skysight-inc/HackerNews huggingface dataset:
I definitely understand the embargo, but this is one of those situations where the vuln was already fixed and it's likely very few malicious actors (possibly 0, but of course who knows) were aware of its existence.

I feel like adding even just another day or two would've allowed them to purge more of these search results. I think that would greatly outweigh the increased risk of letting it remain undisclosed for slightly longer.
I entirely see your point and think you're correct in your analysis.

Personally, I would like to give the other involved party a reasonable chance to try to respond with ether a refutation or with intended next steps before grabbing a pitchfork.

To be clear, I have no sympathy for Uber and have something like an 85% expectation that the current accusations as accurate. I do find value in erring on the side of giving all parties a full say and a full chance to institute some sort of remediation, if possible, before final judgment.

For example, many media outlets have picked up this story, and one such outlet came across today (wish I had saved the link) also mentioned alleged threats of physical violence from managers to employees. In my workplace, I've heard a manager joke "now that you've seen this, I'll have to kill you", which was clearly a joke but which could be portrayed as a death threat by a (perhaps rightfully) disgruntled employee.

When there are personal situations and emotional hurt involved, things can get skewed further than they need to be, even if the objective reality is already one to warrant raising an alarm.

Point taken, however, in its entirety. I could have communicated my perspective much better.
Sure, it's pretty, and if you want an completely un-upgradeable appliance, it's probably wonderful.

The point is, most professionals upgrade the same computer multiple times over it's life, particularly for fast-moving components (the GPU, in this case).

Making them basically completely impossible to upgrade significantly reduces the long-term value of the mac pro.
Porsche for instance isn't earning any money with their LMP1 race cars. They need them to sustain the illusion that they're a sports car company, despite the majority of their sales being SUVs (Cayenne, Macan) and sedans (Panamera).
Which is largely irrelevant on desktops. Nobody's using git on embedded devices, so hash computational cost shouldn't be the deciding factor. Maybe people storing BLOBs will notice.
Got a non-paywalled link for this story?
Humans did not evolve needing these stimulants. I think coffee is a habit far more than a necessity.
Application security team? Probably needs work.

But their overall response to this was still good, and very quick given the scale of the issue.
Isn't it worse than that? Even if you are not a CF user, if your apps make calls to a third party site protected by CF, you could be at risk (stolen credentials, API keys), and could be attacked using those now.
Yeah. I'm changing all the passwords I can get my employer to go for and upgrading auth infrastructure for the rest.
They have "for Teams/Families" options now that appear to use a proprietary, server-side sync, instead of the safer guarantees of the traditional client.
archive.is was red, meaning it uses Cloudflare....

www.doesitusecloudflare.com
While I would never say the Facebook staff are intellectual authority figures, I think that "a small group of people doesn't get to say what is true" is just plain false. A small group of people tell the rest of us what's true all the time. They're called domain experts.

>You should have the ability to curate your own feed even if by managing your friends, but the buck stops there.

The feed is generated by an algorithm designed to maximize the chance I click links from my feed. It has never been a rote concatenation of my Facebook friends' walls/timelines/whatever-they're-called-today.

That kind of concatenation and interleaving of content from my friends would be an improvement. It's just not what we ever had at any point. Facebook has not suddenly acquired a bias or agenda. It's been filter-bubbling everyone since forever, and now people have objected that some of what it feeds them in their own personal bubble is bullshit.
Not combining, that's why I said or.

And I said that because I'm not sure why they've made that decision...it could have been either or both. And sale of DDoS service is arguably illegal in at least some places, so they obviously aren't rejecting all illegal content.
Yes, with oom_score_adj[0], which I've mentioned several times. Setting it to -1000 for a process protects it from OOM killing.

