skysight-inc/HackerNews huggingface dataset:
You asked for a reason, not for a good reason.

malloc/free were designed around 1972. That was a time where performance was much more important and security concerns didn't really exists.

Modern systems, like Go, do zero-out newly allocated memory because they do consider a bit more security to be more important than a bit more performance.

But changing the defaults of malloc/free is not really an option and it would probably break stuff.

Especially on Linux, where, I believe, malloc returns uncommitted pages, which increases the perf advantage in some cases.

Security conscious programmers can use calloc() or write their own wrappers over malloc/free.
We're working on getting a full list up here: https://github.com/pirate/sites-using-cloudflare

I'm currently just searching the Alexa top 10,000 doing DNS scraping, but I'll updating it with reverse resolves from cloudflare.com/ips/ next.
There's a bit of a theme in these comments that make it appear that the founder-investor relationship should become a suicide pact in the face of problems.
> A mandatory filter run on the TV News Archive might catch a famous song used in a political ad or at a campaign rally, and determine that such material must be removed.

Imagine when that becomes a strategy. If always have copyrighted songs playing in the background of speeches you wish future control over, you can just sue to get those speeches removed over copyright in the background, and the removal propagated to filters everywhere.

I like my instant revisionist propaganda with The Beatles playing in the background.
Don't bother, it's obvious they're not a pet owner and don't understand the sort of companionship one can have with pets.

When I first got my cat (for mousing) I was shocked at how quickly I grew attached to her. I had her about a week and she found a way out of the house, I searched and searched and searched and was about to let her go emotionally when I found her, and I was extremely happy.

And I had only had the cat a month, and no I didn't live by myself either.

You could use the same logic this person is using to describe a parents relationship with their child as well. It's just someone's opinion who has never owned a pet.
I started reading to know what's wrong with PGP, but it very quickly escalated to the discussion about making educated bets about cryptography as a whole. I think this is hugely important topic and it is a real shame this is not being discussed more. Maybe security people a more conscious about that (I surely hope so), but general public doesn't seem to be. And by "general public" here I actually mean self proclaimed paranoids and not your grandma or a girlfriend. We talk a lot about if something is proclaimed secure by so-called experts, about theoretical weaknesses of Telegram or something, monitor important 0-days, buzz about how bad it is to give all your private data to facebook or google and how fucked we all are. But we rarely seriously talk about who our adversaries really are, what exactly we are trying to protect and if we're using the right tools for that. About making educated bets. And in the end of the day, this is all it is actually about — making educated bets. Because not all our data, not all our accounts are equally important, and they are not equally important to the different kinds of adversaries. So the only way to be somewhat secure is to recognize, that there's no absolute security and we cannot protect everything. So better start taking it consciously and focusing on what's really important.
too bad IP geolocation is pretty bad. if you're lucky you'll get the city correct but that's about it.
I'm compiling an unofficial list, hopefully they'll release an official one though:

https://github.com/pirate/sites-using-cloudflare

The issue is they have to get permission from their customers before releasing affected domains.
Even as a long-time holder of bitcoin, I don't see how the Coin ETF will be approved. There is so much risk in the ETF that your investment may be wiped out instantly. I wouldn't approve it.

My expectation is that it will be rejected, and the price of bitcoin will crash back to about USD$700 or so, and continue its long march upwards. It's important to recognize that that crash would still mean that bitcoin has almost doubled in value vs the US dollar in the past year. It has doubled in value over the past six months.
Off topic, but I find it really impressive that Google packed their system into a 500 millibit binary; wow!

Seriously, people, units and prefixes are case-sensitive.
I haven't found a clear answer to this:

CloudFlare has multiple SSL configurations:

> Flexible SSL: There is an encrypted connection between your website visitors and Cloudflare, but not from Cloudflare to your server.

