skysight-inc/HackerNews huggingface dataset:
The problem is that many branches of science don't have any immediate pressure to produce something that is usable by people outside the field, and sometimes not even peers. So they do what is needed to get out papers, and bothering about eliminating false results goes against that interest.

I'm going to bet that in competitive research branches, for practical applications, that have objectively verifiable results, most studies will, in fact, be reproducible.
someone has to tell the thing what to do, in a understandable way. and this will not be the client/manager/whoeverneedssomething.

To start with, sure. That's where we are now - even the best "AI" tool needs a lot of help from the user giving it instructions in specific language. That will improve very quickly though. For a limited subset of apps, you will be able to describe what you want in plain English and get something usable out of it. That subset will start off being the sort of apps people have made in VB for years, and now make in web languages.

If that's what you do then your job will be automated away over the next decade. Learn to make something that can't easily be automated.
To me its a reminder of how times have changed and a tale of caution.

Pre internet there was no place (blog) to write about work.

Now, one always has to be conscious that their coworker-friend or coworker-foe can tell the world stuff you would not tell. Reinforcing the keep quiet about everything mantra

The other risk is that a decade from now the person making the blog will be known for that blog. To everybody.

More caution will be required when coming in contact with that blogger.

Pick your battles wisely
Schneier predicted "between 2018--2021 depending on resources". He explicitly says "Since this argument only takes into account commodity hardware and not [...] GPUs". Since Google used GPUs that very well explains the speedup to 2017.
It is a terrible thing, and it is absolutely nothing like finding bugs.

Reproducibility is a core requirement of good science, and if we need to compare it to software engineering, the reproducibility crisis is like the adage "many eyes make all bugs shallow", when the assumption that there is many eyes even looking is often untrue. Most studies are never reproduced, but are held as true under the belief that if someone tried they could.

EDIT: You claimed that in an ideal world, 100% of experiments/studies would not be reproducible. This denotes a profound misunderstanding of the scientific process, or the whole basis of reproducibility. In an idea world, 100% of studies would be vetted through reproduction, and 100% of them would be reproducible. This is essentially the fundamental assumption of the scientific process.
So you would be in favour of an otherwise free market, but with the government breaking up companies that grow too* big? I.e., you agree excessive concentration of money and power is harmful, and would be willing to compromise free market ideals to prevent it?

Also, just because -some- companies can outperform larger ones in some areas, does not mean greater size does not have significant advantages. There's a good reason there's no mom&pop car manufacturers.

*E.g. so big that consumers no longer have a meaningful choice, or so big that they start to benefit from monopoly pricing or price collusion, or are able to make use of anti-competitive practices, such as stores selling their own brands more prominently.
The intersection of hard to prove murders and Alexa is going to be tiny.
Any heat source exposed to space has the basic problem of its volatiles running away and not coming back. On geological time frames, this effect is probably nearly instant, so it isn't very helpful that maybe a new volcano could pop up somewhere and melt lots of stuff or something, because all that does is put a hole in the permanently frozen layer. Any heat source not exposed to space might harbor life, but that's not particularly true of these planets; we already have things like Europa locally with the same possibility.

The issues with valuable resources running away and not coming back is a serious one even for Earth, which I think might surprise some people. The geological carbon cycle [1] in particular is one that may surprise people who have not encountered it before, or not thought about it in terms of extraterrestrial life. On geological time scales it's surprisingly easy for entire important elements to go find themselves a low-energy configuration they like and disappear from any putative biosphere. The issues with a tidally-locked planet providing such solutions to "all gasses liquids" is merely an extreme example of the case, and really makes one wonder how it would be possible for such a planet to stay "stirred" enough for life to have access to what it needs to develop.

[1]: https://en.wikipedia.org/wiki/Carbon_cycle#Geological_carbon...
If anyone is talking about Mobius Strips then Cliff Stoll MUST be mentioned. This guys passion for Mobius Strips is infectious.

https://www.youtube.com/watch?v=AAsICMPwGPY

Also he was one of the first system admins to actually catch a hacker who was using his server in Germany in 1989. https://www.c-span.org/video/?10122-1/cuckoos-egg
Edit: Nevermind, I misinterpreted something in the report. Collisions between malicious and non-malicious documents are indeed most likely feasible.

Original comment:

While theoretically possible, I don't really see that particular attack as being an actual, practical problem anytime soon.

In order for that to work not only would you have to find _a_ collision, but you'd have to find one with the additional constraints of "one copy is malware free while the other isn't", which would be significantly more difficult (at least, as I understand it).

