skysight-inc/HackerNews huggingface dataset:
Apparently root case was:

/* generated code */
if ( ++p == pe )
goto _test_eof;

"The root cause of the bug was that reaching the end of a buffer was checked using the equality operator and a pointer was able to step past the end of the buffer. This is known as a buffer overrun. Had the check been done using >= instead of == jumping over the buffer end would have been caught."

Detailed timeline:

"2017-02-18 0011 Tweet from Tavis Ormandy asking for Cloudflare contact information

2017-02-18 0032 Cloudflare receives details of bug from Google

2017-02-18 0040 Cross functional team assembles in San Francisco

2017-02-18 0119 Email Obfuscation disabled worldwide

2017-02-18 0122 London team joins

2017-02-18 0424 Automatic HTTPS Rewrites disabled worldwide

2017-02-18 0722 Patch implementing kill switch for cf-html parser deployed worldwide

2017-02-20 2159 SAFE_CHAR fix deployed globally

2017-02-21 1803 Automatic HTTPS Rewrites, Server-Side
Excludes and Email Obfuscation re-enabled worldwide"

Seems like a pretty good response by cloudflare to me.
> Is anywhere else really any better?

Yes. A t-shirt contest is a joke of a security bug bounty.

https://hackerone.com/cloudflare (t-shirt)

vs.

https://hackerone.com/coinbase ($500-$10k) or https://hackerone.com/uber ($500-$10k) or https://hackerone.com/facebook ($500-$10k) or dozens of others...
People who write computer programs are "programmers", people who assign standardized codes to turn instructured domain information into structured data are "coders". These terms were both in wide and consistent use before some people (apparently people with narrow knowledge in tech management) decided to start calling programmers "coders".

Those of us working as programmers in environments where we not-infrequently work with actual coders appreciate the distinction being preserved.
seems really cool doc, thanks for that. it's a different way to look historical data on google.
Then that would require a breakthrough in FHE no? I believe current implementations would be way too slow for this.

Or is there another way to outsource computation in a secure manner?
Add Paolo Gentiloni (Italy) and Alexander Van der Bellen (Austria) and thats already 14% of european union. I shouldn't have said "many", but "more than comfortable".
It is very painful for me to develop on Windows. The development tools seem very disjoint and not integrated with the OS. Some projects are cygwin, some are Visual Studio. A lot of the Visual Studio options are tucked away in different configuration dialogs. Command prompt is bordering on useless. On *nix I can do everything I need to outside of an IDE, if I run into a problem, there is documentation for just about every program. OSX is pretty nice with brew. At the end of the day though, Linux just feels like it was made for developers.
> It was not a bug it was not a theft, the DAO worked perfectly as designed.

By that definition of a 'bug', all bugs work perfectly as designed. I mean what is your definition of a bug then?

The DAO's code allowed a person to ask for money to be taken out before the balance was fully updated, this resulted in the attacker taking money out over and over and over.

This clearly was not the 'intent' of the creators or any of it's investors.
All that that tells me is that switching is hard.

I use both Linux Mint and MacOS on a daily basis and I can't say that one really is better than the other. I'm sure it would be the same with Windows if not for the fact that I need some unix-y stuff.

I do have a use case that I would really like to get on my primary laptop that neither Mac nor Linux currently offer: Detach screen and use stylus to annotate pdfs. If I was using windows on a surface this would be a major part of my workflow, and I would find it impossible to switch back. Doesn't prove that Windows is superior. (Maybe I will end up dualbooting Windows and Linux on a Surface or Yoga or some such thing eventually).
https://golem.network/
I'd expect for a company that can MITM a good chunk of the Internet to incur that pain in exchange for all the money customer pay them.
A country only needs one leader to do significant damage. ;)
From github, the first time only. Not every single time.
I am almost certain someone is scanning archives for this data and reviewing it for anything sensitive now they know it exists. Yesterday when Google announced the SHA-1 collision, someone else took that and used it to unlock a 2.4btc reward, at the same point a bot scanning for this attempted to double spend the reward with a higher fee to claim the reward.

