skysight-inc/HackerNews huggingface dataset:
I wish Apple would just admit the trash can Mac Pro was a mistake and bring back the "cheese grater" Mac.

Some people just need or want a beefy desktop built with upgradable components (in addition to a laptop).

Or, crazy idea here, they could licence their OS if they don't want to make pro gear anymore.
We discovered 7 earth like planets yesterday, google and cloudfare went full chaos today.
Library Genesis.
The Master Switch by Tim Wu
otherwise :

dig website.com +short | head -n1 | xargs -- whois | grep -q cloudflare
Alternatives to Uber
Allow me an analogy. It's not the fault of a rope if you use it to cross between two skyscrapers and slip and fall to the ground. But if if you mind your life you use at least a safety cable to tie you to the rope, or use the lifts and cross at road level. There are still cars to watch for, but...

C is simply too dangerous, even the best developer can slip without noticing. There are safer alternatives now, we should start using them at least for new projects.
Lessons Learned from Watching “Pumping Iron”
Unless it's changed since the last time I played with it osquery doesn't upload anything on its own–it's just a local tool/agent that you can use to gather data. Carbon black is a good example of something like that.

JAMF I believe gathers application usage data but nothing as in depth as what's being discussed. It's also comically handicapped. It somehow manages to do a poor job of everything it tries to do so "the world's largest online Mac administrator community" is forum post after forum post of half understood franken-scripts. I used to think it was milquetoast but after sitting through their sales reps crapping all over open source software (despite extensive use of OSS libs in their products) and seeing it fail to do the most basic stuff out of the box my opinion is that it's over priced crap.
On Mac it is so easy to steal a password. In Javascript: var gmailPw=prompt("Facetime requires your password to login"); Macos asks it every week/month for one reason or another, people are conditioned.
they actually were made for developers

Apple has never, so far as I am aware, deliberately targeted developers as a primary audience of a laptop computer.

Apple's laptops became popular because they ran an operating system that was Unix under the hood, with a nice UI and good set of non-developer applications, which made them good as machines a developer could use for work and for non-work (Linux on the desktop being not so great at the second part of that). Apple has certainly been happy to make money from developers buying laptops as a result of this, but has consistently ignored the expressed wishes and desires of developers when updating its laptop lines, meaning Apple was popular in spite of Apple's indifference, rather than because Apple lovingly catered to this audience.

In other words: if you were looking for an executive to run around the stage screaming "DEVELOPERS! DEVELOPERS! DEVELOPERS!", I think that was probably some other company, and they got ridiculed for it...
How was https traffic leaked? Cloudflare, in order to offer its services, acts like a man in the middle and internally decrypts https traffic [0]

[0]: https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar...
Arizona's state legislature is sure giving that a try, though: http://www.azcentral.com/story/news/politics/legislature/201...
Decentralisation doesn't do a whole lot better. Just think about MTA or DNS vulnerabilities, for a start.
Why would that make the attack harder? Both PDFs are the same length.
Yes. They would not use Git for huge binary documents if they were in their right mind.
How was https trafic leaked? Cloudflare, in order to offer its services, acts like a man in the middle and internally decrypts https trafic [0]

[0]: https://scotthelme.co.uk/tls-conundrum-and-leaving-cloudflar...
Even if your password manager is not compromised, the credentials of so many sites is potentially leaked that you should probably still update a substantial number of passwords.

I hope 1Password's Watchtower service will soon give hints.
I got a t-shirt from cloudflare, and all i did was tell them "please send me a t-shirt" - they shipped it halfway across the world as well, for free! (it didn't fit...)
Reposted here? https://news.ycombinator.com/item?id=13721452
Free Ebook (Till 28 Feb): Cloud Is a Piece of Cake
> But then refused to say more

What more is there to say?
He could have wiped it with a cloth or something. It's kind of scary how they could figure out what he did after the wipe.
I don't think I'd want investors to publicly criticize a founder or CEO in their portfolio even if the founder was arrested for shooting someone (particularly outside the workplace). Plenty of other people can do this; there's no reason for investors to weigh in. If it were a situation which were work related, then the issue is "pending" vs. "resolved" status. (If it were a serious crime credibly alleged, then I'd expect the CEO to resign pending resolution, but there isn't a whole lot of cause for anyone to comment on it during that process.)

