skysight-inc/HackerNews huggingface dataset:
I posted this on the reddit thread, but I thought it would be interesting to hear feedback here too:

I don't know much about git internals, so forgive me if that is a bad idea, but what does everyone think about it working like this:

If future versions of git were updated to support multiple hash functions with the 'old legacy default' being sha1. In this mode of operation you could add or remove active hashes through a configuration, so that you could perform any integrity checks using possibly more than one hash at the same time (sha1 and sha256). If the performance gets bad, you could turn off the one that you didn't care about.

This way by the time the same problem rolls around with the next hash function being weakened, someone will probably have already added support for various new hash functions. Once old hash functions become outdated you can just remove them from your config like you would remove insecure hash functions from HTTPS configurations or ssh config files.
Also, you could namespace commit hashes with sha1 beging the default:

git checkout sha256:7f83b1657ff1fc53b92dc18148a1d...

git checkout sha512:861844d6704e8573fec34d967e20bcfef3...

Enabling/disabling active hash functions would probably an expensive operation, but you wouldn't be doing it every day so it probably wouldn't be a huge problem.
Great, just another thing I need to delete
Please see my comment with regard to respiratory versus dermal administration. Further almost all research with regards to these agents has been military and thus is not widely shared or known. Even further, the Soviets spent more than 30 years developing 3rd generation nerve agents that would be undetectable by NATO.[1]
[1] https://en.wikipedia.org/wiki/Novichok_agent
Reset everything you don't want to assume is public
Significantly, they've updated that with a section that deserves highlighting here:

"There's been some confusion around wording used TechCrunch's reporting of the DeviantArt and Wix story.

Their article includes: "...Wix will open up DeviantArt’s repository of art and creative community to the Wix platform, giving Wix’s users access to that work to use in their own site building."

Please know that the DeviantArt Submission Policy, Terms of Service and Copyright Policy all remain the same. Deviants continue to own their own works. In the future, there's a possibility Wix might provide opportunities for you to license your work -- only if you want to -- to more people around the world. And, there will be opportunities for Wix users to join DeviantArt and make the community stronger."
Certainly the attempt to kill Castro, of all people, with an exploding cigar should rank higher. Just imagine how that CIA brain storming went:

A: "We're tasked with killing Castro. Again. Any ideas? Anything? Nothing is stupid! Castro! Go!

B: "Cigars"

C: "Boom!"

A: "I see we're in mind-melt here. No wonder the western world trusts us with their lives during these troubling times"

If you insist on actually successful assassinations, and score it on cruelty as well, using Polonium should win. The victim doesn't only die a miserable death. It takes two weeks during which they can still give interviews, know they're going to die, and even knows exactly who did it.
It's not just that this is about taking something away. It's that, rather than give-and-take, it's all take. Gun owners see a ratchet effect. For a very long time, things only went one way. Gun owners lost rights again and again and again. Changes would never go the other way.

A lesson has been learned, and now nobody will give an inch. With today's gun owners putting up a fight, not much happens. They seldom win or lose; we are held to the status quo even though both sides might benefit from a bit of horse trading.

The trust isn't there. Consider registration: Gun owners would support registration except for the fact that history shows that registration is typically the first step toward confiscation, and this was even seen as recently as during the aftermath of hurricane Katrina. The cops lost in court, but the guns were already taken and destroyed. With events like that, and with gun opposition often having the stated goal of ultimately having a ban, the paranoia is justified.

Ownership went way up under Obama. The more people thought he or Clinton might restrict guns, the more guns people bought. There was also the matter of BLM and other riots, and a bit of terrorism here and there, and immigration. People buy guns when they don't feel safe.

Speaking of rhetorical framing devices, what is this "gun violence"? People can be violent, crazy, and evil. Guns are no more violent than knives, baseball bats, pit bulls, 5 irons, cars, hammers, and heroin. You're trying to put the focus on an inanimate object instead of on the guilty.
Hahaha, I built something just like this site once, just to see what would happen.

