skysight-inc/HackerNews huggingface dataset:
So who is an expert in your opinion? Obviously a PhD who can be trusted to infer objectively from facts does not make the cut in your eyes. Who gave you the moral policing authority to call anybody disingenuous etc. I'm sorry if you are a muslim & I ruffled your feathers a bit. But be a sport and see it for what it is. Stop judging people just because they have a thought or idea that is different from yours, never mind opposing yours.

"weirdly anti-Islam"?? - Damn! Say one word against Islam and people are so defensive. No wonder we have so many problems in this world with kids trying to act like they know it all.
The not-so-hidden secret is that voter id laws would stop one type of fraud - in person voting fraud, or the most logistically challenging and hardest to do. Most old white people rely disproportionately on mail-in voting, oddly enough there are no pushes to restrict access to this method of voting (even though it is the easiest to defraud) - voting fraud legislation tends to focus on the methods that minorities use.
Any spy agency worth a damn should be able to source weapons locally.
Only for the case like I mentioned (SourceForge example above) of verifying payloads that only ship with those two broken hashes. Not advocating for publishing new work like this.
What point are you trying to make?

Are you suggesting that if there were less Government run prisons and more private prisons, there'd be less people in Government run prisons? Cause, ah... yeah.
Latent issues can get exposed when something in the environment changes. Probably an interaction with some other piece of software that changed what it was doing.

Looks like the factory reset process is a little flakey but works to fix this, which seems typical for dealing with routers.
You wouldn't be able to have any CDN caching, only transit of encrypted traffic. Which is fine, but all the major clouds have load balancers that already do this and have varying levels of included and paid DDoS protection.
This is easily the most terrifying comment I've ever seen on Hacker News. You are a deeply scary human being. May I ask how do you know all of this? Edit: weird, I typically know ahead of time what's going to get downvoted. Didn't see it coming this time around. shrug
That's the message we all got, but I think we can agree it wasn't the intended message. "I'm still in control, I can still reach out anywhere, and I don't care that people know it's me."

As you say, reasonably that translates into, "I'm insecure."
Seems like Google/Waymo has known about this for a while, funny how they timed this lawsuit announcement during the Fowler blog post uproar
These 7 Books Are Necessary Reading for All Creatives
Why do something that's so obvious though? Bump into someone instead and you can accomplish the same thing without a big stunt.
I noticed StackOverflow is on the list of compromised sites. I sign into that via my google account. Does this mean I need to change Google credentials?
Oh I always imagine North Korea had the assassins family chained up. WTF does it matter if they get back?
If I (user A) access upwork.com (I just saw this on the list of affected websites, so it's not meant to be an ad), I am sending them my headers. Let's say my headers and other data are saved in M1 (memory register 1).

Then Google accesses the website as the crawler (user B), and their header and data is saved in M2. However, Google triggered a bug and now has access to M1 as well. So now Google sees their own headers + my data + other garbage.
I'm sad that the AF wants to retire this plane. This plane was defined with one purpose: build a plane around this gun, that being a 30mm autocannon firing depleted uranium shells (not radioactive) that fires at such a rate that it retards the velocity of the plane carrying the gun, and would melt the gun if it fired from full to empty continuously.

The plane was built for survivability. It can withstand an engine being shot off (why the engines are external on "pods"). The cockpit is (I think) surrounded by a 2 inch titanium tub.

I'm not sure the JSF, i.e. F-35 will be capable of taking over this role, as is intended.
@homero (since I can't nest a reply any further), it's not the contents of the crawler's request that gets randomly injected into the page that the crawler requests, but rather the contents of other requests to the same Cloudflare server.

Imagine I'm having a chat on some website X, which uses Cloudflare. Cloudflare acts as a man in the middle, meaning my request, and the response, likely pass through its memory at some point to allow me to communicate with X.

