skysight-inc/HackerNews huggingface dataset:
>Is it to show how Linus aimlessly speculates and gets his guesses wrong?

I wasn't thinking of it like that, but now that you mention it, yeah. There's definitely something to learn from the way people make assumptions and are subsequently led by them.
> 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

HTTPS lets you verify that you're fetching changes from, say, a Github server. Just because a repo is hosted by Github doesn't mean that you can trust its contents.

> 2) Even if git did rely on SHA-1, there's no imminent threat. What happened today was a SHA-1 collision, not a preimage attack. If a collision costs 2^n, a preimage attack costs 2^(2n).

This needs investigation, but I suspect some plausible attack vectors exist based on collisions. Say you generate a good file and a bad file with the same SHA. If Github uses some kind of object cache for viewing files through the website, you could probably get the good file into their cache, then open a PR with a commit containing the bad file. The project maintainer would see the cached good file, but when they merge the PR, the bad file would be merged.

I'm not sure if this exact attack would work, but probably something like it would. If not with Github, then perhaps with Bitbucket or GitLab.

Another possible approach would be to send a PR which discreetly introduces the bad file into the project maintainer's object store. (It doesn't have to be in a commit you're asking them to merge; it could be in a separate branch which they likely wouldn't notice.) Once that's done, you send a PR which introduces the good file. If they review the second PR on a website, they'll see the good file, but if they merge manually, they'll get the bad file from their local object store. Even if the maintainer merges through Github, if they deploy from their own machine, they'll deploy the bad file.

> 3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's objects, they'd still have to convince you pull from their repo. This requires trust.

Not really -- on Github, contributors are often strangers, and project maintainers often fetch from a stranger's repo in order to try something out. They expect that fetching objects is harmless. Even if some project maintainers do look for signs of trust before fetching, they'd probably be easily fooled by fake info in a profile. A determined attacker could even make a large network of fake accounts which star each other's projects and so forth, similar to black hat web rings.

> 4) Even if you pulled it in, your git client would simply ignore their "poison" object, because it would say, "oh, no thanks, I already have that object". At worst, the code simply wouldn't work. No harm would be done.

If an attacker had the resources to perform a preimage attack, one thing they could do is take the latest version of jQuery on the day it's released. They could append some malicious code, then add junk in a comment until they get the desired SHA. Now they just have to get a project maintainer to fetch from their repo ("Check out this feature I added! Just fetch from my fork and run the server."), and then wait for the maintainer to upgrade jQuery.
UPS
Can someone list out the best network ups manufacturers in India?
I think you might be right, but I had reason to worry given Uber's history with competitors, esp. industrial espionage. They were actively competing with the company I worked for at the time. The laptop was my own, but I have no reason to assume that they knew that. I did have some material of my own that I considered to be valuable to their business so I was concerned primarily about that (I had done things that have pushed the envelop quite a bit in a very specialized area that they were just getting into) All of those factors made me paranoid. If Uber was a good corporate citizen with no history of actively and illegally spying on competitors, I would not have been so freaked out after that episode. Call me paranoid... what's new.
My experiences with cisco software has made me vow to never install cisco software again.
This is the most insanely exaggerated and ridiculous comment I have ever seen on Hacker News. I have no clue how you sleep at night.
"When you see something like the opioid addiction crisis blossoming in so many states around this country, the last thing we should be doing is encouraging people.”

