skysight-inc/HackerNews huggingface dataset:
Yes, consensus does mean that the group "in power" can change the rules in ways that can harm those outside the consensus.

This is kind of scary, but on the other hand I think it won't be exercised in too strong a way - or at least in a way that harms a large number of people. The reason it won't happen is that aggressive moves that harm too many players threaten the whole game. So those in power have to consider whether their actions could ultimately undermine their own value, since the value is agreed upon by a larger market than just the people with consensus.

Now, if you have a pile of nerds with more interest in ego or "correctness" than in financial value, then wild changes can occur. I don't mean to suggest that's always a bad thing either. It's a bit like choosing when to evolve in a backward compatible way or when to make changes that are good for the long term but which annoy or frustrate some people in the short term.

For me, the takeaway of most interesting events in the blockchain world is that it's still quite young. There's a lot to learn, and it will take time to stabilize and become boring and reliable (or at least more predictable).
Announcing the first SHA1 collision
Burger King to Buy Popeyes for $1.8bn--BK Version of KFC's Double Down Coming?
I've never come across a great book of relational models specific to domains.

My favorite general db book is Database Systems: The Complete Book (DS:CB), by Hector Garcia-Molina, Jeff Ullman, and Jennifer Widom. This is a good book for learning about relational modeling and how to normalize a model so that your eventual schema has as few dependencies between entities as possible. I taught an introductory class where the required (by the department) textbook was Foundations of Database Systems by Elmasri. It's definitely not my favorite book, but if you skim chapter 3 on entity-relational modeling and then chapter 9 on converting an entity-relational model to a relational model suitable for an RDBMs, that is a useful starting place. When I was teaching the class, I often had to go back to the Garcia-Molina,Ullman, Widom book for simple and clear language around concepts for my lectures.

I'll second the recommendation for Joe Celko's books for general SQL programming.
Can we get the click bait title changed. Amazon is arguing that the consumer first amendment rights extend to alexa recordings.
"You just started collaborating with [insert your open-source choice] engineers on some piece of technology that they were working on in the open, then when it was clear that you were making a valuable contribution and were a great person to work with, you would apply for a job. Or they would hit you up"

Clear to whom and to what degree or how exactly? Then even getting over this stratagem, they might ...or not! Maybe not, most likely. I understand that this might hurt some feelings or dispel some fantasies, but this is exactly the way you (as workforce asset) are encouraged to think, and not in your best interest, really. The reality, more likely than not, is that a business has to be run and the people responsible for it have to cover the business model's needs with some X number of engineers. If the business is doing well and the men with the ropes see real benefits in hiring more, than there you go -- green light for the lucky department for getting a new pal along. The circle of developers in that area already know the contributors and just open the gate for one(s) they like. That, of course, has nothing to do with absolute quality of the contributions. It's not necessarily the best of open-source contributors that get hired, it's not even the best contributors of some specific open-source commercial project like Red Hat, it's just the best (read "convenient") in the area they need at the moment. Realizing that we're talking about an entity living under business laws of survival, you also have to assume it has to employ some of the same prosaic principles in order to survive, just like anyone else. The rest is propaganda. Be assured that your position as free contributor suits the recipients a great deal already and they won't change anything about it just because.

That being said, I agree that the exposed work works very well for engineering, just as for any other portfolio-based enrollment.
Many races do have cash prizes. For a smaller race, it could be just a trophy, or a trophy plus something from a sponsor, but it could also be cash ($50-$100+ range).
I inflated nothing. I made reference to a hypothetical situation where either more or less were killed and then I mentioned the universally known number of 6 million.
>* Distribution software checksum. SHA1 is the most common digest provided (even MD5 for many).