The first guy knew how to take advantage of the information but the second guy could sit and wait for someone else to solve it and take the reward, it also meant the bot programmer wasnt in a competition with everyone to submit the solution first.

Given that there are many bitcoin sites listed with cloudflare there is some potential reward in locating and scanning that data.
American College of Pediatricians, “Gender Ideology Harms Children”
Taxing robots is easy. Just tax every company with a fixed amount and then give them a tax rebate when they employ humans.
She does not regard her fear as irrational. She is choosing to let her fear limit where she will take her next vacation because she believes the danger is real. She thinks that by choosing to not travel to France she is reducing her exposure to a real danger.

Another point she made during our (far ranging) discussion which I didn't mention, was that she regards Islam as part of the cause of terrorism. In my mind, (as a non-religious person who thinks all religions are crazy but not all religious people have to be) -- this is an idea which is pointless. Its an idea which is dangerous if many people believe it or basically harmless if most people don't. I tried to argue that the relationships between muslim communities around the world and Islamic Terrorism were cultural rather than religious but she rejected that, suggesting that something specific about the terms of the religion as dictated in their holy texts/rituals were an important part of the Islamic Terrorism phenomenon. She disagreed with me when I argued that terrorist attacks in the west were primarily the result of people with random assortments of psychotic mental illnesses pattern matching against propaganda on the internet to find 'reasons' for conducting their attacks -- much more so than from some fundamental aspects within one of the largest religions in the world ...

My preferred hobby is rock climbing which involves a fairly direct dialogue with the fear response. Accurate risk assessment is a visceral part of the process of maintaining safety in rock climbing. I tend to be sensitive to scenarios where over-estimating risk actually has counterproductive effects on safety. Not only do I disagree with her because of my perceived errors in her personal decision making -- but its also my opinion that this error is too common and should be called out for what it is, because mis-allocation of fear becomes increasingly dangerous as it becomes more common.

I think the capacity for the fear of terrorism to justify horrible decisions is clear and supported by historical evidence (second Iraq war). Playing to fear of terrorism -- by condemning the party in power for failing to be hard enough, by things like muslim bans, and by attempts to kill them over their so we don't have to kill them here are real phenomenon whose real world cost far exceeds the actual damage from terrorism. Us not going to France for holiday because of fear of terrorism ultimately supports other much worse irrational actions ...

I think the way she justifies her fear of muslims and the way that she prioritizes that over other forms of fear is racist ... I think I'm reading in the responses to my comment that maybe the takeaway sentiment is that -- (a) she isn't alone in feeling an irrational fear as she does, (b) she should strive to acknowledge that her fear is irrational and (c) she should try to work to not let it govern her actions. So ... does that mean that we should travel to France or not?
Do we really need to reinvent the wheel when it comes to taxes? Tax personal and corporate incomes, just like we do now.

If someone is able run an automated business with no employees, just tax the profits and income. Nothing changes.
Traffic fatalities have ticked up quite a bit in the past couple of years, with about 40,000 deaths in 2016, but the rough magnitude is correct.

But I'm specifically talking about hate crimes. The vast majority of those firearm deaths were suicides, and the vast majority of the homicides weren't hate crimes. According to the FBI, there were 18 murders that qualified as hate crimes in 2015 (the most recent year available): https://ucr.fbi.gov/hate-crime/2015/topic-pages/incidentsand...
It's just my opinion of course :) but I think css-in-js is a step backwards in the majority of cases. I do like CSS modules in terms of scoping / modularity, but I don't want to replace CSS with (what I consider to be) really gross JS implementations.

I don't want to discourage people trying new things, but I also don't want people to waste thousands of collective hours dealing with crazy configuration.

I think toying around with those things are fun for people who get paid by startups etc, but for those of us who simply want to get things done, the ecosystem is not enjoyable.
But it did impovrish them. How big a percentage of the population needs to have it worse that automation becomes a burden on society?

