skysight-inc/HackerNews huggingface dataset:
"States rights" is widely viewed as a racist dog-whistle [1]. States rights doesn't have to be racist, although it is very often linked that way [2].

The war on drugs was instituted as a racist policy [3]. It's quite likely that the main motivation here is using drug laws to punish people of color.

[1] http://www.slate.com/articles/news_and_politics/history_less...

[2] https://www.theatlantic.com/magazine/archive/2001/03/getting...

[3] http://www.cnn.com/2016/03/23/politics/john-ehrlichman-richa...
Every piece of dependency in your stack is a vulnerability vector. I feel like this is the only sane assumption to make these days. Yesterday I was thinking of doing some stuff with cloudflare and today I'm reading this report.

The modern web requires a paranoid attitude.
Disagree. The point is that when people see that lock that tells you your connection is secure, when it's actually not, that causes more damage than if your connection was actually not secure (because then presumably you wouldn't be typing in credit card numbers and other sensitive info if you saw http:// in your address bar).
I know what Cloudflare is but i don't quite understand the underlying issue.

Can someone explain in simpler terms what happened here and how it a) affects sites using Cloudflare and b) Users accessing sites with Cloudflare?
It also seems like the least interesting thing to steal. The hard part is probably the software and access to real world driving data. It is like holding up a bank and walking out with just the coins. The risk reward profile is terrible.
No. Bitcoin uses "scripts" to validate transactions. It is a small turing-incomplete language with specialized operators that let you perform comparisons and such. This script was set up such that you could spend the coins if you could make a hash collision in SHA1.
Considering even with logging off: journaling file systems, "user assist", device connection logs, pre-fetch (or your OS's equivalent)- these are all huge tranches of data if you are looking at a system shortly after an event. Ask me 6 months later- probably not. Give me a system that hasn't even rebooted, has a heap of ram and hasn't been used much since- 6 weeks is fine, not ideal, but doable.
Then have the government paid for it. It's a minuscule cost to have a fair election.
Securing free speech
Gold is hard.

It's hard to get a hold of, it's hard to store securely, it's hard to transport, and it's hard to get people to accept it.

If you're really considering gold or Bitcoin, you very likely care about many of those things, and you'll see that Bitcoin has distinct advantages for several of those problems, with a lot of potential to improve.
Maybe video footage?
Cloudflare blog post related to this incident: https://blog.cloudflare.com/incident-report-on-memory-leak-c...
GitHub Language Labels
In fact, copying can be theft.
In case you're wondering how this could be worse than Heartbleed:

Yes, apparently the allocation patterns inside Cloudflare mean TLS keys aren't exposed to this vulnerability.

But Heartbleed happened at the TLS layer. To get secrets from Heartbleed, you had to make a particular TLS request that nobody normally makes.

Cloudbleed is a bug in Cloudflare's HTML parser, and the secrets it discloses are mixed in with, apparently, HTTP response data. The modern web is designed to cache HTTP responses aggressively, so whatever secrets Cloudflare revealed could be saved in random caches indefinitely.

You really want to see Cloudflare spend more time discussing how they've quantified the leak here.
Severe gum disease may be early sign of undiagnosed diabetes
Yes. And in this case you have to be quick and maybe need some luck. Because everyone could try to get those coins you have to be the one that gets his transaction included in the block chain first.

If Google had not publish the collision but you found it yourself, miners could still just steal the collision from your transaction, throw your transaction away and spend the coins themselves.

Actually everybody could just watch all new transactions, steal your collision once they see it and try to front-run you. So this kind of challenge is not really a good idea in general, at least not in this simple form.

With normal transaction this is not an issue because there you only reveal a signature proving that you know the private key, you do not reveal the private key itself and therefore others can not sign their own transaction and try to front-run you.

[...] and, as a followup challenge, something encrypted with your public key so only you can decrypt it later on.

