skysight-inc/HackerNews huggingface dataset:
Holy sh*t. Is this the end of Cloudflare with the trust being absolutely destroyed and lawsuits coming in? Can't say I'm sad for them. Cloudflare sells you DDOS protection, and hosts (eg. masks the IP of) the very DDOSers to protect against themselves, which I find bordering on the criminal.

Hosters like Hetzner, OVH have for a year now offered DDOS protection (I'm guessing it's heuristic rate limiting, but they won't tell details b/c that would make it trivial to workaround it, so they say). Could someone characterize their offering and tell me if it's any good?

To those spinning a story against C programming here: it is entirely possible (trivial, even) to isolate address spaces between requests, and has been for like 25 years (CGI programming) and more. When you absolutely must use a long running, single-address space service container, OpenBSD's httpd shows how to do it right (goes to great lengths to randomize/re-initialize memory etc.). I agree, though, that using straight C isn't a good choice for the latter.
But .. that's what Linus is saying in his mail. Like, really exactly what you say in your last sentence..?
It doesn't make sense to me. The more successful sites will be around longer - so $75/one-time probably means less lifetime value versus the $5/mo you suggested which I think makes more sense. But they probably need more cash sooner.

And $75 one time will just push the masses to alternatives.
Nice to hear you improved your technical skills. But your next step is probably not extending those skills more, by learning maintenance etc. Your next step is going to market.

Re-read the article: only a tiny part of it explains the technical challenges/mistakes. Most of it revolves around finding the problem people face, presenting them the right solution, etc. Checking if people are willing to pay for such a solution.

As said in the article:
> Market-specific experience is probably the biggest and most under-valued asset that you can bring to any project. Few people ever talk about it.

Solving the technical problems is the easy part. Knowing which problem to solve, which solution to offer, how to get the right people to notice you, how to get them to give you money. That is the hard part. Start learning that part now.
In addition to the 1st amendment problems of banning certain kinds of code, I think forcing encryption to have a backdoor could be construed as part of a search, and so run afoul of the 4th amendment. Who knows what the courts might say though - I wonder if there's any precedent...
Speculation: people may want to use Ragel-generated code in C++, where strict equality checks are idiomatic. p may be an iterator instead of a raw pointer. >= can be absent, or slower than ==.
CF's success (especially in the free plan) suggests that this might be actually true---I'm afraid I cannot prove or disprove the claim (that's why I believe so). My observation comes from drawing the parallel to djb's Internet Mail 2000 [1], which tries to counter spams by changing mail storage to the sender's responsibility.

[1] https://cr.yp.to/im2000.html
iOS supports third-party keyboards since, like, 8th edition. Exactly what made iPhone acceptable to me.

Not that I'm too happy with it: for some reason my SwiftKey's gesture-recognizing algorithm seems to be getting worse over time, while next-word prediction becomes better.
Well a good start would be using a different supplier than Waymo.
Well, it's obvious that there will be an improvement in specifiying the syntax for a computer program as it has been for the last decades.

e.g. Assembler -> C -> C++

There recently has been a post @ HN about the missing programming paradigm (http://wiki.c2.com/?ThereAreExactlyThreeParadigms). With the emerge of smarter tools, programming will get easier in one way or the other, releasing the coder from a lot of pain ( as C or C++ did realse us from tedious, painful assembler ). However, I am quite sure that it won't replace programmers since our job is actually not to code but more to solve a given problem with a range of tools. Smarter tools will probably boost productivity of a single person to handle bigger and more complex architectures or other kinds of new problem areas will come up. Research will go faster. Products will get developed faster. Everything will kind of speed up. Nevertheless, the problems to get solve / implement will remain until there's some kind of GAI. If there's an GAI smart enough to solve our problems probably most of the Jobs have been replaced.
> "Why do we offer $5k for a small bug again? Look at CF, they don't offer any money!"

