skysight-inc/HackerNews huggingface dataset:
The root cause is apparently coming from auto-generated code that causes buffer overrun:

/* generated code */
if ( ++p == pe )
goto _test_eof;

With the help of Google, Yahoo, Bing and others, we found 770 unique URIs that had been cached and which contained leaked memory. Those 770 unique URIs covered 161 unique domains.

The examples in the report shows Uber, okcupid , etc. It would be good to know the full list, to know what password might have been compromised.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...
pick up that can
I'm not so sure you will tell me what I'm missing. An investigation conducted by an independent third party is going to tell me what's missing. Maybe a 'witch hunt' as you call it is a completely necessary and appropriate reaction to the evidence. The fact that Eric Holder has an interest in the success of Uber is a legitimate problem and something we should all be outraged by and attempt to change.

It seems like you may have failed to comprehend the point I was making, but from the other side of the spectrum, which is pretty interesting. My point is that no one knows the truth until we have the evidence. Until then, all we can rationally advocate for is a process that uncovers the evidence in an unbiased manner. The author of the letter seem to be making many conclusions without the support of public evidence. Maybe the author knows certain facts we don't.
Ask HN: What are the online products with attached pledges?
Example: https://posthaven.com has a pledge that they won't be acquired. The inboard.in also has sort-of a pledge done by Maciej in his posts to not take outside money. Anything else where the service is somehow "restricted" by a pledge?
I just checked them too, but they may have just switched over.
Being ultimately required by circumstance to make a substantial payment to settle a lawsuit does not imply that the payer was lying, or even incorrect, in their defense.
Dozing engineers convince Ford to aim for level 4 autonomy by 2021
But it's not illegal for a US citizen to be carrying no form of identification, which makes "you have no papers" kind of a flimsy argument: how do you know the person is not, in fact, a citizen? Especially on a domestic flight, where there was nothing forcing any of the US citizens on the flight to bring travel documents like a passport with them.
Why are they called scientists then?

If you can't write a good modus operandi you are just a fraud.

If you cannot reproduce a well writen modus operandi, you are a fraud.

Thus take the failures divide it by 2 (odds wrong articles are as much as wrong manipulators) and you got a 33% of lousy scientists
there is a pretty frequent drumbeat of stories about drivers being racist/sexist. not to mention that this is a company one of whose VPs threatened to go after a journalist that wrote critically of it. not exactly a social "good", that. I'd love to see stats on how and where Uber is actually "fighting cronyism" as well, instead of just rote ideology.
Where is a reliable list of CF-protected websites so I may identify which ones I have interacted with?
Can we get a CLI for a non-sexual abuse condoning ride-sharing company?
Moving cab drivers from company X to company Y won't change human nature and 'more or less fix... racism'.
Except people only started dying when crackdowns intensified on legal, pharmaceutical, sources and prescribers of opioids.

Crackdowns on "pill mills" and "overprescribing doctors" is what denies people a safe and legal source of pharmaceutical-grade opioids and forces them onto the black market of illegal, overpriced, and fentanyl-contaminated opioids.

Also crackdowns on "over-prescribing" invariably lead to people who experience chronic pain being denied medical access (or being subjected to extremely invasive and degrading treatment to weed out "drug seekers").

The DEA cracking skulls over opioids and investigating doctors is literally the only reason illicit fentanyl even is a thing. I am so very doubtful that skull-cracking and door-kicking will miraculously work after decades of it not working.

Do you want even nastier and even more potent (per unit volume) opioids than fentanyl? Because more prohibition (and yes, investigating and prosecuting doctors is absolutely a component of opioid prohibition) is just gonna give that result.
It is an informed guess based on the fact that the settlement involved acknowledging, as the original YC paperwork said, he was a cofounder who owned 50% of a $1b exit. I haven't seen anyone in a hurry to leak claims that the settlement was for a trivial amount, nor did anyone at the time offer any good reasons for thinking that.
Has anybody else actually received an email from Cloudflare about this? I'm a paying customer, but haven't heard anything from them yet. I hope they don't expect they can leave it at a random blog post that will go by unnoticed?
That honestly doesn't feel too bad. $75 is a pretty low price to pay if you care enough about the custom domain and the branding capability that comes with it.

