skysight-inc/HackerNews huggingface dataset:
Immediately i see you have this line:

>And until we develop an AI powerful enough to write clear, step by step instructions for any random task, code will be written.

so its "will never be at risk of automation UNTIL" which is vastly different from "will never be at risk of automation"

The article we are commenting on is about an AI writing code, so im not sure im seeing a convincing argument here.

secondly, automation isnt about some industry disappearing overnight, its about an ever decreasing amount of jobs in that industry. You cant imagine a system/tool/framework that allows such greater efficiency that a single developer can now reach the output of 5 or 10 developers?
No, but companies are (sigh). This is really an expression of Citizens United. Alexa and Siri use cute names to cover it, but "Ok Google" reveals what you're really interacting with for these sorts of tools: You're talking to a company.
but a lot of things use defaults or common practices which could be collected and used. and if this AI had a chat interface it could prompt for some of the requirements. for a lot of users its not knowing the questions. and the pros and cons of the answers.
What about git?

This makes it technically possible to get a backdoored linux repo with the same commit hash.

EDIT: this is wrong, it's not a second pre-image attack only a collision attack. That is, you can create 2 git repositories with the same commit hash, but not a git repo that matches an already existing repo. In other words, you can create 2 things with the same hash, but can't control what that hash actually is.

You might be able to fashion 2 commits to the linux repo with the same hash but a different modification though.
App Navigation Routing Algorithm
On a rooted Android device, TitaniumBackup can be used this way (not factory updates, but those don't get wiped by factory reset anyway).

However, it doesn't solve your real problem, which is that you can be compelled to log into your social media accounts in the presence of the border control officers. You can do that from the browser on a wiped phone, or on their equipment.
The first collision for full SHA-1 [pdf]
Read the 'whole' [not that big] page. The explanation is there, in short: yes.

>How is GIT affected?
GIT strongly relies on SHA-1 for the identification and integrity checking of all file objects and commits. It is essentially possible to create two GIT repositories with the same head commit hash and different contents, say a benign source code and a backdoored one. An attacker could potentially selectively serve either repository to targeted users. This will require attackers to compute their own collision.
Well, looks like this guy was wrong: https://lwn.net/Articles/307281/

Copy-pasting for posterity:

I've been informed by the git Gods that the chances of a
SHA1 collision is the same as the Earth being sucked up into
the black hole created by the CERN accelerator. If this is
indeed true, then there's no need for that extra memcmp.
MongooseIM 2.0.1 more stability for app developers
So apparently it's still in use for GPG and for Git? Why wouldn't that have been switched over to SHA-256 at some point?
https://news.ycombinator.com/item?id=13713603
Are you comparing to Lyft or Lyft Line?
So... you are saying I couldn't do this on my Macbook's Core i7?
The series of tubes analogy was pretty sound. Hell, it is even literally true now.
The PDF says:

> Using a p2.16xlarge instance, featuring
16 K80 GPUs and nominally costing US 14.4 per hour would cost US 560 K for the necessary 71 device years
EDIT: My original comment was wrong. Git commit signing apparently only signs the commit hash itself, so it's only as trustworthy as the integrity of the hash. However, see also other comments which point out that this isn't a pre-image attack; you can't find a collision for a given thing (in this case, the linux kernel); rather, you can generate from scratch two pieces of data which happen to collide. Still, this is worrying.

ORIGINALLY (INCORRECT): Git commit hashes were at least never intended as a form of authentication. That's why git has commit signing. That said, they list GPG signatures as one of the things affected by SHA1 brokenness, so maybe even that's not enough? I don't know enough about how git commit signing or GPG works to tell.
Probably peanuts to any 3 letter government agency.
On a hiring and a being-hired perspective of my own, I agree with you.
https://workfrom.co/ has more data
can we put the date in the title?
Athletic is subjective of course. I do think boots are fine for most, so this is a good addition, but if you run a lot your ankles are probably pretty strong. And moving heavy boots every step slows you down.

Caveat: I run ultramarathons and have thousands of trail miles on my feet. Never rolled an ankle. Never worn boots for 99%. Sample size of 1, etc, but I have met many others in this camp. Shoes can get "religious".