> Full SSL: Encrypts the connection between your website visitors and Cloudflare, and from Cloudflare to your server

(I'll add Full SSL mode still involves CloudFlare terminating SSL (decrypting) before re-encrypting to communicate to your server)

If I am running in Full SSL mode, is (or was) my data vulnerable to being leaked?
The battle is over, and not newsworthy outside of small vacal subreddits that statistically few people read.
Up until 2015 there was a related but more consequential issue that made it extremely hard to prosecute crimes committed on reservations by non-Natives. Tribal governments couldn't prosecute non-Native offenders, instead those crimes fell under federal jurisdiction--and the federal government itself is generally uninterested in prosecuting petty crime. [1] Off-reservation offenders would deliberately go onto the reservation and target the population there because they knew that it was practically impossible for them to be prosecuted, allegedly. Native American women experience sexual violence at much, much higher rates than the general population at least in part because of the jurisdiction issues. [2] VAWA passed in 2013 though, closing the loophole as far as I'm aware. [3]

[1] https://www.theatlantic.com/national/archive/2013/02/on-indi...

[2] http://www.nytimes.com/2012/05/23/us/native-americans-strugg...

[3] http://www.huffingtonpost.com/2015/03/06/vawa-native-america...
There's a lot of stuff in between those two extremes. As someone that operates an HTTP accelerator and caching server.
https://www.justice.gov/usao-wy/criminal-division/violations...

Its a federal enclave and you get charged under federal law in the closest federal court.

Other than federal enclaves, if you are not a tribal member a lot of crimes on reservations are handled by the federal court system. You get to deal with Federal Marshals and the FBI.
...and then after that, do also read Flash Boys: Not So Fast by Peter Kovac. Not necessarily for Aleynikov's case in particular, but because it's healthy to see both sides of the greater narrative that Lewis unfolds.
HIV patients left 'virus-free' with no need for daily drugs in vaccine trials
Yup. Particularly /r/ama is a prime example of being compromised by admins.
Full SSL requests still terminate at CloudFlare, and would still be vulnerable. It's just that CloudFlare's connection to your origin is also encrypted.
Anthony Levandowski was targeted back in 2014 by protesters against Google's military work with Boston Dynamics.

https://arstechnica.com/business/2014/01/protestors-show-up-...

http://www.berkeleyside.com/2014/01/22/activists-target-goog...
"civil disobedience"

LOL. Give me a fucking break. Don't you dare use a term from the civil rights movement in reference to Uber.
abritinthebay's answer is the same thing I'm doing. Webpack can give you a hash on each use, which allows you to:

* add that hash to the filename(s) of your generated assets;

* print out that hash to a file;

* fetch the hash from that file for use in your helpers/views, to call the correct assets.

The following blog post is a good place to get started.

http://pixelatedworks.com/articles/replacing-the-rails-asset...

Whether or not this is better or worse than your current setup, I'm not sure. It's probably equal levels of duct tape either way. Printing out the hash and rolling your own solution gives you a bit more power and flexibility though.
Really? This has the opposite effect on me. Uber and Travis were given plenty of opportunity to change and they didn't take it so the Kapors are taking action. We need more investors like Kapors and less amoral profit first and only investors.
I do agree, it seems like right model, and will have a large impact.

Between automating labor, economies of scale in purchasing, and access to more efficient technology(like acoustic liquid handling) ,etc - isn't it just a matter of time before cloud biology becomes quite cost effective and combined with other benefits - it would be the only way that makes sense to do research, so funding will naturally go there?

Also - do you see a way to add the extreme versatility of the biology lab into a cloud service ?
Would you have celebrated the assassination of Hitler if one had been performed?

I know that's a stretching comparison, but it's not too far off. Dude was garbage, deserved EXACTLY what he got. Hell, NK even runs concentration camps, so it's really not even that wild of a comparison.
Yes, I'm just editorial (and until recently design). Ken is our sysadmin and, as it happens, got txt.fyi back on its feet today when HN blew it down! He's brilliant!
Nice link, this is a great read for anyone interested in endpoint security research.
Oh, absolutely. Baidu's relationship with their host nation should be a source of concern for us all. I've heard some interesting and unusual stories.