Totally agree with you about not wanting Uber-like culture. People should take affirmative steps to not develop that kind of culture. Investors should contribute to that. But, I don't see investors going public with their concerns about portfolio companies as contributing to solving that.

I would possibly feel differently if it were a situation where the investor had special knowledge of the incident, but otherwise, why should this one of ~1-100 people comment, when there are ~7b other people who could?
Happened on both my Macs roughly 12h ago, on two out of three accounts. Had 2FA configured for Google Authenticator, so took the time to refresh the OTP and bind it to 1Password instead.
That's pretty cool but won't do much against macOS.
Even if it is, what does it have do to with all those hundreds of sites?
I often see the suggestion that storing the length of the file too helps secure against hash collisions because it adds the additional requirement that both files be the same length, but every single MD5 and SHA1 collision I've seen are between values of the same length anyway! Where does this myth come from?
True, but for most jobs rewards are also set up in a way that short term benefits heavily outweight long term benefits. And that's not just top management. E.g., many software engineers are respected by their managers and team mates based on how many issues they close every week. Nearly zero reward for creating meaningful issues or solving a problem with a big long termin impact that is not an issue.
Peace of Westphalia is 1648, not 15xx. And the Peace of Westphalia wasn't exactly a centralizing influence--in confirming that the Holy Roman Emperor could not interfere in the matters of its constituent states, it repudiated the attempt of the HRE to centralize.

Strictly speaking, the Roman Empire was a surprisingly centralized state for its size--the provincial governors spent a lot of time asking the Emperor for guidance. (That was a large part of the reason why it fell--it was just too big to be centrally governed, and the administration couldn't really effect the necessary decentralization). Decentralization was the norm from post-classical times up until the development of gunpowder, which allowed central governments to start to exercise a monopoly of force over their subordinates.
And if you need a more expedient fix for existing C/C++ code, there's SaferCPlusPlus[1].

[1] https://github.com/duneroadrunner/SaferCPlusPlus
Inside of TLS, 1Password uses an additional SRP handshake that negotiates a static secret (like a DHE), which 1Password uses to both authenticate the user and set up an additional AES-GCM transport encryption.

So even a full memory dump of what's transported in TLS should, as long as it's properly implemented, only reveal an SRP authentication session and subsequently symmetrically encrypted data.

(And inside that SRP-negotiated encryption should only be more symmetrically encrypted vault items, and RSA-encrypted vault keys. If properly implemented even complete TLS breaks do not break 1Password at all, even the cloud version. Properly implemented being the key words of course.)
If I have an account on an affected site, but did not interact with the site (via my browser or through some other site with an API call) during the time period when the vuln was live, am I still at risk?
Here's the most interesting Blockchain news from last week
Nice, I did not see that one yet; any papers on how it works?
If you want a specific hash, why pull it from github everytime?
It happened to me in my phone and Chrome browser on my desktop; but my password did work (using 2FA). Both use "app passwords".
Cucumber and other tools such as Behat allow you to capture conversations you have with your client, product owner and stakeholders.

They enable you to build the right thing - the thing that helps the users or meets the business goals.

Have a look for BDD, Behaviour Driven Development.

The main thing is to have the conversations. The automated tests are a lovely side effect!
On one hand you are right, but on the other I've seen this argument used soooo many times in my life by people who didn't leave you another chance. And if one can believe the content of the open letter, it also says that they already tried multiple times to discuss this in private.