If you are on super rough terrain or mountaineering you also want specific boots.
Hi all,

MongooseIM, the massively scalable XMPP/Jabber server, written in Erlang, under GPLv2, is available in version 2.0.1.

What's new?

=> For DevOps/SysAdmins

Cassandra DB support for MAM (XEP-0313: Message Archive Management)

Simplified MAM configuration

ODBC/RDBMS backend for MUC light

MUC hibernation, for memory saving

=> For client developers

SSE (Server-Sent Events), as an addition to our client-side REST API, for server to client real-time push

XEP-0363: HTTP File Upload

Improvements to XEP-0016: Privacy Lists and XEP-0191:
Blocking Command

=> Raw versions of the changelog

https://github.com/esl/MongooseIM/releases/tag/2.0.1

=> What's coming next?

Mangosta Android and Mangosta iOS: opensource mobile clients, with focus on social microblogging and group chats (just a humble techno demo, only available as source code, no intention to go on AppStore/PlayStore)

An opensource push notification server written in Elixir

An opensource ICE/STUN/TURN server written in Elixir

=> Links

https://github.com/esl/MongooseIM/

https://twitter.com/MongooseIM/

The documentation: https://mongooseim.readthedocs.io/

Any comment?
Is this your way of saying that the term "Latin America" does not include French-speaking nations? Because the French apparently created the term and it included French Guiana.
If a potential employee contributed to an open source project that is a plus and something to talk about. But I would NEVER expect it. 99% chance their previous employers would have kept all of their source code private and not public on github.
And every 6 months you need to learn the latest and greatest new framework if you live in JS land.
You're making the assumption that companies need to accomplish a constant amount of work, and that they only hire enough developer to perform this work. I would argue that many companies have a limited budget, and will continue hiring developers to expend this budget. Once hired, there is effectively indefinite work that can be done, and which will better the position of the company. If each developer can do 5x more, then the company will accomplish 5x more, not spend 5x less.
Maybe just writing 2^63 would have been easier to interpret than that huge number in the context of cryptography. (Unless you assume this targets a non-technical audience, which I doubt.)

Pretty impressive, though. And worrying, because if Google can do it, you know that state-level actors have been probably doing it for some time now (if only by throwing even more computing power at the problem).
I don't think it's that simple. Imagine a simple add(int32, int32) int32 function. Unless you write a test for all 2^32 * 2^32 possible inputs and their expected outputs, how could you guarantee that the AI will come up with the "correct" implementation?

Automated tests are generally not practical for proofing program correctness. Why would you expect them to be sufficient as a specification format?
Say you want to replicate this in 1 month, you need 1320 GPUs for a month. They didn't specify which ones, but say at 1000 bucks per GPU, that's a 1.3M USD investment. And some pocket change for power etc.

There isn't anything new about this result actually, Google just set aside the necessary resources to demonstrate it.
Can someone explain how they made the two PDFs cause the same hash, I feel that's the bit that's missing from the explanation
Big things affected:

* DHT/torrent hashes - A group of malicious peers could serve malware for a given hash.

* Git - A commit may be replaced by another without affecting the following commits.

* PGP/GPG -- Any old keys still in use. (New keys do not use SHA1.)

* Distribution software checksum. SHA1 is the most common digest provided (even MD5 for many).

Edit: Yes, I understand this is a collision attack. But yes, it's still a attack vector as 2 same blocks can be generated now, with one published, widely deployed (torrent/git), and then replaced at a later date.
Social conditioning ~= socially more acceptable, would you agree?
You make it sound like Google gave up because it was unable to fight regulations designed to keep incumbents entrenched. Google got unprecedented concessions from municipalities in terms of franchise requirements, fast-track permitting, etc. For example, the kerfuffle in NYC with Verizon's FIOS buildout (whether it has built out to all housing units?) Google won't even bring fiber to any city that imposes build out requirements.

