skysight-inc/HackerNews huggingface dataset:
By basing your choices on feelings (i.e. "not in the mood") you are likely to go with the path of least resistance. If instead you choose to do what you prioritize by conscious mental effort you are likely to feel more rewarded in the end. For example, if you decide that learning photography is important and you spend hundreds of hours practicing you will be more satisfied than if you spent those hundreds of hours playing a game. At least you will feel that in retrospect. In the moment, perhaps the game will seem more satisfying. But most people find more fulfillment in practicing a skill or hobby.
Bing and Yahoo with the same cached content. Interesting:

http://208.71.46.190/search/srpcache?p=yOGHqpbGWiXrRAIqLM87w...

http://cc.bingj.com/cache.aspx?q=%22X-SSL-Server-IP+104.16.5...
Amazon Deforestation, Once Tamed, Comes Roaring Back
After reading this, I'm considering switching from cloudflare for my DNS servers. Recommend a similar free service?
What precisely? I don't see a counter-argument.

If you're saying not to use any CDNs then that's not very reasonable considering the service that CDNs provide.
Play Guitar Notes
Archives don't delete stuff, nor do they have much capacity to do much computation on their archived data. Whereas if blekko still existed as a search engine, I'd just push code to refuse to show cached pages or snippets containing text that likely means the CloudFlare problem. 15 minutes work, and the underlying data would expire fully in a couple of months.

So I would completely disagree with your speculation about what's easy or hard. (Note that I've worked at a search engine and an archive.)
Hi Will. Thanks for the shout-out.

I still think many of the arguments in that blog post hold up for non-embedded KV stores. I think you can mitigate a lot by aggressively caching metadata, but eventually you end up moving the SQL engine closer and closer to the storage layer to get performance. And yeah, you end up more monolithic and testing gets harder. Sigh.

Some of this is workload dependent. If you're not touching many rows in your queries and transactions, then you can get away with a lot more. But if you give someone SQL, they're going to want to scan.

I wouldn't mind being proven wrong. Maybe Apple made FDB run SQL at legit speeds. I haven't seen much from public projects that work this way to change my mind yet.

> I won't claim that a transactional ordered key-value store is the perfect database abstraction for every situation, but it's one that I've found myself missing a great deal since leaving Apple.

How does Spanner not satisfy that itch? Not ordered matters?
Why can't they just search for pages with data after the closing HTML tag
That does seem to be an accurate name, it is a feature that's offered and up to the site operator to enable, and yes it's unfortunate that it potentially gives a false sense of security to end users. However in almost every case, it's still better than both sides of the connection being unsecured.

I'm not sure what this has to do with all CDNs being MITM operators when caching secure content.
The benefit of CDNs is increasingly questionable, but you can still realize them by managing it yourself. What I'm saying is to never use a third-party network that subverts your own security. I would try harder to nail that point in, but I don't think Cloudflare's coffin has room for any more.
This is a surefire way for people to burn out on something. If you never allow yourself mental downtime, then everything you do feels like work. If it's not meant to be work, then it's a hobby and if it's a hobby then it needs to actually allow you to unwind. Some people do surprisingly complex things for this, but the mistake we tend to make externally is view the accomplishment as "work" or something they really need to achieve - rather then something they devote idle brain-time to.
You can use the SHA-1 of the PDF's to avoid serving the same pdf twice.
But does it keep both the layout and Sha-1 hash? Not sure it's HN worthy otherwise.
Perhaps because people who are addicted to nicotine are likely to also have addictive personalities, whereas anyone can easily get addicted to heroin.

Kind of like how in WWII the British improved the survivability of their bombers by increasing the armor in the places returning aircraft weren't damaged, theorizing correctly that those were the places the planes that didn't return were hit.