I think automation will happen no matter what, but in the meantime, sometimes it might make sense to slow it down. Saying there is no such reason for slowing it down is a simplistic point of view.

EDIT: You edited your initial comment and I find it commendable you changed your stance based on new information. (relating to Luddites and technological unemployment)
STIGS say that if it is open source and unencumbered by contract support requirements that it is fair game. Use IA's own hammer against them. It's right in the AppDev STIG.
Study finds unattractive people as successful as attractive people
SF Libraries are a safe haven for homeless ppl but locals seek to exclude them
I don't think we have to wait for white collar jobs to disappear before automation disrupt's society. Because if Trump and Brexit and their very pro working class messages are any indication then automation doesn't have to hit white collar jobs to disrupt society, it already has.
I don't know exactly how they work, because I'm not a tenured full professor on a committee, deciding which candidate for hiring (or tenure, promotion, or whatever else) has the best CV.

I would guess that original research showing significant results, published in a major journal, with a lot of citations by peers, earns the most points. You have to ascend higher on the prestige point leaderboard to get the career advancement achievements and character perks.
> "Oh but I want to do with my phone what I want"

The ability to browse a legible file system on the computing device that I own is not some trivial preference which can be so lightly dismissed. It is a huge deal to a lot of people. There are at least half a dozen reasons why I vastly prefer my Android device over iPhone (after using the latter exclusively for many years), but this one is enough all by itself.
IA is there to tell you no. You have to make the case to the aquisition organization and the end user that not using the tool is a greater risk to the mission than using the tool. And remember what you're developing may outlast your career- maintenance and sustainability are much bigger issues to the DoD than any discomfort caused to the developer, even if it means schedule slip.

And for what it's worth, open source has been used pretty widely on the projects I've worked on- there's risk being tied to a single vendor and most acquisition orgs get that. The rare cases where we couldn't use O/S were usually situations where someone was trying to do something on Windows machines and they were trying to fly under IA's radar.
Yeah, from what I've heard the Chinese ones come with this sort of stuff pre-installed!
How Customer Service Employees Make Good Managers
The lambda calculus preceded Turing machines, in fact Turing worked on the lambda calculus before he published his work on Turing machines. Where on Earth did you pick up this rubbish?
Here in Texas, upon realizing that most of the improperly cast ballots they had trumpeted as voter fraud were cast by eligible voters, Republicans are now drafting a bill to make it illegal to lie on a voter ID affidavit. In other words, they want to make it possible to prosecute registered voters who accurately identify themselves at the polls and cast a ballot in an election they're eligible to vote in.

Sounds creepy and far-fetched, right? Surely they would only use a law like that to punish voter fraud. Oh, but they're already talking about prosecuting registered voters who voted in the last election.[0]

How are they going to do that? Well, it wouldn't be possible if voter fraud were real, because all they have to go on is the affidavit forms filled out with the names of eligible, registered voters. The real perpetrators would be a mystery. But if you assume that voter fraud doesn't happen, that all of the ballots were cast by eligible voters voting honestly as themselves, then all you have to do is track them down by their voter registration records and prosecute them for perjury.

For every eligible voter they arrest, ten thousand will be scared away from the polls. For every person they prosecute, a hundred thousand registered voters will avoid the polls for fear of breaking the law. (I have no idea if those numbers are overstated or understated. The point is that it's well worth their effort even if they don't convict anyone. I'm sure they accomplished plenty just by floating the idea.)

Remember this when you're wondering how "close" we are to authoritarianism in the United States. It's here. It has always been here. It just isn't evenly distributed. There's a constant battle to incrementally expand it in one place or roll it back in another. Dribs and drabs. Boring politics.

It would be cliché to say if you're reading this then it will affect you last -- cliché and wrong. By design, this kind of disenfranchisement will never affect the vast majority of the American registered voters reading this on HN. We have the financial means and the technocratic know-how to abide by whatever rules they invent to reduce the voting power of the underclass. If you're black or brown, so much the better. You will probably vote successfully, and they will point to you as proof that the system works and democracy has not been subverted.

