skysight-inc/HackerNews huggingface dataset:
It is only pretending to be QNX, it's really Windows...

Here's the (genuine) QNX boot floppy demo, BTW. Alas, my new laptop doesn't have enough RAM to run it.

http://toastytech.com/guis/qnxdemo.html
Shouldn't it be the responsibility of the original experimenter to provide the information necessary to repeat the experiment? I see nothing in your list that sounds like a good excuse for not being repeatable.
that's very good progress,please continue.
"Being hit on by colleagues" and being asked for sex by your direct superior are two vastly different things.

Pretty sure what you're doing is called victim blaming.
this doesn't even begin to cover the possible scope of the leak does it?
For actual in-depth technical discussion / criticism of the paper, you can read its ICLR peer reviews (and other public comments): https://openreview.net/forum?id=ByldLrqlx
There is some speculation on whether Linus got it right or wrong, but I haven't seen anyone actually test this with the shattered-1 & 2 files, so I did.

Git sees them as different despite them having the same hash. You can test with:

mkdir shattered && cd shattered
git init
wget https://shattered.it/static/shattered-1.pdf
git add shattered-1.pdf
git commit -am "First shattered pdf"
git status
wget https://shattered.it/static/shattered-2.pdf
sha1sum *
md5sum *
mv shattered-2.pdf shattered-1.pdf
git status

So it doesn't see the files the same.

Apologies for those on mobile (please fix this HN!): the commands are:
mkdir shattered && cd shattered
&& git init
&& wget https://shattered.it/static/shattered-1.pdf
&& git add shattered-1.pdf
&& git commit -am "First shattered pdf"
&& git status
&& wget https://shattered.it/static/shattered-2.pdf
&& sha1sum *
&& md5sum *
&& mv shattered-2.pdf shattered-1.pdf
&& git status

EDIT: Ah, of course! git adds a header and takes the sha1sum of the header+content, which breaks the identical SHA1 trick. You can add a footer on and they keep the same SHA1 though. Don't have time to play about with this more just now, but try it with `cat`ing some identical headers and footers onto the pdfs.

EDIT2: Actually, this is discussed more extensively in the other thread which I hadn't read yet. Go there for more details: https://news.ycombinator.com/item?id=13713480
Improved reversals of cognitive decline in Alzheimer's Disease
Not much actually technically-grounded ML discussion occurs on Hacker News.
I am all for an investigation. Don't get me wrong. I am just being pedantic :)
How is this different from being able to flick through long documents with a finger via a touchpad (aside from not having to reach up to the screen)?
> Might have been FSB, but there were plenty of other parties that really didn't like Litvinenko and could have used Russian Polonium either to blame the FSB or to tell the FSB not to fuck with them, because they had the means to blame them for random hits (or a million other possible reasons)

According to the book 'A Very Expensive Poison' by Luke Harding, the Polonium used in the Litvinenko assassination is only produced in one reactor in the world, located in Ukraine. It would have been almost impossible to obtain without FSB knowledge or collusion, leading investigators to believe that Putin had direct knowledge and/or approval.
What about external GPUs? I wonder if Apple should be doubling-down on that because it turns even the weakest MBs into incredibly capable machines.
Today I learned that uber does not have a change password option once you are logged in. You have to log out and pretend you forgot the password. Bad UX if you don't know.
Man, it's true those terms were standard -- in the 90's. Seriously founder-unfriendly.
You started a platform and editor flamewar at the same time. Impressive!
Container Orchestration Comparison
Depends on the implementation, which I'm not familiar with, but there are definitely ways to handle that.
> I cannot remember a single occasion, where my desktop recovered when it started swapping.

