skysight-inc/HackerNews huggingface dataset:
Plausible deniability? "How could we have known the flaw was exploited by NSA and FBI? We didn't know about the flaw at all!" When, actually, it was designed by NSA, before they created CF as an attack vector. Eventually the vuln is discovered as was inevitable, but because the caches were theoretically "public" no one notices all the drone strikes and parallel constructions correlated with CF use.

I don't actually believe that, but it isn't an unreasonable theory.
Sci-Hub: removing pay-wall barriers in the way of science
That would be Sergey Aleynikov [0]. I'd recommend reading Flash Boys by Michael Lewis [1], who covers this story in detail. Sergey's case seems much more nuanced, and if I remember, Lewis takes his side on a number of issues.

[0] https://en.wikipedia.org/wiki/Sergey_Aleynikov
[1] https://www.goodreads.com/book/show/24724602-flash-boys
CF's infosec team is very, very good at their jobs.
This reminds me of Arrested Developments Faceblock way too much
>Welcome to a future where only voices that broadcast their grievances loudly over social media get answered

Oh please. This has been the case throughout history. If you can get the attention of a higher up, by whatever means, you have a much better chance of getting what you need done.

Nothing has changed and social media has nothing to do with it aside from providing another avenue (albeit a more accessible one) to put pressure on those with the power to help you. People are people.
Just like why most filesystems don't zero deleted files.
I was prescribed oxycodone after getting hit by a car and my liver couldn't process the Tylenol in the pIll adequately and I was feeling nauseous and faint. I collapsed in my primary care doctor's office when getting looked over a couple days after leaving ER.

I decided to just bear through the searing pain than risk permanent organ damage.
Why don't you just login, then...? All of that just goes away when you only subscribe to quality subreddits that interest you.
Probably the best time to sell, actually. Buy when it crashes and stays "uninteresting" for a year.
Yep - that was the mount thing I mentioned in my prev' reply: We've not yet got around to mount support, but it is on our backlog and we're keen to get to it when priorities allow ;)
I'm glad you commented. I was sitting here racking my brain, trying to remember what book I'd read that involved Q codes. Then I saw your comment, and it was indeed Seveneves.
Good one! Checking HN/fb for hours must be some kind of flow indeed.
>The darknet markets certainly bring some demand, but it's high-velocity. You don't need to hold BTC, only transact in it.

Except that if you're doing something illegal you pretty much do need to hold onto it unless you have a way of laundering it to a national currency.
So if I clone this repo I can now access your API account? Might want to pull this repository from Github......
Kim Jong-Nam Was Killed by VX Nerve Agent, Malaysians Say
> where your employer will demand to inspect your social media, you need to act appropriately.

"Acting appropriately" in that case involves telling your employer to mind their own damned business.
Several years ago I worked on a security product that used git as a sort of tripwire-type database. Since SHA1 was considered inadequate for Real Security, we had to hack jgit to use SHA256. It took a stupid amount of work - the 160-bit hash size was scattered all over the codebase in countless magic numbers. But it worked.

The product was cancelled. I always wondered if the patch would be of any use to anyone.
I imagine there are more software people capable of programming their way through the problem than electrical engineers that can work their way through it.

An electrical engineer is also going to see the Uber name and expect Valley idiocy, while being a being a secondary concern for not being softwary enough.
And what if you fly somewhere outside the US ? still no Uber ?
I used to really enjoy coming to HN for some good tech/hacker/software news and to get away from the near ubiquitous political bullshit on th web, but over the last few months this site has changed for the worse.

I've had different accounts over the years since the beginning of HN, following pg, rtm, arc, etc. and I've never seen it like this. Differing opinions are what make discussions interesting, but this whole "fake news" horseshit Trump is pushing is just pure garbage.
Not NSA, but the CIA funds and operates In-Q-Tel[1]. They've funded companies like Palantir and Keyhole (which became Google Earth).