Perhaps they could tier it so that there's a "vanity" tier and a "branding" tier, that way people who really just want the vanity URL can have it for cheaper.
I'm fine with classical reasoning and uncomputability, and I acknowledge the intuition for classical truth (it got popular for a reason). But pretty much all the useful classical math can be performed all the same in type theory without significant change, therefore the presence of "useful math" is not an argument for or against type theory and classical foundations. Rather, the main thing is that type theory is just better for formalizing things, and while type theory can conveniently embed classical reasoning and talk about various levels of constructivity, classical foundations is not convenient for constructive reasoning. Math with justification in ZFC is useful in practice, but ZFC itself is mostly not. I would like to see eventually many or event most things formalized, and for that we need fundamentals for more than justification.

On the more philosophical side, "philosophers should care about computational complexity", certainly, but it's not like one cannot have gradation in philosophical appeal. Also, it definitely helps to have computation at hand if we want to talk about feasible computation.
Would love to know the legal details behind this scenario and what rights people actually have to be stopped by various types of law enforcement, in such a simple case as just leaving a flight you were just legally on.
The crackdown on OxyContin certainly seems to have made things worse. The OxyContin users were driven to switch to black market heroin. Black market heroin is much more dangerous than OxyContin.
Yes, it was under insured. But do you feel the $1000 insurance we had was not enough insurance for them to locate the box that has my address clearly written on it? :/

If not, then I'm not sure $10000 would have been either.

There were many reasons we couldn't insure for $10000. That wasn't our mistake, though. The mistake was shipping 100 games at once instead of 20 - 25 games at a time.
Someone with influence saying "search again, and search harder" is hardly a procedure.
...and is the second investor today to turn on Uber.
Is the HN headline correct? The bloomberg article says "trade secrets" which are very different from patents, the video also says that this is not primarily a patent case.

edit: 0:48 in the video
I prefer the entire thread: http://marc.info/?t=148786884600001&r=1&w=2
Many browser features (like location API) are gradually being deprecated from plaintext HTTP.
Someone just posted how: https://news.ycombinator.com/item?id=13719366
This is incredibly disturbing. This reminds me of all the random border patrol checkpoints set up in Arizona and California that were hundreds of miles from the border, stopping all the highway traffic. Of course this is where all those famous Checkpoint USA videos come in (https://www.youtube.com/user/CheckpointUSA).

I can only imagine what would happen if they just started stopping everyone on the freeway asking for ID...

And so it begins.
The same thing as far as I see.
Seconded. Too often the headline doesn't tell me what the topic is, let alone whether it's worth reading. The comments will, though, in a hurry.
That's also what I'm interested in. There's a lot of talk about the sites that had the features enabled that allowed the data to escape, but it's the sites that were co-existing with those that were in danger.

In terms of the caching, knowing the broken sites tells you where to look in the caches after the fact, but do you have any idea of who's data was leaked? Presumably 2 consecutive requests to the same malformed page could/would leak different data.
But it's not illegal for a US citizen to be carrying no form of identification

On a commercial flight? Of course it is. This is different from accosting a pedestrian on a street without probable cause.

[EDIT: Note what the regulation actually says:

"If your identity is confirmed, you will be allowed to enter the screening checkpoint." (That does NOT, in itself, include boarding a plane.) Continuing: "You may be subject to additional screening. You will not be allowed to fly if your identity cannot be confirmed, you chose to not provide proper identification or you decline to cooperate with the identity verification process."

