skysight-inc/HackerNews huggingface dataset:
Why? What makes it reasonable to search all passengers on a plane to find an undocumented immigrant, that wouldn't also make it reasonable to search all passengers on a bus, or all congregants at a church, or all pedestrians at a crosswalk, or similar?

What happens if I don't have my citizenship papers with me? Is ICE going to take my word that I'm not the person they're looking for and I'm actually a citizen?

Why should I, a natural-born US citizen, be obligated to carry my citizenship papers around with me in any of those situations just in case ICE decides to show up? I have certain rights as a US citizen, and one of those is that I expect to be able to travel domestically without carrying my papers and without ICE detaining me.
Normally I eye roll whenever I see that there is some sort of reply to anything from Linus, but this time I agree with him.
Show HN: Instance-drainer – cleanly remove current AWS EC2 instance from its ELB
Not just headers, basically random memory dumps that could contain anything that Cloudflare saw (which is almost everything). Passwords, certificates, you name it.
personal hug box, with areas to challenge your creativity and request the harshest of criticism if you so desired.

putting yourself out there in this way was also part of the networking aspect, as it was hard to get any attention to your artwork.

as we've seen to this day across a plethora of networks, nobody has come up with a real solution to discoverability in the face of volume, and I fear machines are just going to learn to do it the same way as humans.
Those of you that need (outdated) proprietary software should just give up on security to begin with, PGP or no PGP.

>if you can get root on the client device, you own everything.

No security model will protect you from a compromised system.
My guess is he still had a network connection up when he did the copy. These kind of things like JAMF, osquery and so on upload what you do on your computer on a fairly frequent basis. After a certain company size all of them do something like this, and most of them do not spell out the amount of spying they do on their employee's work devices and office space.

Or he didn't do a secure wipe when he reformatted the drive and google inspected the computer when he returned it.

OR google modifies their laptops and has separate chips logging this stuff, which would be fairly impressive!

Or he didn't actually do any of this alledged stuff and it's all innocent.

We will find out in the court case either way!
You are essentially arguing against freedom of speech. Cloudflare will protect any site that doesn't host child porn. Yes that includes things which you don't like, but it also includes all the things you do.
Because you'll make much more working for people who specifically hire you instead of doing a bunch of risky work on spec.
If Cloudflare accidentally leaked additional sensitive data to Tavis during the handling of this incident, and that data wasn't already compromised by the parser bug, then you should call that out in the incident report.
"Targeted shooting"? That's a no-shit assassination. All it needs is Chow Yun Fat and some sunglasses.
Ellen Pao: Toxic Behavior at Uber Reveals Tech's Existential Rot
Ugh -- browsing on a desktop now I clearly see there are two sample PDFs, and:

host$ sha1 ./Downloads/shattered-*
SHA1 (./Downloads/shattered-1.pdf) = 38762cf7f55934b34d179ae6a4c80cadccbb7f0a
SHA1 (./Downloads/shattered-2.pdf) = 38762cf7f55934b34d179ae6a4c80cadccbb7f0a
host$ md5 ./Downloads/shattered-*
MD5 (./Downloads/shattered-1.pdf) = ee4aa52b139d925f8d8884402b0a750c
MD5 (./Downloads/shattered-2.pdf) = 5bd9d8cabc46041579a311230539b8d1
host$
How early investers in snapchat screwed up the founders
What I said:

> you can't install yourself as a worker with your own personal goals of changing a company's culture

From their letter:

> As early investors in Uber, starting in 2010, we have tried for years to work behind the scenes to exert a constructive influence on company culture.

What strawman?
I take a different view. I would expect the airline to know the full name and age and travel history of every single person on the flight from SFO->NYC.

Did they tell CBP that the person was on the flight?
Did they tell CBP that the person may have been on the flight?
Didn't they know for sure?

Don't we have computers now?
The problem is conservative economic philosophy depends on letting a problem get bad enough that the typical customer becomes informed. How many people do you want to get MDR TB before people are sufficiently interested in the topic to become informed enough to make rational decisions in a well-developed market?