That is not entirely correct, as mentioned above this works by signing and not encrypting. Everybody and especially miners have to be able to verify your transaction but they could not do that if you simply encrypted something. Well, they could if you published the private key but then you get into said front-running issue.
"Rather than stating that you don't know why it would be relevant to mention the man's race, why don't you just actually ask yourself the question? Why does it matter that he is black? You all are great problem solvers. I think you can come up with some interesting answers."

I can answer to this. His race is mentioned because today's radical left wing journalists think that separating minorities and putting them on a spotlight is progressive and going to fight against racism.

Well...that's pretty much absolute bullshit. Actually it's doing the complete opposite. For example in this article the credit for the achievement is stolen from the person himself and given to a generic group of people with only thing in common being the race. This is active way of telling his not "us", but his "them".

When journalists and people stop seeing black, white, yellow, green, gay, straight etc. or just stop caring about race and start seeing just people we most certainly won't have society without racism but we might have a society with much less racism from all sides.
To be clear, I was talking about a completely different issue (deliverability, in general -- not related to Mailgun). My mistake, I suppose.
My password manager has > 500 entries. Changing all the passwords....isn't going to happen any time soon.

If it only took 60 seconds per site, it would still take eight hours to change them all.

Might change a few key passwords, though. Couldn't hurt. I only have a couple of bank/financial passwords at this point. And my various hosting service access passwords.

Anything else is not worth the hassle -- and mostly would have 2FA anyway.
The only thing the end user has is the difference between http:// and https://. Cloudflare undermines that entirely. How can a user possibly ever know whether it's safe to enter their credit card number or medical information in a web form, in a world where CloudFlare "Flexible SSL" exists?
Google Maps with AngularDart
I'm not convinced that nofollow == no value.
i guess thats what they did. funny, it seems they got penalized regardless somehow, because i started getting emails asking to please remove the spam they posted.

Edit: It seems some of them were trying to damage competitor's SEO ranking by posting irregular links. SEO is wild west.
OK, "severe in impact", but there isn't much victims can actually do besides try to invalidate as much data which had potentially transited Cloudflare as possible.
How do you check if a website uses cloudflare ? Any scripts that do that ?
You should be in favor of alcohol prohibition then, because a drunk gun user is far, far more dangerous than a high one.
Police power was something meant for the states, not the Federal.

Excesses like this are a good reason to advocate for originalists to SCOTUS.

Thankfully, United States v. Lopez (1995) started to reverse things a little.
Marijuana use is correlated with improved outcomes for patients in opiate addiction programs. That said, I'm not sure what you mean by marijuana being more pleasant than opioids. Have you done both?
IANAL. But it might be possible that the Supreme Court no longer regards Wickard as good precedent. IIRC, the Obamacare case got decided in a way that said that the individual mandate could not be justified as "interstate commerce", but that it could be justified as a tax.

This may leave the Feds needing to say, "We can't prohibit it. That's outside the powers given to the Federal government. But we can tax it, and tax it highly enough that nobody can afford it..."
How is that not slow as balls when you're hammering memory? Guaranteeing atomic writes to disk for every memory access would seem to be problematic from a performance perspective.
That's what happens when an organization is KYC/AML compliant. Legal compliance and customer experience are mutually incompatible in finance.
Everyone: HN should implement U2F or TOTP so we don't need to only rely on passwords :(
>edit: why the revulsion

I'd guess it's because of the crude and reductive way you describe the service cloudflare provides. I don't know what type of programming you do, but many small services don't have the infrastructure to mitigate the kind of attacks cloudflare deals with and they wouldn't be around without services like this.

I don't like the internet becoming centralized into a few small places that mitigate DDOS attacks like this, but I like the alternative (being held ransom by anyone with access to a botnet) even less.