Communication always has two sides. And if one side is not willing you can't just blame the other side.
Nice tools to have in Jekyll, 0.11 released
Have you read Superintelligence? It is a great read
Church doesn't really define computation[1], and Turing most certainly bases his entire definition (the first ever definition of computation) on multiple references to physical things (finite "states of mind", limits of what can be read or manipulated at any one time etc.). Brouwer also bases intuitionism on the physical, when he appeals to the limited capability of a finite (idealized) mind. Computation carried out with an infinitely fast (in terms of physical time) and/or infinitely large computer is not Turing computation.

[1]: He conjectures that LC coincides with what he calls a "a vague intuitive notion" of an algorithm, and when he tries to make a rigorous argument he finds that he needs to rely on circularity, and writes this: "if this [circular] interpretation or some similar one is not allowed, it is difficult to see how the notion of an algorithm can be given any exact meaning at all."
How can a company fight for equal rights while simultaneously encouraging the opposite in their work culture?

I think you are the one with "broken logic circuits."
This incident fails to explain why common stockholders should have zero voting power. That decision doesn't fall naturally from "an early VC had onerous terms that we didn't vet".
Replacing Cloudflare with CSF Firewall
I hope we reach that phase, but so far it does not look promising. We'll get there, but I don't think it'll be in my lifetime. I hope we do though, I'm up for a career change.
I believe you are talking about a distant relative or nephew of the North Korea's Kim family. I believe the victim was actually shot to death in front of his home by someone with a pistol, which was a big news...

Touch choice. Stay in North Korea and be dragged off to labor camp or get executed. Or defect and get assassinated years later.
That's interesting that the paper was on arxiv since November ( https://arxiv.org/abs/1611.01989 ) and people payed attention just now.
Any statistics to back that up? Because some random hacker news comments dislike new MacBooks it doesn't mean other developers would.

I find it hard to see any realistic alternatives for MacBooks in software development. They give you all the tools you need from the Windows world that are not available on linux like Office, Photoshop etc. and it is still a UNIX system which can do all the stuff that linux can without kernel panics, crashes, bugs and other crap. Also unlike Windows or Linux, a single macOS installation can last pretty much forever and doesn't need to reinstalled every year because of the lost performance like Windows. And last but not least MacBooks are well optimised for the hardware they run on which gives them 1.5-2.5 times the performance with the same hardware as on Windows or Linux.

The whole thing about complaining about new MacBooks is same thing as with iPhones. People complain because it's trendy to whine about anything Apple does even if they would create eternal world peace and still everybody will buy them because there is nothing better or even similar on the market.
According to Tavis Ormandy this had nothing to do with the Cloudflare data leak, but I'm not so sure about that. It may not be directly related but could be indirectly related to what Google did about the Cloudflare issue. It's just too much of a coincidence.
What is the best way for a founder to secure the kind of control that Mark Zuckerberg has in Facebook to this day? And still raise VC?
Because, when provisioning a new server, where else can you get it from?
Personally I edit video in Blender on Linux. But from what I understand, these days Premier is kind of the default for general purpose, non-legacy video editing on Windows. Resolve has a free as in beer version that's supposed to be pretty good.
Not that I can recall, at least not on Windows 10.
Where did you get that Mac VM from and on which host OS are you running it? That should be a Mac, you know.
People ask for the other side all the time. But where is the other side? Why are they not using neutral outside investigators?
I've been tinkering with a Python notebook for a few minutes to try to quickly assess how much of my LastPass vault is affected:

https://gist.github.com/dikaiosune/0ca7829884b3b3f790418f0f1...

Improvements welcome.

One interesting thing: the raw dump that's linked from the list's README doesn't seem to include a couple of notable domains from the README itself, like news.ycombinator.com or reddit.com. I may be mangling the dump or incorrectly downloading it in some way.

EDIT: disclaimer, be responsible, audit how the dump is generated, etc etc etc
Same here. I just spent the last 30 minutes changing passwords at my most critical sites. Banking, email, VPS providers, etc.