[1] https://www.crunchbase.com/organization/in-q-tel
The line between 'advocacy' and 'research' is not as clear as you suggest. There are plenty of people who will label any form of gun research by the CDC as advocacy:

"Timothy Wheeler, director of the group Doctors for Responsible Gun Ownership, said Congress had good reason to stop the CDC’s firearm inquiries. "It was what we call advocacy research," Wheeler said. "It was research done with a preordained goal, and that goal was gun control." Wheeler, voicing an opinion shared by many in the gun-rights movement, said the CDC has been "irredeemably tainted" by past controversy. "I don't have faith in them anymore," Wheeler said. [1]

So it seems that CDC is avoiding gun research in order to reduce the risk of having their funding cut in other areas. From the Washington Post again:

The agency recently was asked by The Washington Post why it was still sitting on the sidelines of firearms studies. It declined to make an official available for an interview but responded with a statement noting it had commissioned an agenda of possible research goals but still lacked the dedicated funding to pursue it.

But Republicans aren't interested in providing funding for dedicated research:

Congress has continued to block dedicated funding. Obama requested $10 million for the CDC’s gun violence research in his last two budgets. Rep. Carolyn Maloney (D-N.Y.) and Sen. Ed Markey (D-Mass.) have introduced bills supporting the funding. Both times the Republican-controlled House of Representatives said no.

If Republicans consider the CDC to be tainted, why not establish a new, independent agency to conduct research into firearms?

[1] https://www.washingtonpost.com/news/storyline/wp/2015/01/14/...
Welp, time to move and get a different IP again :\
Let's be honest. There are holes. More than we care to admit. The truth, if embrassed, could undermine the world's economy. It's just question of when.
And this is why making that yearly payment for your service actually makes me happy. :)
where's the ruby-to-brainfuck cross-compiler?
Neither of these are good reasons: I already talked about MALLOC_PERTURB_ (man mallopt) in my post and my naive performance tests, and we rarely get bad security holes based on data from deleted files left on filesystems.
+1. I often debated if Uber was better off with a CEO like Eric Schmidt. But I think ultimately in this business, you need a certain mindset to really go after establishment and entrenched interests.
Do you know who Mitch Kapor is? https://en.wikipedia.org/wiki/Mitch_Kapor
Getting Human Resources Right
The Internet will remain periodically broken until we put a cost metric on the breaking (and working) times.
How do you explain to your boss a glass of chianti classico on your desk in the morning? /s
I don't know anything about IPOs. What is left for them after taxes? Or are they charged only if they sale any of the shares?
Until they don't. Other betting sites have 'lost' everyone's coins.
[video] Developing the Developed World – Peter Thiel Interview
Fowler made accusations of fact. They can be proven or disproven.

She didn't say opinions like "they were meanies to me" or "they gave a promotion to a man when I was the better performer." In that case, people would likely decide who to believe based on their priors.

Instead, she made specific accusations that, if false, Uber could easily show as false. Note that Uber has not even done that. Likely because she can prove the claims are true, in court if necessary.
Just to be clear: is this a cert used for authenticating with Cloudflare's systems or just for encryption? If used for authentication, you need to ensure it hasn't been stolen and used before this was found by P0.
The assumption is there is no value in a system which is currently insufficient for use as a currency ecosystem, and doomed for obsolescence as other cryptocoins prove to offer objectively more effective feature sets.

Bitcoin is inherently deflationary as coin creation slows to 0.

This is exactly what makes BTC ineffective as a currency ecosystem and thus counter-productive for speculative hording. Speculative hoarders assume the value comes from limited supply, and so the problem is two fold; the system disincentives spending, starving the economy in paradox. Additionally, as speculators place their bet that BTC's value is derived from a limited supply, we see there are already numerous competitors with improvements over the BTC protocol, and many more sure to come.. so this supply is not limited at all.
Unencrypted over private fiber and unencrypted over the public internet are worlds apart.
Try "What is Mathematics?" by Courant et al.

