skysight-inc/HackerNews huggingface dataset:
No, research isn't inherently advocacy. But it can be advocacy depending on the way you do it - what you include in your studies and what you exclude. What you lump together when you roll up the numbers. And everybody knows this.

It's not that I suspect the truth disagrees with my beliefs - it's that I suspect my tax money is being used to propagandize my fellow citizens in an effort to erode my civil rights.

As to your p.s... 1) you are confused, and 2) people who assume other people are trolling when they meet disagreement aren't doing a good job of defending their own beliefs.
> > If we want to have any kind of confidence that the hash is reall yunbreakable, we should make it not just longer than 160 bits, we should make sure that it's two or more hashes, and that they are based on totally different principles.

Why is this quoted in support of an argument that Linus used to come across as a lunatic in online correspondence ?

This seems to me like an entirely reasonable way to make it very, very difficult to ever attack, because an attacker would have to be able to generate collisions for both of your hash functions.

(I'm not a crypto expert -- maybe you are, if so and my above comment is totally wrong, can you explain how it's wrong?)
"The company doesn’t have a product right now and is cagey about what it will eventually release"

Incredible pitching!
> a stealth-stage startup that wants to enable internet users to “regain control” of their personal data, has landed a $4 million seed funding round... Other investors that participated include Lemnos Labs, Liquid 2 Ventures, CrunchFund*,...

So Arrington is promoting one of his investments on one of his sites. The investment claims to "give consumers control of their data," but the site gives that data to at least 9 companies: AOL, Facebook, Gravatar, Parsely, Taboola, Tinypass, Twitter, Vidible, and Wordpress.
> I wouldn't consider one of the (100?) investors Uber has to be responsible for Uber's actions

Not fully responsible, but still responsible. IMHO we are accountable for the consequences of our actions. As an extreme example, I shouldn't fund someone who uses slave labor. If I knowingly funded someone's violent, criminal act, I would go to jail.
Is it true that in the beginning, staff members would comment on every piece of art that was uploaded?
>Welcome to a future where only voices that broadcast their grievances loudly over ... media get answered.

Welcome to our past and future. The fastest way of getting any dispute resolved is often to contact the local media or a political representative. Disputes with utility companies, retailers or landlords that grind on for months are often settled in minutes when a journalist or council member picks up the phone. If anything, the ability to kick up a stink on Twitter is an improvement.
Wider HN community could probably have rounded up 36M to keep DA being DA.
Can you explain how git uses the sha-1 hash? If the maintainer still has to merge PRs I don't see how it's affected.
What's the rationale behind sending user PII through a CDN? Presumably that is useful to that one user only so a CDN wouldn't be super useful in distributing the load across its edges. Also doesn't CDN caching kinda defeat the purpose of having SSL?
Storing in S3 should just work. Isn't it?
A better strategy is just to not interview at uber.
I have often wondered about the legal basis for the prohibition on cannabis. I always assumed it must be the interstate commerce clause but I could never make out why we needed an amendment to outlaw alcohol.
A DUI checkpoint is not an automatic waiver of your 4th amendment rights. In many places DUI checkpoints are not legal and instead they have drivers license checkpoints.
Really. You don't need to dump all your ammo on the very first day.

She said what needed to be said. If Uber challenges her account, she can post more information, assuming she is telling the truth (which I am for now).
"clearance" is not the same as solved.
I agree that many books could be distilled into small fractions of their total length. I also agree that these books are sometimes repetitive and tiring. That said, I think it's often still sensible to write (and read) such books.

I read Deep Work and didn't find anything Newport says in the book to be that profound, counterintuitive, eye-opening, etc. But it's a good book and I'm glad I read it because it's, idk, 2-300 pages of ideas, however mundane, that are simultaneously good to think about and easy to accidentally ignore. As a direct result to reading Deep Work, I made a few small changes that have had a positive impact on my life since. Now, did I _learn_ anything new from Deep Work? I don't think so, but it helped me focus on things that I think I already knew.