Answer: "Because if they had set up a bounty of $50k for security issues, they'd had thousands of researchers/students/white hats etc. watching the output of their servers."
Happened on my phone and my Mac. I thought it was odd but wrote it off to a developer having programmed a computer to be stupid somewhere. Turns out I was right.
Does traffic from different sites flow through the same server process on CF? E.g., can the following sequence occur?:

1. a request hits a site that doesn't use any of those features, but loads juicy data into memory temporarily; the memory is dealloc'd, but is now "primed"

2. a request hits a site that uses those features, triggers the bug, and leaks the data from step #1.

Said differently, my reading of the CF blog is that only sites using those three page rules trigger the bug, but that is distinct from being affected by it. (The affected site is the one in the uninitialized memory; the site using the rules is in the initialized memory being processed.)
Take a look at multihash[0]. I don't know the inner workings of the program, but I imagine it would be possible for `multihash` to periodically rehash files (as a cron job?) when a new crypto algorithm gets introduced.

[0]: https://github.com/multiformats/multihash
Leaving TPM breaking aside, is dude who did all these things on work network the same dude who's going to break a TPM?
Not exactly physical ailment, but I don't sleep well if I spend most day just sitting and thinking.
As a janitor, I feel the same way. By the time a robot can cost effectively do my job, everyone will be out of work. My job even requires motor skills!
This is huge and CF is certainly downplaying the issue. To be clear, I think the kind of tech that they deal with is extremely complex, which makes it ever harder to test or uncover them easily. And they have been reasonably good with disclosures (prior to this incident).

When I was evaluating CF for a small personal app, I really thought hard about using a public reverse proxy and decided that it wasn't worth it for the scale I was dealing with. No one can predict these security issues, but I sure am glad I didn't go with them!
Incidents like this remind me that the password problem is only partially solved by password managers: most of the internet (i.e. if you're not my bank) needs a simple, easy to script protocol that allows me to automate the process of rolling a lot of passwords.
Show HN: Twitter bot event recommender near you
Hi HN,

I have create a twitter app on https://twitter.com/DropinIn which recommends an event starting in the next three hours near you if you tweet to the bot along these lines :

@DropinIn event recommendations in New York

The architecture is a python twitter streamlistener writing into a Redis RQ, then a worker is picking it up and looking it up via our API.

I would be interested in your feedback.
Licensing could easily eat up their laptop revenues though.
Better than telling you to panic, right?
I'm answering my own question, well sort of. The complaint doesn't state this, just "specialized software". This doesn't make the complaint lesser of course.

There are all sorts of other tidbits in the complaint that further strengthens the case in favor of Waymo, it's an interesting read, and I'm surprised it's very readable even for a non-lawyer.
I know what you mean. Anyone need a DNA Analyzer?

https://www.govdeals.com/index.cfm?fa=Main.Item&itemid=296&a...
You cant restore SSDs. I would assume Googlers are rolling SATA SSDs, if not M.2 PCIE ones.

What Google could be doing is remote logging on the laptops - logs uploaded to ze cloud every time you connect to the mothership. Plugging in USB drive leaves trace with USB ID, volume information etc. Windows also logs this and more http://www.forensicswiki.org/wiki/USB_History_Viewing

Protip: to exfiltrate data with minimal trace your best bet is taking out the drive and reading it in another computer (using write blocker for best effect), this can still be traced if someone is logging SMART written/read data (I am, but Im paranoid), not all HDD/SSD vendors provide this info. Second best is booting from USB drive so the original OS never sees the plug/unplug event in the first place, I have no idea about current state of UEFI/AMT logging going on tho.

Disclaimer: I used to do forensics.
They switched to Surfaces because they saw what I was doing with mine, wanted to be able to do the same, and Apple had no comparable answer. Simple as that.
If apple reinvent the IDE for use with touch on ios they might be able to drop their laptops altogether for development, and maybe market some kind of cloud-cube that people who want more grunt could purchase, rather than be limited to what can fit in a 2mm thick laptop.
I should have done my research, but I walked away from an accepted offer at a company once I found out they took money from In-Q-Tel.
When Linux Subsystem will be finally finished I personally don't see any reason to use Linux as desktop environment.