However, you might be mistaken about language and problem solving being independent.
One hopes there would be fewer tech-bro founders needing minding, and that founders would model their management's sex diversity after their funders. Lack of more than tokenism in women and minorities is self-perpetuating, and unless you fix it at the origin, the statistics, never mind the motivation, of fixing it later are always pretty grim.
Yes, the victim can be a different site. Cloudflare's post mentions this:
"
Because Cloudflare operates a large, shared infrastructure an HTTP request to a Cloudflare web site that was vulnerable to this problem could reveal information about an unrelated other Cloudflare site.
"
https://blog.cloudflare.com/incident-report-on-memory-leak-c...
> there is often little incentive for a researcher to hide parts of their methods from their 'competitors' since, for example, my memory study is not about reporting but protecting a new technology

If you are protecting, not reporting information (e.g., about a new technology), why would you be incentivized to share it?
That has nothing to do with using fiber vs internet though.

EDIT: Original comment said he could pull content off Google results. To respond to the new one:

No, they're not worlds apart when you're on the backbone. They still go through other people's datacenters and that's what causes the problem - we're not talking about stuff that goes over wifi or corporate networks here - we're talking generally just big ISPs in both cases.
They could ban booters. But then someone else will say "but you allow <some other type of site>! They're clearly bad, you should ban them too". And so they do, and now someone else complains about some other site. Once you start banning sites for the content they hold, where do you draw the line? I don't fault CloudFlare for drawing it at the legal barrier (e.g. no CP).
Why would they check everyone's ID instead of just the people who looked like the person they were looking for? At least people who are obviously the wrong age and sex...
Your argument essentially revolves around "what are the chances I'll be compromised!?" rather than focusing on "What's the potentially affect of getting compromised" Most people with data or access rights which have several orders of magnitude of value relative to 8 hours worth of labor.

The decision to wear a seatbelt isn't driven by the probability of needing it, the decision is drive by the magnitude of exposure to an event where you would need it.
Downloading the PDFs [1] and comparing their sizes takes less than a minute. They're the exact same size. Yet here we have Linus making one bet after another that size has to be different for this attack.

Now to be fair, he also keeps repeating that he hasn't seen the attack yet. Which leads me to question why is this post interesting to HN? Is it to show how Linus aimlessly speculates and gets his guesses wrong?

--

[1] http://shattered.it/
Even though I am a huge command-line fan, I am not sure that "everything they are trying to do [in an IDE] is easily done in the command line" is entirely true ;)

While one can do at least as much, if not more, via a variety of command-line tools, the integrated build & debug workflow of a good IDE is invaluable to many. Esp. for those for whom learning a multitude of command-line tools, and syntaxes to drive gdb, profilers, etc. as a little costly/cumbersome.
Want to Know the Future? Most People Don't, Study Suggests
They switched lately from no-js-needed-ignore-those-fancy-kids to we-now-use-js

Imo worth rationalizing and explaining to their community
> One of our suppliers ... sent us an attachment (apparently inadvertently) of machine drawings of what was purported to be Uber’s ...

Ouch, this doesn't play well for the supplier either!

Presumably if Uber wins, it'd have a solid case against the supplier. If it loses, or while Waymo v Uber is ongoing, might there be a case anyway?
How about Cloudburst?
No, the CDC mission is public health, which is why the National Institute for Occupational Safety and Health for example is under it. https://en.wikipedia.org/wiki/National_Institute_for_Occupat...

And no, I don't agree that simply doing research is inherently advocacy. All you have shown is you suspect the truth disagrees with your beliefs which is something you should consider more deeply. Cognitive dissonance is a sign that something you believe is false and ignoring that is a bad idea.

PS: Thank you for acknowledging your above statement was wrong. I am going to assume it means you where not simply trolling.
Because as we know, the security industry isn't a firehose of fear about everything that isn't airgapped (and then airgapping itself). Security recommendations come so thick and fast that even security researchers themselves don't bother following them. Even the bloke in your link explicitly apologises for using Word for some things, and he's considered a saint in the industry.