Did I mention that the votes in question were never even counted? So I should have said they're considering prosecuting eligible, registered voters who tried to vote as themselves but had their ballots thrown away.

[0] "The chief election officers in two of the state's largest counties are now considering whether to refer cases to local prosecutors for potential perjury charges or violations of election law." http://www.dallasnews.com/news/texas/2017/02/18/hundreds-tex...

The Republican take on what happened: http://www.foxnews.com/politics/2017/02/19/hundreds-texans-m...

Another take; you decide: https://www.nytimes.com/politics/first-draft/2014/11/18/texa...

More background: https://www.nytimes.com/2016/09/08/us/court-filing-accuses-t...
That is a very important point!
The Luddites were wrong in the sense that they and their children for the most part had far better jobs than they did before the power loom. Automation has always caused improvements in the occupations that exist.
Allow me to rephrase:

"So why is a hostile work environment somehow one of those things that are unjustified no matter what?"

Words matter.
GoJS 1.7 Released – Interactive Diagrams for the Web
Correct, but how many people died in the average fatal car crash?

Also, how many of those gun deaths were accidents, suicides, etc.?
The Grim Truth Behind the ‘Winner Effect’
Exactly! You can't give in to even the idea of restricting knowledge.
Kansas man shoots two from India in hate crime, killing one
> for the host-your-own version are there any HA features for Postgres?

Not right now. This is definitely on our roadmap though.

> what language is it written in? GitHub link?

It's mostly in Haskell, with smatterings of Python. Planning to open source it soon!
I think you've misunderstood the conversation. I am including getting shot while having a normal conversation in a bar. When I pointed out how unlikely it is to get shot as part of a hate crime, the response moved the goalposts to include "a whole spectrum of bad things that could happen" including non-fatal harassment and discrimination.

Having someone call you names or refuse you service, while bad, isn't what the original comment was talking about.
Have you tried the Windows Subsystem for Linux? You might be able to get by without a separate Linux install.

https://en.wikipedia.org/wiki/Windows_Subsystem_for_Linux
Recycling memory buffers, like CloudFlare does?

https://blog.cloudflare.com/recycling-memory-buffers-in-go/
How are you going to "fix" that amount? Does every hosting company must pay X amount of $? Or is it based on annual sales? If the latter, It should be fairly easy to open a new company after you reach your sales target.
...I kind of hope so.
Trump, Putin, and the New Cold War
There must be a further vetting process beside whether or not an open source library has contract support requirements. Otherwise GOV developers could just pull some Chinese student's OSS encryption library for their next VPN project... Oh wait, there's FIPS. This blanket statement you've made isn't very meaningful.
> I don't understand why there's such a drive for taxing high earners.

Envy, mostly. That and the thought that wealth is a fixed sized pie, so if someone is rich that must be causing others to be poor.
Oh wow, that's embarrassing for me, but thank you!
In all honesty, I need to try building something that does semi-distributed computation. Here's my idea to throw in the pool.

First, you don't get something for nothing. So you need computers (surprise). Now, how do you share code? You can share code directly via IPFS. Now, admittedly, binary is the fastest, but limits your architecture rather greatly. So an interpreted language seems better.

I'm looking at Erlang, given its functional attributes and ability of swapping code with no downtime. It also works in a cluster.

I also look at Tor for entry points to get requests on these machines. We already can interact with IPFS for files, but it has no logic capability. And Ethereum is a joke in many ways (and it simply can't interact outside its blockchain).

The idea: IPFS filestore for storing functions, and chaining IPFS hashes to be ran by a Erlang cloud connected by Tor Onion links.

It's not completely serverless computation, but you can ideally abstract out the server so it doesn't matter where it is, or who handles it.

