skysight-inc/HackerNews huggingface dataset:
Best-selling? Sure, I can believe that. Pent-up demand alone likely accounts for much of it.

Best-selling to developers? Not a chance.
BrandChecker – Another quick way to check usernames in bulk on social networks
It is small indeed.

$ diff -u <(xxd -g1 shattered-1.pdf) <(xxd -g1 shattered-2.pdf)
--- /dev/fd/63	2017-02-24 12:25:17.311939732 +0530
+++ /dev/fd/62	2017-02-24 12:25:17.311939732 +0530
@@ -10,14 +10,14 @@
0000090: 72 65 61 6d 0a ff d8 ff fe 00 24 53 48 41 2d 31 ream......$SHA-1
00000a0: 20 69 73 20 64 65 61 64 21 21 21 21 21 85 2f ec is dead!!!!!./.
00000b0: 09 23 39 75 9c 39 b1 a1 c6 3c 4c 97 e1 ff fe 01 .#9u.9...<L.....
-00000c0: 73 46 dc 91 66 b6 7e 11 8f 02 9a b6 21 b2 56 0f sF..f.~.....!.V.
-00000d0: f9 ca 67 cc a8 c7 f8 5b a8 4c 79 03 0c 2b 3d e2 ..g....[.Ly..+=.
-00000e0: 18 f8 6d b3 a9 09 01 d5 df 45 c1 4f 26 fe df b3 ..m......E.O&...
-00000f0: dc 38 e9 6a c2 2f e7 bd 72 8f 0e 45 bc e0 46 d2 .8.j./..r..E..F.
-0000100: 3c 57 0f eb 14 13 98 bb 55 2e f5 a0 a8 2b e3 31 <W......U....+.1
-0000110: fe a4 80 37 b8 b5 d7 1f 0e 33 2e df 93 ac 35 00 ...7.....3....5.
-0000120: eb 4d dc 0d ec c1 a8 64 79 0c 78 2c 76 21 56 60 .M.....dy.x,v!V`
-0000130: dd 30 97 91 d0 6b d0 af 3f 98 cd a4 bc 46 29 b1 .0...k..?....F).
+00000c0: 7f 46 dc 93 a6 b6 7e 01 3b 02 9a aa 1d b2 56 0b .F....~.;.....V.
+00000d0: 45 ca 67 d6 88 c7 f8 4b 8c 4c 79 1f e0 2b 3d f6 E.g....K.Ly..+=.
+00000e0: 14 f8 6d b1 69 09 01 c5 6b 45 c1 53 0a fe df b7 ..m.i...kE.S....
+00000f0: 60 38 e9 72 72 2f e7 ad 72 8f 0e 49 04 e0 46 c2 `8.rr/..r..I..F.
+0000100: 30 57 0f e9 d4 13 98 ab e1 2e f5 bc 94 2b e3 35 0W...........+.5
+0000110: 42 a4 80 2d 98 b5 d7 0f 2a 33 2e c3 7f ac 35 14 B..-....*3....5.
+0000120: e7 4d dc 0f 2c c1 a8 74 cd 0c 78 30 5a 21 56 64 .M..,..t..x0Z!Vd
+0000130: 61 30 97 89 60 6b d0 bf 3f 98 cd a8 04 46 29 a1 a0..`k..?....F).
0000140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0000160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
For 3 though, how is trusting a random author on git (with fake stars etc) practically different than a random author who has the exact sha1 of a "trusted" repo in their history? If you pull from a random author are you really doing a diff with the last trusted commit or something?

Face it - it's far more likely that a github account is compromised and that repo you rely on has been amended. And you don't really have a good way of verifying which commits are "safe" whatever that means. At best, commits can be cryptographically signed by ther authors, to prevent this. But if the author goes rogue then all who depend on them are up the creek.

And all this for what?
People store all kinds of binary data in git, not just source files. E.g. images or PDF files with specs or documentation.
I think it's relying on libcrypto from openssl, at least that was the case when it came out. E.g. it implements TLS/SSL protocols only, no crypto. Not sure if that's changed and they implemented crypto as well.
Most honest comment in this entire thread.
I would imagine there are IDS systems running, given Google's state level adversaries.