Wouldn't this be fun? No auth, no rules, no permanent database, just plain text that hangs out for a while (though people could reply to it - ours was more like a forum). The ones with replies jump to the top, everything else slowly falls off into the abyss where it can never be found again.

Literally had people posting ASCII-rendered child pornography within 24 hours
wrt "darcs is slow": the darcs source repo is 59M and took 3:27 for me to clone. Git's repo is 117M and took 6:02 to clone. So per repo size they're pretty similar. Darcs has its issues, but under normal conditions it's not notably slower than git.
They likely took the antidotes that are available for VX right before, chemical-resistant gloves, applied the VX in non-binary form, then washed their hands in bleach and washed it off with water.
By the same logic, the search engine you used to find those sites is also a "protection racket".
Yes, I experience it as well on a daily basis. What I've found really helpful was attending physiotherapy and deep tissue massage sessions along with deep breathing exercises. I do plan to exercise more and maybe take up yoga to see if it is completely healed but otherwise what I mentioned gets me through the day.
Eh, Google doesn't use patent litigation as an offense strategy, but they _do_ pursue leaks. They treat leaks (that is, exfiltrating data while employed) very seriously. Offensive.

https://www.reddit.com/r/google/comments/4emtua/nest_ceo_ton...
Interesting tid-bit from Wikipedia [1]

In fiscal year 2008, the US Department of Defense released a study finding that the U.S. had dumped at least 124 tons of VX into the Atlantic Ocean off the coasts of New York/New Jersey and Florida, between 1969 and 1970. This material consisted of nearly 22,000 M55 rockets, 19 bulk containers holding 1,400 pounds (640 kg) each, and one M23 chemical landmine. [25]

[1] https://en.wikipedia.org/wiki/VX_(nerve_agent)#US_VX_stockpi...
Kernel is trying to hack the human brain but neuroscience has a long way to go
The bug was in cloudflare servers, not code run on customer's own web servers, right?
The stream lasts for some amount of time between 3.5 and 8 seconds. Each sink has a different pressure, most too high, a few too low, one just right. When one hundred people go to use the bathroom in a five minute period, that one functioning (other than turning itself off) sink is certainly not available, so the only means of pressure control is to use multiple faucets simultaneously as pressure reliefs, turning hand washing into a soapy game of whack a mole in which your pants come out sprayed from the knees up. Hope you weren't wearing khakis.

I confess I don't care about the toilets flushing multiple times. With how little water toilets use per flush now, it always takes multiple passes to do the job properly, anyway.
calloc zeroes memory on allocation.
You should probably keep the porn sites on the list, folks have accounts at porn sites too
And so they did:

https://stripe.com/blog/idempotency
No. This is wrong. The far better approach would be "Pharmacologic prophylaxis against nerve agent poisoning." [1]
A prophylaxis agent is NOT an antidote.

[1] https://www.ncbi.nlm.nih.gov/pubmed/15792266
Tarek15333's Profile – Dell Community
Repo access doens't stop people from injecting code into your repository. A pull request actually puts objects into your repo, but under a different ref than heads and tags.

1. Go to github, do a git clone 'repo' --mirror
2. cd to the bare repo.git and do a git show-ref and you will see all the pull requests in that repo. If any of those pull requests contained a duplicate hash, then in theory they would be colliding with your existing objects. But since git falls back to whatever was there first, I think it would be very challenging indeed to subvert a repo. You'd essentially have to find somebody who's forked a repo with the intention of submitting a PR, say, on a long running feature branch.

You could then submit your PR based off hashes in their repo before they do, which would probably mean your colliding object would get preference.

Its pretty far fetched, but the vector is non-zero.
CloudBust
Apple's 2017
I wonder if they used this binary combination: O-Ethyl O-2-diisopropylaminoethyl methylphosphonite and sulfur [0][1]. Not sure if that would be consistent with one being in a spray bottle.