0. http://man7.org/linux/man-pages/man5/proc.5.html
It still seems like a gross mismatch of power though. Correct me if I'm wrong but Ragel only can output parsers for regular languages, yes? You can't call their Ragel code an HTML parser because Ragel can't output a parser powerful enough to parse HTML.
You too can create an off world colony.
Ah, I misunderstood. Then, to provide a citation which is related without being analogous: the Duke lacrosse case. See: https://en.wikipedia.org/wiki/Duke_lacrosse_case
Isn't SFO a good fare? It's a long drive from the South Bay, and the driver is certain to find another passenger quickly after dropping you off.

Maybe I don't understand what makes a good fare.
That's exactly what reasonable people would do. But people are afraid of a bait-and-switch where they activate segwit and then larger blocks are never delivered. Semi-reasonable people are asking for a bundle that includes segwit and larger blocks but no one is offering that yet.
Sorry for my ignorance, but isn't SHA-1 in git supposed to protect only against data corruption and not against someone maliciously replacing the entire repo?
I'd guess it's because the external chassis is really expensive, and it's silly.

All the busses are there, inside the device, but nope, you have to drop several hundreds of dollars (or more) on a box that squirts them over a expensive wire because marketing and design said so.
A better counterargument to his argument would be: hashes are not "my plane", potential adversaries are not "a meteorite".

Using analogies is okay when you try to explain a difficult idea to somebody who wants to learn about your subject. Using analogies is not okay when you want to make a solid argument, when you want to convince somebody whose stance is very different from yours.
And those NVMe devices don't necessarily get dedicated access, they can definitely be over provisioned for access to PCIe
I think the bar for criticizing an existing portfolio company should be far higher than the bar for declining to make an investment (and potentially telling the company why you're declining...not often done, but if it's due to a moral reason, probably worth it.)

Criminal activity is clearly a line which can't be crossed even for existing portfolio, but I don't think an investor is the one in a position to deal with that -- it's more for regulators.

Exiting the investment is probably the course I'd take before publicly calling out a portfolio company, for "non-criminal but terminally bad-for-brand" reasons.

Internal corporate governance (board/shareholder actions) would be before that, and extreme internal pressure before that. I'm absolutely not calling for investors to just let stupid stuff pass; I just don't blame investors for not taking action when not required, and I think there's a defined escalation path which doesn't include an open letter to a portfolio company which isn't public.
You reminded me of Nepter on Adventure Time.
Looks like macrumors is covering this as well:

https://www.macrumors.com/2017/02/23/apple-ends-relationship...
Exactly what I was wondering after reading the article... Something seems to be wrong or incomplete.
Cloudflare handles SSL for a lot of sites. It decrypts everything and passes it along.

For certain other sites, with malformed html, there is a bug that caused it to grab random data (headers and body) from memory and include it in the body of the response HTML. (Some html rewriting product that cloudflare offered was broken and it ran on the same servers.)

This stuff got sent to peoples browsers and also to web indexers like Google or Bing.

Google lets you search for stuff and will also show you the original page that it scraped, making it easy to find this data.

Edit: Also you may be seeing more headers in examples because headers are easier to search for.
They're still an expensive and relatively difficult asset to replace. It's not like they're disposable front-line infantry. Assassins presumably have a fair amount of training. If you lose the assassin that's another expense you have to cover. Not to mention the indoctrination required to have someone perform this overseas and come back again.
Hearn is right. The wider world simply doesn't know how dysfunctional Bitcoin is, mostly because of the censorship taking place on the main communication channels. You will literally be banned from /r/bitcoin if you post a comment notifying other users that comments are being deleted.

The blacklist article is pure FUD, seemingly written with the sole intent of smearing Hearn.
It sounds good but apple makes it a pain, to use an eGPU effectively you need to use windows via bootcamp
Debugging a stopped Elixir Supervisor
It only addresses half the problem, but Ruby's own man page has a bolded warning:

http://ruby-doc.org/stdlib-2.4.0/libdoc/openssl/rdoc/OpenSSL...

