skysight-inc/HackerNews huggingface dataset:
Which is the plan. If people recall, the rights holders have never been happy with the status quo, which is one of the reasons copy right in America has constantly become longer, even though the creators have long since passed.

Copyright feels like its has lost its original intention of ensuring the creator of an idea or property is protected, and has become a way of permanently annexing an idea or IP forever.

And as long as the rights holders have more money, time and resources, there's no real reason they shouldnt stop pushing the enevelope.
Of course. Google dumping their cache puts only a small dent into the problem, but I feel that it's their responsibility to the innocent site operators caught in the middle of this.
There is book called "The Design of Everyday Things" that discusses such things. https://www.amazon.com/Design-Everyday-Things-Donald-Norman/...
I don't even know if it is a cheap product thing as many of the cheap products are very usable. For example, light switches are very cheap. People place them in strange places or in strange orders and it makes them hard to use.
Don't forget the extra computation cost with a more complex hash.
An unofficial list is being compiled here: https://github.com/pirate/sites-using-cloudflare
I've compiled a list of 7,385,121 domains served through cloudflare using several scrapers.
https://github.com/pirate/sites-using-cloudflare

The full list is available for download here (23mb) https://github.com/pirate/sites-using-cloudflare/raw/master/...

I will be updating it as I find more domains.
Doclt
Bitcoin nodes have bandwidth limitations, and specifically upload bandwidth. Increasing the blocksize without taking this into consideration kicks nodes off of the network, and decreases decentralization. Right now, a node can be run on a personal internet connection in Australia. Double it, and you hit the limit. Quadruple it, and you effectively stop nodes being hosted here. That's a problem.

Larger blocks are not actually necessary with other layered solutions to bitcoin. The people who are pushing big blocks are mostly uninformed of this reality.
We're interested in the quantity:

(1) P(crash | section hit)

and adding armour to those sections where that quantity is maximized (maybe with some thought to the relative weight of armour needed for each section, but I digress).

Let's directly apply Bayes' rule:

(2) P(crash | section hit) = P(section hit | crash) * P(crash) / P(section hit)

The denominator can be further expanded:

(3) P(section hit) = P(section hit | crash) * P(crash) + P(section hit | no crash) * P(no crash)

So we can see from the 2nd term that if aircraft regularly comes back with a section that's been hit and yet it hasn't crashed, then that directly reduces (1), meaning that section needs less relatively less protection, all else being equal.

Another point in this method's favor is if crashed aircraft frames are too damaged to permit us to identify which sections were damaged. In that case, we can still estimate (1) just by replacing all the P(section hit | crash) terms with a uniform term.

This analysis can be further expanded to the actual amount of damage each section took in a as well. The more damage a section took on surviving aircraft, the less protection it needs.
... all which are easily compromised by a commodity phone.

"Ah you know, I forgot my charger! Dang! I'll just plug this into the USB port of this sooper secure machine connected to this sooper secure network."
I've compiled a list of 7,385,121 domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare
I used Censys to search for the IPv4 addresses of servers serving matching TLS certificates: https://censys.io/ipv4?q=443.https.tls.certificate.parsed.na...
Parsers don't usually need to hold onto what they're parsing for a very long time, so unless they were running this parallel on a machine with 4k cores, I'd imagine it would be much more likely that a buffer overrun hits the middle of an already-freed allocation rather than going into an active one.

In terms of "wasting" memory, perhaps the kernel could detect that you are writing 0s to a COW 0 page and still not actually tie the page to physical RAM. (If you're overwriting non-0 data, well it's already in a physical page.)

I don't quite follow the details of the CPU cache issue and why that is more-than-minor.

