skysight-inc/HackerNews huggingface dataset:
15 to 25km/hr is a running speed of human, probably you meant 15 to 25 km/s here (actually, some meteorites hit atmosphere >70km/s). Seems like they decelerate pretty fast after that[0]:

"At some point, usually between 15 to 20 km (9-12 miles or 48,000-63,000 feet) altitude, the meteoroid remnants will decelerate to the point that the ablation process stops, and visible light is no longer generated. This occurs at a speed of about 2-4 km/sec (4500-9000 mph).
From that point onward, the stones will rapidly decelerate further until they are falling at their terminal velocity, which will generally be somewhere between 0.1 and 0.2 km/sec (200 mph to 400 mph). Moving at these rapid speeds, the meteorite(s) will be essentially invisible during this final “dark flight” portion of their fall."

0. http://www.amsmeteors.org/fireballs/faqf/
Could SpaceX's technology be used as components of a Space fountain?
Vacuum tubes and rockets capable of blasting down the tube with high precision could help make a Space Fountain in my opinion.
Happened to my phone too.Suddden alert without any explanation.
Some election systems let you rank candidates in addition to the party (e.g. Sweden lets you in a limited fashion)
A Glimmer of Light Against Dark Silicon
Indeed, I've heard the issue of low signal-to-noise ratio, but it's pretty irresponsible not to offer any real reward.
and the very next day almost everyone's credentials need to be entered again. to rehash to SHA-2?
Recruiter A to recruiter B: Well, I hoped this one would be sharp enough, guess we need to search harder for people that wont be careless with our company sensitive stuff laying around simply because someone told them to leave laptop behind and take a walk ...
Last time I checked, Hezner's DDoS "protection" basically meant they disconnected you from the network if you got an incoming DDoS. Has this changed?
Lady and gentlement: http://imgur.com/n4Qo0yb.jpg
GV may make decisions and operate completely independently from the rest of Alphabet, but that doesn't necessarily mean that Alphabet does not take into account GV's portfolio position in Uber, which is its largest investment. Waymo even hints as much in its Medium post: "Our parent company Alphabet has long worked with Uber in many areas, and we didn’t make this decision lightly."
Not quite. CloudFlare is available to users of Google Cloud, but Google services don't use CloudFlare.

The only exception I could imagine would be some service that was brought in as part of an acquisition but has not yet been migrated to Google's internal platform. Obviously not applicable to products like Gmail or other core G Suite apps.
List of affected Cloudbleed domains
I value a lot the existing versatility of my Macbook Pro, and lament that it falls short when it comes to 3D rendering in C4D/AE.

However, I’m aware that my case is abnormal. The only thing preventing me from owning a high-GPU Windows machine for certain kinds of work is that I haven’t yet figured out how to use it for rendering remotely, since I move around a lot and I can’t bring it with me due to the bulk. So far I’m just sticking to 2D.

If I were a stakeholder, I’d be against Apple trying to dominate the professional market. People increasingly have multiple computers for different tasks so there’s more win in focusing on whichever market has thicker margins.
Awesome mITX chassis
A Zimbabwean male teacher was gang raped by 4 ladies
This seems like one of those headlines that would have been a lot more interesting ten years ago.
> I doubt anyone is able to find an input that MD5 and SHA-1 both hash to the same value. It would significantly reduce reliance on a single hash function.

As was mentioned in the original collision thread, concatenating insecure hash functions has fundamental weaknesses: https://www.iacr.org/archive/crypto2004/31520306/multicollis...
Problem most often is that after you take cover, you forget to ask that question.
15.6 million yen ~ 138 K USD
There's a widespread effort in USA to teach calculation using multiple algorithms (thanks to Common Core), and the unsurprising result is that parents are howling mad about the "nonsense" their kids are being taught.
I believe Homebrew on macOS uses it for formulae (Ruby scripts to actually download and build the application)
It's not arbitrary. The gender and ethnic makeup of the tech industry are significantly divergent from the general population, and there is no job-performance reason for it.

