skysight-inc/HackerNews huggingface dataset:
Does your girlfriend give those drivers 1 star reviews?

For what it's worth, my girlfriend has taken an uber in NYC 100+ times, and has never complained about any kind of harassment from an Uber driver. She's complained to me about sidewalk/subway harassment, and workplace harassment, so I don't think there is a reason she would hide Uber harassment from me.

Also: Regular car services were horrible pre-Uber...which is why Uber took over NYC car transit.

It was basically: Call up a number, get answered by a guy with a heavy accent on a low quality landline, tell him what you want, and hope and pray that he understood what you said and the car shows up. If it doesn't, call another company and repeat.
Oh wow, that's awesome. Will have to try it out.
How about recording videos of the lab? People trying to reproduce the experiment can just sift through the video. That may be tedious but it's far better than nothing.

Just a little metadata would help: Experiment A, Phase N, Day X
Levandowski allegedly downloaded 14,000 files. The lidar circuit designs, while arguably trivial, are what Waymo can prove have been appropriated.
jgrahamc: can you list which public caches you worked with to attempt to address this? It does not inspire confidence when even google is still showing obvious results
That seems plausible, but what would "yield" have meant before?
Waymo lawsuit against Uber
I am confused - why is 1Password is using anything but iCloud or Dropbox? Those are the only options I see (and "Folder" which is presumably just local).
You can use a plugin like assets-webpack-plugin [0] to get a JSON file that maps to the compiled file names. That's basically the same thing asset pipeline would do.

Here's a blog post [1] explaining how to use webpack with rails.

[0] https://github.com/kossnocorp/assets-webpack-plugin

[1] http://clarkdave.net/2015/01/how-to-use-webpack-with-rails/#...
Couldn't do that on another planet without installing them first. They want their system to be usable everywhere.
IMO the only reason why it's unreadable is font size.
This administration is so weird that I wonder if there isn't a power Illuminati style group of trolls out there.

Hear me out, I don't think I am crazy. I don't believe this, I just see it as more and more plausible every news story that comes out of the white house.

What if several of the world's richest, perhaps Gates, Buffet and a few other like minded kind souls got together. What if they did everything in their power, legal and illegal, to elect the most preposterous candidate possible. All the shouting about the election being rigged has people looking for fake democrats, not trump supporters.

Then they have this candidate do everything the wrong way, and obviously the wrong way. This is intentional, is should mobilize and unify all the people against a bunch of idiocy. By the time this is done we will either have destroy the coastline or we will all understand what CO2 can do.

Instead of trying to shroud BS arguments in a veil of reason-ability like typical a GOP politician Trump comes out and does the dumbest thing he can for "his" side of the argument. There are GOP hardliners that back him, but it seems to taper off as the crazyness continues. Eventually everyone just towing the line will be unelectable or at least powerless for a brief time and we do a bunch of objectively smart things like end the war on terror, end the war on drugs, pass more laws protecting church and state, make sure future presidents can read, strengthen our healthcare, etc....

But that is just not as simple the other explanation: Americans, my fellow countrymen, elected someone just as dumb as them.
In the case of investing, isn't network effects a euphemism for bubble?
She should release them.
Google Self-Driving Car Unit Accuses Uber of Using Stolen Technology
Different authentication methodologies on the web
Top Uber self-driving car engineer resigns
Great. Let's do that first, then we can talk about voter ID laws.

Doing it in the other order is a non-starter because it deprives people of their fundamental rights.
To test or not to test
Of course.

The police unions strongly backed Trump and probably helped carry swing states.

