skysight-inc/HackerNews huggingface dataset:
The promise of doing really cool work.

What also increases the rate of people choosing a at the first question.
I was really stunned that Deutsche Post in Germany not only accepted the package, but were the ones to recommend it be shipped this way. They really should have known better, what with doing this for a living and all. It wasn't reasonable for the sender to know about the USPS' bulk processing machines and their tendency to tear off brown wrapping paper.
Nest had a nice exit.
What anomalies would be apparent in your logs if someone malicious had discovered this flaw and used it to generate a large corpus of leaked HTTP content?
Far worse than this. Yes, browser caches, but also web crawlers (like google)'s caches. This means that anyone who requested certain public content could have instead received secret content from completely unrelated websites.
https://news.ycombinator.com/item?id=13717250
> The opioid crisis is a product of, ironically, crackdowns on opioid abuse.

This does not mesh with reality in states like West Virginia, where drug companies sent 9 million pills in two years to a town with less than 400 people - 780 million pills in six years to a state with 1.8 million people.

As the "crackdown" revved up in these states, more people have died as they've turned to replace their prescription habit with heroin, and street heroin is increasingly being laced with fentanyl analogs which cause nearly instant overdoses.

Not pinning this on the drug companies or doctors that are handing out these drugs like candy to anyone willing to write a check is putting the blame way downstream of where it belongs. The DEA sure can crackdown on marijuana and molly but Rx drug abuse? Move along, citizen. Nothing to see here.
My intuition about this would be about hashes with "hidden state" that is neither reflected in nor reconstructible from the digest. For example, suppose the hash has a 1024-bit internal state and a 256-bit digest. Then two inputs that have a hash collision have the same digest but only about 2¯⁷⁶⁸ probability of having the same internal state, so if you continue to extend them, subsequent hashes will be different.

I think there are engineering reasons why this isn't typically the case for the hashes we normally use, but I'm just hypothesizing a way that this could be different.
If a user thinks the presence of "https" means it's safe to enter credit card details or medical information, that's already a huge problem. Yes, "https" should be a prerequisite to entering sensitive information, but that's only part of it; the other part is whether you actually trust the server you're sending that information to. The server could be using ironclad encryption across the whole connection, but that doesn't mean they'll still handle your data safely. Any site that wants sensitive information like this has to do many things to ensure it's secure, and making sure they have a secure connection is only one of those things. If you trust that the server operator has done everything else necessary to keep your credit card details safe, then you should also trust that they're not using Flexible SSL.

Edit: Dear downvoters, can you please explain why you disagree? What I wrote really shouldn't be controversial in the least, so I don't understand the drive-by downvotes.
> This is an interesting concept, but it still requires self control. I could browse all day if I wanted but I WANT to get more work done, but I cant help it.

It doesn't require that much self-control as you may think. The important part is to control that 'first' desire of looking at your phone or opening up distracting sites.

What I found is that if I can curb that first desire to get distracted, then the rest of everything is super easy. But if I can't curb that first desire (which usually happens on Mondays), then I have to write that day off to non-productivity.

I started this project last November, and coincided with shutting down Facebook notifications (which helped me a lot). Two weeks ago I uninstalled Facebook mobile app and now I only check facebook by logging into the web version.
For the mentors, you should join an Open Source project where people will die to have you contribute, and if you have questions and problems, you should ask. They're more than likely to help you, free of charge. But you must contribute and show the willingness to work hard.
If you can believe it, both are true. It sounds like a contradiction, but it isn't as cut and dry as our brains might like it to be, or like a writer might like it to be.

They are both over and under-prescribed. Pain is both over and undertreated every day in every state in the country. There are pill mills, there are stingy ER's and clinics, it goes both ways. It isn't one or the other.

On one hand, you have doctor shopping.

On the other, you have legitimate chronic pain sufferers turning to the street to make ends meet.

My grandparents bought pills from the black market at black market prices to fill the gap of under treatment. At the same time, people were paying cash-only pain management clinics for prescriptions which they were filling multiple times.

There will always be abusers, lawmakers and activists need to realize that you can't regulate or price someone out of an addiction (or a dependency.)

There is a staggering difference between addiction (which usually involves abuse) and dependency (which usually involves no abuse)

Addiction to prescription opiates leads to one of two roads. The problem road is heroin. For example:

Let's say you get addicted because you abuse the pills prescribed to you after surgery. You continue to maintain your addiction with drugs purchased from the street, then at some point you remember that heroin exists and is dirt cheap compared to the dollar per milligram you were paying for oxycodone. Suddenly, heroin doesn't seem so evil. Now you have a new perspective about heroin, mainly that it's cheaper and more potent than prescription pills.

Dependency, meanwhile, can be maintained under a doctors supervision for years. Pain can be managed with prescription opiates safely and effectively, increasing the quality of life of someone who suffers from pain every single day.

