skysight-inc/HackerNews huggingface dataset:
Change my name? Change my address? Change my date of birth? My mother's maiden name? My passport number?

It's simply not possible to change all of the sensitive information that might have been leaked.
The Flash Boys presentation is not accurate: https://news.ycombinator.com/item?id=9047068. (Though I don't think you should be sent to prison for a crime like that.)
You're not so much selling them to google, you're disclosing them.

It's more of a contractual agreement between you and Google, or whatever company you're reporting the vulnerability to.

As long as you follow the rules for their bug bounty, you'll be fine.
Showing ID may not be part of a war against voting rights, but it's also basically completely useless in addressing any kinds of voting problems that have been shown to happen. I'm pretty sure that even now after CRTs are mostly gone more people are killed by falling TVs in the USA each year than are charged with voting abuses that would be addressed by showing ID.

But thousands of times as many people as that are prevented from voting because they don't have such ID and are not feasibly able to get it.

That doesn't even cover the situations such as Alabama and Wisconsin, where they passed laws requiring voter ID, then proceeded to close or severely curtail the hours at DMV offices across the states - particularly in poorer counties.

In Alabama, they closed the DMV offices (for budgetary reasons) in 29 of the state's 67 counties a year after the ID requirement went into effect, and I'm sure it was just a coincidence that the closures included every county with a population >75% black and most of the counties that went for Obama and Democrats. Of course, after the news and analysis of this started, the state that can't afford to keep DMV offices open said “We will go to people’s houses to have their picture made if they don’t have a photo ID in the state of Alabama,” or they can go to any probate judge (who? and aren't they busy?) or county register office. Mmhm.

In Wisconsin, they closed and cut hours at offices in more Democratic areas while expanding them in areas that tended to vote Republican. The most egregious one (and the one that got national attention on John Oliver's show) is Sauk City, where the office hours were cut back to the fifth Wednesday of any month with 5 Wednesdays - which in 2016 meant 3 times prior to the election, plus November 30. Admittedly, you could go 20 miles to the next closest (open Mondays and Wednesdays), 30 miles to the one open on the first, second and third Wednesdays of each month or just a little further to the state capitol with pretty normal hours. Hope you're not walking or on a bike, or that you're good with doing a 40-mile round trip on a weekday and that you don't forget to bring something they'll accept as proof of residency.

Basically, voter ID as it's presented is a solution to a problem that basically doesn't exist, but it's a solution that happens to have some pretty severe side effects. Maybe the folks pushing so hard for it are incompetent and innumerate, or maybe, just maybe, it's those side effects that are really the goal.

Edit:
Oh and for the argument that there's massive in-person voting fraud I have a simple question: If you're claiming that are you also therefore arguing that all of the people responsible for monitoring the voting process are utterly incompetent because even when they go looking for it they can't find it? Or are the perpetrators of the fraud simply superhuman and able to get their fraudulent votes counted while leaving no other traces?
DevOps and Microservices Node.js Starter Project
Prescient warnings about Cloudflare and Bitcoin sites going back to 2013
Bitcoin websites too dependent on cloudflare (2013)
https://bitcointalk.org/index.php?topic=297154.0

Use of CloudFare Puts Bitcoin Users at Grave Risk of Exposure (2015)
https://www.cryptocoinsnews.com/use-cloudfare-puts-bitcoin-users-grave-risk-exposure/

Omg, Coinbase API uses cloudflare (2016)
https://community.coinbase.com/t/omg-coinbase-api-uses-cloudflare/10982

EDIT: Unlike normal HN comments, apparently URLs in text submissions are not converted to hyperlinks.
Those are opposites.
The CloudFlare blog entry [1] authored by him, also submitted by him to HN [2], and also posted by him in this thread [3].

[1] https://blog.cloudflare.com/incident-report-on-memory-leak-c...
[2] https://news.ycombinator.com/submitted?id=jgrahamc
[3] https://news.ycombinator.com/item?id=13718752#13718782
Well now I have a great response to the sales guy that bugs me everyday.
Company-issued laptop probably tracks what software is installed anyway to mitigate malware. Services are probably designed not to accept connections from untrusted devices. Hardware 2FA makes it difficult to impersonate someone without their knowledge.