Later, a Google bot comes along and requests a page from site Y. Because of this bug, random bits of memory that were left around on the Cloudflare server get inserted into the response to the bot's request. Those bits of memory could be from anything that's gone through that server in the past, including my conversations on website X. The bot then assumes that the content that Cloudflare spits out for website Y is an accurate representation of website Y's contents, and it caches those contents. In this way, my data from website X ends up in Google's cached version of website Y.
This is a shocking aspect of crypto. Old standards get broken regularly, yet people waltz around with a "it would be embarrassing to do more since no one else does" attitude.
He was dead the very instant that ball was shot into him... he could have realized what had happened that instant and no one could have saved him; it really was diabolical.
Friendly reminder that Cloudflare willingly hosts the top DDoS-for-hire attack sites, and refuses to take them down when they are reported.

Run WHOIS on them, it's almost 100% behind Cloudflare: https://www.google.com/#q=ddos+booter

I would be less concerned about the fact that Cloudflare is spraying private data all over the internet if people weren't being coerced into it by a racket.

We won't have a decentralized web anymore if this keeps going. The entire internet will sit behind a few big CDNs and spray private data through bugs and FISA court wire taps. God help us all if this happens.
Any tips you can give as far as starting to learn VTK, especially its Python bindings?
Find my email in my profile. You may email me and I will respond.
I think this is an important point. If you depend on a source control tool to handle security, you have bigger problems in life. There are way too many things to worry about when designing a source control tool to believe that security will be handled properly.
It strikes me that this is very similar to the NBN (broadband network) problem. There is a widely deployed network of old technology that is no longer worth investing in (copper in the NBN case / coal plants) and newer technology (solar + storage) that is still a little pricey (storage) and not widely enough deployed.

Which means you need to manage a transition so it's not too painful.

A first random guess -

One way might be to allow a few coal plants to go bust, and enact "load shedding" (turning off areas of the grid during times of low demand). Within a year or so, enough places will have batteries that you're load shedding less often.

If the government purchases the coal plants when they go bust (at a steep discount), they can then stagger the shutdowns enough that load-shedding is controlled.

But it doesn't seem sensible to force it to be economic to run the coal plant full-time. Surely that just drags out the transition, and suppresses the demand for storage that we're hoping will be the solution?
Piece of unsolicited advice for the future: don't let anyone pressure you into doing anything you don't feel comfortable with. Ever.

If a place is worth working for they're not going to judge you for feeling more comfortable keeping your stuff with you.
Accusations of astroturfing or shillage are not allowed on HN without evidence. Please don't do this again.

We detached this comment from https://news.ycombinator.com/item?id=13716677 and marked it off-topic.
Look at the number of Wikipedia links, it's not like tlow is the only person on earth that knows about this.
Wouldn't this imply that all hash functions (other than one-to-one mappings) must have collisions?

Why does the pigeonhole principle hold?
A unit of Bitcoin is not replaceable with a unit of some random alternative cryptocurrency.

There is a huge barrier to switch. Bitcoin has common mindshare. Why would someone want to use an asset with far less mindshare?

The history of altcoins over the past 6 years supports these points.
Who wants to bet this won't change a lot of developer's making statements like "I use <Insert HTTPS offering CDN> so my site is secure"
The implied comparison to Heartbleed problem is that everyone's old encrypted traffic was suddenly in the open, key change didn't help.

(except for the enlightened few who used PFS before Heartbleed)
Apologies, fixing that now! I ran uniq before but piped it into the wrong file and ended up uploading the non unique version.
Nowhere in that letter did they discuss continued investing that I could see. This amounts to a wild accusation with no basis for it.
In StackOverflow's case, login happens using Oauth2 by way of accounts.google.com, meaning your google login creds don't go through StackOverflow's servers - Google acts as a trusted 3rd party and verifies that you are who you say you are, and tells StackOverflow.
The article title is "Garmin engineer shot and killed in Kansas by man who allegedly yelled ‘get out of my country’"
Everything Is Fucked and I’m Pretty Sure It’s the Internet’s Fault
Well, logs are quite easily accessible on any OS.