I'm not sure people realize how much the public health labs do that would simply never pay, yet saves lives: who's going to speciate and sequence rare, but highly contagious or virulent organisms (like MDR TB) isolated from some one homeless person, who, by virtue of their unfortunate circumstances, serves as a canary in the coalmine of the modern city.
It can host more than just plaintext
https://txt.fyi/+/36d433e6/
AI? Maybe not quite, but sophisticated analytics influenced the election
What was the outcome of this lawsuit?
Not in a vacuum, difficult in near-vacuum (relevant for Musk's Hyperloop).

Also hovercraft are not known for efficiency. Ground-effect airplanes on the other hand can be nearly as efficient as cars.
Yeah, I saw that too. I guess I have no idea what it means to be "under the sole and exclusive jurisdiction of the United States." I wonder if that clause (or anything like it) has ever really been litigated.
it doesn't seem to matter since _ANY_ service that CF gave data to could possibly have cached it and thus have a random site's secrets.
Sure, I was more replying to the insinuation that the value went up now that they've been found, by showing that it was always reported as 10k.
> I had the impression that all the "soft" science is based on statistics.

In medicine, case studies are often used for low n issues. There are too many variables for meaningful statistics to be pulled out, but a "this patient had X, we did Y, Z happened" is still a way to pass on observational information. It's recognised that case studies aren't ideal, but it's still better than not passing on information at all.
The Distribution of Prime Numbers on the Square Root Spiral [pdf]
Judging by the number of people I see on my feed who share Onion articles without realizing they're satire, it's pretty clear that the ability of many to think for themselves is lacking.
That may be a good analogy to make but it is not that simple. I am going to try find it, but there was at least one paper showing how it really depends on the placement of the kind of actors in a system. Enough (but an easy minority) of good actors in a system could "clean up" the system by ensuring everyone acts well. If you want a more relatable simple analogy is a benevolent dictator cleaning up the mess.
The best you can do is to just learn stuff that is useful to you on a everyday basis. There's too much stuff to remember anyway, so there's no silver bullet for forgetting.

my take is this: if you forget, it's not very useful/valuable knowledge and you shouldn't feel bad about it.
Thanks for posting that, I found it intriguing and ended up watching the entire video. Amazing to think this was back in 1975!
So it's fixed, then? (I haven't read the article yet.)
Free Download APK File of the Contacts   v5.39.9 for Android – APK4Fun
It's strange that reddit would enable that kind of activity. Are moderation logs not public?

Makes me wonder what other communities are oblivious to moderators influence.
Another implication: they could be using their access to these sites' traffic to prepare their own infrastructure for attacks before they happen.

There's nothing about their hosting of these sites that doesn't reek.
And I don't. I believe that investors who would be quiet in this situation have shown that they have absolutely no scruples or morals.
Why I Created Invigoral-Chapter 3
Yes to all of this.
Kapor Capital focuses on funding companies that strive to make positive social change. Uber's behavior pretty much forced Kapor into make a statement; staying silent while touting their message of diversity would look extremely bad.
That's just not true. I've gotten on planes without ID before, after losing my driver's license. I got patted down extra thoroughly, but there's no issue of legality.
Simply firing people that have committed a certain offense may not fix the underlying problem—only treat the symptom. But I agree that sexual harassers should be separated from the company.
the ratio of relevant new relevant to this problem information/new information is low.

If a low signal/noise ratio is still the purpose of information then the thread is less interesting than Linus mail:

- if we add size it will make forgery harder
- yes SHA1 should be replaced

What linus is missing is people rewriting history. This will not be a concern for git, but certainly will for any crypto currency relying on SHA1 in a close future. (Hint this transaction belonged to me)
Because the 10k people that would fall for such a trick (and I don't doubt there's at least 10k of them), are most probably already part of at least 23 other botnets.
I ... didn't say any of that.
As I said, I support gun control but don't see it as a viable political goal. So I guess I won't be stunned if gun advocates continue to gun advocate.
++++++++[->++++<]>[->+>++>+++>++++<<<<]>>>---------.+++++++++++++
++++.>-------.<<<++++++++++++.------------.>>------.>-------.<-.+
+++++++.>----.<---.>+++++++.<---.++++++++.<<++++++++++++.--------
----.>>++++.---------.<<.>>---.>------.++++++.---.+.<++.<<.+.
It's a variant of JS in that it uses curly brace syntax, but that's pretty much all it has in common with JS. It's statically typed, class-based, and all numbers are integers.
It's easier to use and to reason about a uniform hash, but you can design a secure system with a non-uniform hash.