..which operating system is that?
Memory (8GB) is just suddenly jumping to red, usually by some Safari tab (gmail etc) which suddenly jumps to 1GB. And that's it. No indexing or mds processes; just browser tabs which suddenly jump over a point and lock up everything because of memory use. It's like i'm back in the early '90s when I first touched a non Amiga and non SunOS system. And asked how people can work with that 'Windows/DOS stuff'. I am not sure why it misbehaves so much though...
I'm curious if people have shorted bitcoin to any meaningful extent.
This is wrong. There is no faster way for preimage attacks with truncated SHA-2.

http://crypto.stackexchange.com/questions/9435/is-truncating...
Yes - I've had back, shoulder, leg & sciatic pain in the last few years all caused by a sedentary desk based career.

Physio and simple rehab exercises got me to a point where I could do structured exercise again. Then I built muscle tone back up through weightlifting and a better diet.

I can sit a full day now but notice that it isn't good for me. It's sustainable because I have a good chair, make sure I change position regularly, walk and stand hourly, take a longer break to get outside at lunch and put the hours in to keep muscles strong.

Having been there myself I know it's a struggle to need to work but also need to be able to get better too. If you would be interested in freelance projects I have a few things you could work on at your own pace while you work on improving your health. My e-mail is in my profile.
> how do we know if an android app is the real deal?

You don't.

Not that it really matters, if you care about security you shouldn't be using Android in the first place.
Ah right on - didn't realize Instacart would be taking a portion of it... and it looks like it would be taxed, effectively making every dollar into a $0.70 tip...
A Mind-Body Look at the Concept of Asperger's Syndrome
Interesting article. However, I wonder what's really causing the difference in achievement - at first, it would seem that just skin color doesn't explain it, as Indians (also darker-skinned) outperform even whites (according to the article). In theory it's possible that they're being discriminated against (in a racist way) but they outperform despite that, though I've never seen any study that would suggest such genetic superiority (in terms of IQ). Could it be culture (Asians/Chinese are well known for their "Tiger moms", maybe Indians have a similar achievement-oriented culture), or possibly family wealth (Asians coming to study to the UK are more likely to be from wealthy families)? I'm really curious.
None of that would solve the issue.

Google can only verify what hardware you're running by sending a packet via ethernet to your device. You control all software running on your device, and can send a spoofed result.

If you were crazy, you could even just emulate Google's hardware entirely and proxy all requests to that emulated hardware.

Nonetheless, while this guy certainly wouldn't be able to do it, many Google employees would.
T-Mobile May Be Following Sprint and Rogers to Offer RCS in Google Messenger
The End of SHA-1 on the Public Web
Touchpad gets that for me. Only way I can find what you saying more "comfortable" if you hold it in hand or horizontally on table while reading.

Most of my "work" time I spend in terminal. White text on black background, keeping my fingers on home row. I cannot see scenario where touchscreen makes me more productive except in some edge cases, and btw they don't gain over what I already have now. But that's just me. Each to their own, that is only fair thing to say.

But making assumption and claim based on your own point of view is not best thing to do. With Apple, especially it is always the same story, customers leaving and rarely satisfied (it was period around Snow Leopard, IIRC 2009-2010), but still I can't find anything better than MacBook. Dell and Lenovo came close, but when I install Linux on them I make few more sacrifices, summing everything up, Apple just works for me. (I won't even mention Windows. 100% not my cup of tea)
What.CD violated the first rule of preserving things on the internet: make lots of copies. https://rocknerd.co.uk/2016/11/19/what-the-death-of-what-cd-...
Then why's it worth discussion?

Why is there no "general" deep learning algorithm?!
I once read that you can pretend to be charismatic, confident; and it may become natural soon. And please do not think of yourself as "suboptimal", not having "the charisma of a director/VP/CEO of a large scale company". Challenge yourself - with sport, public speaking, starting a business - and your charisma will grow :)
>The purpose of an analogy is to simplify something that's too hard to understand for the person you try to convey your idea to

An analogy applies a principle to a common setting without loss of specificity. Specifically the dedicated adversary is lost in this abstraction, so it's a bad analogy.
I use apt-get.
I don't like the living-on-the-edge-attitude that Linus and others here promote regarding Sha1 in git. First, attacks only get faster over time. What costs millions today is likely to be achievable on commodity hardware in the coming years. Second, attacks only get more flexible over time. A contrived collision on MD5 in 2004 got perfected to a single block collision in 2010 [1]. Third, devising an update strategy and rolling it out takes time. I can't guess how much hardwired use of Sha1 is in Github.