Memory forensics would have 100% given you evidence that it was accessed and exactly what was done. There are plenty of guides on how to forensically dump memory but that depends on the OS.

But I'm also in this is FUD camp. I highly doubt any company would do such a risky thing such as mirror your machine data merely for an interview. This would be highly illegal and damage the companies reputation for a relatively minor benefit.

Especially when interviewing any software dev which any infosec person would assume they are dealing with a sophisticated target with a high chance of being detected. Meaning they would have to use very careful cloning techniques.

It would be much easier to get you on staff on a company machine and temporarily monitor you closely after the fact. There are plenty of ways to thoroughly vet someone beforehand without taking such a risk.
AI Threatens Top Paying Jobs--And the Ax Can Fall Quickly
What's shocking is how badly people understand the purpose of an analogy.

It's to communicate an idea to another person in a way that can also convey subtleties, and not just the literal words being conveyed.

In this case, he was trying to convey the idea that the risk is so small and so remote that it really isn't worth spending a lot of time on.

You understood the point, I understood the point, and everyone else understood the point. Which means the analogy was successful.

So please, stop trying to pull the conversation on some tangent so you expound on why smart people should spend more time on the perfect analogy that you approve of.
Ahh thank you that bit didnt click for me, that is scary
Ask HN: What are some other communities you participate in?
The bandwidths can be found via a quick Google search. You'd need something like 8 usb c ports in parallel, and the CPU overhead would be punitive.
The A-10 delivers rounds at a rate that the individual shots are indistinguishable to the the human ear.

Another story that I've heard is that a B-1 flying at operational altitude (200 ft above ground level, mach 2) was often as effective as dropping munitions.
oh yeah!! i was searching for those :)
I think such incidents are more messages about the ability to stage an elaborate and unexpected attack than about the death of the unlucky victim, who may not even be that important in the scheme of things but is chosen to call attention to the political nature of the act.
I don't really understand your point. In 2012 I was working on a startup that was DDoS'd and it was not fun. This was back before Cloudflare offered a DDoS service and we ended up having to hire a random company in Canada to help get us back online. At the time there were surprisingly few people out there offering DDoS mitigation. Cloudflare wanted to help us but they were still in early development for their service, but I remember them being good guys. What's wrong with providing a service to help fight the bad guys?
It's far easier to touch someone in public than it is to garotte someone in public and North Korea seemed to think it had some kind of diplomatic right to the body before an autopsy, which would also lead them to believe that their exotic toxin wouldn't be discovered.
Your comments in this thread have been breaking the HN guidelines. We ban accounts that do that, so please read and follow them when commenting here. That means posting civilly and substantively, or not at all.

https://news.ycombinator.com/newsguidelines.html

https://news.ycombinator.com/newswelcome.html
Not according to the lists others have posted, but 1password are.
Have you asked them for an eta on your shirt?
Thank you. I am merely a curious character who happens to read; occasionally on esoteric matters.
We want you (to write for the Linux Experiment)
Another "I don't think PGP is good enough" and "here's all these things"

Yet none fully replaces PGP yet. Before you actually retire PGP, maybe you need one of these projects to finish a real, complete, reviewed and high quality replacement ;-)
You don't have to use scrapers, just use copies of the TLD zone files looking for cloudflare nameservers.
Your point illustrates why half of the federal reserve's mandate from congress is price stability. See Macroeconomics 101... https://en.wikipedia.org/wiki/Money_supply

OP's point seems to be that inflation of bitcoin value is built in, effectively resulting in de minimis velocity and seeking out of alternative stores of value which are more stable. Bitcoin is how I would design a currency if I wanted it to self implode.
Care then to explain how almost all of the extreme prison population boom occurred during a time in which private prisons had a very small market share?

1980 to 2000 - which spans over 3/4 of the boom in incarceration - private prisons were a single digit percentage share of the market. US incarceration from 1980 went from about 550,000 to 2.1 million by the end of Clinton's second term. Almost all of that went to government prisons and jails.