I do think in this day and age we should be re-visiting this question seriously in our C standard libraries. If the performance issues are actually major problems for specific systems, the old behaviour could be kept, but after benchmarking to show that it really is a performance problem.
That's a pretty inflammatory title. The guy was shot after an argument in a bar.
As far as I know Otto wasn't YC - are you sure you're not thinking of Cruise (which was acquired by GM)?
SOS was meant to be easily recognizable and trivial to generate:

... --- ... --- ... --- ... (and so on)
Eh, if drinking coffee is to be considered a loan on time at all, it's a very, very low interest loan. For me at least. Never have understood people who "crash" on coffee. Maybe it's because I drink it black, no sugar, no cream. shrugs
It's not a strawman if you grant that only people installed as workers get to have influence. As the rest of the people in this thread have pointed out, that premise is false.
Had no idea. I just assumed it was a generic site builder.
It's definitely criminal.
I'm merely suggesting that the comment claims to be interesting and related but because it is not directly related to the subject it seems off-topic and irrelevant.
Large Companies Will Be the Biggest Beneficiaries of the Lean Startup Movement
Yes, I think the question was something like "why doesn't malloc call calloc?".
Military morse users would predominantly send ciphertext, so the letter distribution would (hopefully) be random.

Professional morse users often sent very condensed messages using a variety of abbreviated formats. For example, here's an excerpt from an NOAA aviation weather forecast:

WA CASCDS WWD
CSTL SXNS...SCT025 SCT050. 06Z SCT020 BKN050 TOP 100. OTLK...MVFR
CIG.
OLYMPICS...BKN-SCT060 TOP 080. ISOL -SHSN. 04Z SKC. 08Z BKN050
OVC150 TOP FL200. OCNL VIS 3-5SM IN SCT -SHSN. OTLK...IFR CIG
SHSN.
I've compiled a list of 7 million+ domains that use Cloudflare here: https://github.com/pirate/sites-using-cloudflare

Including the subset of the Alexa 10,000 that use Cloudflare in the README.
The one time Amtrak lost my bag, it went to the end of the line (New Orleans), and then sat there (despite my immediately filing a claim) until the 3-day pickup period had expired. Only then did they look at it. Not that surprising of a strategy, if you think about it.
I'd suggest just flagging it away. It is out of date, and was actively wrong and full of misperceptions even in 2008. There's no virtue to keeping it here now.
Actual title: "Charges filed in Olathe Austins shooting; suspect waives extradition to Johnson County"
No they are not. The states share sovereignty through the Federal government. That's the very definition of Federalism. We are not a single Unitary state.

The mere fact that any partition of union requires the approval of the legislatures of the involved states is demonstative of this.
Sure... but that probability is equally present in the non memory-safe language, so that doesn't change anything.
It'd be really weird for them to request you to bring a laptop, but sometimes when a company flies you out for an onsite and your return flight is that night, your options are either 1) leave your laptop with the hotel as luggage (pretty bad) or 2) bring your laptop to the interview. There's no real reason for them to know you have your laptop with you however.
That's partly because of safety regulations making it have anti-spill features.
So you've never heard of Enron?
Change all your passwords. Many sites use Cloudflare to serve secure content, and it was recently discovered that Cloudflare has been leaking secure content, including passwords, API tokens, etc. to unintended viewers.
Google Account Unexpected Sign Out Issues
Multi-member districts would certainly be better than single member.
There may be some miscommunication here. There are the 555-DRYV car services that are precisely what you described, and then there are the private car services that you routinely see lining up on Park Ave. to collect the glut of lawyers that had to stay past 8pm. The latter are fantastic.
It could also be that Levandowski met with Uber execs as the lawsuit claims, but didn't tell them he had stolen the documents.
> I always wondered if the patch would be of any use to anyone.

You think? I dunno why you wouldn't try to submit a pull request though.
>It is a snapshot of the page as it appeared on Feb 21, 2017 20:20:45 GMT

So the issue wasn't fully fixed on Feb 19, or Google's cache date isn't accurate?
>A witness said he yelled “get out of my country” to two of the victims, reportedly saying the men, believed to originally be from India, were “Middle Eastern.”

