skysight-inc/HackerNews huggingface dataset:
That's more than just an oversimplification.

Security is inherently hostile, I don't see any other way of putting things. We tolerate a certain amount of hostility in order to reap the benefits that security gives us, and we tolerate a certain amount of vulnerability in order to reap the benefits that laxness gives us.

> If someone needs access to something, they request it, you grant it. Simple.

The saying goes that for every complex problem, like security, there is a simple solution, like that one, and that solution is wrong. The cost of such a process is just too high for most companies. You have to request access, explain why you need access, someone has to review it, then grant it. That's how it worked at the company I was complaining about. Processes that should take minutes took hours, those that should take hours took days.

Security, like so many things, is subject to cost-benefit analysis. Better security systems use the full triad: prevention, detection, and response. From the article, it sounds like these are working as intended. The security team detected the exfiltration and responded with a lawsuit. Trying to rely only on prevention will just lead to paralysis.

I might also be jaded, because when I hear phrases like "good practice" my instinct is that it means "omitting the cost-benefit analysis."
What exactly would constitute founder-friendly seed / series A terms in the area of future investor participation rights? Are we literally saying any right of first refusal is onerous, or is it just the multiple that gave Lightspeed up to 50% of the next round (which sounds like a 2-2.5X multiple)?

Sam Altman has a right of first refusal provision in his "founder-friendly term sheet". At least I think he does.. he doesn't call it a ROFR, preferring the plainer language of "investor participation rights". But it's there and even the multiple is left as an open variable.[1]

So are @sama's terms actually spat-worthy?

[1] http://blog.samaltman.com/a-founder-friendly-term-sheet
Yeah, that really surprised me when I saw an ad for driver recruitment that the initial incentive is a trip count one. Sure they have some anti-abuse system in there, but seems like a weird one to lead with in big cities where you could rack up 20 short trips in quick succession.
This happened to me on Hangouts.
I think you're seriously underestimating cloudflares fuckup here.

Listing all CloudFlare proxied sites is exactly the right thing to do. Everyone seems to have been in the scope of the bug, and CF doesn't seem to have any good way of identifying affected customers.
I must've missed that story, when did Uber steal competitor IP?

(Except this one, of course. To be fair it was Otto before the acquisition)
SteamVR for Linux is now officially in Beta
I did the transition from Windows to Mac last year after many years of having both and hating OSX while loving Windows. Now I love it.

The event that changed everything was getting a 34" Ultrawide monitor and the Mac experience was just so much more solid and respective of the screen space. I can't quite put my finger on it but I felt more in control.

I have a Surface Book on my desk, but my Macbook Air is what I use daily. For me, Mac wins with:

- Predicable window management - everything stays where you put it

- Tidier fonts and app bevels so it doesn't waste screen space

- Access to apps like Sketch

- No UI delays when using Adobe Premiere, despite the less capable hardware - definitely an issue on Windows

- Much better command line support (not used the Windows Linux subsystem)

- Apps are easier to handle and less bloatware

- Notes app that is actually helpful

- Fast with an SSD - absolutely rubbish without (my mac mini is unusable)

- I have gotten used to clicking the window first, before it doing something in that app - so fewer accidental actions

But, I do still love Windows, it wins on the following:

- Better graphical support (ok, hardware specific)

- Windows Explorer is much better than Finder for me

- Window snapping is easier (but might be also frustrating, can't put my finger on it)

- I can open multiple calculator instances

- Wider app support, but less of an issue these days for what I use

Windows does have a lot more bugs, such as incorrectly scaled cursors in Premiere, or apps that a impossibly small or stupidly large when using a non-retina second monitor.
Horizon enables a "Programmable Edge" for Analytics and Cognitive Applications
This is based on https://github.com/open-horizon

Anybody knows more information about open-horizon and how to run it?
This might be all completely true but doesn't regard mindshare or loyalty. Apple has historically had a fanatical fan base, and should be spending a small fraction of their huge cash reserves to make sure they keep a fanatical fan base.
Programming is easy if specs are frozen. I want to see that neural network discuss with my managers about inputs/outputs. Good luck.
The problem is I can't now download a git repository from someone I don't trust, verify it is correct, and then publish "I, Chris Jefferson, trust git commit abc125.... is good.". Now I would have to be sure everyone who has ever committed to that git repository wasn't trying to do something dodgy.