Always create a secure random IV for every encryption of your Cipher
I was one of the first people to join /r/bitcoin, and was banned years later, after the block size debate started, for being on the large block side.
It's pretty stupid to get paranoid over this. As GP pointed out if you logged out then it's very unlikely that they will get access.
That's not entirely true. You could fork a popular git repo, and then make some kind of patch for a bug in some seldomly changed file. Then force a collision in the new file with the benign change as well as your poisoned version. Then they could convince you to pull in the changes. Then they could reset their repository to the one with the poisoned version and anyone who pulls from them first would get the poisoned version of the file instead of the right one. It seems extremely unlikely that a practical attack would come out of this though.
That's not how pensions work. Seriously, the postal union was very against the law requiring this.
It seems kind of pointless to engage in crime if you can never spend the profits.
It's true, you could add an external ThunderBolt chassis, but when the trash can Mac Pro first came out I recall that not many companies were making the chassis and they were pretty expensive maybe around $1000 from Sonnettech.com (which was added to the already very expensive Mac Pro). The expansion chassis prices have dropped now. But the expansion chassis won't allow you to add a second CPU which is very helpful when compressing video.
A big part of that incoherence comes the fact that a lot of their guidelines are too broad. For instance, one requirement says all activity performed by an admin must be logged. How many financial companies do this today on every server/device in their PCI environments? My guess is nearly zero, because it's very difficult to find someone who knows what is needed and how to do it correctly, but very easy to avoid even being discovered as being out of compliance.

Then there's the whole lone-auditor thing where a very large data-center or three are being audited by a single person over the course of two weeks, or less. That person is absolutely bombarded with information about an environment that is foreign to them. The end result I think is that so far companies have had it very easy to get by. They only have to pay for a week, or two at most, and whatever limited findings they get are fixed and they move on to the next year.

If companies actually had to live with a slower and more methodical audit, there would be many more findings and a lot more money spent, both on the auditing process and the resulting cleanup. The upshot is this would drive actual innovation in the space of having proper logging, file integrity, encryption, access controls, etc.

The whole audit industry is just.. icky. It needs a massive overhaul and the financials need to be forced to pay for it.
Microsoft has like 100,000+ employees, so it's possible that a non-negligible fraction of all tech employees have worked at MSFT at some point.
And ports of entry are defined as borders, so all the international airports count too: http://imgur.com/a/DqDeQ

It's my quick & dirty edit of their image.
> The idea of voter ID is effective because of what you just said it sounds so reasonable..

This goes for more than just voter ID. Politicians will say things that "sound reasonable" or "are common sense" on the surface, but the motives and fact once you get into the details tell a much different story.
Painful to read all the 'this isn't an issue because of bad reason X, Y, Z'.

Git can implement checking for easily collided data and warn the user, potentially even look to implement the safer hash countermeasures too. The fact that this isn't a second preimage, or that SHA1 isn't used to auth a repo doesn't really factor in to it.
Show HN: Scip – Location Arbitrage for Uber and Lyft
I personally favor them being overzealous than too lax.

I'm pretty confident Coinbase will still be here in 10 years with no major breach. And I'm also fairly confident that even if there were a major breach, I wouldn't personally lose any Bitcoins or money.
I think a lot of people are arguing for accountability. Society tends to source important roles to government because it is 'for and by the people', there's direct relation and accountability there. To me, private prisons are like Linux depending on 3rd party modules for something as important and ubiquitous as ext3 support.

I'm all for cutting the needless cruft off of government and keeping the kernel from getting bloated, so to speak, but prisons and other major roles of society where accountability and direct communication with the people is of utmost importance, this is something that should reside within government. Like the Linux kernel, I think all important functions should stay within direct reach and have direct interoperability.