Fourth, people use git in creative ways. Linus may think it is a cardinal sin to commit binary blobs in a git repository, but I can't imagine I'm the only one using git as a poor man's backup and file sharing solution.

And last but not least, relying on Sha1 takes effort of constantly asserting its use in Git is still secure. Support request to that end will skyrocket from now on, both of the constructive kind, like the technically concerned coworker ("but isn't git insecure now that Sha1 is broken"), and of the regulatory kind ("if you use Sha1, MD5, … please fill out these extra forms explaining why your process is still eligible for certification with ISO norm foobar").

Since we have to migrate away from Sha1 at some point in the future, I'd like it to be sooner rather than later.

[1] See Wikipedia for a timeline and references: https://en.wikipedia.org/wiki/MD5#History_and_cryptanalysis
From https://arstechnica.com/security/2017/02/serious-cloudflare-...:

A while later, we figured out how to reproduce
the problem. It looked like that if an html page
hosted behind cloudflare had a specific
combination of unbalanced tags,
[...]
The leakage was the result of a bug in an HTML
parser chain Cloudflare uses to modify Web pages
as they pass through the service's edge servers.

Ahem, at the risk of sounding pedantic, but this wouldn't have happened when using a proper HTML/SGML parser ([1]).

[1]: http://sgmljs.net/blog/blog1701.html
You can track down the discussions from 6 years ago:

https://news.ycombinator.com/item?id=2435710

Some significant discussion was here:

https://news.ycombinator.com/item?id=2434333

And here:

https://news.ycombinator.com/item?id=2434975

In short, it has been decided that removing the display of points against comments has reduced some undesirable behavior. The issues are complex, the arguments not entirely convincing, not everyone agrees, but the decision was taken that behavior and comment quality improved.
There's a great discussion of that article in Russ Robert's interview of Epstein on the Feb 13 episode of EconTalk.

http://www.econtalk.org/archives/2017/02/jim_epstein_on.html
Machine Learning for Programming
From a cloudflare employee:

"We were working to disclose the bug as quickly as possible, but wanted to clean up search engine caches before it became public because we felt we had a duty of care to ensure that this private information was removed from public view. We were comfortable that we had time as Google Project Zero initially gave us a 90 day disclosure window (as can still be seen in their incident tracker), however after a couple of days, they informed us that they felt that 7 days was more appropriate. Google Project Zero ended up disclosing this information after only 6 days."
Almost all of them:

Npm: https://docs.npmjs.com/cli/install

Bundler: https://bundler.io/git.html

Homebrew: https://github.com/Homebrew/brew
While Cloudflare might contact their customers, it's no guarantee that the customers will actually notify their users, so I think this is a good way to find out which sites I might have to change my passwords and API keys on.
Rangoon+review,+Rangoon+movie+review,+Rangoon,+Kangana+Ranaut,+Shahid+Kapoor
I do understand, but "the trust you need to put to use the code" is what we were talking about, no?
Thank you for your feedback. Originally I tried this, but Twitter automation rules disallow this; got banned for a week as a result.
No. If you have any of those features enabled Email obfuscation, Server-side Excludes and Automatic HTTPS Rewrites as well as you have an invalid HTML markup. Per their blog post it is 0.00003% of the total requests.
> There's a huge difference between being able to write "programs" (for example the ones described here are ~5 lines) and being able to write a large and very complex piece of software, which such an AI would undoubtedly be.

That's true. real-life programs that programmers get paid to write are typically more complex than 5 lines. Any AI good enough to replace real programmers is going to be very close to good enough to rewrite itself.
And yet you're arguing for this by replying to the top comment.

