skysight-inc/HackerNews huggingface dataset:
Circuit designers didn't lose their jobs to EDA tools any more than software developers lost their jobs to compilers.
ASK WHO is she
WHO is she?
Designers, developers and gamers have always been the opinion leaders in personal computing. Apple showed they could maintain and resurrect their business by keeping their appeal with designers and making an attractive platform for developers. Gamers always stuck with Windows or consoles.

Abandoning designers and developers means gradual erosion of your position as leading personal computing platform; the opinion leaders are no longer on your side telling everyone how great your products are.

Now this might be a really smart strategy when you factor in mobile and cloud computings impact on personal computing. Hard to say how that will play out. My guess is it's a big mistake to leave designers and developers behind, especially as we enter the era of VR content creation.
Note that in addition to the Morse Code that roughly equates to "printable" ASCII, there are prosigns [procedural signals] which are control characters that affect things like transmissions and message formatting.

https://en.wikipedia.org/wiki/Prosigns_for_Morse_code
That would be unrelated to this. We haven't taken any action on any accounts because of this issue and have no plans to, as we (reddit.com) were unaffected.
Not much harder than creating a collision in each of the hash functions, sequentially. You can't combine two broken hashes into a strong hash. But as long as at least one of them remains unbroken, then their concatenation is clearly secure too - assuming you keep the full result of each hash function and concatenate them into a long output, rather than trying to combine them somehow. Since it's impossible to know how resilient a given hash function will turn out to be against future cryptanalysis, it can make sense to hedge your bets by combining dissimilar functions.
You missed the "possibly" in the header.

And the disclaimer right at the top:

This list contains all domains that use cloudflare DNS, not just the cloudflare SSL proxy (the affected service that leaked data). It's a broad sweeping list that includes everything. Just because a domain is on the list does not mean the site is compromised.
The scary part is I keep saying that each and every year.

They just keep getting more and more insane.

Even two years ago when I bought Iron Commando for the Super Famicom, the $240 asking price was insane. It's at $1500 now for a complete copy. I passed on Pokonyan for $100, thinking that was too high, and a year and a half later ended up paying $800 for it.

How many years can the prices keep doubling like this? How can anyone afford to collect these games at these prices?

The whole thing feels like a giant hyper-inflated bubble.
We moved off of CloudFlare to Fastly before this vulnerability.
This has been bubbling for a while.

https://techcrunch.com/2014/02/17/microsoft-launches-smart-v...

http://codesnippet.research.microsoft.com/

Things will continue to simmer and obviously we are safe for a few more years but I for one welcome the day when machines replace us.

Anyone aware of any opensource repos that we can help contribute to on this topic?
Reddit is not affected.
Guess I did the right thing enabling 2FA everywhere possible, but how come such a huge bug was left open all these months? Not even cloudflare sec team notice it?
It took five years to acknowledge that the Radeon X1900 XT video cards in the 2006/2007 Mac Pros were inherently faulty. They would regularly overheat and fail. Apple based forums spread out the internal case numbers that tracked the issue. In the end, five years later, anyone that had one was given a free replacement. Five years is a very long time in the terms of hardware obsolescence.

The only reason I did well in that situation is because I had the AppleCare warranty they kept replacing the video card no questions asked.

My 2007 MacBook Pro was given the option for a free repair or replacement as well for issues with the nVidia video chip overheating and desoldering itself. The problem with that was that it also took eight years for them to finally acknowledge the issue. However, I missed the short warranty window in which people were allowed to claim it.

Apple has a horrible track record for owning up to their problems.
This seems like linkbait to me. My understanding after looking at the document is that the heart of the issue is whether organizers of protests that lead to destruction of property should be liable for that destruction of property.

Maybe I'm missing something, so if so, can somebody explain to me what purpose "the Same Way They Do Terrorists" serves in the title of this post other than draw a very emotional association?
SSH or a web editor.
Why would a developer be on a mac in the first place? Cause ur a fanboy? Cause ur against monopolys?

