skysight-inc/HackerNews huggingface dataset:
It isn't just on the market or utilities. All of their prices are heavily regulated. Companies that produce baseline power are expected to make a set profit (no more or less) and the people lending them money and buying their stocks also expect a set return on investment. Any price increases have to be justified politically and the companies are expected to pay off previous investments and then return the majority of their profits to the shareholders. It is a case of an extremely conservative market being upended by rapid change.

And the kinds of investments the grid needs to move to a majority renewable system are very different from what was needed in the past. Many of the best wind projects, for example, are located out in the middle of nowhere and require large transmission lines to bring them to the places that use the electricity. The distributed nature of solar and wind require more interconnections to bring in power from locations that have an excess of sun or wind to those that need the electricity. It is more difficult to keep these diverse sources of power synced so that the grid transports a steady amount of power at the right frequency, and that also needs more and different investments than in the past.

It's not a simple matter of profit/loss, but of balancing a number of political considerations and a huge bootstrapping problem. I don't think any one company can handle this by itself.
Instead why not introduce Approval Vote ballots in every congressional district? BOOM solves most of the major problems.

It can be done on a local level and in each such district you will see people hate each other less, third parties get a real chance etc.

Google APPROVAL VOTE.
Wanderers: A Short Film by Erik Wernquist
Why the hell is this getting downvoted?
I would say the crazy thing is a mere t-shirt as their "bug bounty" top tier award given how they've pitched themselves as an extremely secure service.

https://hackerone.com/cloudflare

I'm sorry but when the reward for breaking into you is basically a massive pinata of personal information...that simply is a bad joke. Security flaws are going to happen and if you aren't going to even offer a reasonable financial reward to report them to you, well, that is just begging to be exploited with a pinata that size.
I think it's missing some words, maybe "after the first attack"? (Was 2005?)
And, if you're correct, that's a reasonable case.

"You want us to turn over that information? You're going to have to meet your full burden of proving need before we do so." That's reasonable for a case about a device that sits in your house and is constantly listening.
Huh. And I've already got this 4-mile deep bunker hole...
> My second thought after relief was the realization that even as a consumer I'm affected by this, my password manager has > 100 entries what percentage of them are using CloudFlare? Should I change all my passwords?

Yes. Right now. Don't wait for the vendor to notify you.

> What an epic mess. This is the problem with centralization, the system is broken.

Yep.
Calling this a "memory leak" is rather misleading. The problem is literally leaking the contents of memory, yes, but the term memory leak usually means something else, something that is usually not as problematic as dumping random memory to the internet.
5 Roadblocks Faced by Tech Professionals When Attempting to Develop Soft Skills
T-Mobile’s plan to give away free stock could create a tax headache for millions
Envisioning Cryptonomy: technologies affecting the future of finance
I never really got this argument. Is it not much better than the majority of companies that have no bug bounty and where the reporter needs to worry they will be met with legal threats instead of a t-shirt?
It's generally safer to use your own wallet. Online wallet services are a massive target for would-be thieves, so even if they use better security practices than you would, the risk isn't necessarily lower.
This is probably a good moment to recall the article I published a while ago about how CloudFlare is actively putting the web at risk: http://cryto.net/~joepie91/blog/2016/07/14/cloudflare-we-hav...

This is precisely why. The only thing that surprises me about this, is that it was an accidental disclosure rather than a breach. Other than that, this was completely to be expected.

EDIT: Also, this can't be repeated enough: EVERYBODY IS AFFECTED. Change your passwords, everywhere, right now. Don't wait for vendors to notify you.

Anything could have irrevocably leaked, and you have no way of knowing for sure, so assume the worst.
That's not the argument of Quinones's book Dreamland: http://seliger.com/2016/10/04/review-dreamland-true-tale-ame..., and Dreamland, like most other books and articles I've seen, argues that availability and over-prescribing have been major contributors to the crisis.
Anyone wrote a script yet that checks the top 1M (or so) web sites to find out which use Cloudflare? It would help with knowing what secrets I need to change (as an end user -- I'm not a Cloudflare customer, thank $deity).
That's size, not mass.