You have a point but I think it's undeniable that a significant share of developers wants a UNIX environment. Me included.
> Why exactly do you need Uber in the city with arguably the best bike infrastructure in the world and no hills, whatsoever?

Because cycling when drunk is illegal.
Ask HN: GCP or AWS Credits Without VC/incubator?
How would a bootstrapped startup achieve this?
Fasting diet 'regenerates diabetic pancreas'
The bad and good urllib
>> our job is actually not to code but more to solve a given problem with a range of tools.

Actually, often the most valuable thing a programmer can do is build a tool/dsl that lets the domain experts(or cheaper labor) to solve problems.

So if a programmer just solves problems, he will probably have some serious competition.
OVH Kimsufi database leaked
Every time I've gotten into an uber the first two questions have been "PriceChild? Where are you headed?"

I'm very sure they don't get the destination when choosing whether to accept the ride, and often don't seem to get it until you get in the car?
As I said, I don't have a problem with ads per se, what I find objectionable is that most display ads download Javascript into my browser that tries to do funky things (like use HTML Canvases for fingerprinting, inject stuff into the local-/sessionstore) and usually sends data to some remote hosts that could be used to de-anonymize me (even revealing my IP address is enough to do that in many cases).

From my own experience (I did various research projects on this working with journalists) the data usually ends up in places where it's not supposed to be and might cause a lot of harm in the future, hence by blocking this content I'm trying to protect myself as good as I can.

I'd accept ads if the following conditions are met:

* They are served through a trustworthy CDN, which guarantees that my IP information will not leak to the ad network operator.

* They do not execute JS and consist of elements whose safety can be (reasonably) proved, e.g. images and text.

* They do not blink, move, break the page or hide the content that I want to read.

* They do not try to "contact the mothership", sending back personally identifiable information to their overlords.

Sadly, I have not seen a single serious effort to implement this, instead websites just ask me to disable my ad blocker and expose myself to privacy risks. No.
I am the only one who sees this JS integration as bloated overkill?

Nowadays developers prefer to do SPA based approach where you have API (RoR - JS Stuff) and Front-End (Whatever front-end people decide to choose that will be outdated in 1 year).

Why can't RoR just focus on the back-end stuff instead of adding bloat that will be obsolete in 1 year?
Easiest chocolate machine ever DIY
Opus2Audio Golang Telegram's bot
No TLS on this site?
Usually companies make the money with the boring products and then they showcase their talent with superbly designed and not-all-around-versatile demos that make a loss.

It's kinda neat that with Apple it might be exactly the reverse.
Apparently I was incorrect, and HIPAA does not require protected data streams to be isolated from each other. Perhaps I was confusing some other (European) regulation. For HIPAA it seems to be sufficient to promise that everything is secure, that you have documented everything and that you know what to do when stuff goes wrong.

So we should see very quickly that Cloudflare knows what to do when stuff goes wrong.
You might as well scrap http entirely, with or without the "s".

The web simply doesn't scale. The only way to fix DDoS reliably is peer-to-peer protocols. Which hardly ever happens because our moronic ISPs believed nobody needed upload. Or even a public IP address.
>>> len('''> Wow, Linus raises an entirely different issue which is that the PDF-based attack can't and won't work on git at all. Due to length prefixing it is extremely difficult to insert some nonsense into the middle of a git object which is how this attack works on PDFs.''')
264
>>> len('''Please note that the shattered-{1,2}.pdf files both have exactly the same length. And even with cleartext it is easy to pad passages so they contain the same amount of bytes. See how the quoted paragraph above has exactly the same number of characters as this one.''')
264
The security infrastructure behind the Windows desktop is a decade ahead of the Linux desktop. Yes, kernels are okay in both cases, but e.g. Xorg is a security disaster.
Well it's on npm so the Author will delete it once you become dependent on it.
iCare Data Recovery Pro Crack Plus Serial Key Full Download
How did they find the agent? Do they have a list of thousands of agents to test against, and do they work down the list one by one? How does this work?
I meant to write "non-civil" or "international" war. Oops. I definitely had that in mind.
because he refused to hand over the local passwords for his devices.