So uh... where's the action on opiate addiction?
I'm surprised there are no comments yet... I haven't heard of S2n until reading this post, but it sounds like it could potentially replace OpenSSL usage?
I think Alphabet probably views Waymo as their next big thing, and Waymo appears to have a sizable lead over everyone else in the self driving space which they want to protect. Remember, Alphabet is a major investor in Uber through Google Ventures, and their stake is likely worth billions. They wouldn't pursue this unless Waymo was of critical importance to them.
I regularly visit /r/rust and am happy with how it's stayed away from politics. At one point, it almost brushed on it with Trump's travel ban affecting an event, but overall it's a nice "oasis" from the sea of politics.
The medium article also notes that a couple more employees stole confidential information. Five years later Waymo employees will be bitching and moaning about corporate overreach and will have these fucktards to thank. (If allegations are proved).
In 10 years. 75 years in 10
If MS want to poison the skype brand I won't stand in there way.
Yea but... seems like a quick run of valgrind would have caught this
A classic. I fear however, we have made no progress towards preventing mud balls since this was written. There are two old methods of application design predominantly used today:- functional decomposition and information (data) modeling. Both lead to big balls of mud as size and complexity of a problem domain increase. Have we given up on finding ways to model a problem or system into code in a better way?
Happened to my phone this afternoon. Odd, but thought it was because of my vpn bouncing my IP around.
Always nice to have options. Not zeroing memory on allocation might save a few cpu cycles.
> But I do not agree with the claim that this is interesting in this context as it seems irrelevant to the discussion

The discussion appears to be on the topic if we assume the topic is VX or nerve agents in general. I assume this is in line with your intention for posting a series of Wikipedia links on the subject in this thread, which I found both relevant and interesting.

The reasons why I suggested that the dumping of large quantities of nerve agents was an interesting fact is an inquisitive person may ask themselves -

- Is the product still down there under the ocean?

- What could be the environmental impact?

- What were they thinking at the time to dump such a hazardous material? Why didn't they use alternative means to destroy the material?

- Was this standard practise back then? If so what other deadly man made products are under the ocean?

- If they are still working to eradicate 5,950 tons of nerve agents in a single storage complex in Russia, how much did that country dump back during the cold war and would we actually ever find out? TFA says the 5,950 tons is only 14% of of Russian chemical weapons [1]

[1] https://en.wikipedia.org/wiki/VX_(nerve_agent)#Worldwide_VX_...
Here's the 2 year old thread about S2n https://news.ycombinator.com/item?id=9804349
> What's shocking is how badly people understand the purpose of an analogy.

The purpose of an analogy is to simplify something that's too hard to understand for the person you try to convey your idea to. Sometimes analogies are appropriate, e.g. when you teach something. When you want to convince somebody whose opinion is very different from yours, analogies aren't appropriate. They sound condescending: "because you are not smart enough to understand the real rationale behind my opinion, here is an oversimplified argument based on analogies I made just for you". The question is, did Torvalds have any real argument back then? Maybe he fell back to using analogies for the lack of any real argument.

> In this case, he was trying to convey the idea that the risk is so small and so remote that it really isn't worth spending a lot of time on.

To convey the idea that the risk is very small, one needs to have a proof. Real proofs shouldn't involve analogies. They should use facts and logic.
I assumed this was a reset from Google due to the Cloudflare stuff, but seems like it wasn't?
Would a potential roadblock for such systems be automatic verifiability? Consider that a system provides a ranked list of possible code snippets someone would still need to pick from these choices and test it.
Happened to me. Signed out of all my devices & browsers!

I thought I was in sleep and had signed out of my mobile. But then same in mac. Then I thought some issue for sure.. And reports are here...!
Thanks for the reply. it has been a while and i don't even remember the username of that account.it wasn't that important to me (plus, a relatively new account) so i didn't bother contacting HN.
I actually ended up in the same article because VX is related to オウム真理教(Aum Shinrikyo), the group that was responsible for the gas attacks in Tokyo. They were also manufacturing VX and are the only ones on record to have used it to commit a murder, until now I guess...
https://en.wikipedia.org/wiki/Aum_Shinrikyo
I was married to a mostly white girl (one-quarter Indian) that grew up on the Crow reservation and we visited frequently. I found the Crow reservation to be nothing like I'd heard. People were friendly to me and I could count on one hand the number of times I ever got a mean mug. At the time, my unit had just reclassed from infantry to cavalry, so I was a US Army cav scout married to a Crow Indian. Anyway, I realize it's anecdote and only one point on a graph. But people were always friendly to me and I never felt unsafe, or like I should just keep on driving.
Science backed parenting
Hi fellow parents!