Venus is about 81% Earth's mass, and Mars is only a little over 10%. Mercury gets you another 5.5%, the Moon (as above) another 1.2%, and the asteroids are negligible.

In the outer solar system, it's basically all the Galilean Moons + Titan.

ETA: Hmm, or maybe those are surface gravity numbers you're thinking of?
I had an interview there where the manager asked me to leave my laptop behind and go for a walk. I was hesitant after hearing stories of Uber conducting electronic espionage against its competitors. They could easily bypass Macbook security with a USB device (I had heard of that on HN too) so I was very nervous to leave my laptop behind and noted its exact orientation and position on the table. Sure enough when I returned my laptop had changed both position and orientation, but only enough to tell if you had specifically memorized it. I could be paranoid. They could have simply moved things on the desk. But anyway, people who are paranoid like me are advised not to take their laptops into Uber interviews. They are capable of just about anything, or so thinks my now paranoid self.
Yes, that was my point :)
What Keybase does with their new Key model and the way they send encrypt messages is pretty nice. The way they do the public directory is pretty nice, but improvement can still be made.

https://saltpack.org/
This was the noteworthy part for me as well.

They had to know that he:

1. modified the software on his laptop

2. logged into an area he should not have had access to (this is probably standard)

3. attached an external drive (possible, but standard?)

4. and they got all this info after he deleted the drive, which means they either went in and found remaining data on the drive or else they captured the info in real time.

I suppose if the drive is clean now, and they know he downloaded data, they can infer that he wiped it.

I suppose that if they know he accessed it, and there was software on his computer preventing him from doing so, they can infer that he downloaded something to overcome it.

But knowing that he connected to an external drive implies active monitoring. That's the part I am most curious about.
> Incident report on memory leak caused by Cloudflare parser bug

This title sounds like Cloudflare doesn't know what a memory leak is or are intentionally trying to downplay information disclosure. Neither option is comforting.
How would you respond to the negative Amazon reviews that say the book is very difficult, not well explained, and has no exercises?
Doesn't sound like anyone stole anything.

Waymo/Google still had the documents, and copying isn't theft.

Right?
Using a Memcached and Twemproxy Distributed Caching Fleet to Halve Query Latency
There are times when you want non-repudiable signatures, times when you want to be able to keep an archive, times when you want your messages to behave more like letters than like spoken conversations. PGP is still the best fit for email-like use cases and long-lived identities; Signal et al don't even try to address that use case.
I'm not 100% clear: Only three features were affected, and only sites with one or more of those features enabled leaked data into their pages.

But was the leaked data similarly limited to only the sites with the features enabled? Or could it have come from any request - even an entirely unrelated site?
Hapijs/joi: Object schema validation
+1 for better release notes - examples would be highly appreciated.
> Some circumstantial evidence suggests children with autism and Asperger's could be more vulnerable to becoming hackers

Someone thought printing that was a good idea?
It could also be a e-discovery tool like Nuix. If you want to find all documents containing X amongst millions of docs- that's the sort of tool I would use (work in computer forensics)
*edit. And 9.7 GB of data, assuming it's docs not "just' a lot of CAD is a lot of docs..
If serious researchers are looking to get paid, I think bug bounties are the wrong approach entirely
As has been mentioned elsewhere, a 1942 Supreme Court case, (Wickard vs. Filburn) greatly increased the power that Congress could exercise in pursuit of regulating "interstate commerce". Pretty much any activity, by anyone, anywhere, could be put under "interstate commerce". Literally growing your own vegetables on your own farm could now be regulated by Congress, on the assumption that if you were growing those vegetables yourself, you wouldn't be buying them, and would so affect the market price for said vegetables.

Yes, the Supreme Court really did rule that way.
Is that because, even though a very small number of pages (they claim) triggered the bug, any adjacent traffic in memory could be disclosed?