Accessing large amounts of files you haven't previously accessed and shortly thereafter attaching an external drive should trip a competent IDS.
Lyft is not a Cloudflare customer (I work at Lyft).
Not everyone uses Cloudflare for their proxying service. I use them purely for my DNS, but don't have the MITM proxy enabled at all. His scraping is a better idea probably.
Street cred?
Google, Microsoft Bing, Yahoo, DDG, Baidu, Yandex, and more. The caches other than Google were quick to clear and we've not been able to find active data on them any longer. We have a team that is continuing to search these and other potential caches online and our support team has been briefed to forward any reports immediately to this team.

I agree it's troubling that Google is taking so long. We were working with them to coordinate disclosure after their caches were cleared. While I am thankful to the Project Zero team for their informing us of the issue quickly, I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache. We have continued to escalate this within Google to get the crawl team to prioritize the clearing of their caches as that is the highest priority remaining remediation step.
I actually asked this exact question in the SHA-1 thread and got an informative response [1]. Apparently creating a collision in two hash functions is not much harder [2].

[1] https://news.ycombinator.com/item?id=13715146

[2] https://www.iacr.org/archive/crypto2004/31520306/multicollis...
Cloudbleed Bookmark Checker – Chrome Web Store
My wife is coworkers with the girl whose husband, the Indian that didn't die, was shot. We've had dinner with them several times. She and her husband are... Simply the sweetest quietest people you would ever meet. She is just a few months pregnant with their first child. I can only imagine the draining soul crushing experience this has been for them.

The savage animal who did this will get the death sentence I have no doubt. I wish Kansas still hung people. I hate to think of wasting more than a few dollars worth of rope to terminate this sack of sh6t.

No remorse. Just pure blind hatred. Ignorant AF, can't even tell Indians from Arabs.

Anyone who has been to KC or surrounding towns like Olathe can attest to this animal being an anomaly here. We are the friendliest most accepting people in the US. And I've been all over the US.

It's just so incredibly tragic. So pointless. Sigh.
I think he's recommending it, more so than assuming it's what he uses.
> It's like some extremely popular remailer company accidentally put badly or barely shredded copies of handled letters into other people's envelopes.

Or used as confetti for a parade: http://www.npr.org/2012/11/27/166023474/social-security-numb...
The blog post makes it seem like the problem was in an nginx module. Looking at the docs [1] it looks like that's a C API; as far as I know writing shared libraries in golang for a C caller isn't really a thing (because the runtime needs to exist). Rust might have better luck here (I _think_ there have been attempts to get rust code loaded by not-rust code), but I haven't kept track.

[1] https://www.nginx.com/resources/wiki/extending/api/main/
This thing does not like exclamation points. I'm all for being less toxic and more positive in my language, but sometimes I get really excited about it!!!
KasperskyOS – Secure Operating System Released for IoT and Embedded Systems
An idiot’s guide to fulltext search in PostgreSQL
I didn't mean 'obsessive' as a smear, more that they were dogged in their pursuit, going as far as crunching biometrics and zooming in on a watch for evidence (enhance.. enhance.. [1]). It was an entertaining read since it looked eerily similar to how conspiracy sites construct their hilarious conclusions. And yet, it was real.

Also, 'relatively innocent' was meant in context of buying instagram followers, not in cheating.

> I'm more disturbed with the evident impulse to forgive. Is nothing important any more? Is character and honesty so worthless?

The thing I'm most disturbed by in these threads is how easily nuance is lost to the power of righteous indignation. It's like we're reading an entirely different set of comments.

[1] https://www.youtube.com/watch?v=Vxq9yj2pVWk
Can somebody please explain what exactly do they mean by a dump here? How is the leak happening? Is it something like we get extra data than we ask for in a request?
I have been presented with a captcha by cloudflare many times without using tor or a VPN. It is the best way to divert users from your website. My natural reaction is that unless I absolutely need to use this particular website, I move to the next result on google. Websites who use cloudflare are suicidal.
Hwoever thows errs pars fiarle easly

People on both ends tend to adapt quickly. A few brief, known exchanges will typically result in longer ones going fairly well.

And "the meat" does all sorts of stuff. Names get shortened or changed for brevity or style. Gark might be gary, for example.

One group I observed used a lot of first letter strings:

BBQSTSP?

Y

K

Barbecue, same time same place?

Yes

OK
You aren't allowed to have source on your laptop? How do you edit it? Through some web editor? Serious question!
Well, keep centralizing and this is what you get, sooner or later.

