skysight-inc/HackerNews huggingface dataset:
> It is constitutionally impossible to disband the House of Representatives and switch to proportional representation

the constitution dictates how representatives are apportioned and sets out the rules for how election laws are handled. The districting rules are not in the constitution. So why would it require an amendment? You wouldn't dissolve the house, you would just change the apportionment as needed (people/rep) and pass the appropriate laws.
The site publishes the bitcoin txids + addresses so it is trivial to verify whether they are paying out the winnings.
Yes, and Amazon's argument is more detailed than "it's private".

https://news.ycombinator.com/item?id=13714797
There's no need for a middleware service. Just store it outside of the repo.
Hacker News uses Cloudflare: http://bgp.he.net/dns/news.ycombinator.com#_ipinfo

Add the following to your hosts file to bypass Cloudflare and access HN directly:

50.22.90.248 news.ycombinator.com
It's going to be interesting to me to see how this all affects Uber's bottom line.

If they keep scaring away engineers and getting bad publicity, will be scare away customers too?

Or will the trail of engineers eventually catch up with the quality of the experience?
Linus' reply on Git and SHA-1 collision
True, but even though Morse is a denser encoding than ASCII, there is often enough redundant information to infer the correct letter from context. A/E seems a really bad case, but I don't think we have to go all the way to A/Q to fix it.
This might be the time to point out the CloudFlare watch blog: http://crimeflare.com/
Popular companies that use CloudFlare can be found here: https://stackshare.io/cloudflare/in-stacks
Not the TLS Private key, this would pertain to the ClientKeyExchange. The TLS Private Key, should NEVER leave the server. The buffer overruns was only what a client/server exchange would see.
Federal agents make domestic flight passengers show ID to disembark plane
Infringement. The cause of action for infringement begins on Para. 88.
It's extremely difficult to find an addict that didn't "try pot first" but that's only one part of the equation.

Where it breaks down is when you draw the correlation as "most hard drug users have tried pot, so most of the people who tried pot become hardcore drug users". OF course we know that not to be the case.

However if you only use the first part of the definition (as many anti marijuana advocates do) then you must acknowledge the amount of hard drug users who smoke cigarettes ( a lot ) therefore cigarettes are also a gateway drug. Still legal.

I too am surprised this theory is still being peddled.

Personal/anecdotal:

I worked near addicts in treatment for a few years, (no I am not an expert or counselor it was a tech role) and I noticed many of them smoked cigarettes. Many of them still smoked weed too for medical purposes and it simply didn't have the adverse affects on their life that the "other" drugs did (heroin, meth, etc). It's simply not in the same class.

I'm not a pot smoker and never have been, but I strongly agree with legalization based on what I've seen.
In a nutshell, the point is that despite near-constant warnings not to commit secrets to repositories… people do. So this lets developers commit secrets to their repo with reduced risk of leaking the secrets themselves.

That said, there are other good reasons not to commit configuration like this to your repo (configuration and code don't always change in unison; sometimes you need to use older code with more recent configuration, for example) but it's at least better than the current situation where careless developers wind up with thousands of dollars of charges against their AWS accounts after accidentally committing AWS keys.
Thanks for the info. Will know not leave my laptop behind in any interviews.
> it's also secure against anyone passively sniffing the traffic between the website server and CloudFlare

How is it secure? CloudFlare allows you to send this traffic in the clear. If they required this traffic be HTTPS, that would be far better for web security.
16 cores + 122GB + 3.8TB for less than $1k/month is impressive.

On GCP: 16 cores + 104GB + 8x375GB (for 3TB total) = $1470/month or $1226/month with continuous use discount.
The problem is that it prevents people from voting out representatives that fail to advocate for their constituents and represent their interests. The entire concept of a representative democracy is that we elect people to represent our interests, and then if they fail they can be voted out when their term ends. With gerrymandering on the table, they're able to almost literally move the goalposts. It also violates the principle of "one person, one vote", because politicians are manipulating districts to essentially make votes opposing them meaningless. This is the reasoning that was recently used to reject Wisconsin's redistricting, specifically because they exceeded a reasonable "efficiency gap"- the number of votes wasted in a district.

https://www.washingtonpost.com/news/wonk/wp/2016/11/23/wisco...