As for MacOS looks - Windows also are releasing update to their visuals this year which looks pretty darn aesthetically pleasing. [0]

[0] https://blogs-images.forbes.com/amitchowdhry/files/2017/02/P...
It's not a myth. It is obvious that you can find collisions with this constraint. When you make a collision attack such as this, you start with 2 inputs and have a target size, i.e. with a specific size of the padded data, then you simply iterate over paddings (of the same size), and when you find a collision, it will be of the correct size.

But it does add an extra constraint, and it prevent attacks that rely on random length filler data. This is not much of an improvement, but an improvement non the less.
>as an excuse

That part wasn't an excuse for harassment. And it also wasn't about programmers' salaries as justification. He was using rhetorical hyperbole to emphasize that the utilitarian benefit of Uber for brown and female riders is still true. That was a response to tyre's comment, "So now you have a company that isn't actually what it pitched itself to be.

Yes, harassment is harassment but it looks like yummyfajitas was responding to a specific business claim by tyre.
I actually had issue last weekend. One of the 3 routers died (shows as offline), So I tried reconfigure by unplugging and replugging it in. The light went on for few seconds, and the whole thing won't light up again. looks like dead.
i reinvented the space fountain, so ignore that.
HTML isn't a CFG. The HTML spec is setup as a state machine ( = regular language) + a number of side data structures like the stack of open elements and list of active formatting elements. This maps very easily to Ragel, where your actions can easily have side-effects and reference internal state within the language.
There is a huge fleet of compromised machines out there that belong to botnets. Soon we will see the botnets operators extracting content from these compromised machines browser caches to hunt for data leaked in this incident. Clearing search engines caches is just not enough, all secrets need to be replaced.
I did the same, just the Gym came after work and it was home "Gym". I can't work if I'm physically tired.

The same thing with coffee. It doesn't help me at all. If I'm sleepy, I sleep. You can not win fighting your body just like you can not win fighting nature.
Can confirm this happened to me this afternoon on my android. Went into a full panic mode. I refused to type passwords since I was worried it might have been another app imitating Google and I had no recollection of any action that would have required me to sign in again. I made sure that my password was correct on my laptop browser to ensure that I was not fallen for a account compromise. Eventually restarted the phone, ran lookout security app and then typed it on smartphone.
Most vexing parse
A prophylaxis is aimed at preventing an agent from unfolding its effect, an antidote is aimed at reversing its effects. An antidote can only be used as a prophylaxis if it has no adverse effects in the absence of the effect caused by the agent.
I enjoyed sinks activated by pushing down on a pedal with your foot. Maybe there are problems for handicapped people but I find this to be a nice solution to those that complain the water stream always stops before you're done.
Your sequence is correct. The bug was triggered at the proxy level, in an nginx module.
Moore's law still holds, and is expected to hold true until at least 2025 (see wikipedia). I don't think it will be done by then, but that is just guess work.
Then get an Air or a Pro. Or a Dell, or a Lenovo. There are these things called market segments. For some people the MacBook is a great design. For others, it isn't. No developers were harmed in the making of this laptop.
The Confusing Comma in JavaScript
> you should be using package system supplied by your operating system

2005-me vehemently agrees with you.
The horrors of dealing with LinkedIN support
What are my rough odds of having stored a credential,if I were a provider?

What are the odds I had a credential stored?

We know the impact but what are the odds to a provider and to a possible exposeee?
Either way he'd be pulling from Github.com at some point, whether in the build environment or production. He won't ever know that the repository was compromised.

Besides, some people use Heroku simply to deploy their rails or node apps, and they don't have an artefacts server.
> "Long live the independent web!"