It's not like it's the NBA, where you have to be a tall strong man to make the team. Anyone can program, market, manage, etc.
First of all, just try to be spontaneous and natural in whatever you do. It should not come across as you're trying too hard to be charming(even when you're!). Its there on your conscious and too much thoughts are not helping you. Meditation can help you control your thoughts & stay calm but at the end you have to put it into action. Stop being too analytical about things just be present in the situation and act accordingly.
A decade dormant Garfield parody channel just uploaded its magnum opus
[quote] iMac (built in monitor)[/quote]

It's not the built in monitor that's the problem, is the overheating with the assorted noise and possibly thermal throttling if you use it for something that actually maxes out the CPU/GPU.

Well, and the lack of expandability. While the portable MacBook Pro equivalents are about the same thing (look at Dell XPS 13 pricing), Apple right now has nothing for developers/power users on the desktop side.
That's what I use too :). I also highly recommend it. I would strongly recommend binding either escape or ctrl to caps lock on every keyboard.
If you setup TOTP (Authenticator) while this bug was out in the wild your shared secret key could have leaked. SMS would actually be safer than TOTP in this scenario.
reminds me of https://ncatlab.org/nlab/show/computational+trinitarianism
That's because, AFAIK, no any meaningful problems were solved by this algorithm yet. I'm not even sure it can make a Max(array) on its own.
Well HIPAA wouldnt allow your https traffic flow unencrypted through a shared proxy right? This means cloudflare couldnt offer that feature, so they probably didn't?

Just think about the HIPAA document describing a single endpoint of dozens of sensitive datastreams, decrypting and then encrypting them all on the same machine, a machine that does some random HTML parsing for snippet caching on the side.

I don't see that passing review, but perhaps I'm naieve..
I also got logged out of Google on my Android phone yedterday.
How much faster is a cpu from 2012 and a cpu from today when you compare them by single thread performance @ 3 ghz.
Can you link to some of the references you cite? That seems like an interesting read.

As for computability being a physical notion, I can't speak to the motivation of Church and his students, but I do know that there are characterizations of total computable functions in domain theory which make no mention of physics. The intuition about computable functions is that they are precisely the functions whose output for any given input depends only on a finite part of the input. The really interesting thing about the Church Turing thesis is that there are so many different models of computation that capture precisely this idea (the surprising part is that these very simple models are expressive enough to cover all computable functions).
It's madness. I keep saying it, but this is basic UX stuff. Even using JIRA lately has become painful as components bounce all over the place while they sling in code asynchronously with no UX indication. Save a sub task and watch as the whole page jiggles about like it's trying to avoid being clicked.

I will get you, edit button. You cannot escape my patient pointer.
> Wow, Linus raises an entirely different issue which is that the PDF-based attack can't and won't work on git at all. Due to length prefixing it is extremely difficult to insert some nonsense into the middle of a git object which is how this attack works on PDFs.

Please note that the shattered-{1,2}.pdf files both have exactly the same length. And even with cleartext it is easy to pad passages so they contain the same amount of bytes. See how the quoted paragraph above has exactly the same number of characters as this one.
So the comments and cross-linking is cool... But maybe comments shouldn't hit the frontpage? Its looking a fair bit confusing at the moment.
It's not the responsibility of anyone except the police to police those sites. Cloudflare aren't providing those attack sites with an attack vector, they are just serving their webpages. The post office isn't responsible for policing blackmail letters sent through the mail.
> Some old IBM environments initialized fresh allocations to 0xDEADBEEF, which had the advantage that the result you got from using such memory would (usually) be obviously incorrect.

On BSDs, malloc.conf can still be configured to do that: on OpenBSD, junking (fills allocations with 0xdb and deallocations with 0xdf) is enabled by default on small allocations, "J" will enable it for all allocations. On FreeBSD, "J" will initialise all allocations with 0xa5 and deallocations with 0x5a.
There must be something wrong with the way you choose companies to work for. My employers were pretty low on this kind of drama.
Is there any kind of report or ongoing investigation blog?
No. Just coincidental timing.

https://bugs.chromium.org/p/project-zero/issues/detail?id=11...

