skysight-inc/HackerNews huggingface dataset:
It's estimated that there are 20 million developers world wide.

Stack Overflow surveyed that 20% of developers use a Mac.

So lets say there are 4 million developers using a Mac. And lets say they buy a new Mac every 3 years. Then 1.3 million developers buy a Mac each year.

Apple sold 20 million Macs last year. So lets say 6.5% were developers and 10% of those developers are complaining about the new Mac series. If I am right that means that 130 thousand developers are complaining. That's 0.65% of Apple's customers.

Now I don't believe Apple is stupid. They are in business longer than some people here are alive.

So I can very much imagine that Apple decided to go for 2% more customers while losing 0.65% of them while making even more profit.
@jgrahamc: If this problem doesn't justify emailing all proxy service customers, what problem would?
Introducing Amazon EC2 I3 Instances – Storage Optimized High-I/O
I'd be more impressed if both paragraphs also had the same SHA-1 hash ;)
If it walks like a duck and quacks like a duck, flag it as a duck.
A link to an announcement on the issue?
Workstations mount what's called citc (clients in the cloud). And you can use whatever ide or editor you like. Code is never downloaded directly to the desktop. You don't really notice any performance issues with this and you get the benefit of being able to build or include any library without having to download it all.

Laptops can't mount citc, and you need to either SSH/rdp into a workstation or use a web based code editor.

Once you've used citc/Piper/blaze you'll find it's a great system and there is no good alternative... Yet

As for OS choice I believe only goobuntu can be used to modify Google's code repo.
Do tell me, why are you still using Uber? What needs to happen? Let's see: Weakening the rule of law by deliberately ignoring taxi legislation, that's not enough. Rebuilding indentured servitude via subprime mortgaged cars where the payment comes out of the drivers' wages, that's not enough. Launching self driving cars going again against regulations and putting cyclists in deadly danger, that's not enough. Treating women like shit, that's not enough. Stealing Google tech brazenly, that's not enough.

Tell me, what would be enough?

Sources for subprime loans: http://valleywag.gawker.com/uber-and-its-shady-partners-are-... https://www.bloomberg.com/news/articles/2016-05-31/inside-ub... https://twitter.com/shashashasha/status/688734478181732352 Self driving shit: https://www.theguardian.com/technology/2016/dec/19/uber-self... the rest is either obvious or recent enough not to need a source.
Some more advanced Git operations (I sadly never needed so far) can be used to break the "append only" part, right?

Like for instance rebases?
Just stop using pointer arithmetic and manually managed buffers for anything security/safety related already.

Had this proxy been written in nearly any other language it wouldn't have had this vulnerability, like so many similar vulnerabilities.

Using ML or Rust or Java or whatever doesn't magically make all vulnerabilities disappear but it sure makes those that are intrinsic to C disappear. And that's not just a few.

There is just no excuse.
You can always break append only logs, the point is, it's detectable.
Minority shareholders writing angry public letters happens more than you think. It's just that normally it doesn't make it outside the financial news.
Moore's Law (the 2-year version upwards-revised from the original 18-month version) stopped holding last year when 10nm (Cannonlake) was delayed to this year and Intel introduced a third step in its tick-tock process. The quotes you're looking at about 2025 were from 2012 (the one cited in 2015 has no support for the quote) and all three should be removed from the article or the assertion altered.
> Some security-focused developers sign git tags and/or commits, specifically to have things verifiable end-to-end and not having to trust HTTPS and all the middle men that entails.

This is a completely orthogonal, separate layer of security that has nothing to do with this particular issue.
if it's public static content what exactly has been compromised?
Just the word "huge" would be fairly subjective, but your comment ignores that "HUGE" was in all caps. That makes it seem a lot more like trying to attract attention than any neutral summary of the content.
Practical SHA-1 signature collision
What to learn on a 8-month roadtrip?
By the end of April me and my girlfriend will be on a 8-month road trip that will take us from Amsterdam to Cape Town.*

During those eight months I would like to spend time on learning a new software development skill. At the moment I do most of my work in PHP and ruby.