>>It pushes decisions locally (to the "laboratories of democracy"). It is responsive to "We The People"...

I would love for you to elaborate a little more about this. I happen to think that it does the opposite by making representatives less accountable to their constituents (they can just pick new ones).

In general, it seems like a mechanism designed to advance the power of a given political party by repressing the will of the people. That just doesn't seem like it can possibly lead to better outcomes.
It's not a relational database, but it's a database. A filesystem, where the directories represent tables and the files represent records, is effectively a https://en.wikipedia.org/wiki/Hierarchical_database_model.
It's C. If you have an array, you may only compare to one element behind the last. Everything else is undefined behavior. So a compiler may just "optimize" your >= to ==.
being a libertarian usually begins and ends at your own front door.
I read it as "sensitive query strings sent to Google by CloudFlare engineers".
I can confirm that. I made https://pastery.net, a pastebin (THE BEST ONE), and I looked a few weeks later to find that it had a few hundred thousand pastes. I was very happy to see that people were using it that much, until I realized that most of it was spam.

I wrote some heuristics to delete spam pastes, and only about 1,000 pastes were left, about half of which were spam still :(

I don't even know why they do this. They just do it.
I had a bike crash about six months ago and was prescribed a handful of Norco, which is about the least opioid opiate around these days. If the phrase "worst constipation of your life" does not yet have meaning...
I feel that the fact that they were able to recover this package with what seems to be relative ease is evidence of that.
You don't need to find a collision to do that :)
So how does one find or generate a list of companies using CloudFlare to figure out how you're affected - kinda like HaveIBeenPwned.com?
Even with this, I think it's personally a bad idea. But sometimes security is improved more by reducing the impact of making poor decisions (e.g, storing secrets in your repo more safely) than it is by chastising users to make better decisions (not storing them in your repo at all).
Just to be clear "his" laptop is "the laptop issued to him by Google".

I'd think that standard antivirus software detects and alerts external drives being attached.
Yeah, if you're capable of MITMing traffic between CloudFlare and the server, you're most likely capable of stealing emails or HTTP requests to the server anyways and generating your own certificate for them anyways. It's a security loss, but probably a minor one.

The reality is, you're much more likely to get sniffed on public wifi or even your school or workplace network than someone running the server in a datacenter is, generally speaking if someone can sniff them at a DC they can do much more already. So it's still a respectably huge security gain for users.

And they do offer a good way to secure this connection too where you can do full SSL and use a certificate signed by them.

Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?
Why not use SHA-1 recursively, e.g., append SHA1(text), then SHA1(everything)?

Of course, it would probably make more sense just to use one of the recommended replacements in the first place, e.g. SHA-256.
They're not factory or mining jobs being lost from red states, so who cares?

(edit: ...is Trump's view, not mine)
yeah...dude is going to jail.
Thank you for posting this. This is a very significant, specific, and actionable way of thinking about productivity.
Funny. My first thought was to wonder how far this was from annual Fed hoedown in Jackson Hole.
Certificates, Provisioning Profiles, and Expiration Dates: The Perfect Storm
How many different sites? Your team sent a list to Tavis's team. How many entries were on the list?
Interesting. Is the specific Lidar unit really that big a differentiator? I understand they aren't cheap or simple, but it seems odd that each self driving car company would want to design their own. I would guess you would rather have some healthy ecosystem of suppliers...Velodyne, etc.
It's an NPM package that people download - how would you store it outside the repo such that people that download the package can reference the token? Can't really use an environment variable at that point, right? There probably has to be some HTTP request to some service that ends up forwarding the request to Uber with the token. Maybe I'm over-thinking this...
Early Morse code was sent fully by hand, and so the timing would not be precise.