I'd be willing to bet that an altered version of SHA3-256 that replaces four bits in the middle with length%16 is better for most purposes than SHA256, despite being non-uniform.
Artificial synapse for neural networks
GOD THE CREATOR HAS SPOKEN THE WORD THRU THE QURAN,LISTEN AND YOU SHARE – YouTub
Interesting. I hadn't heard of that before. Looks like it's just Chrome doing this?
Thankfully the old "blasting links" type of SEO is pretty much dead now.
I think your estimates fell apart at step 2, 1/1000 pages being cached. HTTP is aggressively cached, on many different layers. I'd put it closer to 1/10.
No, but accepting the ride before seeing the passenger's face does reduce discrimination. Just like blind resume reading does (although, see sibling comment by cstejerean). "More or less fix racism" is a wild exaggeration, but being safer, less-discriminatory and less-corrupt than taxi services in parts of the developing world is quite a feasible bar to meet for Uber and they in fact do often meet that bar.

That said, one can meet that standard, and provide a better/cheaper transportation service and everything else in Uber's mission without standing for a toxic workplace environment for women, no matter how much they are or aren't paid. There is exactly one profession where the amount of money you are being paid justifies tolerating unwanted sexual overtures and is not the profession software developers are signing up for.
> Presumably 2 consecutive requests to the same malformed page could/would leak different data.

Wouldn't the second request be served from the CDN cache? Since for Cloudfare that particular page is a valid cached page, it would send you that same page on the second request.
> The infosec team worked to identify URIs in search engine caches that had leaked memory and get them purged. With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains. The leaked memory has been purged with the help of the search engines.

So I tried it too, and there's still data cached there.

Am I misunderstanding something - that above statement must be wrong, surely?

They can't have found everything even in the big search engines if it's still showing up in Google's cache, let alone the infinity other caches around the place.

EDIT: If the cloudflare team sees I see leaked credentials for these domains:

android-cdn-api.fitbit.com

iphone-cdn-client.fitbit.com

api-v2launch.trakt.tv
Businesses are people. A very special kind of people, even. The best kind.
Software Prefetching for Indirect Memory Accesses
Certificate issue temporarily disables 1Password on Mac
Ask HN: Why are Yahoo comments sections overrun by seemingly unhinged people?
I take about 100% of the stuff I read on Yahoo! with a grain of salt, as most should. That being said, when there is anything of interest to click on, the one place you can guarantee to be morbidly entertained and disappointed with society at the same time is the comments sections. I have my suspicions of the possible types of people that still have Yahoo! usernames, that make the effort to leave comments, but my question to this community is, who are these people?
This seems relevant https://i.imgur.com/l4kjNba.png
Maybe less so when you do the math and find you can buy a similar machine for something like 4-5k, and use it for 3 or so years?
That's a lot of "Approx. X pounds of knives/boxcutters"
Essentially. Any headers from any site routing through cloudflare could get injected into the body of a second site's page if that second site was using the obfuscation feature. Those "mis-stuffed" pages could (and were) then cached by, among other things, crawlers like those operated Google and Bing.

Apparently 7xx sites had this enabled, but that affected 4000ish other sites that happened to be on the same infrastructure.
If you're disabled they'll stick you on fentynal for $0 on Medicaid, keep you on opiates for life but medical cannabis has no support for the disabled even though the side effects are nothing compared to opiates. Lack of Medicaid funding for medical cannabis is a major driver behind the opiate crisis.
https://webcache.googleusercontent.com/search?q=cache:lw4K9G...