I can see the temptation—I've always missed having access to IP after leaving a company.
Well you said it... it's not a misunderstanding, it's a podium.
It's untrue. Otto was not a YC company.
Cloudflare's Cloudbleed in plain English
That's rare but possible. If you weren't spamming, I'm sorry. Let us know at hn@ycombinator.com and we'll fix it.
Interesting. Wouldn't a note or read-it-later service be more useful than a tab snooze?
CloudFlare should not align itself with the adversaries its mission is to protect its users from. This isn't a slippery slope distinction, this is a binary exclusion.
Half a Life in Customer Service
The AI would have to be able to ask for clarifications on ambiguity as it goes.
This not true. Why would you spread this lie?
Facing issues with Google accounts, Chromecast and related apps
It's sad how G lost its top engineers and is now trying to get back at them in the courts.
I'm in exactly the same boat as you and thought VX was fictional until about 10 years later when a mainstream media article made a reference to it.
Right, you either choose an integrated design, and commit to expending the resources to keeping it upgraded right there on the bleeding edge, or you build an expandable machine and let your customers do that work for you.

But even before the integrated Mac Pro, they regularly let it go two years between updates of the pro model. They must have known when designing the machine that they wouldn't be keeping it up-to-date and that it would quickly become obsolete?

Apple also has the issue of trying to align their releases to their PR schedules. When a component (like a CPU generation) slips, it really messes with their update cycles (see: MacBooks). This doesn't matter so much to consumer devices, but pros are more sensitive to this, and letting pros upgrade their machines mitigates this to some extent.
You got it. It's a strategy employed by the automobile industry as well: high-end loss leaders that "signal the brand" and cultivate loyalty among enthusiasts.

Apple's claim is staked on high-margin products, so it needs an elite cachet much more than say... Xiaomi or Dell. And you can signal that to consumers with one-of-a-kind high-end products that operate on the absolute cutting-edge of various creative, technical, and scientific niches.
I mean... maybe. Judges do have a certain amount of discretion and ability to interpret. But they are also supposed to stay within the law, and not just go to "well, this seems like the right thing to do."

If a Judge wanted to ignore this and seat a jury from... where? Somewhere else in Idaho? Then they'd probably at least need to advance a theory for why they got to do that in their response to your motion.

Now, as others have pointed out, unless you could plausibly assert that the crime was wholly and totally contained within the zone of death, and you didn't plan it outside the area or purchase items with the intent to use them in the crime or so forth, there is existing precedent to use that place as a venue for the crime.

But we're talking about a Constitutional right in terms of jury seating. Judges don't get to just wave their hands and say, "Well, the Constitution is dumb, so we won't do that." If they do, it's likely to get overturned on appeal.

(I am not a lawyer; this is not legal advice; don't commit felonies)
IF lyft is behind all this, I'm impressed.
Not 1 by Lawrence Sinnott
This is probably gonna get buried at this point, but one thing I'm surprised about is this seems like yet another parser bug. Why are we still using hand-written parsers? Even if you're Very Smart, you'll probably get it wrong. We have parser generators for a lot of things. Even for mostly unparseable garbage like wild-type HTML we have pretty good libraries for handling it. Fresh hand-written parsers are just bombs waiting to explode.
I'd like to add to what other people are saying here. I've worked at a company where people were given, basically, the minimum level of trust. All the horizontal projects were dead, teams competed with each other for the same clients, and we chose meeting rooms to avoid being overheard by other teams when we were discussing things.

It sucked. I left.
Virtual-Reality Goggles Come with a Hitch: Real Reality
https://news.ycombinator.com/item?id=13719530

Doesn't seem to be hand-written.
It's probably a rare person who is sane, intelligent, capable of detailed planning, and willing to potentially have a really nasty and protracted death. It seems to me that far more often you have people who are deluded in some way and don't perceive risk (bad planners, may not be particularly mentally fit), rare cases of extremely violent mental illness (not sane, bad planners), the highly motivated fanatic (good planner, sane, tends not to be the most intelligent).