Maybe I'm mistaken, but isn't the purpose of those mainly to verify that you've downloaded the file correctly? At least, the use of MD5 suggests that this is the case.
Earth has a rotation period of 1 day (around itself). When stargazing a 1 day rotation period would be the same as 1 day orbital period whilst being tidally locked (which seem to be the case for these planets)

I don't think anyone is getting dizzy down here so I would assume it would be the same there? or have I missed something?
The importance of that update cannot be understated. Torrents are much more viable to being exploited than anything else out there.

I think everyone should be on alert for updates to their favorite torrent softwares.
git does some other funky things, usually it just uses the pre-existing object, or crashing

http://stackoverflow.com/a/9392525

It might change, but the response could quite likely be a stubborn "I said no before, so I'll say no now"

- - -

This attack has been known since 2013, that is a really long disclosure time (the main thing today is proving that the attack isn't theoretical)
Certainly, ZFC is not a pathological constructed example. When a mathematician looks for a foundational set of axioms, ZFC is THE standard choice. It is, and has been, for the last ~90 years at least.

My point was that foundational mathematics is rarely touched upon by a lot of normal pure mathematics (say number theory, field extension, graph theory).

Interestingly, I believe a lot of people actually dislike the axiom of choice. They find it to be way to 'complex' when compared to the other axioms. It is a lot like euler's 5-th axiom (2 straight lines with the same direction are equidistant everywhere). Interestingly in that case, removing the axiom led to spherical and hyperbolic geometry.
The commit object is signed; which contains a signature to both the tree and the parent. I don't see it as feasible to do a collision on both at once with the method outlined here, but maybe I'm missing something.

Tagging on the other hand is at risk, as it's just the hash that's signed.

Edit: You can check what is actually signed with `git cat-file -p $obj` where $obj is a commit or tag id.
It most likely does not but what you're overlooking is that it makes some people "feel" safer.
PGP V4 key fingerprints still use SHA-1 exclusively. There hasn't been an update to this part of the RFC as far as I know [1]. Collisions where both preimages are of the attacker's choosing matter less in this context, but who knows what clever attacks people can come up with.

[1] https://tools.ietf.org/html/rfc4880#page-71
That's a very useful and informative post. Thanks!
Correct, and if you have 2 images that have the same hash, you can serve one or the other at different times. This is the attack.
> I have seen most folks around me who own cats have this need for constant drama

I actually consider cat owners as the inverse; they want the love and attention and cuddles and purrs, when it's convenient for them ( after a hard day at work etc ) but otherwise they can chuck the cat outside and foist the 'dramas' onto their neighbours.

It's possibly the lowest-responsibilty-for-owner pet possible but does require a total indifference to one's neighbours.
The Disappearing Book (2012)
Having used Scala I can't stand to go back to Python. Almost as lightweight (more lightweight in some places - case classes and "_ lambdas" are things I really missed in Python, though attrs maybe solves the first), but a whole lot safer, which makes it much easier to refactor, which makes it possible to maintain a much higher quality standard in a long-lived codebase.

And the whole library/build ecosystem works a lot better - partly the problem is harder for Python because many "python" libraries rely on native code (whereas JNI is relatively rare), but it seems there are still four or five different ways to build and package Python projects and to work at an organization with a large Python codebase you end up having to understand all of them. (Every few years I see a blog post on how the packaging problem is totally solved now, for real this time, but at this point I've stopped believing them).
>"It's no Space X, but giving people a cheaper, more reliable cab that can be used for carpooling seems more meaningful ..."

But the "cheaper" part is largely because rides are being subsidized by VC money no? Is it that meaningful if its not sustainable?
I read the link from work where they've disabled the use of adblockers, I didn't have any trouble.
IANAL and my expertise in this matter is only as deep as skimming these articles[1][2] but it seems like it would be illegal if Uber were a monopoly and cutting prices to prevent competition. Cutting prices to try to gain market share seems to be a competitive practice which benefits consumers.