What all the commenters here doing a hatchet-job on Torvalds are missing is that he's saying "show me the money"/"perfect is the enemy of good". The hatchet-jobbers are too busy doing the usual tittering over his language to actually absorb the point.
Probably this: https://en.wikipedia.org/wiki/Space_fountain
Why didn't you just shut it off first? You had FDE turned on, right?
Not the parent commenter, but I personally would support this if the ID card was mandatory and free to any resident citizen. If it was issued by states, the federal government would need to require all states to comply.

The REAL ID act was supposed to be a step toward this, but has been continually delayed as far as I know.
> Showing your ID isn't waging a war against voting rights, its straight up common sense like we have to do for every other thing in society. Many people find it surprising around the world that we don't check IDs.

I agree that it's common sense, but data often trumps common sense. Before you combat voter fraud you first have to establish that it's a real problem. To date no one has shown that it's a real problem.
You can actually manage/control Docker for Windows (upon which you can run Windows & Linux containers) from your Docker client running in Bash (or Windows) on the same box.

Inception ... noitpecnI ;)
This hypothetical scenario is muddled. OP is lamenting an investment decision (sell BTC, buy computer). It's irrelevant that he/she might have had extra funds (the second $2,000 of bitcoin in your example) that weren't part of that investment decision. OP probably owns other assets as well (car, stocks, patio furniture, etc.). They weren't part of the investment, either. They're irrelevant to this analysis.

Saying the computer was free is misunderstanding what "free" means. If the computer were free, he/she would have paid $0 for it and would still have the bitcoin.
Being a "team player" often is shorthand for being willing to tolerate a bit of moral stench for the sake of everyone's economics - or to ignore the odor as long as the team member's heart isn't in the wrong place. Not everyone would accept that definition of team play. If the investor had sent this letter without engaging in private attempts first, that would have been a failure of team obligation, I agree. That wasn't the case here.
"Congress" - noun

A place where even an obviously good idea with no downside gets no where because it doesn't have a big enough upside.
Sure, and Eric Garner, Michael Brown were resisting arrest, and Freddy Gray was just being transported.
> If not, then I'm not sure $10000 would have been either.

i'm given to understand that with at least fedex, there are magical cutoff amounts which change the handling of the package. qualitatively different things happen with something insured for $5000 than $4999.

so, yes, i'd be willing to believe that $10k might've triggered processes that would've gotten the package to you with less hassle.
List of domains affected by Cloudflare's SSL traffic leak
HaveIBeenPwnd must be having a great day today!
I disagree. Grammar rules are a very effective checklist for clarity and precision in communication, IME. Does the verb have a subject and object? Otherwise, it's not clear who should do which to what. The instructions say, 'turn it on'; does "it" have a clear antecedent? Otherwise, what are they turning on?

I would guess that the practical benefits are a big reason that they are the 'rules'.
There's a grand tradition of founders being fired/resigning once their companies grew up, in order for the companies to grow up more. Kalanick's resignation is likely the ideal way forward for Uber as a company; it will be very difficult for him to solve this problem as it's tainted his reputation.
Then you risk to lose all einstein work unless you have two einsteins at the same time in fact. Genious are scarce. And you could not publish nothing about comets for example, because this would be unreplicable until the next 20 years. Is not so simple as that.
I'm also seeing a ton from cn-dc1.uber.com with oauth, cookies and even geolocation info. https://webcache.googleusercontent.com/search?q=cache:VlVylT...
Make Your Own Microchips at Home
One of my Uber rides two weeks ago went completely nuts.
Both my and my drivers app screwed up at the same time and I was never picked up and then seconds later the app claimed I reached my destination.

