skysight-inc/HackerNews huggingface dataset:
How to F*k with your friend using WordPress, Facebook ads, and $36.52
It's telling/ironic that the google security blog will not display the text without javascript enabled.
What is this mythical "appropriate conversation" you are alluding to?

That Facebook's primary incentive is to create as much detailed information about the individual as possible, in order to broker that information to advertisers and surveillance regimes?

I think you just don't want to have that conversation :-)
This discussion reminds of this question/answer on quora: https://www.quora.com/Since-programming-can-be-self-taught-w...
Related: someone claimed a 2.48 BTC (~2800 USD) bounty by using this SHA1 collision data: https://news.ycombinator.com/item?id=13714987
It was honest. Didn't know that it was black history month, I live in Scandinavia where we never used black people as slaves (albeit you could see them in a zoo hundreds of years ago, but that was while arabic slavers was still pillaging islands taking virgin girls as far as the Danish west coast for slavery in harems).

I just don't see the point in poking a wound like that at frequent intervals...
Isn't this related to this change on kernel 4.10? https://kernelnewbies.org/Linux_4.10#head-f6ecae920c0660b7f4...
Or they could do what Romney did and have most of the Olympic facilities out in bumfuck nowhere to avoid inconveniencing the city with traffic.
Fair enough, I was using Chrome "Version 50.0.2661.102 (64-bit)" on Linux Mint. I have updated it to 56.0.2924.87, now I'm getting a full error page "Your connection is not private" NET::ERR_CERT_WEAK_SIGNATURE_ALGORITHM. I need to search for this issue now.

No I'm not using anything that intercepts TLS connections.

EDIT: It's fixed now, `sudo apt-get install libnss3-1d`.

http://askubuntu.com/questions/880695/neterr-cert-weak-signa...
There are paying users!
What is it about Rust that makes porting QT different from any other language?
Sorry to interject, but does this imply that FB is not a distracting insular tire fire? hmm...
But you choose amount of RAM dependant on maximum memory usage. Therefore swap space (being proportional to RAM) becomes dependant on largest expected allocation also.
It wouldn't be wise to build system with 2Gb of RAM and 4Gb of swap space, when you need 6Gb of memory at peaks: such a system would be slooow. It may be not wise to buy 8Gb of RAM when 5Gb is the maximum that might be needed.
I haven't seen the actual PDFs, but the way my crypto prof taught me about this attack in college is that you generate a PDF of the form

if (x == a) {
// display good content
} else {
// display bad content
}

You have to craft this PDF file in such a way that given a SHA1 collision (a, b) that the file with x = a and the file with x = b have the same SHA1. (There are some nuances about aligning to block boundaries, IIRC.)
The Joinmarket Community Wants to Improve Bitcoin’s Fungibility
You know, the interesting thing to me as a sysadmin was coming to understand that tech is inside every industry, but not every industry is inside tech, if that makes any sense. In that way, I have seen the insides of hundreds of companies, from 2 man law firms to fortune 500 oil companies, and the almost universal thing I have found is that the tech side of the business is usually being underserved and under-represented in the boardroom.

Think about how many senior sysadmins you know that answer to a CEO, or to a CFO, instead of a CTO or CIO... What is going on in my opinion is that without someone playing the business-political games for them, tech workers almost always are forced to move companies in order to find upward mobility.

I got burnt out in my last position dealing with this very situation, and so I have been spending more time trying to understand how the best CTOs and CIOs do their job, so that I can eventually help other sysadmins/future employers understand how to fill that gap since management largely doesn't understand the technical debt they create by cutting short-term costs in that way.
The real issue is not an amount of swap but thrashing.

E.g., several large processes sleeping in memory on desktop would be fine if only one or two used at the same time. OTOH, clustered nodes well tuned for a single task may not need a swap.

In any case, it is a metric for thrashing that should be used to initiate culling.
Ask HN: Would you use a site that explains complicated topics in plain English?
How many times have you looked at a software project's website, or docs, and closed the window because it didn't say, simply, what is is or how it could be useful?