If i need to build code that apple says can only be built on a mac, i simply spin up my mac VM and point some tools dont need to drink any koolaid to get the job done.

MDI + keyboard skills beats vim ninjas any day of the week.
Me too (typing this in my 277th tab)

Using Firefox on Bunsen Linux (Debian Jessie derived)

Its only using half of 4G of RAM, but there's 20 Mbytes in swap.
SHOW HN: Quality service for PSD to XML works
> Not saying it's easy, but now it's on the horizon.

Not really. It's not a preimage attack. They spent several hundred dollars to find two random byte strings with the same SHA1 hash. There's still no way to SHA1-collide a specific byte string instead of random junk.
Improved WebGL experiment to compare multiple planet sizes including Trappist-1
7% share according to this article https://www.recode.net/2015/12/6/11621176/google-ventures-ow...
I'm confused by the "not affected" remarks. I thought the issue was any site which passes data through cloudflare could be leaked by requests to a different site, due to their data being in memory. Have I misunderstood?
Oh my gosh, that's the Ivey Business School, where I graduated from last year. I didn't expect this to hit so close to home...
As in InfoSec guy, I confirm you did the right thing. Better be safe than sorry!
But the server might have sprayed out your login credentials while travelling through Cloudflare.
What's the fear? Aren't all passwords encrypted on the server side?
Thanks for the nice feedback everyone. I had some time tonight after work and made an improved version with better selection UI and allows for multiple bodies at once: http://callumprentice.github.io/apps/celestial_bodies/index....
>1. OP article has nothing to do with JavaScript.

JSON is a format directly derived from JavaScript. The affinity for using JSON for things that have nothing to do with object serialization or simple data structures is characteristic of JS mentality.

>2. It's not like the JS community is anti-XML, most JS libs/frameworks still use HTML/XML markup for rendering.

Of course JS community is anti-XML. They don't use XML even when it makes sense to do so. And they use HTML only as a rendering layer, completely ignoring its other use (e.g. semantic document format).
> Those of you that need (outdated) proprietary software

I'm not clear how Photoshop is "outdated", unless you're trying to make some convoluted dig about proprietary software being obsolete as a concept.

> should just give up on security to begin with, PGP or no PGP.

This kind of smug dismissal of the average user's needs and abilities is exactly why Linux on the desktop never took off.
I get that a lot of people on HN are highly skeptical, but Google Ventures claims to be completely firewalled from Google corporate (this issue is only made more confusing by the fact that Google Capital is not firewalled, and by the fact that Google corporate itself also invests in companies).

I do believe them: many media firms have the same set up between the journalism and advertising departments.
TECH WATCH: 10 trends that will define 2017
"git diff" highlights, in bright red if you have color enabled, trailing whitespace. The changes you'd be able to make without making it suspicious would be highly limited.

Maybe it's possible, but it doesn't seem very likely for source. You'd be more likely to succeed if someone stores binary files in git where people don't have an easy way to audit what's causing the difference. But in that case it would seem you likely have simpler attack vectors.
> In 20 years, the $100,000 attack will be a $100 attack (or perhaps a $1 attack)

No. Moore's Law has been dead for years and will never come back. The benefits we saw in recent years came from people figuring out how to compile code for SIMD processors like GPU's, not faster or cheaper silicon.
Ayurvedic home remedies to boost eye sight, physical strength,memory power
Back when the first intel macs came out, they actually were made for developers and were great machines.
Ask HN: How do you develop a charismatic personality?
I have been doing software development for a long time now. I noticed that I am always in my head. I have zero charisma and may be suboptimal personality. Once I start talking, I am able to convince people.
But, I don't have the charisma of a director/VP/CEO of a large scale company.

I am reading Charisma myth from Olivia Fox Cabane. I agree with the content. I have been exercising and improving my posture for last 6 months now.