This is patronage.
We need an official and comprehensive list of domains served by Cloudflare throughout the affected period.
Otto was a YC company so there's your answer. People condone a lot of awful if they 1) make money off it; 2) Have some emotional connection to it
I'm paid (in part) to develop a GUI application with PyQt. It's excellent. Riverbank Computing deserves every penny. And QOpenGLWidget + PyQt is far and away the easiest way to get off the ground with modern OpenGL.
This is basically how an EDS maglev train works, though with linear motion instead.
FWIW, the first warnings that SHA-1 was insecure and "It's time for us all to migrate away from SHA-1." were published prior to git's initial 2005 release: https://www.schneier.com/blog/archives/2005/02/cryptanalysis...
The More Things Change: A history of worrying about distraction
I'm sorry you (or anybody else) have to go through this.
Can anyone ELI5 what's going on?
We, FastMail, are not affected by this. We do not proxy TLS connections via any third party. We use CloudFlare for DNS distribution only, which is not part of this issue.
1. Why bring your own laptop to an interview?

2. Isn't this scenario incredibly suspicious?
Exactly this. Anytime you give sensitive information to another party you have to evaluate the risk. Having an insecure connection to that party is obviously risky, but that doesn't mean that having a secure connection means there's no risk. Companies that accept sensitive information while using Flexible SSL are probably mishandling your data in other ways too.
“My Car Pays Cheaper Rent Than Me”
"Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company..."

I once came up with that exact concept for a nation-state subversion. It would even pay for itself over time. I kept thinking back to it seeing the rise of the CDN's and the security approaches that trust them.
Seems like we need to reset/rotate everything. So yes, I believe so.
Moto Said to Introduce 12 More Moto Mods This Year
4 mils seed fund with no product or traction? are they trying to repeat the path color App took?

http://mashable.com/2012/10/17/color-shuts-down/#9QwfKgsSEGq...
Sustainable Machine Learning Workflows
If the breadth and depth of federal law and regulation supports uneven application, the solution is to pare back the breadth and depth of federal law and regulation, not pick and choose which laws you're going to enforce. The latter leads to a situation where all sorts of draconian laws are passed and nobody cares because they don't expect those laws to be appllied to them.

But that gives the government all the tools it needs to make life a living hell for people who irritate the mandarins in Washinton. I'd be curious to know just how many people in federal prison for possessing less than an ounce of pot are really there for possessing less than an ounce of pot.
To save you the quick google search, this is it: http://dangeruss.deviantart.com/art/A-Dangeruss-QNX-12

It is the oldest submission not performed by deviant art staff and the oldest submission still online.
This is exactly why the facebook feed and people getting news from it is such a problem. God forbid you see an alternative viewpoint.
Long-term stress linked to higher levels of obesity
FYI, I'm seeing some more of these results show up (with active caches) for the following searches:

"CF-RAY" "CF-Force-Miss-TS"

"X-SSL-Server-Name"

"Internal Upstream Server Certificate0"
> A small group of people doesn't get to say what is true

The pope didn't endorse Donald Trump. That is objective fact. Yet that popped up on facebook.

Why shouldn't they censor that shit?
State level political parties have the power to challenge the registration of voters within their boundaries.
The problem is fixed in that as far as we know no new data is being made public.

...but since this bug has been out in the wild since perhaps 2016-09-22, now is indeed, the time to go and reset your active sessions and change all your passwords.
I'd be more interested in this except for Lyft instead of uber.

Like many others, I'm done with the tire fire that is uber.
I stopped using my real name Twitter account a few years back after my favourite apps died - except to bitch about my ISP every so often. Why? Bitching on twitter gets the problem fixed, calling tech support doesn't.
A lawsuit would not really pay out that much. She got another job, so her damages are, what, a few tens of thousands of dollars? And it would mark her, for life, as someone who sues.

A friend has worked on sexual harassment suits and says it's unfortunate that, as far as he's experienced, every single one he's been involved in has been bogus. Meanwhile, he knows there are several people with good cases who don't bring them, because the social penalties are too high.

Part of the reason I believe her is that she isn't bringing suit. She's not trying to make a payday out of this. Further, she has alleged specific acts which can be definitely proven or disproven. If she made it up, it would be trivial for Uber to show she did so.
PyQt has a whole other project, called sip, in service to it. If I understand it correctly, sip generates the bindings semi-automatically with a lot of special cases for Qt. Compared to the other set of Python C++ library bindings I've used (Vtk), they're magnificent.
Nope, just a rule of thumb. :-)
The effort you're putting into cleaning up someone else's mess cannot be understated, nor can it be sufficiently appreciated. Thanks!
The goal of this project is to be able to check it from the command line. So while you're at the computer, you can check it via CLI rather than opening a browser.