How many times have you stopped learning a hard topic because there was seemingly no clear and digestible way to get started with the topic?

I've come to think that overcomplicated language is one of the main limiting factors of human knowledge/progress.

Would you use a website that let you search for things and read plain English, no-bullshit descriptions of stuff? (I'm thinking a good place to start would be to write better descriptions of software libraries than what's written by the projects themselves.)

Thanks in advance! :)
What is a "TCP monitoring tool with a REST interface?" Do you want a TCP proxy, or a system telemetry tool to report TCP related metrics?

I don't see why you would want to apply REST to a proxy unless you mean using REST to create filtering/interception rules. Using REST for a telemetry tool might be a good solution.

If you need packet filtering, there are tons of TCP proxy solutions out there. Maybe try this: https://github.com/ickerwx/tcpproxy

If telemetry is what you're after, maybe have a look at OSQuery (https://osquery.io/) from Facebook.
I honestly try to do this all the time, but mostly for those who are less vocal, the quiet ones. I tend to be on the other end of the spectrum, so if I never shut up at least I'm throwing someone else a bone in the process.
Or, if you're really clever - and Ange Albertini is quite good at this kind of trick - you can design the PDF so that the different garbage in the middle causes the other, unchanged content to be interpreted differently in the two PDF files, possibly even designing it so that the intended contents of each PDF is treated as garbage and ignored entirely in the other PDF.
Very detailed thought. Thankfully, the human body doesn't work like that so I think I'm okay. So far nothing has hap<BARFdn091@ #( .1#

NO CARRIER
We're talking about energy storage, are we not?

If you think that energy storage "makes money", build a small 10MW battery plant to supply a neighborhood or two. Buy electricity when its cheap, sell it when its expensive.

There's no "common infrastructure building" going on here. You own the batteries, and maybe you have to pay the big utility for some power-poles and comply with some basic regulations.

The fact of the matter is: these sorts of infrastructure issues are being solved by the free market all the time. Frequency regulation, long-term energy storage (which really is just ~hours) and such are commonly subcontracted out to smaller companies who own small plants from the big utility companies.

-------

> I haven't invested in the infrastructure because electricity is not my business.

Then do the next best thing. Buy stock in companies that are doing grid-scale energy storage across this country.
One of the "no" bets was for ~7.4 BTC (~$8500 USD). Interesting that somebody was willing to lay down that much.
Yeah. I've had issues with this on some systems.

On Windows without swap when you hit a remotely low on RAM point, things start going really poorly for some reason - random latency. So with 16 GB of RAM even I can't disable swap on Windows without some really strange performance characteristics, I run SSDs so I really wanted it off and I just stuffed more RAM in my box - with 32 GB it isn't a problem.

On Linux however, you can pretty much turn it off and everything will run smooth until you're actually out and then you lag badly briefly, Linux's oom-killer does its thing and all is good again within the span of a few seconds.
With SSD's disk is not that slow.
A system that has way more swap than RAM will run out of 'performance is acceptable' way before it runs out of memory.

That was different in the early days, but that was because people accepted worse performance (GC that stops the world for seconds can be better than no GC, even when running a GUI).

Certainly nowadays, if you take out half the RAM, you will want to take out half the processes, too.
Obviously the landlord doesn't know or care what SHA-1 is, but he may care if his Adobe Reader says "This file was signed by the Department of Housing" at the top of the screen when he opens the PDF. As Reader fully supports signed PDFs and they do get used, believe it or not, this attack is not theoretical.
I am obviously speaking about the end result of that debate and my personal opinion, which I won't try to hide. The debate itself was substantial, however, not merely word games.
> I've had the OOM-killer render the system unresponsive a couple of times

Use earlyoom instead of relying on oom-killer.

https://github.com/rfjakob/earlyoom

To quote from the description:

> The oom-killer generally has a bad reputation among Linux users. This may be part of the reason Linux invokes it only when it has absolutely no other choice. It will swap out the desktop environment, drop the whole page cache and empty every buffer before it will ultimately kill a process. At least that's what I think what it will do. I have yet to be patient enough to wait for it.