We recently launched www.bestparents.club, the first research-backed parenting resource. This FREE service will send text based recommendations and activities to help you interact in the best way with your kids.

Sign up today at www.bestparents.club. Any feedback you can give us will be very appreciated.

Martin
Running a bitcoin node in grandmas Australian basement was never a long term design constraint.

In an era of Chinese fabricated asics running on state subsidized energy, I fail to see node centralization as a priority.
FYI, you can still buy commercial microwaves with knob controls and an absence of useless buttons.
Yeah, same here. I was trying to figure out if I had done something to trigger it or, worse yet, if I'd been "hacked" (or someone got close and Google noticed and killed all my sessions).
> Apple consistently chooses form over function, but they don't usually let the scales tip this far.

Does it? For example, in the laptop space, Apple has consistently shipped the largest batteries of any notebook without an external battery pack.
Looks like prescription medicine is rife with opportunity for some kind of ML analysis to find abuse and be more "just" (make better decisions) about restricting distribution and use.
Happened to me as well, I was signed out of every device I use google on.
He's not wrong about the noise level. I conducted a survey of the most notable bug bounties in 2014 and found that the largest companies either have ineffective programs or quickly scale teams to handle inbound reports full-time. There are security engineers at Google and Facebook who spend a majority of their time responding to, and triaging bug bounty submissions.

That said, I disagree that bug bounties don't work for CDNs. You can scale a bug bounty up, it just requires resources. Cloudflare has those resources, and part of it is a function of the reward tiers you offer.
Yeah, sorry, brainfart. I have only ever used NVMe drives in M.2 so I completely spaced that you can put 'em in PCIe slots too (which is probably more popular, actually?).

Thinking about it, that (2 x NVMe in PCIe) will probably be the first upgrade I do to my new workstation in the future. It looks like those only use four lanes each and I've got enough still available (80 total) to support way more of these drives than I expect to ever need on my desk.

ETA: PCIe v3.0 x16 == 15.75 GB/s. I expect we'll see, at some point, PCIe cards/adapters that support up to 4 NVMe drives (in one slot). Hell, they might exist already.
No, see, because opiate addiction exists, we shouldn't be encouraging people. Only the premise, not the action in the conclusion, references opiates.
> 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

I thought that if you signed your git commits or tags with GPG, you implicitly relied on the commit checksum, and thus on SHA1.

Is that right?
Many mobile providers cache heavily as well. In my country, Vodafone does this.
When your company stores very private info on billions of people, and is actively attacked (sometimes successfully) by the top intelligence agencies of the world[1][2], you have to be extremely careful, and monitor everything.

[1] https://en.wikipedia.org/wiki/Operation_Aurora

[2] https://www.newyorker.com/news/amy-davidson/tech-companies-s...
At least they apologize. I've noticed a recent trend with bay area Uber drivers calling immediately after accepting the ride, asking the destination, and trying to strong-arm me into cancelling the ride if they don't feel like trip is worth it (the answer of course is hell no dude). I've been curious whether there has been a recent major change on their side of the app.
Why is "the culture" always used in Silicon Valley to justify incredibly bad decisions?
> Most people would've gotten their personal-ish data off a corporate laptop with a usb key/harddrive which they probably wouldn't have triggered any alarms.

Most top banks use Citrix technology (or similar virtual desktops) to stream workstations for employees accessing both locally and remotely, so the only way you can get data out is by using your phone to take photos.
Right, I feel like the law doesn't have loopholes for things like violent crime. Some kind of twisty scenic routes might work for cornering the market or employing dragnet surveillance on a population. But you swing a crowbar at somebody for their wallet, you're pretty much going to jail, even if you think you've got some kind of genius loophole.
> Showing your ID isn't waging a war against voting rights

While this is superficially true, pragmatically speaking it depends entirely on the outcome of doing such. If it happens to avoid no voter fraud, but does succeed in making it so certain demographics are inconvenienced in voting, then the effect of it is indeed undemocratic voter suppression.