Turns out there is vast profit in government prisons. It goes into the pockets of millions of government employees and private contractors that benefit from the huge government prison complex. Those employees and their reps then spend millions of dollars lobbying to build more government prisons for their own benefit, along with lobbying against laws that would reduce incarceration.

Politicians love to build government prisons to employ people in their districts, to lure tax dollars, it has been an easy vote generator for decades for them.

Further, the extreme expansion of the government prison complex the last three decades, has increased the total power and size of government, another thing politicians go wild for.
There's a lisp interpreter written in Brainfuck, does this count ?
Ouch, you really see everything :

> authorization: OAuth oauth_consumer_key ...

what a shit show. I'm sorry but at that point there must be consequences for incompetence. Some might argue "But nobody can't do anything" ...

I'm sorry, CF has the money to to ditch C entirely and rewrite everything from the ground up with a safer language, I don't care what it is, Go,Rust whatever.

At that point people using C directly are playing with fire. C isn't a language for highly distributed applications, it will only distribute memory leaks ... With all the wealth there is in the whole Silicon Valley, trillions of dollars, there is absolutely 0 effort to come up with an acceptable solution? all these startups can't come together and say: "Ok,we're going to design or choose a real safe language and stick to that"? where does all that money goes then? Because this bug is going to cost A LOT OF MONEY to A LOT OF PEOPLE.
Via bittorrent. It's much harder to get the video now that fewer people are sharing it.

It's part of a series where the journalist (Stacey Dooley) visits different countries (including Greece and Ireland). The full episode along with links to other episodes is also on Youtube & DailyMotion. The links are in the description box below the video.
here's the JVM bypass: http://seclists.org/fulldisclosure/2014/Dec/26 / http://www.security-explorations.com/materials/se-2014-02-re... (see page 58 for some fun)
By the way, is it possible to use Signal to communicate with people using WhatsApp? Probably stupid question, but since they both use Signal protocol, phone number and stuff I would guess it should be possible to write a bridge that reveals to the MITM (FB) only your phone and the fact you are talking to the person they know, and blatantly lie about everything else, such as your contacts, seen messages (if desired), etc.
Having access to code and data you don't technically "need" is often how people learn new skills and advance their careers without leaving the company. It's an important part of the culture.
It's interesting to note that when the first MD5 collisions were discovered a bit over a decade ago, they were computed by hand calculation. Next came the collision generators like HashClash/fastcoll (remember these?) which could generate colliding MD5 blocks within a few seconds on hardware of the time. I wonder how long it will be before the same can be done for SHA-1, because it seems here that they "simply" spent a large amount of computing power to generate the collision, but I'm hopeful that will be reduced very soon.

As for what I think in general about it: I'm not concerned, worried, or even scared about the effects. If anything, inelegance of brute-force aside, I think there's something very beautiful and awe-inspiring in this discovery, like solving a puzzle or maths conjecture that has remained unsolved for many years.

I remember when I first heard about MD5 and hash functions in general, and thinking "it's completely deterministic. The operations don't look like they would be irreversible. There's just so many of them. It's only a matter of time before someone figures it out." Then, years later, it happened. It's an interesting feeling, especially since I used to crack softwares' registration key schemes which often resembled hash functions, and "reversing" the algorithms (basically a preimage attack) was simply a matter of time and careful thought.

There's still no practical preimage for MD5, but given enough time and interest... although I will vaguely guess that finding SHA-256 collisions probably has a higher priority to those interested.
A totally legit question. Yes I would have approved but there you had a state of open war. Short of that unhappy circumstance, assassination is usually either a tool of oppression or an act of war, neither of which are things I'd want to perpetuate. Once hostilities have been declared then the ethical calculus changes significantly.
I'd like to see how much of a mess their argvs are
Fixed: https://github.com/pirate/sites-using-cloudflare/raw/master/...
Tesla looks for SolarCity savings as challenges mount
In 20 years, the $100,000 attack will be a $100 attack (or perhaps a $1 attack), but programmers of the day will be overwhelmed with fixing all the 32-bit timestamps that everyone ignored for 50 years because the clearly forecast problem hadn't blown up in their faces quite yet.
I've been going through Google's and Bing's caches for about 2 hours looking for leaked credentials and I don't see much - many results don't have an option to view a cached copy. I think Google and Bing are wiping any cache entry that are affected by this vulnerability.
I had duplicates, it's actually only 4,287,625 (still a lot though).

