skysight-inc/HackerNews huggingface dataset:
Better title: "Green power subsidies are disruption the power economy". Subsidies are good for wind and solar, but corrosive to existing infrastructure, which are being squeezed to stay in business. Maybe some more measured plan would be good. Instead of blind enthusiasm.
Hi Pratish, just emailed you! :)
Lavrentiy Beria was the head of the NKVD (USSR secret police) during WW2 and also a serial rapist/murderer, the high ups including Stalin all knew, but considered him good enough at his job to essentially let it slide though of course they never let their female relatives anywhere near him.
It's a good question, and vidarh's response that "it's right there in the article: chilling effect" is clearly not helpful, since your question still applies without modification.

Looking through the memorandum, it appears that there are different levels of need/importance the government must establish depending on whether they are requesting information that could chill free speech. That is, warrants are granted more liberally for information that does not have a tendency to suppress speech (e.g., the date you filed for your car registration) than info that does (e.g., the list of books you've checked out at the library). The latter category must be shown to be more directly related to the issue of the case, rather than being merely a search for possibly-useful background info.

Amazon is arguing that (1) Alexa searches are of this second, more protected form of private information, and (2) the government has not met the higher burden of showing their importance to the case.

That, at least, is my reading of the memorandum. I am not a lawyer.
Miller Puckette: the man behind the Max and Pd audio programming languages
Also, why NOT measure "diversity"? You don't have to act on it, but it sure would be nice to have the metrics for any later analysis. It's not hard and isn't something that takes many resources to compile.
Long may this continue, because otherwise the implications for privacy and anonymity rights are extreme.

In some concrete fields like web/SNS, I believe completely surrendering your persona online is already a requirement. Let's hope this doesn't spread.
Your 3rd party software is irrelevant to the article.
OTOH, 12 years of reliability from a checksum in the age of Moore's law and quantum computers is pretty good, frankly.

I don't think they ever expected sha-1 to survive forever.
If you created the original torrent then you can do it
I always have 2 others in my Uber Pool or Lyft line. Some Uber drivers have told me they make the money through trip bonuses and not so much on the fares themselves, they get a certain bonus when they get to a certain number of trips, but I can't imagine that would make up the difference.
For me it means enough, i just deactivated/deleted my deviant art account.

This unclearness, plus their in my humble opinion, horribly annoying youtube ad campaign, did not make me ponder about deleting my account for a second.
Is there any merit to using two hashing algorithms simultaneously particularly if the algorithms are very different in nature?
It's not illegal to take them, but yes I doubt insurance will cover unapproved treatments. Also, while it's not directly illegal for a doctor to prescribe an unapproved drug, I think it would open them up to malpractice lawsuits, and it just seems like a bad idea in general. Here's a doctor's blog post about this issue: http://thehealthcareblog.com/blog/2013/08/26/should-a-doctor...
Ugh, another cute name. Who let marketing get their hands on exploits?
Hm, according to https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a27... a GTX 1080 can do 8.54 billion SHA-1 hashes per second. That puts it at only 34.2 years to compute 9.22*10^18 hashes.
Sometimes I can't even tell when I'm being sarcastic
I am a bit saddened that Vegard Nossum's work, which they used for encoding SHA-1 to SAT, is only mentioned as a footnote. The github code is at

https://github.com/vegard/sha1-sat

and his Master Thesis, whose quality is approaching a PhD thesis is here:

https://www.duo.uio.no/bitstream/handle/10852/34912/thesis-o...

Note that they also only mention MiniSat as a footnote, which is pretty bad. The relevant paper is at

http://minisat.se/downloads/MiniSat.pdf

All of these are great reads. Highly recommended.
> The methods section only contains variables the authors think worth controlling, and in reality you never know, and the authors never know.

Think about the epistemological ramifications of this.

This is why trust is so important in social contexts, even in science.
> Then if people are positive about the article I will go back and read it.