At the cost of resorting to slippery slope and being light-hearted here, what's next, a McDonald's-sponsored drive-thru DMV? On second thought, DMV could learn a few things from McDonald's there but I'd be very leery of McDonald's handling my important tasks and the direct power of the people would get watered down with every government function relegated to corporations.
Look here: https://en.wikipedia.org/wiki/Long-term_memory#Encoding_of_i...
Same here, it is unfortunate that we have to be worried about appearing on lists just for having a curious mind.
Why Stripe payment gateway is a good option
iPhone 7 Price, review, specifications full guide 2017
Samsung Galaxy S7 Price, Review, and Specifications
Not with the block size limit serving the market for payments to the first competing cryptocurrency (like Ethereum) that develops a decent wallet and gets critical traction.

If there's a shift, it can quickly turn into a flood, since much of the value of bitcoin is based on speculation, rather than more robust demand from use as a payment vehicle.
It is worth mentioning that a powder form of nerve agents was also created during the time that these things were the fad.
Mirzayanov covered the functionality of these binary powder based chems with 5-7x efficacy over VX. It would be highly unlikely for NK have functional quantities of these though.

Edit: Also it would be possible to use a non-military Acetylcholinesterase inhibitor for this attack.
It reminds me of the Stauffenberg plot. And then there are the bodyguards who got Indira Gandhi --they did not care what happened to them, they "cared" about carrying out their mission. Although, it's quite possible both were equally motivated but one was just not lucky enough to carry things through.
Why does the website seem to be a cheap ad whose only purpose is to get you to install the app, which could presumably do anything it wants with your data?
DNG Image Support and Images Export in Multi-Threaded Environment inside Java Apps
Are you dead? If you got a knife and cut out that section of skin/muscle fairly quickly is it too late?

But it's terrifying. Also that video of the CIA people testifying about the heart attack drug. I find the 'we dont know' if it was natural vs assassination scarier as nefarious people are more able and probably willing to use it. When you see all the type of things the CIA was up to 50/60/70's there must be some crazy stuff we'll never know about.
Myself and 4 other people I know all happened to get their reddit accounts temporarily locked due to a "possible compromise" in the past week or so, which has never happened to any of us before. Anyone else?
Emotionally insecure, sure, but extremely dangerous, obviously.
Ok so I have been downwoted for "not understanding" that he just can't pull his investment.
Of course I understand that. But if you are a billionaire then you can do what you want. Put pressure on the board and threaten with lawsuits or something, in effect "pulling" your investment and support.

I mean nowhere in mitch's post do I see any concrete action he is going to take.
Typical, not ready to do anything that could maybe cost him.
The moderators of /r/bitcoin owe you nothing. If you don't like their moderation policy, go somewhere else. No-one is forcing you to read them, and you can't force yourself to be read by the people who go there if the people there don't want to read what you have to say.

Hearn tried to fork bitcoin, and learned the hard way that the people who use bitcoin didn't like his direction. He then had a whiny rage-quit, and has been throwing rocks from over the fence ever since.
Another day, another C memory safety bug that completely breaks all security everywhere.

We're definitely doomed to repeat the same mistakes over and over.
What are their "SJW credentials"?
It's not finite but inflation is paid out to ETH holders in proportion to the amount of ETH they stake for validation, so on the balance, ETH holdings experience no dilution. Rather, there is constant (and gradual, at a rate of about 1-2% per year) transference of ETH value from inactive holders, who don't stake their ETH, to active holders, who do.

So I think ETH can be both digital oil (or digital solar, if you want to be PC) and digital gold.
And the world moved on, I'm sure.
As a experimental researcher for the last 16 years, I don't find this surprising. Publishing industry has becoming a scam. Wherein journals like Nature or its sister journals are charging $1000s to be open access. They don't care whether it is reproducible....
>which makes the theft or misappropriation of a trade secret a federal crime.

https://en.wikipedia.org/wiki/Trade_secret
As I said, "unless they do something about this that he can agree with (like fire the CEO".

