skysight-inc/HackerNews huggingface dataset:
People sometimes overstate the impact of length extension attacks. If your format has a length prefix (really common) then you may well be "vulnerable" in the sense that appending arbitrary data is "valid", but a canonical form without the appended data is trivial to construct; and indeed most software would likely completely ignore that extra data.

HMAC is a neat trick to avoid length extension attacks (and other issues) in a generalized fashion, but that doesn't mean those risks actually apply in practice. (Some googling finds e.g. this paper: https://www.iacr.org/archive/fse2009/56650374/56650374.pdf which proposes an attack on length-and-key prefixed messages, using some sha1 weaknesses and merely over 2^84 memory and 2^154 queries - color me impressed, but not scared). Edit: just to be clear, I'm not suggesting anyone actally use LPMAC-sha1 given the current state of sha1.

For another example; in general it's unsafe to truncate a "secure" hash - hashes that satisfy most security requirements can be constructed that are not safe when truncated (e.g. sha3 prepended by zeros is still safe, but obviously not if truncate the sha3-provided bits off). But I don't know of any mainstream hash where this theoretical risk actually applies (e.g. no merkle-damgard hash suffers from such a risk); nobody constructs hashes intentionally with more bits than entropy.

It's probably still wise to stick with known-good constructions, but the risks seem overstated, and the difficulty is also overstated - assuming the primitives used aren't too flawed. Sure, it's cool that HMAC can use even flawed things like MD5 and retain safety, but typically nobody is forcing you to stick with md5. I guess the world is more complicated if you need to pick a protocol and then you're unable to change it, but most applications can (with some effort) be changed. You need something safe now, not for all eternity.

So, I think the rule is simpler: this has little to do with crypto per se; just don't be unnecessarily clever, in general. Crypto makes the consequences particularly nasty, often. But that's about it.
To add to this, AFAIK postmodernism is actually a critique of modernism rather than a being a substitute for it. This critique may/will eventually produce a concept which can replace modernism.

I found that enlightening, but it is probably also splitting hairs with regards to the blog post.
Yann LeCun – Energy Based Adversarial Training (NIPS 2016)
I know what my parents say about the starts of their careers.

Dad: abject strong-silence, refuses to reminisce because it makes him look less competent, I hear about all the odd jobs he tried before programming from Mom

Mom: playing music is a bad business and sheet music is a bad business and teaching is a bad business and everyone was hostile about everything I tried and I never succeeded - votes Trump

I say anything about what things are like for me and they're stunned, they can't relate. Mom makes a good effort to relate, but it mostly turns into her career story each time.

I don't blame the generation, really, though. I blame whatever sociocultural fallout it is that created such scared, damaged people.
On the other hand, the random nature of the overflow plaintext also means it's perfectly possible for one or several keys to various kingdoms having fall into unsuspecting laps. Whether that happened or how much of those will be discovered by bad actors and to what effect we cannot really know for sure, but I it already says not so great things about those who downplay it.
Not yet you can't.
Color the character boxes and display in two adjacent lines.
> I migrated from Wordpress to Ghost (using some sort of provided Ghost tool) ...

More people should do this. Recent security issues of WP is kinda horrific, but then again it always been a security nightmare. It makes me sad that people don't realize it, the only answer you get is: " but it's so popular so it must be good", well smoking has also been popular - it doesn't mean it's good for you.
see "Why Is Stoicism Having a Cultural Moment? " https://news.ycombinator.com/item?id=10372640
Another reading of this paragraph is that it's essentially douchebaggery.
I dunno, I see the continued survival of our species as a cruel joke - certainly bleak - given the amount of harm we do to each other and everything around us.
in a post on Quora about what it's like to fly on Air Force One:

First, as we started to descend I instinctively went back to my seat and buckled up. But I noticed a lot of the other "frequent flyers" were still up and walking around. So I asked one of them, "When are we supposed to sit down?" They just kind of laughed at my "noob question" and said something to the effect of-- "You don't really have to sit down at all just watch how the pilot lands this thing." So people were still up and walking around as the plane landed. For someone who had only flown commercial it was a fascinating to me for some reason. Sure enough- the pilot put her down like a feather and came to a gentle stop.

