skysight-inc/HackerNews huggingface dataset:
@jgrahamc how can you even answer that question when you didn't detect the issue yourselves?

The email we received was a joke, OK great our domains 'weren't affected' in the sense of memory dumps weren't being injected into our HTML, and luckily we only proxy static images/html through CF so at worst a visitor's google analytics cookie could have been leaked, but on a personal level any person who has used any CF-proxied website (e.g. Uber) in the past few months is potentially affected.

Whether or not you think it's likely anyone discovered this earlier, the fact remains that private data is still in various public and private caches around the world. It's a monumental cock-up that will require every CF proxy customer to rotate keys, invalidate tokens and force mass password resets to ensure complete peace of mind for millions of consumers who will probably never hear about this issue even though their credit card information, passwords and private messages could be floating around the internet as part of a cached version of a website they've never even visited.

Even the way you're looking for cached data to find affected customers - yeah ok, for page x.com/y you found data for customer z.com, but what about the other million times that affected x.com/y page was loaded, that could be data from a million different customers that someone else (human or otherwise) saw, whether they realised what it was or not. And trust me there are more than a few people on the planet who would know _exactly_ what they were seeing.

Forget about shareholder value for a minute, please, because it's an absolutely fatal mistake for your company to downplay an issue like this.
Recommended Reading List for Developers – Intel [pdf]
Apollo 11 launch, video of engines at 500 frames per second
You've been breaking the HN guidelines repeatedly by being personally abusive and uncivil in your comments. We ban accounts that do that, so please stop doing that. I'm sure you can make your points without stooping to that level, and HN will be better for it.

We detached this subthread from https://news.ycombinator.com/item?id=13721183 and marked it off-topic.
I have never used Bigscreen (just had access to a Rift for a couple weeks) but I'm not surprised by this investment. When I played around with it, despite the several gaming options available, the most compelling experience I had in VR was just a pretty mundane casino game where I played poker. That above all else sold me on the potential of VR. As long as people think about VR just as immersive gaming, the potential is going to be limited. But what the casino VR experience taught me was that even something completely mundane like playing a game of cards could be far more immersive and more entertaining in a VR setting; if I had 5 friends over at home with me, I would've much rather plugged in with them into this beautiful virtual casino then dealt with shuffling cards at home in real life. Can't wait to be able to get the hands on my own VR device to see everything that Bigscreen has to offer!
The headline really undersells the story.

The New York Times has internal Uber documents, confirmed by multiple Uber employees, showing that Uber lied to the public and to regulators by falsely claiming that a self-driving Volvo running a red light on the first day of its operation in San Francisco was caused by human error.
My problem with Google products is that (it seems) every single product released is designed to collect data in a different manner. It almost as if they only release products so they can collect new data. And you can tell exactly how badly they want your information by just how attractive they make the product offering. Gmail for example.
Kholat Download for Free on PC Full Version Game
Yeah, there are definitely too many FBA sellers who are 100% reliant on the Amazon audience for sales. No online store (Shopify etc.), no marketing, no email list etc. It's hard hearing those cases where seller accounts get turned off for some reason and the seller has to fight to get them item back online.

As for some being "scammy" - yeah sure, there's definitely a bit of people looking to make a quick buck on whatever they can at FBA. Every market has that. But the people I've seen have the most success on FBA do just what you mentioned

- listen to the customer via reviews
- improve value via product fixes, bundling, packaging, etc.
- provide good feedback & service

That said - I don't know how anyone selling commodity, off-brand stuff does it. I could see that being a huge race to the bottom as stated. The only people I know doing FBA stuff are going the private label route to avoid competing solely on price.

My brother actually makes a full-time living off of FBA now via private label goods. He really enjoys being his own boss and providing a BETTER product than what was available before.

I sold my first FBA product, not a huge success, but validated the business model is real if you work at it. FYI - I've started compiling info for small-scale eCommerce sellers at http://www.privatelabelweekly.com for any sellers interested.
There is a hint of truth to the concerns you're articulating, but it shouldn't be enough to dissuade you (or anyone else) from doing this.

The argument that people will always pay for the cheapest reasonable alternative would suggest that grocery stores would only sell the cheapest, generic brands. People will pay for quality and social proof, perceived or otherwise. Two identical products but one with (say) 500 genuinely earned reviews over time will always feel like a safer bet.

My expectation isn't that Amazon FBA will be my career for life. I expect it will be a viable income stream for a few years while I reinvest this time (and some of the earnings) into more stable industries (I have so much time to play with VR now) and develop an SaaS (including one in the Amazon space, go figure).
Do you have any recommended links for those recent studies?
I feel your procurement pain.