Internal Upstream Server Certificate
...
/C=US/ST=California/L=San Francisco/O=Cloudflare Inc./OU=Cloudflare Services - nginx-cache/CN=Internal Upstream Server Certificate

That really doesn't look good.
The point of bug bounties isn't to attract the interest of people who are working to find bugs. It's to make sure that if someone is finding bugs for fun or stumbles over bugs by accident, it's worth their time to report the bugs.
Google at least proxied everything over their own private fiber. Cloudflare proxies it over the public internet on a long route (since they terminate SSL as close to the client as possible).
There is that, though the documentation somewhat resembles a Pile of Index Cards itself.

I've been following a similar concept myself, including adopting many of the conventions described by the author of this piece, though not quite to the extent of edge-marking cards (I'm also not using quad-ruled cards).

I'd been using a time-ordered "dock", though am in the process of organising one set of cards (associated with ongoing research) into a structure that more closely resembles the ontology I'm using for that project, as well as some administrative elements. Essentially:

1. Planning.

2. Bibliographic cards. Both obtained and unobtained (materials I'm hoping to acquire).

3. Biographic cards. People associated with the topic(s).

4. Organisational cards.

5. Open questions -- for research.

6. Topics -- the project structure itself.

7. Writings -- various pieces being written based on various subsets of cards. I'm still thinking of how to dispose of those cards once I'm done with them.

Cards, boxes, and other elements lend themselves to certain types of organisation, including edge marks, conventions, colour-coding, striping (talk to old punch-card hands about deck management policies), etc. It's interesting.

There are also affordances (and limitations) of card-based information capture. Search is an obvious compromise, but there's also a much more fluid capability to create and designate conventions than with software-based systems. The ablity to rapidly scan a fairly sizeable card deck (100 - 500 or so cards) beats many electronic formats. The ability to flexibly organise cards on any given surface (desk, table, floor, wallboard, etc.) is another element.

I've run across a few further references to card-based research techniques, including:

* Carl Linnaeus inventing index cards -- as he was engaged in the process of devising his own ontological classification scheme. His was among the first known cases of information overload. https://www.sciencedaily.com/releases/2009/06/090616080137.h...

* John McPhee, author, who uses index cards to both find and define the structure of his own works. See "Structure", 2013: http://www.newyorker.com/magazine/2013/01/14/structure

* Nklaus Luhmann, German sociologist.

* Vladimir Nobokv.

* Garrett Hardin -- his office was an absolute warren of card stacks and boxes, as well as books and papers.

Several of these examples are mentioned in a Guardian column by Oliver Burkeman: https://www.theguardian.com/lifeandstyle/2009/may/09/health-...

The challenge for me has been finding useful organising and management principles (and tools), hence casting about for articles.

This one has been posted to HN previously, though the accompanying Flikr stream rather than the blog.
It's pretty easy to do - have your build tool generate a hash of the bundle and store that (simplest way is a json file with the file:hash as a key:value, obv other ways are possible)

Webpack has built in support for this as it generates chunk hashes and can output filenames with them in it, then you just get that data and do the same as above.

How you put that in your Rails app is up to you - could be a simple helper like javascript_tag, that would be easy to do.

Rails really didn't have any magic to the asset pipeline in that regard.
> But in the wild, there aren't separate rooms for predators and prey, either.

In the wild, there are plenty of mice that aren't in the vicinity of rats.
How does Google Maps get this information? They probably have their middleware, right?
it seems to me you'd have to know at a minimum:

1. every tag pattern that triggers the bug(s)

2. which broken pages with that pattern were requested at an abnormally high frequency or had an unusually short TTL (or some other useful heuristic)

3. on which servers, and at what time, in order to tell

4. who's data lived on the same servers at the same time as those broken pages

to even begin to estimate the scope of the leak. and that doesn't even help you find who planted the bad seeds.
Just to point out, this is apparently a cert used for communicating between Cloudflare's services which has (presumably) been replaced. Cloudflare customer's certs weren't exposed.
Can you think of an existing system (let's go with websites) that meets your standards?
What does that have to do with git?
Google Pixel XL, four months later (LTE performance analysis)
Actually AFAIK this specific attack doesn't let the two files have different lengths, so the size header is irrelevant anyway.
Outbound.io can now tell you when to send a message to users
and he also made anti-legalization comments.
Yes. Think of it this way.