Also, mono-cultures have always been a very bad idea, not just in agriculture.
"CF doesn't even host them, they just protect their sites from DDoS and DNS."

The #1 excuse people use. They do more than just DNS, they deliver the actual data, that would have been delivered by the original host, to visitors. So I'd consider them hosting an automatically updated mirror, and as bad as the original host.
CoreCLR debugging returns in JetBrains Rider
Ask HN: What password manager do you use, and why?
Okay, so CloudFlare has caused a decidedly large security breach, and everyone's being told to change their passwords. Now's probably a really good time to switch to a password manager.

I'm sure plenty of folks around here, myself included, would be interested in hearing your thoughts on popular (and not-so-popular) password managers.
There has been amazing news from Apple since Steve died. There was the introduction two years before everyone else of the new blazing fast ARM AARCH 64. There was retina notebooks. There was the design and thumbprint reader tech on iPhone5.

But all of those were built and designed while Steve was leading Apple. They're like little amazing tech gifts from beyond the grave. It just takes a while to get to mass market.

There has been nothing amazing that started while Tim Cook has been running the place except raising margins by making base products less useful. Keeping the crippling 16GB limit on base iPhones for three extra years while camera images grew and grew was a bold move to drive up average selling price at the expense of customer happiness.
If only you assigned it a probability of success near zero rather than at zero...
Is it connected to Cloudflare incident?
Not sure why http2 and SPA's are in conflict here. If anything they complement one another.
and at Switch Datacenters in the Netherlands. I am EU customer. And its aussie company.
Happened to my work account and my personal. Got a scary notification on my phone telling that "Something changed on my phone and I need to login again"
Given that the whole class of operators seem somewhat shady, I imagine that sometimes they would need to fend off attacks from competition services. In that case, being on a free DDoS protection plan seems like a reasonable thing to do (from their point of view). As long as they're not initiating the DDoS via Cloudflare, I'm not sure how that would be unreasonable of CF's part, given that I assume it's all automated and nobody ever looks at what sites have signed up.

I don't like CF for their fishy SSL architecture, the increased centralization of internet traffic, and the constant captchas when using tor, but the DDoS protection part (regardless to what sort of people they're providing service for) seems fine.
Until they open it all the way (remove the brown paper) they would not have seen the address.

They would only open it as part of the process to eventually auction it.

So I can totally imagine it sitting there waiting for someone to claim it (like you did), without anyone seeing the address.

Stop being so negative, it's not good for you.
I used to worry about being "on a list" and then realized I wasn't okay with worrying about while considering myself a free person.

Every time I wonder if I might get in trouble for reading, clicking, or watching something I make sure to do it.
> Another story that I've heard is that a B-1 flying at operational altitude (200 ft above ground level, mach 2) was often as effective as dropping munitions.

That very topic is being discussed right now on the Aviation Stack Exchange:
http://aviation.stackexchange.com/questions/35771/is-it-corr...
They should investigate before refuting. Investigating takes time. If the investigation confirmed what she claimed, then it will require even more time to adequately tackle the problem before going public with an announcement.
Show HN: Designing a Personal Shell command keeper
Japan in Need of ‘White-Hat’ Hackers, Pays Handsome Bug Bounty
Yet other times, people use analogies to gloss over important facts, to sort of hide them from listener. The logical conclusion taken from analogy will be different then what would be reasonable if all facts would be taken into account. Great when your arguments are weaker, but you still wanna convince.
"He added that as a goodwill gesture the U.S. was strongly considering appointing Chelsea Manning as his next ambassador to Russia, in the event her planned confirmation as Deputy CIA Director falls through."

Definitely satire,;-0
I've had arthritis issues in the past and the best thing I can recommend is make room in your day for 30+ exercise, eat decently and invest in a good, ergonomic chair. I know it's vague advice but just a vague diet and exercise routine, putting at least some thought and effort into it, was good enough to improve my health.
Only my master password? That seems kind of important.
Only happened on my phone, not desktop/laptop. Haven't logged in as it could be some sort of attack. Any updates/info? Is a phone wipe in order?
Not as epic, but I wrote a small node app that checks a list of URLs (made it to check my 1password sites, but it can be used on stuff in general). Not very sophisticated, just checks DNS and setCookie strings...

https://github.com/weltan/cloudbleed-1password
I think the above poster is implying that voter fraud is so infrequent as to not be a problem.