That traffic could be basically anything sent through Cloudflare, it would seem.
Very simple, to the point. Great tool.

These types are becoming more popular for people who don't really care to blog and just want to get something up quickly. I think pen.io were the ones who pioneered the idea of it.

So many others followed and I wrote something similar: https://mypost.io/

It allows for much more user control including easy HTML and CSS usage with the ability to set your own URL. It hasn't receive as much thrill as your product has on Hacker News, but it is being used worldwide.
You can really only speculate, but I think it's safe to say that the strong majority of trading is for speculation.

The darknet markets certainly bring some demand, but it's high-velocity. You don't need to hold BTC, only transact in it.

The remittance market does seem to be there, but it's still in its infancy. Maybe only a small fraction from this.

Similarly, actual e-commerce is quite limited. Bitcoin offers few advantages over PayPal and credit cards for the large majority of consumers. There's only a subset of international transactions and other fringe situations where it makes sense.

I think the other significant market, after the speculators, are those that are ideologically motivated to hold Bitcoin.
United States v. Lopez (1995) hopefully started cutting back on such a laughable decision. Can you think of any behavior which doesn't in some indirect way affect interstate commerce?

If the founding fathers had intended for an unrestricted commerce clause, they wouldn't have bothered with the 10th amendment or enumerating the other powers. The constitution is a whitelist.
>I've seen this type of complain at every single company I worked for

Wow, I have never encountered that kind of thing (admittedly I've only worked at 3 companies)
Thankfully it looks like it's not 1Password, who seem to use AWS CloudFront.
Yup. Hence their motivation to nip legalization in the bud. (Pun intended.)
Google's self-driving-car company has sued Uber for stealing its technology
At first I was tryin to deny it, but once I got to the multiple email addresses I couldn't anymore.
It provides pseudonymity. KeyIDs exist but they're not inherently tied to e.g. your real-world location the way a phone number is (to an attacker with access to the towers). Whereas OpenPGP can reasonably be combined with e.g. Tor.
We've been watching the ETF with interest. To gauge market sentiment, we launched an ETF approval binary contract (https://www.bitmex.com/app/trade/COIN_BH17). COIN_BH17 saw a jump from 35% to nearly 50% today. Optimism on the ETF is rising.
When you say something similar do you mean also not indexed, or do you mean you ran a text submission site with nofollow links?
I've known quite a few heroin addicts who got started because of a prescription for relatively mild but on-going pain. At some point the pain was gone, but the desire/addiction was not... Perhaps I'm just weighing my anecdotal knowledge too highly.

I'm not saying opioids are always inappropriate but I think a lot of situations could do without them if marijuana was available as an alternative.
I strongly encourage people to read about the lesser-known Tichy diff algorithm too: https://bryanpendleton.blogspot.com/2010/04/more-study-of-di...
Read Tavis' comments. He disagrees with you regarding the severity. This is a big f--king deal!
Can you please elaborate? Your initial comment makes the point that no one is questioning Susan Fowler's allegations, that it's only one side, that her "blog post does not establish truth." That's the point that many other comments have made, whether it be about what happened at Uber, or more generally about whether the allegations are true at all.

At this point, the accused (or Uber, for that matter) is perfectly free to make some announcement if they so choose. I wouldn't expect them to—nor fault them—as it wouldn't make any sense, politically or legally, to do so at this point, at least until the conclusion of any investigation.
This release is in my opinion a life saver for Rails.
Instead of forcing people to hop off the Rails train, it empowers them and let them choose their favourite JS library on top of it, while serving them hassle-free, in a very rails fashion.

Shouldn't this have been shipped in 5.1, it might have very well been a bit too late.
And this "over 14,000 highly confidential and proprietary design files for Waymo’s various hardware systems" is what, an engineering repo? (Edit: My money's on repo. It says 'searched for and installed specialized software', I'm translating that as 'installed git.') Or did he just take a copy of his mailbox?