I see how you can call this independent (eg. not a big hosting company), but for me the independent web is people hosting their content and keeping control on it. The ideal case is everyone hosting on their own machine (the old WWW?)
Thanks. FWIW, links in posts (as in, not comments) don't linkify; an Arc thing. Probably meant to combat spam.
Package managers allow you to download from git repositories too. He'd suffer from the same attack vector.
That's what I read in the thread about the collision that was found.
It served the wrong resource instead of failing to serve a resouce? Back then, if I were to suffer this, what is the likelihood of a porn for cats experience?
That is jerry rigging it. If a stronger hash function is known to be secure, you throw all that confidence out the window if you truncate it. At best you reduce the brute force complexity, at worst you enable pre-image attacks.
Erm... Which ones?
> So no, the kernel does in fact do ASLR to very small resolutions on the main thread stack.

Wow. You learn something new everyday.

I don't expect to be in a position where I need to know this soon, but it does increase my confidence in the kernel.
> There is no way to securely deploy a package directly from the internet.

Fetching a file from the internet and verifying it against a hash or signature is the only way to securely deploy a package from the internet. This is exactly one of the use cases theses cryptographic primitives are built for. Don't blame the users when they utilize the tools the way they are supposed to be, blame the tools when they fail when doing so.

And by the way, if you ever need to run `apt-get upgrade` or `apt-get install` on your production server from a public mirror, then you are guilty of "deploying a package directly from the internet", too. (My apologies and congratulations if don't.)
It was solved with ALGOL, but everyone wants to implement their own variation of it.
> I don't know what stormfont is

https://en.wikipedia.org/wiki/Stormfront_%28website%29

Stormfront is a white nationalist, white supremacist and neo-Nazi Internet forum that was the Web's first major racial hate site.

Stormfront began as an online bulletin board system in the early 1990s before being established as a website in 1996 by former Ku Klux Klan leader and white supremacist Don Black
Having a MacBook myself, I haven't found any problem only having one port. It's an excellent computer in general use, and very portable.

But I agree it's not at all entry level, this is a a luxury computer. It's an exceptionally well made machine. Their best product IMO.

It's not for everyone, sure. But it's great for me.
Ah, that makes sense. Thanks for clearing it up for me.
Yes, thank you. If you somehow have a problem domain where most of the errors you encounter can be gracefully (but uniquely) handled, then that's fantastic for you. But in virtually every golang example I've seen, you're just gift-wrapping the error with a little bit more context (or not) and returning it up the stack. In which case you've just replaced automatic, computer-executed exception handling with bespoke, artisanal, handcrafted exception handling for no gain and a hell of a lot of loss.
Can you explain how 2FA would have helped?
I used to work with below AS 2.0 on a 4GB machine with poor performance. but after updating to 2.2+,I think it won't work without 8GB.
You could add the new hash functionality, and enable Git to use variable length hash functions and multiple different hashes based on setup. So for compatibility, you keep SHA-1, but for future you use a better hash function.
Php Real Estate Script
When in a tactical emergency do not say "and why is this shit raining down upon us?"

That is a separate step. First you either take cover or help.
Yeah, the "throw-away" $5,000 Mac Pro wasn't such a good idea.
Real Estate Script
4.2ghz OC'd i5 4690K, 16gb ram (would like more though), Asus Maximus VI Hero ATX mobo, GTX 970 card. It's not a terribly fantastic setup, it's mainly the HAXM integration on the emulator. If you haven't tried the emulator since that was included you need to. It went from 5 minute startup to 30 seconds tops. And if it's already running then rerunning the app is nearly instant.
2FA doesn't protect you against cookie/token stealing. The website owners need to invalidate all of that on their ends.
Maybe they are migrating user credentials to SHA-2 and don't want to be too open about it till it's over.
Bitcoin is surging because it's a globally accepted store of value and means of commerce, and the fixed quantity prevents devaluation. Unlike gold, all transactions can be done remotely and confidentially, an there are no storage cost, eliminating all the problems that are associated with storing large quantities of gold. IMHO, all dips will continue to be bought and the price will keep rising...$4,000/coin is possible...been long since 2013, so I am biased in that regard, but there are real fundamentals here too.