Your view of the world doesn't explain why Google doesn't build fiber to cities like Baltimore and LA that have been publicly disparaging their incumbent providers and begging someone to come build fiber and compete. Or why Google won't wire up Silicon Valley. Is it at all credible to suggest Comcast or whatever has more pull than Google in Google's own backyard?

I tend to agree with your overall point that regulated monopolies are the way to go for internet service. But that has its own set of challenges. The AT&T monopoly worked pretty damn well to tell the truth. They built what was at the time a gold-plated telephone network. It was also expensive for consumers, and the government was willing to let AT&T be profitable enough to make building worth its while. That's very different than how "utilities" are regulated today, where they deal with crumbling infrastructure because no politician wants to authorize raising water or sewer rates.
Soda Sales Fall Further in Mexico’s Second Year of Taxing Them
> Historical breakdown doesn't mean much since very few people were computer programmers at all back then.

Programming was a different affair too. You have to be much more detail-oriented to deal with punch cards and spaghetti goto code; this means fewer people get to be big-picture focused.

Going back a couple decades further, computers were huge halls where women did small calculations by hand; someone (Oppenheimer, Feynman or some such) did the big picture work and divvyed it up much like physicists now give Matlab or Fortran work to do.
Like the semi-colon; useful for showing you went to college.
The Motivation for Julia
Do you have a pay_pal ? because if you have you can get an additional 1600 weekly in your pay just working on the internet 4 hours per day.. see this site... http://bit.ly/2atnA1a
Water quality data for national-scale aquatic research: The Water Quality Portal
Computing a collision today costs about $100K from my reading of the paper. So most uses of SHA1 are protecting documents of far lower value, and would not be likely attack targets (today).
> "x=x+1" must be especially confusing to high-school kids

I like immutability as much as the next programmer, probably more. But the idea that changing the value of a variable in memory is confusing to high-school kids gets repeated way too often with way too little evidence. X isn't the x from algebra, x is your bank account balance. That it changes at payday is not a hard analogy to understand. I have yet to meet the high-school kid who thinks this says that 1=0.

Now, like the rest of us, high-school kids can get tripped up by assignment and its consequences. Functional programming offers us great tools to deal with that. But the 1=0 argument is not credible to your average procedural programmer who's been doing assignment since the age of fourteen, and is in full command of basic algebra. A much better argument would be that Haskell lets you take advantage of algebra as an analogy, and Python doesn't unless you're unusually disciplined.

Edit: removed a word for grammar.
How Small Firms Can Defuse a Political Threat and Blunt a Boycott
Link to the actual data portal. Submission contains the abstract: https://www.waterqualitydata.us
I see it here in the Netherlands as well, one cause is that we had some referenda in which the majority vote (no against a European constitution (we got the Geneva convention), no against associating with Ukraine) was ignored. This is of course food for anti Europe sentiment. That and then the never ending stories of bureaucratic non sense like the monthly move of parliament from Brussels to Strasbourg.

[0] http://www.telegraph.co.uk/news/worldnews/europe/10565686/Th...
> SHA-1 is still used in some important software like torrents and git.

Which can be appropriate. Not every use of SHA-1 is security focused, it might also be combined with a file size and used to check for file consistency.

The same thing happened with MD5 (which is much more broken). People freaked out because some software was using the "insecure" algorithm while entirely missing that it was used a file consistency check (in combination with file size) rather than for security within its own right.

If you're doing security work, you should already know that SHA-1 is unacceptable. If you aren't doing security work then you MIGHT want to look into something else but only if there would be a benefit to someone abusing a SHA-1 collision.
Yeah, it seems like a non issue for Git.
Do you use a pay~pal ? because if you do you can include an extra 300 a week to your earnings only working on the internet for 5 hours per day, check this site... http://bit.ly/2atnA1a
Ars technica's article is not as optimistic:

> Had the researchers performed their attack on Amazon's Web Services platform, it would have cost $560,000 at normal pricing. Had the researchers been patient and waited to run their attack during off-peak hours, the same collision would have cost $110,000. That's within the $75,000 to $120,000 range CWI's Stevens projected in late 2015.