For a brief moment, I had a mobile test automation gig. I found a device specific bug, and we only had one unit of that device. The device was inexpensive and easy to procure. But I had to make the case about why I needed to procure another device for fault isolation purposes, and doing so was not a trivial process. It kind of felt like a someone in accounts payable having to explain the need to buy more checks.

I left soon after that.
Yeah, abusing the DMCA because it's the only tool you can think of, that's a great idea.
Huh interesting. Thanks for the datapoint. Fwiw, nicotine has never been problematic for me. I dated a girl who smoked for 3 years, and she'd smoke around me all the time- and while i indulged in it every once in a while, i never felt like i HAD to smoke. Biological things at play, most certainly.
Not your typical news, this video is 47 years old. But to witness for the first time such an amazing achievement in human history, at such an intimate level of detail... it certainly feels new.
Online-go – Source code for the Online-Go.com web interface
But you said "You can refuse". His case proves that's not true.

And his case wasn't dropped. He plead guilty.
I'll just use their own logic they use against us when we ask them to take down the DDoS attack-for-hire sites they host while they are attacking our servers:

Why does Cloudflare think Google needs to do anything here? It's not illegal. Google shouldn't do anything unless they receive a court order to do so! Why does everyone expect Google to do enforcement here? Google has the right to post this information, it's not illegal to do so, therefore they shouldn't do anything at all about this. Don't you care about freedom of speech? If Google removes this, it creates a slippery slope that will lead to the entire internet being censored.
This hypothetical company wants to drop packets from lower tier customers first, when congested, and oversubscribe their fiber to reduce costs.
I haven't seen an attempt by Cloudflare at claiming that this definitely didn't happen. They may still be working on it. It's possible that the question is basically unanswerable even with logs.

As you say, in the presence of uncertainty it's most prudent to assume that this actually happened.
This incident affects Full SSL sites too.
ISPs need to be prohibited from preferring HTTP and TCP over other protocols

If anything, it would be the reverse.. HTTP and TCP (which doesn't care if its packets arrive out of order) getting deprioritized in the face of streaming content (which does). That kind of blows your restriction away. QoS under heavy load is the difference between everybody getting to use their apps and one or two people getting to use their apps.

Thing is, there's no successful ISP in the world that has enough capacity to service maximum bandwidth from all of their customers at the same time. There's always going to be a fudge factor worked in, and QoS to help out when that goes wrong.
Looks like a slick way of preserving cultural artifacts that would have otherwise been discarded.
Show HN: SHA1 PDF collision generator
Also still in Yahoo.

https://search.yahoo.com/search;_ylc=X3oDMTFiN25laTRvBF9TAzI...

http://208.71.46.190/search/srpcache?p=2001%3A56a%3Af651%3A6...
The comment from eastdakota seems to be political in nature; some on here have suggested he has an axe to grind with Google.

Why do humans politicize so much? That's one thing I'll never understand, and one of the reasons why I refuse to become a manager.
Just shows that every financial decision regardless of political system is driven by incentives.
Agree that it's a shame that it doesn't really feel like they're owning up to how bad it was.

But I wonder if it will just mostly go away. Luckily for cloudflare this is a pretty random sampling of people around the country and world. Unless someone has put together a big data set from the caches and decides to leak it or inform the victims, it seems like most people whose accounts do get taken over from this will have no way to trace it back to this bug.
It's heavily used now. Works very well.
Kansas has the death penalty, so maybe he will be getting out of our country.
Shameless plug: I built my own version of this to collide arbitrary PDFs: https://github.com/nneonneo/sha1collider

My version is similar to this, but removes the 64kb JPEG limit and allows for colliding multi-page PDFs.
>Tavis found it by accident just looking through Google search results.

Curious whether there could be some automated way of preventing such a widespread cache poisoning in the future. Some ML trained on valid pages from a given domain?

Is it even possible to recover the original content of the documents or was the data randomly inserted into different parts?
Strongly agreed - Google's Project Zero helped them immensely and without them it would have continued to grow worse.

The length of time this went for was already disastrous. From the Cloudflare blog post, "The earliest date memory could have leaked is 2016-09-22".

As an example of how destructive it might have been beyond leaked information, note that Internet Archive have spent considerable time archiving the election and its aftermath.

donaldjtrump.com is served via Cloudflare.

Chances are it wasn't a domain that was leaking information - though we don't know as there's no publicly accessible list and no way to tell if they had the buffer overrun features active.

If it was however the Internet Archive now have a horrible choice on their hands - wipe data from a domain that will be of historical interest for posterity or try to sanitize the data by removing leaked Cloudflare PII details.