This strikes me as over-editing your intake feed and potentially missing out on information that you might be positive about, or take action on, or...
Dev Survey Results: diversity, tool preferences, and culture
The Keccak sponge function family
Thank you. At first I thought puzzagate?! - I don't need that bs, but this is very different pizzagate.

I once found a good blog about mental health and science, a lot of snakeoil shown about srris, adhd etc. but I'm unable to find it now. Can anyone help me out?
I tried two phrases:

59% You're a potato.

and:

60% You're a potato

Just losing the period makes it more toxic! Wow.

Now what can I do with this?
Yes.

Xcode was hacked not so long ago. The malware could remain invisible even to the creators of the app. Although it's less likely to remain unnoticed with open source projects due to the visible nature of it.

On desktop, Mac OS and Windows now provides official stores where apps are verified and signed.

On Android I remember Google added an app scanner in order to detect infected apps even when the security setting is disabled. On windows there is defender.

At the end of the day it's all about trust. Be very careful regarding where you download the software from.
Nice article, I'd say that crossfit and co. also suffer from a very high risk of injury. Many teachers have no experience other than going through crossfit themselves, and HIIT exercises make it harder to tell what is too far.
Slightly off-topic, but I don't know where to get help with this.

I see one of our projects has gotten a quota of 16 GPUs in asia-east1, us-central1, us-east1. However we seem to have been allocated nothing in europe-west1. Is this an error, or simply something I have to manually ask for somewhere?

"Quota 'NVIDIA_K80_GPUS' exceeded. Limit: 0.0" :(

I'm so psyched to finally be able to use GPUs on GCE instead of AWS, so any help would be appreciated.
I think worth clarifying, the fix on svn r49255 is in git tag v2_3_1, so if you're on ~2.3.1 Then you're back to linear #reject.
I very often read only the comments on HN, as they are routinely more interesting to me than the articles.

In fact, it might be worth trying out not even needing articles. Just submit a topic.

Discuss HN: Numerical analysis

Discuss HN: Rust vs C for embedded development

Discuss HN: Health benefits (or myths?) of eating kale
So, it seems highly likely that the device doesn't have the information the police want. Barring any nasty surprises, Alexa only stores the actual requests made to it.

However, Amazon doesn't want to win this case based on the technical details of this specific device, because maybe a future device will store more—and then they'd need to fight this battle all over again.

So they're trying to make an argument that doesn't rest on the technical details of their current devices. If they win that, then they won't have to worry about this kind of case later.
If you are touring with gear, that weight gain is a rounding error :)
Yes, as it uses a similar hashing scheme as git.
https://www.mercurial-scm.org/wiki/FAQ#FAQ.2FTechnicalDetail...

That said the file format was switched pretty early on (2006 I think, less than a year after initial release) to reserve space for 32 bytes instead of 20 for the hash, thus allowing hash migration more easily (sha1 is 20 bytes, sha2 which at the time was the obvious replacement was 32 bytes).
https://www.mercurial-scm.org/wiki/RevlogNG
The first I heard of Wix was a few months ago when a local news site deployed their new design. The page would be completely blank for 10-15 seconds while it made hundreds of requests for useless little React turdlets. As far as I can tell, they "fixed" it by moving away from Wix.

If that's normal for a Wix site, then I would say no, nobody involved on either side of the transaction is a web developer except in the most pejorative sense of the term.
This is one of the reasons it is important to have multiple hash algorithms in use. Even when a collision can be triggered in two systems, it becomes markedly harder to trigger a simultaneous collision in other systems at that same point (payload).
Yhat announces limited Beta program for centralized data science system, Bandit
Oh god, I remember this do vividly. Especially when Andrew joined, the dAmn thing and the hacking community, and then the Co founder drama and slow death.
> say, break SHA1 SSL certs

Maybe, and probably, but probably not within the scope of this attack. This attack relies on being able to have a large similar prefix and a lot of control over further internal data; SSL certs are somewhat more constrainted.
I find these utterly idiotic: you are telling patients about side effects of some drug with pretty pictures and a pleasant voice but only a doctor can prescribe them and you would assume understand the side effects and contraindications. What is the point? Other than obviously make drug companies more money.
As someone who knows only the very basics of cryptography - would verifying hashes of a file using SHA-1 and a "weak" hash function like MD5 provide any additional protection over just SHA-1? I.e. how much harder would be it be to create a collision in both SHA-1 and MD5 than in just SHA-1?

