skysight-inc/HackerNews huggingface dataset:
On a quick scroll of the comments, I haven't seen this posted so far: http://valerieaurora.org/hash.html

We're at the "First collision found" stage, where the programmer reaction is "Gather around a co-worker's computer, comparing the colliding inputs and running the hash function on them", and the non-expert reaction is "Explain why a simple collision attack is still useless, it's really the second pre-image attack that counts".
I prefer just getting code, editing and figuring out what it's doing. So learn by doing!
If i'm super stuck I use google. This is how I learnt programming at a young age(12), back in 2002 - at the time I didn't have money for books, and there wasn't really any programming videos about. No stackoverflow then either - you'd have to experiment a lot more with code to work out what was going on.

Learn by practice!

Just realised this seems to not be the case as much anymore, as emphasis is on speed of learning, not really depth.

Occasionally i'll watch videos though too - but unless i'm practicing i tend to forget it quite quickly.

I did try using books from the library when I was younger - but I don't think I got past the first 2 chapters of a c++ book without getting bored. Being able to take small video games and edit them kept my interest and passion much more.
> are you willing to sacrifice your ethics and morals just to create the world's best taxi service in the near term?

Depends. Uber is more grounded and useful than most SF startups. They choose a good problem to solve. Bashing it whatever you want, as a service, it is pretty valuable.
Has anyone read "The Circle" by Dave Eggers?

I enjoyed it. Raised a lot of interesting questions that I think we're all going to be debating in coming years. Privacy, surveillance, transparency, etc.

Genuinely surprised how rarely it comes up in these discussions about toxic corporate tech "culture"
Social feedback mechanisms appropriate for small tribes of 100-150 people become overwhelming when used by 100,000-150,000 people, to say nothing of what happens if you add three more zeros.

You can see modern celebrity as the flip side of this problem, too. 100,000,000 people giving just a bit of respect and thumbs up to someone becomes quite a torrent of social currency.
You don't understand what I am talking about, neither do FileStreamResult authors (I've looked at mono and ms implementations) and that's the problem I am talking about.

Linux users either know what sendfile syscall is and how to use it or use libraries whose authors know.
The GP probably means "that it wasn't corrupted during the download", as there are a few attack vectors for someone who could serve a different file (they could trivially serve a different hash).
The biggest mishires I've experienced were generally students with a whole lot of history in their GitHub accounts. I haven't done a thorough post-mortem on what was going on there, but I wouldn't rule out plagiarism or an ability to make small tweaks but little sense for dealing with a larger, more complex project.

What we found was the way you figure out whether or not someone with a strong GitHub history is going to be a good hire looks more-or-less exactly like the way you figure out whether or not someone with zero GitHub history is going to be a good hire. All focusing on GitHub really seems to get you is the ability to cast an artificially narrow net.
Self-Flying Drone Taxi in Dubai
There is/was this: https://arstechnica.com/security/2016/11/elegant-0day-unicor...
Kernel patching with kexec: updating a CentOS 7 kernel without a full reboot
Bad Approaches to Web TV Cost the Tech Industry Billions
It's going to be hard for any language to compete with the .NET ecosystem due to the hundreds of millions of dollars of funding it gets from industry compared to OCaml.

There's still room for both and they're still both great languages. That F# is quite similar to OCaml is a good thing... it means there must be some good ideas in there. :)

As for a MongoDB driver I found https://opam.ocaml.org/packages/mongo/mongo.0.67.2/ on OPAM in a few seconds. OPAM has been huge.
Does bt have checksums for pieces and files? I thought it was only pieces.
Although they'll have a lot more intense x-ray and UV radiation to deal with. Surviving for long enough from under ice or an ocean might be harder than getting out of our gravity well.
SpaceX Dragon Delivers NASA Cargo to Space Station After 24-Hour Delay
BASIC used "=" for both assignment and equality tests long before Pascal existed and was more popular for teaching the youngest students even when Pascal was available, so I find the idea that the use of "=" for assignment is some kind of barrier that high school kids (or younger, even) are going to have a lot of problems with just as implausible as the idea that imperative mutation is such a problem.
Well I guess it's all about context isn't it?

