skysight-inc/HackerNews huggingface dataset:
> vm.swappiness = 0	The kernel will swap only to avoid an out of memory condition, when free memory will be below vm.min_free_kbytes limit.

This is not the case.

It used to be the case, but changed in kernel version 3.5-rc1 (2012 ish)

There was a discussion about this on HN a few weeks ago: https://news.ycombinator.com/item?id=13511086

And there's a blog post on the percona website about how this rather bizarre change bit them: https://www.percona.com/blog/2014/04/28/oom-relation-vm-swap...

I call it bizarre because (as I wrote in that other HN thread) a) it changed the behaviour of lots of production systems in a surprising way, and b) if you want to ensure your processes never swap you already had the option to not have a swap file or partition.
If I understand wix.com's product correctly, those customer sites run on wix.com's servers. So, one could argue that it would be wix.com that shows the images. It would not be clear-cut that this infringes on that license.

I do hope that wix.com will do the right thing, though, and limit this to images that their creators permitted to be reused and/or add a feature where wix customers can negotiate with deviantart users over pricing.
The filing itself claims both [0].

[0] https://drive.google.com/file/d/0B7dzPLynxaXuQjY3dkllZ2ZKb0k...
> success must be measured in more than just returns.
It's a good thought, but if the functions have bounded-length outputs (as with all major hash functions), then your combined hash value is still a bounded length. A collision must therefore exist because there are many more potential messages than potential hash values.

If your functions produce unbounded-length hashes, then you may as well just be compressing your input to guarantee there are no collisions in your "hash".
It very deeply concerns me as well. Very few people have the audience to even do what I did. And I do not like abusing the tiny bit of notoriety I have for personal reasons like this.

If it weren't for the fact they aren't my games, and that I promised the donor he would have them all returned to him, I wouldn't have made a big fuss about this.

And even in my case, I was extremely lucky that some sites picked up the story. The ones I personally asked all shot me down.
Yep, sorry, it was far too early in the day for me to appreciate the magnitude of 2^{160}.

If I could downvote myself...
You assume that he is rational.
It's not a red flag, it's reality. Biology is complicated, and no matter what the synthetic biologists tell you :)

You use independent methods and good controls to deal with this. This is nothing new, it's been the basis of experimental science for decades. If you're allowed to publish without doing this, the field has failed. Molecular biology, in particular, has flourished because of the effectiveness of genetic controls. Mutants are highly reproducible (you just send out seed, cultures, or live specimens), verifiable (sequencing), and combinatoric (crossing).
How Flexport keeps its data secure
Statistics is also the way to look at data in the "hard" sciences. Every measurement has error, and that's how you deal with it.

However it's not a simple thing that automatically combines different studies. It takes skilled application to understand how data connects, what's comparable, what's not, etc. Traditionally, "meta-analysis" is the sub-field of statistics that combines studies. But that only combines extremely simple studies, such as high-controlled clinical trials. It's inappropriate for the complex type of data that appears in a typical molecular biology paper is a chain of lots of different types of experimental setups.

Those who don't know the body of stats, trying to reason about application, is a lot like an MBA trying to reason about software architecture. The devil is in the details, and the details are absolutely 100% important with application of statistics to data.
Chris Christie has been outspoken on the opioid crisis, making a bold effort to re-cast drug abusers as "our neighbors" rather than as criminals.

He spoke at length about it[1] in his recent state of the state address in New Jersey. He made it a key part of his failed presidential campaign[2]. He is reportedly a long time opponent of recreational marijuana[3].

[1] http://www.nj.com/politics/index.ssf/2017/01/christie_2017_s...

[2] https://www.bostonglobe.com/news/politics/2015/05/07/chris-c...

[3] http://www.thecannabist.co/2017/01/16/chris-christie-marijua...
Sure, that's what Google's lawyers claim.
> Nor is it customary to check for a "memory tight" condition and have programs restrain themselves, perhaps by starting fewer tasks in parallel, opening fewer connections, keeping fewer browser tabs in memory, or something similar.