I figure I’ll slowly work through the rest in the coming weeks as time allows.
>We're investigating, but not to worry: there is no indication that this is connected to any phishing or account security threats.

This statement is as ridiculous as it gets.
Yeah, it may be more of a society problem than a corp problem.
Just like humans program; you write code and have unit tests (if you are lucky). What is different about this? It has the same inputs / outputs so the unit tests will be there. Formal verification would be better; aka having a model for the original and having the computer prove that new version is mathematically identical to the original. But both the formal verification and the transformation proof are far off for almost all software projects in practice.
Anyone here would do the same thing.
The length field makes the attack significantly more difficult. In the publish attack, you take 2 fixed input and prepend special data to make the collision. With Git, you have additional constraint. Either it needs to be of exact length, this may or may not be an issue, but most likely is unless we find a new weakness in SHA-1, or you must be able to handle the changing input.

In all the examples in your link, while true that you can add "silent data" to all of the examples, they are all examples of structured data. So not only do you have to figure out the collision, you have to do so within the structure of the format you're attacking. This is a lot harder than just prepending the exact bytes you want.
In a lawsuit you fight alone and either give or get money in the end. A convincing public message can change the situation, sometimes.
Before the feature files get written, have a conversation with the PO and other stakeholders.

Involve a QA person and relevant developers.

Catch the changes early, ask for more examples of the feature or goal, "have you thought about ...", "What happens in this case...?".

You will get better quality features with less rework, because you are writing the thing the PO actually wants and cover off edge cases before they crop up in testing.
Happened to all my email accounts I have on my Android phone. I thought this was a planned, intentional change by Google and so I logged in with 2FA...
I was authorized to trash my employer's network, sysadmin tells court
They covered his mouth and nose, so it's quite likely he also inhaled some.
From a custom package you have built? Did you know that RPMs and DEBs don't
grow on magical trees, but are built?
That's... an impossible task. All ways to identify a machine in a network are dependent on the machine itself — if properly configured, I can create a machine that can not be told different from another machine.

Just extract the device certificate from one device and store it on another. Problem solved.

Extracting data from the TPM or equivalent stores in ARM devices is also not impossible, as the DRM-breaking community has shown with extracting keys from TPM-based DRM.
This list doesn't appear to include sites that use a CNAME setup with CloudFlare -- i.e. sites on the Business or Enterprise plans that retain their authoritative DNS and use CNAMEs to point domains to a CloudFlare proxy.

There probably aren't many but with something this serious it could be important. I'm not sure how one would go about finding the sites that use the CNAME option. If it helps, they use a pattern like:

www.example.com --> www.example.com.cdn.cloudflare.net

Hacker News is one such site, but it's listed in the "notable" section (it's not in the raw dump).
A host that you control.
Τι site φτιάχνουν περισσότερο οι γυναίκες – fashionentry.gr
What is the point of professional sports?

The only benefit I can see is learning more about the human physique. But does that alone justify the scale and investment, or could that be had in cheaper ways?
Tim Cook has just been repainting Jobs's toys for the last five years. Cook's success is a testament to how good the toys were, but nobody wants Woody and Buzz Lightyear anymore.

I'm an iOS developer. I'm sure if Apple were making decent machines I would be more optimistic about my job. But the current situation is making me prepare for an escape route. I'm sure there are many others who feel the same, and that will have a knock on effect on the iOS world.
> therefore the presence of "useful math" is not an argument for or against type theory and classical foundations

I wasn't making an argument against type theory (although constructive analysis is quite different from classical analysis) but an argument against a weak argument against classical math. Useful math is very much an argument in favor of a foundation. In fact, it was the winning argument in favor of ZFC, when it was thought that intuitionism would mean radically changing analysis.

> Rather, the main thing is that type theory is just better for formalizing things

In mechanical proof checkers? Then say that type theory is a more convenient small core for a mechanical proof checker. But you're arguing for constructive math, and constructive math is significantly less convenient for proving many things (and constructivists openly acknowledge that).