I think the authors intent was just for his own use and some fun.
Heh heh. When I was growing up there was a big push to prevent kids from smoking, because smoking was supposed to be the gateway drug to marijuana. When I got to college I heard the same thing from all the smokers: "I never had any desire to smoke cigarettes until after I started smoking pot."
If I'm understanding correctly, that list would include not only the 3,438 domains with content that triggered the bug, but every Cloudflare customer between 2016-09-22 and 2017-02-18.
> "what if a meteorite hit my plane while it was in flight - maybe I should add three inches of high-tension armored steel around the plane, so that my passengers would be protected"

I think this is a shockingly good example of how smart people get security questions utterly wrong. The right analogy when it comes to security has to involve some type of adversary, not just random, unmotivated natural phenomena -- as long as we're using aircraft analogies, it's not so much "a meteorite might randomly hit my plane in flight" as "there's angry and armed people shooting at my plane with armour-piercing ammunition".

Indeed, in the real world, putting hundreds of kilograms of armour on aircraft isn't the absurd/childish idea Linus seems to think it is:

https://en.wikipedia.org/wiki/Fairchild_Republic_A-10_Thunde...
> no one is going to record or archive, let alone watch, years of footage

Recording and storing years of footage shouldn't be a significant problem with modern tech.

Nobody has to watch years of it; they can watch the parts they are interested in. They also can watch at 4x and search, as needed.
4 mils seed fund with no product or traction?

... or Head of Marketing, or Head of Design (per their Openings)
That seems inconsistent, curious how you reconcile. Some companies now might hesitate to work Kapors. Some companies now might hesitate to hire Susan. If you are okay with employee speaking up publicly when private action failed, why not an investor? Seems entirely within their rights and the moral thing to do.
Sorry for the paywall - but I find this story fascinating and it will probably make its way through mainstream media soon.

Saint Francis High School, of Mountain View, CA has a small investment fund through its endowment. It was believed to be an early investor in Snapchat, and the high school is believed to be making tens of millions of dollars on the IPO.
Drug policy hasn't been a really hot topic for a long time. If it becomes one, you can guarantee that the right-wing media are going to sway the opinions of a lot of Republicans and conservative Democrats.

So I really would really not count my chickens before they hatch here, and would not underestimate my opponents or the gullibility and intolerance of the general public.

The fact is that illegal drug users are a minority in the United States, and a widely despised minority at that. The United States has not had a very rosy history in regards to the treatment of widely despised minorities. That history could very easily be repeated.
Could someone enlighten me on why malloc and free don't automatically zero memory by default?

Someone pointed me to MALLOC_PERTURB_ and I've just run a few test programs with it set - including a stage1 GCC compile, which granted may not be the best test - and it really doesn't dent performance by much. (edit: noticeably, at all, in fact)

People who prefer extreme performance over prudent security should be the ones forced to mess about with extra settings, anyway.
Fowler had specific accusations of fact. Either the "got told six times it was a first offense" thing happened or it didn't. Either the leather jacket incident happened or it didn't. Uber can easily claim these things aren't true if they aren't.
Still hoping for Downpour
Couldn't an attacker construct a page that triggers the memory leak and just keep accessing that page to get different pieces of memory?
He is a great fit as an Uber executive... another greedy pig!