[0] http://emedicine.medscape.com/article/831901-overview

[1] https://en.wikipedia.org/wiki/QL_(chemical)
Another paying customer here. No email communication from CloudFlare. Found out about this on HN.
Yep. And who knows what the affects of that were. But I do not agree with the claim that this is interesting in this context as it seems irrelevant to the discussion.
anti-aircraft fire is random so doesn't specifically target any section of the plane. Therefore, the planes that return to base are a biased sample of the planes that took on damage. See: http://www4.ncsu.edu/~swu6/documents/A_Reprint_Plane_Vulnera...
It's about payoff * probability.

Let's say I (an idiot, but knowledgeable enough) stumble upon a serious vulnerability in Google.

Option 1: I could try to sell that on a darknet market for a decent amount of money. State actors, hacker groups, lots of people want to pay for such things to exploit. But, I might not get paid very much, I might get screwed over, I might go to jail, who the heck knows, I'm playing with a bit of fire here. Could make a good pay day though.

Option 2: Google offers a bug bounty that is known to pay well. It probably offers guidance on how much my exploit is worth. They'll almost certainly pay. And hey, no one gets exploited, which most people feel is a good thing.

Value = payout * probability. If bug bounties pay well, option 2 has a higher value most of the time. But if a company offers t-shirts, or is known for screwing over the discoverer, the perceived value falls quickly.

That's why companies who take security seriously pay good bounties, loudly and publicly.
I guess it might be better to disable the api key...
What is it with these tinpot strongmen? Polonium, mortars, nerve gas... in my day when you wanted someone dead you just shot him.
While we're sharing confusing pathways, here's a visualisation of _some_ of the known metabolic pathways:

http://biochemical-pathways.com/#/map/1
Distraction requires cognitive overhead to remain "skillful" at something, especially if you are expected to create content with those skills.

Some jobs don't require as much cognitive overhead as others. Some jobs require creative skills. If you look closely at labor laws, the distinction is made between exempt employees and non-exempt employees. One type has volition to determine how the job they are to do is to be done, the other has others tell them what job they are to do and how they are to do it. One gets overtime (the ones doing) and one does not (the ones observing).

It's important more people learn to achieve flow and create content by while doing direct observing. Creating content comes "effortlessly" when in the flow because the judgement of the observation doesn't get in the way. The judgement is where all the work is.
Note that for sites like HN, changing your password doesn't expire other sessions. You have to go find every browser with an HN cookie and logout.

(Where I mean some other sites that are not at all HN, but might plausibly exist.)
All those things are true. ;) And the author admits them in the introduction, which you should be able to read from the amazon page. It is still an amazing book. A lot of the reviews clearly expected this to be a way to learn quick tricks to impress their friends. There are lots of books like that, but this isn't one of them, this one goes deep into the theory and long lost methods for doing difficult problems without a computer. For this audience, the difficulty level will be mixed and not necessarily all hard. Anyone who's done some programming will find plenty of material that is both accessible and super interesting.
Well, if stopping people from demanding you solve a problem before pointing it out is so simple, why don't you go do it then?

...

I'm sorry.

In all seriousness though, it's a no-expertise-needed response that's meant to shout down people who are particularly clueless and disconnected. Perhaps we need a substitute response, like calling for an expert on the relevant field to decide whether the person is clueless or not?
The Rock came out when I was 13 so needless to say, I'm a big fan.

I absolutely thought VX Nerve Agent was fictional until today.
Computer Show is back (As an ad for HP printers.)
Writing a monad blog post is obligatory for all who know monads. Here's mine: a monad is a class with a sensible flatMap operation. Hope that helps you understand monads...
In that vein... Sometimes people act like software architecture is about making the difficult choices and tricky decisions.

However, often the biggest value of "architect" is to intelligently defer decisions, keeping options open until new information makes the problem easy and obvious.

Granted, that style of work isn't as glamorous as the "decisive leader who makes the hard choices" narrative.
Thanks! Will keep at it.
I think you'd have much better luck turning the rocket into some kind of a sabot round and spending a week compressing a bunch of air into huge tanks and launching it that way. That's how subs launch ICBMs.