Books aren't all about information content.
Is there an International Day of Internet Security? I think we should make today that day.
I wasn't aware of that. Thank you for risking down votes to bring that to light.
More detailed information for others:

https://www.cloudflare.com/case-studies/fastmail/
This and the SHA1-pocalypse cannot have been a fun day.

Maybe time to consider one of the nap rooms?
Technology has changed too much to make any sort of reasonable comparison of gun politics today with those of two hundred years ago. Certainly the national mood has shifted toward fewer restrictions on guns over the last generation.
How timely was this PR considering what happened with CF today[0]. I'm sincerely impressed!

https://news.ycombinator.com/item?id=13718752
A full mempool is by design. Without it, bitcoin can be used as a permanent secure distributed file storage system with massive redundancy. Thanks... I'd prefer to keep it as a non-censorable store of value.
Yes, we're essentially giving the Windows Console its biggest overhaul in > 30 years!

It's important to remember that the Console was one of the first things Cutler & team implemented when they started NT itself, and it's been updated, patched, partially-enhanced and modified quite a few times in the last 30+ years! ;)

We're in the process of modularizing much of the Console's internals, replacing particularly archaic parts with shiny new modern C++ collections, etc., removing unnecessary cruft, etc. ... while trying not to break anyone!

Much of the work we're doing right now will result in Maximus5 & the Console2 / ConsoleZ / etc. teams having to jump through far fewer hoops to implement decent terminals on Windows.

And while we're doing this, we're also enhancing the console to support *NIX VT sequences, adding 24-bit color, etc., working with several other teams around Microsoft who need Console changes to make their things work.

This week, we are planning & building features for the NEXT OS release!

As you can imagine, it takes considerable effort and care to do this and we've got a great team with Michael, Paul, Mike2 & Austin beavering away as I type.

Actually; small lie - Niksa is on vacation this week re-charging his fuel cells before I chain him to his desk again ;)

We'll be writing a series of blog posts in the coming weeks, summarizing what's new in Bash & Console in Creators Update, and will have some cool stuff to show off at Build 2017!

I'll also be speaking at OSCON 2017 in Austin (same week as Build!!), so stop-by if you're in TX and want to chat about Bash / Console :)

https://conferences.oreilly.com/oscon/oscon-tx/public/schedu...
Does anyone else remember this New Yorker profile [1] of Anthony Levandowski and self driving cars? Way back from 2013, when this tech was still novel. Google let Levandowski run the show for this piece -- his name is mentioned 57 times in the article. Goes to show how important and trusted he was in Google's universe.

[1] http://www.newyorker.com/magazine/2013/11/25/auto-correct
There's a C to brainfuck compiler as part of ELVM, and the LLVM C backend was resurrected recently, so it may be possible to do Crystal to brainfuck.
My favorite book on the subject is "Free Play : Improvisation in Life and Art" by Stephen Nachmanovitch.
https://www.amazon.com/Free-Play-Improvisation-Life-Art/dp/0...

His description of the necessary fight with the "inner critic" more or less lurking in everyone's mind - and especially in OCD/perfectionists - is really interesting and got to me much more than Flow (haven't read Deep Work tho).
Only people who really don't understand how bitcoin works are pushing for a hard-fork over a soft-fork.
Buy 'em by the pound!

I'm almost surprised by the number of firearms, more so that it appears most were drug-related seizures. I shouldn't be, but I am. Many of the pistols appear to be in terrible condition, too. (Unsurprising.)

I am wondering if any of the rifles not marked as confiscated property were lost in shipping...
OpenBSD Foundation 2016 Fundraising (goal: $250K actual: $573K)
The book Chasing the Scream is a great summary of how crackdowns on opioid abuse, and other drugs, have led to the problems we have today. I've mentioned it other times on HN, and it's still a well-written primer to why we should legalize many, and perhaps all, drugs.

[1] http://chasingthescream.com
It's reminiscent of the earlier days of the Squid cache.

When it had bugs and devivered up cached files the typical symptom was that everyone in the company got unwanted porn.