Sounds like a rookie move to be downloading this stuff on his work laptop either way.
TL;DR for the lazy ones:

> The examples we're finding are so bad, I cancelled some weekend plans to go into the office on Sunday to help build some tools to cleanup. I've informed cloudflare what I'm working on. I'm finding private messages from major dating sites, full messages from a well-known chat service, online password manager data, frames from adult video sites, hotel bookings. We're talking full https requests, client IP addresses, full responses, cookies, passwords, keys, data, everything.

This is huge.

I mean, seriously, this is REALLY HUGE.
Let me know if you want to help- Ive just forked a couple repos and started writing out some notes
It appears that it could be from any site that passed through that server, not just those with these features enabled.

That's just how I read it.
Everyone: change your HN password asap!
But it is secure. It's secure against the user being on an untrustworthy connection, it's secure against their ISP deciding to MitM their traffic, and it's also ~~secure against anyone passively sniffing the traffic between the website server and CloudFlare~~ (EDIT: No it's not, see [1]). The only thing it's not secure against is someone in a privileged network position who can MitM the connection between the website and CloudFlare.

So no, it's not 100% secure, but it's far far better than having an unsecured http:// connection.

As for the green lock, you can blame that on Chrome. I have no idea why they insist on using a green lock and green "Secure" text for DV certs. Safari only uses a green lock / green text for EV certs, which is a lot better (and I don't know offhand what Firefox or Edge do). Of course, you could have an EV cert and still use Flexible SSL, but anyone who cares enough to get an EV cert should know better than to use Flexible SSL anyway, and there's a great many ways to make your server insecure, using Flexible SSL is very far from the worst way.

All that said, it would be great if CloudFlare would just stop offering Flexible SSL in favor of the self-signed CSR approach. Any CloudFlare customer who can create their own cert to talk to CloudFlare can also create a CSR to get a cert from CloudFlare just as easily, so it's not clear to me why they still even offer Flexible SSL.

[1]: I thought Flexible SSL was the option to use an arbitrary self-signed cert on the origin server. gkop pointed out that, no, Flexible SSL means no encryption at all.
Hardcode-Tray
> Alphabet’s venture capital arm, GV -- formerly known as Google Ventures -- is an early backer of Uber.

Correct me if I am wrong, but does that mean Alphabet is suing itself since Alphabet owns both Google Venture, Waymo and has an investment in Uber...?
These days the primary use of swap is to get the efficiency of overcommitting RAM without compromising reliability.
True - I suppose the hash function just ends up being the convolution of say an interior CRC and some exterior hash function. That gives us low to zero chance of something mathematically provable. But perhaps some arrangement of functions forces an attacker to scramble the inputs in more drastic ways such that the original data must be altered by more than a handful bytes it could perhaps raise the difficulty on a practical basis.
Many applications request a memory, do some writes and don't use it in typical scenarios. So this memory is effectively wasted. If there's swap, smart operating system will swap that memory and use physical memory for more important tasks, e.g. for disk caching. So using swap allows for more efficient memory usage. E.g. on small server with 21 day uptime I have 102/1024MB memory used and 41MB is in swap, which means that I have 5% memory almost for free.
taviso called out 1Password in the initial tweet, although that still leaves room for other password managers too: https://twitter.com/taviso/status/834900838837411840
Sure, dealing with legacy systems might mean messing with swap.

However, as pointed out elsewhere, if you're hitting swap your performance will be so bad you might as well have lost the machine.
Personally, I'd prefer the recreational gun user. But what I'd really prefer is not both - not a recreational marijuana and gun user.
2x RAM as swap is clearly bad, but I like having around 512MB to 1GB (on systems of basically any size); when you do start using more ram than you have, it gives you some buffer (as long as you actually alert on it). If you have a small memory leak, you can recover; if you have a large memory leak, you're going to run out of swap pretty quick anyway.
How to raise capital in China
There's no reason why the Signal app couldn't allow you to register mailto:joe@example.invalid as well as tel:+18005551212; it just, currently, doesn't.

