skysight-inc/HackerNews huggingface dataset:
Constitutionally, they don't have a leg to stand on. The police cannot demand your ID without probable cause.

I wonder what would have happened if someone refused.
Just looking at that site... what's so bad about Wikipedia? There's a lot to criticize about Wikipedia, but I've never heard of them violating someone's privacy.
Strategic Laziness: How I learned to run ambitious software projects
Yes, hate, hate NDEBUG. Such a terrible idea to disable assertions.
Allowing violations of our rights "just in this case" is how they get stripped down to nothing. The government does not have the right to demand your ID at any time they please.
Since it's easy to be unclear of your legal rights and protections, can you ask officer if you're legally obligated to comply with their request, and if they're recorded lying can the agency be held accountable?

That might be another way to try and have a legal push back, as most people, probably myself too, might not feel up to trying to stand their ground on their rights impromptu with no time to become aware of whatever specific rights will challenged ahead of time.
I don't have much handy right now, but after this Enterprise Ethereum launch event on Monday there might be more information available: https://www.eventbrite.com/e/enterprise-ethereum-alliance-la...
The "low-level system monitoring" is effectively a software implementation of any "active" ACPI logic (e.g. Intel's SpeedStep.) This used to be in a separate "platform controller", but putting it in an on-CPU-die coprocessor 1. allows the ACPI logic to be regular x86_64 code, and 2. allows much simpler motherboard layout wiring (because you don't need a bunch of duplicate pinouts running from peripherals to both the CPU and platform controller; they can all just go to the CPU.)

> The remote access stuff is usually marketed as "vPro", and it's sold as a premium feature.

AFAIK, in all modern Intel processors the IME is directly attached to the network hardware and gets its own SR-IOV virtual instance of the hardware (with its own MAC) to talk to. But not all motherboards support vPro: the onboard Ethernet controller has to be designed with awareness of the IME so it can recognize its packets as additional Wake-on-LAN packet types, and not all are (yet). So—at least if you're building custom—you can just buy a non-vPro motherboard to "wall off" your computer from secret probes of its ports. (Or, you know, use a router. It's not like these packets will make it to your computer from across the Internet.)
This. It is very possible to fly without ID. Have done it several times due to lost wallet/id. Takes longer. And there is more verification. But def possible.
1Password's blog post responding to this incident: https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...
In what way is this a protection racket? That's sort of like complaining that mob-owned businesses enjoy the same police & fire protection that all other businesses have.
It's not possible unless you have zero-days against the USB drivers or firmware on your laptop, in which case being logged in or not doesn't really matter.
I recently saw an illuminating video about how Robert Mercer, a billionaire quantitative wall st. trader and computer scientist, not only backed Trump with $15 million, but madeover his whole team. Mercer's analytics companies, which make him money faster than Warren Buffet, were set to the task of winning the election.

Not to mention Peter Thiel.

Now, we don't know how they did it, but I can only imagine that with deep learning, etc, this is only going to get worse.

Shameless plug for the video. I doubt it'll get traction on HN, but it was 100% a wakeup call for me.

https://news.ycombinator.com/item?id=13719646

Now I recognize it for what it is. Its a techno-hyper-capitalist power grab.
Extremely relevant discussion on stackoverflow from 2012 on how would git handle a SHA-1 collision, someone called Ruben changed the hash function to be just 4 bits padded with zeroes and checked what git actually does on collisions: http://stackoverflow.com/a/34599081/308851
Definitely! You'll probably appreciate this podcast if you haven't already heard it: http://www.wnyc.org/shows/radiolabmoreperfect
Maybe you can go backwards and see which websites resolve with these IPs:

https://www.cloudflare.com/ips/
If you're using it for three years, then you'd take an RI and it'd be 60% of the cost. You also don't have to worry about failed parts, hardware monitoring, racking, power, etc, plus the skills required to manage same.