https://www.quora.com/Whats-it-like-to-fly-on-Air-Force-One/...
Am I correct in thinking that duck tying and type hinting are not mutually exclusive? Type hinting is not enforced at runtime, so we are still free to pass around whatever we like as long as it behaves as expected.
Evilness/Goodness depends on what utility function you ascribe to god. If you define god's utility function as "avoid all pain in living organisms", then it's indeed an evil or non-cooperative god or universe. I personally can deal with pain (remember, suffering is optional).
Half Field Offense: An Environment for Multiagent Learning and Ad Hoc Teamwork
Portability of NetBSD VS OpenBSD?
The Claim to fame of NetBSD is portability, but i know that OpenBSD is a fork of NetBSD.
'politicize' is just a fancy word for 'dispute'. humans have emotions and we still have mostly reptilian brains.
Looks like a nice way for Google to train a machine learning model to answer trivia questions
Highly recommended by me. Free (up to 50 domains) and ns[2-5] are anycasted.
> It's a different usage of the term than the normal case

Is it? How? It's a simple case of length extension, just that here, since we have two independent starting points sharing the same state, we start with a collision and we extend to a collision.

In other words, these are two length extensions on independent prefixes. It just happens that these prefixes share the same state / hash, hence the surprising result (on a first glance).
Article video marketing
I use Route 53 myself and it's under $3 for several domains. Google Cloud DNS is even cheaper.
Note that stoicism is NOT rejecting and ignoring your feelings. If you feel bad about something, that too is a fact that you have to accept and deal with in the best way possible. Stoicism is about keeping your head up in the face of adversity, and not about becoming a hardened robot capable of taking any punishment. I think a lot of people on HN might get this wrong.
Cool. Just checked API documentation [1], looks great. What tools/language/library are used?

1. https://docs.staffjoy.com/v2/docs
What I learned from activities related to being a gamer, decades ago:

- Built my own computer from parts, and squeezed more performance out of it through overclocking and tuning mostly everything that could be tuned

- Learned about networks, power grids and basic event planning setting up LAN parties

- Built a website for my team. Learned to program with PHP and to manipulate images

- Made many contacts, many of them software engineers, including the ones that got me my first jobs

- Lots of team related administrative tasks like screening and recruiting players for my team, creating strategies and tactics with fault tolerance in case of events such as missing players or reduced network connectivity

All this before I turned 18. All these skills and connections turned out to be incredibly valuable later on when I went through financial hardship during college, my former teammates showed up with job offers for programming jobs, which helped to sustain me and my family.
But the code responsible for the bug was generated C. That they use Go in other applications is irrelevant.
China's a counterexample. Their censorship efforts are pretty damn effective.
Yes, it's possible. Any data that passed througb Cloudflare was possibly exposed.
Do the right thing  doing things right
no I meant, get a list of all domains using Cloudflare, get that removed from the cache of Crawlers.
If it was documented policy that the captain could authorise extra passengers and so on, 3/10. But if they just ignored their own rules it's a 9/10, because adherence to procedure is critical to avoiding death. If they can't do that bit right, what other (expensive) corners are they cutting? Engine maintenance? Crew training? Rest time log fabrication? Nepotism?
If he'd lost, he would have remained "William the Bastard"

https://en.wikipedia.org/wiki/William_the_Conqueror#cite_not...
I like Drupal but I would not advise anyone to start a new project on it. Not in a world where we have Django CMS and Wagtail.
Schengen makes a difference (for an island nation, that is, which you can enter or exit by plane only anyway) only for non-EU citizens. EU citizens are free to move anyway, Schengen or not.
Cara Hemat Membuat Alat Pemanas Air Dengan Sendok
Looks like a nice way for Google to prove that their ML model has made us into thinking we are indeed teaching it how to answer trivia questions.
That’s rather unfair. We should be able to distinguish between someone cynically exploiting a bad situation to enrich themselves, vs someone who is earnestly trying to offer a product that will be useful to its customers but that also has positive externalities.