Other ways to go about this would be homomorphic encryption (way too computationally expensive at this time)... Or some sort of trusted computing (shudder).
> We live in very different bubbles

HN is a North American bubble, mostly Silicon Valley. Apple computers are a thing only in North America and parts of Europe.
First party, as in, provided by Microsoft.

I just ran Win10 for the first time yesterday to work on a security guideline and I was blown away by how janky the whole thing was. Using it is like crawling through 20 years of computer history; there's things from every phase of Windows since '95 in that UI, and I don't mean UI hints, but entire applications.

I bet somewhere in there there's still UI that dates back to Win3.1.
Would you consider taxing automation in current industries with high structural unemployment for the purposes of giving displaced workers the resources to change careers?

Or more general if a person or group of people are let go because their jobs were automated then that automation is taxed for X number of years for the same reason.
I've said it before and I'll say it again:

Uber has started a revolution. I do not require them to survive it.
It depends on the size of the chunk of allocated memory. If it is quite large, time spent zeroing it can be substantial.
Then again, if you're allocating in performance critical path, you're doing it wrong anyways.
This post had a lot of thought and effort put into it. I have no idea why it's downvoted. Regardless of whether you agree or disagree with the premise, it's put forward in an excellent manner and that's what we should strive for here: quality discussion.
> avoiding the "end of life" blackmail

People usually think that costs nothing, until they get bitten by it.
Sia [http://sia.tech/]; filecoin; Storj [https://storj.io/]; maidsafe [https://maidsafe.net/]. Sounds like someone could do a good comparison article. Does anyone have any experience of using any of these? They do take quite a bit to set up compared to, say, Backblaze B2 or AWS S3.
Jet fighter projects are late. Should they source electronics from Russia?
It appears that the claim of states rights only applies when they know the states will go their way. This would be a PERFECT test case for such resolve.
https://news.ycombinator.com/item?id=13722744
I honestly don't know about how quickly you'd have to cut out the affected region, or even amputate the limb. My guess is that if you were very lucky and it missed all major blood vessels, you'd have seconds to act decisively. Maybe.

As to the rest, yeah definitely. Just consider the B2 bomber. I always wonder what's hidden away being tested in the same way that was.
This seems like working on a similar space as loopback.io, is this correct? if not, how would you compare the two?

I ask because I'm currently using LB for a project and while I actually like it a lot I always like to be aware of alternatives and similar tools that I might need in the future.
From the Flare website

"4.1: Why is the Singularity Institute interested in Flare?

"AI has always been one of the traditional drivers of programming language advances, although usually for the wrong reasons. We don't think AI is so simplistic that the thought processes have anything to do with the idioms of the underlying programming language, but we also think that current programming tools are simply inadequate. It would be really hard to code an AI in a non-object-oriented language and it probably won't be easy to build AI in a non-annotative language either. Flare, an extensible language easily modifiable by Flare programs, will let us write more powerful tools, and will let the AI introspect and tinker with its own source code, without our needing to become compiler and interpreter specialists."

"If there's no production-quality Flare language by the time the Singularity Institute begins writing code on the AI project, as seems likely, then we'll probably be forced to write pseudo-Flare programs in Python, at least for the prototype. But we won't have to like it, and we'll still want to switch to Flare as soon as possible."

The Singularity Institute has embarked on a long-term quest to develop real AI. They don't want to stop there, either; they want to develop recursively self-improving AI, Friendly AI, and transhuman AI. The Singularity - the technological creation of greater-than-human intelligence - is a quest of such mind-boggling importance and earthshaking impact that our words cannot even begin to describe it. (You should go read their website.) Even if you've never heard of the Singularity Institute and you're getting involved in Flare solely because you love annotative programming, we still hope that you get a warm fuzzy feeling from helping to bring about a swifter and safer Singularity. "
When you solder SSDs and RAM into a machines logic board that doesn't exactly make your very expensive investment future proof. Let alone glue a battery into the case and the battery life is horrible on my touchbar MacBook Pro.

Apple machines are now appliances that cannot be modified. They are throw away, so spend your dollars wisely.