Because the biggest user (by far) of the 'net was the person into porn and so 90% of the Squid cache was porn.
If you mean that web == HTML + internet ports 80/443 etc., then it's a forgivable error. s/web/internet/ doesn't make the article any more or less effective at getting the main points across (price high, ETF rumors).
> however the effects are most severe for miners

Incorrect. The most severe effects are on the nodes.
Ask HN: Do you have physical ailments from sitting all day?
I would like to ask you something that has been bothering me for a while.

I develop software for a living and have been doing that for a few years now. I developed leg pain on these past (full time sitting) years. I get this pain specifically where it makes contact with the chair, and then it eventually spreads all over the leg. The pain goes away if I walk around, but almost immediately comes back if I sit again after a short while.

When to have it checked at the MD, but nothing came out of it, he just told me to adjust posture and stretch.

Nowadays, if I am in front of the computer for more than 4 hours per day, the pain starts getting worse and worse. The only solution that seems to work for me is to limit my time in the computer to those 4 hours per day and do other stuff during the day, like exercising for example.

I was afraid this was messing with my circulatory system, so because of that discomfort I quit my job and now I fear cannot/shouldn't comeback to a 8 hour+/day software development gig.. I also have zero experience in freelance, which seems to require almost 8 hours per day as well to be done properly, or am I wrong?

I am fairly young, I’ve invested numerous hours in software development, it fulfils me, it is the best thing I know how to do, not to mention that it is the only thing I have to pay my bills.

I am feeling lost and increasingly depressed by this whole situation. Your peer experiences would be of most value to me. Do any of you have similar experiences? How do you handle it? Did you switch careers because of this?
Take this with a grain of salt since this anectode is a few years old, before I upgraded to a SSD to host my swap, and this is on Windows.

I'll always remember when I used to load a large piano instrument in a VST DAW on Windows 7, taking about 3-4GB out of 12GB of RAM, it played perfectly fine but if I left the application open, invariably on the next day I'd get a barrage of audio dropouts when pressing any new piano key. One trick was to put my arms on the entire keyboard a few times to wake the swap back up to memory. Another trick, which I ended up relying upon despite occasional low memory warnings, was to disable the pagefile entirely - that sure fixed the problem.

I'm not sure how/if things have improved since with Windows 10 and SSDs, but I always felt there was something wrong with the algorithms, since even with GBs of memory free at all times, old memory content would tend to end up on disk, without any good reason I could see.

I assume the OS used time to prioritize various caching/pre-fetching techniques over actual application data, and/or once paged, never preemptively loaded data back to RAM even if plenty of memory was available.
I'd suggest "FlareOut".
Presumably you're in Arizona at the moment, Mr. Levandowski, it's close to the border, run for it!

We'll take a moment to remember the salad days, when you were just a crazy college kid who showed up at the Darpa Grand Challenge with a self driving motorcycle:

https://youtu.be/XOgkNh_IPjU
DataOps Conference at MIT
In the video, my demo was to take a POSIX C++ application and deploy it to a local WSL instance, built it, run it and debug it ... from VS.
The word "theft" can have different meanings depending on context. Most people think in ethical terms rather than legal.
Yeah what is the attack here?

If you don't have permissions to my repo that already limits the scope of attackers to people who already have repo access. At that points there's tons of abuse avenues open that are simpler.

If someone could fork a repo, submit a pull request and push a sha for an already existing commit and that would get merged and accepted (but not show up in the PR on github) well that would certainly be troubling, but at that point I'm well past my understanding of git internals as to how plausible that kind of attack would be...
For fun I tried to change the meaning of the quote but leave most of the words and syntax:

"The discovery of the Polio virus is one of the greatest revolutions that has taken place in the world. The battle in which we are engaged today is of the same sort as the battle waged, during the last century, by Jonas Salk. How many diseases have their origin in the Polio virus! ... We shall regain our health only be eliminating Polio."

5% toxicity. So just talking about Jews makes a quote 4 times more toxic. Interestingly, the word "toxic" itself also makes a quote 4 times more toxic.