Foreign currencies have lost anywhere from 30%to 99% of their value against the US dollar since 2013. Beginning around 2002 and ending around 2011, many foreign governments carelessly amassed substantial infrastructure debts that now they are struggling to pay off (due to economic weakness for these foreign economies and the surging US dollar), creating a cycle of inflation and currency depreciation, making Bitcoin more attractive to own for people and businesses in these countries. Bitcoin is rising because citizens and businesses have lost faith in the competence of their governments, and rightfully so. America is an exception in that it's well-managed and strong economically and fiscally (especially relative to these foreign economies), which explains the flight to the US dollar, and also Bitcoin.

For example, in 2013, depositors at Cyrus' largest bank lost 48% of their savings above 100,0000 Euros:

NICOSIA, Cyprus (AP) — Depositors at bailed-out Cyprus' largest bank will lose 47.5% of their savings exceeding 100,000 euros ($132,000), the government said Monday.

The figure comes four months after Cyprus agreed on a 23 billion-euro ($30.5 billion) rescue package with its euro partners and the International Monetary Fund. In exchange for a 10 billion euro loan, deposits worth more than the insured limit of 100,000 euros at the Bank of Cyprus and smaller lender Laiki were raided in a so-called bail-in to prop up the country's teetering banking sector.

http://www.usatoday.com/story/money/business/2013/07/29/bank...

A second factor may be the rise of global authoritarianism, unrest, and unease, reducing confidence in keeping money in banks, and assets that face geopolitical risk...Bitcoin, because it's decentralized, is immune to geopolitical risk. As long as you have your wallet, you have your wealth.
I can install hardware backdoor in a macbook in under 3 minutes (with prep obviously).

Even you could do it https://www.youtube.com/watch?v=qGPGOoJn54E hint: there are internal USB buses in the macbook, you can hijack one for something like rubberducky +management circuity to trigger only when laptop is powered on for a longer period of time but not touched (no imu/keyboard/touch events/dimmed screen).
Oh really? Who won then?

Because the way I see it, both SegWit and BU are under 30% activated, and the most plausible future is the status quo.
I had a higher end Mac Pro when I was doing iOS development and Android Studio is way more stable than XCode and the emulator is at least as fast.
I find that things that prevent me from getting into deep work (as I understand from the comments here, didn't read the book) is the crap involved with 'getting to work' these days. Not a day goes by were I do not have to spend a strange % of my time screwing around with settings, setup, libraries, fixing libraries, (re)installing libraries etc. This is why I would like to do embedded coding or game coding (it applies less and less there, but it applies to the games I like writing) all the time; stuff is just there and I do not have to fiddle around with 'stuff'. I still do see a good place for IDE's like Delphi & Livecode or closed source systems like q/kdb+; install and just start working, no messing around with whatever badly built 3rd party stuff. Even with containers it's not perfect; too many things are just deterring from what I am hired for or, more importantly, what I want to be doing, which is writing code. If I need something (trivial or complex) and open nuget search or (more so) npm search, I know that now I will lose a lot of time installing and learning all kinds of mess I don't want to deal with as I was in the flow.

I am teaching a few people programming so they might have a better life (they asked me for that reason; I recommended to them to open a pizza restaurant in a small mountain village and be happy but he) and they keep asking me things like; 'why does Postgresql not contain a full search engine like elastic search, why elastic search? why do I need to install a queue, why is that not in Postgresql? why does this language library not have x, why not y? (also, why do I need to install a webserver, why is that not included? Mailserver? DNS server? etc)'. I know the answers and I know why it all is like that as I lived through the years when it was, then wasn't, then was, then wasn't but it does take me out of the flow and it makes me, sometimes, long for just switching on a computer and just having basic + assembly and that's it.
http://www.usdebtclock.org/ (although the whole debt thing is complicated with state/federal bank owning a large piece of the debt).
I wonder how Shopify due with it too.