This one broke many laws and needs to go to jail!
This is why PCI Compliance exists. Part of the requirements of PCI are that you must encrypt transmission of cardholder data across the network. So companies that accept credit card details while using Flexible SSL are presumably violating the PCI DSS. Companies handling small volumes use self-assessment, but larger companies are actually audited annually for this stuff.
What Is the Price of Broken Window Repair in Greater Vancouver BC
Lastpass knows how to change your passwords for many popular sites, and can automate it away for you.
Blur their faces? Some experiments might depend on seeing faces, but not all. Plus, you would at least have video of everything the experimenters do, if not the results.
Machine Intelligence 3.0
How Twitter Amplifies Authoritarianism
Well fuck. I have no idea what (if any, or all) of my authenticated web sessions have been going through CloudFlare in the last 6 months. How do I even start to protect myself from this?
Video and photographic evidence can play a big role and when we have the extra bandwidth to process such a dataset. Right now we barely have time to do the experiments, much less 'watch tape' to see how we did (maybe if scientists were paid like professional sports players...). In an ideal world we would be collecting a much data as we possibly could about the whole state of the universe surrounding the 'controlled' experiment. That said video and photographs are very bad a communicating important parameters in an efficient way. Think about how hard it is to get information out of a youtube video if you need something like a part number. Photos do better, but if you need to copy and paste out of a photo we will need a bit more heavy lifting to translate that into some actionable format (eg ASCII).
I think the Qt Company is trying to revive pyside, but they have a lot of catching up to do. Not sure if they plan to do an update on their bindings generator (Shiboken) too, or start from scratch on that front.
That's not how it would work. Incoming kinetic projectiles are just as vulnerable to defensive systems as ballistic missiles. Hit it hard enough and you can knock out the guidance system. They would need very precise and sensitive guidance systems to hit anything from orbit.

Space enthusiasts constantly underestimate costs and schedules. Just because something is theoretically possible doesn't mean that the engineering problems can be solved in an economical way. If there is large-scale asteroid mining in my lifetime then I'll eat my hat.
> Could someone enlighten me on why malloc and free don't automatically zero memory by default?

The computational cost of doing so, I suspect.
> but git doesn't actually just hash the data, it does prepend a type/length field to it.

To me it feels like this would just be a small hurdle? But I don't really know this stuff that well. Can someone with more knowledge share their thoughts?

I think Linus also argued that SHA-1 is not a security feature for git (https://youtu.be/4XpnKHJAok8?t=57m44s). Has that been changed?
Maybe I'm being a bit too paranoid, but shouldn't your services be set up in a way that doesn't let Cloudflare touch that sort of sensitive data in the first place? You can't distrust everything, of course, but "compromised reverse-proxy acts as a MITM by logging and exfiltrating sensitive information" seems like it ought to be in the threat model of service providers.
How You'll Die on Mars
Google developing Allo desktop/web client
I don't think I've ever seen Google go in the offensive like this, so this must be pretty serious.
I'm fine with racist people having trouble finding jobs. Or only being able to take jobs where they don't have to interact with other people. If you can't make a person less racist, marginalizing them so they do less harm is the next best thing.
> No one is going to document and record the entire course of an experiment; that would literally be months of footage.

Why not? Just setup a permanent camera and go. Storage is cheap. Organizations with security cameras often have multiple streams to record.
> Recently, we received an unexpected email. One of our suppliers specializing in LiDAR components sent us an attachment (apparently inadvertently) of machine drawings of what was purported to be Uber’s LiDAR circuit board — except its design bore a striking resemblance to Waymo’s unique LiDAR design.

Doesn't sound plausible. At a minimum, this would have to be the "dumbed down" version of how they uncovered this.
Shareholders are well within their rights to take an "antagonistic" stance with respect to companies whose values disappoint. We need more shareholders like this, not fewer.
So would it be possible to migrate to a different hash seamlessly?
> not everything appears on video

Sure, but a lot of information does appear. Not everything appears in papers; should we stop publishing them?
Who knows, but they routinely overstep their boundaries simply because they can and they're used to doing it.
We detached this subthread from https://news.ycombinator.com/item?id=13718795 and marked it off-topic.
Cheaper for their scripts to indiscriminately spam than them manually work out which forms and public sites are indexed and will actually bring them value.
I don't think that comparison is quite right: ten years ago we already had two of Xiaoyun Wang's attacks which significantly reduced the work factor to break SHA-1. They were already cited at the time as reasons to move away from the algorithm (and I doubt we'd be able to do the 2⁸⁰ work needed to get a collision without cryptanalytic research! — notably the successful Stevens attack today reported performing a total of 2⁶³ hash operations while claiming to be "one of the largest computations ever completed").