And of course the protocol in general is much higher-level than that.
Can someone provide a lay-person's explanation of the issue and its implications?
Was it already "censorship" when Facebook didn't present me, a card-carrying socialist, with far-right websites in my feed? Or is it "censorship" when they start taking USUncut out of my feed because, frankly, its journalistic quality is crap?

Which one of these was censorship? Does Fox News have a right to show up in my feed, given that I very much don't want to see it?
Is it possible to hibernate without swap? That's one of the use cases when it's actually useful.
Yep. Mine was sitting there for 45 days ... of the 60-90 required before items can be auctioned off.

It had my address clearly visible on the package still. They could easily have delivered it.

If not for the media attention, these most likely would have ended up on a govdeals.com listing, and going for an absolute fortune (tons of collectors know about that site.)

Then again, maybe they only try to recover mail right before they list it for sale. Can't know for sure, but glad I don't have to find out.
On my thru-hike, I ran out of candy (I always carried a bag with an assortment of gummies, hard candies) and just started eating sugar (intended for my tea) by the spoonful. I've never felt such an intense craving for simple sugars as I did on the PCT. It seemed to revitalize me, both physically and emotionally. So I can totally understand this mint "cake."
Nowadays there are quite a few extremely reputable and solid exchanges, insured, following all regulations, etc. For example Gemini run by the Winkelvoss twins, and Coinbase/GDAX (a YC-funded company.)

MtGox has never been reputable. It was the biggest, and it worked, but it has always been sketchy. I say this as a MtGox user through 2011-2013. And yeah I stopped using it about a year before it got shut down because other exchanges more reputable than MtGox started appearing and it was more and more obvious MtGox had serious internal issues (delays in processing transactions, one of their bank account seized by the feds in 2013, etc.)
From the blog post: "For the avoidance of doubt, Cloudflare customer SSL private keys were not leaked. Cloudflare has always terminated SSL connections through an isolated instance of NGINX that was not affected by this bug."

Is this statement accurate considering Tavis said in his report that: "We fetched a few live samples, and we observed encryption keys, cookies, passwords, chunks of POST data and even HTTPS requests for other major cloudflare-hosted sites from other users."
Yup, it's not an exact tradeoff, and near-0 it breaks down entirely. At zero it's worse than that, because of the diminishing block subsidy schedule, having zero fee pressure will reduce the incentive for mining, and therefore security.

However, miners can't simply apply the limit to themselves without a consensus rule. There is code in Bitcoin Core to apply a soft limit, but as long as there is any fee pressure, ignoring transactions leads to a disadvantage compared to other miners, so in practice all miners tend to always use the maximum permitted block size. Most proposed schemes for increased or variable block size still enforce the same size across all miners for this reason.
Salient question at this point: Did Cloudflare have any systems in place that would allow themselves to identify queries that were abusing this defect?
My girlfriend gets harassed by Uber drivers all the time, to the point where she had to switch to using Lyft or call the regular car services here in NYC (which used to be amazing pre-Uber, by the way).

The one time I took Uber Pool in Brooklyn the driver refused to let a black couple into the car, which we all protested and complained about, but nothing came of it.

In New York Uber isn't necessarily safer or less racist, although I'd concede it probably is in other countries.
> A site using Flexible SSL is no less secure than one using http://,

It can be, in several ways. Most critically, it stops browsers from detecting the connection as insecure and applying mitigations.
And it shall be called Cloudbleed.
The huge huge huge majority of published papers aren't CERN-style monumental efforts with bazillions of repeated experiments that you can use to get insanely good stats on.

From my own experience in my PhD I've seen outrageous replication problems in CS, microbiology, neurology, mechanical engineering, and even physics on the "hard sciences" side of things. I've seen replication problems also in psychology, sociology, and political science on the "soft sciences" side of things.

People who come from a "hard science" background seem to have this belief that it is way more rigorous than other fields. I disagree. If anything, the soft sciences are actually making a movement to address the problem even if that means more articles being published saying that 40% of psych papers are not reproducible or whatever.
Building Layouts in Flutter