History will already look back at the early digital age with despair - most content will be lost or locked in arcane digital formats. Imagine having to explain that historical context was made worse as humanity deleted it after accidentally mixing PII into random web pages on the internet -_-
Pytorch Implementation of Hierarchical Attention Networks for Classification
This is actually a great example of how modern day propaganda works. One tactic to discredit someone is to combine two true statements by them that look similar to create a false statement. Case in point:

Claim 1: Trump says he was against the war before it started. In the Cavuto interview he's questioning the war, and he says he used to argue with Sean Hannity about it. Sean Hannity backed this up. There's no reason to doubt this.

Claim 2: Trump says he's different from his opponents because he came out strongly against the war before anyone else did. That's a fact and there's plenty of evidence.

Then comes the spin. The media will mix the two statements together to say Trump said he came out strongly against the war before it started. They'll use this to call him a liar. Try to find me one example of him saying he came out strongly against the war before it started. You can't, because he never did.

This is why people don't trust the media.
1) I'm impressed by your technique, and I intend to copy it.

2) The numbers in that autoresponder caused my jaw to hit the floor. I thought I was well compensated but apparently there is a lot of room for me to grow!
You've described Emacs, which is a huge library of frontends to common Unix utilities. Dired, for example, just parses `ls` output.
More like tRagic based on the comments here.
Only if it's interesting enough to read. Usually the comments are more interesting.

If someone summarizes or does a TL;DR, I'm even less likely to read it.
lol, really? Google authenticator is just TOTP - it's an open standard. That seems childish.

Also, the notion that the CEO of an internet company would have a "beef with Google" is pretty funny.
Don't get me wrong - amazon returns are incredibly well done!

I'm just saying that even then, a return is still enough work that investing 15 minutes in reviews pays off, once you consider all the othet factors as well.

Good luck! Sounds very complex indeed.
Depending on how in depth the papers are, and what your definition of "read" is, this might not be easy.
A Functional Programmer’s Introduction to JavaScript (Composing Software)
Midland county. Here's a similar document for an area near me; the city doesn't seem to have a fee schedule online anywhere.

http://www.lincoln-twp.org/forms%20policies/New%20Water%20Co...

$2,520 is what they charge for water; not sure what it is for wastewater - they may not have a public sewer system - but it's about $3,500 where I live. It used to be $150 (seriously, not a typo) and people got really upset when they raised it by a few thousand dollars all at once a few years ago.

I guess it's not a very densely-populated area and the state is surrounded by water so that might explain why it's so cheap.
HIPAA and Cloudbleed
We've banned this account for posting unsubstantive comments and ignoring repeated requests to stop.

If you don't want it to be banned, you're welcome to email hn@ycombinator.com and promise to follow the rules in the future.
I agree that nuking entire domains would be bad for the Internet Archive. But I don't think it would be overwhelmingly difficult, nor controversial, to identify and remove the vast majority of "contaminated" documents. This applies to the Internet Archive as well as major search engines.

First, we're talking about raw memory pages, not merely malformed HTML. Those memory pages might contain valid HTML, but most of the sensitive information is in the headers, not HTML markup. It won't be very difficult to write a script to identify documents where random headers and POST data have been inserted where they don't belong, or where the markup is so obviously invalid (even compared to similar documents from the same site) that there is a high probability of contamination. Having a full list of contaminated domains would obviously help a lot, because we'll only have to deal with thousands of domains instead of millions.

Second, contaminated documents by definition contain information that is NOT what the publisher intended to be crawled, indexed, or archived. So there should be less resistance to removing them.

Finally, most of the contaminated domains used features such as Scrape Shield that were intended to deter archival. It's as if the domain had a robots.txt that said "User-agent:* Disallow:/". I'm not sure whether it's even possible for the Internet Archive to archive such domains. If they can, maybe they've been doing it against the publisher's wishes. If they can't, well, there's no problem to begin with.
I lost all respect for Cloudflare
I'm at a loss for words. First spiders that can strategize [http://thescienceexplorer.com/nature/jumping-spiders-smarter...]. Now bees that can tech tool use.
If the only headers are at the end, then yes, that's a really neat idea. I'm not sure of the constraints for zip files. Maybe it would be interesting to brainstorm with some people with a lot of file format knowledge to find additional such formats. But if the formats have any constraints at all on the first few hundred bytes, those generally won't be satisfied by the prefix here.
Why Become a Product Manager
What has Jil Stein to do with that story?
Which is precisely why you should not use an MITM network.
https://www.youtube.com/watch?v=uPtZAakAXns

Complaining about leftists reveals someone's brain damage. Sow now you stand by it, riiight?
I think you are mistaken it says created: 43 days ago
the two PDFs used the same (colliding) prefix and included both files you supplied. once you've reached a hash collision, any number of identical blocks after that would hash the same.

if you want a proof, submit a different image: the hashes will be identical, but different from your first attempt.
Simulating LIDAR Driving with Rust and OpenAI
something close is "greens"
Honestly, this isn't nearly as abrasive as some things Linus has said and it has some cogent generalized engineering advice mixed in. Certainly not the worst thing he's said. Also, he was correct at the time and left open the possibility of something changing in the future.
Nice, you're able to line it up so the colliding data starts right at the beginning of one of the torrent blocks.
> Giving up on their citizenship and applying for a new one is no easy decision.