We can debate the merits of a given approach, but we can be civil and charitable about it, and be appreciative when someone seems sincere about trying to do the right thing.
PDF is not very fine. Copy-paste from PDF very often results in complete rubbish, even when it is not deliberately prevented (which the format allows, and then you have to do OCR).
I think that another downside of badmouthing code is the effect on morale.

Who among is hasn't written code that, upon review, made us cringe? (Maybe a lot. Maybe just a bit.)

When you complain about code, instead of making constructive critiques, you aren't actually doing any one any good, least of all yourself. Instead, focus on what is good about the code and the opportunity to improve it that has just presented itself.
acme.sh
Though it depends whether it is intentionally a lie. If a bee suffers some memory loss or otger failure of cognition causing them to think their position was better / worse it isn't intentional.
New Book: Lean Experimentation in Action
Sure, but maybe he doesn't want to do business with Cloudfare anymore?
So who is the mac?
Show HN: HNView – Browser extension providing a better style for hacker news
Me too. I posted a trivial script to my blog yesterday to show the _age_ of entries in the store:

https://blog.steve.fi/rotating_passwords.html

Useful if you're looking to rotate some/all of your entries in light of the recent news.
Log(x) vs. ln(x) – The curse of scientific computing
zero downtime noticed in several years. They are public about their issues but I cannot remember ever being unable to access my mail

https://www.fastmailstatus.com/
The other comments don't really take into consideration the possibility of turbulence.

Imagine people trying not to fling around the cabin when hitting a rough patch. This isn't something that happens on a bus, but it is routine in aircraft.
As it says in the article:

Such an over-crowded flight would have caused
problems in an emergency evacuation, aviation
experts said, and passengers would not have
had access to oxygen if it was suddenly required.

Additionally, you don't wear a seatbelt on a plane to save you from a crash, you wear it to stop yourself being injured during turbulence, or from injuring someone else by being thrown onto them. Obviously these people did not have seatbelts.
Nick Cannon sued for $1.7M over talent search app
Tabula is a great tool. In my experience it's the most reliable open source software for extracting tables from PDFs. We are using their underlying Tabula-Java library for some parts of https://docparser.com and are happily sponsoring their project.
Sorry dang, will avoid this sort of thing in the future.
Een suikervrij dieet doet je tot 5 kilo afvallen in 1 week
The evacuation risk is only one side of the issue. People not strapped in are another. With enough turbulence, they'll fly around the cabin. In the best case it will be uncomfortable for them. In the worst, a 100kg body will suddenly hit you in the face.

I mean, this can happen on a bus: http://stream1.gifsoup.com/view3/2175405/bus-bounce-o.gif If you experienced proper turbulence in flight, you can imagine how it can go wrong on a plane. So around 8 and I will call the staff if you sit next to me and think you're too cool for the seatbelts.
It's not clear to me at all that the kind of trees desirable for commercial wood plantations are the same you needed to offset the environmental and biodiversity effects of the current deforestation - especially if the trees of your "reforestation" are not planned to get older than 40 years.

I don't know much about rainforests, but central-european commercial forests have significantly less biodiversity than "wild" forests.

In short, I don't think the problem of deforestation is that we won't have enough wood anymore.
The pdfs don't have arbitrary content, they contain very specific headers (crafted by Google research), in one file the header selects one image, in the other it selects the other. These two headers are SHA1 colliding and the remainder of the files are identical.
That's why he asked that the caches of all Cloudflare sites are dropped, not by Cloudflare but by these 3rd parties.
It doesn't have anything to do with it. The OP is trying to subtly insert a pitch for his kickstarter campaign into hacker news and this was his angle. Ironically, I think this highlights the very problem behind the deforestation. So long as we are all consumed with trying to make money, at any cost, we will continue to destroy the planet. We need to think beyond the $, even as entrepreneurs and capitalists.
Full disk encryption on their servers and they ignore non-Australian court orders
Looking at the requirements.txt in the repository, it's a Python project using Flask, SQLAlchemy and Celery with MySQL and Redis for storage.
Requests cannot throw errors from urllib because Requests does not ever invoke urllib code.