What would you start to learn? Internet access is most likely limited and/or slow.

*the exact route is unknown right now but we intend to roughly follow this route: Amsterdam, Istanbul, Tehran, Amman, Cairo, Nairobi, Cape Town.
They've never made a secret of it being LAMP throughout. There's still some code in there from the original PHP4 site 14 years ago (or at least, there was at the time I left staff).
Apple suffers seriously from NIH syndrome, so they will probably never let NVidia play a major role in their ecosystem. Too bad, customers move away.
> real people that are in all likelihood good at heart

So are the harassment victims and underappreciated employees. Spread your empathy around.

"Good at heart" is kind of meaningless anyway. Judge people by their actions, and their sincerity by how they respond to criticism and mistakes. It's a character test and they're failing it.
> Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL.

This is true, but conversely there is no legitimate use case for Flexible SSL. Having a datastore like Redis or MongoDB that by default listens insecurely on any address is almost as bad, and such things often compromise the security of a site if it e.g. sends your data across the internet to one of those, but at least there's a more-or-less legitimate use case for that default if it's used on a secured network - it's at least possible that someone using that default isn't deceiving their users. Whereas anyone using Flexible SSL is necessarily deceiving their users (I mean you can argue users might genuinely think "I don't trust my local cafe operator but I do trust the completely public, unsecured internet", but I don't think that's a coherent position for anyone to take).
To be fair there's a timeline in the post.
I'd be more comfortable if they didn't lie about security to site visitors. "Configure a self-signed cert on your hosts so we can encrypt the traffic" is a low bar to clear.
27 Jobs with Unbelievably Tough Interview Questions
Poll: Support for Obamacare is rising
> He told the BBC: "It boils down to do not try this at home, this is so much more sophisticated than people realise." He said people could "get into trouble" with their health if it was done without medical guidance.

Ok, where can I find more information?
I ranked your list of Cloudflare-using domains by their Alexa rank.

Sharing here in case anyone else finds it useful

(warning - it's 1.1MiB gzipped / 2.4MiB uncompressed)

https://polarisedlight.com/tmp/cf_ranked.txt

any domains outside the top 1 million are ommitted
5 Tips to market your business on Twitter
But it sounds like in the absence of laws, you want private companies deciding what is allowed to be on the internet.
> lay off people when they don't need them or move operations to cheap regions to also have bad heart?

Those are always rather cold-hearted actions. Employees are not a disposable quantity that you can dump at Goodwill like surplus furniture; companies should make sincere efforts to avoid layoffs.
Bidirectional Backpropagation
History proves again and again, that yes, big companies - even when they are presently turning record profit - can be indeed stupid. Very, very stupid.

Thinking that just because a tech company is big and therefore has the brightest minds there running the products and as such they can't go wrong and it's us, the users, that just don't understand their fantastic strategies is, as we can clearly see from the past, just not true.

Just look at Microsoft in the 2000's for instance. Or at Yahoo in the end of the 90's.
They wrote that they already tried those channels. Justified at that point to grab the megaphone.
Maybe "vanilla as possible" is not desirable if it means that your markup is non-semantic. I like that Txt.fyi tries to be as simple as possible, but there are some UI anti-patterns like the textarea placeholder instead of a matching label.

It would be pretty easy to add the proper HTML elements like <header> and microformats.
From the incident report at https://blog.cloudflare.com/incident-report-on-memory-leak-c... (not the article):

> About a year ago we decided that the Ragel-based parser had become too complex to maintain and we started to write a new parser, named cf-html, to replace it. This streaming parser works correctly with HTML5 and is much, much faster and easier to maintain.