[...]

> This made people wonder if the oom-killer could be configured to step in earlier: superuser.com , unix.stackexchange.com.

> As it turns out, no, it can't. At least using the in-kernel oom killer.

And earlyoom exists to provide a better alternative to oom-killer in userspace that's much more aggressive about maintaining responsivity.
But their automated thermostat won't mind!
Prolonged Sleep May Be Early Warning Sign of Dementia
Cold snaps certainly do happen even in climates that normally only justify a heat pump. I grew up in rural SE Tennessee, so I totally get that.

Even in an environment of electric heating and an impoverished customer base, the price doesn't have to be totally inelastic to avoid a social justice nightmare. You can choose not to run the electric clothes dryer in the middle of the night, for example. Having regular large price swings will be accurately perceived by the energy storage market as an arbitrage opportunity. Even if you only allow the price to swing by some limit (say, by enforcing a maximum price ceiling on the utility through the state regulatory commission), the electric utility will be incentivised to pay even more than the natural swing to third parties who can provide that arbitrage.
2016: The Year in Bitcoin
All the laptops at my workplace have the minimum storage (Apple...), it becomes frustrating when I open photoshop and almost my entire free space suddenly vanishes while my 16gb of ram isn't even 20% utilised
> I don't think the meter needs to be that smart.

The current energy meter is this: http://pimg.tradeindia.com/00263409/b/2/Single-Phase-Electri...

Anything smarter than that is considered a "smart" meter. A dude comes out one a month to see how many KWhr the meter has ticked up, then they send you a bill in the mail for you to pay.

All this talk about "spot" price and "day of pricing" simply doesn't work with current electricity meters that are deployed around the country.

And honestly, if we're going to be upgrading to "smart" meters... we should all have "smart bi-directional" meters to account for the ability to "sell back to the utility". (IE: Net Metering).
Aren't there legacy applications which expect swap where otherwise with modern applications swap isn't necessary? Or, at least that is my current (mis)-understanding...
these articles push me more and more to drop using gmail in favor of "self hosted email". i really do not understand why we do not think and give it all up for free to google (and compromise our personal security in the mean time).
We used their react-templates extensively last year and the experience was mostly positive.

This year we are moving from React to Vue. In parte because we prefer working with HTML + directives than JSX, but also because Vue is more pragmatic and much nicer on beginners and people coming from jQuery.
I see you are one of those people who can't stick to a topic for more than one message and constantly change the specific topic of conversation rather than engage in debate. Especially when my own message already carried the idea that Haskell and Python vary substantially in their mathematical content. Carry on then.
That statement didn't seem to be implying that men and women are different, but rather that men and women are treated differently by mentors -- specifically, that mentors are more likely to "endorse" men, and more likely to tell women how to improve. Immediately following that sentence the article says:

> A study of 4,000 women and men who graduated from top MBA programs (surveyed in 2008 and again in 2010) found that when women receive mentorship, it’s advice on how they should change and gain more self-knowledge. When men receive mentorship, it’s public endorsement of their authority and concrete steps to take charge and make career moves. [...] Men who received mentorship were statistically more likely to be promoted, but that was not true for women who were mentored.
I think those who would forgive her believe that the response is disproportionate, and that the cheating doesn't rate worldwide infamy. I guess I side with runnr_az on this in that what she did is not right but it also isn't very important. But maybe he and I share the same worldview on running and racing, in that in almost all cases racing's value comes from doing the race, not the result. Yes, in the moment I'll do whatever I can to scratch out one higher place in the result, but after the race is done it really doesn't matter if I got 23rd or 123rd. Those that finished faster could have trained harder, trained more, had more experience, had better coaching, had better genetics, or even cheated, but I found that in the end those places don't matter nearly as much as the experience I got, and even if I found out that one or five or twenty people had cheated in the races I've done, it wouldn't have taken away from that experience.