Gmail doesn't use cloudflare.
No, it's keepassx on my laptop. I don't trust my passwords to somebody else.
interest paid on US debt relative to GDP is at multi-decade lows https://blogs-images.forbes.com/larahoffmans/files/2013/01/f...

The US dollar is unique because it's the world's benchmark of wealth. The Forbes 400 list is benchmarked in dollars, not Yen or Euros. The US dollar is not only a reserve currency, but everything (such has oil, gold, etc.) is denominated in US dollars, not Euros, Francs, Pounds, or Yen. This allows the US to persistently run trade deficits without hurting its 'wealth', unlike other countries that wold lose wealth in the form of high inflation and currency depreciation if they did the same. This makes the debt clock almost meaningless, and had someone in 2000 sold short US treasuries in anticipation of high inflation, they would have lost their shirt despite the national debt surging since then.
There is this misconception among HN folks that a developer is a UNIX guy, get real there are many kinds of developers.

Many of us, developers, don't care 1 split second if the OS we are targeting has any kind of UNIX support.

Mac is still a good platform for developers writing OS X, iOS, tvOS and watchOS applications.
According to https://wiki.hetzner.de/index.php/DDoS-Schutz/en, they're using Arbor and Juniper kit
You miss the point of the story. The story is about "calculating" vs "thinking", and how refusing to think holds one back.
Sort of. It does not improve brute force resistance in a meaningful way, but that is not the purpose either. It protects against one of the hash functions being broken.

Let us assume that we have 2 160bit hash functions, and one is broken to the degree that we can find collisions in constant time. This now means that we can break the combined hash in 2^80 rather than 2^80 + 2^80. The total brute force complexity was not improved, but the reliance on either hash function was.
Today, all my Androids required me to reenter my password. May be related to the Google Accounts problem. Is there any more info about it?
It would be amusing if it wasn't so unsurprising.

The article neglected to mention that neither side wants to actually fix the problem, but both sides want to gain an advantage under the guise of fixing the problem. It's like players arguing calls in contemporary sports–it's not based on what's correct, it's based on trying to win at all costs.
Archicrapture: diagrams that illustrate nothing
Because for inclusion into upstream git it has to be done in some at least somewhat backward compatible manner, which is not exactly trivial.
https://en.wikipedia.org/wiki/Duopoly
i dunno...part of why i use Linux or MacOS is the knowledge that under the hood they're well designed.
With Windows, no matter how good it looks, I feel like it's an ugly system, not to mention insecure.
zram has worked fine on my chromebooks. This is with running multiple chroots - and I have hit the oom killer a number of times (when even zram swap wasn't enough).

Until you actually run out of memory, zram seems very much a set-and-forget type of thing. No babysitting required.

tl;dr: it does what it says on the tin, and ... with minimal cpu impact.
Moore's law is not about single thread performance, and attacks like this are easily parallelized anyway. Not to mention that fixing them at 3Ghz is just trying to coherce the conslusion to be that we have seen little gain in the last 5 years.
Why did you refer to it as a "'million dollar' workup"? Can you explain the costs?
Fasting diet regenerates diabetic pancreas
I'm not from the US but don't IDs require proof of citizenship? I mean, if an illegal immigrant were to try to get a driver license wouldn't they have to prove that they were legally in the US? Or can anyone from any country take a driving test and get a legal American drivers license?

If the later, then I can understand why people are against requiring such an arbitrary form of identification.
Well, I don't hear too often about a fleet of servers running MacOS
(because this branch of comments started with provisioning in a fleet of
servers).