I'm going to take a more even handed approach than what you're suggesting. Any time you work with a service like this you risk these kinds of things - it's part of the implicit cost/benefit analysis humans do every day. I'm not ready to throw out the baby with the bathwater because of one issue. I'm not sure what alternative you're suggesting (I didn't see any suggestions, just a lot of ranting, which might also contribute to the 'revulsion') but it doesn't sound any better than what we have.
nofollow, but indexed
In that case I'd make my own fork and leave it there for anyone else who may have the same issue.
Every time I start a new project, read a book/tutorial/blog, or watch a lecture, I write down notes in a Google Doc. These notes are mostly bullet notes summarizing the main idea of what it is that I've learned (Feynman Technique), and I make sure to document from which source I learned that thing. Every few weeks I'll read through this document full of notes to refresh my memory on whichever topic I choose. That way, instead of wasting time (for example) re-read a dense technical textbook, I can quickly ramp up on a topic by reading my notes. If those notes are insufficient, I'll reference my bibliography and go straight to the source. The benefit of having these notes stored in Google Docs is that I can reference them from any device. However lately I've been considering switching to writing all notes in plain text files with vi so that I could grep and find things easier later on.

I also personally retain knowledge better when I write it down. I always keep a stack of printer paper or composition notebooks nearby so that I can write down my ideas. These methods aren't always very effective, but they help.
I don't get it. How is this info leaked? From the blog posts, it seems that "only" the HTTP Headers are being leaked and somehow being crawled by Google? But since when does Google store HTTP request info? Can someone explain?
In my experience regaining the skill is much faster than learning it in first place (assuming I'd gotten reasonably proficient). I spent a few years not coding much and had easy time getting back to it.

I often find that more important than having a skill is knowing it exists, so I can learn/relearn it when needed (https://codewithoutrules.com/2016/04/15/40-hour-programmer/).

Earlier in my career gaining the skills was probably more important, though.
Even a >= check would have been suboptimal. Rather than

/* generated code */
if ( ++p == pe )
goto _test_eof;

or

/* generated code */
if ( ++p >= pe )
goto _test_eof;

they should have had

/* generated code */
if ( ++p == pe )
goto _test_eof;
assert(p < pe);

since having servers core dumping would have drawn attention to the bug in a way that counting one byte too many and then hitting _test_eof would not.
> That could mean he downloaded an SFTP client like Cyberduck. He could have searched the internet for a client and then installed it. It doesn't say he did not have auth.

They weren't trying to claim he hacked in. They're making the case he went out of his way to get his hands on these documents, and building a timeline that suggests why he went to that trouble.
For anyone interested, 20x has been around for 2 (IIRC) years, providing endless entertainment for trading forums for the duration.
Not so much an interface board as a whole new tested design for a LIDAR unit, including a unique patented optics setup and laser driver circuit, according to the complaint. Also testing, manufacturing, and characterization procedures and results and information on suppliers for the parts required. The PCB was just the component whose accidental disclosure lead them to conclude that Uber and Otto were using the stolen design. Since the PCB apparently dictates the position and orientation of the laser diodes and sensors, presumably it would only be useful if they copied the whole thing.
Do you realise that racism and sexism are not conspiracies? If they were conspiracies, you would be a prime example of a co-conspirator: dismissing one woman's testimony because no men have testified in agreement with her.

Here is now HR takes part in "the conspiracy": they take no action against a man who is in a senior position because they do not want to lose their jobs.

Here is how "all these employees" take part in "the conspiracy": they do not speak up because the issue is not affecting them personally, they don't want to rock the boat, and maybe they feel that the woman in question is just a pain in the arse because she always talks back and challenges assumptions, so why would anyone stand up for her?

Sexism is not a conspiracy, it's a learned behaviour. You can't eliminate sexism by breaking the conspiracy, you have to find ways to adjust institutionalised behaviour.

Consider the classic story about the monkeys and the electrified bananas: monkeys in captivity were shown bananas. If any monkey went to pick up the banana, the entire cage would be electified, shocking all the monkeys. Eventually the monkeys would best up any monkey trying to pick up the bananas.