If a person with an addictive personality gets on heroin, they're probably visiting the ER very few if any times before they hit the morgue.
That sounds like something that could be badly implemented, but there's nothing unreasonable about the idea in general. Oversubscribed services are par for the course. If your neighborhood's uplink is saturated during a period of heavy usage, do you really expect each customer to get 1/N share of the bandwidth, or do you expect the customers paying for the 100Mb plan to get up to 5 times more bandwidth than the customers paying for the 20Mb plan? Either way, it's obviously not suffering from the kind of unfairness that gives preference to certain usage patterns over others, and it doesn't involve any extorting of upstream content providers or other form of double-charging for services.
Maybe I am missing some special point but a decent PG box will do 1,000,000+ TPS vs 3,000+ TPS here. When pgXact lands it will do close to 2,000,000 TPS. So reading all the posts about the amazing new db "X" that can do about N times less than PG on a multi-node cluster I get confused why the numbers are being presented as some sort of achievement.
Yes and more.

Is there an algorithmic way to get an explanation ?
Then

What is the filtering mechanism to make sure the audience get maximal understanding based on their comprehension level
That was amazing. The coolest part is around 2:15.
Yes, but you would need help.
> by visiting one of the vulnerable sites repeatedly

I mean, how could CloudFlare, or anyone, possibly differentiate this from normal scraping/polling/ manual F5 refresh behavior? This sounds like a PhD thesis.

I guess you are asking CloudFlare to quantify the amount of distinct bytes of unauthorized data sent to any particular user agent? But then, any sophisticated attacker would rotate IPs, UA identifiers, and probably even between vulnerable websites, if they had known about this vulnerability.

I don't think it's reasonably possible to rule this out, even with a massive dedication of investigative resources. Like the other commenter said, it's wisest to assume it happened.
That's beyond flawed because he assumes any site that uses cloudflare's NS is using the proxied services. Which is 100% utterly _wrong_.
Also mutt, which I've switched back to recently. I've got a little Atom powered Chromebook converted to Linux that just does not like modern heavy webmail clients(even GMail when it was still running ChromeOS, and this is one still on the market, Acer CB3-131) so a combination of mutt, mbsync, and msmtp is a much nicer combo. Mutt is a terrific mail reader but its internal SMTP and IMAP handling can be a bit iffy, hence mbsync and msmtp.

Though I can generally open attachments just fine, this text rendering of PDFs would be useful for when I'm SSH'd into my home machine and reading stuff remotely(usually from work where I don't want to download my personal email).
Wait, are you arguing that using a CDN is overrated? For everything, or just for HN?

A CDN is extremely valuable for a website that has cacheable content, since it allows a site to scale dynamically with increased load. This is the same reason people use AWS or any cloud provider; a website has to have the capacity to serve their highest peak traffic, but it is needlessly expensive to maintain that much infrastructure around the clock.
Be careful of the trap: for quite a while now, each generation has simply treated it as "realistic" to match the brain's workings to that generation's popular new computational technique.
Because it is hard. Harder than it needs to be. Of course it has gotten easier recently. But it is more complicated than it needs to be.
I like this advice. I never played CS:GO. But I did get to platinum in StarCraft 2 building nothing but stalkers. All I focused on was my economy and A-moving when it seemed like I had an advantage. Focusing on the right skills is important. Many players who were in gold and below were worried about strats and builds and micro. Totally putting the cart before the horse.
So, applicable name then?
This is a burden that Cloudflare has placed on the internet community.

Nitpick: you're referring to the web (i.e. HTTP(S)) rather than the internet (UDP, TCP, IPv4, IPv6).
Furthermore, the proliferation of fake news shows that having the tools available does not mean that the tools will be used by everyone all of the time. If we were to check everything always, we'd have no time to do anything else.
https://www.dropbox.com/s/3m9mr24rahwwzoz/St%20Thomas%20Aq%2...
Eh, what's an order of magnitude here or there or at the beginning of your chain of huge multipliers? heh.. Yeah, no wonder the result was so enormous.