At any rate, the fact that one party is pushing the matter, while the other resisting should suggest that there are expected gains or losses, respectively, for those parties. That's all the more reason to insist on fully demonstrating that there is a bonafide need to implement these measures before blindly doing so under the ultimately irrelevant rationalization that "everybody else does it this way".
Same here. Had to log in again.
Really? That search engine sells DDOS protection?
The reward includes a t-shirt, it isn't a mere t-shirt. You also get "12 months of CloudFlare's Pro or 1 month of Business service on us" (~$200). The reward is also not tiered.

The award may still not be all that much, but let's not make things up about them.
When possible, measure security in attacker dollars.

What's interesting here is that, just 5 years ago, the 2017 cost of this very attack (the Stevens attack) was estimated at 2^18.4 = $350k [0]. The collision announced today cost about $100k. Perhaps even less. [1]

Cloud computing is cheaper today than many expected it to be, and it seems like we're only now entering the era of fierce competition. Who knows what the next decade will bring. If your modeled attacker cost is within an order of magnitude or two of the danger zone, beware. Better to have many orders of magnitude of headroom.

Along these lines, I really like what cperciva did with attacker cost modeling in his scrypt paper. See the table on page 14 [2]. I wish more security choices were presented this way, with estimated attacker costs. Taking that even further, I wish the numbers were updated dynamically against present day hardware & compute costs. Maybe even with trendline projections. It's difficult to make good security choices without knowing costs.

[0] https://www.schneier.com/blog/archives/2012/10/when_will_we_...

[1] https://sites.google.com/site/itstheshappening/

[2] https://www.tarsnap.com/scrypt/scrypt.pdf
That, plus also the effect that people in the market for pro computers tend to be infleuntial. They creatd software and influence the purchasing decisions of others.
A lot of people probably left with accounts created for their Android phones and no idea what their password is.
> So for those us that need to run Windows/OSX to run software, like Photoshop, for our job, we should just give up on PGP? Seems like a supporting argument for the article then.

If you're paranoid, run that stuff in a VM. If you're really paranoid, run it on a separate machine.
I would even say it cares that other dissidents notice and understand exactly who did it. Had this been a robbery or some car accident it would not have been as effective. The message is "we are coming after you"
Happened on one browser, of one device this afternoon. Other browser on the same computer, and other devices, were not impacted...

Like most here I assumed it was just a random, regular occurrence, and didn't pay much attention.
I dont understand why Apple doesn't offer a clone program for workstation Macs. Dual socket and above only (so that it doesn't compete with the iMac or the Mac Mini), restrict it to Intel, but give Dell/HP/custom builders the opportunity to build the pro systems that don't make much of a profit themselves, but support the army of content creators for their other devices.
My reddit password failed a week ago, and I had to do an email reset. And I use a password manager.
I interviewed with Amazon several months ago (and turned down the offer, so I have no affiliation); as part of the casual conversation with the people there, it was mentioned to me that the company hadn't offered instances optimized for IO up until that point due to other priorities but had been recently focusing on it with the I tentions of releasing something like this soon.

I was under an NDA on the topic and so never mentioned it; now that it's been released, i am free to say that this has been worked on for a while and that these sorts of gains in performance were not only expected but a goal.

(No disclaimer: I didn't take the job and none of my work or personal projects run on AWS.)
In my journalism law classes in the US, precedent was dictated on the terms I described.
True. You get some, you lose some.
If only CloudShare wasn't a thing already. :)
I usually turn them to Weebly and SquareSpace and adamantly turn them away from Wix. I think some of this has changed recently, but most Wix sites unnecessarily hijack browser functions, have time wasting page transitions, the SEO is terrible, and social sharing links always are buggy. Financially speaking, as a company they simply just out-spend everyone on marketing/sales to compete in the market, with very little product innovation.
If you're going to draw lines with characters, use the line drawing characters. We have Unicode now.

I have a program which takes text files with ASCII line art and automatically turns them into text files with UNICODE line art.[1] I wrote this for some very old documents, but it's still useful.

┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Source Port ┃ Destination Port ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Sequence Number ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Acknowledgment Number ┃
┣━━━━━━━┳━━━━━━━━━━━┳━┳━┳━┳━┳━┳━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Data ┃ ┃U┃A┃P┃R┃S┃F┃ ┃
┃ Offset┃ Reserved ┃R┃C┃S┃S┃Y┃I┃ Window ┃
┃ ┃ ┃G┃K┃H┃T┃N┃N┃ ┃
┣━━━━━━━┻━━━━━━━━━━━┻━┻━┻━┻━┻━┻━╋━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┫
┃ Checksum ┃ Urgent Pointer ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━┫
┃ Options ┃ Padding ┃
┣━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┻━━━━━━━━━━━━━━━┫
┃ data ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

[1] https://github.com/John-Nagle/pasv/blob/master/src/Util/picf...
> I could never make out why we needed an amendment to outlaw alcohol.

We didn't. We needed an amendment to ban alcohol in a way which could not be undone without a subsequent Amendment; the 18th Amendment banned alcohol itself, it didn't grant Congress discretion to do so.
He would have greatly increased his chances. Assuming that the agent used was run of the mill V/G agent and not a specialty delivery variety.

In reality atropine and pralidoxime(antidote sorta) administration would have most likely saved him, but it would be very unlikely for a medical professional to deduce that the threat was cholinesterase inhibition(nerve agent poisoning).
Unlike Reddit, it doesn't have financial backers who have produced a ridiculous narrative. (which is important btw, I work in M&A)
Coffeescript 2 has some breaking changes, most notably classes since it is moving to ES6 classes instead of its own implementation.

I'm with you though, I much prefer Coffeescript syntax over Javascript so I'm really happy to see it coming along.
> Clarence Thomas would agree with you. Hopefully Neil Gorsuch will be in his mold

Raich was 6-3, Gorsuch voting with Thomas rather than the way Scalia did gets you to losing 5-4.
Researching chemcal weapons on wikipedia wont get you on any list. Asking people where you can buy the needed stuff, THAT is list worthy.

Anything on wikipedia was put there by someone. That someone is far more suspect than the readers. Material that is actually dangerous is quickly edited away. Unless you live somewhere properly dangerous or are already on a list. Such people should probably stay away from the internets all together as almost anything found online can be made to sound evil.
You were the one brought up /r/bitcoin in a discussion about Hearn, not me. And you did it in order to trash /r/bitcoin in an account you created an hour ago. You're exactly the type of user that moderation was invented for.
Information about who voted is public.
Unrelated: I remember when xoom.com was an e-mail service provider with free web space back in 1999. Feels weird to see URLs recycled like this.

http://web.archive.org/web/19990508170650/http://www.xoom.co...
Google’s Allo chat app is finally coming to desktop – eventually
They used to anyway. Back in the day when their laptops were good.
Security industry != crypto academia.
Yes, but Excite Lite no longer supports the webmail.
Google updates Gboard for iOS with new emoji and voice-typing
Trump Voters Are Not the Enemy
Charlie Munger on Getting Rich, Wisdom, Focus, Fake Knowledge and More
More importantly they have high gross margins and debt is still really cheap right now.
In landscape on mobile, 2/5 of the screen is taken up by social media icons.
Sounds more normal than asking you to take your laptop on a walk.
China's Weibo will soon be bigger than Twitter
AWS launches I3 VM instances starting at 15 cents per hour
I don't think successfully going after establishment and entrenched interests is incompatible with being decent.
In that case I'm even more inclined to think it might be because of Cloudbleed.
Top Reasons Why Swift Is the Right Choice for iOS App Development
The 3 Coolest Cloud Trends You Will See This Year
Since he was working on self-driving cars at Google, he probably was authorized access to the software and hardware involved.
I've yet to learn a language where not handling exceptional cases properly did not result in a bug.
Peter Thiel’s Palantir Spreads Its Tentacles Throughout Europe