Yes it is more expensive than buying your own hardware, but I thought we all understood at this point that AWS does a little more than just give you an empty server and no additional services.
First Tibetan library opens up in India. Help em
Oh c'mon, you have to link to a piece of internet history like that!
A lot of pentesters make good money off bounty hunting. Some months they make more money off hunting than they do their day job.
From an engineering POV, this line makes the most sense out of all:

> when ECS launched, the goal was to do a smaller number of things really well, and then listen to the community on what _they_ wanted to see from a container management platform, and grow accordingly

I'm coming from a small CoreOS cluster on bare metal, onto Kubernetes and Helm on EC2 nodes. I was a Fleet user before and I loved it! But always with the understanding that when things got better in the cluster space, I'd move from Fleet toward some resource aware scheduler.

I love to read how you're all going down a similar road, however you get there! Thanks for the blox links and I think I will be able to make immediate use of ECR with the rest of my AWS stack.
It looks like it was 1Password who have blogged their take on this Cloudflare vulnerability here - https://blog.agilebits.com/2017/02/23/three-layers-of-encryp...
How to Retrieve Deleted Photos from LG 5/G4/G3 Phone Memory
It's the same stance that antivirus developers have always had, more or less. As usual, the difference between blackhat and whitehat is very, very thin - if there is a difference at all.
Bitcoin is a popular one. 2 sha-1 rounds.
Think twice about leaving secrets in your docker images during test and dev
Both should be there, as well as 'Set-Cookie: __cfduid=...'

$ curl -I okcupid.com
Set-Cookie: __cfduid=...
Server: cloudflare-nginx
CF-RAY: 335f033b77742b76-AMS

EDIT:
Better yet, make that 'curl -IL domain.com' to follow redirects because it may not show in the first response.
There are a few reasons why police will set up roadblocks, yes, like a manhunt, missing prisoner, or DUI checkpoint. The big difference is they don't ask for ID at these positions, and I've never personally seen a roadblock on a major interstate, usually it is smaller roads and closer to where they think the person might be. Of course roadblocks are only useful if you can set up blocks all around a perimeter.

Also, those roadblocks are extremely temporary by nature, in terms of hours. Some of the border patrol checkpoints are basically permanent (a big sticking point in terms of the law).

Now let's expand this instead of fugitive, you're looking for illegal immigrants on a list of people. Does that mean you can stop everyone, and scan their ID to try to find these people? Not to mention search the vehicle?

In terms of the constitution, my right to free travel and the 4th amendment, I would hope that such a thing wouldn't happen, but it seems like that is what they are trying.

For airports, things are a bit different, and you waive certain rights because of public safety and the risk of terrorism. But I can see something like that being moved down to travel by road as well.
They know what a memory leak is, so...
That you're a natural-born citizen is completely irrelevant; naturalized citizens are no less entitled to the exact same rights less serving as POTUS. See the supreme court ruling from Luria v. United States, 231 U.S. 9 (1913). Link: https://supreme.justia.com/cases/federal/us/231/9/case.html
Indeed. And that's not an anachronism, I just did it 2 years ago when I forgot my license. Just had to show them a credit card.
There's a trend to many of Trump's decisions so far, which is that they are punitive. He knows there are things liberals want and support, and he's going to go after those things. Not because he cares about them, but because it's important to him to "get back at" his detractors.
No, it uses SHA-256
Lyft begins service in Iowa City despite state warning
I have been struggling to get into the flow for the same reason that I have trouble getting into meditation: I have bulging disks and chronic pain.

I can never completely focus on anything these days because I am constantly focusing on the pain.

Does anyone else with chronic pain have advice for getting into a flow state without being interrupted by pain?
> We think the 1998 statute struck the right balance and is generally working well, a view shared by nearly all Internet platforms and users.

This might be peripheral to the main point, but I have a hard time believing this. Spurious takedowns have inspired multiple waves of invective on YouTube alone. It's a pretty common opinion (at least in my circles) that the current law unduly encourages copyright owners and their representatives to send vast numbers of notifications with no regard to their accuracy. Furthermore, the lopsided requirements of notification vs. counter-notification ("reasonably sufficient" contact information vs. name, address, and phone number) have been abused in order to dox people [1].