So, had there been passengers for which a knowing exception had been made, the investigators would have known that going in. So, it's wrong to say that "it's illegal" to be on a commercial flight in that case, but for the purpose of this specific search, any such granted variances would have had to be on record, and known to the investigators.
I have absolutely no empathy for the management team at Uber. They are the ones that set their company up to be like this. They have known for a long, long time that their company culture was terrible. The only reason they're appearing to do anything now is because it became public.

I absolutely wish this "stress" on them, because they deserve it for letting their company get to this state. And people who are good at heart don't let their company's culture get like that.
Yes, but if it really is advocacy there's no reason to fund it with tax money. I have no interest in having money taken from my paycheck to generate advocacy for political positions contrary to my own.

The CDC lost a lot of respect and public trust as a result of that gun "research". Respect and public trust it's going to need to carry out its actual mission, which is disease control.
also note that it's currently (idk how that will change with the clusterfuck that is REAL ID, though) legal and possible to board a domestic flight without any forms of ID.

https://www.tsa.gov/travel/security-screening/identification
I think you might be confusing logical thinking with the way the legal system works.

I hope an attorney on HN can comment on this. Happy to be wrong but I don't think I am, at least not massively wrong.
I think losing a lawsuit is definitely evidence for claims being false just as winning correlates with telling the truth about not doing wrong things, and if it is true that there is no correlation whatsoever between losing a lawsuit and making false claims, then the legal system has failed utterly (and incidentally, you have given me a great idea for a business model).

Given the adversarial nature of the system and the many past comments on HN to take claims by litigants with very large grains of salt when it came to the Oracle or Facebook or Oculus lawsuits, I'm surprised at the apparent credulity on display. Google will huff and puff just as much as anyone else when it comes to lawsuits.
This has happened to me twice on Canadian flights; the second time I asked one of the police officers what was going on, and they said they were looking for someone whom the flight manifest said was on board the plane. I suppose they could have come onto the plane to pull someone off, but that would have delayed everybody far more than checking ID on the way off.

I wouldn't want this to be a routine fishing expedition, but if there's someone specific they're looking for and they have a reason to think the person in question is on the plane, I really don't see any problem.
So is this why Google asked me to type in my password this afternoon? Cause I was kinda cautious about that, but still did it...
He doesn't listen to experts or research. Instead, he uses common sense.

“So really,” continued Eric, “I should be saying sorry to you, for jumping to the wrong conclusion. Instead of considering all the evidence, I just applied some common sense—otherwise known as prejudice—and came up with a totally wrong answer.”

― Lucy Hawking, George's Secret Key to the Universe

https://www.goodreads.com/work/quotes/857108-george-s-secret...
Oxycontin was suddenly a dollar per milligram when that happened. It seems obvious in hindsight what the result would be.

That's 80 dollars for one 80 milligram pill, which is about 6 hours worth of a high for someone crushing and snorting it. Less time well per dollar spent if they're smoking or injecting them, more if it's being taken orally.

Also, keep in mind that Oxycontin was reformulated to be resistant to crushing, meaning that suddenly a lot of addicts were up shit creek without a paddle when they couldn't snort/smoke/inject or even chew the pill they just bought.

Heroin, on the other hand, is much cheaper, more potent, and more widely available than Oxycontin could ever hope to be.

When you're that deep in the hole of addiction, you start thinking of heroin not as evil, but as a cheap, potent substitute for the prescription pills you've been throwing money away on. It's a fucked up path that too many have walked.
Do you think my address being plainly visible and highly legible right at the top left of each box counted? Because they had it for at least 40+ days just sitting there collecting dust. Even though I had my missing mail search in, just idling and going nowhere.

You're right though, there's the possibility that they don't actually try to deliver the mail properly until right before they are getting ready to auction it.

However, I'm very glad I didn't have to find out whether or not that was the case.
Their old Ragel-based parser was affected. According to their post mortem both the old parser and the new cf-html one are compiled as nginx modules so I'd venture a guess that this is probably C/C++ code since afaik you can't extend nginx through modules written in Go.