1.https://www.ftc.gov/enforcement/anticompetitive-practices
2.https://www.ftc.gov/tips-advice/competition-guidance/guide-a...
one of the rules appears to rely on hashing the function body to produce a result

Gross! I wonder what that's for. Somebody's hack to allow same-name/same-interface header inline functions to coexist?
Can someone explain to me why edge servers do not have all of the terrible effects of non-net-neutrality? ISPs install edge servers that result in faster service for content from some providers. Maybe they charge for them. Maybe they also charge for a leased line from the content provider's data center. They can of course do this for their own content as a way of utilizing their monopoly power. Why hasn't the sky fallen already?
I know that OCaml, Haskell, the JVM and Microsoft .NET do it (I think Mono does, too, but am not positive). And I know for a fact that OCaml and the JVM inline allocations and optimize multiple allocations that are close together (e.g. increasing the allocation pointer only once even if you allocate a pair of objects).

It's fairly common and needed for modern functional languages, as they can go through a lot of temporary objects when programming in a purely functional style.
If you're very careful with your machine maybe you can make it last 6500 years, but I think that is way outside the expected lifetime of a mobile CPU under full load.
Not to mention the whole "us" and "them" separation that would eventually arise the same way we have with our arbitrary borders.

Hmm, wait we were talking about intelligent species, never-mind.
Torrents have a tree of hashes for the parts. That allows validating pieces without the entire file (which is also validated at the end).

Probabilistically, the hashes of the parts would not match even if the top level hash matched.
I, like much of Silicon Valley, make more money with strongly-enforced net neutrality. I try to remove those blinders from time to time and think from the other side.

Could an oscillation between hard and soft net neutrality b better than NN "always on"? Let me explain. Strongly-enforced NN earns those using the pipes (including those not yet founded) more. Weakly-enforced NN earns those owning the pipes (including those not yet laid) more.

When returns to content creators are low, you get incumbency--no Netflix or Spotify. When returns to pipe owners are low, you also get incumbency. No Google Fiber or SpaceX satellite Internet [1]. (Another solution is weak-form NN on new (and utilized) capacity. After some time, that incentive would phase out to strong-form NN. Like patent protection.)

Corollary: is a pro-NN ISP something consumers would pay more for?

[1] https://en.wikipedia.org/wiki/SpaceX_satellite_constellation
The second attempt at docking Dragon was successful: https://twitter.com/SpaceX/status/834716206930108416

Progress MS-05, the first russian resupply mission after the failed Progress MS-04, should arrive tomorrow, February 24th:
http://www.russianspaceweb.com/progress-ms-05.html
> Do you really have to?

Think about it. You have an understanding of history. You can't not have an understanding of history, unless you live under a rock. As you study history more and more, you realize that all of your prior understandings of history are wrong.

What do you do then? You don't have a past anymore. The only thing that's making sense is the present. So you re-examine the past in light of the present. That's reifying. It's your only option. You're reifying today, you're going to reify again tomorrow. Because the thing doing the understanding is changing every day, so you need new understandings. You're not building, you're constantly demolishing.

Logic is only as good as your premises. If your premises can't be trusted, you need to go back to the drawing board.
Understanding CIBIL score: Importance and factors affecting it
Yep, I saw that and edited as needed.

Isn't there still an attack where you create to different commits to the linux kernel with the same hash? (I presume here that a git commit hash is calculated over the diffs, not the end state of the repo).

If that is the case, you can still sneak code into the repo, though it would be easy to detect by seeing repos diverge.
If you're using your own car, it's a losing proposition, unless you never drive in between rides, which is impossible because you have to drive unpaid to pick up the rider. Vehicle costs $0.61/mile to operate, ridesharing platforms pay $0.83-$0.88 per mile. So do the math, if you're driving more than 1/3 mile unpaid for every paid mile, there's a loss. Don't forget paying the vig to the Rideshare network of 20-35%.