I'd assume that at this point, customers would like to have a little more than a vague promise.
Wow, I only recently had a discussion about "What if this happens?". Great timing to make a point. Unique "told you so" opportunity, but I actually am sad that this happened. Millions of people wasting time on password changes and related things again. :(

And now off to resetting a lots of password and checking where OTPs are possible.
The article was about video editors, but it doesn't chnage the essence of your point. However.

That little group is power users. New adopters. Influencers. In the late 2000s, if you saw someone using a macbook pro, you knew he was some kind of professional, and most likely, something "sexy" - a developer, photographer, designer... This user base, professionals who care about quality over price, helped create the Apple company image. They loved Apple products and were voluntary apple advocates - I know I was. I convinced several friends and family members to switch to Mac because I sincerely believed that the extra cost is worth ease of use. And because I'm a power user (in their eyes), they believed me. And that same company image helped sell iPhones - the main Apple profit driver.

But now the same high-paid professionals are switching away. "Regular" users are going to see it, sonner or later; how do you convince them that this "Apple quality" still exists, when they see the power users trashing it?
It would for users that have 2FA enabled.
Do I need to change my cloudflare password?
git checkout 0.1.0
git tag -v 0.1.0
Other comments here seem to be more detailed and could help more, but I have a simple check to do. Is your chair at the right height?

If the chair is too low, your knees stay higher than your ass, and you ass sustain all of your upper body weight.

If the chair is too high, your knees stay lower than your ass, and your thighs sustain most of the weight. I suspect that what is happening to you as you say "I get this pain specifically where it makes contact with the chair".

Ideally, your knees form a 90º angle and you can feel the weight more uniformly distributed between your ass and your thighs.

If I were you I would reposition the chair's height so it is a little bit too low, purposefully relieving your thighs from the weight. Check if it helps with the pain. If it does, you can gradually adjust to the perfect 90º (or you will soon have the same pain in your ass).
This idea was implemented in EROS, and we've been exploring it for Robigalia as well. Storage is a finite resource which can be transferred between processes, including an "auction" mechanism which allows two processes to examine a trade before agreeing to it.
If you want a pc with the design of Mac Pro (actually better in my opinion) look at the samsung Art pc Pulse. It is the same concept, but way smaller (about half the size), modern specs, I think you can upgrade at lest the ram (not sure about ssd though) and for the specs the price is OK.

Actually, photos do not do much justice to it. In real life it is way more impressive. The upper part looks like it floats on a colorful aura. The design is an obvious copy of Mac Pro, but they made it way better.
Interesting, thanks for the reply.

I wonder which password manager the original Project Zero thread referred to then if not 1Password.
Reddit thread with lots of discussion:

http://reddit.com/r/science/comments/5vufpb/the_pancreas_can...
No, the language is bad if using it wrong can leak sensitive data.

The choice of language is wrong if you pick such a language in a situation where mistakes can lead to safety or security problems.

The first requirement is security.
looks like no way user can unsubscribe. can you add link for unsubscribtion too??
This reminds me of vulnerability reports that start with "if you have root access..."
Tag signatures only cover the mapping from tag name to commit hash. In other words, specifying a manually-verified commit hash is actually more secure.

Tag signatures are mostly worthless now from a crypto point of view -- with the caveat that you can still get some value from them if you still trust sha1 to be secure against second-preimage attacks.
They verbatim say they want to work behind the scenes in the company to change the culture. That's not advising or just "having influence". It's simple...they do not have a right to do this as investors unless it was part of their terms.
It wasn't like that in 2005.
6 Things to keep in mind before developing a product
I was under the impression that most people were very aware that removing the headphone jack would become a revenue stream for Apple? That's what all the fuzz was about - a lot of people didn't want to buy adapters or new wireless headphones.
I HATE gray text. I haven't had a single book with gray on white, not a single newspaper with gray on white, what is this gray-on-white trend in the internet, I don't understand it. But that's illegible, that's an eyesore, and if I were to have to read it, I'd first go to the dev console and change the foreground colour.

>> Black on white? How often do you see that kind of contrast in real life?