So oops, I guess.
Maybe OVH?

https://www.ovh.ie/cdn/infrastructure/

I know their ddos is pretty good, and it is tiered flat fee, and fairly cheap.
It's not simply a sha1(contents), but sha1(header + contents); the addition of that header means that SHA1's internal state is different from what it was in the raw PDFs when we encounter the section of the PDF that — without the header — would cause the internal state to align in the two PDFs. So, the header throws things off. But, if you took the header into account, redid the giant computation that Google did, then you could get two PDFs with different SHA1 hashes that, when committed (and thus get the header added) hash to the same thing.
Just sent you a link. It's pretty raw, it needs some filtering before I do anything to it.
Yes I suppose it could have nothing to do with the fact that (1) those jobs aren't remotely respected, (2) the jobs pay terribly, (3) OH&S will be treated as a joke, and you can expect to be physically unable to do the work by your mid-30's at which point you're unemployed and unskilled and (4) the work is a wildly unstable source of income.

Every time someone talks about trades paying well, they miss the fact that the whole industry routinely goes bankrupt when there's a drop in demand and prices plummet once people start moving into it.

Short answer: unless you work one of these jobs already, you are really not qualified to be telling other people they should plan to take them.

Tangential to the point: also you'd generally find people who work in those industries play videogames anyway - because entertainment media has very little to do with America's employment situation.
all the things i explained about metadata are implemented in postgrest and they work, and there is no loss of flexibility sinceyou can expose any table you want from any schema by explicitly creating a "mirror" view in the exposed schema. and relations are detected across tables and views and there is a way to deal with collisions.
I am not saying that your way is bad (having a metadata file), just saying there is a way to automatically create it.

- b,c that's good that you don't expose the entire SQL
Cloudflare is physically incapable of posting a blog that doesn't make them out to be saviors of the internet; the only way they could spin this to make them seem like the hero here is to throw Google under the bus.
Play YouTube song directly from terminal
My understanding is that scrape shield protects against certain abusive patterns of robot access, but not all URLs on the domain would ban robots. So archive may have many contaminated pages that scrape shield was enabled for but did not ban all robots from crawling based on various criteria.
I don't believe so. Cloudflare had this responsibility and they messed up. They are the only ones liable.
Questionable? There is no shortcut for the speed of light, regardless of how optimized the HTTP and TLS protocol gets. Building your own CDN is no easy feat if you want the performance, security, scale and reliability that you get from a focused vendor.

Everything on the internet is a product of thousands of vendors, hardware equipment and software components working together. There are millions of factors that can and may be compromised so the only realistic approach is risk management.

It's far better to rely on a well funded, staffed and capable vendor rather than building your own version. This is solid advice for everything outside of the expertise of your business so I'm not sure why a CDN is anything different. Assess the risk and do what works for you.
Developers, certainly. Programmers...I'm not aware of another use of that other that creating software.
I use Fastmail as my primary service and am happy with it.

I have had a play with the free tier of ProtonMail. It offers a TOR website and an iOS app as well as normal webmail access.
The problem isn't so much the length of opportunity as the fact that profits are effectively capped but losses aren't.
Senseless violence is and everywhere should be condemned, but violence itself is not inherently a wrong.

The violent actions of the US and Allied forces brought an end to the Holocaust.

Violence is sometimes necessary and morally just in self defense and in defense of those who cannot defend themselves.

Would you claim that the work of US Coast Guard after Hurricane Katrina was immoral? Is the Coast Guard "in the business of hurting, killing, and causing suffering"?

The "support" you see here on HN has less to do with hypocrisy, but instead is condemning your ill-reasoned moral absolutism.
At the very least that'd cost Internet Archive a lot of human resources. I think it's reasonable to assume that if Cloudflare wants them to fix the problems they themselves created, they should cover their costs of such operation.
For those interested in converting PDF tables into CSV, there's also Tabula ( http://tabula.technology/ )

(Used by many journalists to analyze the data in PDFs)
For sufficiently large firms, that is probably not true because the risk of getting sued for violating Apple's EULA is probably too high.
I was only kidding. You can say that of any profession.