What argument?
I have been asked to bring my laptop to a interview so that I could could in a development environment I am already comfortable with. I not only found it reasonable but also appreciated it.
Nor did he suggest it was. He said it was an interesting tid bit from the article.

It was indeed an interesting tid bit. I also found your comment about newer practices interesting, and neither comment rebuts the other.
Migrating Firefox for iOS to Swift 3.0
Remember seeing in subreddit drama section a situation where the CEO went into the database and apparently changed one of the comments from Trump's subreddit. It was probably something insulting or taunting as usual. What was interesting to me is one of the admins then leaked internal Slack chat logs talking about the fallout of it and such. In there one of admins boasted getting paid by Correct The Record which I understand Democrats contacted with to control the narrative online. And I thought that's pretty brilliant - focus on admins and moderators of a popular site or subreddit is more effective than just picking any old Joe from the street.
"I’m always a little bit wary of coming off sounding like I’m the very first person to work on this idea; I just want to be clear that’s not the claim." -- from the article
And for sheer elegance, I'll give it to the assassination of Georgi Markov by being poked with a ricin-tipped umbrella.
Thanks for the link. Some of the issues raised definitely have the potential to be problematic.
Where are the technical arguments? Just false analogies and hyperboles. I wouldn't like to work with a person like this in my team.
Yet another strong argument for end-to-end security. Terminate in the middle, and you risk things like this.

Hopefully people will learn something from today.
"Blame" is one of those double-edged words. Unless you do this for a living or have seen many horror stories before it's easy to make mistakes.

Maybe it's just me but I don't really trust the regular postal service with anything, and if there's no other option, super-duper insurance is the order of the day.

Anyway, what a project this will be. Hopefully you can get it completed without any more unnecessary drama.
Menyuan Qinhai，The best hike in China
Cloudflare terminates SSL and then forwards the request to your servers as one of their services. This isn't about the CDN, but about them terminating SSL, then leaking the plaintext data back through other requests.
Your comment got flagged and killed, which I thought was bullshit so I vouched for it.

Because you're correct: if CF's info sec team is "very very good at their jobs", how did this incident happen?
> What's needed is a solution which actually fixes the problem.

That solution is the lightning network, which the transaction malleability fix of the segwit patch fixes and makes possible.
> The important part is to control that 'first' desire of looking at your phone or opening up distracting sites.

Yeah, this is always key. If you don't get that initial dopamine hit from the first potato chip, or that first cigarette, it's a lot easier to ignore the urge.
One of the reasons I prefer paying with Bitcoin over credit card, is that when using cryptocurrency I don't have to give them they key to my account - instead they give me an inbox that I send the value into.

Guessing a lot of credit card details are ripe for picking in the data they leaked.
Yup. There are things in the world that are kinda bad, but worth imposing on people for the greater good of society (e.g., taxes, jury duty, bans on raw milk). There are things in the world that are really bad, and no amount of greater good justifies them. Harassment is one of them.

Part (but not all!) of the reason for this is that not every $150K/engineer is getting harassed, only some are, and some are doing the harassing, and in particular, those who are doing the harassing are, by all reports, not actually helping Uber's social mission effectively. If you're willing to sacrifice something about engineers to help Uber change the world for the better, sacrifice the people who take time out of their workday to proposition the people they manage, or who ignore their boss because they're trying to get themselves promoted, or who create and cancel projects to create the illusion of work, or who interpret people who sabotage their teammates as high performers. (And sacrifice them by firing them or better yet not hiring them, not by harassing them.)
Apple Doesn't Need to Buy Netflix
Yes! It's open source: https://github.com/google/grr

Google probably has the largest team of internal forensics software developers.
It's also going to present zero obstacle to a meteorite travelling at six times the speed of sound. It'll rip through that armor like it's not even there.
"Experiencing Issues" is way understating this.

I had two OnHub devices (different models) do this during business hours at two different places that ran on WiFi today.

The first I took as a complete fluke, but the second made me realize this was a Google issue.

They say it wasn't related to a software update, so what the hell resets a device into setup mode?