I mean where these people live? Don't they read anything on paper? Don't they look ad ads on the road, ads on TV. God, is this a plot on our eyes?.
Here is a list of domains where I found public leaked data: http://doma.io/2017/02/24/list-of-affected-cloudbleed-domain...
Civil Rights Groups Back FCC Chairman's Effort to Kill Net Neutrality [Video]
Very nice. Just one question: what if the host environment uses a large line height?
Swap media is closing in on RAM speed at a fast clip. RAM latency has been stalled for 30 years and storage latencies are doing very well & improving due to flash. So from hardware POV, it should be a good time for swapping.
Malwarebytes Anti-Malware 3.0.7 Serial Key and Crack GET [Free] Here
Sure- for me it's a ritual to take a break work. And it works really well.

>Humans did not evolve needing these stimulants.

We have had no time do adapt evolutionally to the different requirements of civilization. So I think this point is moot
(we are built to hunt and gather I understand).
Paper from Deep Mind potentially describing how general AI will look like
It's not just me then! I hate these things with a passion too. I have largish hands, but hardly out of the ordinary, and yet I find it difficult to put my hands in and out of the drier without touching the bottom or sides. Another problem I find with these is that they tend to spray the water coming off your hands all over your face.

Not my favourite tech!
There is a fascinating BBC-documentary about chemical warfare history and the british Porton Down military research facility, hosted by Michael Mosley [0]. There is a part where the researcher actually makes sarin and VX right in front of Michael in a fume-hood. They literally watch the VX-liquid condense out of the vacuum distillation apparatus right in front of Mosley and the camera team.
[0] http://www.bbc.co.uk/programmes/b07hx40t

Edit: Program available here until mid March: https://tv.nrk.no/program/KOID23002916/mosley-og-de-kjemiske... If you can VPN to Norway.
Best programmers are domain experts. The line will just continue to blur.
Civil Rights Groups, Funded by Telecoms, Back Plan to Kill Net Neutrality
What One Photo Tells Us About North Korea’s Nuclear Program
That's a good idea, but most of the functionality of the site comes from its API. Then again, it's easy to require a key and a captcha to sign up, so your idea is good, thank you.
Maybe quote the second line as well?

> Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious version that verifies fine since it has the same hash the original developer signed.

What's your response to this? To me it seems like this would be a serious issue.
Monzo’s Response to Cloudbleed
any means of contacting you in private? (asked on another comment, but I guess it got lost, HNs comments are messy :)
And https://notehub.org/

(Features: markdown preview and password for editing)
That's not the biggest risk. The biggest risk is that a malicious actor stumbled upon this bug, realized they could trigger it with specially crafted HTML, then wrote a script to harvest the data, which would be private data from any website with an active session in memory on the shared proxy. In that case, the bigger websites are more likely to be affected, because high traffic means they're more likely to have data stored in memory at any given time.

If you think this is implausible, consider just one persona who could do this;

- Someone turns clouflare https service on their website

- They check their pages and see some random data in the middle of a <p> tag

- They reproduce the bug. Then they reproduce it again. Then they script it.
This is about Uber CLI not about your 'righteous' war against uber.
MobiCommerce, a top mobile eCommerce app builder launched its new version 3.0
After thinking a lot about buying an iMac for development (I've been using MacBook Air for five years now), I just decided to forget about it and consider another platforms as ASUS VivoPC X, it is good looking enough, incomparable horse power and way too much less expensive. The only thing I am sure I am going to miss is MacOS.
[book] Elementary Number Theory: Primes Congruences and Secrets – W Stein (2017) [pdf]
Don't let the perfect be the enemy of good. Or in other words, I try to adjust my opsec/persec to a realistic threat model, not to my worst dystopian nightmares.
What Goes into Making a Reliable Tax Report?
Whilst the experimental subjects and data collection are inherently fraught with difficulty, there's still a LOT of low-hanging fruit regarding things like automation. Many scientists use computers to write up results, to store data and perform calculations, but there's often a lot of manual, undocumented work which could easily be scripted to help those re-running the experiment. For example, running some program to produce a figure, without documenting what options were used; providing a CSV of data, without the formulas used for the aggregate statistics; relying on a human to know that the data for "fig1.png" comes from "out.old-Restored_Backup_2015~"; etc.