It's a multi-faceted issue with many variables, you can't really reduce it down to one sentence or another. There is no easy solution, either. You can't under-prescribe or prosecute doctors, that just hurts the people suffering the most.

I know what the solution isn't, though: banning fucking kratom. this entire thing is a complete and total structure fire, and the DEA is trying to immediately move to Schedule I a powdered leaf that stops withdrawals for addicts. For the opiate naive, taking powdered kratom leaf results in a light buzz. For an opiate addict, it's no buzz + immediate relief of withdrawal symptoms.

There is always methadone and suboxone, but these drugs are extremely long-acting. Meaning that if and when you come off of them, you will be in withdrawals for weeks or even months. For comparison, short-acting opiates like heroin withdrawals last about a week, maybe two.

Now that you know this, it might not surprise you to hear that methadone patients often switch back to shorter-acting drugs like heroin to attempt to get clean.

Ironic, isn't it?
> The ones I personally asked all shot me down.

This has been my experience with any of my ideas, causes, or product marketing.

The most logical fits tell me to f* off in more words, and completely unpredictably random partners come out of the wood work after I just do it my way.

That kickstarter/product hunt style of lining up your marketing partners beforehand will never work for my ideas. The plan is to make a big splash for the time dimension of virality. Unfortunately, people that I think would understand my idea/cause/product, don't. And unlikely partners are completely enamored by it. This has limitations.
Ah. I see what you mean. Apologies, kind of tired.
Heh, several people accused that note of being fake because of an obvious spelling error on it ("where the weight of the contests rest.")
'Mathemagics'

https://www.amazon.co.uk/Mathemagics-Genius-without-Really-T...

This is awesome book, it teach you all sort of tricks from 3 digits addition to 3 digits multiplication.

I know its written for school teens, but still pretty helpful life skills.
See https://news.ycombinator.com/item?id=13719468.
I'm sure I have a bit of a chip on my shoulder about the whole thing; I'm jealous of people like you who never roll their ankles!

Know your own capabilities is a good approach, in most activities.
This is just the political disaster anti-fascists need. The public will be overwhelmingly opposed to this and will wake a few people up.
There are all kinds of places were things are cached, both on- and offline. Your data may end up in:

* Browser caches.

* Sites like wayback machine or search engines that make copies of webpages and save them.

* Tools that store data downloaded from the web, e.g. RSS readers.

* Caching proxies.

* the list goes on and on.

I think what tptacek wanted to say: It's just so common that people download things from the web and store them without even thinking much about it. And all those places where this happens now potentially can contain sensitive data.
As I understand Uber makes all employees sign an arbitration clause to prevent lawsuits.
3438 domains which someone could have queried, but potentially data from any site which had "recently" passed through Cloudflare would be exposed in response, right? Purging those results helps with search engines, but a hypothetical malicious secret crawler would still potentially have any data from any site.
Yeah, that's wrong, being an investor in a company doesn't make you liable for their actions.

It does mean that Alphabet stands to lose something if they win the lawsuit, though whatever stake they do have in Uber is obviously negligible compared to WayMo itself.
For all intents and purposes it's impossible, especially if you consider exactly who would be ratifying such an amendment anyway. This is the GP's point: it's unproductive to talk about this topic because there is no remotely plausible way for such an event to occur.
Actually, it is worse than just using plain HTTP because it tricks people into believing their connections are secure. There is a significant and growing group of lay people who have been trained not to input sensitive data into nonTLS web pages. "Flexible SSL" effectively screws them.
What an excellent presentation. I don't have much of a physics background, but this was immediately understandable.
It depends how you interpret this (and IANAL):

The Yellowstone National Park, as its boundaries now are defined, or as they may be hereafter defined or extended, shall be under the sole and exclusive jurisdiction of the United States. All the laws applicable to places under the sole and exclusive jurisdiction of the United States, shall have force and effect in said park. Nothing in this Act shall be construed to forbid the service in the park of any civil or criminal process of any court having jurisdiction in the States of Idaho, Montana, and Wyoming. All fugitives from justice taking refuge in said park shall be subject to the same laws as refugees from justice found in the State of Wyoming.

And then you also get into issues around juries, etc.

It's a unique situation (hence why it was an article). I don't actually believe anyone would get off with this sort of "technicality" but it is a real corner case.
Holy shit, this could be a company-ending event. For CloudFlare or any of its clients.
Some assert() macros are disabled on release builds, so that's not exactly safe either.
There are caches all over the Internet; Google and Microsoft run some of them, but so do virtually every Fortune 500 company, most universities, and governments all over the world.