[1] https://torrentfreak.com/anti-piracy-group-reveals-personal-...
Nah. Bug bounties don't work for services like CDNs. Maybe they do elsewhere. But for enterprise services, the noise rate is too high, and the very good bug finders are either salaried, free, or working for the adversary.
Nothing special; each Xeon socket can provide 5 PCIe x8 slots. Don't try this in a 1U though.
This assumes that the Bad Guys hadn't noticed the bug before Tavis, and hadn't started intensively mining Cloudflare for data.
This has been addressed in just about every discussion of her article.
My non-lawyerly understanding is that in theory, officers of the law have substantial protection as long as they can claim they were not willfully violating your rights. On top of that, in practice they have even more protections (http://m.huffpost.com/us/entry/4221000)
Only if the leaked memory is in the response before the response is cached.
I don't know enough about the layers in the cloudflare system to say. Does it only apply to cached pages? What about https? They would have the ssl termination first and then these errant servers behind that - none of those pages would be cached, right?
From my blog on this:

The three features implicated were rolled out as follows.
The earliest date memory could have leaked is 2016-09-22.

2016-09-22 Automatic HTTP Rewrites enabled
2017-01-30 Server-Side Excludes migrated to new parser
2017-02-13 Email Obfuscation partially migrated to new parser
2017-02-18 Google reports problem to Cloudflare and leak is stopped
I'd imagine that's exactly what OP was referring to.
You might be able to try, but that's a much flimsier case than them taking punitive actions against you for refusing to show ID.
You can't really do that kind of math without using AWS incorrectly. The reality is that you won't run the instance on AWS for 3 years. You spin it up when you need it, and you kill it when you don't.

There will be some instances that you'll run 24/7, but this shouldn't be the case for your entire fleet if you're on AWS.
The abuse continued after the exit.
I meant cached by a public service like Google Cache Bing Archive.org that expose the pages.

A browser cache might be 1/10 but that's not open.
CloudFlare is neither the first nor the biggest CDN. I can't recall Akamai having a hole this big. They're either more secure or better at keeping things quiet.
How can I find out which services I have accounts with are using cloudflare? Or better have been using cloudflare in recent months? Assume I have a list of domains, where I have accounts.
Recording security operations at the airport may itself be illegal, depending on the state and local laws.
Copying illicit data constitutes copyright infringement at its best, or industrial espionage at its worst.

Theft is a different type of crime involving actual things.
Also, have you worked with any search engine to notify affected customers.

ex: Right now there is in an easily found google cached page with OAuth tokens for very popular fitness wearable's android API endpoints
> only sites with one or more of those features enabled leaked data

No. From what he says, enabling that feature on a CF proxy basically triggered the bug on any site that happened to go through that proxy, regardless of whether it used the feature or not.
Because Pharma pays more than people?

All snark aside, traditional Republicans are more in favor of societal stability. And this is achieved, in their mind, via social institutions and a thriving economy. Thus, their values that align with moral institutions, corporations (economic and potential societal homogeneity), and a strong military (both defense and because it shares it's values of a highly connected, dependent structure of individuals striving for a bigger cause).

I'd recommend reading up on the Moral Foundations Theory, especially the work looking at the differences between Liberals and Conservatives in light of this.
https://en.wikipedia.org/wiki/Moral_foundations_theory
http://www.moralfoundations.org/
Are these comparable to Google's Local NVMe SSD? On Google, the drives alone are as expensive as these i3 instances.

375GB*3 drives on GCE will cost you 0.3431/hr over a month (incl. auto discount), which is already more than an i3.xlarge, and you still have to pay for CPU/RAM.
Google OnHub and Wifi randomly dying on people, requiring factory resets
You must not be a heavy user of reddit. Nearly the entire site is compromised, both by mods and admins. And even without that, subreddits are created and defined by users, and thus free to set whatever explicit and implicit rules they wish.
The PDF's released as proof are the same size, so if size and checksum are the same, git could certainly be fooled at checkout time.