You have a function that strips all colons from your input. For some reason - in certain cases - your code misbehaves and when you are replacing the colons with an empty character you accidentally replace that colon with other data you have in the memory. So now all the colons in your input have been replaced with data that you shouldn't have touched. So now whoever sent you an input, gets back that input + more data they shouldn't be able to see.

And Google in this case caches those output strings.
1Password has said via their blog that nothing was compromised whatsoever: https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...

More details are promised in the coming days.
Sure, when you have physical access to the device, which wouldn't seem to apply at all here.
I wonder if archive.org or archive.is have anything cached...
That's a great defensive technique. But even when you do that, the underlying bug should still be fixed. I don't think the equality operator is the underlying bug.

Consecutive pointer increments without a bounds check in between sounds like a bug to me. But I don't really know Ragel, and perhaps the compiler doesn't have enough information to determine this is what's happening.
I'm not aware of any crypto currencies that rely on SHA1.

Can you name one that does?
This was interesting:

"Based on his review of the scientific literature, between 10 to 30% of regular users will develop dependency. Only about 9% will have a serious addiction"

https://www.psychologytoday.com/blog/the-teenage-mind/201012...
It may seem like a nightmare Internet data security scenario, but it looks like Tavis is going to get a free t-shirt out of the deal, so let's just call it a wash.
A Stray Email Caused Google’s Waymo to Sue Uber and Otto Over Stolen Tech
According to their blog post about this issue they use multiple levels of encryption to guard against compromise at the SSL/TLS layer - https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...
Here's a question your blog post doesn't answer but should, right now:

Exactly which search engines and cache providers did you work with to scrub leaked data?
It's still UB. The array could potentially be at the end of the address space...
> it seems odd that each self driving car company would want to design their own

They don't want to do this, so, if they do, it's because they had to do this.

Practically all of the current sensor suites are expensive, bulky, and power hungry. If you want them on lots of cars, you need to reduce all 3 of those characteristics dramatically.
According to one study (relied upon by a US Federal judge in a voter ID case in Texas), 600,000 registered voters in Texas did not (as of 2014) have any form of ID that would be acceptable under Texas' new voter ID law [1]. That was about 4.5% of all registered voters in the state.

[1] http://www.politifact.com/texas/statements/2016/apr/22/tom-s...
With an SSD it only slows down my system enough that I know I need to free up some memory.

But it allows me to save, exit a program, or close a tab, without losing any work.
I'd like to know what kind of motherboards they are using that support up to 8 NVMe drives!
whois $(dig +short yoursitehere.com) | grep -i 'Cloudflare' 1>/dev/null; if [[ $? -eq 1 ]]; then echo 'Didnt find CloudFlare'; else echo 'Found CloudFlare'; fi

Not at a terminal now, but this long one-liner should work.

Like you said, not 100% reliable though. For example, I'm pretty sure Reddit uses CloudFlare, but their whois mentions Fastly, which is a competitor.
This is going to be interesting to watch. Alphabet just:

- went nuclear on Uber/Otto

- revealed what they track internally to all their employees
I'm not saying that's all they should do but, fundamentally, all the policies, training, press releases, investigations, CEO statements, etc. are secondary to the core test of whether bad behavior is encouraged, ignored, tolerated, slapped on the wrist or punished severely.
The size is useful when you want to know the length of an object without unpacking it. The size is uncompressed length and not the size on disk.

For example, if you want to stream the blob over http you can use it to set the content-length. Otherwise, you have to use chunked transfer.
Seems kind of pointless. Only thing that will change is I'll have to get my weed from a dealer like in the old days, instead of a dispensary. Good way to kill good paying jobs, asshats.
Correct. That's that cert.
This is utterly factual. If the facts are shameful, that's on the person who created the facts about them, not on the reporter.
Insight on Climate Change