The reason that's not done is that rockets aren't reliable enough yet and nobody wants to bet their billion dollar cargo on the engines starting the first time, every time. If you lose every 100th ICBM it's a bummer, but it doesn't make MAD not happen.

https://www.youtube.com/watch?v=1aPvGGvnAGQ
ppl have learned _nothing_. how much does it take to just STOP TO MITM YOUR OWN SERVICES?
I'm neither OP nor an expert, but I highly recommend rust. It's got a few great features that put it higher on my list than go

1. Zero cost abstractions, namely the ownership system - No GC by default, provides memory safety without the overhead but at the cost of a higher learning curve.

2. Higher-level language features like FP, inheritance, and generics that optimize away to machine code that's equal to or faster than the equivalent C version.

3. Cargo / crates package management. You just include any external library you need in your Config.toml file and cargo takes care of the rest.

4. Best of both worlds type system - about as strongly typed as Haskell but type inference takes care of the tedium of having to annotate the type of every variable like C / java style giving the killer feature of "if it compiles it's basically bug free".
The solution to cab racism was a lie anyway, I've been kicked out of an Uber multiple times because of "I don't go to that neighborhood" (which happens to be primarily black)
A friend of mine accidentally pushed his Heroku or New Relic API key to a toy repo which was public and that information was immediately scraped and used. He was billed a non trivial about which he disputed but cost some time and headache.

Enforce best practices and don't do that even if it's for something trivial and won't have real world consequences.
I don't know what stormfont is but I'd focus on /r/politics. I managed to bump randomly there in what looked liked bots or some organized trolling. In one case I disagreed with some topic regarding Clinton during elections and got this general (vague) insulting comment back. Looking through posters' history noticed they/it? just copy-pasted same thing into their other responses.

FSB ones might be fun too. There is a certain class of grammar mistakes Russians make when writing in English. You could filter by that in addition to other stuff.
AKA shifting the Overton window, foot in the door/door in the face, camel's nose in the tent, etc.
That's not it's claim. He specifically goes down on saying how PDF are different than source files, and why while it is trivial to produce two forged PDF with the same size, it is not with source files.

That being said, his motto is more like "don't freak out", and in the specific git context, I can only agree.
It will likely never be known what compound, but the "spray bottle" tells us that the agent was targeting respiratory system, not dermal. However the use of V-Series agent is a strong indicator of military assassination as almost all research on these chemicals is confined to secret military research. The Russians have admitted to the synthesis of more than 100 more novel V-series nerve agents.[1]https://en.wikipedia.org/wiki/Novichok_agent

While I'm not convinced a binary compound was needed in this case, it is an interesting theory!
Absolutely agreed. I could type better on an iPod touch with its tiny 2010 screen than I can on my 6 inch Android screen (despite my large hands.)

Outside of that, the author nailed it. Especially the phone system, though he could have taken it further in saying that the humans after the recordings is also taught to not serve the user, but rather be an obstruction with just enough "give" to prevent legal action. The exceptions to the seem rare, but I definitely cling to them.
/r/bitcoin was being brigaded by a person (Roger Ver) with a personal vendetta against the moderator of /r/bitcoin, and pays people to do it. The moderation policies are there for anyone to see, and if you feel like you don't have an outlet for your theories there, there are plenty of other outlets for you elsewhere.

What seems to be mostly adolescents continually scream 'censorship' without knowing the meaning of the word. Without that moderation, you get the cesspool funded by Roger Ver.

https://xkcd.com/1357/
I don't think the author groks monads or writing maintainable Haskell.

> The essence of monads is to use abstract types to enclose a mutable state

That's not really true. Many types that are monads are just data. Some trivial examples: List, Maybe, Either, Free. There are several other misunderstandings in the post.

> For one thing, when you use a monad, you get hooked to it: the type constructors of the monad start to appear in the signatures of your function.

Only if you write unmaintainable code. I wrote a full RFC 2616 HTTP server and basically every function lives inside a completely parameterized monad type `m`. All of the dependencies each function needs are injected as arguments (See http://www.haskellforall.com/2012/05/scrap-your-type-classes...).