My question is -

1. What can I do to get out of my head? Meditation is good but I feel it is just not helping me out.
2. What can I do to think on the fly? I like planning and being highly analytical. But, the world is less analytical than it should be.
Without disagreeing, can you give me an example.

And it's just a speculation. Shrug.
Simplifying Your Transition from Macro to Microservices
How much has Spiegel's father earned for footing the initial bills?
Why I didn’t build my company in Silicon Valley
GitHub GDC Party 2017
God i feel you. Everytime a pastebin close we get a surge of dox / warez / child porn activity on http://0bin.net. Since by design we can't monitor it we just get notified after the fact by concerned citizens mailing us. One month our mailbox is empty, the other one it's report day every day.
I think it is universally understood that Ronald Reagan, Bill Clinton and George W Bush established the trend. You seem to think that nobody understands this, but I think everyone understands this. There has been a growing authoritarian trend that goes back decades. The trend is worrisome. One manifestation is private prisons. There are lots of other manifestations, too many to discuss here. We can criticize the latest manifestation, and also acknowledge that the problem has deep roots in time. You sound like you feel this is an either/or situation, but I think many of us who care about civil liberties are worried about the entire 40 year trend. It's especially worrisome to think where we end up if we continue in this direction for another 20 years. With prisons and with all other issues regarding civil liberties, the current trend is ominous.
previous discussion https://news.ycombinator.com/item?id=13711910
You're better off building a hackintosh and sticking a huge GPU in there.
The PDFs have the same size, but they do not have a header in the file that states their overall size. If PDF had a header at the beginning of the file that states the file size, then it could be harder to find a collision. From what I understand, the attack works by inserting garbage data after a fixed file prefix and before a fixed file suffix (anyone please correct me if I'm wrong).
Thanks for posting and curating this list.
WiFi AP Direction Finder with Augmented Reality User Interface [video]
An entry level computer that provides just the basics... for 1300 dollars.
> Showing your ID isn't waging a war against voting rights, its straight up common sense like we have to do for every other thing in society.

Yes. And it would make sense if the USA had some form of free universal ID. It doesn't, and the people most strongly in favour of voting ID laws also seem to be the most strongly opposed to universal ID.
That sounds awful! Is that just a "laptop" rule (i.e. are "desktops" exempt)?
SHA1 and Mercurial security – Why you shouldn't panic yet
It comes across, in the context of the comment you replied to, as incredibly dismissive. If you can't see that, I can't make you see it.

It also seems to imply that the rest of the world would tell you to stop working on your supercomputer and go deliver rice in Africa or something. This actually is elitist and condescending, as it assumes that just because people are starving today they would be unable to understand the value of your work. You should give the rest of the world more credit. That's the elitism.
From what I remember, OSX is just wasn't cut out for dealing with NUMA
Nothing (in the league of things we are discussing) is inevitable, it's a result of choices, sometimes masked with rationalizations of how things are inevitable. For me good times start where there are people with both feet on their own liberate square meter to have fun times with, to the rest I can only say "connect me to whoever told you this".
Require some complex js codes workflow to post using websocket or something and most automated spam goes away. They are mass mindless bot, not targeted spammers.
To elaborate, it uses a series of dynamically-sized swap files (something like 256 MB, then adding a 512 MB file, then 1 GB, then 2 GB, etc)
Web Page Essentials for a Fast Loading Site
To add on to this, the existence of other Google investing arms makes me more believing of the claim that Google Ventures is firewalled from Google corporate; it seems Google needs Google Capital (and Google corp which also directly invests sometimes) because they can't tell Google Ventures to invest in certain companies even if they would like to for strategic reasons.
Sad to see an innocent die, this is what happens when elections are fought over hate.
Ah I didn't notice that that was your longer comment above this and misinterpreted you.