So I could imagine in a large source file, it would be possible to have some malicious code plus some data in comment blocks to make the hash match. That said, the PDF's are 422k, and I think it's a much more difficult attack on more typical, smaller size source files that one would typically check out and build from git. Maybe Xcode .nibs and that sort of tool output could become relatively easy attack vectors, though.
This way of thinking makes ethereum bring nothing new to the table vs. democratically elected rulers of government changing monetary policy. So nothing aside from the fact that you can make little programs using its language makes it unique from how the fed is run today. This explanation that you post is a hallow excuse that knowledgeable people do not buy into.
Apple Severed Ties with Server Supplier After Security Concern
"2 years after a jury found that Ellen Pao"

... found that Ellen Pao could not prove her case on the balance of probabilities. That's not the same thing as you just said.
I think it's probably one of those weirdo cases that makes for good movies and books but, in practice, you get arrested and the judge laughs at your creative defense and orders you remanded without bail. (And it's not even wrong because law != code.)
I wonder, what are the pluses of F# that missing in more mature and widely adopted OCaml? Why to create a clone of good language? With porting opam to Windows platform [1], along with improving the Unicode support [2] in it I'd say it has a bigger potential in this field.

[1] https://github.com/ocaml/opam/issues/2191

[2] https://github.com/ocaml/ocaml/pull/153
Python type annotations
Adding another "It's completely possible" data point. I've done it at least twice (probably more, but I only remember the twice due to the "enhanced patdown" I received being a bit...touchy-feely...)
Three layers of encryption keeps you safe when SSL/TLS fails
Google OnHub routers suddenly factory-reset
Oh good, I can't wait to see what awesome innovations rapid militarisation of our country will bring!
IMO they will both continue to grow. Bitcoin simply cannot do what Ethereum can, and as a result, Ethereum will continue to be used.
She says she has screenshots of those messages if she was lying Uber would have sued her by now. They know she has enough actual proofs to back her story.
We detached this subthread from https://news.ycombinator.com/item?id=13718947 and marked it off-topic.
This really isn't unusual.

I was once stopped and asked for my ID (and other questions) because someone had committed a robbery in the area.

People are routinely stopped at checkpoints when crossing state lines, when police are searching for someone, and at "dragnets" for DUI and immigration.

And yet, suddenly, the left-wing media cares?

Could that have anything to do with their candidate (Hillary) having lost the election?

They're going to exploit anything they can to make Trump look bad, just as the right-wing did when Obama was in office.
> Cloudflare will protect any site that doesn't host child porn

Doesn't that make it worse? They aren't saying they don't or won't police the content they protect. They are obviously capable and willing to draw a line on ethical or legal grounds, if they have done so in that case. They have just chosen to draw that line on one side of porn but another side of DDoS services.

Ultimately it is their decision to make, but I don't think it's unfair for people to question possible conflicts of interest in how that decision is made.
What is the problem being created? They were looking for a fugitive
Yeah.

"We leaked information from Customer A to Customer B by accident" is the first order problem.

But the existence of web caches means that all that private information of customer A is potentially fucking everywhere now.

How do you even clean this up? How do you even start?
Can confirm I opted out of the custom domain today when emailed back with the $75 charge. The cost isn't bad but it rubbed me the wrong way doing the form two months ago and heard nothing back until today. 15 emails/tweets unanswered. Completely understand charging but was turned off by the lack of response/acknowledgement.
I also took 'searched for an installed specialized software' to mean 'downloaded the client for Google's repo server from their internal IT site'.
Fair enough. Maybe I just don't like self-help books as much as others do.
I _suspect_ this is because you don't move in the same circles as the people who benefit most here.

Spend some time talking to the sales people who's haircuts look like they cost more than you make in a week, or who's suits probably cost more than your car. They're _all_ got finely tuned Salesforce (or equivalent) setups and can probably at any time tell you off the top of their head the number of leads and prospects in their pipeline, the size of their expected deals, their recent conversion rate, the estimated total value of their prospects/leads (and the precise dollar value of their commission and bonus...)