Not cheap but definitely achievable by a wealthy individual or corporation.
Active discussion: https://news.ycombinator.com/item?id=13713480
if there are any important ssl certs signed with SHA-1, the race has just started.
Circa 870,000 USD using AWS p2.xlarge instances.

edit.: they seem to quote 560k, I overlooked using both the CPUs and the GPUs.
You can also open a terminal and type 'python3', and get a Python 3 REPL.

I only learned recently that it's a compatibility decision that means that plain 'python' will always be Python 2. However, you're starting to see Python 3 distributed right alongside it in most recent distros.
Well he seems to be talking about a random collision, not an attack. So not really the same subject.

See the end of his post: "He did show some concern that there might be a way to crack the algorithm"
Is a 30 day disclosure period really enough for something like this? It's obviously not possible to 'fix' big systems that rely on SHA-1 such as git or github in only 30 days. Hardware devices that use SHA-1 as a base for authenticating firmware updates?
Linus' answer: http://marc.info/?l=git&m=115678778717621&w=2

tl;dr it's a non-issue
I prefer to use both. They provide different approaches to learning, that complement each other.
Scientists finally have the technology to test Einstein's theories
>git has commit signing

What the commit actually signs? Is it the sha1 hash?
F12, delete element
> What is currently still not feasible is to create a custom git repository whose HEAD matches that of the Linux kernel.

I'm not convinced that's good enough.

In git, the SHA1 is always the hash of a gzip, which is subject to tricks[1] where a header might be prepared and then some padding inserted to collide a malicious tail.

[1]: http://swtch.com/r.zip
That is a bit of hyperbole. Just as MD5 is a good hash function, as is SHA1 - they just are not good cryptographical hash functions. We've known this for more than a decade, so this is just confimation of what we already knew.

That said, it's relatively straight forward to upgrade Git for instance, but it will break all external linking to a repository unless they store both new and old hashes for existing commits. If the hashing function in Git should have been secure, it should not have been created with SHA1 in the first place, as it was known to be broke before development even began.
For some cities maybe, but it really depends.
>torrents

Good, if something stronger and better comes out it'll still be a win.
SHA1 was shown to be flawed in 2005. That's more than 30 days ago.
Kymeta's solid state connected car satellite antenna technology
The article states 90 days.

> we will wait 90 days before releasing code that allows anyone to create a pair of PDFs that hash to the same SHA-1 sum given two distinct images with some pre-conditions
Of course not. It's just that a lot of the biggest software companies—Google, Facebook, Pinterest, Twitter, Snapchat and to an extent, LinkedIn—are advertising companies
I think you're missing the big picture. As said in the parent, other news are covering also the story with her real name and pictures.

It's a shame fest with media trying to give as much info on the woman they can. Not this article in particular, but the coverage of the story is borderline hateful. The Internet don't like cheater.
Thank you. It took me a while to realize that the paper you're citing is not directly linked in the Google blog article. It is actually found at shattered.io:

http://shattered.io/static/shattered.pdf
They provide an estimate in their paper:

> The monetary cost of computing the second block of the

> attack by renting Amazon instances can be estimated from

> these various data. Using a p2.16xlarge instance,

> featuring 16 K80 GPUs and nominally costing

> US$ 14.4 per hour would cost US$ 560 K for the

> necessary 71 device years. It would be more economical

> for a patient attacker to wait for low “spot prices” of

> the smaller g2.8xlarge instances, which feature four K520

> GPUs, roughly equivalent to a K40 or a GTX 970. Assuming

> thusly an effort of 100 device years, and a typical spot

> price of US$ 0.5 per hour, the overall cost would be of

> US$ 110 K.
The signature affirms the validity of the SHA1 hash, so ... the GPG is not more helpful than the underlying SHA1.
8 tips to know while hiring a Web designer for your business
i can imagine the torrent thing to be worth the $100k per collision.
I find Harvey Friedman has made the FOM mailing list completely unreadable. AND incredibly hostile to anyone with any sympathy to category theory, type theory, or the like. See https://plus.google.com/+CodyRoux/posts/6TiKLxjSCnu (not by me, but expressing many of the same thoughts I've had; I particularly agree with many of the comments made by John Baez).
Hosting a PyPI index on S3 is simpler, but I admire the effort here!
> Nowadays I tend to use Google searches instead, as Google pays contributors to keep details in their area updated (eg free 1TB Google Drive after a certain number of contributions).