If you're working in a place where everybody is working 60 hours and competing to be the richest man in the graveyard then yeah it's not much.

But when you're working an extra 2 hours a day on your own then yeah - then that's something. It's all relative.
When it's triggered, Amazon stores recordings of every command. You can then play that back, and tell Amazon whether it heard you correctly.

I've used this several times to figure out items on my shopping list where it misheard me.
Video files are purposely made to work even with some data blocks missing. It's the feature that enables video streaming. Valid header is usually enough for video player to at least try to play a file.
I did this by accident before, at a 5K. I arrived to the race so late that when I crossed the starting line to BEGIN the race it registered that as my finish time and I'm posted on the result website as finishing in 2nd place.
How do you know the exact number of devices, suspicious.
What about those of us who have no interest in their githib profile, who instead use their spare time to build their own products/services. In my case, I make a significant percentage of my total earnings from side projects yet prefer to stay a full-time employee. To me, working for free on someone else's project on github is an opportunity cost I simply cannot justify.
By design, in case of a collision the new version will not replace the old (older version has preference in case of a collision). Not sure if you could somehow fiddle with the meaning of old and new from the systems POV though.
I have the app, it allows you to play back any prompt that Alexa was triggered with. For instance the maintenance people at my apartment complex decided to play with it and I can listen to them ask stupid stuff like: "how many apples are in a bushel"
Perhaps some of them, especially the innermost. Considering the orbital periods and resonance it seems like this system might be similar to the Jovian or Saturnian systems.

The planets may be tidally locked but there is also a chance they could have a slow rotation similar to Mercury. That planet has also shown us that a magnetic field is possible without a fast rotation so there's a chance of these exoplanets having one as well.

Tidal forces can be a boon to planets with synchronous rotation since they provide an additional source of heating for the side of the planet that faces away from the star. If there is liquid water or a thick atmosphere they may also drive tidal and weather patterns that could help circulate heat from the warm side to the cold side.

Geological activity also 'stirs the pot' when it comes to precursors for life. All this extra energy in the system could mean that even TRAPPIST-1g (outside the habitable zone) might have an atmosphere and oceans.
The method presented works only with data formats where you can add section of 'calculated junk' into the data.

Public key can't contain junk and work, so I don't see how this method would work.
I'm a thru-hiker. I'm done PCT/CDT & others.

8 hrs & 18 miles/day is pretty slow and short day.
This is a novice thru hiker pace, but I doubt they were trying to set any records--
As has already been mentioned, the digest of a torrent's pieces is also checked

Source: my own crappy implementation of a BitTorrent client, e.g.: https://github.com/charmeleon/BitClient/blob/master/src/conn...
7 Ways Democrats Are Setting Themselves Up for Failure
I have fond memories of being blown past by thru-hikers on the Appalachian Trail. They all had massive quads and calves, with tiny knees.

I don't really like the folks who hike, but don't actually camp and carry their food. Seems unsportspersonlike.
Understanding Developers (for API providers)
Website builder Wix acquires art community DeviantArt for $36M
As long as he used the same equipment before and after, does it matter? The Point is the change, not the exact numbers.
One of the good parts of doing it at the leaf hashes over the top level hash as proposed further up the thread is that quicktime/avi/etc are much more amenable to carrying some "junk" data than trying to figure out two colliding merkle tries with the same hash.
Love Python, but very happy to be writing Go instead now, to give one example of a post-90s language.

(Their intersection of uses isn't total, of course; Python's still got Go handily beat for numpy-ish stuff and interactive use. See Julia for a possibly-superior post-90s competitor in those areas, though I've only played with it.)
If such technique would be as accurate as their DCMA take-down notices, I wouldn't be surprised in resulting subverted Linux installations and whatnot.
You should remember that youre not the only one trying to take and spend tax money.
Most semi-primitive types in python is immutable, yes (int, float, char, str, and DateTime), but all of the collections are mutable (List, Dict, Set).