I guess if one subscribes to the race-as-life metaphor, where cheating in a race is tantamount to stealing from someone, and how one acts in a race is how one will act in the rest of life, I can see more reasons to get angry, but I think that viewing this as "rupturing the social contract" is a more extreme view, and is entering the area that Hugo was exploring with the Inspector Javert character. Yes, she cheated, yes it's wrong, and yes, she should face consequences, but how much mental energy should we expend in the pursuit and punishment of this cheating? I think I'm almost as disturbed by the obsession with the cheating as by the cheating itself.

Maybe this thinking is objectively wrong, but at least for me that's why, if forgiveness means not to ban her from all future events, my impulse is to forgive.
I'm okay with the alternative.

HTML + CSS + JS are just barely not shitty, but have such widespread adoption and libraries. Web apps are just so easy to package and maintain.
It's schrodinger's cat. When you observe, its state collapses.
As someone who has long explored such subjects, this type of discussion is the worst place to try to have that kind of discussion, it is usually unsalvageable if you start by defending the thing others are attacking, and you should start with reading up on things like broken windows theory. In a nutshell: Abuse begins with disrespect and escalates to worse things. If you insist on real respect for all members of the group, abuse becomes far less common.

This is the reason I criticized your comment. Women get shunned, silenced, disrespected, etc in ways that are career killers, that happen solely because they are female and which most men would never put up with. When men are called on this uneven pattern of behavior -- especially by a woman -- the person calling them on it gets attacked, often viciously so, for disrespecting the man.

Real respect is a two way street. When one group or person is supposed to get respect and another is supposed to give it, it isn't respect at all. It is kowtowing.
Cellebrite can unlock iPhone 6/6+ and extract data from array of popular apps
"A language that doesn't affect the way you think about programming, is not worth knowing."
There's some neat software now (not sure if it was around when you were in college) to translate video into reliable data about the movement of animals. I've used it for fish, but the same software can be used to track people around a room or to track mice in a cage. I think that might be much more useful than, say, how many backflips a mouse does in their cage.
If you can do a first-preimage attack, you can do a second-preimage attack. Just hash the document you have. Therefore a first-preimage attack is strictly more severe.
Okay I did not know this. I thought it was connected to the FB account, just like how AirBnB and Dropbox require an account.
The rule made sense when your system had fewer than 128-256 MB of ram. These days it doesn't.
Setup a MITM proxy for an iPhone and show them how much private data is going over the wire.
> Is there any way to tell the OOM killer which program to kill first?

The fun OOM analogy [1] that comes up when people propose different OOM killer designs:

> An aircraft company discovered that it was cheaper to fly its planes
with less fuel on board. The planes would be lighter and use less fuel
and money was saved. On rare occasions however the amount of fuel was
insufficient, and the plane would crash. This problem was solved by
the engineers of the company by the development of a special OOF
(out-of-fuel) mechanism. In emergency cases a passenger was selected
and thrown out of the plane. (When necessary, the procedure was
repeated.) A large body of theory was developed and many publications
were devoted to the problem of properly selecting the victim to be
ejected. Should the victim be chosen at random? Or should one choose
the heaviest person? Or the oldest? Should passengers pay in order not
to be ejected, so that the victim would be the poorest on board? And
if for example the heaviest person was chosen, should there be a
special exception in case that was the pilot? Should first class
passengers be exempted? Now that the OOF mechanism existed, it would
be activated every now and then, and eject passengers even when there
was no fuel shortage. The engineers are still studying precisely how
this malfunction is caused.

[1] https://lwn.net/Articles/104185/
Yes, it really is a generally good thing for all humans. Everyone responds generally positively for being recognized for whatever their contributions are. Even if the ideas aren't particularly amazing, there's something pretty powerful in general human interactions that happens when you make a point of noting people's ideas, and making correct attribution. This may be somewhat of a learned skill. In practical terms, it's as easy as a summation of ideas thrown out--e.g., "Bob has suggested we take a better look at X. Sue's thinking we ought to consider Y."