I am not saying what the CBSA did was legal (as the case was dropped), but not handing over local passwords is considered "obstruction of the officer's job" by the CBSA (for which he was charged).

So I'm assuming that if they did want to charge you, they could.
Show HN: Introduction to Swift
The mechanism by which sites (well, domains) can specify which CA may issue is named CAA, it's part of DNS and is an IETF standard.

However, the current Baseline Requirements for trusted CAs don't actually require them to check CAA unless their declared policies say that they check. Let's Encrypt's policies say so, as do Symantec's but many others do not.

Gerv (of Mozilla) is trying to get this changed, either by industry agreement in the BRs, or de facto by changing the Mozilla root programme rules if the CAs try to block changing this in the BRs or keep stalling too long.
https://en.wikipedia.org/wiki/Atropine#Side-effects
Well, purge their public cache, after taking a private dump and supplying it to those who would find value in such a thing.
Oh, really? Do they have any plans to?
> it seems irrelevant to the discussion

Unless the victim ate the wrong fish.
Bcachefs: Next gen copy on write filesystem for Linux
It's difficult for most people to relate to arbitrary laws that don't affect them but it's very easy to relate to sexual harassment. I'm not saying it's right or wrong , that's just how we all function. I think everyone knows someone close to them that has been a victim of sexual harassment. Not everyone knows a struggling taxi driver.

Edit: Furthermore , the Susan Fowler incident has just been the key that opened up the flood gate of internal problems. Everyone to this point has been too afraid to speak out about many other issues, its just an harassment case that happened to open it.
You use 500 sites which use 2FA?
>Some people just need or want a beefy desktop built with upgradable components (in addition to a laptop).

Apple is a hardware company. What you're suggesting doesn't make business sense for Apple. They rely on being able to sell new hardware. Allowing upgrades wouldn't make sense. A laptop last for five years, for most people, being able to slap in extra memory, a new graphics card or just a new SSD would "rob" Apple of a sale of a new computer for an additional two or three years.
I thought those were the conditions that caused PII to be included in the HTML response, but the PII could come from any customer as it's a buffer overrun situation. Damn this is confusing
I never said that, at all. I explicitely say

At best you reduce the brute force complexity, at worst you enable pre-image attacks.

One thing I hate about crypto talk is statements like this

So, truncating one of the SHA-2 functions to 160 bits is around 2^20 times stronger when it comes to collision resistance.

Which is all too broad. What if SHA-1 is down to 2^10, is truncated SHA-2 2^30? Does it mean we have proved that no weakness exist in SHA-2? A correct statement would simply be that no known attack exists on truncated SHA-2 yet.
I believe you've conflated two assassination attempts, one on Hassan Nasrallah, one on Khaled Mashal. Mashal was the one in 1997 where the antidote was turned over by the Israeli government. Nasrallah was in 2008, and also survived after being treated by Iranian doctors.
IBM Blue Horizon
The takeaway from the Cloudflare story seems to be: don't rely on TLS encryption for critical data, since it may be compromised by third-party actions and may be completely compromised in the future.
Mastering Vim Quickly: From WTF to OMG in No Time – Introduction
> Yes, you should be able to create any kind of product you want as long as it's within the law.

Exactly. And what if the law says "anyone has the right to repair or modify any software product they have a license to"?

And what if the law says that makers may "not try to discourage users with technical or legal means from using their rights"?

That’s the point where we’re at, and intentionally making it hard for users to modify the software just for that purpose is something you only do to prevent users from using their rights.

> You're not the authority on what constitutes a problem

No, but the people who wrote above laws are.

> this is part product, part intellectual property.

Which, luckily, EU law has settled even more definitely than anything else: If you can buy a license for something, then you own that product for which you bought the license in the same way as if you had bought a physical product. And you can create private copies for yourself, you can modify it like you can repaint your IKEA table, you can return it within of 14 days and get all the money back, and you can resell it to others.