There's also important concern about SHA-512 (which has led to SHA-3 and other options), but I'm not sure it can be put in the same category; at least all of the best attacks today are significantly reduced-round.

https://en.wikipedia.org/wiki/SHA-2#Cryptanalysis_and_valida...

By contrast, Wang's original attack (which we had more than 10 years ago) achieved a 2¹¹ speedup for collisions against full SHA-1 and her second attack later the same year achieved 2¹⁷ speedup.

Evidently the speedup for the final version of Stevens's attack (which worked) was also around 2¹⁷. By contrast, a Moore's law improvement over 10 years would only be expected to make computers around 2⁶ times faster! (At the risk of mixed or mangled metaphors, we might say that mathematical insight during the time period you mention has been about 2¹¹ times more useful for attacking SHA-1 than computer power increases.)

Edit: someone else linked to Valerie Aurora's chart, which I'd forgotten about, which gives a synopsis of the historical status of the most popular hashes. On that chart, SHA-1 from 2005 was one category worse ("Weakened") than SHA-512 is today ("Minor weakness").

http://valerieaurora.org/hash.html
Nice, good to know the credit card companies are doing their best to mitigate their liability due to issues like this too.
This comes around to me as something that just shouldn't have happened. CloudFlare are pretty big on Go, as far as I can tell (and I guess Lua for scripting nginx). Why was this parsing package written in a non memory-safe language? Parsing is one of those "obvious" things easy to mess up; the likelihood of a custom, hand written parser being buggy is pretty high. If it's somehow understood that your library is likely to have bugs, why do it in C/C++, where bugs often lead to bleeding memory? In a shop that's already fluent in Go, where they have the institutional knowledge to do it safely? Sure performance is not going to be the same, but with some care it'll get pretty close.

Sorry I hate to just be a coach commentator. Obviously hindsight is 20/20. Still I think there's a lesson here.
I have to call you out on this. Most drivers have both apps installed in their phone and their behavior does not change because they got hailed through Uber.
That list contains domains where the bug was triggered. The information exposed through the bug though can be from any domain that uses Cloudflare.

So: all services that have one or more domains served through Cloudflare may be affected.

The consensus seem to be that no one discovered this before now, and no bad guys have been scraping this leak for valuable data (passwords, OAuth tokens, PII, other secrets). But the data still was saved all over the world in web caches. So the bad guys are now probably after those. Though I don't know how much 'useful' data they would be able to extract, and what the risks for an average internet user are.
Azure Network Watcher – Network Performance Monitoring and Diagnostics for Azure
Garmin engineer from India killed by U.S. domestic terrorist
There's plenty of evidence that alcohol leads many to aggressive and violent behavior and a fair amount of evidence that pot has the opposite effect. I think that's reason enough to belief that a drunk gun user is apt to be more dangerous than a high (on weed) one.
>i always thought we should just email the user a link if their session has expired. there's no reason to have passwords.

Yes! You are so right. What have I been thinking. This is an excellent and care-free way to do it. I didn't even consider persisting e-mail tokens, but that makes so much sense! Thanks!
Interesting. I vividly remember a commenter here on a thread about Uber's acquisition of Otto. The user said based on the timeline and filings, it seemed like Otto hadn't really accomplished anything yet, and was probably founded purely to be acquired by Uber. I wonder if there's even more here...
I thought waymo's lidar sensors were much, much cheaper than other sensors: https://arstechnica.com/cars/2017/01/googles-waymo-invests-i...

We're talking about reducing a ~$25000 part to ~$2500.
This article is beginning to look like a whole bunch of people talking about a leak and not saying that they would use that data for vicious things.
Kathrine Switzer, the first woman to run a marathon (50 years ago)
I prefer go-qml
https://github.com/go-qml/qml

or PyQt
Gotcha - ok, that certainly makes sense. Though makes for a slightly less friendly (but certainly more secure) service.