I'm not factoring in the time component of the fare, because for average rides it is immaterial. In Los Angeles, Lyft pays $9/hr for regular Lyft and $6.60/hr for Lyft Line. Only when there's a rider in the car. So if you wait 3 minutes after drop off for the next request (like if it's busy and you aren't in an alligator pit of drivers competing for requests. You can also end up waiting an hour between rides if you're really unlucky or get taken outside of the hip zones where riders are plentiful), then take 3-10 minutes to arrive at the pick up, then give a typical ride of 5-6 minutes, your time payments are less than $5/hr. Possibly less than $1/hr.

The only way to eek out a slight profit is to rent a vehicle under a partnership and hit your ride quota to get the rental cost bonused back to you. At that point, your expense is fuel, and if you hypermile the right vehicle, the cost is about $.10/mile. Then on top of that, you need to win the lotto several times daily and get the vaunted long ride with a $12-$20 fare or $80-$90 if you hit the jackpot and you'll then be doing better than working in fast food. But don't forget there are plenty of unpaid miles. Getting back to your hot spots to increase ride count/decrease idle time, returning from the sticks after the jackpot ride, and driving home from the other side of the region when you're too tired to drive any more.
Malware infecting a few hundred beefy-gpu PCs isn't implausible.
There is this (which Google licensed from Yahoo/Overture/Go):

https://www.google.com/patents/US6269361

and then there are the patents filed by Friendster, that Facebook later acquired:

https://www.theguardian.com/technology/pda/2010/aug/05/faceb...
>Which can be appropriate

I disagree. Obviously if you have a big distributed infrastructure (like git) then you won't be able to switch within a day, but that's a pretty extreme example. They should be working on moving away from it though, pandora's box is open now, it's only going to get easier and cheaper.

There's no benefit until there's a benefit. If you're using a hash it's probably because you want a compact way to reference a resource, or maybe simply check it's integrity. If this property no longer holds then it's basically useless. You can ignore it until somebody decides to forge collisions in your system in order to corrupt files or DoS it somehow.

Or you use SHA-1 to deduplicate your files, somebody stores two colliding PDFs and you delete one of them because you think they're dupes.

So I don't think there's any nuance needed here. The word should be "stop using SHA-1". Otherwise people will keep making excuses not to do it until something important breaks.
Filters are used all the time in C++.

* If the filtered result is used locally in a function (and then thrown away), a filtered view works just fine, is very cheap, efficient and is lazy (nice if you only consume a subset of it).

* Often only the filtered view is used, so you can destructively modify the original list, so no copies.

* If you need both the original list and the the filtered list, in a functional language you need to allocate new cons cells anyway. The cost of allocating, modifying and touching the new memory is going to dominate except for very long strings, so copying is not an issue.

Of course in C++ lists are frowned upon in the first place (as many algorithms can handle any data structure transparently), while they are kind of central in many functional languages.

There are cases of course where frictionless shared ownership is nice and GC shines. Filter is not one of them.
If you ban encryption, only criminals will be able to use encryption. That is very convenient, since it's easy to detect when people are communicating on a secure channel.

The same argument applies of course if you only allow encryption that has a master key that allows LEA to eavesdrop. That is probably safe enough for online banking (it's the system we currently have with https), so from a policymaker's point of view this is an okay solution.
Saying it was shown to be flawed is being nice. It was outright broken 12 years ago as it was shown that you could find collisions with far less complexity that a bruteforce attack.

What has happened is that someone created the code to actually carry out an attack, and showed that it will cost around $110K today.
This makes the assumption that every program it writes is somehow guaranteed to be better than the original. Why would it not run into the Multiplicity problem, where each subsequent copy is a bit dumber than the original?

I would think it would be much more likely follow a normal evolutionary model - improve itself to a local maxima, then just stall while the random mutations fail to make the huge leap required to hit the next maxima.