Some time later, when another person offers up an idea, there's a different relational outcome between saying, "Oh, nice idea, John"--while Sue is thinking, That's an awfully lot like my idea from a couple weeks ago--and saying, "Oh, hey, that sounds a lot like Sue's idea from a couple weeks ago, but with a little twist." Sue's going to respond positively because you're acknowledging her idea. John's going to respond positively because you're doing the same for her. Now both of them may be encouraged to work together on it.

There's also a funny thing about us humans in that the same ideas and thoughts can hit us differently at different times. Making a point of tracking (mentally or otherwise) people's contributions to an organization isn't something that is likely to ever be a bad idea.
So from a security standpoint if my hash was a sha-1 concatenated to an MD5, how long would it be before they found a collision?
SSDs are only ~4x faster than magnetic last I checked. If RAM is 100ns per access, and hd access is down from say, 1ms to 0.25ms, that's still a huge huge gap. 4x isn't even an order of magnitude.

EDIT: see comment below for more accurate numbers.
Ah, this is a great idea. It'd also be easier to understand and see service degradation (ie. physical memory being used on the host) directly from something like vCenter instead of relying upon Solarwinds to tell me the host is out of memory.
> ... it's easy to screw one up no matter how sound the underlying science because you messed something up.

Yes, but when a replication fails, the question one wants to ask is whether it was the original study or the replication effort that caused the problem. J. B. Rhine's seemingly solid psychic-abilities studies couldn't be replicated, but this was because he kept tossing results that didn't fit his expectations, something that didn't come out until after he passed on.
So far the feedback from Node.js users/developers indicates that the --future configuration is a net win. There are some cases where performance degrades, and we are actively working on those. Instructions how to test-drive --future with Node.js can be found here: https://medium.com/@bmeurer/help-us-test-the-future-of-node-...
I have tried to use Docker on very busy processing systems with short to medium running tasks. My efforts were on Ubuntu 16.04... because any non-LTS is almost a non-starter.

There were two major obstacles; the file system driver and the Docker daemon. I ended up settling on 1.11.{i forget}, because virtually every other version was unusable. As sad as it may sounds, I was tracking two metrics; probability the container will start and time until the docker daemon reaches a state of irrecoverable dead-lock.

Personally I found containers (on a highly contentious system) launched at ~98% success rate with a time-to-dead-lock somewhere around 6500 container start/stop (it was a pretty fat tailed distribution). For a busy system... those numbers equate to an administrative headache.

And on Ubuntu/Debian the defaults (the thing the majority of non-specialists are probably using) were far worse. The only filesystem driver which seemed to work at all was devicemapper direct-lvm.

-

If you have developers on your team who can spend their time figuring out the one magic incantation that makes Docker work most of the time, you're fine. Everybody else should follow his advice for using service providers.
anilgulecha is correct. Consider the following attack:

You wish to undermine the security of an important codebase managed by git.

You write a valuable and useful contribution to the code. You also create another version of the commit that has the same SHA-1 as the first, which breaks the security of that code.

You submit the first commit, it is accepted and merged.

Now you wait for your target to do a git clone on the repository, perhaps because it's a build environment. You then MITM it (e.g. using infrastructure like QUANTUM INSERT) and redirect the clone to your own git server, which serves the bad commit.

The target compares the top commit hashes of what it expected to get and what it actually got, and is none the wiser. They now compile the code and produce a backdoored binary.
"Systems without swap can make sense and are supported by Red Hat - just be sure the behaviour of such a system under memory pressure is what you want"

So, it doesn't exclusively recommend it, but it concedes that there are use cases where it makes sense.
Automate the Boring Stuff with Python by Al Sweigart – Book Review
"She said that there was a meeting where a manager actually made a comment about underpaying her because she was a women then they immediately freaked out."

That sounds like she was discriminated against originally. When they inadvertently admitted it, they tried to shut her up with pay raise.