There are no calls for action in his sad whiny blog post.
Do you think travis is in any way affected by some polite words in a blog?
Prison and putting people in jail for minor things has become huge industry. It might be time to add some competition and let prisoners chose prisons they want to go to and the prisons must be incentivized if the prisoner finds gainful employment and does not turn repeat offender after release.

I can totally see private prisons doing a better job of identifying normal people incarcerated incorrectly and offer them a better life than getting raped in a gruesome prison.
So this is how the uprising happens.

First they came for the factory workers. Then they came for the accountants. Then they came for the drivers...

Then they came for me.
There's always gerrymandering as a concept: If you build everything by algorithm, you are making the problem far smaller, but ultimately the decision of which algorithm to use is never going to be as good as proportional representation. Whether one only looks at population density and geography, or one adds ethnicities or party affiliations, there is no such thing as an objective algorithm that will not lead to biased results. The results will be more fair under any definition than the gerrymandering in, say, North Carolina, but they are still not going to be wonderful.

Given how the US political landscape is, it's not difficult to build a generic system that produces results that will favor the same party in all states. Compactness will, in general, be closer to favoring Republicans, while something that aimed for even population density in each district would favor democrats.

If I had to choose between any algorithm and what we have now, I'd pick the algorithm, but it's still going to be a worse output than someone actively redistricting aiming for maximally competitive elections or a proportional system.
But he doesn't say that they won't implement checks for collided data and warn the user (not in this post anyway).

He does say that the sky isn't falling, and there are some steps they can take to mitigate it.

Edit: or do you mean all the posts here in the comments?
You should consider detaching comments that divert a thread to discussing competition when it is entirely irrelevant to the topic at hand. Is is a well known and commonly practiced discussion hijacking technique that does nothing more than decrease the value of a discussion forum.
You're deflecting with a change of subject. This is the kind of attitude that is typical of the pro-censorship crowd.
Worse, it happened with that page itself. It took 10 seconds before it loaded any content beyond the header and base template.
How Design Pickle Bootstrapped Its Way to $2M Revenue
Sorry if you take it that way but it's a blatant lie. And these need to be called out strongly. This is nothing personal against the OP, it's against the people supporting this.

We can't continue having people using alternate irrelevant facts as an excuse for their bandwagon.

The workings within a company are totally separate from its mission. We all know this, yet people are blatantly supporting lies like this on this anti-Uber bandwagon. Why? Because it works is why, alternate facts convince people and it needs to stop.

We so far have one specific source of issues within the internal workings of Uber. There seems like there might be more to this but so far no one has come forward publicly.

This is currently a witch hunt by the general public and the normalisation of this behaviour is troubling.

And now people are extending the witch hunt to Uber's mission on the basis of...... I don't see how this is acceptable.
I wish Apple management folks read the sentiment here. Because, I believe if not for Apple, the industry wouldn't have progressed this far, at least in the build quality department (We had Sony, Dell and IBMs pro laptops but they never had the combination of price/build quality/looks nailed).
I've never been in a situation anything like Cruise, but I've been a founder in an acquisition that went to legal over absent cofounders --- actually, come to think of it, twice, once with me the absent cofounder and once not --- and: I can't imagine any of these cases ever not settling.

Even with no tenable claim at all, the absent cofounder has a gun to your head: a proposed liquidation that pends on a civil suit simply isn't going to close. There are time limits on all of this stuff, and the acquirer is simply going to say "fuck it" and walk if they can't predict when the deal will close. A detail I think people who've never sold a company don't realize is that the legal costs for both sides of a deal that closes uneventfully can get close to 7 figures.

I guess this is valuable information for startup founders. It's also a reason you should run, not walk, from any early-stage business partner that wants to negotiate or complexify vesting. 1 year cliff, 4+ year vest, the way everyone does it, or go start a different company.
Related - OnHub & Google Wifi devices reset due to Google Accounts bug: https://productforums.google.com/forum/m/#!topic/googlewifi/...