These aren't mutually exclusive and are actually complementary with swap.

If you have more than enough memory then swap is unused and therefore harmless. The question is, what do you do when you run out? Making the system run slower is almost always better than killing processes at random.

And it gives processes more time to react to a low memory notification before low turns into none and the killing begins, because it's fine for "low memory" to mean low physical memory rather than low virtual memory.

It also does the same thing for the user. "Hmm, my system is running slow, maybe I should close some of these 917 browser tabs" is clearly better than having the OS kill the browser and then kill it again if you try to restore the previous session.
> Many of the logged urls contained query strings from https requests that I don't think they intended to share.

I guess this confirms a few things.

- The complete query strings are logged,

- They don't appear to be too concerned with who accesses the logs internally or have a process that limits the access, and

- They're willing to send those logs out to a random person.
I would assume that the servers that host big trade secrets would log everything happening. There wouldn't be a need to log the laptop itself.
You do that sort of thing all the time though with electronics:
I'll open it up, and find some undocumented chip variant and see if I can source it elsewhere, I'll also search+email around to see if I can find a datasheet anywhere.
If it's not printed on the chip you'll probably be able to get it out of JTAG.
Why justify what you can just deny as fake news?
Uber hired an entire experienced department from CMU.
And they often use USD because of that.
To everyone reminiscing in this thread:

Better make a repository of your works, quickly! Who is to say it will be the same site in a few months, or weeks.
If you read the article:

We found that six weeks before his resignation this former
employee, Anthony Levandowski, downloaded over 14,000
highly confidential and proprietary design files for
Waymo’s various hardware systems, including designs of
Waymo’s LiDAR and circuit board. To gain access to Waymo’s
design server, Mr. Levandowski searched for and installed
specialized software onto his company-issued laptop. Once
inside, he downloaded 9.7 GB of Waymo’s highly
confidential files and trade secrets, including
blueprints, design files and testing documentation. Then
he connected an external drive to the laptop. Mr.
Levandowski then wiped and reformatted the laptop in an
attempt to erase forensic fingerprints.
This has nothing to do with logging.
I don't think he had to, but he got an answer in minutes. I don't think that's the part to be worried about.

As for what you should do: it sounds like the impact is relatively low. I'd personally change easily-changed secrets which go over the session, and potentially externally facing customer passwords (yes in enterprise, maybe not in consumer).

(I don't have any insider info on this breach, though, but I read both posts and know how the system works.)
With how ASIC & firmware companies do things, best to assume they're all the same thing until proven otherwise. As in, the circuitry and software for doing any of that is there but only made visible/usable to by a configuration that changes the more they pay. This is the most economical thing for hardware makers to do as they build just one thing instead of several things. This was also the trick some hard disk makers use where they put the same platter in all the drives but a firmware option limited how much was visible to user (less money = less visible).
Yup, this made it crystal clear, years ago, that Cloudflare's business incentives were and are at odds with a secure web.
Except all exchanges between mercurial client and server happen with changegroups and changegroups are still limited to 20 bytes for the hash.
It looks like bloomberg updated the title to: "Alphabet's Waymo Alleges Uber Stole Self-Driving Secrets", which makes more sense. We should change the title here.
What? Most version control systems have authentication systems, I'm pretty sure Google has good reason to keep audit logs of employee's access to schematics.
This is part of the Elixir standard library

https://hexdocs.pm/elixir/List.html#myers_difference/2

https://github.com/elixir-lang/elixir/blob/master/lib/elixir...
> "With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory... The leaked memory has been purged with the help of the search engines."

I wonder if the search engines found any interesting patterns of searches performed whose results contained these 770 unique URIs.
It is not a completely general problem. In the field I work in (computational physics) we very often reproduce results published by other research groups. It's very common in our field to see plots in a new paper overlaid with data from old papers showing where our results agree (where they disagree is not a reproducability issue but is instead due to our ability to do more accurate calculations).

