduces the probability of a bad torrent chunk from spreading as much across the network.

EDIT: Here's a good article that isn't very technical

https://www.wired.com/2017/02/common-cryptographic-tool-turn...
A 4 Year Old in Conversation with Alexa
Music: a mathematical offering [pdf]
Tech opens new war with Trump over transgender rights rollback
apparently they give the ability to access your communication with Alexa with a phone app. So they put themselves in a box by having features in an app that prevent anonymization of the data. Going forward they may have to drop the app or limit its functionality.

I don't have the app in question and am only extrapolating based on the text in the article. Does anyone here have the Alexa app? What are its features?

So is law enforcement going to try to go with voluntarily allowing recording of oneself allows them access? Push a claim that Amazon has no standing in the case and cannot object?
It can use buffer overflow (which is often easier than it looks in a large codebase written with memory unsafe languages) to execute arbitrary code. Modern OS have protections from such attack vectors, but they are not sufficient enough and well-funded attacker can bypass them.
Vanity metrics, the future, and 100,000 thank yous
I don't actually know the in's and out's of BitTorrent structure but wouldn't that not work as the 2 files would be completely different?

ie: I'd be downloading (and putting together) some blocks of the "real" movie and some blocks of the "malware". I'm guessing the resultant file wouldn't even open?
As long as you aren't in the 5% of people who get Acute Mountain Sickness, probably just chill for 1-3 days at 6K-8K ft, and then "Hike High-Sleep Low".
Git was released in 2005, 12 years ago, and it's based around SHA-1. They've done a massive miscalculation there.
Accidental collisions are still unlikely, it loses SHA1's "security" properties though. http://www.monotone.ca/docs/Hash-Integrity.html#Hash-Integri... goes in some detail for a different (older) DSCM, but same issue.
Apple's $5B campus will open in April – and you'll be able to visit
> the latest hot TV show in high def or whatever

Since it takes 6,500 CPU years and 110 GPU years, it won't quite be the latest show, unless you have really deep pockets.

There are way less costly ways to make money illegally using simpler vulnerabilities or by being a pay-to-use DDoS provider.
If they MPAA could subvert torrents of their property and and replace sections of the footage with just warnings (ruinning the download) i would find that much less objectionable than DRM.

Frustrate the people pirating instead of punishing everyone else.
jinx.
The IKEA Growroom isn’t just pretty – it’s the future
Take it from me, pemmican is the best thing ever, and if you are a hiker, Hunter, or general outdoorsperson, you owe it to yourself to try a few different recipes. (Wrap it extra good in bear country though!)

Fun tidbit of the day: in the Marine Corps our long full pack hikes (~90lbs) were called "humps". In the old days they were death marches.
Wouldn't that make the attack easier, since you just have to manufacture a pair of pieces with the same hash, instead of having to make the whole file have the same hash?
Previous brute forcing efforts [1] have fiddled with commit and author timestamps.

If you had seven commits, and two timestamps per commit, and each timestamp could be fudged by 90 minutes without detection, you might not need any dummy comments or files at all.

[1] https://github.com/bradfitz/gitbrute
Not only that, BitTorrent also uses a Merkle tree of the torrent data split into pieces (e.g. 1 MB per piece), meaning you need to compute thousands of colliding hashes, with the added restriction that the data must be exactly the piece length.

The torrent ID is the Merkle root hash, which is a hash of all the piece-hashes hashed together in a tree structure: https://i.stack.imgur.com/JVdvj.png
It'll only work for a few days/months after people start noticing it.
Software produced by a typical business app developer is not provably correct either. TDD of AI generated code could not hope to produce something more correct. As your tests get better, so would the software produced both by the human and the AI.

For your add(int32, int32) function: While an AI-generated implementation is not provably correct unless the test contains 2^64 inputs, I think it's pretty likely that a correct implementation would in fact be generated pretty quickly.
There are standard APIs, and in some countries they're coming into law to be offered this year.

Mint itself, like a lot of personal/SME finance apps, started out as a layer on top of Yodlee, or a similar service, at the time providing a technology/data layer for other apps to work with, so it was less giving passwords to apps, but having them pass-through to a heavy lifter. I agree giving passwords away is not wise, however.

I could talk for hours on on changes in APIs happening over the next couple of years here if you fancied. If you'd like to know more, just reply saying so and I can drop you a mail.
Paula Radcliffe
Google created a complicated and expensive method of undermining an integrity check, making that integrity check less safe to use. The method will get cheaper and easier to use, so systems using that integrity check have to be moved to integrity checks that are believed to be better.
You still don't get it buddy.
I wasn't arguing against imperative semantics. I was trying to point out that Python abuses notation and conflates paradigms; and so perhaps may not be the best teaching language.
Both Haskell and OCaml make very good imperative languages, but are much more explicit about what's going on. Assignments are clear to see (using "<-") and one must explicitly declare a mutable reference, rather than the Python default of everything is mutable.
Where did England’s counties get their names?
If they're desperate, please tell someone to write a book for noobs. I opened The Book of F# and recoiled in horror. The whole book was basically if you're a C# expert, here is how F# is different...or at least a lot of it.
The Philippines — specially Palawan — is another good destination for remote work. A co-worker lives in Davao and have met people in Manila that do as much (or more) work than me with their Internet speed which is not at US levels but is good enough for what most nomad developers do. Be sure to get a local SIM card and a 4-8GB plan just in case so you can share it with your computer.

There is also an advantage of living in this side of the world, most of the time you are the first person in the company to initiate your work day which allows you to focus more on what can be done for the day with the rest of the team. And of course, incident response is much better since the timezone difference allows you to stay awake at times that are considered difficult if you are living in America.
Free Cyber Security Awareness Posters for /r/sysadmin (no watermark or logos)
Hi All,
We have a few free posters available for anyone running a security awareness campaign.
No watermarks, logos or licensing!
Also, they look good if you move the title text down and insert your companies logo.
http://imgur.com/a/OtqPO
(BTW, I don't think it's that simple either. Just pointing out that TDD is a possible approach to avoiding the infinite recursion of specs-are-just-programs-in-a-higher-level-language.)
Sneak Preview of NativeScript 3.0
Ask HN: Easiest way to convert website to hybrid mobile app?
Hello guys,
I have a website and I would like to convert it into mobile app (Android + iOS). What's the best way to do it without programming? Can you recommend some platform for building mobile apps?

Thanks!
The US Army's Ranger School is 8 weeks on 2 hours of sleep a night, apart from one night you are allowed 5 hours because there's a parachute jump the next day...
AirMap raises $26M to manage air traffic as drone use surges
Any marketers currently working to manipulate public opinion on HN through the use of sockpuppet accounts, upvote this comment.
Funny, I did the exact same thing!

Tried to push learning Rust via the Go examples. It has been a great exercise, but highlighted the pain of dealing with various string representations in Rust.
Well, you really don't need the complete file either. Since torrents are usually shared unzipped, they can just replace a chunk with a bad one (It varies usually from 256KB-2MB) and a single chunk can be replaced with a bad one embedded with malware to cause problems.

Especially something like a buffer overflow attack on a video file.
The Developer Manifesto
Akira Endo (biochemist)
Quantum Resistant Algorithms [pdf]