I have put git commits into scripts I run on automated servers for example, to be sure that every server runs exactly the same copy of the program.
For the argument at hand (Can you deploy anything on a production server from a third party that is only verified cryptographically?) signatures and hashes fulfill the same function (and btw I also wrote "verifying it against a hash or signature" above). More to the point, under the hood GPG signatures only sign a hash of the file in question anyway. Verifying a file via a GPG signature is strictly less secure than verifying it by its hash (assuming you use the same hash function as the signature).
Marketing in Your Car [FREE Pre-Loaded MP3 Player]
Do You Love Funnel-Building As Much As I Do?!!

YESS!!!??? Then Come Get Your FREE Pre-Loaded
MP3 Player With 527 FunnelBuilding Tactics Straight
From The Man Himself RUSSELL BRUNSON

>>CLICK THE LINK TO GET YOURS TODAY<<
https://theviralgeneration.sendlane.com/view/marketing-in-your-car

SEE YOU INSIDE!!
Ask HN: Why are so many people here fascinated with solo-founder business?
I found my mistake g2.8xlarge have 4 GPUs each, so it cuts the cost by 4 (~626k per collision). p2.16xlarge have 16 GPUs (~867k per collision). Exact model of GPU not taken into account, so this could vary widely.
There's an absolutely terrifying book by Ken Alibeck ("Biohazard") about the Soviet secret chemical and biological warfare programme. (https://en.wikipedia.org/wiki/Ken_Alibek)
Basically yes. If some of your traffic was flowing through a server on which any customer had the vulnerable features enabled, parts of your traffic may have been dumped.
The internet reveals the horrifying nature of humanity.
So its not only the tor browser experience that sucks with cloudflare.
I was booted off YouTube streaming on my AppleTV. Then my main account disappeared from iOS GMail app, even though a secondary GMail account was still there.

Was afraid my accoutn was hacked. My GMail password is unique and quite long compared to my other pw so I doubt someone could find it.

I added the account again on the iOS GMail app and then signed in YouTube and it was back to normal... hmm.
they explicitly mentioned all my stuff will get deleted.
> because they are undercutting the Marathi autowales.

Vast majority of the cab drivers are from the Northern states. The natives of Mumbai dont want to drive cabs.
Set Bing's photo-of-the-day as your desktop's wallpaper, Automatically – Windows
I don't what what she was really doing, but from her blog post, it didn't seem like she was "hit on by colleagues". In general, while I think it would be beneficial for companies to employ only asexual (and otherwise perfectly rational) people, realistically employees are going to fall in love, and there's nothing wrong with that. So if she had been politely propositioned by a coworker to go on a date, in a way that would allow both of them to save face (usually, this is done by making the request ambiguous, "I only meant as friends"), then I'd agree that reporting that to HR would be unnecessary and inappropriate.

But I don't think that her boss essentially emailing her "I can't get all the sex that I want" on her first day of work quite falls under the above scenario. While there's nothing wrong with no-strings-attached sex between fully-informed partners, I do think that employees should avoid that - you can't really help falling in love with someone, but please "keep it in your pants" (and the equivalent for women) at your workplace.

In addition, if there's something wrong and you need to be mindful of your "political power" before reporting it, then there's much more wrong.
Well even if there is no immediate danger, still it "proves" that Google has problems controlling its security and/or software engineering process.
Did exactly this in December for CUDA based 3D rendering.