Power cycling did nothing, I had to re-configure the devices from scratch: switch to its setup network, use the Google WiFi (renamed from OnHub) app to set network name password, reset to bridge mode etc.
I think they're excellent – the text is actually interesting to read and it gives me a much better impression of the relativ importance of changes than a simple list would.

I also can't find fault with giving some appreciation to the relevant people who contributed by actually naming them.
Frankly, I wish this "patented" (does that word mean anything at all these days ?) tech gets into China, and gives all us hackers cheap Lidars to play with.
It was recently pointed out to me by a friend with a hobby for cryptography and mathematics that "secure" doesn't mean anything - something can only be secure with respect to a specific threat model.

It seems like a straightforward, almost painfully obvious definition in retrospect now, after having it articulated to me. I think education on security manners is poor and should be a standard topic.
I wasn't implying intention.
Merely that both my and the drivers app screwed up at the same time, and have a good chance of hitting the same Uber end-point.

Apps that consume APIs would be more sensitive to unexpected junk than browsers.
Is your list "customers of cloudflare" or "customers of cloudflare that could have sensitive data cached by search engines"

For example, Digital Ocean uses cloudflare, but the domain with sensitive data (cloud.digitalocean.com) is entirely blocked from Search Engines https://cloud.digitalocean.com/robots.txt
> No scientist treats published studies as gospel.

Why then do so many scientists in so many different fields insist "the science is settled"?
Yes, I found some leaked data referencing Discord still in Google's cache so I'd say it's them.
Unfortunately, people write microbenchmarks of malloc and free a lot (and not completely without reason: they do quite often show up high in profiles).

For example, binary-trees on the Benchmarks Game is basically malloc/free bound (or at least is supposed to be as Hans Boehm originally designed it). Likewise, most JavaScript benchmarks (V8 splay, for example) are heavily influenced by raw allocation performance. Many people choose browsers and programming languages based on relatively small differences in these results. All of the incentives align in favor of performance, not security, because performance is easy to measure and security is not.
Thanks for (re)posting this--the clear desk analogy was very communicative.

For a while, I found myself waking up and spending a good 20-30 minutes in bed just reading news, then I'd open up the laptop and browse HN while eating breakfast, and before you knew it, it was 10:30 and I still haven't left the house. Gotta spring clean again.

Thanks!
> In a memo made public on Thursday, Attorney General Jeff Sessions said the Obama policy impaired the government's ability to meet the future needs of the federal prison system.

> The Obama administration said in August 2016 it planned a gradual phase-out of private prisons by letting contracts expire or by scaling them back to a level consistent with recent declines in the U.S. prison population.

Yeah, dictators need places to lock up dissidents. Trump's foreseeing incarceration growth.
Well, brick is too harsh. I got mine up and running after redoing first-time setup routine.

But most people seeing a blinking blue light are not going to think "oh, I'll just open the WiFi app and a new network in setup mode..."
That zipper noise: To think that those are 30mm rounds being fired at that speed is just plain scary. http://www.xdtalk.com/attachments/img_7014-jpg.34438/

If one of those is lingering, I wouldn't even fight if I was the enemy.

It might not be able to kill a modern main battle tank, but I bet spraying it with rounds like that would fuck it up pretty seriously.
I read somewhere that they wore gloves before applying the poison.

Wikipedia has something interesting about VX:

> VX can also be delivered in binary chemical weapons which mix in-flight to form the agent prior to release. Binary VX is referred to as VX2,[6] and is created by mixing O-(2-diisopropylaminoethyl) O′-ethyl methylphosphonite (Agent QL) with elemental sulfur (Agent NE) as is done in the Bigeye aerial chemical bomb.

So maybe two of them were holding different component and they only reacted after being sprayed on Kim's face. If this is true then this is a very intricate assassination plan.
(not op) Well as it happens, Cloudflare has had this massive data leak you might have heard of...
> So now you have a company that isn't actually what it pitched itself to be.