I'm not convinced that the deflationary spiral argument applies to what I view as a settlement layer, but it's definitely concerning to Bitcoin's future. I will agree that as long as bitcoin is seen as more of a commodity than a transaction layer, it will have a questionable future.
Wow, Linus raises an entirely different issue which is that the PDF-based attack won't work on git at all. Due to length prefixing, it is extremely difficult to insert nonsense into the middle of a git object which is how this attack works on PDFs. Linus correctly notes that using the first forty bytes of SHA-256 is an option if an attack against git's use of SHA1 were developed.

1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

I don't think I've ever (intentionally) used git over HTTPS. I always clone using ssh (which has its own authentication mechanisms) or the git protocol (which is read-only).

2) Even if git did rely on SHA-1, there's no imminent threat. What happened today was a SHA-1 collision, not a preimage attack. If a collision costs 2^n, a preimage attack costs 2^(2n).

Thankfully, the collision attack doesn't apply to git (see above) so the cost ought to be greater than 2^n for a collision.

3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's objects, they'd still have to convince you pull from their repo. This requires trust.

Find a popular git host (say, Github but if a popular project is on Git Lab or Bitbucket, they will do just as well) and compromise them. Target a recent release for a popular project (say, Rails) and poison a relevant object that gets pulled down by all the downstream maintainers to package the release.

The benefit to straight up compromising a git repo without faking the hash lies in introducing a vulnerability without the maintainers nor developers of the project noticing (or noticing months/years after the fact).
There is not mutch risk now, but git should be able to switch to another and longer hash. Truncating another hash to 40 chars does not "fix" the problem. It just move it into another place.

Another possibility, but this is a hack to keep key length to 40 chars, would be to change key encoding from hex encoding to base64. In 40 chars you could encode 240 bits instead of 160. It is preferable to get rid of the hard coded 40 char limit. It shouldn't be that hard.
The update from 1password indicated that there was application layer encryption happening in addition to the TLS encryption, so a breach of the TLS protection did not expose any sensitive data. Presumably other sites are in similar situations. But don't take my word for it, go change all your passwords.
I think from a design standpoint it was interesting, and might have been forgivable if there had been slightly more diversity in the GPU lineup and if they had kept it up to date.

The latter one is the big one. You can't just leave an unupgradable professional focused machine sitting on the shelf rotting.
I wrote this(1) script to check for any affected sites from local Chrome history. It checks for the header `cf-ray` in the response headers from the domain. It is not an exhaustive list but I was able to find few important ones like my bank site.

1: https://gist.github.com/kamaljoshi/2cce5f6d35cd28de8f6dbb27d...
The least surprising message of the day. Thank you.

My Fastmail-money is well spent.
Git prepends type and length, that makes an attack significantly more difficult, and certainly you cannot just directly translate the pdf attack to Git.

For applications, such as signing pdf or other documents, SHA-1 should be retired. But the collective crypto community have said that for more than a decade, so I have little sympathy for companies that is affected by this.

But for Git, there is no reason for immediate concern. Should they upgrade to a more secure hash function, yes. Ideally they make it rather straight forward to use different function in the future and perhaps multiple hash functions. I doubt anyone is able to find an input that MD5 and SHA-1 both hash to the same value. It would significantly reduce reliance on a single hash function.
Even when it was new, the GPU was a problem for me. Now it's both a problem and old, which is not a good combination.
Apply the first one directly to the skin. Apply the second as a spray.
I doubt we have any container technology today that anyone would want to use in 10 years, just like nobody would want to use a Java applet today.

And I say this having used Docker myself to make one piece of computational research reproducible. I'm not sure it helped in the end. I do encounter people who want to reproduce it, and mostly I have to teach them how to use Docker and then apologize for all the ways it goes wrong.
Yes, full of contradictions, like the journalists are good at making deep work in pieces of 10 minutes where just before this is the definition of multitasking reducing the quality of deep work.

Every single page is contradicting another in the book. This is because he tries to write a book from a single idea. A bit like if the top comment on this thread about "boring yourself to do deep work" would be converted into a 200 page book. Of course at the end, you eat yourself like a snake and you cannot find any more ideas to fill the pages.
Mitch Kapor must know that a number of founders will react this way. That makes it a stronger statement, because it's costing him something.