Also these days (though not when the article was written in 2008), free monad DSLs are becoming a very popular way to abstract away this stuff (See http://degoes.net/articles/modern-fp)
I'll definitely keep that in mind. I'm planning on using a standing desk, does that do any good?
What about Bing, Baidu, Yandex, The Internet Archive, and Common Crawl? What about caches that are surely maintained by the NSA, ФСБ, and 3PLA?
1. rotate passwords, tokens, auth stuff on any and all service you use that may have used CloudFlare in this time period (as of time of writing this list has not been enumerated)

2. hope that no personally-identifiable info or damaging plaintext that can be tied back to you has been exposed, but you will probably never know for sure

3. join class action lawsuits if you so desire and receive the chump change that is your share once they inevitably get settled

4. ponder what it truly means to willingly (or unknowingly) give information to or through a "trusted third-party" who may employ other "trusted third-parties"

5. languish in unsatisfactory answers and outcomes, return to step 2.
The toilets in the US seems to clog more easily than toilets in other parts of the world. I don't understand why America hasn't figured this out.
Go is only memory safe, not data/resource-race safe across threads like rust. That is an important consideration. Go is not as fast as c. Go is not even as fast as rust. Especially in cases that do a lot of memory allocations. Go is easier to write and compiles much faster. That matters. Dropbox used go and then replaced the parts that didn't run fast enough with rust. So you don't have to do either or.
Cheaper? Hell no.

Fossil fuels and nuclear carry their own weight, unlike, say, wind. Here in Finland, there would be no new, not any installations of wind without massive subsidies (we're talking about a guaranteed price more than 2 times the market prices) – just to disrupt the working grid as it is. (Solar isn't really even worth talking about here...)

Coal is dirty, and dirt cheap, but wind is simply too inefficient.
It's unfortunate that the actual content of PCI is an incoherent and actively counterproductive mess.
I think this is the case, and it has been mentioned elsewhere in this thread. When I see a paper published that I am interested in, I have to fit it into the context what I already know about a field, the standards of the the journal its published in, sometimes the origin of the paper (some labs are much less sloppy than others), and other factors.

For a recent personal example, a company published a paper saying that if you give a pre-treat with 2 doses of a particular drug, you can avoid some genetic markers of inflammation that are in the bloodstream and kidneys. Well, I looked at the stimulus and ordered some of my own from a different manufacturer that was easier to obtain and gave it to some mice with and without pretreatment by their compound. Instead of looking at the genes they looked at, I looked at an uptick in a protein expected to be one step removed from the genes they showed a change in. Well I haven't exactly replicated their study, but I've replicated the core points: stimulus with a the same cytokine gives a response in a particular pathway and it either is or isn't mitigated by the drug or class of drugs they showed. Now, my study took 2 days less than theirs, but it worked well enough that I don't need to fret the particular details I did differently from them. If my study didn't work, I could either decide that the study isn't important to me if it didn't work my way or go back a step and try to match their exact reagents and methods.

So yes, I do think the news industry picks up stuff too quickly sometimes, but depending on the outlet, they tend to couch things in appropriate wiggle words (may show, might prove, could lead to, add evidence, etc).
> What monopoly embraces change?

Ones that are well-regulated?[0] Personal experience with this includes the electric utility where I used to live which was proactive in building an open fiber network using their existing conduits, and the effective land-line phone monopoly here which has been at the forefront of wiring everyone with increasingly high-speed fiber when they could just as well have gouged everyone with horrible DSL (there's barely any cable TV here to compete on data).

[0] well as in "in a good way", not "very"
I mean, I don't know your tech background, but think of, like, the different between Web Forms and MVC or something.
Graphs, GraphDBs and JavaScript
What exactly is the security issue on a repository?
The article seems to suggest that became common practice in 1990, before when the parent is talking about. I'm not sure how you can claim it's inaccurate and that the parent should RTFA, it's a verbatim quote from the article isn't it?