Fixed the duplicates: https://github.com/pirate/sites-using-cloudflare/raw/master/...
DataTau: HN for Data Science
Yes, this is correct. It's a really simple principle, and I think an explanation can help you understand :)

Suppose you have 3 holes, and 4 pigeons, and you stuff the pigeons into holes. There must be 1 hole with at least 2 pigeons, right?

The same is true with hash functions. If you're hashing data down to a fixed length, like say 256-bits with sha-256, and the data is longer than 256 bits, there must be a collision somewhere.
(whoops forgot to remove dupes, it's only 4,287,625) https://github.com/pirate/sites-using-cloudflare/raw/master/...
You won't need to change your Google password, that's never given to websites as part of Google's OAuth process.

You may want to revoke access at https://myaccount.google.com/permissions and reconnect to SO.
> FSB ones might be fun too. There is a certain class of grammar mistakes Russians make when writing in English. You could filter by that in addition to other stuff.

Cool, you would filter me out too. Or would you not? If my English is good enough to confuse your bot, then what stops FSB from hiring somebody like me?

Also, what stops FSB from hiring native speakers of English?

There are plenty of people on the Earth who speak Russian, but don't live in Russia and don't support the Russian government. Bear that in mind too, please.
Functional MRI in woke dogs predicts suitability for assistance work
It only triggered the bug on sites that were using those features, but any other CF site was vulnerable to getting dumped out.
Adam Smith, Watch Prices, and the Industrial Revolution [pdf]
Kinship, Fractionalization and Corruption
it doesn't make it any less positive because it has been reversed...
always wondered what dA's stack is. anybody has any insight?
In the steady-state, renewables will be cheaper.

For fuel-based plants, you have the cost of the plant, the mine, the transport between the mine and the plant, as well as the clean-up. That's quite a lot of operating cost on top of the capital cost.

For a network of solar-panels and domestic batteries, it is almost all capital cost. There is no fuel transport, no mine, etc. And whereas one massive plant with one massive mine is a decade-long planning and construction process, the domestic panels and storage are each very short installations that can happen largely in parallel.

The domestic solar+storage grid should win, because it is a heck of a lot faster to marshall consumers into buying a consumer good, than to plan and build out nation-wide infrastructure projects.
I check in on DataTau occasionally, but it's not an active community. You're better off with https://www.reddit.com/r/MachineLearning/
Wouldn't this imply that all hash functions (other than one-to-one mappings) must have collisions?

Yes, they do. Finding them is the hard part.
>how do you know the person is not, in fact, a citizen?

By checking their ID?

Don't you think it's a little hypocritical of you? You seem just fine with green card holders being subjected to something you yourself would not stand for. My spouse has a green card. I find the requirement rather onerous given the level of scrutiny required to get one.

Edit: Oh yes. Let the down votes begin. How many DHS officials looked through your wedding photos? ID requirements are fine for "those" people.
Don't worry about someone making this knowledge public. Worry about whether it were to fall only into the wrong hands.
Considering Apple's significant profits and cash in the bank... Apple is well-suited to fund a loss-leader products that bolster their cachet in the professional community -- putting their platform on the front-lines of culture creators.

Furthermore, today's demanding professional are tomorrows Joe Schmoes: having the hearts and minds of pioneers would them better see what's coming on the horizon. It just seems silly not to invest money to keep the power-user niches happy.
This comment is beyond unproductive - it is outright rude. Please try to be civil - your points would be significantly more palatable.