I've seen the same with large logistics operations - the ops/management people know exactly where all their assets are and the schedule of movements compared to the upcoming work requests.

You won't hear these stories at a Ruby On Rails meetup or in a weekend hackathon. It's not part of most tech/IT stories. But it's 100% happening out there.
So a junior engineer took the files, left Waymo to join Uber and tried to pass off the files?

Correction. So he's not really a junior engineer. But how can he not think that everything he access on the Google's network is monitored?
There's this browser addon

https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...
I've so far seen an oAuth key for fitbit (via their android app) and api keys for trakt (though apparently that service doesn't use them?)

I don't know, this just seems catastrophic.
Cloudflare sells protection from the internet attacks through its network. The same company and network facilitates the organisation of those same attacks, and helps keep them anonymous.

That's a high-tech protection racket.
Text for well-defined subject matter.
I only like videos that discuss high-level concepts.

I don't like the screencast kind. In fact, one advice I'd give to my younger self is to try not to read and watch tutorial-style content (and this includes many books too!).
Understandably, I think. I can't imagine you've had much sleep this week.
Why is your company severely downplaying it?

Honestly, this is the biggest security incident in a long time, and proper mitigation would probably warrant:

- forcefully terminating all cookies on CloudFlare sites, cloudflare already injects JS onto the page anyway

- MITMing all CloudFlare sites with a warning for users to change their passwords
The first couple I looked at were requests to Uber and Fitbit...
Ragel is a low-level tool, it doesn't operate on bounds-checkable abstractions. But it does allow you to specify how to get the character, where you can do bounds-checking, if you need.
"Don't worry, the keys weren't compromised."

I know how to replace my TLS keys. I have no idea how to replace everything else.

It's like people who think losing my credit card number is the worst thing. No, it can be a hassle, but once I replace it I'm okay. It's everything else.
I don't need to blog about it - it was headline news:

https://www.theguardian.com/technology/2009/jul/17/amazon-ki...
Icon lights up if the current site is on Cloudflare proxy.

https://chrome.google.com/webstore/detail/claire/fgbpcgddpmj...
The on-prem vs cloud argument is sufficiently tired. Obviously you should do the math and figure out what's best for you, but that's not really related to AWS releasing new VM types.

If you're running on AWS for whatever reason, i3 VMs are great news.
There is no reliable way to check. The problem is that even if you verify that a site isn't using CloudFlare now, that doesn't mean that they didn't use it in the past (and you'd still be affected).

In other words: Just assume that everything has been compromised. With how much of the web CloudFlare controls nowadays, you're not going to be far off anyway.
Reconciliation should be done at some point.
for easy firewalling and i'm sure a fun internet experience https://www.cloudflare.com/ips-v4
So the next question would be whether it's possible to remotely reconfigure the "non-vPro" machine to activate the features, in which case it could be considered a direct equivalent.
A really interesting read, yet for me the takeaway is still that AdS/CFT correspondence is an area full of theory, devoid of experimentation. You get these incredibly interesting and elaborate models, and sometimes it takes a depressingly long time for people to admit/realize that they're not falsifiable in any conceivable way.

It's an exciting area of research that seems to produce useful tools, but as to whether it is describing actual, physical processes? Ehh...
I think what is at issue here isn't Uber's external accomplishments, but it's internal culture. It's great that Uber has been able to reduce racism in your area. But it doesn't change the allegations that there are deep dysfunctions internally.
This smells like FUD.

> They could have simply moved things on the desk.

Is there any evidence suggesting something else happened?
I'm going to guess that the board and investors know more than we do, and that they know what such an investigation would bring.
They definitely ask for ID at DUI roadblocks - license and registration, just like a traffic stop. They also will question passengers and if desired, ask you to go to 'secondary' for a search or K-9 inspection. I looked at the stats near San Bernardino while I was there for a time last year, and from what I recall they found more stolen vehicles, individuals with warrants and drugs than impaired drivers.
Ten example uses of Monads