Correct. My grandmother was an operator during WWII in Australia, communicating with various places northward such as Papua New Guinea. She said that she could easily recognize individual operators via their timings.
"I am ashamed at having to abuse my position and ask for help in getting this story out there. It's not something that most people can do, and in any other circumstance, is not something that I would ever do."

No reason to be ashamed at this. All the free time invested into this project gave the author a little fame. They used that fame to further the interests of the project. Win win.
Related: http://crimeflare.com/
You don't even have to write a script, all that info is already out there.
Can't type while it is thrashing. Otherwise the offending program could just be killed
In the US at least Uber hasn't done a very good job at eliminating racial discrimination. A study has found that drivers continue to discriminate, this time based on the race they assume based on the person's name.

https://www.bloomberg.com/news/articles/2016-10-31/study-fin...
I would guess that the motors are harder to turn than they would be if they were just in the air. There must be some current in the baseplate which creates a magnetic repulsion opposing their motion.
It doesn't need to be about "secrecy", it's about "security". Even when you ignore the employee trust issue, and assume everyone at your company would never betray you, "least privilege" is still not just best practice for security, it's common sense.

People should not be able to access data they don't need. If they need it, you can grant it. But the assumption should be that someone who doesn't use the design server shouldn't have access to the design server.

I don't want to know about or see information I don't need to have at work. It's not that I'm not trustworthy. It's not that I would abuse it. I just don't need the liability that it gets out through me.

Because your account credentials could get stolen. Your laptop could get stolen. Your laptop could get hacked into. Your laptop could get malware. Reducing the list of people who have access to a resource insulates against all of these things... automatically. And sure, all of those risks have other ways to mitigate them as well. But layers of security is key. And hey, it also stops employees from sneaking off with your data too.
How come Republicans/Conservatives want to regulate people but de-regulate businesses ?
Glad to hear someone else was struggling with this. I wish there was a better solution.
Can someone tell me the implications of this in laymen terms?

For instance what does it mean "sprayed into caches"? what cache? dns cache? browser cache? if the latter, does it mean you are safe if the person who owns that cache is an innocent non technical iser?
It's pretty remarkable that a remote process could brick everyone's wifi. (Wired ethernet works fine.) Just a very bad thing to allow.
There are two ways that things can be reproducible: reproducible in practice and reproducible in principle. You are stating that you have a computation that is reproducible in principle (just in practice, unfeasible).

I find this an easy and useful distinction and your publication should NOT be prevented from being published by this measure.
In designing Kubernetes, for instance, we document and (mostly) enforce swap off for many of the reasons laid out here. Kubernetes takes over the management of host overcommitment, and being able to react correctly to OOM and near-OOM depends to some degree on having a clear understanding of the actual memory use on the system.
It sounds worse when you consider the potential for treble damages due to having knowledge of the infringement. Uber's negotiating position is doubly weakened by the fact that they are dealing with a reputation crisis at the same time as this claim has been brought forward.

If Google has the information they claim they do, they have persuasive arguments to anchor their damages calculations on the basis of Otto's acquisition value. Times three.

This is a sword of Damocles hanging above Uber.
>
I support the Electoral College because I think that without it, the issues that Americans considered at the national level would be very strongly dominated by the concerns of the most populous urban centers, which would lead to even more fractiousness between urban areas and "flyover" areas.

and with it the majority of voters get overridden because of those flyover states. I don't like this argument because you are arguing for exactly the opposite as the better way.

Anyway, I still think the easiest way is to remove the cap on the house or raise it a lot. You still get the electoral college benefit you want but the disparity in power isn't so high.