Been a mac user for 15 years. It was hard to make the jump but I came to the realisation Apple just doesn't care about my work and therefore my money anymore.
A quote from the page:

> This list contains all domains that use cloudflare DNS, not just the cloudflare proxy (the affected service that leaked data).
"their personality doesn't appeal to the zeitgeist"

Really? The only problem you see at Uber is that their personality doesn't appeal to the zeitgeist? They are unpopular for superficial reasons and that's it?
http://calteches.library.caltech.edu/51/2/CargoCult.htm

"Cargo Cult Science"

> I looked into the subsequent history of this research. The subsequent experiment, and the one after that, never referred to Mr. Young. They never used any of his criteria of putting the corridor on sand, or being very careful. They just went right on running rats in the same old way, and paid no attention to the great discoveries of Mr. Young, and his papers are not referred to, because he didn’t discover anything about the rats. In fact, he discovered all the things you have to do to discover something about rats. But not paying attention to experiments like that is a characteristic of Cargo Cult Science.
Best defence against this, if you're worried, is to wait 24 hours after gaining control of the domain, then check Certificate Transparency monitors for issuance in that domain.

(24 hours is the CT Maximum Merge Delay, a correctly operating log promises to be able to reliably and consistently tell the monitors about any certificates logged more than 24 hours ago)
nation state.

The issue is that territories often shifted hands, and what territories happened to be ruled by the same people often boiled down to which monarch happened to inherit or conquer which areas.

There simply was no clear unified concept of a nation of people.

The rise of the national states came in part as a result of Romantic Nationalism (or Nationalromanticism) [1], and the wave of revolutions that swept Europe in particular as a reaction against the above:

For the first time there was the rise of the sentiment that certain areas belonged to certain states because their people belonged together due to common language or culture, rather than because the territories were owned by a specific monarch, or because of a given convenient political association.

This coincided by wholesale creation of cultural mythos. E.g. Norway had not existed as an independent kingdom since 1380, and had only existed as a unified kingdom for a few hundred years at that time. But with the rise of Romantic Nationalism, authors and artists and politicians contributed to creating a mythos of a Viking era Norway and Norwegian people that had a common destiny.

Norway was nothing special in that respect - it is one example of dozens in Europe alone where nations were spun out of mythology or ideas about a shared history or destiny that largely boiled down to finding convenient political or language boundary and creating a mythos that fit them.

[1] https://en.wikipedia.org/wiki/Romantic_nationalism
What did it show before it was taken down? In vague terms, of course.
I've been thinking of making an ant colony roguelike for a while now. And this article has given me great ideas for content.

Thanks OP
This is at about 38 upvotes ATM, and I believe it may not be killed for anybody's whims after that. It's tech-related, actual, and liked by the community here (not that is of particular interest to me but still).
Show HN: DatoCMS – A client-friendly CMS for any static website generator
Toptracker – Free, platform agnostic time tracking for freelancers
You have a very good point here.Believe or not,the one thing that totally changed me mentally was playing Chess.It was a total enlightement.
# I learnt that we make tons of Mistakes.
why do we make mistakes?
>most of the time our minds run on auto-mode.
>we play with emotions;emotions block our minds
To really improve you start by accepting failure, reflecting on your own mistakes which is very painful .you have got to tame your ego!
and this is very important at least to me :you have to forgive yourself,and give yourself time.

# having a worst plan ;is better than no plan.always aim at something,and be flexible with you plan.

# never resign,swallow you ego and make it hard to your opponent to win.if he is better than you,try to learn his finishing technique.

# if you're wining pay extra attention,get it done with.

#Enjoy it;or learn to :)
> Which means the analogy was successful.

Sure, if he's saying he is powerless against higher powers. But if he's trying to make a quantitative assertion, a qualitative analogy is not the right tool.
Hi guys, creator here. We started building DatoCMS as a side-project a year ago as Contentful was way too complicated for our web agency average brochure website client. We quietly launched the product 4 months ago: Since then we are getting steady signups and paying customers through organic traffic. Customer feedback has been an invaluable tool so far to route our development roadmap. Eager to receive some more feedback here :)
The problem is that it’s basically a fancy version of using MAC addresses for auth.