My common sense intuition is that it would be a lot harder, but I'm guessing theoretically/mathematically it's only a little bit harder given how easy collisions in MD5 are?
Serverless on AWS: Extract, Transform, Load (ETL)
Ah, sorry. I got confused by this section on shattered.it, which seemed to be saying that merely requiring a certain level of entropy in the resulting documents would be enough to mitigate the attack:

> Are TLS/SSL certificates at risk? [...] it is required that certificate authorities insert at least 20 bits of randomness inside the serial number field. If properly implemented this helps preventing a practical exploitation.

After giving it a bit more thought though, I realize now though that this mitigation actually works by preventing the attacker from fully controlling the hash of the first, non-malicious document.
We need to get from A to B. In between there'll be a time where this variability needs considerable conventional backup. We're living in that time.
What the article is talking about and what that bill seems to address are two separate issues. Whether you have high or low evidentiary standards for a new treatment is, under our current system and almost any system I've ever seen proposed, independent from whether doctors will end up completely correctly using those new systems. Doctors already have that responsibility and are already failing in that responsibility for a variety of complicated reasons, apparently, but it's easy to construct "solutions" that make it even worse. How do you out-expert the very people you've trained to be experts in the first place? That may not be unsolvable but it surely isn't a trivial problem to be fixed with some regulation here and some pamphlets there.

We've frequently discussed on HN the idea that sky-high evidentiary standards for new treatments may have passed the point where they are doing more harm than good. While I'm sure there are disagreeable details in the new bill, the broad strokes of the bill are things that the HN gestalt has at least been talking about for a while. It's not like it's a sudden out-of-the-blue idea that nobody's ever heard of before.
I missed one of my favorites: Office Space.

http://m.imdb.com/title/tt0151804/
6 Cool USB Flash Drives
Mobile web performance anti-patterns
calm down, it's not coming for your job yet. soon, though.
Do you know where most of SpaceX's funding comes from? Companies who make money by selling ads.

Besides listen to it from Musks own mouth, "Meaning is about the delta between impact and scale. Whether you help millions of people share a photo more easily or send one person to mars."
Yes 3mph is the pace for slightly rough trail. On flat/smooth ground it is slightly faster. Up at altitude & scrambling the pace will drop, but the CT doesn't have much of that. The CT is high altitude but overall fairly easy grade(the CDT has much more challenging sections).

8 hrs is nothing, once you have trail legs many thru hikers will basically walk the entire day. 3*15 = 45 miles per day give or take. In CO it will be slower generally as CO is not the easiest hiking, but still 18 miles/day is very chill pace.

The CT is also only 450 miles, so when they finished, they were just starting to get in shape really. On a longer trail is it generally considered that around 500 miles is where people start to observe really obvious improvements.
> I very much doubt that many of the people (broadly) deciding which products to support and which to drop were hired via a new-grad-like interview process.

I'm confused as to why you doubt that. Google's been around for almost 20 years. Their interviewing process has been around since at least 2003.[1] It's 100% possible that somebody was hired, ended up in higher management, and graduated to making driving decisions (at least over a particular area) in that time, unless your suggestion is that nobody who enters as a new grad ever stays long enough to get to that level, which at Google (vs other SV companies) seems unlikely.

[1] http://jeremy.zawodny.com/blog/archives/000616.html

> For things like moonshots/other bets, the "build something awesome but don't monetize it" makes a lot of sense, since the entire point of that division seems to be "build something awesome and see if it is sustainable too". More often than not, unfortunately, the answer is no.