We can't even properly model the human mind in computers yet - not enough processing power - so it follows that an AI which is "better" than humans would require even more processing power than that required to ape humans.
Right, the Wikipedia page for SHA1 does show research on a variety of possible attacks, starting from 2005.
I've been using TVs as monitors for years and one thing I can say for sure from my own experience is this: Try not to let any static images stay on the screen for long periods of time. This isn't really an issue with actual computer monitors, but when using a TV as a monitor, it almost always leads to burn-in of the images.

Another note is that you'll likely want to turn off some of the features that benefit you on the TV side of things (motion flow, image sharpening, etc). These features actually make the experience worse when using a TV as a monitor.
One practical attack using this: create a torrent of some highly desirable content- the latest hot TV show in high def or whatever. Make two copies, one that is malware free, another that isn't.

Release the clean one and let it spread for a day or two. Then join the torrent, but spread the malware-hosting version. Checksums would all check out, other users would be reporting that it's the real thing, but now you've got 1000 people purposely downloading ransomware from you- and sharing it with others.

Apparently it costs around $100,000 to compute the collisions, but so what? If I've got 10,000 installing my 1BTC-to-unlock ransomware, I'll get a return on investment.

This will mess up torrent sharing websites in a hurry.

Edit: some people have pointed out some totally legitimate potential flaws in this idea. And they're probably right, those may sink the entire scheme. But keep in mind that this is one idea off the top of my head, and I'm not any security expert. There's plenty of actors out there who have more reasons and time to think up scarier ideas.

The reality is, we need to very quickly stop trusting SHA1 for anything. And a lot of software is not ready to make that change overnight.
It bugs me when people obsess over equality, and not the standard of living. Today's poor have it better than kings in many ways. Running hot water, air conditioning, much more.

If people would stop coveting what everybody else has, society would be much better off. Instead of saying "he has more than me" say "I have enough for my needs".

There will always be someone with more. Don't be greedy be grateful, or you will never be happy.

The commies obtained "equality" but did standard of living improve? No many people starved, and millions were murdered. They depended on the west for their very food. Now China is becoming less authoritarian and is able to grow.
Don't bother thinking about what the processor is doing. Just trust it to figure it out. Tell it what to do (which shouldn't involve "weird tail recursion" - rather you probably want to use "map" or similar), and let the runtime/processor do it for you. If and when it turns out to actually be too slowly, and you profile it and can't immediately see why, then you're allowed to worry about that kind of thing. Not before.
This requires the addition of random garbage in the first file which someone will detect anyway. Why not release an infected file with a timebomb malware instead of colliding SHA1? Much cheaper. Still, none of this allows you to attack an already existing torrent.
The initial torrent metadata is pulled from nothing but the first hash. This is the point where the rest of the data forks.. someone gets the movie, another gets the .exe.
You could also find a preimage for any tree or blob object referenced by that commit. And in large projects, you have a lot to choose from.

(As has been stated, I know this isn't a second preimage attack.)

Edit: See my answers in this thread: https://lists.gnu.org/archive/html/bug-guix/2016-06/msg00009...
They actually did numeric simulations of that system, and it seems to be stable for several millenia at least (their entire simulation time).
> the assignment syntax "x=x+1" must be especially confusing to high-school kids

It wasn't at all confusing to me as an elementary school kid in BASIC, so I doubt it. The variables = named boxes metaphor was a fairly standard part of the pedagogy.

Immutability is great, sure, but let's not pretend that imperative sequences of instructions aren't basic and common things humans have to deal with and quite natural.
Ümraniye’nin Ateşli Kızı Sıla Huzur Escort Olarak Sizlerle
The only validation that matters: Sales
I do not welcome the new Compuserve, AOL, and Prodigy oligopoly.

Also, how will this affect mobile app-developers that rely on a server backend? Will this drastically curtail mobile app development?
Niice Launches
To completely specify a program via tests, you've effectively written the program. You've also probably written somewhere around 2x the code the actual program would require as well.

I'd be more curious to see an AI write tests...