You have to wonder whether something like this is implicated.
Rise of the Monk Mode Morning
Patreon

4chan used to use it apparently, don't know if affected

kik

Zoho CRM

change.org

Cloudflare itself, of course

Feedly
Monads are a class of hard drugs
You should be able to enumerate network connections on recent Insider builds ... or on Creators Update when it arrives in ... well ... "Soon™" :)
Announcing the launch of Milqy, an extraordinary creative studio
I don't respect a site like this. Instead of getting scientists to actually willingly upload their research for free, you are just infringing on the rights of the intellectual property owners.
Are these results hardware independent? Maybe it makes a difference on older machines, or different architectures.
Yeah, I also can only imagine what will happen if they start stopping everyone on the freeway and forcing them to take the body scanners./s
exactly, which makes splitting his positions from his administration's a meaningless endeavor.
Fowler's claims are statements of fact that can be easily proven if true or easily disproven if false.
Sorry for being annoying, but the text area says "Write." and the button "PUBLISH". I'd keep the same case and punctuation.
The problem is that in the U.S., we don't have a fundamental right to privacy. Constitutional guarantees of privacy are either specific (e.g., to practice religion) or indirect (e.g., search/seizure).

But I do agree that it should be a more broadly defined fundamental right.
"We also undertook other search expeditions looking for potentially leaked information on sites like Pastebin and did not find anything."

How comforting!
Because of the heat or something else?
I agree painkillers like oxycodone are a huge problem, but ironically, this is exactly because doctors are over prescribing them. If people had access to options like medical marijuana, I think we'd actually see less prescription drug abuse.

And why not allow the OTC treatments and clinics you describe? They may not (probably should not) be covered by medical insurance, but I see no reason not to allow someone to open up a medical advice clinic of their own volition. Is that even illegal today?
Remember what they're fighting against:

> some incumbent rightsholders and their advocacy organizations disagree and think the system needs to be completely redone because it is too hard to police copyright infringement online

Compared to what the rightsholders want, I think the current system is a good compromise.
Yes. Sign up for service, configure a page with crafted invalid HTML at your origin, activate all three buggy features, and spam it with requests.

If you can find such a page already, just jump to the last step and avoid signing your work.
I applied! Note that there will be regional programs in the next year that follow this initial program at Tufts.
I didn't mean record it to use the data in your analysis, but record it to preserve the methods for others. If they have trouble getting part of the experiment to work, they can pull up the video and see how you did it (at least to a degree; I'm not expecting 360 video. You can't possible record in text everything a video could capture.

Thanks for sharing your knowledge and experience in this discussion, by the way. It's what makes HN great.
> Linux's oom-killer does its thing

Usually selecting sshd to kill, in my experience, rendering the server inaccessable.
Interesting example. Bitcoin as an example of increased purchasing power facilitated by an increase in productivity and value generation of the entire (global) economy. Thus, a more prosperous ecosystem makes each individual who shares its "currency" wealthier over time - a distribution of the time savings / value generation to all participants.
She made accusations that specific incidents happened.

In general, someone who makes a specific accusation that can be disproven if not true probably isn't making it up.

I know we can all recall specific times when this hasn't been true. But as a general rule it works, as long as we remember we are still in the "judgment" phase and not the "punishment" phase.
And oddly enough Democrats support states' rights when it comes to marijuana, but don't trust the states on abortion or health care.
So, would LastPass be involved in this at all? Do tey use CloudFlare?
This would be like expecting a car brand to open its code to its competitors before to release a new product. Will lead typically also to the peers rushing to publish the same discovering on disguise before the original.
Call it a conflict of interest then. The worse the internet at large becomes, the more money cloudflare makes.
The long term trend over the last 200 years is gun advocates are slowly losing. As someone that enjoys shooting that does bother me, but don't expect public gun ownership to be a thing in 200 years without some fundamental changes.

Personally, I would focus on winnable fights. But, politically having red flag issues tend to get out the voters.
I have friends who are long-time Apple employees. The houses they bought in the mid-2000s effectively cost them more than $20m, because they sold their employee stock to pay for them (AAPL has gone up 20x since then).

They don't feel bad, of course, and nobody feels sorry for them. But you can drive yourself insane if you spend too much time thinking about the wide variation in outcomes if you'd made slightly different investment choices.