As a thought experiment, what if Travis Kalanick personally committed a serious violent crime, and Uber the company was covering it up? I think you would agree that it would be ethical and commendable in that hypothetical case for Mitch Kapor to go public like this with his criticism.

So if you accept that, then really it's just a measure of what offense is bad enough that it's ethical for an investor to criticize an investment like this. Maybe to you this sort of offense is not so bad, it's on the "okay" side of the line, and to Mitch Kapor this offense is pretty bad, it's on the "not okay" side of the line.

I don't think either you or Mitch Kapor is a bad person here. But, maybe all this public outcry indicates it is worth you thinking for a bit if perhaps you are underestimating how bad it is to allow this sort of environment at your company. Maybe you have been thinking "hmm this sort of problem is X amount badness" and the reality is it's 3X units of badness.

Personally, this makes me more likely to want a Mitch Kapor investment. If I am founding a company then I really do not want the culture to be Uber-like in its treatment of women. In fact I'd like everyone working at the company to know that up front. After he called out Uber publicly, anyone taking money from Mitch Kapor in the future is making a statement that they care about their culture not ending up like Uber culture.

Anyway I can't see inside your head so I don't know if your real nuanced stance on this is right or wrong but I wrote this comment in the hope that you would reflect a bit and consider retuning your instincts on "how bad is this sort of behavior" to be more critical of it.
Things to Consider Before Hiring an App Developer
Cloudflare is also breaking anonymous surfing by throwing captchas at you.
Security wise they do DDoS ok but not WAF which Incapsula does a lot better.
When I mean better I mean protection against exploits.
I've begun painfully shifting away from Mac Pros for scientific computing work as well, which six or seven years ago I wouldn't have believed. But my lab recently bought a high-end workstation and the MP didn't make sense, and my current MP is getting a bit long in the tooth and, unless something very unexpected happens, it's replacement won't be made by Apple.
But if an in-transit plaintext password is leaked by CloudFlare, server-side encryption is irrelevant.

(... that said, it's not like revoking sessions would impede a password-holding adversary...)
Sounds like sentence three is where you got it wrong. You should be pulling your software to a development host, building it after verification, and uploading the deployment package to an artifact repository inside your security perimeter. Sentence three becomes 'pull library X from my artifact server.'

There is no way to securely deploy a package directly from the internet. The sooner you understand that, the sooner you'll be able to sleep through needless catastrophes like this hypothetical attack -- or leftpad.js.
Cheaply fix DDoS attacks as Cloudflare does and people will move away. It's a big problem and the general consensus is, "just use Cloudflare to fix your DDoS problem!"
Ahhy my wife mentioned this happened to her this morning, she thought her account had been breached.
As a side note, in some poor, largely rural countries, acetylcholinesterase inhibitors in insecticides are the most popular suicide agents.
I cannot remember a single occasion, where my desktop recovered when it started swapping. Always, the whole system locks up and I need to reboot. Thus, better kill some random processes instead of all of them.
I'll accept that it's hard, but why do you think Google didn't do it right?
Trojan of Things: Embedding Malicious NFC Tags into Common Objects
Happened to me too, only on a work email attached to a custom domain though and not on any of my Gmail.com ones. Strange.
Does this have anything to do with CloudFlare's ambitious attempt to be the first service to proxy your https traffic to your users?

Perhaps the largest MITM ever eh?
At google's scale, it seems "some" === 10 million :-)
No.. may be my code is just not worth commenting ;)
Confirmed, reddit.com was removed from the list. My mistake for not double checking this one.
Seems not to happen on 2fa accounts
Yeaaaaa, this isn't good.

This is what CloudBleed looks like, in the wild: https://gfycat.com/ElatedJoyousDanishswedishfarmdog

A random HTTP request's data and other data injected into an HTTP response from Cloudflare.

Sick.
Announcing MirageOS 3.0.0