But they're probably aware of this issue and know enough to go looking to purge their caches.
Signs you are about to have a bad time: Tavis Ormandy publicly tweets that he urgently needs someone from your security team to contact him, and no, the public disclosure form won't do.
Zeroing on malloc and/or free would not have prevented this type of error, since the information disclosure was due to an overflow into an adjacent allocated buffer.

However, zeroing on free is generally a useful defense-in-depth measure because can minimize the risk of some types of information disclosure vulnerabilities. If you use grsecurity, this feature is provided by grsecurity's PAX_MEMORY_SANITIZE [0].

[0]: https://en.wikibooks.org/wiki/Grsecurity/Appendix/Grsecurity...
Tricking two people into using binary chemical weapons to kill someone under the guise of it being a prank sounds like something out of Hitman (https://en.wikipedia.org/wiki/Hitman_(series)).

I find it highly unlikely this kind of high-profile assassination would be left up to unwitting amateurs to carry out, though.
FWIW, I admire you for how you're handling this, taking the grunt of the storm all by yourself and not throwing anyone under the bus. Tip of the hat to you and may better times lie ahead!
How did you find that IP?
Typical garden-variety endpoint security/IT management solutions such as Crowdstrike or Casper with a kernel module are capable of all of that.
But this guy was an enemy of North Korea. That's why he was assassinated...
A 1U physically doesn't have room for 8 PCIe cards, although come to think of it you can fit 10 U.2 SDDs.
The teaching one is interesting actually, it's almost totally explained by ending the requirement for women to retire from teaching when they marry.
I think this site is the easiest to show bitcoin value charts in various time-scales.

http://data.bitcoinity.org/markets/price/2y/USD?c=e&t=l

And you can download the data-points if you want.
Steam Audio: Spatial Audio Tech Announced, Beta SDK Available Now
I'm seeing it more and more. I just saw recently that you can buy gold and silver from Provident Metals using Bitcoin.
I have tried and failed to reproduce some findings on ML papers. Sometimes graphs are being significantly smoothed or filtered which makes results look better, other times core components of algorithms are not described and the findings cannot be reproduced at all.

Source code, or at the very least proper pseudocode, should be mandatory for all published computer science research.
He was Un's half brother. First line of the article.
Thanks. Wish they had explicitly stated that all SSL modes were affected (unless I missed it...)
I think every gallery was different, but every gallery director was super attentive, people took the task of gallery directing super seriously as it was a pretty huge honour. For the years that I did it, I didn't have a life outside of IRC/deviantART period except to go to high school, and even then I would bring my laptop to the library at lunch + breaks and find an RJ45. I also slept for about 3 hours a night during those years as I was in the UK and much of the community was in the US.
Although that is unfortunately currently being broken by a spam attack.
While we're at it, every SHA-3 finalist were deemed "good enough", so we now have more than 2 such hashes. (I personally love Blake2b.)
No, but the burden of videography is a lot higher than the burden of writing a paper. In fact, a paper isn't written for every study, so in order to write a paper, you'd have to take video of every study just in case one of them is used in a paper in the future. It's a much higher burden than people want to believe. Add to that the fact that most animal facilities won't add cameras unless you force them at gunpoint because historically, videos of that sort make for targeting by protest groups.
I don't understand why the segwit softfork and a block size increase would have to be mutually exclusive.

As segwit generally improves the protocol (makes it more efficient, fixes a transaction malleability issue, increases capacity and gives way to proposed future improvements) and doesn't require a hardfork, I think it makes sense to apply that first.

And if with segwit and all the improvements it enables the capacity still doesn't prove to be enough for the future growth, we can hardfork to dynamically increase the block size.

But for now, we need to do something. Why not do the thing that's simpler to put into effect and provides more benefits?
I agonized over this, then forgot to fix it! I promise to do so soon
Revcontent acquires Rover for better content recommendation tech
Using a document description language for general application development is and remains INSANE.