But personally I don't think Hitler quotes should be rated as toxic. The point isn't to control what people say, but how they say it.
Ah, gotcha. Thanks for explaining!
can you not link rt please. we don't need Putin's mouthpiece
I got signed out of several of my accounts on several apps but not always the same set of accounts.

I'm guessing they're invalidating auth tokens that could have potentially been compromised with the Cloudflare leak: https://news.ycombinator.com/item?id=13718752

Edit: Or maybe it's unrelated and just a coincidence. Here's someone purportedly from the Chrome team posting about it on reddit: https://www.reddit.com/r/chrome/comments/5vuurk/account_acti...
Zeroing on alloc/free probably wouldn't have helped much with this bug. Data in live allocations would still be leaked.
geaserg34234 is a very similar name and 18 hours old that started this thread which is where the trolling assumption came from.

1) you just acknowled NRA has fought against the CDC conducting and then acknowled CDC where conducting research. Which means you acknowledged the NRA was fighting research. You may feel it was biased or that the NRA was in the right or whatnot, but that's a completely separate point that I really don't care about. NRA's job is to support a viewpoint so that's what they are going to do.
We're working on traceroute for a future release. In the meantime, you can run `tracert.exe <ip>` from within Bash which will invoke the Windows trace-route command-line tool to do the same thing ;)
Could Google's records be fabricated? If there are separate logging chips, one would get access to all schematics, fabrication facilities, etc. in order to even consider any Google claims based on data collected through such methods.
You've flipped the situation. Arizhel isn't making an analogy, they're correcting your misuse of one ("a few rotten apples") to defend a conclusion that is the exact opposite of the one it implies.
RGB to Hex: Understanding the Major Web Color Codes
No plans at this time; we're focusing entirely on command-line tools & scenarios right now. Besides, there are plenty of X Servers out there, no?
Another difference I just thought of (which may have been what I was originally thinking of but I said it wrong.)

I think an advantage of a Roth is that you don't have to pay tax on the money you earn via investing. For example, if your money in a Roth doubles then you only need to pay tax on the half of it that was there when you added money to the fund. Whereas for a traditional 401k you pay tax on money as it comes out which includes money earned via the investment.
Houses like this are a lot of fun, how did you find this video?
> their personality doesn't appeal to the zeitgeist

There's also the minor matter of breaking federal law. You can call this "the zeitgeist" if you like, but if I was an Uber investor I would be concerned that the company is leaving itself wide open to multiple class action lawsuits. The amount of their funding used to fight the many suits against them is also more generally concerning. Lyft doesn't seem to get into the same battles they do, so clearly it's possible to achieve good without being raging assholes while doing it.
With respect, the blog post buries the user with details. In my opinion, there should have been in bold at the top something like:

Title: Security report on memory disclosure caused by Cloudflare parser bug

(This is a security report, "incident" underplays this. Memory leak sounds a lot more innocuous than memory disclosure).

Data from any website that was proxied via Cloudflare since September 22, 2016 may have been leaked to third parties via a bug in Cloudflare's HTML parser. Operators using Cloudflare should:

* Invalidate session cookies

* Reset user passwords

* Rotate secrets

* Inform users that private data (chats, pictures, passwords, ...) may have been inadvertently leaked by Cloudflare.

* ...

Users using websites proxied by Cloudflare should:

* Reset their passwords

* Log in/out of sessions to remove session tokens

(Begin rest of post)

Last Friday, Tavis Ormandy from Google’s Project Zero contacted Cloudflare to report a security problem with our edge servers. He was seeing corrupted web pages being returned by some HTTP requests run through Cloudflare.
...
I'm compiling a list of affected domains here, please submit PRs: https://github.com/pirate/sites-using-cloudflare

I'm currently running a DNS scraper to find more.
The price of bitcoin, the price of transactions, and the ratio of bitcoin to other alts disagrees with that theory.
You kind of had me until you used someone's salary and work opportunities as an excuse for their harassment mattering less, or being overlooked.