I also note that mandatory ID laws wouldn't have stopped the case you linked - they had IDs but the fraudulent bit was the citizenship!
https://www.gofundme.com/a645d-ians-road-to-recovery this is the gofundme page of Ian Grillot, the American who tried to save these two men and got shot as a result.

He is undergoing medical treatment and probably needs all the help he can get.
It says their bug bounty program has a top-tier reward of a t-shirt? Wow ... don't go bankrupt Cloudflare.
Escalation of commitment / commitment bias / sunk costs are what you're looking for. Agree, I've observed this 'cover it up with a bigger lie' thing happen. Madoff's scheme is a similar one, and that judge story in sibling comment is great example. These things are almost always comical/tragic in nature.
Good at lying for sure https://twitter.com/taviso/status/834918182640996353
Again, "bad" is your opinion. People aren't machines: how much trust you place in them affects your relationship with them. Culture is about your team's interconnected relationships.

For example: Smaller companies often have the luxury of more trust / transparency. As companies such as Google grow, they have to resort to things like sending internal notice of big announcements very close to when the actual announcements come out (because leakers). If you have 10 people, you can usually trust the whole team.

Google tries very hard to allow as much transparency and openness as is allowable for its size. It fosters a culture of trust. Logging access rather than restricting it is one of those culture moves. It makes employees feel trusted, and puts responsibility on them to behave ethically. When they don't, the other end is that Google can still take legal action.

Culture isn't a fake floofy thing, it's real.
Well guys it's over. Buy a cow and find yourself a meadow :D

Next up, this is gonna turn the Node.js script kiddies that copy-and-paste together modern society's infrastructure from Stack Overflow into copier-pasters of "Deepcoder specs", which doubtlessly over time will become ever "easier to get wrong", until "Deepspecr" shows up to close that gap as well. The saddest part, it'll probably improve the quality of code-bases on the whole..
Razer Power Bank: an external battery dedicated to laptops
> In the case of seat belts that's probably because the cost of your life is infinity.

The cost of your life is much higher than your blogger account, but it's not literally infinite, even from your own perspective.

If it were truly infinite, then it would be irrational for you ever to take any action that were not 100% motivated by the desire to protect your life. (Not just "never take any risks", but literally irrational not to actively spend every waking second solely on that goal).
Robots Will Soon Do Your Taxes
What do you think about USB-C and Thunderbolt 3?

In a dream world they'd make all iOS devices USB-C, release new Mac Pros, all types of laptops, and all of them able to use the same Thunderbolt 3 eGPUs, RAIDs, etc, albeit at different levels of performance.

When you look at the public reaction to iPhone dropping the headphone jack (I agreed with) and the revenue from wireless headphones, we know nothing compared to the analysts locked in a vault at Apple who knew more about making money for their company.

And yet, I still think of the not-quite dichotomy of the two Steves. Making out-of reach-tech available to everyone, and making tech available to cool-people, where cool-people turned out to be a large superset of 'everyone'.
10's of machines? i3's are definitely dense in performance but GCE can be stacked pretty well too.

The biggest issue beyond pricing though is that GCE has a limited total disk bandwidth regardless of the number of local SSDs attached.
Because it is a non sequitur. It fails to engage the point of the argument.

The point is that SpaceX is a making a potential contribution to humanity's future, which makes it a more meaningful way to spend your working years than an advertising company.

The fact that an advertising company thought that SpaceX was a good investment has absolutely nothing whatsoever to do with this argument. It completely misses the point.
I've been toying with the idea of modifying git to use (iirc) SHA-256 so that any commit hash could be downloaded directly from IPFS. Seems like as good a time as ever.
Can I ask for some details about the niche or product/ service you were providing? (I'm slightly worried I might be building something similar and the same thing will happen to me)
Let's assume that you can use spaces, tabs, newlines and linefeeds. It's still only 4 bytes amongst 128 possibilities (using ASCII)... Good luck with that. Or, in other words : good luck to conceal pseudo-random _bits_ in _text_ files...
Why Bisexuals Apps Are Better Than Dating Sites?
South Africa allocates $147M for broadband infrastructure implementation
Ronsaldo/woden2: World Dynamic Engine 2
We're talking about a conversation amongst kernel/software developers about a very technical software issue.