The browser is an atrocious, non-sensical platform that was invented to display Hypertext, not to run apps.
Now look what we got?
5 new JS frameworks per month, because of some minuscule, often fabricated productivity gain.
Various competing improvements to make CSS somehow manageable and an untyped, arcane and hard to optimize language on top of it.
And we still struggle to make decent looking and performing apps.
It's stupid.
Been in 4 SV companies and only some FT's work more than 40. Usually the ones that do are leads or really invested in the company.
I believe both of my comments make it evident that I'm perfectly clear on this. In fact, I don't see how it would be possible to argue what I WAS saying without understanding this. But, hey, I've been wrong before; I will be again.
> Is yelling abuse at people a violent act

No, it's an abusive act though.

The simple answer to your question is: The definition of violence by the courts is physical.

And it's probably a good decision. Otherwise the rabbit hole will take us bad places.
It could have been an accident that they survived. In this case the assassins dying along with the victim is a feature, not a bug.
Show HN: V (npm install v)
It seems like the reasonable thing for Google to do is to clear their entire cache. The whole thing. This is the one thing that they could do to be certain that they aren't caching any of this.
Definitely smart thinning, but not sure what makes it Bayesian.
I wish they used more specific language than the blanket term "scientists". Reproducibility is highly field-dependent. In organic chemistry, for example, the journal Organic Syntheses only publishes procedures that have been checked for reproducibility in the lab of a member of the board of directors. http://www.orgsyn.org
A few years ago someone published a paper in a highly esteemed journal that was largely thought to be bunk (oxidation of alcohols by sodium hydride). A prominent blogger live-blogged his (unsuccessful) attempt to reproduce the experiment, as did others. The oxidation was in fact due to the presence of oxygen, not due to sodium hydride. The paper was retracted.
DBS Bank is hiring Full-stack developers to be based in Singapore
Shill much?
I promise that so long as I can pay my domain name dues and maintain backups, the stuff posted to it will remain online e forever, even if posting new stuff has to end for whatever reason
What if you took the information that doesn't fit in the paper and publish it on the web?
Video Pros Moving from Mac to Windows for High-End GPUs
> It is simply NOT TRUE that you can generate an object that looks halfway sane and still gets you the sha1 you want

This was his point, and it's still true. Generating a specific SHA-1 hash is still not feasible.
Clearly, Linus didn't know at the time. If he'd know, he would have chosen another hash in 3 seconds —no additional complexity, no additional effort involved in not choosing a hash the security community starts to have doubts about.
Show HN: mod_log_header_size
It's interesting that there was another recent Cloudflare bug caused by using an "==" vs "<=" or ">=".

It's good to know that programs can get into states that you don't expect.

https://blog.cloudflare.com/how-and-why-the-leap-second-affe...
I'm fairly sure that it's Discord.
Yeah, and has been living in exile since before Kim Jong-Il died.
If it only works on a Wizbang 200 and cannot be reproduced with the Doodad 3000 then it probably doesn't work or there are other variables missing from their results. Specialised equipment should not affect results (proving that equipment is broken has some value though).
Reports of ICE “showing up” to valley companies and checking H1B paperwork
That's not the metric by which ETFs are approved or denied.
If we are talking about V-Series Agents, we might as well talk about the secret Soviet Program to develop additional V-series compounds[1] that would be undetectable by the west. It is important to note that there are many vectors of entry for a V-series agent, and in this case, evidence points to an atomized version, as opposed to the dermal administration which is more common among this class. An atomized version targeting the respiratory system and not the dermal would explain why two women attempting to aid "with bare hands" would not have been harmed.

Beyond VX, there exist a plethora of other analogous chemicals, namely the G-Series[2], VE[3], VG[4], VM[5], VR[6] and VP[7]. A notable commonality among these compounds is that very little is known about their effects outside of military research (ie not shared).