I'm sure there are immutable versions of those same data structures hidden somewhere in the standard library, but I haven't looked.

I did stumble upon pyrsistent (https://github.com/tobgu/pyrsistent) a while ago which does provide proper immutable (and persistent) data structures for python.
Speaking of cutting Möbius strips, I used to love making Möbius bagels [1]. Fair warning: your significant other will likely be unimpressed to discover that a gnarled bagel is the "special surprise" you promised for breakfast.

[1] http://www.georgehart.com/bagel/bagel.html
If you find a collision for the smallest piece, you don't need to find collisions for any higher nodes on the Merkle tree because you'll just be hashing the same values as the legit version.
It's not excusing, it's providing context in a conversation about policy in the corporate, white collar, workplace. Bringing unrelated incidents into the conversation distracts from that.
Most torrents use a flat list of hashes. The merkle tree is an extension. With a collision you could replace the metadata wholesale though, pointing at completely different content.

But then the torrent client would also present that different content from the start when asking you what to save.
Also:

http://www.trueactivist.com/woman-sees-strange-item-on-winds...
Implement Lazy Sequences in ECMAScript 6 with Generators
An interpreter understands what machine instructions you want it to execute at line #. Which seems to me pretty close to what you describe. I mean programming with a natural language interface seems possible but lacks the precision and so programming would probably wind up with a technical language for instructing to behave predictably and I am back at interpreters and programming languages.
5 Things You Need to Know About Web Push Notifications
A guide to seeing news from different perspectives
I really enjoy reading these pieces where someone rewrites something in rust and it turns out better than the old C version due to rusts safety features. Usually those kinds of projects are just a rewrite to someones favorite language of the month, for little tangible benefit other than their own satisfaction or education. These rust ones seem to show tangible benefits to the language itself.
SHA1 use cases are not limited into integrity verification of documents, but used a lot for traffic integrity and generation of authentication codes:

- Torrents of all kinds.
- Version control systems (where ability attacks like displacing release pointers become easier).
- IpSec, SSH, PGP and a number of other protected data exchange systems.

Being able to subvert integrity guarantees is a nice building block for complicated man-in-the-middle attacks.
What startups? They all seemed to be backed by people with money and power.
I love it! The fact that you made it for your daughter is even better!

Comparing our sun with Trappist's star is really interesting. Try to compare it with Jupiter. They are almost exactly the same.
Start thy purse to fattening
Build Git – Learn Git
As thanatropism said, "coordinate-free" is not synonymous with (Einsteinian) relativity. It's a general mathematical approach, and it doesn't have any philosophical consequences that I'm aware of. Just because spacetime is a curved manifold doesn't mean it can't be dealt with using coordinates in a higher space in which it is embedded.
Google’s plan to make talk less toxic
Epic summary!!!
uBlock v1.11.1.0 managed it flawlessly.
https://news.ycombinator.com/item?id=13713480
Well how many are there?
Most scientists 'can't replicate studies by their peers'
> The AI is itself a program. If the AI can write programs, it can write a better version of itself.

Not necessarily (or even likely). There's a huge difference between being able to write "programs" (for example the ones described here are ~5 lines) and being able to write a large and very complex piece of software, which such an AI would undoubtedly be.

There's also the question of what constitutes "better." Improvements in e.g. speed or memory efficiency (hard enough as it is, but conceivable for an AI) are a quite different thing than improvements in capabilities or understanding.
Probably nothing, because they'll just used compromised aws keys to spin up instances for free.
Submitting this because it's come up on HN before and there's a few people who think it's limited to just social psychology or similar. But this report include eg cancer treatments.
Now I really wonder what will happen to Git we all know and love.
I wonder if this is really the case.