You need a lot of elements to come together to murder someone who is well protected and expects to be the target of violence, while having a state to protect them. The scary thing is that of course, sometimes, this does happen; when it does there is very very little that can be done to stop it, short of you aforementioned 24x7 sleeping cycle.
Deepcoder builds programs using code it finds lying around
I am not assuming they are fake. In fact, I find it highly likely, given Uber': reputation and the clarity of the exposition given, that it is probably true in substance, if not in entirety.

There have also been knee jerk reactions and witch hunts orchestrated via the internet based on one side's story or an incomplete story that were later regretted. I do not wish to sugges to cast doubt, but to give a chance for the full story to be heard.
Imagine this—Google sends a request to get data from malformedhtml.com for crawling purposes. This site's html happens to have that weird incomplete tag problem they mentioned. This site is served by Cloudflare, wherein a buggy script manages to insert some data from the server's memory into the HTML that it returns to Google. Now this data in the memory contains HTTP request headers etc. of _completely unrelated websites_ that are also behind CF.

Google gets this HTML and caches it and that's how it ends up there.
Divesting would actually be the more direct form of profiting from the status quo. Lock in the gains that the status quo created for you before the culture becomes so toxic the company folds. Keeping your holdings and releasing this letter is actually the bravest thing you could do as an investor.
I have a long track record of RSIs and other injuries that have affected my ability to sit and work at a desk, so I'm unfortunately very well-qualified to tell you what's worked for me. Despite it all, I still happily work a full-time desk job with the help of these coping mechanisms.

First, standing desk. You don't need to stand all day; in fact I don't recommend it. You just need to switch it up at least once an hour so you're never sitting for more than an hour. Find excuses to walk around, too -- a 5-minute stroll around the block is great for thinking.

Second, have you had an ergonomic evaluation? There may be something about your setup that's all wrong, and a professional can help you correct it.

Finally, consider going to physical therapy for your leg pain. A good physical therapist can identify posture problems that contribute to your pain, and give you exercises to correct it.
Gopher reincarnation?
"... encryption without authentication is worthless."

I have heard this before, i.e., seen it in HN comments.

There are uses for encryption without authentication.

I am not an expert on encryption. This is all I will say.

In your example, Alice may not know where Bob is, but if the message is encrypted with Bob's public key then unless I am mistaken only Bob can decrypt it. She can leave the message somehere for Bob to get it.

Does Bob need to know the message was sent by the real Alice?

Do web servers check client certificates?

Assuming what you say is true, that unless your authentication solution is as good as your encryption solution, then the encryption is "worthless", then I think there is a large amount of "worthless" encryption being performed using TLS.

How many users have control over routing on the internet?

Even if a user had a solution to verify a physical computer on the internet, e.g., SSH, whether she could actually reach that computer in order to verify it is not necessarily within her control.

She might as well just assume a third party, i.e.. "anybody on the street", could easily obtain a copy of the encrypted data she is transferring.

File encryption can be useful without any authentication of any other party. Some files are not "messages" intended for any other party to see.
DDoS attacks are the ultimate form of censorship.
Check out Jim Epstein's article on how its used in Venezuela. Pretty great use case. As long as there are a few intermediary companies, i'm not sure it matters that most companies don't take btc.

Like many bitcoin users, Alberto, the miner who makes $1,200 daily, imports food from the U.S. through Amazon's Prime Pantry service. This would be impossible with bolivars because almost no one outside of Venezuela accepts them as payment, and the growing scarcity of U.S. currency has made purchasing foreign goods with dollars increasingly difficult. Though the Seattle-based retail giant doesn't accept bitcoins itself, plenty of intermediary companies do. Alberto purchases Amazon gift cards through the cryptocurrency-friendly website eGifter, using software to mask the location of his computer, and then routes his orders through a Miami-based courier service.

http://reason.com/archives/2016/11/28/the-secret-dangerous-w...
For non-human spaceflight, a 1% loss is an option. Insurance ussually assumes a 5ish percent chance that the payload wont survive and another 5ish that it wont be delivered into the ideal orbit.
Thanks for your reply. You've definitely given me some direction thanks :)
In the case of seat belts that's probably because the cost of your life is infinity.