The best way to understand the bug is this: if a particular HTTP response happened to be generated in response to a request, the response would be intermingled with random memory contents from Cloudflare's proxies. If that request/response happened through someone else's HTTP proxy --- for instance, because it was initiated by someone at a big company that routes all its traffic through a Bluecoat appliance --- then that appliance might still have that improperly disclosed memory saved.
Is the software tech industry better or worse than all the other industries?
This is all information a rudimentary desktop auditing tool can gather and store on a server. Most collect both hardware (which would include connected devices) and software inventory. Anyone SHOULD be auditing company PCs on a relatively regular basis. It wouldn't surprise me if Google was auditing much more frequently than the average and could catch something like this in the act.
It's a pastebin, with somewhat-nice formatting.

I think half the "pastebin problem" has been solved by just avoiding setting up your own backing store (and frequently your own input step), and instead being a presentation-proxy for a more "raw" content-editing service, like Github Gists. For example: http://gist.io

There are a few services like that; what I'm still yearning for, though, is one that either

1. has a real design team focused on making its pages "read" well, like Medium does; or

2. does have accounts, to let you set up a custom theme for your pages. (Though you can be creative about this, for example by letting the Gist include a JSON/YAML/TOML/whatever properties file that specifies the theme, and by making the themes Github repos that the service just pulls and caches on first use rather than needing to own itself.)

A service that offered either of these would finally fulfill the promise of letting me separate "writing" from "blogging", such that I wouldn't really need a "blog", just a microblog containing links to my own posts.
No it won't. It's using pointers, not array indices. The compiler has no possible way of knowing that `pe` is the one-past-the-end address.
It was a bug in C code (automatically generated by the Ragel state-machine compiler), some details are in CFs blog post: https://blog.cloudflare.com/incident-report-on-memory-leak-c...
This has already happened - see Gonzales v. Raich[1].

The Supreme Court ruling on that case was a huge blow to both marijuana legalization efforts and gun rights.

1: https://en.wikipedia.org/wiki/Gonzales_v._Raich
> I dunno, with originalists like Thomas & (hopefully) Gorsuch it's certainly possible.

Compared to Raich (2005), even if Gorsuch flipped from the way Scalia went you need another vote; Thomas was on the Court then so is no change.
"Utterly amateur" => runs boingboing.net.

No need for modesty.
It's pretty easy to transfer your coins to an external wallet, and then spend it as you please.
Right there with you. I'm currently scrambling for remediation ideas. "Change everything" isn't tractable.
I understand the threat model. However that notion implies that those of us who aren't at risk of death over our emails should give up PGP. Given that (I assume) most of us aren't at risk of murder by the nation-state, PGP is dead.

I would prefer a solution where everyone could reasonably get end-to-end encrypted emails. Unfortunately, given the unfitness of PGP for this goal, coupled with recent work in the space, it looks like we will either get plaintext over decentrailzed email, or e2ee inside walled gardens.
"Cloudflare undermines that entirely. "

In their defense, this is a flaw of the whole SSL/TLS security model. I think even Google did that before Snowden, presented you with https:// urls but proxied everything in clear text (they claim they don't do it now). Still, you can be pretty sure that many https websites might pass traffic in clear text to their backends and not necessary take security even a little bit seriously.
How do i get the key information to HN without passing through cloudflare so that someone could sniff it?
And https://pastery.net
On the flip side, this media attention may help motivate the USPS to improve their systems. So while some may have lost a place in a dysfunctional queue, there is a chance future customers will not have to wait as long.
Because they care less about the former than the latter? ;-)
Modern JavaScript Apps with Neutrino
> PGP is decentralized with no possible way of knowing how many use it

> ..., apply some multiplier, ...

You glossed over that like it was nothing. Let me rephrase GP: "... with no possible way of knowing the multiplier".

Obviously there exist k such that for n keys on "the keyservers" (we'll have fun enumerating those too) and s signal users, k*n > s.
Yep. The guy is not a big-time games distributor. He's a guy with a childhood collection that offered to lend it to me for a few weeks.

There were definitely mistakes made on our part. But what I really can't forgive is ... once the outer wrapper came off, my address was still plainly visible on the box.

I can't for the life of me understand why they shipped it to their undelieverable mail / govdeals.com auction site location.
> They could easily bypass Macbook security with a USB device

Isn't this only possible if the laptop is unlocked?
My bad. I thought Flexible SSL was the option where you can use any arbitrary self-signed cert. But you're right, Flexible SSL means no encryption at all between the origin server and CloudFlare. I will edit my post accordingly.
Is there any evidence anyone refused? If not, then they can frame it as consensual and no one will have standing to challenge it.
This is a little idiotic. Alphabet let all their talent walk out the door. I'm assuming mostly because of idiotic management and now they're suing. They're basically losing on all sides.
People are going to lambast CF for downplaying the impact, and there could be merit in that.