Some day people will say the same of software engineers.
Programmers are also people who schedule broadcast programming or otherwise determines broadcast content.
While it is good that you discovered leaked content is still out in the wild, your tone is somewhat condescending and rude. No need for it.
At times..but that's not what we're talking about. Why should they be excluded at all? Regardless if it's a multi-year plot or just throwing a fit, it's unacceptable. One of factors behind Trump becoming President is how much time the media spent on him because of his unusual campaign style and rhetoric, and now he wants to pick and choose the media allowed to cover him to suit his narrative and it doesn't work that way.

What I don't understand is why so many tolerate his lies.
What Is the Perfect Drone for Me?
Is not the web part of the internet?

If I place a brick on the cushion on my couch it is correct to say I have placed a brick on my couch.
Its not that they can, many corps can. They do.
You can't compare startups vs established companies. Each organization has its own culture. I know a lot of big companies where the culture is horrible, but the perks are better. Where the mission is amazing but there is no work/life/balance. A startup of a 100 employees could have an amazing culture and a simple 9 to 5 schedule.

Plus, what you'd personally value in a company is not necessarily something I'd value the most. The mission? The location? The brand? The perks? The office? It's really case by case.
I would rather not have my network gear directly connected to Google. It's enough already that you don't have much choice on the internet.
Google cleaning this up is going to take a ton of man-hours, which will cost a LOT of money. How much money is Google obligated to spend to help a competitor who fucked up? Are they supposed to just drop everything else and make this the top priority?
Also still in Yahoo caches with the same leaks found in both Yahoo and Bing. I posted the URLs to the linked thread.
Also tracks with my experience.
Right. Clear text data was exposed, not the certificate itself. But who needs a certificate when you have the cleartext?
That is exactly the bigoted thing I would expect an internet vegetarian to say. Way to live up to the stereotype dude.
This is par for the course for Matthew Prince. I actually posted about this a few years ago, and it's relevant now so I've posted it below. The basic outline is that the cloudflare CEO either blatantly lies, or has a company whose communication structure has completely broken down.

> I have multiple horror stories from my days at Malwarebytes about CloudFlare. They absolutely refuse to take down people who abuse their network- at best they'll block a single file from being distributed, but then the malware authors simply change the name of the file (or, more commonly, dynamically name the file something completely random). Their network is fantastic for malicious activity, not only because of the technology but because of their policies around it.

> They will do everything to keep bad sites up, even flat out lying. Here's Matt Prince, their CEO, claiming that Malwarebytes was blocking their CDN because of "political" reasons, even though we had emailed him actual PCAP files showing that their network was distributing malware-

> https://forums.malwarebytes.org/index.php?/topic/108447-my-s...

> Despite the fact that Malwarebytes actively engages with communities and groups that teach people who to manage malware removal, and have always stood for free speech and only removes harmful software, Matt Prince tried to deflect front the truth of the situation by claiming this was about censorship. Really all it was about was that multiple clients of theirs were hosting pages that were actively infecting thousands of computers.

> To make matters worse they put these customers who are hosting active exploits and malware right next to their small business customers, so any time someone threatens to block them they hide behind the innocent victims who are caught in the cross fire.

> I should point out that I no longer work at Malwarebytes, and this all took place several years ago. I am only speaking about the portions of this that were public, and you can find all of that in the Malwarebytes forums and other places online.

https://news.ycombinator.com/item?id=7967832
I'm not at all opposed to UTF-8 as internal encoding for strings. But that's completely different and orthogonal to what you're talking about, which is whether strings and byte arrays should be one and the same thing semantically, and represented by the same type, or by compatible types that are used interchangeably.

I want my strings to be strings - that is, an object for which it is guaranteed that enumerating codepoints always succeeds (and, consequently, any operation that requires valid codepoints, like e.g. case-insensitive comparison, also succeeds). This is not the case for "just assume a bytearray is UTF-8 if used in string context", which is why I consider this model broken on the abstraction level. It's kinda similar to languages that don't distinguish between strings and numbers, and interpret any numeric-looking string as number in the appropriate context.