Here is a paper where some colleagues of mine wrote a benchmark paper explicitly to check various methods against each other (with good agreement): https://journals.aps.org/prx/abstract/10.1103/PhysRevX.5.041...
Yep, I should have read all the way to the end. And now I can't delete so my idiocy as there for all.
I think this bug is kind of an indictment of Ragel. It has some great ideas, but since the generated code is so low level - and allows arbitrary blocks of code to be executed in the guts of the parser, bugs like these can result in this horrible memory issues - particularly since the generated code is often used to parse untrusted user input.
You are stuck so far inside that bubble that you can't see the walls :D

Imagine srriving at an airport and seeing they have signs up advising tourists how to determine the validity of a taxi. All well and good, until you find out the signs were fake and erected illegally by one taxi company to steer people away from their competitor.

Or head over to somewhere like Tunisia for a while. The line between legitimate and illegitimate is so blurred as to be nonexistent.

Even in my home town of Canberra we have a tightly regulated but loosely policed taxi industry, and there is no guarantee that the person driving the taxi is the same as the person whose licence is displayed on the dash.
Support for legal marijuana and ending prohibition is up to 60% and over 70% for democrats and independents, republicans up to 42%[1].

They are fighting a losing battle and most politicians will not go against that type of landslide polling.

Good luck, 2.4 billion in Colorado, 20,000 new jobs and personal freedoms will not go away lightly[2].

They could legalize and end prohibition and throw the other side a bone, but if they pick this fight it will be a huge mistake and an attack on logical/smart people [3] and public opinion [1].

Prohibition makes the punishment on a non-violent personal action into a crime, wasting billions (20-50 billion)[4] of tax dollars and funding cartels, to the tune of 25-50+ billion [5], while harming decent people.

[1] http://www.gallup.com/poll/196550/support-legal-marijuana.as...

[2] http://www.denverpost.com/2016/10/26/colorado-weed-economic-...

[3] http://edition.cnn.com/2017/02/22/health/teens-smoking-drink...

[4] https://www.aclu.org/blog/hundreds-economists-marijuana-proh...

[5] https://www.washingtonpost.com/news/wonk/wp/2016/03/03/legal...
Thanks to you (and Chinjut) for the replies. I don't know how to correlate your reply to Chinjut's, though (or vice versa). Could either of you take a stab at it? Are you saying the same thing in different ways? Or are you actually disagreeing?
The valuation makes sense to me. Their userbase is hard to monetise (I'd wager a large chunk of kids aged 10 to 18 with limited purchasing power - and the adults there are definitely in the AdBlock crowd). Things like premium site subscriptions and print services will only take you so far - and now that we're post-"mainstream Internet" its growth is limited to the rate people are being born and given its anti-establishment streak I don't think the site will last long in China.

So if the site is making $10m/yr profit, 3 years' revuenue and no expectations of growth means $36m is a fair price.
I don't blame Ragel.
"enable AMP, and more" is a certainly nicer than ""ScrapeShield" feature which parses and obfuscates html".
The Supreme court decided that the Fed could regular intrastate commerce in Wickard v. Filburn, and that ruling has also been used since to go after marijuana that stayed intrastate. [1]

I think it's a bullshit interpretation of the text of the Constitution too, but that doesn't change the current legal landscape, however much I or anyone else might want it to.

1. https://en.wikipedia.org/wiki/Wickard_v._Filburn#Subsequent_...
Sounds bad to me...

"We've discovered (and purged) cached pages that contain private messages from well-known services, PII from major sites that use cloudflare, and even plaintext API requests from a popular password manager that were sent over https (!!)."

The trouble is you have no way to know if someone discovered this earlier, and harvested info for a long time.

Or, how much harvested info from your site might be in a Google cache for someone else's site.
Oh that happened to my site as well. Was fun trying to figure out what was going on in the middle of the day.

Nothing on their status page about it though :|
>Many people find it surprising around the world that we don't check IDs.