Such scripting is a step on the path to formalising methods. They'd help those who just want to see the same results; those who want to perform the same analysis using some different data; those who want to investigate the methods used, looking for errors or maybe doing a survey of the use of statistics in the field; those who want a baseline from which to more thoroughly reproduce the experiment/effect; etc.

The parent's list of mouse-frighteners reminds me of the push for checklists in surgery, to prevent things like equipment being left inside patients. Whilst such lists are too verbose for a methods section (it would suffice to say e.g. "Care was taken to ensure the animals were relaxed."), there's no reason the analysis scripts can't prompt the user for such ad hoc conditions, e.g. "Measurements should be taken from relaxed animals. Did any alarms sound in the previous 24 hours? y/N/?", "Were the enclosures relatively clean? Y/n/?", "Were the enclosures cleaned out in the previous 24 hours? y/N/?", etc. with output messages like "Warning: Your answers indicate that the animals may not have been relaxed during measurements. If the following results aren't satisfactory, consider ..." or "Based on your answers, the animals appear to be in a relaxed state. If you discover this was not the case, we would appreciate if you update the file 'checklist.json' and send your changes to 'experimentABC@some-curator.org'. More detailed instructions can be found in the file 'CONTRIBUTING.txt'"
I was literally just saying to someone that this sort of tool needed to be made. Good job!
And which of these are "package systems supplied by your operating system"?
The customer. The bot cannot do that (and if it could, it would not need to I guess).
eastdakota is one of the cloudflare guys, so "they" in that sentence can only refer to Google (see also the previous paragraph/sentences, where eastdakota used "we" for cloudflare).
Seven sci-fi predictions about robots that came true
Returns 404, the link should probably be
https://noctuasky.com/planetarium/
Why Do We Spend So Much Time Teaching Historical Physics?
> Most language-specific ones do.

Those are development tools, not deployment ones (even though they are used as
such; programmers usually don't bother with learning what sysadmins do, so
it's not a surprise).
Note that if Cloudflare didn't have the content of those sites and their requests in memory this couldn't have happened.
Exascale Leaders on Next Horizons in Supercomputing
Unfortunately this seem to include news.ycombinator.com
>the audio without the music is a derivative work of the audio with the music, which is itself a derivative work of the music //

Obviously this is technically correct, which is usually the best kind of correct (internet memes can't be wrong).

However, legally whilst the work of 'music+speech' is used to acquire the speech the resulting speech is not artistically related to the preexisting 'music' work. The art is supposed to be the bit that copyright protects.

In practice Fair Use / Fair Dealing should apply quite easily to the whole work, or indeed a processed derivative used for (eg) news reporting. (The rights holder licensed use at a rally they should thus have anticipated Fair Use reproduction for news/history.)

The derailment on that line though would be when the speech is made over music that the speaker didn't get permission to use. Use of arms-length controlled corporations could probably generate such a situation.
Is Arduino based on C or C++
Toddlers’ grammar skills not inherent, but learned, new Stanford research says
It should have:( For the moment I changed the server config to support .html. I'll make a redirection later.
Also git compresses before hashing IIRC.
Facts about migration and crime in Sweden
Why India needs to go cashless
Indeed, they probably have to have the same length since the length is inserted into the final block as part of SHA-1 hashing and every block after the collision must be the same. I don't think it's even possible to create a MD5 collision between two documents of different length yet.
This is exactly what euyyn is saying: create two files with the same SHA1 (by adding bytes of gibberish to an unused section), commit one to the repository, and now you have an collision available.