Also, from rants I hear about Homebrew and its breaking random libraries on
upgrades, I don't think it should be mentioned as it was state-of-the-art or
something.
I don't think that's how averages work. But it's true that relying on the birthday paradox, you can reduce the average. I was just trying to compute the "cloud" cost of 110 GPUs for 1 year (or the equivalent for a day, assuming this is embarrassingly parallel).
Google’s New Tool to Weed Out ‘Toxic’ Abuse of Online Comments – Ie. Censorship
Oh come on, there are plenty of reasons, it's a case of whether they affect you enough personally. Telemetry, closed-source kernel/base system, Microsoft's history of nasty practice in the computing industry, E&E, having to pay money vs. free as in beer, outside of the VS ecosystem a generally poor development experience.
I know a few video pros who have switched their edit systems to PCs. Adobe Premiere has run better on PCs for a while now.

Anyway, their personal machines are still all Macs, iPhones, etc. Different products for different uses.
> Then get an Air or a Pro. Or a Dell, or a Lenovo

Exactly! And that's the entire premise of the original article, people who used to be highly satisfied Apple customers are leaving for other, more suitable hardware after feeling that Apple is neglecting their needs.
Does this use live data? Would a site be positive even if it, after the publication of Cloudbleed, migrated away from Cloudfare?
A really critical thing that hasn't got much attention is that shortly before leaving Waymo, Levandowski had a meeting with senior Uber execs(!). The day after the meeting, he formed 280 Systems which became Otto.

The implication in the filing is that Uber planned this with Levandowski, and he only created Otto as a plausible corporate vehicle for developing the LiDAR technology before Uber acquired them. Given what we know about Uber and the assertions in the complaint, this sounds entirely plausible, maybe even likely.

https://drive.google.com/file/d/0B7dzPLynxaXuQjY3dkllZ2ZKb0k...
"...and could maybe avoid or lessen the impact of this fiasco."
This happened to me also. And: All the apps I used to authenticate, are gone (eg. IFTTT, Unroll.me, …).
I'd be fine if each state requiring ID to vote provided free licenses. States run elections, so it'd make more sense to pass on a federal ID card and just allow states to make their own should they require ID to vote.
Ask HN: How to exit from startup with incompetent majority co-founder?
*throwaway for obvious reasons...

I joined a start-up as a co-founder recently (gonna be light on the details to protect others involved). The CEO who I thought knew the space, judging by past experience, turns out to be amazingly incompetent (my fault for not doing more due diligence). S/he doesn't listen to world class mentors we have, leaves meetings after consensus for strategy and next actions reached and then does what s/he intended to do anyway (completely opposite what we discussed), takes potential revenue source options off the table because s/he wants "to build another app for that" (under a different company of course), asks the most basic questions about the space that even the other non-specialists in the room can answer, doesn't understand the tech behind the product and reminds everyone s/he are not technical constantly (as a way to basically say they don't care and they're not going to try understand even though we're a tech company). Judging by their CV it never occurred to me that they wouldn't have picked up an passing understanding of tech and space purely through osmosis.

Needless to say I'm not sticking around though I would like to protect myself and others I work with as I make my exit. It's important to note that we have a small investment from a world renowned VC and I'm concerned reputations of some of my peers could be unfairly sullied by this whole situation if not managed accordingly.

Anyone had a similar experience? How did it play out? What did you do and what would you do differently in hindsight?
Not necessarily.

If they just keep reusing a buffer and forget to clear it in between requests there is nothing automated that would find it.

Bounds checking languages would not help either - they would only work if they delete and reallocate the buffer on each request, since that's slow it's unlikely anyone would do that.

They probably wouldn't even clear the buffer, instead they rely on keeping track of the length of data in it, so any errors in there would be a problem.
how can her experience with lyft be any better? most times the drives are using both services...
What happened to Mit spinoff solidenergy – solidenergysystems.com
If I recall correctly they were supposed to come out with a battery half the size of the current smartphone batteries in 2017. Haven't seen or heard of any device carrying their tech.
I won't take the initiative of changing passwords, and I will only be doing it for services that ask me to do it.

In my opinion, if my accounts get compromised because the provider uses Cloudflare and leaks my data all over, it's their fault, not mine... It's not my job to guess which services are using Cloudflare, which ones were affected... and further, if my account gets compromised, others presumably will.