I’m more surprised a Google engineer couldn’t circumvent it.
> with the assorted noise and possibly thermal throttling if you use it for something that actually maxes out the CPU/GPU.

Yeah it's worth pointing out that the trashcan runs silent at full pelt, while the iMac sounds like a jet engine.

Keep this in mind when you imagine a row of 10 3d/video artists rendering away all day.
That's really interesting, thanks for taking the time to give a detailed reply.

I love the iOS platform, it just works and has never failed me (I am leaving iTunes out of this). However, even with the scaling/DPI issues I find Windows 10 fast and easy to use. It must be biased as I've used Windows more, but I thought I'd love macOS more than I do, having loved my iPhone & iPad experience. I do always have to put the taskbar at the top of the screen, but that I think goes back to my Amiga Workbench days!
Do you need a better proof that you're not in control of your own device you paid for ?
If the machine doesn't have full harddrive encryption, you can just boot from USB/CD/Firewire and have access to everything.
It's not available right now, but I recommend a BBC doc "Inside Porton Down: Britain's Secret Weapons Research Facility"[0], in which they showed nerve agents like this being created.

[0]: http://www.bbc.co.uk/programmes/b07hx40t
If people are concerned about the geographic link that too can be solved.

E.g. Norway uses proportionality within regions, and counts votes per party list and then keeps track of how many "wasted" votes each party has.

Then a small fixed number of seats are allocated in descending order of remaining wasted votes (each allocation removes an equivalent number of votes from that party-lists pool) from the region where that party had the most wasted votes.

There's also a 5% threshold in the national vote to be able to receive seats from that pool.

It both gets relatively close to proportional, still makes it possible for very popular independent candidates to get elected directly, and the seats used to even out are also linked to regions. The areas are just a bit larger.

Even 2-3 seats per district plus a few seats used to even out representation would give dramatic improvements in proportionality.
Great, now just flag "every opinion that's not ours" as toxic and you're set. Brave new world.
> I wrote some code yesterday and didn't share it - are you going to justify forcibly prying it from me?

No, but some realistic proposals include forcing developers to release their source as soon as they stop providing fixes for bugs to all people who bought a license.

Another proposal that’s currently demoed is the government paying a wage to all open source devs: https://prototypefund.de/2017/02/22/german-prototype-fund-gr...

> outright banning all closed source.

I’m not sure where you see the problem? With patents we already require you to publish the entire process to get protection – as algorithms are not protected by copyright, and most not by patents, a possible solution for software protection that’s discussed is providing copyright protection for software under the restriction that the source is published after a few years (and until then held by a trustee)
What if I sign in with facebook or other? Should I change muy password con facebook or what?
HTTP Headers were being including the http response bodies of other random websites. Those websites were being crawled and cached.
If Apple doesn't care about high-end desktops anymore (and it certainly seems that way), they could only license MacOS to third parties for desktop use. This wouldn't cannibalize their laptop sales, but would keep power users in their ecosystem. In the end they'd probably sell more laptops too.
Near as I can tell, the HTTP Headers from one site are being included in HTML of other sites...
Mid 2016 they were serving 4M requests per second.
This is simply not true. If TLS fails, the vehicle used for code delivery has been compromised and can be used to deliver compromised code. Everything written in the article is only true if you assume that the code is delivered with its integrity in tact, which on the web is a property that can only be guaranteed by TLS.
You can try searchIQ. I am using it for a while and my website search looks good so far. Though i am still using free version but they have also released Pro version with added functionality. You can have a look at that also.
> 1) Git doesn't rely on SHA-1 for security. It relies on HTTPS, and a web of trust.

Some security-focused developers sign git tags and/or commits, specifically to have things verifiable end-to-end and not having to trust HTTPS and all the middle men that entails.

Would that not be a case where git relies on SHA1 for security? Someone could replace a tag or commit with a malicious version that verifies fine since it has the same hash the original developer signed.

> 3) Even if someone managed to pull off a preimage attack, creating a "poisonous" version of one your git repository's objects, they'd still have to convince you pull from their repo. This requires trust.