That said, I agree it's probably time for torrents to start moving to another hash function. With time and additional research, it's entirely possible that theoretical attacks like the one you described could eventually become practical.
I don't understand Amazon's position here. They're being asked for evidence in a murder investigation. I don't see how the first amendment could be construed to protect against this. The data being asked for concerns the two involved individuals and the request doesn't seem overly broad.

What this case does show is that Amazon puts a listening device in your home which has a very acute understanding of your live. As they argue themselves.
I remember this. And even the first bot vs bot competition was won by a clever bot scripter simply denying the gas early on from his opponent. Took all his competition down to a standstill.
But there is a warrant:

> The tech titan has filed a motion to quash the search warrant for recordings

ps. Ianal
> A field that basically runs society

Fact 1: In the House of Representatives, women hold just 83 (19.1%) of the 435 seats.
Fact 2: In the Senate, women hold just 21 (21%) of the 100 seats

Politics as a field disagrees. And it has been running like this for a long time, I guess?

One thing I don't get is that, when people talk about NBA, with very little Asian representation, they will gladly accept the fact that Asian men are, physically not as capable as African Americans, but freak out when it comes to the tech sector.

Isn't this hypocritical? Diversity is a good thing to have, but I don't think it is more essential than, software engineering skills, itself, when hiring a software engineer. Companies are not charity, they hire engineers because they need engineers. If the demographics of engineers reflect the overall demographics, diversity will come to companies naturally.

Maybe one should ask the right question how to educate more african/hispanic engineers, and Asian basketball players than trying to find them only when blame comes.
Show HN: Itinerary matching service (carpooling)
I find some implications of this chilling, while on the other hand the potential for humanity is possibly vast. The only thing I really like is the idea of a meter that gives me instant feedback of the "toxicity level" of a post I'm about to make. Unfortunately 1) I and many others would probably, on a "bad day", game this to increase this rating before posting, and 2) I and many others would probably, prior to having a "bad day", turn off comment filters and read the toxic comments anyway, thus exposing ourselves to even more toxic comments than before (because they'd been gamified for maximum toxicity).
"waldoed"?
You didn't "do this" unless you also stood on a podium, lied to race officials, and tried to cover it up.
If there are errors in a study's methods that make it unreplicable, then it shouldn't have passed peer review or been published.
Both -- there is so much to learn and forget -- practice and note taking is essential.

If a book has 30 pages in a chapter, I'll always have about 2 pages of notes at the end of it. So at the end of a book I usually have a 24 page mini-book/doc that I can refresh my memory quickly. In fact, I read these mini-books all the time when I'm stuck in traffic or waiting on anything.
While tooling can be better on Windows, and many do target it first, I took issue with the claim that no one targets anything but Windows.

Anecdotally, I just had Atmel recommend a switch from Windows to Linux, as their compiler toolchain "can work better there".

This space is more diverse than just Windows, and growing in that direction more and more. Atmel, Cadence and Qualcomm are just a few who welcome you with open arms.
The attacker needed access to the phone.

It's generally game over for any device if the attacker has physical access.
Is Mercurial impacted?
ClassList.js – Cross-browser element.classList
If that were the case Amazon would have provided the data rather than contesting the warrant the police issued to obtain the data.
100,000 dollars to do the computation it seems, not that hard to get funding for if all the computers you infect can participate in your botnet once you do
One potentially alarming sentence in this article is "Wix will open up DeviantArt’s repository of art and creative community to the Wix platform, giving Wix’s users access to that work to use in their own site building."

Exactly what do they mean by that? Will it be opt-in? Will it only cover art that's already under Creative Commons? Will be it all Creative Commons? Does a Wix site count as commercial use? I can't imagine people would be very happy about their art suddenly being available for use elsewhere without their consent.

Hopefully, this is much ado about nothing, and Wix won't do anything terrible, but we've seen technology companies do stupid things before. At the very least, it would be nice if they elaborated on their plans regarding this.
In applied mathematics, the idea of having a standard platform for releasing numerical experiments and standard datasets have come and gone over the years. My advisor said that in the early 2000s, there was a push in some areas to standardize around Java applets for this in a few journals, but never really took hold. Nowadays I would think some form of VM or container technology could probably do the trick while avoiding configuration hell. Commercial licensing for things like MATLAB or COMSOL etc. would be the real challenge for totally open validation in a lot of disciplines. Proprietary software is way more prevalent in scientific and engineering disciplines than I think many general software developers realize.