It does make sense, it's more the messaging around those kinds of projects that tends to get lost. You end up in situations where thousands or sometimes millions of users are relying on a "beta" product, which has no monetization strategy, and then gets scrapped. It's a pattern that's still unpleasant for end users and not great for Google's reputation.

> If we presuppose that there is this dichotomy in people and it affect google's motives and goals as a company, then this would influence the tech hiring practices to be the way they are, not vice versa.

That's a great point, and likely, assuming of course that Google started this way (I think it likely did, given its founders' backgrounds). It creates a self-perpetuating cycle, though, which still ends up being problematic.
May I piggyback on this tangent ?

I really want a real-time heartrate monitor but have been convinced that the wristwatch heartrate monitors are quite inaccurate compared to the chest straps ...

But I also need a simple timer/chronograph. Do I need two devices or is there a chest strap HR monitor that has a simple timer/watch/chrono built into it ?
You mean like this? https://en.wikipedia.org/wiki/Pumped-storage_hydroelectricit...
Neither side supports the case of [promise chaining](https://capnproto.org/rpc.html), where one or more resources can be used to look up further resources in a single round trip. Each style has tradeoffs.
People who care about public awareness. Imagine we never talked about Heartbleed, but always said CVE-2014-0160, instead? That would do wonders to raise awareness about the issue of software security, I'm sure.
> "Don't forget Jeff Bezos's CIA connections"

There aren't "connections". Amazon is just building a private cloud for the CIA. There's nothing nefarious going on.
"It works in my computer."
to fill people in, "wixen"/"wichsen" is slang for masturbating. "Du wixxer" can also mean "You wanker" as in cussing at someone
That would offset a very, very tiny fraction of the cost of 56,940,000 CPU hours and 963,600 GPU hours.
Memory Error Detection Using GCC
Best i recall there was one company that claimed this, and they made one with a half-assed Suse install that were lacking drivers for various parts (webcam included).

Sadly they were also the company many retail chains turned to for rebranded netbooks.
"That didn't prevent the 2016 Philadelphia Marathon organizers from placing an unannounced mat at a turnaround point 22 miles into the race. It helped them catch hundreds of cheaters."

That sounds like a nice and easy way to weed out a lot of cheaters - every race has one or two randomly placed timing mats.
>... confounding the results that the studies should account for...

You're absolutely right that studies should make sure to control for potentially important variables. I don't know which studies you referring to. Not a topic I've looked at.

That said, criticising a second group of studies can't reasonably cast shade over the first group, if that was your implication.
It sounds exactly like someone in an abusive relationship.
Correct -- I was being terse: the commit is a function of the changes going in (and metadata like time, authorship).

Details: https://gist.github.com/masak/2415865
Number of people who were dismissive of my heavy hiking boots in the first 200 miles of the AT: too many to count (maybe dozens?).

Number of those people who went home with injured ankles: 2. Anecdotal, of course, but I certainly felt vindicated (and, of course, sad for those folks).

If you're in a super duper hurry, having your boots slow you down is maybe a slight drag. If you value foot health over speed, I, too, am a huge fan of heavy hiking boots.
The article discusses beta-blockers.

The overall picture of beta-blockers is complex. For example, some beta-blockers have been shown clearly to reduce the chance of a stroke or heart attack in patients with heart failure. But the latest review of beta-blockers from the Cochrane Collaboration—an independent, international group of researchers that attempts to synthesize the best available research—reported that they “are not recommended as first line treatment for hypertension as compared to placebo due to their modest effect on stroke and no significant reduction in mortality or coronary heart disease.”
The C++17 Lands
I can't speak for you the way you think you can speak for me, but I wouldn't be one of them.
Also known as pumped hydro?
Microsoft invests in real-time maps for drones, and someday, flying cars
An alternative headline would be "Most Published Studies Are Wrong"

Am I wrong for considering this not-quite-a-crisis? It has long been the case that initial studies on a topic fail to get reproduced. That's usually because if someone publishes an interesting result, other people do follow up studies with better controls. Sometimes those are to reproduce, sometimes the point is to test something that would follow from the original finding. But either way, people find out.