Then the researchers started replacing the population, and stopped electrocuting the monkeys. The society still best up monkeys trying to get the banana. Long after there were non of the original monkeys in the group, and none of the monkeys had been electrocuted, they still beat up any monkey trying to pick up the banana.

So too, in any institution the new people learn ways and means from the incumbents. They learn that certain people are beyond reproach, long after any remaining incumbents can remember why. They learn that certain issues are smply not discussed, and do not question why.

How do you get that institutionalised behaviour back to normal?
While these guides are aimed at specific distributions, many (most?) of the concepts "translate" quite easily to other flavors of Linux. sysctl's, for example, might be configured in a different file but they will still exist and work the same (disclaimer: usually!).
AES-128-GCM (or ChaCha20-Poly1305 if you're feeling particularly hipster) with a new, random IV every time data is encrypted.
Step 0) Obtain black funding from NSA budget to start and "VC invest" in a global CDN company...

(Now I'm trawling Crunchbase to see if I can work out which investors are NSA front companies, then I'm gonna look to see what _else_ them and their partners have invested in...)
Big Pharma Quietly Enlists Leading Professors to Justify $1,000-Per-Day Drugs
I think of Python like a Swiss Army Knife of programming.

Like a swiss army knife, it is no replacement for a butcher knife however it's convenient, easy and for most cases it gets the job done.
That program used to stall your startup something fierce too. It was really annoying.
Google was on the other side before:

https://techcrunch.com/2011/05/26/paypal-lawsuit-google/
And I opened a PR to fix the issue :)
Sure, some people care about the supply decades from now. Personally I only care how much inflation happens while I'm holding the coin.
our districts are set by an independent non-political body

Heh, yeah...we used to have those in the US, too. Is there anything in AUS law that prevents infiltration by members more political than the body's charter anticipated?
According to Tavis Ormandy's twitter post it was 1Password, https://twitter.com/taviso/status/834900838837411840
Amen. You can google the controversy around the StatCheck program to really dive into why stats and their applications are beyond lies and damned-lies in their falsehoods (because you can prove the lie is right). Doing something as simple as smoking causes cancer is a very very simple experiment to interpret (hard to fund/preform though). It's the pernicious little studies on 8 cells total that get messy. Preforming a lot of experiments is hard.

I knew of a student that graduated with only 8 cells of data out of his 7 years in grad school. That may sound like a small amount, but to his committee, it was a very impressive number. He (very very) basically sliced up adult rodent brains and then used super tiny glass pipettes to poke the insides of certain cells. He chemically altered these cells' insides in a hopefully intact network of neurons, shocked the cells, and then recorded the activity of other cells in the network using the same techniques. Then he preserved and stained the little brain slice so he could confirm his results anatomically. From start to finish, it took him 13 hours total, no lunch or restroom breaks, every day, for 7 years. He got 8 confirmable cells worth of recordings total.

That is a hard experiment. But due to his efforts in adding evidence we now suspect that most adult hearing loss is not due to loss of cells in the ear, but in the coordination of signals to the brain and their timing mis-match. It is not much, bu it adds to the evidence and will for sure help out people someday.

To add, he is now a beer brewer in Bavaria and quit science. This shit takes sacrifice man.
It shouldn't be too difficult to feed an instrumented copy of the parser some fraction of their cached pages (after all, that's what they're for.. right?) and calculate a percentage of how many triggered e.g. valgrind, or just some magic string tacked on the end of the input appearing in the output or similar

I prefer CloudScare to Cloudbleed :)
Response headers will contain a "cf-ray" header or "server: cloudflare-nginx"
Are You Leaking User Information in Your GET Requests?
It's not obvious that quietly separating is the principled stance when dealing with ethical issues.
What a mess.