They also find it surprising that the US has no universal ID system issued at age 18 to absolutely everyone.
But... They have a warrant.

Amazon is arguing that they don't have to turn over information in response to the warrant.
I definitely agree with that.

I offered a $500 bounty to anyone who could help me locate the package. It was worth that much for me to recover it.

In the end, both USPS employees that really helped me out the most turned down my offer to send them the bounty.

I realize there's a dark side to this suggestion: it weakly incentivizes loss for the purpose of getting a reward for it, and makes getting help a luxury for the wealthy.

However, the current system of only helping when cases hit the media doesn't work either. Obviously they can't afford to do exhaustive searches for every last piece of lost mail. There needs to be some sort of middle ground, where value and personal importance of the package is weighed against costs and available resources.

Probably the first thing that needs to happen is for the USPS to stop getting bled dry over pension payouts.
Google might have been better off with patents than trade secrets. There are financial penalties for theft of trade secrets, but once the secret is out, no injunctions. The one who stole it can use it. With patents, injunctions are available, although hard to get.

Anyway, several companies are developing automotive LIDAR units which are better than Google's rotating things. Quantergy and Velodyne claim to be close to low-cost solid state LIDARs, and ASC has good ones now at a high price point. (An ASC unit just docked the Dragon spacecraft with the ISS.) By the time this gets to court, Google's secret technology will be obsolete.

The question is whether Uber will defend Levandowski or leave him to twist slowly, slowly in the wind and go to jail.
Speaking as someone with no particular interest in using either, I'd much rather have a neighbour who was a recreational marijuana user than one who was a a recreational gun user.

But, you know, tastes vary, and apparently the laws reflect a different aesthetic to mine.
The notion of "document security" is a common desire in business and legal contexts. PDFs are a standard representation of documents, whereas JPGs are less common (TIFF might count since it's a somewhat common scanned document format, but I digress).

Subverting the most popular document format, one which even provides built-in support for digital signatures is probably much more interesting than subverting the JPG format.

Open challenge: build two signed PDFs with identical signatures and different contents - it's not necessarily hard, and it would definitely drive the point home.
Some things are very consistent. I was surprised by the map of election results in Alabama from 1892 and 2016 in this article: http://www.economist.com/news/united-states/21716658-why-cou...
States can't choose which Federal laws are obeyed inside their borders or not.

If the federal govt. has to enforce federal law in a state, that needs to happen, and the state needs to cooperate to the extent laid out by statute & legal precedent. No more, no less.

The right answer is to have legislation that squares the federal & state policies at the top. "States Rights" never extended to nullification of Federal law, there was a substantial dispute over this in the 1860s.
you identified why the illegal drug trade is so hot:

> Cross-border drug trade fueled by prohibition

Legalizing marijuana would probably mean more domestic growers, maybe even blowing up like craft beer did.
Why not just gold?
bitcoin.de seems quite reliable and trustworthy. I bought bitcoins there and also use it as a wallet.
I have no idea which of Trumps statements on this topic are going to end up being accurate. All I know is that one side will start mass producing articles with click-bait titles, and another side will ramp up every possible anti-marijuana talking point imaginable.
When Will We See Collisions for SHA-1? (2012)
I don't buy this argument.

A site using Flexible SSL is no less secure than one using http://, and in fact is more secure, because nobody can MitM the connection between CloudFlare and the end user. The only thing vulnerable is the connection between the website and CloudFlare (~~and only to MitM, not to passive sniffing~~ EDIT: this isn't true, see [1]), but that's a much smaller and much better-protected surface area.

Now it's quite obvious that the alternative SSL options are much better because they secure the data properly the whole way. But claiming that Flexible SSL is somehow undermining the security of the web is extremely hyperbolic.