Because if we can drive storage costs much closer to zero (e.g.: a beefed up local server), we can keep storing hashes and the next collision should be much closer. Starting and stopping and throwing away the previous work does work out to $560K per collision, but doesn't it just keep getting cheaper if you keep going?
Sometimes it's not an option. I've survived years of solo hiking but I do worry and try to keep to places where someone would find my body within a day and only hike in warmer months.
>This will mess up torrent sharing websites in a hurry.

I doubt it. Should this ever become a problem, it would be trivial to change the hashing algorithm. Not worth the effort.
Tips to Improve Your Mental Math Ability
"Hello mister security person"

"Did you pack this bag yourself sir"

"Oh yes"

"And all the contents is yours"

"Well, no. I mean, there's a package in there that I'm taking with me that's somebody elses"

"But you wrapped the package yourself?"

"Well, no"

"So you didn't pack the bag yourself?"

"Yes I did, there's just one brown paper wrapped item I'm couriering for a friend"

"So your bag contains a package that it not yours, and that you've not seen inside which was given to you by someone else?"

"Yes. But it's fine. I got it via an App..."
it's more common in extreme environments where your caloric expenditure is very high.

antarctic sled teams do this sometimes, because you're burning about 7,000 calories a day just staying warm.
Deceptive headline. This is yet another anti-Trump diatribe disguised as journalism. The word Reddit does not appear in the article.

Flagged.
There's also patience diff[1], which does a better job in some situations[2] (you might not normally see these inferior diffs because the diffs are massaged after the LCS algorithm).

[1]: http://alfedenzo.livejournal.com/170301.html
[2]: http://bramcohen.livejournal.com/73318.html
8 Things to Know Before Starting Application Release Automation (ARA)
> How am I going to explain this to my wife?

Someone has discovered a computational equivalent of bypassing tamper-proof seals, but only a specific brand of seals (SHA1) which is very currently popular. Other types of seals still work fine. This means we can no longer trust if the cake from the baker hasn't been tampered with even though the packaging it comes in has an intact SHA1 seal, we should therefore demand that the baker start using SHA256 seals lest we get poisoned by the delivery boy who wants to steal the shiny PS4 he noticed the other day.

Edit: perhaps delivery boy underplays how costly the attack currently is. Perhaps make the poisoner a person of means who wants inheritance money. As the attack costs go down, even delivery boys will start to afford it, multiplying the risk.
That was changed early on git's history. Originally, the object was hashed after being compressed; it was changed to be hashed before being compressed.

See this commit: https://github.com/git/git/commit/d98b46f8d9a3daf965a39f8c00...
We clearly do, it's called Signal, it's just not as convenient for you to use. Which is pretty much everything FOSS.
Is that Verizon's FIOS, or is it Frontier FIOS?
There was a button that said "Continue using adblocker" that removed the popup and let me read the article.
It's a perfectly reasonable assumption until there's some evidence there is. Given the vastness and scale of the universe, it seems quite likely that our disappearance would never be noticed.
صور+صلاح+رشوان+2017+صور+من+جنازة+الفنان+صلاح+رشوان+الله+يرحمه
> other news are covering also the story with her real name and pictures

Should they blur her face and not use her name?
What about tidal and geological heating? or a greenhouse effect similar to Venus?
The UK has this as well, it's called Paym here. Mind, bank transactions through Faster Payments are also almost always instant, so it's just a convenience feature, nothing majorly new. In the US, inter-bank transfers are not instant at all, so these middleman services provide direct benefits.
A Look Inside Britain’s Plucky (and Criminally Overlooked) Space Program
What can be done to protect against attacks like this?

I'm considering switching from Android to iOS since I've heard good things about the security and privacy.
You can use SHA for this purpose if you retrieve the hashes from a trusted and secured source.

Buildroot does that for 3rd party packages for instance. It downloads the source from the original website (possibly completely non-secured) but then validates the checksum against a locally trusted hash list. Buildroot supports a variety of hash algorithms but many packages still use SHA-1.
Someone just made about $2500

See https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2013... and https://bitcoinchain.com/block_explorer/address/37k7toV1Nv4D...
Thanks, very interesting reads.