FWIW, the string implementation in Python 3 supports UTF-8 representation. And it could probably be changed to use that as the primary canonical representation, only generating other ones if and when they're requested.
anyway, good luck with your product. As i mentioned, it's the only thing out there close to the concept of postgrest, and that's a good thing :)
I would be pretty mad if a website that I was supposed to trust with my data made an untrue statement about how something was taken care of, when it was not, and then publish details of the bug while cache it still out in the wild, and now exploitable by any hacker who was living under a rock during the past few months.
I also completely share your attitude. And I think the harsh tone of your post was appropriate too, given the circumstances.

It should now be crystal clear to everyone why it is simply not ok to bomb endlessly without congressional approval, create massive military / surveillance apparatuses and systems of secret courts with secret laws, run black sites and an enormous network of prisons all while diminishing habeas corpus, perform targeted assassinations on American citizens and foreigners alike, develop 'tactical' nukes, etc. It is crazy to allow those things to happen without speaking up (no matter who is president, Democrats), and nearing evil to directly contribute to the creation of these precedents and apparatuses. Obama is about as objectionable as Trump IMO, but the point is you never know whose hands all of this power will end up in.
New Funny Video
Education publisher Pearson reports biggest loss in its history
Yes. Encrypted traffic is unique to every TLS session so when data is received from the origin, it must be decrypted (then stored and cached by the server) and then re-encrypted for every user that CF sends the data to. This is the whole reason why all CDNs are a MITM for secure connections.

In this case, certain CF features when enabled would transform the HTML that was sent to users, and sometimes it would include random bits of the server's memory in the output. These bits of memory could include anything like private data from other requests and responses being handled by the server.

This is very similar to the openssl heartbleed issue which also exposed random bits of the server's memory under certain conditions.
You might not know the history here. Tavis works at Google and discovered the bug. He was extremely helpful and has gone out of his way to help Cloudflare do disaster mitigation, working long hours throughout last weekend and this week.

He discovered one of the worst private information leaks in the history of the internet, and for that, he won the highest reward in their bug bounty: a Cloudflare t-shirt.

They also tried to delay disclosure and wouldn't send him drafts of their disclosure blog post, which, when finally published, significantly downplayed the impact of the leak.

Now, here's the CEO of Cloudflare making it sound like Google was somehow being uncooperative, and also claiming that there's no more leaked private information in the Bing caches.

Wrong and wrong. I'd be annoyed, too.

--

Read the full timeline here: https://bugs.chromium.org/p/project-zero/issues/detail?id=11...
Ubuntu 17.04 Beta 1 Released
#FUNcationFriday What is FUNcation?
To be honest though, ANY is mostly used for reflection/amplification attacks or to scrape domain records. Sure there are legitimate uses for them but I can't think of many that need to happen over the internet vs. only allowing that from specific trusted parties. And yes I'm aware that it can be useful as a debugging tool. There are also ISP recursors that don't allow ANY queries through for similar reasons so relying on it will cause trouble for some and there are other broken implementations in the wild. Though ANY can be useful it shouldn't be assumed that it'll work.

What I'm thinking they could've done in the case of ANY is to respond with truncated and switch to TCP mode at which point it becomes harder to do the spoofing dance and (ab)use ANY as a DNS amplification attack to DDoS a target. Unfortunately that does put an extra cost on the DNS server which might also be undesirable. However that would've probably been a worthwhile tradeoff.

There's an IETF draft that attempts to provide some guidance in the area of the ANY query: https://tools.ietf.org/html/draft-ietf-dnsop-refuse-any-04
I think we should start by defining the term "harassment". Most of the people don't know the exact definition. Is it a big smile? Is it talking too much to someone? Is it asking a question not related to work?

Or is it about sexual words and gestures towards someone?
Leave it alone. Stop demonizing the companies that give Internet.