The good news is that you can't really fake proofs or formal analysis. But the truth is, many folks in the area do cherry pick use case examples/numerical validation as much as you see in other disciplines. Perverse incentives to publish, publish, publish while the tenure clock is ticking keeps this trend going I think.
Phenomic – Modern website generator based on the React and Webpack ecosystem
Some of them do this. The Marine Corps Marathon places mats at the end of long turnaround points and they say they routinely disqualify people.
*should start one or join a late stage startup who is still offering equity

N=1, but a friend has done this twice as a product manager with joining late stage startups, getting a decent amount of equity/stock and then the company has IPO'd.

I agree with your point though, the risk/reward for most early employees who are not part of the founding team is not worth it. You'll work just as hard as the founders with a fraction of a fraction of the payout compared to the founders
You could say the mathematicians work as much with ZFC as programmers work with assembly
> Why does SSL, hereafter "TLS", not separate the two concepts for the user?

Because encryption without authentication is worthless. It's Alice passing a secret message on paper to anybody on the street that will claim to be Bob.
I think I must have expressed myself poorly, as I think my conclusion is the same as the article suggests i.e. that the science/code shouldn't be considered "done", until it's been peer-reviewed, since it's easy to fool yourself and others if you're not actually reviewing and testing your code.

What did you take away from my comment?
SHA-3
Ng2-materialize an Angular 2 wrap around Materialize library
Science publishing is based in a review by peers system. All evident bugs (and many non so evident bugs) should be catched before to appear in a journal. Is totally different to standard journalism.
Yep, it would be hard to get away with ugly, intrusive ads when your users are obsessed with aesthetics.

I also can't imagine the print-selling business reaching the kind of scale that today's VCs would like to see.
They're talking about the novel, 1984.

https://en.wikipedia.org/wiki/Nineteen_Eighty-Four
How to Set Up D3.js with Webpack and Babel
great reference -- I love this episode
Yeah, and honestly I don't feel like the defense will hold up for much. It's not uncommon or unreasonable to request data from a company pertaining to a criminal investigation. It's not an overreaching request, they're asking for a narrow field of data, they have probable cause for a warrant. This is really not unusual from a criminal investigation standpoint, except for the interface in question being somewhat novel.

But the case has gotten national attention, and people are talking about privacy of services like this, so it makes sense for them to put up that "we're protecting your data" fight. But the only real way to protect your data from the government is simply to not collect it in the first place.
Experimenting with React and Phoenix Channels (Screencast)
well I would say that if an attacker controls what you sign, your security model is already toast, isn't it ?
I have a high level question that I don't see answered, but maybe I missed it?

Are most studies conducted by folks in academia before they get tenure? That is, are most of these results that they're trying to replicate or study done by people who are rather new to doing studies? Is this even possible to know? My guess would be yes, but really I don't have much to base that on. And if that is a yes could that have something to do with the problem here?
If you trust a signer, does this attack do anything to invalidate their SHA-1-based signatures? Or is the scenario strictly an attacker generating both versions of the message?
Hello, creator here. Do you guys have any suggestions on how to make this product successful? I am trying to sell this service to businesses, in order to offer it to their employees, but it has not been successful so far. Should I write an API? I am also trying to sell it as white-label software. I think there are many cases where such a simple tool can help millions of people doing carpooling efficiently, but struggling to get it in the hands of people, even not making much money.
> * PGP/GPG -- Any old keys still in use. (New keys do not use SHA1.)

> * Distribution software checksum. SHA1 is the most common digest provided (even MD5 for many).

Software distribution seems to be the greatest threat (e.g. a Maven repository or Debian repository).

It still seems like an enormous amount of work. You would have to go after a package with an old PGP key and then I guess go spoof a mirror (most of these guys already use SSL so that is a problem). There are probably easier and far more cost effective attack vectors.
Samuir Rahman from Canopy with his list of favourite books
While I don't think that you're advocating the same type of "help" that a colonialist would, you must be able to see the irony in calling someone a colonialist while also saying the exact same thing that all colonialists said — that "we must help them". The implication, of course, is that they are unable to help themselves.

You believe that — through your own luck and with your own privilege — you are able, and therefore should be willing to help people who — through no fault of their own — require some help.

A colonialist would say that — due to their innate genetic superiority — they are able, and therefore should be willing to help people who — due to their own innate inferiority, primal culture, and lack of intelligence — require some help.
>But the "cheaper" part is largely because rides are being subsidized by VC money no?