Any error that does not inherit from our top-level exception is a bug: please let us know so we can fix it.
Think you have that the wrong way around! Taking on more passengers than there are seats is not safe. If it's an isolated incident, then that's 3/10. If it's an actual policy of the airline then holy shit! 11/10
Why we shouldn't trust experts
iOS for consumers, macOS for professionals
Yes, you are right, I have messed it up a little. What I have tried to say is that there are major and minor factors, and the major ones, with highest weights, so to speak, are cultural instead of economical, and I will keep my stand.

A culture, which is a set of shared values, views and behavioral patterns, defines a person more than just his income. Occupation is important, (think of the castes of India) but the modern world a truck driver could be a physicist or a philosopher could make and sell sandwiches.
Yes, if you exceed the bandwidth, they revert the DNS back to whatever the defined back end is.
- Exactly. The feeling of safety, that there is someone looking after me no matter what was gone which manifested itself in anxiety. I do not believe in afterlife now so the realisation that this is it was overwhelming at first but now that has given way to increased importance of how I budget my time, increased focus on what I do and being more grateful for little things.

- For me it was the latter too. I remember ( I am probably wrong ) that it was Napoleon who asked Laplace that why was there no god in his mathematics ( apparently before Newton had attributed some stuff to god ). And Laplace (or could be someone else ) that he did not need god to explain his work. That has sort of stuck with me.
Years ago I had a conversation with a Pan Am flight attendant who worked a Teheran evacuation flight after the Pahlavi "dynasty" was deposed and the US nationals had to clear out of Iran quickly. She told me they filled their Boeing 747's aisles with people sitting on the floor.

She told me it's a calculated risk to put passengers in the aisles.

But, the captain of the flight knew exactly what was going on and made the decision to proceed. It sounds like this PIA flight crew concealed their overloading from the captain. THAT is a very serious infraction indeed.
When you consider that planes have crashed killing all on board due to overloading, it's actually a pretty big deal.

http://www.nytimes.com/2003/05/18/us/crash-that-killed-21-ap...
http://www.detroitnews.com/story/news/local/michigan/2015/11...
http://www.bbc.co.uk/news/uk-scotland-glasgow-west-32732607
https://sputniknews.com/latam/201612261049016624-plane-brazi...
https://generalaviationnews.com/2011/07/18/overweight-airpla...
http://www.dailystar.com.lb/News/Lebanon-News/2004/Mar-29/29...

Google tells me that the average person weighs 80.7kg, let's conservatively round up to 100kg to take into account clothes, and luggage (It's probably higher). From this we can estimate that the PIA flight had an extra 700kg (It's probably closer to 1 tonne) of weight on board, and extra 700kg that wasn't properly secured or distributed.

Depending on the plane, the effects could range from using up more fuel (planes carry extra fuel for emergencies and so they can circle their destination while they wait to land, it would eat into this reserve making flight incidents more deadly), to failing to take off the runway; The pilot wasn't informed until he was in the air.

While the plane in question is certainly larger and more powerful than the majority of the links I provided, the fact of the matter is an overloaded bus or train may refuse to move if overloaded, a plane can fall from the sky killing people both on-board and on the ground. Planes fail deadly.

You now have 7 extra, fragile humans standing in the aisle who have nowhere to belt down in case of emergency. If the plane crashes, needs to make an emergency landing, or even encounters incredibly rough turbulence they could be thrown around the cabin hurting both themselves and others.