I mean, I guess the real problem is that lots of sloppy studies get published, and a lot of scientists are incentivized to write sloppy studies. But if you're actually a working scientist, you should understand that already and not take everything you see in a journal as actual truth, but as something maybe might be true.
This attack requires both to be, in some sense, "random looking". i.e. you can't generate a collision for an arbitrary first text.
I'm not sure you can teach people to be self-starters.
Linux Kernel 4.10 Released – Happy Anniversary
What a time to be alive! Me, I drink when I'm thirsty.
> all bitcoin did was create a massive market for sha1 asics

A massive market for SHA256(SHA256(value)) asics, actually; so no, they can hardly be used for anything other than bitcoin mining.
The Firefly system is one in which stars are orbiting stars are orbiting stars, and among these stars are many many planets and moons. Presumably the distances involved here can be traveled in a matter of days or weeks at some fraction of c. So, they're fairly close.

In contrast, Proxima Centauri orbits from a distance of about a quarter lightyear, and we've found a single planet orbiting very tightly. We've also found a single planet around Alpha Centauri B, also orbiting very closely. There may be more we haven't found, but probably not nearly as many as in the Firefly system. Firefly seems to use the idea that more stars mean more planets, but more stars and planets during formation means more chaos, more things to swallow up or rip apart planets, and more mass to throw them out of the system.

I don't think the Firefly system is necessarily impossible. You can even construct models such that the white star is at the focus of all other orbits (you know, if you're the Alliance and you need to do that for political reasons). (An Earth-centric model of our solar system needn't necessarily be wrong in terms of its ability to predict the position of bodies in the solar system - It's just needlessly difficult and convoluted.) I just think the Firefly system is highly improbable.
I would hope that they wouldn't, and hopefully I'm very wrong that they wouldn't want intelligent discourse instead of uniform agreement. That's why I'm very curious what interest there'd be in adoption of such a tool.
There is different math for each system.

In the USA:

if riskFromTreatment <= riskFromNoTreatment:
doTreatment

In most public systems:

if (treatmentCost <= someThresholdPerBenefit) && (riskFromTreatment <= riskFromNoTreatment):
doTreatment

In practice, treatment outcomes are pretty similar, but more treatments are preformed in the USA system. Being a for-profit system is one cause, but so is the litigation culture. Not doing every possible treatment and test can lead to the physician being accused of being negligent.
Are you taking into account the recent studies of the effectiveness of beta blockers, which the OP article discusses?

"the latest review of beta-blockers ... reported that they 'are not recommended as first line treatment for hypertension as compared to placebo due to their modest effect on stroke and no significant reduction in mortality or coronary heart disease.'"
This should not happen. Your shoes/boots are likely too short and/or laced improperly (it's not enough that your toes don't touch the end when stationary under load, you need a good cm or more room).

Also make sure to keep the nails trimmed!
Cheating is endemic in the sport and finding these people can quickly become it's own kind of game. So, IMO there is nothing odd with this effort. EX: http://www.nbcphiladelphia.com/news/local/Philadelphia-Marat...
Distributed Denial of Women Day
Maven is not a build script, it is a declarative build definition system.

It is not supposed to be Turing complete, for things that need that customization, as the GP stated, you use extensions.

For anyone who likes maven, checkout cargo in Rust. It got everything right, and made build extensions easier to integrate.
It doesn't take a million strong Internet mob to punish an individual behavior. This bandwagon/mob/piling-on instinct may have served us well in the wild west or in small villages of a few dozen to few hundred people, but is highly inappropriate in the digital realm where the "village" consists of billions of people worldwide.