Uber is a private company so their accounting isn't publicized but as far we can tell, the VC subsidies target a very specific situation: the low prices from competition such as Lyft/Didi

Leaving out the "price wars" aspect, the unsubsidized higher Uber fares would still be lower than:

1) taxis (especially out to the suburbs)

2) the TOC (Total Cost Ownership) of owning a car if consumers make a behavioral change from buying their own car and instead, switch to an on-demand "car as a service". E.g. using Uber 10 to 20 times a month is less than purchase price of car + loan interest + taxes + annual registration + insurance + parking garages.
"The imperialist interpretation of "The White Man's Burden" (1899) proposes that the white man has a moral obligation to rule the non-white peoples of the Earth, whilst encouraging their economic, cultural, and social progress through colonialism.

"In the later 20th century, in the context of decolonisation and the Developing World, the phrase "the white man's burden" was emblematic of the "well-intentioned" aspects of Western colonialism and "Eurocentrism". The poem's imperialist interpretation also includes the milder, philanthropic colonialism of the missionaries:

"The implication, of course, was that the Empire existed not for the benefit — economic or strategic or otherwise — of Britain, itself, but in order that primitive peoples, incapable of self-government, could, with British guidance, eventually become civilized (and Christianized)."

source: https://en.wikipedia.org/wiki/The_White_Man's_Burden
> The rise of Python at the expense of safer, typed, faster, more principled languages makes me very sad for the state of our industry

There is no rise. Not any more. At best, it's a plateau, and in my opinion, all dynamically typed languages except Javascript are on a straight decline curve, slowly being replaced by statically typed languages.

I noticed that a lot of people who enjoy Go come from Ruby or Python. Go's type system is clearly antiquated and weak, but it's a straight upgrade from a dynamically typed language, which is why it's finding an audience with the Python/Ruby crowd.
Cortisol levels fluctuate with diet and time of day. I don't think I could draw conclusions from the change in cortisol levels and testosterone levels.
I thought it was strange too. I would suspect the caselaw involving the First Amendment provides more definition of the limits upon governments than the Privacy amendments, especially since this is such a novel set of facts with no easily applicable precedent. First Amendment seems to be more broadly protected than privacy anyways, so extending it to this set of circumstances would be ultimately useful.

However, their First Amendment argument would be more compelling if the search request was wider instead of specific. It looks like the request only wants a 48 hour period, so its not a dragnet kind of request (i.e., who checked out books on chemistry in the past 4 weeks?). In the event the ruling is against Amazon, I would guess the in camera evaluation will probably happen.
Awesome Articles for Web in This Week
Now it's expected of you to be impressed and to make a generous offer, of course! (Any further delay with any sorts of interviews is simply ludicrous, you see.)
How do you propose to ensure backwards compatibility with the millions of torrents already produced?
Hear hear. Without deviantArt and the incredible support of the community I would have never gotten into product design.

Also, hi
Noticed too late that I reversed the fat content percentage, it's usually 30-40% fat. Roughly 4 calories per gram, compared to most candy's 3. Pure fat or cooking oil is around 9.
I can't tell if they are joking or really didn't pick up on this.
>Constantly checking that the science can be reproduced?

Scientific experiments usually need actual things to be manipulated in the real world. So I think a concept of Continuous Reproducibility may only applicable to a subset of science that can be done by robots given declarative instructions.
Some people get down to six pounds. See https://www.youtube.com/watch?v=LHmtdtctzzc and https://www.youtube.com/watch?v=LggWPhMv-H4.
Is blockchain technology the new internet?
The 4th amendment and 5th amendment don't protect you from having to hand over incriminating evidence pursuant to a valid warrant. If the government suspects e.g. you're part of a criminal organization and have tapes with your co-conspirators (for future blackmail purposes) hidden in your house, it can get a warrant and get those tapes. It can play those tapes to the jury. The only thing the 5th amendment protects you from is the government making you testify against yourself.
> The time needed for a homogeneous cluster to produce the collision would then have been of 114 K20-years, 95 K40-years or 71 K80-years

If I'm reading that correctly, 852 (71 * 12) K80 cards gets that down to a month, which sounds well within the reach of NSA et al.

Even getting it down to a day (71 * 12 * 30=25,560 cards) seems feasible. Assuming $10k per card ($5k launch price + doubled to account for supporting hardware), the upfront investment is around $0.25 billion, a figure that sounds plausible given, e.g., that the Utah data centre is budgeted at around $2 billion.

Edit: formatting fix. Also, this is of course assuming custom hardware designed for a specific hash function isn't employed.
> "Today, 10 years after of SHA-1 was first introduced, ..."

That part from the original article seems to be missing something?
Magnet URI hash is SHA1.

A hash collision can still be used as an attack if you create 2 torrents with the same hash and then distribute.
Right. The seeming paradox is that a truly free-market needs regulation to maintain its existence.
Jeroen!!!!! Hello!!! Hope you are well and awesome to run into you on HN.