As for a 1 to 10 scale of transgression, it's hard to place because of the nature of such a simplistic scale. Assuming your scale is confined to aeronautics (lest we invoke Godwin's Law) what counts as a 1, and what counts as a 10? If your 1 to 10 scale is truly inclusive of every possible aeronautical incident then 1 has to be a passenger with a typo on their ticket, and 10 has to be 911. I don't know about you, but I have no idea where to place this overloading incident on such a scale.
You desire to LIVE "according to Nature"? Oh, you noble Stoics, what fraud of words! Imagine to yourselves a being like Nature, boundlessly extravagant, boundlessly indifferent, without purpose or consideration, without pity or justice, at once fruitful and barren and uncertain: imagine to yourselves INDIFFERENCE as a power--how COULD you live in accordance with such indifference? To live--is not that just endeavoring to be otherwise than this Nature? Is not living valuing, preferring, being unjust, being limited, endeavouring to be different? And granted that your imperative, "living according to Nature," means actually the same as "living according to life"--how could you do DIFFERENTLY? Why should you make a principle out of what you yourselves are, and must be? In reality, however, it is quite otherwise with you: while you pretend to read with rapture the canon of your law in Nature, you want something quite the contrary, you extraordinary stage-players and self-deluders! In your pride you wish to dictate your morals and ideals to Nature, to Nature herself, and to incorporate them therein; you insist that it shall be Nature "according to the Stoa," and would like everything to be made after your own image, as a vast, eternal glorification and generalism of Stoicism! With all your love for truth, you have forced yourselves so long, so persistently, and with such hypnotic rigidity to see Nature FALSELY, that is to say, Stoically, that you are no longer able to see it otherwise-- and to crown all, some unfathomable superciliousness gives you the Bedlamite hope that BECAUSE you are able to tyrannize over yourselves--Stoicism is self-tyranny--Nature will also allow herself to be tyrannized over: is not the Stoic a PART of Nature? . . . But this is an old and everlasting story: what happened in old times with the Stoics still happens today, as soon as ever a philosophy begins to believe in itself. It always creates the world in its own image; it cannot do otherwise; philosophy is this tyrannical impulse itself, the most spiritual Will to Power, the will to "creation of the world," the will to the causa prima.

-Nietzsche
After 16 hours, those cached pages are still up...
Is Google Carpool Service with Waze Competing with Uber and Lyft?
I meant API documentation. Looks like they've Apiary-like interactive documentation.
Google Spaces will be shut down on April 17th
Pretty close to what you describe is Acme [0] the text editor/shell from Plan 9. It is mouse oriented edit. You can right click on words to search them in file or open text files, directories or compiler errors. I recommend viewing this [1] introduction video.

I miss few things in Acme. A bit more WIMP-y familiarity and a 3 button mouse.

That's why I'm working on experimental text editor inspired by Acme [2].

[0] https://en.m.wikipedia.org/wiki/Acme_(text_editor)

[1] https://youtu.be/dP1xVpMPn8M

[2] https://github.com/hadrianw/werf
> The thing you're trying to change (the HTML) can have PII or be otherwise sensitive.

Sure it can. But leaking PII from the thing you're parsing and leaking PII from any other random request isn't the same thing.

I understand the performance implications (and the added effort) of sandboxing the parser, but I'm arguing for it anyway. The mere presence of a man-in-the-middle decrypting HTTPS and pooling cleartext data from many disparate services in a single memory space is already questionable (something for Cloudflare customers - and not Cloudflare itself - to think about) but adding risky features into the mix shouldn't be done without as much isolation as possible.

Let's face it: parsers are about the most likely place for this sort of leakage to happen...
My favorite quote was “Assembling reality from the fragments of nuance is as foolish as making a snowman by catching flakes in mid-air.“
The Decline and Fall. American refugees welcome here. I can't remember what was it that made the possum visible again?
Still, how can they work in a basically zero trust environment? They can't hope anyone reasonable will come up with some great idea and willingly share it with them.
Speaking of that, as of now on the front page:

23.	Announcing the first SHA-1 collision (googleblog.com)
2882 points by pfg 1 day ago | flag | hide | 488 comments

second page:

37.	Cloudflare Reverse Proxies Are Dumping Uninitialized Memory (chromium.org)
3168 points by tptacek 1 day ago | flag | hide | 979 comments

It says "1 day ago" for both now, but the second story came later. So how come it ranks so much lower, having even more votes? Is that HN penalizing comment count, or users flagging it? If it got flagged, would anyone have a problem with removing those flags and removing flagging privileges from said users?
Thanks for making the connection. If these were Pakistani laborers, everyone's Westernized weight estimate of 100kg/person is about 50% too high.