(PS: Of course you may need to change passwords if you reuse passwords from one service to the other, but obviously you shouldn't be doing that in the first place.)
Airbnb for foreign language learners. Meet in person with native speaker
shit, you just opened my eyes a bit. I woke up, saw 2 notifications about logging in again (got 2 accounts registered on my phone), and just typed the passwords in without second thought. Never occured to me that it could be a fishing attempt
Oh cool I'd not heard of this before but it looks awesome. Good work
I believe you are mistaken. Apple has certainly courted scientific and other developers before.

Here's an article about when they stopped targeting science.

https://www.macobserver.com/tmo/article/apple-drops-science-...
You think? With what, the chinese clones?

I don't mind using macOS, it's a pretty nice experience, definitely nicer than windows but when I buy an Apple machine the thing I'm buying is definitely the hardware and I'm not convinced the clones do a good enough job of matching that, can I get 14 hours of battery life from the leading air-clone?
> The length field makes the attack significantly more difficult. In the publish attack, you take 2 fixed input and prepend special data to make the collision.

That's not how the attack works. Not at all.
Wall of texts in this lovely page [0] are set of good reasons to consider before switching to Microsoft. If nothing, EEE [1] is.

[0] - https://en.wikipedia.org/wiki/Criticism_of_Microsoft

[1] - https://en.wikipedia.org/wiki/Embrace,_extend_and_extinguish
from wikipedia [1]:
- Cloudflare was ranked in the 7th rank among the top 50 Bad Hosts by HostExploit.[41] The service has been used by Rescator, a website that sells payment card data

- Two of ISIS' top three online chat forums are guarded by Cloudflare

- An October 2015 report found that Cloudflare provisioned 40% of SSL certificates used by phishing sites with deceptive domain names resembling those of banks and payment processors.

and so on... WTF is wrong with those guys? money-first approach?

[1] https://en.wikipedia.org/wiki/Cloudflare#Criticism_and_contr...
A fork could definitely cause some temporary confusion, but wouldn't an ETF just be tracking the sum of the value of the forks? At some point they'd need to pick a side, but in the meantime they could just buy/sell equal amounts of the forked currencies. Once they do pick a side they could either sell the other side of the fork, or allow withdrawals (like Coinbase, etc did with ETC).

As long as the rules are laid out ahead of time I'm not sure why the SEC would object.
There was almost zero "amazing" news from Apple while Steve was alive. The vast majority of Apple keynotes were "this year's machine is a bit smaller/ faster/ thinner etc.

And a lot of the very successful products were panned when they came out, including OS X, the iPod, the MacBook Air, etc.

Most of those only took off after a few iterations and changes. The iPod only took off after it went USB for Windows. The iPhone only took off after it got 3G and the App Store. The MacBook Air only took off after a redesign and big price drop.
https://www.howtogeek.com/206620/how-to-automatically-reboot...

I think complete online based bot attack is happening write now targeting a particular device vendor of google. That's why the even internal router of gmail got reset.
This could easily happen in Go as well. All that would be needed is to reuse the buffer in between requests, and rely on the buffer length instead of clearing it.

To make it safer you would need to deallocate and reallocate the buffer for each request, but that might be slow. Doing that would fix it for Go, or for C, it would be the same either way.

So I'm not convinced that using Go would have helped here.
What about that wireless mouse and how you had to have it on it's back to charge it?

Or the apple pencil?
Yes. I would like to see a law passed that required states with voter ID laws to hand out free if to everyone by mail.
Baahubali 2 – The Conclusion – Motion Poster 2 – Prabhas
Oh, good old EEE. So that's why they open sourced and redesigned .NET Core and C#? To extinguish it?

Come on.
Yes but with all the people and even automated 3rd-party scripts making use of archive.is, it is practically a spider.
Ask HN: If HN were a business, how would it be monetizing?
Are the Chinks worse than the Russkis though????! /s
Buttflare.