[1]: The connection between the origin server and CloudFlare can in fact be passively sniffed. I thought Flexible SSL was the option to use an arbitrary self-signed cert, but it actually means no encryption.
During debugging, that seems fine. The previous sentence makes it clear that they added specific logging to track down the problem. I'd rather have a process that allows engineers debugging memory corruption to see the data that's in the process they're debugging, than a process that prohibits them from seeing it.
OMG Donald Trump head used to make a piano instrumental
Does 1Password really send anything meaningful in their API queries, or is it encrypted separately and then just sent over HTTPS?
Very interested to see how webpack plays with the asset pipeline.

With Capybara, I'm not keen on the default transactional rollbacks. The reason for this is, that it's handy to keep the data in the db after a test to see what the final state of it was. I always drop the data before a test runs - but then again, I prefer the use of factories over fixtures.

Can someone please explain the benefits of this encrypted secrets business?? I'm struggling to see the benefit - I understand that you need access to the code + the env var, but in all practicality, if someone has access to your env vars, then is it really that much more of a reach to figure out what the key in the code is?
With the coverage you're getting, I'd expect traffic to go up indeed! Great work :)

http://www.theverge.com/2017/2/23/14712352/txt-fyi-minimalis...
>This here. BMW makes more in profit than Tesla is earning in revenue. BMW sells 2.5 million cars a year, 25 times as many as Tesla. And both companies are valued roughly the same? How? Totally overvalued.

Are you familiar with how companies are valued? You only seem to be factoring in present considerations. What might happen in the future is a major factor in determining these prices, especially in an industry with so much potential upheaval not too far away. (e.g. what if Tesla profits are 10x BMW's in 20 years? Then they are probably undervalued right now.) If you are confident in your assessment though, you can always put money behind it and make yourself rich.
Made a throwaway name because I have an unpopular opinion.

We've likely read Susan Fowler's blog post. If true, it's awful behavior on the part of HR and management at Uber, and action should be taken.

But that's the thing: a blog post does not establish truth. We've heard from only one side of the story. No one ever asks about the other side, or about whether we are being misled. We only talk about the bravery of the author and condemn the other side.

I think the saddest part of our collective behavior is how quickly we come with pitchforks to a witch trial. We must remember that justice is not decided on Twitter, or on blogs. Justice is not decided by the voice of the accuser.

Did you see evidence besides Susan Flower's putting phrases in quotation marks? She mentions screenshots of improper behavior but provides none. What if tomorrow new evidence comes out that this whole thing was exaggerated or flat out wrong. How would it feel, to being so easily manipulated into drawing a conclusion, into retweeting a fiction, into writing an open letter?
No one is arguing that. Please don't move the goalposts and/or set up straw men.
There's a really good Google talk on this subject full of many concerning statistics and anecdotes:

John Ioannidis: "Reproducible Research: True or False?" -- https://youtu.be/GPYzY9I78CI
>... metrics on how well the company has managed to reduce fake news

Or an arrogance in how they believe it's fine (if not their duty) to censor news stories, as they deem fit, almost as if people of voting age can't think for themselves.
I'll come back and use it again once this project includes all relevant options. Off the top of my head, the missing functionality includes:

--demean-underling

--harass-underling

--annoy-competitor

--ignore-regulator

--spy-on-critic

And on recent news,

--steal-trade-secret
Everyone should read this. It's hilarious.

First the judge tried to blame Teresa Brennan, "an old friend" from the USA. Turns out she was dead, and he knew it.

But then he claimed that he had lent his car on that day to a different Teresa Brennan, whom he claimed also lived in the USA, and who had also died.

When various TV shows have comically stupid plot twists I sometimes struggle with "suspension of disbelief". But this is one of those cases where truth is far stranger than fiction. You'd never believe someone in such a position of trust could be so stupid over something so petty.
That's how we should be evaluating products: if they will land the creator a job.

Try applying this logic to politicians or bankers or whatever class you don't like.
Firstly, to clarify I am no longer involved in the referenced business except as a shareholder. I am involved in a newly emerging multi-asset financial services business with an interest in using cryptographic currencies for cross-border transactions. I agree with your assessment that high fees will affect volume, however that is really a separate discussion and perceptions of acceptable fees vary widely by scenario.