However, I really want to say I am absolutely impressed with both Project Zero AND Cloudflare on so many fronts, from clarity of communication, to collaboration, and rapid response. So many other organizations would have absolutely tanked when presented with this problem. Huge kudos for CF guys understanding the severity and aligning resources to make the fixes.

In terms of P0 and Tavis though, holy crap. Where the heck would we be without these guys? Truly inspiring !
>Also, it apparently wasn't all that easy. They searched, came up with nothing, and then had to request a second search in order to find it.

But they seemed to have procedures in place for doing so, no?
Cloudflare isn't just a security hole in the middle of the internet, they're a protection racket.

If you wanted to pay to DDoS a site, search for "booter" and you'll get a list of sites that will take another site off the internet for money with a flood of traffic.

quezstresser.com
webstresser.co
topbooter.co
instabooter.com
booter.xyz
critical-boot.com
top10booters.com
betabooter.com
databooter.com

etc. etc. - from the first 30 results I could find 2 booter sites that weren't hosted by Cloudflare.

But hey, pay Cloudflare and your site too can be safe from DDoS attacks...
> The greatest period of impact was from February 13 and February 18 with around 1 in every 3,300,000 HTTP requests through Cloudflare potentially resulting in memory leakage (that’s about 0.00003% of requests).

1) From the metrics I recalled when I interviewed there, and assuming the given probability is correct, that means a potential of 100k-200k paged with private data leaked every day.

2) What's the probably that a page is served to a cache engine? Not a clue. Let's assume 1/1000.

3) That puts a bound around a hundred leaked pages saved per day into caches.

4) Do the cache only provide the latest version of a page? I think most do but not all. Let's ignore that aspect.

5) What's the probably that a page contains private user information like auth tokens? Maybe 1/10?

6) So, that's 10 pages saved per day into the internet search caches.

7) That's on par with their announcement: "With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains." Well, not that we know for how long this was running.

8) Now, I don't want to downplay the issue, but leaking an dozen tokens per day is not that much of a disaster. Sure it's bad, but it's not remotely close to the leak of the millennia and it's certainly not internet scale leak.

9) For the record, CloudFlare serves over one BILLION human beings. Given the tone and the drama I expected way more data from this leak. This is a huge disappointment.

Happy Ending: You were probably not affected.
We actually did. His collection was 400 games. I asked to split it into four smaller shipments. But what I failed to take into account was that I really could not afford to replace even 100 PAL SNES games. They're just too expensive anymore.

I hate that blame is being placed on him for the shipping. He was doing me the favor. It was my fault for requesting so many games to be sent at once.
I think it's interesting how PC technology has changed in the past 30 years. I remember when PC's first were everywhere in the late 80's. They generally worked, but when they went down (like a virus), they were down for a long time and sometimes never came back.

This is all subjective, but I feel like the end of the 90's and early 2000's was the low point for PC's and computers in general.

Viruses were everywhere it seemed. Things would break all the time. Shit was never compatible. You had to have detailed knowledge of how software worked in order to fix it.

I remember the day I was trying to fix my PC when I finally looked some of the more under the hood files and programs, and was blow away at the complexity. It was very humbling.

Then, somewhere in the late 2000's, something changed and I feel like computers have been working better.

I don't have to fix my computer nearly as much. It just sort of works.

Sure, there are issues, but the frequency and intensity are much less (knock on wood).
I think the idea is that you implement some interface for interested users to supply their own API keys.
I don't worry about it. I suspect that the things that I use often enough to retain are the things that are worthwhile for me to retain.
Define non-entry software engineering position? I really don't thing good code is easy to produce, so it is not definitely the easiest in my mind. I think there is a distinction to be made between becoming a good software engineer, and get a job as a software engineer. The first option takes more than 3 months.
you need at least two things to accomplish this:

- You need to have a personal knowledge base system

- You need to have a system to review this. Either using randomization, flashcards or some other method.

For example, you could use Evernote or Workflowy to organize everything new that you learn and then export all notes to a giant PDF that you randomly browse regularly on your mobile or desktop.

Sadly I haven't found a good knowledge base application that also includes randomized review of content. It is a need but most of them focus on organizing and finding, but not so much on review.
The lawsuit from Waymo specifically calls out good LiDAR as a component that Uber had not successfully developed prior to acquiring Otto.
They do it all online now, and all the big-time retro game sellers on eBay know about govdeals.com now. The auction would have gone for thousands of dollars, easily.
Interesting questions for google employees:

Does Google force you to use specific version of OS?

Do they have pre-installed software?

Is it not-okay to format and install any OS you want?

I work in startups, they provide only laptops and doesnt care about OS or software. There is no mandatory software requirement from company side.
Wow, I just tried this, the first result with a google cache copy has a bunch of the kind of data described. Although there was only one result with a cache.