Makes one wonder why these things aren't default on a linux distro...

As an embedded software developer it's a bit inconvenient that it's all focused towards the big distributions (ubuntu, RHEL, ...), but still interesting input for securing an embedded linux device :-)
So, what did he say about EBITDA?

While I haven't extensively researched, what I did find was this:

"""
Not thinking of depreciation as an expense is crazy. I can think of a few businesses where one could ignore depreciation charges, but not many. Even with our gas pipelines, depreciation is real — you have to maintain them and eventually they become worthless (though this may be 100 years).

It [depreciation] is reverse float — you lay out money before you get cash. Any management that doesn’t regards depreciation as an expense is living in a dream world, but they’re encouraged to do so by bankers. Many times, this comes close to a flim flam game.

People want to send me books with EBITDA and I say fine, as long as you pay cap ex. There are very few businesses that can spend a lot less than depreciation and maintain the health of the business.

This is nonsense. It couldn’t be worse. But a whole generation of investors have been taught this. It’s not a non-cash expense — it’s a cash expense but you spend it first. It’s a delayed recording of a cash expense.

We at Berkshire are going to spend more this year on cap ex than we depreciate.
"""

So tell me - what giant depreciation expense does uber have that is going to jive with this assessment?

Disclaimer: not really an uber fan.
that depends on the attacker objective, if you just want to trash the file you can just search for any piece that have a hash collision, but if you want to turn the file into a malware you will need to modify the file in a specific way, possibly spanning multiple pieces, and there's less room for fuzzing the hash.
It is reasonably common, but there are a lot of factors behind it, as well as mitigating circumstances.

- College costs have risen much faster than inflation.

- At the same time, state subsidies funding universities have declined fairly dramatically since the recession, further increasing out of pocket costs.

- For many students, prestige and amenities are much more important than cost. When you see someone paying six figures for a university education, they're not picking the high-quality, cheap option. They're picking the (hopefully) high-quality, prestigious option.

- In the USA, anyone can go to a university. Anyone. Academic ability is almost irrelevant. Unfortunately, the least academically qualified students are often persuaded into attending very expensive for-profit universities.

- Student loans are very readily available.

- Academically excellent students in many, maybe even most, states almost always get a free ride to an in-state public university.

- Two year community colleges are very cheap, and generally offer an Associate's degree and easy transfer to the closest four-year university.

It is still very possible to go to school and graduate with no debt. I did it in 2011.
Atmel provides their compilers, not their tooling.

I didn't know that ST provided STMCube for other platforms. That's the project generation tool (which is great), it's not the IDE debugging system you get with Keil (which is also great).

You've linked the 'lite' TI toolkit. CCS is available on Linux, but is even less reliable than CCS on Windows.

I'm not trying to argue that all development is done on Windows, or that it's even the best platform to do it on. I am merely pointing out that Windows is the first platform that is targeted for development by the big vendors. Also (more anecdotally) the majority of the companies that I work with and encounter do their embedded development on Windows, until you get to the size of part that is running some form of Linux.
No. Signatures provide the same amount of integrity protection. In fact, all practical asymmetric signature schemes sign a hash. If an attacker can control what somebody signs, he can switch out signed documents using this vulnerability.
Google found a way to crack an algorithm designed to ensure the uniqueness of documents, allowing them to be forged. Although it's expensive to do this, the price will fall, and it's a good idea to retreat to a different algorithm that does the same thing but is so much more difficult to break that no one will be able to do so for many years.
So, is there any coincidence that this is where Walmart HQ is located (some proxy battle)?

Why has no other police department in the country attempted this?
OP posted wrong link to share their propaganda ;]
> And one just has to wonder, if they can't organize a bus terminal what chance do they have of ever organizing a properly functioning goverment that could organize their country?

As a resident of New York City[0], I am not sure how to respond to this observation.

[0] http://www.wnyc.org/story/surviving-port-authority-bus-termn...
I think he meant the devices were first patented in 1984.