The decision is very easy. Obtaining the citizenship, on the other hand, is not easy.
Japan takes step toward enormous bank of personal data
I'll try it. I expect that would be an actionable case of false advertising.
This is using that same $100K.
>A beautifully written language with an incredible community.

This is what has always killed me about Ruby. Such a wonderful language, community, and tooling held back by a painfully slow and inefficient runtime.
It looks like once you entered an invalid project name, the form doesn't accept a valid name. I fixed the issue and updated the app, thanks for reporting the bug. Nice humor BTW! :)
I actually described the issue in question on HN in the past which promptly led to Uber threatening the employee who leaked the details to me. He was so scared that he asked me to reach out to YC and have the original post deleted.

I wouldn't hesitate to share the evidence with a journalist with a publication backing them though as that would be a more appropriate venue.
It's like coding, when you fully understand OOP, you can easily switch languages. Same goes for story telling. You need to learn the structure once, then practice with different stories. People never take time to work on the foundation... they jump straight to the story. Great story tellers are people who use the same approach over and over. They ultimately get better at it. They re-apply the same patterns for new stories. Each individual has its own style. I'd suggest you to work on your own structure. How do you approach a story? Do you start with a punch line that tells people you're about to tell a story? Do you hypnotize people until they realize you're in the middle of a long story and they've been listening for hours? There are different ways of telling a story and you should start by asking yourself, what did I do yesterday? Try to come up with an answer if someone asks you the question. Write the structure down on paper and iterate until you come up with great sentences. Do that during your commute to work. Get ready just in case... How do you tell a great story? You need to highlight the emotions. Did you do something cool yesterday? What was cook about it? Why was it cool? What was your reaction? That's what people want, they're looking for emotional things (things that makes them react). Usually great story tellers make me feel like I was the subject in the story.

I mean... There are a lot of things you can do...
I'm one of the engineers who work on the data service

> about metadata: in Postgrest ..

We don't want to restrict the data service to a particular schema. You can add a table from any schema to be tracked, say information_schema or pg_catalog. In fact, that is how introspection works (you can look at the queries made by the console). This means that the schema cache in memory would be quite large because of the number of tables in information_schema/pg_catalog if we were to auto load all these. There is also the issue that you may not want to expose some tables. We can definitely have a console button which will let you import all the tables in public schema.

Sure, you can infer relationships from the foreign key constraints. But, how would you come up with names that do not conflict with the existing columns? What if you add a new column with the same name as an inferred relationship? With the data service, you can also define relationships on/to views across schemas (1). Making metadata explicit goes with one of our core principles, 'no magic'.

> what postgrest does for protection: a - no fancy joins,

explicit joins are not allowed even with our data service. The joins that happen are the implicit ones because of the relationships. We do the same thing if we need any custom joins/aggregations. Define a view and expose it.

> b -
you can't do anything other than selecting columns and relationships with the api.

> c -
the permission layer can be used to prevent these to some extent (like not allowing an anonymous user to filter on a particular column).

1. https://hasura.io/_docs/platform/0.6/getting-started/5-data-...
I am a Data Scientist without any tools except a single installation of MATLAB 2010a on a computer that my organization doesn't even own, on a network we don't even control. I have a few hundred TB of stuff I need to make sense of. I just can't do it with the tools available.
You don't need to have such JPGs. You just crop/resize them in Gimp or Paint.
How about PE format? You can basically write after the ImageBase+ImageLength and have no functional difference.
Come to think of it, our society grants search engines the privilege of keeping copies of copyrighted material in exchange for the services they provide.

It might not be unreasonable to say that this privilege comes with a certain responsibility to ensure that those copies do not cause excessive harm to others.

So although Cloudflare is the one that fucked up, Google et al. also have a responsibility to do whatever they can to protect the public. They should do what they can, with or without Cloudflare's cooperation.
I don't think that is even the issue. It is essential for him and his followers to brand media as the enemy. As long as they are angry and against him it works for him, ie his followers see any negative repirting as hit jobs by spoiled liberal journos. They don't realize that they are helping him with all the outraging.
With something this drastic, 7 days was generous.