Harassment is harassment.
I searched for

"CF-Host-Origin-IP:" token

.... uhm is that what I think I'm seeing???
>You may feel it was biased or that the NRA was in the right or whatnot, but that's a completely separate point that I really don't care about.

Um... okay. Whether or not the research is biased doesn't matter to you? That's an interesting position. Of what acutal value is biased research?

>NRA's job is to support a viewpoint so that's what they are going to do.

Yes, and the point was that's not the CDC's job. The day we start supporting the NRA with tax dollars is the day we can hold them up to the same scrutiny.
Using this, a command that will get your public IP, geo locate it, and then get an uber pickup time for those coordinates.

dig +short myip.opendns.com @resolver1.opendns.com | xargs -I {} echo "ipinfo.io/"{} | xargs curl | grep loc | cut -d: -f2 | sed "s/,$//" | xargs uber time
Compiling a list here: https://github.com/pirate/sites-using-cloudflare

It will be updated as we find more.
It's actually pretty easy to get alts. Buy bitcoin, go to a site like poloniex (there are lots of them) and trade your bitcoin for the alt.
Only the paranoid survive, Andy Groves famously said.
Their model was "trust the employee, and use the courts to enforce punishment if that trust was misplaced."

We are in phase two of that right now.
All major miners have spent loads of money purchasing mining hardware, and they all need to run that hardware for a long time just to break even. Higher future Bitcoin prices is critical to their ROI.
Even if they do, it is very unlikely they were built with provable nonrepudiation requirements. From personal experience designing the security of a PKI CA that passed gov security certifications, the audit subsystem is the most challenging part to do right. Could probably consult for the defense in tearing down the evidence :)
I'm pretty much completely uninformed on this issue so please don't take this comment as a challenge to your assertion, but how does the US go about determining whether or not voter fraud is taking place? Do polling/voting officials take some portion of cast ballots and investigate them for fraud and extrapolate the results over the broader voting population?

Apologies if this is a stupid question but I'd love to learn about how the integrity of the voting system is maintained in huge countries like the US.
"- revealed what they track internally to all their employees
"

Googlers already know this.
Like it's not even close to being close to being close to being secret.
Maybe there's much more to worry about Baidu's particular not-so-well documented, but longer-term partnerships.
While theoretically many non-cloudflare sites can be affected, I'm compiling a list of known cloudflare-using domains here: https://github.com/pirate/sites-using-cloudflare

It can serve as a starting point, just Ctrl+F for domains you use.
Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect. The fact that it was done decades ago is pretty good evidence that it's not about the actual initialization cost: these things cost a lot more back then.

What changed is the paged memory model: modern systems don't actually tie an address to a page of physical RAM until the first time you try to use it (or something else on that page). Initializing the memory on malloc() would "waste" memory in some cases, where the allocation spans multiple pages and you don't end up using the whole thing. Some software assumes this, and would use quite a bit of extra RAM if malloc() automatically wiped memory. It would also tend to chew through your CPU cache, which mattered less in the past because any nontrivial operation already did that.

I personally don't think this is a good enough reason, but it is a little more than just a minor performance issue.

That all being said, while it would likely have helped slightly in this case, it would not solve the problem: active allocations would still be revealed.
Swap space is only partially related to virtual memory overcommit, and virtual memory overcommit is extremely common and almost unavoidable on most Unix machines. Part of this is a product of a deliberate trade-off in libraries between virtual address space and speed (for example, internally rounding up memory allocation sizes to powers of two), and part of this is due to Unix features that mean a process's theoretical peak RAM usage is often much higher than it will ever be in reality.

(For example, if a process forks, a great deal of memory is shared between the parent and child. In theory one process could dirty all of their writeable pages, forcing the kernel to allocate a second copy of each page. In practice, almost no process that forks will do that and reserving RAM (or swap) for that eventuality would require you to run significantly oversized systems.)
Some of our customers in this sector pay us in bitcoins in exchange for services. They are well known in the sector, so no connected to the dark web.
I imagine clearing memory on free is more relevant than MALLOC_PERTURB_?