I don't really like that though. Personally I think a popular vote would just result in more moderate policies because you need to at least split the cities, and then the rural areas are still valuable to put you over the top.
It sounds like Deutsche Post did this, not the original sender.
Headers (among other sensitive stuff) were being leaked inside document bodies.
We identified 3,438 unique domains. I'm not sure if those were all sent to Tavis because we were only sending him things that we wanted purged.
Why would you say that? What got this resolved was someone with influence at USPS seeing the news story and intervening. The insurance amount was completely irrelevant to this.

Also, it apparently wasn't all that easy. They searched, came up with nothing, and then had to request a second search in order to find it.
Oh man ... I am so regretting the fact that I wrote an article instead of making a music video now :P
I admit that I haven't been doing this for really long, (started around the week of the election, so around 3-4 months).

But the more important thing is that it worked from the day 1. I rarely see things which work from the first day.
Reddit is the wild wild west. Bots are everywhere, power mods sell their services to companies, admins editing comments without anyone kn0wing, it's just a big shit show.

I would be very skeptical of anything I read on there.
I found Big Binary's Rails 5 blog more useful than the Rails 5 readme/release notes. Hoping they do the same for 5.1.

http://blog.bigbinary.com/categories/Rails-5
What's different about Amazon vs Walmart? What makes them trustworthy?

If you dig down a bit, you'll find that it's not much.

There's nothing at all special about Silicon Valley companies with respect to ethics.
I am in favor of people not mixing alcohol and guns, yes. But I didn't say I was in favor of marijuana prohibition, so your conclusion does not follow at all from what I said.

> ... a drunk gun user is far, far more dangerous than a high one.

Source? I could argue that, due to pot still being illegal most places, there are more people drunk than there are high. One would expect therefore that there are more gun mishaps involving drunks than people who are high. If you know of any reasonably rigorous studies that get down to rates per capita per episode of getting drunk/high, I'd be interested in a reference.

I think we agree on this, though: If you are going to drink or get high, stay away from guns. If you're going to have guns, stay away from booze and pot...
For what it's worth, I've posted this question in 1Password's support forum, which is frequented by 1Password staff: https://discussions.agilebits.com/discussion/75711/cloudblee...
> You are setting your own personal threshold here's that many people won't agree with.

Lets look at US law. (https://en.wikipedia.org/wiki/Public_figure) A public figure (like Pewpiedie) " A public figure (such as a politician, celebrity, or business leader) cannot base a lawsuit on incorrect harmful statements unless there is proof that the writer or publisher acted with actual malice (knowledge of falsity or reckless disregard for the truth).[1] The burden of proof in defamation actions is higher in the case of a public figure."

The marathoner is not a celebrity nor does she base her livelihood on being a public figure.

From a U.S. libel/slander perspective there is a clear legal distinction - its not my opinion.
Correct, the Fed is a democratic institution.

Anyone who claims otherwise is confused or trying to sell you something.
For those of you unaware, it's illegal to be caught without your green card. That much is not new.

http://immigrationroad.com/blog/do-i-have-to-carry-my-green-...
I find it amusing that Holder and Obama are making this their focus given the extreme gerrymandering in the state of Illinois.
It was not a bug it was not a theft, the DAO worked perfectly as designed. Ethereum failed to work as designed and intented, by its creators it was hacked and funds stolen from the genius hacker.
$10k SNES game package lost in the post has been found
Some features had a bug which lead to uninitialized memory (AKA previous memory contents) in the output of a malformed HTML page was requested.

As one such server handles many sites, everything that the server handled before that request may be compromised. This includes all HTTP-GET/POST data (credentials, direct messages to other users, ...), Headers (API tokens, Login-Cookies) and contents.

So, you have to assume that everything you did on a CF "protected" website in the last months (especially between 2017-02-13 and 2017-02-17) is potentially compromised.
Maybe she's pissed but doesn't want to sue? Lawsuits are mentally and emotionally (and financially) draining.
Harassment of men in sexual ways is less reported or taken less seriously, in part, because the culture of sexism against women reinforces that male victims of the practice are somehow lesser.