Given the military nature of these compounds, there is a reason to believe that this was a military assassination.

[1] https://en.wikipedia.org/wiki/Novichok_agent

[2] Sarin is a G-series agent https://en.wikipedia.org/wiki/Sarin

[3] https://en.wikipedia.org/wiki/VE_(nerve_agent)

[4] https://en.wikipedia.org/wiki/VG_(nerve_agent)

[5] https://en.wikipedia.org/wiki/VM_(nerve_agent)

[6] https://en.wikipedia.org/wiki/VR_(nerve_agent)

[7] https://books.google.com/books?id=DQw2hVGe0aMC&lpg=PA72&ots=...
Ah, yes, things like JOVE [0] are definitely useful but they don't seem to scale to the sheer number of protocols that need to be documented (eg a single JOVE publication is exceedingly expensive). I have also heard from people who have tried to record video of themselves doing a protocol is that it is very hard to make them understandable for someone else. That said if the 'viewer' is highly motivated videos of any quality could be invaluable. Sometimes it is just better to buy the plane tickets and go directly to the lab of the person who can teach you (if they are still around).

0. https://www.jove.com/
You also have to carry the weight of the corresponding track to at least a couple thousand feet to jettison it safely I bet. It's also at the point where the rocket is at it3 heaviest so the assistance it could give would be really limited.
Mostly yes, although Bitcoin probably has more exchanges and more liquidity than other cryptocurrencies.
>> Which leads me to question why is this post interesting to HN? Is it to show how Linus aimlessly speculates and gets his guesses wrong?

I think it's interesting because it is another example of his basic attitude toward security, and a lot of people who should know better use Linux believing it is secure because "it hasn't been broken yet."
Former Yahoo here. These are legit people commenting on Yahoo websites. They are some of people who trust brand irrespective of what happens. Many have been with Yahoo for 10 or 15 years.

I personally know someone in early 50s who refuses to use Gmail. I joined Yahoo through a startup acquisition and left within in a year. Only thing I miss about Yahoo is free food. There was so much food and in SNVL campus you could see people spending time from 11:30 to 2:30 only eating food.

Despite that fact that a lot of people like to shit on Yahoo, they still have a good technology. I worked highly complex advertising systems that touch over half of entire web. I think lack of business knowledge and partly diversity favored managers is what brought down Yahoo. All cool tech talent left for Ama/Goog/FB/Flix et al.
"It's like some extremely popular remailer company accidentally put badly or barely shredded copies of handled letters into other people's envelopes. Strangers' sensitive info is potentially sitting inside unsuspecting mailboxes worldwide."
Memory safe languages aren't a panacea. There could just as easily have been a bug in the compiler or standard library with the same result.
Reddit still has value in niche subreddits. Do you play bass? r/bass will have conversations about techniques, beginner questions, pointers to bassists on youtube doing interesting things, etc. Think software defined radio is interesting? r/rtlsdr is the place for you. Etc.

There is a sweet spot where the subreddit has gained critical mass to sustain conversations, but haven't gotten big enough to draw in spammers and incite political arguments. There are thousands of such subreddits.
I'd say the risk of a fork of the thing that you're supposedly tracking, such that you might not even know what you are tracking anymore, is a serious risk that the SEC would consider to be a problem.

Don't get me wrong, I'd love for it to be approved. But for that reason, I don't think it will be.
"Interesting" is vague and subjective. Some work is boring as hell but the results provide the foundation for things that are truly "interesting".
> Law Enforcement Using Facebook and Apple to Data-Mine Accounts of Protesters

Protesters or George Soros funded paid thugs and rioters? There's a distinction.
The ACLU opposes it for a number of reasons [0]. A lot of objections relate to the potential for surveillance.

[0]: https://www.aclu.org/other/5-problems-national-id-cards
That is something they would consider.
Anyone know of a way to google for your passwords (assuming you have strong, unique passwords) to see if they've been exposed anywhere, without exposing them?