> ZFC itself is mostly not.

Useful for what? Mathematical foundations are not used when doing math unless you're doing formal math. ZFC seems a lot more useful that type theory when, say, teaching mathematical foundations (which, to reiterate, don't really mean the actual foundations of math).

> I would like to see eventually many or event most things formalized, and for that we need fundamentals for more than justification.

OK, formalizing mathematics is a 100 year old dream and a noble one, but one that may not be shared today by most mathematicians today. Your argument would be clearer and less religious if you said: I want to formalize math mechanically, and currently type theory seems more convenient for that particular task than ZFC.

> but it's not like one cannot have gradation in philosophical appeal

Sure, but I don't understand the aesthetic gradation. Does a mathematical foundation become more appealing to you the more closely it constrains math to the physical? Why? Would a mathematical foundation that doesn't allow expressing speed quantities greater than the speed of light be appealing to you?

I would understand if you said you're an intuitionist, but the intuitionists really did have a problem explaining the effectiveness of classical math (which is simply invalid to them). Classical analysis coincides with constructive analysis on all physically observable propositions and is still easier to work with (at least currently).

> Also, it definitely helps to have computation at hand if we want to talk about feasible computation.

There is absolutely nothing wrong, missing, or inconvenient with how classical math models computation. Type theory or any other constructive math has no advantage there. It certainly doesn't make talking about feasible computation easier.
"Cloudbleed".
> I control a fleet of servers. I have a saltstack or ansible script. One of the steps in provisioning a new server is to pull library X from github.com.

Ansible gives larger and easier to exploit attack vectors than git.

And then, with pulling semi-random things from internets you have much bigger
problems with your deployment procedure. You should never ever download
a git repository with software, instead you should be using package system
supplied by your operating system.
It is laudable, and they definitely aren't going to get this level of concern from the Kingdom of Saudi Arabia Sovereign Wealth fund.
Hey! Super useful, thanks.

Quick question: news.ycombinator.com (as an example) is listed in the README as a potentially affected site, but I don't see it in the raw dump that I've downloaded. Am I crazy?
Isn't taking the antidote preemptively a valid form of prophylaxis?

What do you mean by contrasting the two things?
Same here … I have a few Google accounts and on most devices, I was logged out (and I use the same Google account usually more than once on a device, so today is going to be busy!).
Google/grr: GRR Rapid Response: remote live forensics for incident response
2014 Pagani Huayra – Jay Leno’s Garage
Technically, he was emphasizing how low the probability was, not the risk. Since the impact is pretty high in both cases (accepting a malicious object/mid-air collision), the risk (as a combination of probability & impact) is significant.
VX can be administered by untrained "assassins", or perhaps ignorant dupes, be easily smuggled across borders and have a very high likelihood of success. The DPRK tried to hide the evidence of the poison by attempting to prohibit medical access to the corpse, but it didn't work. Maybe they thought they could get away with it. Maybe they thought it was worth the risk of being exposed. Maybe they wanted to send a message. Who knows?
Insane growth before raising = maximum leverage, and the corresponding competitive pressure on the deal, plus asking for it. (and being in the right place/time)
Ok but lets say they let you do anything, what terms and structure?
Forget Clones, Now Worry about Daylight Robbery on Appstore
What do people here think about Susan's way of doing things? While I think most of her behaviour is valid and I'm impressed by her professionalism, I think she starts too fast to report people, which costs her political power to achieve her goals and makes people in HR more pissed off than necessary. E.g., being hit on by colleagues is a common thing that happens to women. But some can deescalate it without much problems. She didn't even try to deescalate it, just report it and be done with it.

It's a minor thing compared to all that which happened to her and I'm mostly thinking about it in terms of own career strategy.
If there's anything that I've learned over the years it's that you can have two seemingly related outages that are in fact completely unconnected to each other.