Also, plenty of sex-stereotyping that rises to the level of an "ism" is generally positive for men ("big strong man help me move this <heavy object>" or "big virile man you have a beautiful wife"--a doubly sexist trope--and so on).

So while I agree we shouldn't reserve concern only for women, we must also not present the issue as though it is somehow equivalent or equally applied.

The fact is that sexism against women is far and away the majority case. We shouldn't choose to address one concern over the other if they were equivalent, but in this case focusing efforts on combating sexism against women will also work to reduce sexism against men naturally. So it's a win-win to focus on and prioritize combating sexism against women.
I was able to get a few hits from a quick google search that are still in google's webcache.
I'm not sure what you mean by relative ease. This only got looked into after months, due to it raising a stink in the media. The package even made its way to the Atlanta office, presumably where its contents were intended to be sold at auction due to undeliverability.
I have many friends who have worked in Search in the last decade.

You seem to be interpreting "incentives and culture" as "explicit directives or pressure from Ads". There are many ways for culture to grow. Chinese walls can prevent many overt pathways from growing, but they aren't an antidote to the overall role incentives play inside companies.
See https://news.ycombinator.com/item?id=13719437
So time to reset password and logout of all mobile apps to get new authorization tokens?
Beyond Secure cookies, what mitigations are you thinking of? Secure cookies don't count because serving Secure cookies over Flexible SSL is no less secure than serving regular cookies over http://.
Check out Byteball too, its anonymity feature is fantastic.
Then you have to ensure voters have access to ID.

The reason why it's suppression is that republicans have very often done the exact opposite.
How is paging not slow as balls? When you're done changing your data, or your time quantum is up, you are paged and saved. The only difference now is if the system dies for some reason, you come back right where you were paged off.
So just to clarify: some bug makes Cloudflare leak the HTTP Headers into the HTML being served and those HTML pages containing sensitive Info got cached by Google (and others)?
Thank you very kindly.

But I mean, it's not fair in the sense that other people have packages they really care about, but can't get help on.

That and the fact that I probably took someone else's place in the queue to find their lost package :(
Tavis specifically named 1Password, was that wrong?

https://twitter.com/taviso/status/834900838837411840
That's not how Google tells it, if I'm reading this right:

Cloudflare explained that they pushed a change to production that logged malformed pages that were requested, and then sent me the list of URLs to double check.

Many of the logged urls contained query strings from https requests that I don't think they intended to share.

(I'm reading that as "intended to share with Google".)
Perhaps as a follow up to this bug, you can write a temporary rule to log the domain of any http responses with malformed HTML that would have triggered a memory leak. That way you can patch the bug immediately, and observe future traffic to find the domains that were most likely affected by the bug when it was running.

Or is the problem that one domain can trigger the memory leak, and another (unpredictable) domain is the "victim" that has its data dumped from memory?
It is far from over, too! Google Cache still has loads of sensitive information, a link away!

Look at this, click on the downward arrow, "Cached": https://www.google.com/search?q="CF-Host-Origin-IP:"+"author...

(And then, in Google Cache, "view source", search for "authorization".)

(Various combinations of HTTP headers to search for yield more results.)
Interesting. Cloudflare uses a lot of Go, which should hypothetically be memory safe. Was this system in Go? If so, I would be interested in seeing proof of concept code for a vulnerability like this.
> Would you be more comfortable if they offered another way to represent this to the browser? An X-Endpoint-Insecure header or something like that?

Yes, definitely, _Cloudflare_ should own this and push it through. You know they won't though because that would inconvenience their customers.
>This is a corporate crisis for Uber.

More like a PR nightmare.

>Right now, Uber is very clearly following the playbook that historically leads to dead companies

Huh? What playbook is that?
Long been rumoured in the more paranoid corners of the web they are intelligence front/partners.