Anyone who doesn't understand why the risk was so small doesn't belong in the conversation.

Can you even imagine where our medical field would be if we expected surgeons to talk amongst themselves as if they were speaking to the general public?

It is absolutely acceptable for the speaker to make assumptions about the listeners knowledge, and that doesn't reflect poorly on the speaker.

> The purpose of an analogy is to simplify something that's too hard to understand for the person you try to convey your idea to.

It's to convey an idea. That's it, anything you add to that is your own bias at work.

Linus was trying to get across the scale of just how small the risk was.
HyPer: High-Performance Geospatial Analytics in HyPerSpace [pdf]
This is more a long term issue, of course you don't feel it when some trend-setters leave your product behind for something else. But these people are trend-setters...

I'm personally still 2 versions behind on osX because of Aperture. Now I heard photos can do many of the things aperture can except that you can't organize your library. Wut? Yeah, a real pro would switch to Lightroom right? And Lightroom is also available on Windows. As is Bash. As are multiple desktops. And finally Windows machines are getting quality trackpads and in it is easy to buy upgradable Windows PCs. Still I'd wish the Adobe suite was available on Linux though...

This was my last Mac, especially now that Dell and HP seem to finally understand that people are willing to pay for quality hardware.
I control a fleet of servers. I have a saltstack or ansible script. One of the steps in provisioning a new server is to pull library X from github.com.

One day Egor Homakov finds a new hack and finds his way into access to the master branch for library X. As a prank, he force pushes a change to master.

Being aware of such a possibility, instead of setting up my script to pull from master or even a specific tag, perhaps I pull from a specific sha1sum. That way I know I'm getting the exact version I want. That's today. Tomorrow, when preimage SHA-1 attacks are cheap, it will no longer save me.
This is the interesting part: ideally the costs would trickle down to consumers. The other half to a carbon tax policy, or the government auctioning permits in a cap and trade system, is that the revenue raised would ideally be handed back to individuals through increases in welfare payments and tax cuts.

This probably sounds a bit pointless. Why take with one hand and give with the other? Because of substitution effects. By making carbon intensive goods and services relatively more expensive, consumers at the margins will substitute away to less carbon intensive products. In other words, you're relying on the substitution effect rather than the income effect for a carbon price to do its magic. This is going to sound cynical, but I feel it's much safer to rely on the behavioural effects of direct financial incentives rather than the belief that individuals will make ethical choices in service to the common good.

One important caveat: I'm only 'talking the theory' here. It would be interesting to see if all this theory has been empirically validated (I honestly haven't looked). I'd imagine there's a bunch of studies examining the effects of carbon pricing in (mostly) European countries, but I can't certain about that. I might have a hunt around on the weekend (unless anyone here has some good references)...
How to write a Mesos framework(5)
You sound like a farrier complaining about the automobile. :)

Those people who know nothing about horses and riding, getting all this meaningful work done just by throwing technology at it!
Glad my Gmail account is no longer my primary email. Haven't seen issues with it on desktop, but my Windows phone is repeatedly spamming a "your Google account information is out-of-date" message.

Nothing in the Google Account panel for recently security changes though.
It's two orders of magnitude less code, but I would be hesitant to say it's more than a linear decrease in vulnerability. Rust (or OCaml in the past) seem like a match made in heaven for solving Heartbleed and Cloudbleed type of problems.
It is. See the various Wikipedia links given here: https://news.ycombinator.com/item?id=13720517 - it also contains the chemical structure. That's actually one of the things which makes chemical weapons far more dangerous than nuclear weapons - it is comparatively easy to produce them without much specialized equipment.
Yes. I agree, and in a better society there would still be some room for advertising. If a product or service benefits consumers, then it benefits them to know that it exists. However, I would also say that we have several orders of magnitude more advertising than we need, and that the majority if it is zero-sum, or if you consider products like Pepsi and Coke (high margin addictive death syrup that would scarcely have a market if not advertised to the saturation point) decidedly negative-sum.
In all, it's been going for over six years now. I've collected around 2,200 of 2,800 games without incident. This lot puts me up to 2,300. So ... yeah, fingers crossed at there being no more drama.
Use a paper towel or the sleeve of your jacket or shirt.