The same isn't quite true for my blogger account.
For vulnerabilities with immediate exploit exposure, where people are currently being victimized by the flaw, Project Zero has a 7-day embargo.

The short waiting period balances the vendor's interest in coordinating the smoothest fix to the problem with the public's interest in knowing its exposure and maximizing it's options for reacting to the exposure.

The fixed waiting period keeps the process sane. Every vendor you'll ever disclose a serious vulnerability to will try to delay disclosure, usually repeatedly. If you set a precedent of making arbitrary exceptions, you'll never be able to stare anyone down.

Again: as the reporters, you're trying to balance the vendor's interests with those of the public. Your credibility in these situations is pretty important, not just for this vulnerability, but for the next ones. With P0, we all know there will be a long series of "next ones" to be concerned about.
Arizona Republicans Want to Prosecute Protesters the Same Way They Do Terrorists
I think I've settled on "change admin passwords, change any m2m auth credentials which don't require user intervention (API keys in apps, etc. should be rolled regularly anyway)"

Forcing individual end users to change their passwords is probably a net-negative. I might prioritize it if I have OTHER security improvements to roll out soon, though (2FA, upgrading auth infrastructure, other potential compromise, etc.).

I don't think anything else is really viable.

Bitcoin addresses/keys which transited Cloudflare probably should be updated, though, on the extremely off chance.
Very cool. I was actually looking into a platform for this and ended up with cloudron.io. they are open source as well and basically do what you have done.
Not VX, but don't you remember this as well: https://en.wikipedia.org/wiki/Tokyo_subway_sarin_attack
Gmail – some users being signed out of their accounts unexpectedly
That's about equivalent to PCIe 3.0 4x, or PCIe 2.0 8x.
https://en.m.wikipedia.org/wiki/One-way_compression_function

Cryptographic compression is not related to data compression.
> The current Mac Pro design seems like such a massive misstep in product design

Seriously? Perhaps I'm biased because I own one, but it's pretty much the most awesomely-designed desktop computer ever IMHO, at least from a hardware/cooling/looks perspective. The real problem, I thought, is that Apple seems to have left desktops behind to rot
I hold it because there's a huge value to being able to 100% trust your team/investors, and compromising it even for "cause" harms that, and on balance, is a bigger problem.

There are ~7b other people who can call out Uber's behavior who are NOT Uber investors. I don't think any particular value was added in this coming from Kapor vs., say, EKP. There are a lot of people who are not Uber employees or investors who have even more moral credibility here, too.
But there are so many other much more likely reasons why something like that would have happened, it is quite a leap to think that it is somehow related to this issue.
Show HN: Does it use Cloudflare?
Your comment doesn't apply for this particular case, because the submission goes into great detail that the parser in question was written with Ragel, a parser generator. The code written by them in Ragel contained a bug, which lay uncaught and dormant for years, and manifested only when calling/wrapping code was altered.
I'm sorry, but "PR crisis" continues the worrying (if thankfully rare) trend of people talking about this whole ... situation like it's an unfortunate but incidental bug that just needs to be ironed over, akin to some kind of "cost of doing business". There is a very important category difference between, say, Cloudbleed, and allegations of sexual harassment.

Bounds-checking errors and the like do happen, and in rare cases reach catastrophic proportions, as we saw today. Downplaying what happened in that kind of situation isn't quite right, but it's still victimless in a certain sense -- you're minimizing the PR damage to yourself while not exactly hurting any other party. But Uber's behaviour here is essentially an attempt to apply the kind of "mitigation" that a situation report for a security vulnerability documents to a human conflict. (Non-serious aside: do they have an in-house "Fowler incident report" being edited every ten minutes?) It'd be far more admirable if they could go the completely Homo economicus route and declare "We don't honestly care, as long as we're profitable, and we're going to do everything possible to combat this eventuality." or something along those lines that actually reflects what they think of this, but obviously that would be ... suboptimal.