This is just plain factually incorrect.

What the hell does sexism within the companies hiring and personnel have to do with -

"Uber was a platform for democratizing transportation, citing things like racism amongst taxi cabs to spin Uber as social good."

Seriously peoples logic circuits are broken beyond recognition here.

I guess this is why 'fake news' thrives. Could people please at least try and think logically? Or is this a lost cause?
This tiny $40 device can make any pair of headphones wireless
For eng workstations, virtually all are Goobuntu unless you have a reallllly good reason (e.g. CAD software for mech e's, or work on Windows Chrome).

For laptops, they're essentially just used as a dumb web terminal + ssh. You can get mac, goobuntu, or maybe even Windows. Since you aren't allowed to have source code on laptops (except certain special exceptions), it's not as big of a concern.
Since Cloudflare is a business partner of HN, perhaps it's best not to censor criticism of them...?
Pertinent facts for the worried:

1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

2) Even if git did rely on SHA-1, there's no imminent threat. What happened today was a SHA-1 collision, not a preimage attack. If a collision costs 2^n, a preimage attack costs 2^(2n).

3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's objects, they'd still have to convince you pull from their repo. This requires trust.

4) Even if you pulled it in, your git client would simply ignore their "poison" object, because it would say, "oh, no thanks, I already have that object". At worst, the code simply wouldn't work. No harm would be done.

When it comes to git, an attacker's time is better spent creating a secret buffer overflow than wasting millions of dollars on a SHA-1 collision.
You would have access to my server token, certainly. But I checked the documentation and in order to request rides, I think you would need other pieces of information that I did not expose. Additionally, there are various scopes that Uber grants regarding the API exposure that any application has.

I think / hope that the worst damage that can be done is hitting Uber's rate limit.

Definitely not defending my decision to include the server token, but I don't think it's the end of the world (just terrible practice).
It is difficult to make rational decisions when there is a political advantage to be had by misrepresenting the facts. Every system, whether private or socialized, medical or otherwise, has to decide to how allocate limited resources. When party leaders, along with popular media, can successfully label this "death panels," I don't see hope for a rational solution.
Use a taxi.
The kind of fraud that "voter ID laws" are supposed to protect against is "voter impersonation". The fear is that Lisa might know where friend Marge votes, show up to Marge's precinct, pretend to be Marge, and illegally cast a ballot as her. In this way, she could cast multiple ballots in the same election.

As far as I can tell, to pull that off at a big enough scale to affect national or even state elections you'd need to know:

* The voter rolls for a county. I think that, in California anyway, the best you can do is random access by looking up an individual's record using their name, phone number, mailing address, etc. I don't know how one would acquire the entire list of registered voter.

* Near perfect information about which voters will neglect to vote on election day.

The reason you'd need to know the second thing is that many attempts at voter impersonation have been foiled because the impersonated person eventually shows up to vote at their precinct — only to be told they've already voted!

You also need some logistics: enough people to make it worthwhile, vans to shuttle them from precinct to precinct, etc. The whole things seems way too complicated for an organization to pull off without somebody discovering it.

It seems likely to me that voter impersonation could only be a successful tactic in a small town or county's local elections, where you wouldn't need large numbers of people to turn the results in your favor.
No, how do you do that?
I would interpret it more charitably than that. He was responding to a claim that malicious collisions could be passed off as being pure chance:

> it could be incredible bad luck that caused that good-looking patch to be mistakenly matching a dangerous object
Guess which industry stands to profit quite obscenely from this move. And which not-so-coincidentally donated very handsomely to his campaign:

http://www.usatoday.com/story/news/politics/2017/02/23/priva...
True. I don't understand why many of us programmers are not interested in tools that eliminate the possibility of errors?

* Why do we use memoy-unsafe languages (except when Rust or GC is unusable)?
* Why do we use type-unsafe languages, at all?
* Why do we use state-unsafe (mutable) languages, at all?

Of course there are exceptions to these - but they are few.