In the case of signed commits/tags, this opens projects up to malicious action by hosting companies and others. Usually signed commits and tags are used specifically to avoid that exposure, because the developers don't trust the infrastructure.

> 4) Even if you pulled it in, your git client would simply ignore their "poison" object, because it would say, "oh, no thanks, I already have that object". At worst, the code simply wouldn't work. No harm would be done.

That only protects existing checkouts that already have fetched that commit. What about new checkouts, or older checkouts that haven't been updated yet?

Not disputing that this SHA1 collision does not signal any immediate emergency, just pointing out that git is used in different ways by different people, and some of those uses very much do depend on git's SHA1 for security.
Because it's a fullstack framework.
Why the sun shines for Oracle and it’s Cloudy for others
I got problems from clicking ever since I'm wroking on apps in emulators. The doctor said it's not dangerous though and if it gets more than just a bit annoying I assing the mouse-button to a keyboard key.

I love my chair: hag capisco https://images.duckduckgo.com/iu/?u=https%3A%2F%2Ftse4.mm.bi...
sadly slowly falling appart...
doesn't work with my setup, whois on cloudflare domains do not inlcude the string "cloudflare". This works tho:

dig website.com +short | grep -q cloudflare
Excessive explanation, part twenty
Yes, with imminent AMD Ryzen debut I would be more inclined to believe in the AMD route for Apple desktops versus ARM route, at least in short-term.
Is this spam? I don't want to click the link.
Most language-specific ones do. OS-specific ones less commonly do; Chocolatey, for example, can (IIRC) install packages by running PowerShell scripts, which may or may not include pulling from GitHub.
Botnets
Exactly. The term "toxic" is highly subjective and prone to misuse.
We did exactly the same a year or two ago with my last startup. Just did it component by component with a general rule along the lines of "if you have to edit it, convert it to JS". The project was moving so fast that components would often become obsolete within a year anyway. Plus they were all very small so converting manually was trivial.
What's in a Name? Spelling Matters in Code
On my wife's iPhone, it asked her to enter her password again and the weird thing is that it now shows as a new device, called "iPhone" instead of "Cristina's iPhone" as it was before. A few hours later it happened on my Galaxy S7 as well but re-entering passwords fixed it.
Huntsville provides more coverage between Birmingham and Nashville.
That sounds like a great idea.but;where to start.if you have any idea where a beguinner could be useful right away.please let me know.
As an Irishman, this concept confuses me.
>I'm troubled that they went ahead with disclosure before Google crawl team could complete the refresh of their own cache.

It sounded like they (cf) were under a lot of pressure to disclose ASAP from project zero and their 7 day requirement...
> Buy a cow and find yourself a meadow

Not with autonomous farming robots lurking right around the corner to take my job!
Couldn't they do a chip and pin style hardware solution where a security chip generates a response using a unique secret algorithm?
How to avoid short-circuiting evaluation in C#?
> Well, for math we're already here

No, they are here:

> SpiralGen holds the exclusive license to the Spiral software generation and optimization technology.

But I wonder how that can be true if:

> Spiral was developed under the lead of Carnegie Mellon University
But it is compromised.... this is literally the only use case in which you can get comprimised. If you put your _http_ page behind cloudlfare https
SearchOnMath new version with more than 1,900,000 indexed formulas
It turns out that it is less effort to flick/move directly on the item you want to adjust than to do it via proxy on the touchpad.

Like I said before, I was firmly in the "touchscreens are a waste of time for me" camp until I actually started using my Surface. Not trying to sound like an ad, it just has been my actual experience.
They have so many patents on hardware that they could licence the system and clones would still not being able for example to have Apple like touchpad, touchbar screen, MagSafe or even continuity (they could block it for licensed hardware). They will not do that because they realise that they fantastic, proprietary features means nothing to average pro user. Stuff like that is nice to have but more important than that is to be able to run all needed applications reliably. Currently on Macs are only iOS devs and people that hate Windows. That second group could go to linux only if there would be Adobe Suit available on it.