On the plus side, all those booter services hiding behind the Cloudflare are probably being probed and classified/identified/disabled by competitors and probably FBI. That is good.
Living in the USSR isn't a valid argument against socialism, it merely shows that the USSR's methods were not good, if anything.
While I understand that the life sciences dominate science research right now, it still annoys me when I read a headline about "most scientists" and the article is exclusively about the life sciences. Even if the physical sciences have reproducibility issues of their own, those issues may be different enough to frustrate lumping all of the sciences together.

I suggest that future articles about the reproducibility crisis should either: a) Specify "life science" in the title, or b) demonstrate that the generalization is justified.

My field (physics) is certainly not perfect, but we do have a reasonable body of reliable knowledge including reproducible effects. I work for a company that makes measurement equipment, and we are deeply concerned with demonstrating the degree to which measurements are reproducible.
It's just because Coinbase is being extremely/overly cautious about detecting and fighting fraud. They will refuse to let you buy/sell if your account/documentation is a bit suspicious. And they can't explain you why you were tagged (or else fraudsters would simply ask why and would adjust their operations accordingly.)
The Third Age of the Web Is Here,  and It’s Mobile
"This bug would have been caught with valgrind, and by the sounds of it, using nothing more complex than feeding their httpd a random sampling of live inputs for an hour or two"

Or prevented using abstraction that do bounds checking. Or even just used ragel with a memory safe language and prevented all issues like that from ever happening. Probably would have been less work even with the reimplementation of an http proxy from scratch.
Hey, I'm the author (thanks @zoodle for notifying me).

Obviously, this is a security issue that is pretty much bottom-of-the-barrel-shitty.

My explanation is that I didn't feel like standing up a middleware service to direct traffic through in order to obfuscate the server token. Especially for a tool that I anticipated being used by pretty much only me.

Not a satisfying answer, but thanks for exposing this security flaw - definitely going to add it to my project task queue.
$ dig example.com

to get the A Record, then

$ whois 1.2.3.4|grep Cloudflare

Not 100% reliable, but should do the Job.
Don't know if I'd pay $75 for custom domain Medium when there are Hugo, Ghost, Pelican and such free great alternatives for static blogs.

But, man do I really wish my work bought something like Medium and replaced the cumbersome Wiki pages. My own Wiki pages are ugly and a pain to manage tables, images and text.
A Product-Led Approach to Sales
Stealing is a rookie move. But I don't think there was a choice about using his work laptop. You can't connect an arbitrary device to Google's network.

https://research.google.com/pubs/pub43231.html
This just goes to show that nobody's job is safe. The crux is that AI won't get tired and won't balk at changing requirements. Many people will think it's still very far, until it suddenly arrives. The horse buggy drivers never saw the automobiles coming.

On the other hand, until that day arrives, we could take the technology into a direction that actually helps users/customers and software engineers communicate better. The software engineer could have the user feed requirements to a bot, and systematically identify and explain issues in the requirements, based on the bot's output.
Why? Many can help find problems without having to be full-time, that's the point of crowd-sourcing with payouts.
I work at a cloud bio lab. We run all of our experiments on automation, and all protocols must be defined in code. The latter is both the power and the difficulty -- when your protocol is defined in code it is explicit. However, writing code is both new and sometimes difficult for the scientists that we currently work with (molecular biology, drug discovery). I believe what we are doing is the right model. But it comes with this overhead of transitioning assays to code, so there is that against it. This is mostly just a matter of time though. Another nice thing about code is that you can't tweak it once it's running. You can define your execution and analysis up front to guard against playing with results down the road. Now that being said, there still needs to be a significant change to how research is funded and viewed by the public because pure tech solutions can't solve everything. Our tech can't decide what you pick yo research. It can't dish out grants to the truly important research. So it will take many angles to really solve any portion of this problem.
Show HN: Debaters – Friendly conversations with people that think differently
You really want to see Cloudflare spend more time discussing how they've quantified the leak here.

What would you like to see? The SAFE_CHAR logging allowed us to get data on the rate which is how I got the % of requests figure.