They've removed the 1TB/100GB benefit entirely [1], but they seem to have achieved their goal (of crowdsourcing updates).

[1] https://www.google.com/local/guides/benefits/
I may have misread, but I thought from the article they said that the period would be 90 days before the release?
Dell 1815dn Driver Download
About tor: if an attacker produces a public key that collides with the SHA-1 hash of someone else's hidden service, then he would still need to generate the corresponding RSA-1024 private key, which is infeasible as of today.

Is this correct?
Almost certainly padding the file to match.
Am I correct in assuming this is only a US problem?

I am curious what the landscape will look like in the next decade, as "data" prices increase, while local storage continues to plummet.

It reminds me of "Exit Strategy" by Douglas Rushkoff, where it discusses vertical brand integration.
The last 5 I used today:

- Help Scout builds awesome helpdesk software

- Feedly a perfect RSS/feed reader

- New Relic the best APM (and more) platform

- Ghost Inspector is perfect for automated browser testing

- and Runscope for API monitoring and testing.
It's not used as a security feature in Git (though SHA-1 is designed as a cryptographically secure hash) but Git commit singing does use SHA-1 b/c GPG.
None of what you mentioned is affected since this is a collision attack. They purposely created 2 files with the same hash.

Creating a file with the same hash as legit file is a preimage attack and is much more difficult to perform (many orders of magnitude more difficult).

This still doesn't mean that SHA-1 isn't dogshit however. It should have been phased out years ago.
Bittorrent is not a static/unchanged old protocol. It has constantly evolved to keep up with any attacks that could be mounted on it's distributed nature.

I'm sure a BEP will also come up, and speedtracked on the back of this news.
With depreciation over a year, that falls to a USD 100k investment per attack; if realistic to depreciate over 3 years, that falls to USD 30k per replication. Not so expensive on these terms.
Does Verizon FIOS still exist, or has it all been "sold" to Frontier?
71 device years, on an p2.16xlarge instance, I think the NSA could certainly come up with something way moar better in a shorter timeframe, assuming they haven't already done so.
Firsthand Account: The Assassination of Malcolm X
Create 2 torrents with the same hash.

Release one into the wild.

Wait.

Infect.
Unfortunately, the cost of preventing piracy is building a global censor with authority to veto any use of the system. Which can also be seen as "evil".
It was broken 12 years ago, so no serious software that require cryptographically secure hash functions should use it.
It's quite common to hire an interim executive to take unpopular but necessary actions and then leave, taking a large chunk of the ill-will with them and clearing the way for the new management to move forward. If you're the sort of person who can handle being the bastard everyone will hate, then it's a great way to make money.
I don't think we're likely to see it used for torrent poisoning if it takes 110 GPUs 1 year to compute a collision - the electricity costs for such a rig would be enormous. 110 GPUs * about 300 W each = about 290 thousand kilowatt hours to break. Electricity costs of at least 10s of thousands of dollars. For a single torrent. You better be damn confident that those torrenters are going to go buy your product and that they won't just go to the next torrent down the list.

That said, attacks only get better, so it could happen at some point in the future and it's probably worth switching the hash function used sooner rather than later.
Could an AI coding assistant understand what you want it to code on line #?
Careful, that's not what I'm claiming.

First, allocation is only so cheap if it's temporary. If objects survive minor collections, then there's additional cost, as they get promoted to the major heap. The key idea that I'm getting at is that with temporary objects being cheap, you have more flexibility in creating temporary data structures and do not have to fit them in the constraint of a stack frame and (unlike with alloca()) do not have to worry about stack overflow and they can be returned from a function without copying (unlike stack frame contents).

Temporary data structures will still be small and generally fit in the L1 cache of any reasonably modern processor. And using pointer does not mean that everything is a pointer, and that you're necessarily sacrificing ILP.