Yes, Uber management may be (in fact, from the emails they're sending out to people "deleting Uber", they definitely are) suffering as a result, but the lack of a contrite "Yes, this happened, it shouldn't have" instead of the "This is contrary to our values, our ethos, and a few other words that conjure associations of fine, upstanding citizenship in our communities and such" (read "Lies!"), together with the obviously impartial steps they're taking to "investigate" the matter, make it difficult to find empathy for their pain here.

(Any strawmen or logically suspect arguments in the above are unintentional and I'd love being told about them. Damn, I'd use that for an HN signature if those were supported.)
Lots of Juice here.

Complaint:
https://drive.google.com/file/d/0B7dzPLynxaXuQjY3dkllZ2ZKb0k...

>Waymo was recently – and apparently inadvertently – copied on an email from one of its LiDAR component vendors.

Is this going to be a legal test of that annoying lawyer email footer language?

>This message contains information from xxxxxx that may be confidential and privileged. If you are not an intended recipient, please refrain from any disclosure, copying, distribution, or use of this information and note that such actions are prohibited. If you have received this information in error, please notify the sender immediately by telephone or by replying to this transmission.

Ha! More legalese BS that never holds up.

> Otto launched publicly in May 2016, and was quickly acquired by Uber in August 2016 for $680 million.

The fact pattern here is going to be absolutely brutal for Uber. A non-technical judge is going to see the allegation: ex-google employee downloads technical documents in December 2015, launches a company 5 months later in May 2016, and is bought for $680M (later speculated to be $1B+) for all its technical accomplishments. How much fundamental research did they do in the 3 months between May-16 and August-16?!?!? Or was it just to buy the stolen IP that google had developed over 7 years?!? Brutal for Uber!

--

A public company recently settled a similar lawsuit (competitor hires exec, exec is proven to have downloaded documents) for $130M on much smaller numbers. And the defendant was run through the legal wringer first.

http://www.geekwire.com/2016/zillow-realtor-com-operator-mov...

Expect Uber spankage, bigly.

> shortly after Mr. Levandowski received his final multi-million dollar payment from Google

Funny because of all the recent press that Google paid autonomous driving talent too much that they left!

>Infringement of Patent No. 9,368,936 (Against All Defendants)

Real nasty. If a trade secrets lawsuit is an arrow, throwing in a patent infringement claim too, is poison tipped and barbed!

This is some good "old skool Google" where they used to show broad competence across many domains; in this case legal.
I agree. Really, standing up from a desk (should you be so fortunate as to be able to, that is) and taking a walk feels like piercing through the ocean's surface and taking a breath of fresh air. From certain submerged angles, the refractive index of the water makes its boundary a silvery mirror, easy to be mesmerized by.
The owner's address was clearly on the package. They knew whose it was and clearly did not intend to make the effort to deliver it. Until they were publicly embarrassed. That sucks.
I'm in same dilemma, Go is more mature/easy for web/network stuff. Rust seems like more of a complete language.
For now I'm going for Go because I'm focusing on web backends.
Heh, I meant it would be an additional filter not the primary. If you copy and paste the same response to multiple posts back to back you might be a robot, as Jeff Foxworthy would say :-)

FSB probably doesn't pay as many non-Russians on average. It would be expensive, risky and harder to control.

The point about grammar is interesting. Last time I heard of it was when there was discussion if Guccifer 2.0 was a Russian hacker or not. Some were saying he wasn't because his grammar mistakes were not characteristic of Russian speakers and most likely it was a native English speaker trying to talk in broken English trying to sound like a Russian.
How about this idea:
free() zeros or unmaps all memory it allocated. This shouldn't fault. The OS zeros pages when mapping them into the process space (which it should do anyway). I think that solves the problem.