> It turned out that the underlying bug that caused the memory leak had been present in our Ragel-based parser for many years but no memory was leaked because of the way the internal NGINX buffers were used. Introducing cf-html subtly changed the buffering which enabled the leakage even though there were no problems in cf-html itself.

https://blog.cloudflare.com/incident-report-on-memory-leak-c...

There's a section in that blog post titled "Root cause of the bug" that goes in further detail.
A small group of people doesn't get to say what is true, and then impose it on everyone else, without being called arrogant, infantilizing of their own users, or simply pushing politics (which is not farfetched given their execs had such strong ties to one party last election). You should have the ability to curate your own feed even if by managing your friends, but the buck stops there.
The second page had a result with an OAuth2 Bearer token in it.
This administration seems intent on creating problems within what have been relatively stable systems.
I don't know whatever Lyft is doing, but I have a super low rating on Lyft than on Uber and I behave the same in both the cases.
From Twitter:

"@taviso their post-mortem indicates this would've been exploitable only 4 days prior to your initial contact. Is that info invalid?" - https://twitter.com/pmoust/status/834916647873961984

"@pmoust Yes, they worded it confusingly. It was exploitable for months, we have the cached data." - https://twitter.com/taviso/status/834918182640996353
$ uber time '123 anywhere st'
No API key found. Please create one using the
instructions at <site> and call 'uber set-key <key>'
$ uber set-key <key> # writes <key> to a file in home dir or a .gitignore location in the repo
Well done!
$ uber time '123 anywhere st' # reads <key> from file, works as you have it
...
The argument was that Trump wasn't anti-pot, not his cohorts. Trump did in fact make public pro-legalisation comments starting in the 90s iirc.
I'm in all favor of the fedgov ignoring marijuana laws if they do the same for gun laws. Unfortunately many who want recreational marijuana legalized want gun control.
It's always been $5,000 - $10,000. It's extremely difficult to assign an exact value because PAL game prices are extremely fluid. One day a game can go for $50, the next day the only copies are all $200 and another copy won't show up for three years.
PII, OAuth data, etc.
You will find the situation far more tolerable if you just forego Android Studio tools entirely and just create GUIs in code.
Click bait title with a touch of fear-mongering from another MSM outlet.

"as they searched for an undocumented immigrant who had received a deportation order to leave the United States."

"The search was conducted at the request of Immigration and Customs Enforcement"

Seems completely reasonable.
The actual study says they are doing a very good job - traditional taxis discriminate vastly more than Uber/Lyft/Flywheel. Look at the tables at the end, it's easy to see a HUGE delta for traditional taxis, compared to relatively small (albeit statistically significant ones) for Uber.

https://faculty.washington.edu/dwhm/wp-content/uploads/2016/...
im just gonna say the fact that they told you to go for a walk and leave your laptop is pretty creepy.
This robotic camera system can replace an entire fashion photography studio
>No where is it written that the path forward must be compromise.

Well, there you are. Just remember that when gun advocates fight you over every inch of political ground.
TSA say that they will allow people to fly without documents:

https://www.tsa.gov/travel/security-screening/identification

(they treat it as an exception, but it is right there on their website)
Our Lawsuit Against Uber and Otto
This sounds to me like an object lesson in "Why you shouldn't write your own HTML parser."

Every time I see a dev trying to parse HTML with a custom solution or regex or anything other than a proven OSS library designed to parse HTML I recoil reflexively. Sure, maybe you don't need a parser to see if that strong tag is properly closed but the alternative is ...
No, you just keep your work computer separate from your whistleblowing/terrorism computer. Productivity and secure+anonymous communications have different needs, and an air-gap between them is pretty much the only way to achieve both.

Luckily, in the modern world, owning a second single-purpose device is really easy: your secure+anonymous communications can be done on a rooted Android phone or a Tails-reformatted Chromebook for ~$150.
I received the letter with the torn off label about six hours after having published that article, and after Kotaku ran the original story.

I was swamped with updates so I didn't get the chance to get to my mailbox sooner in the day.
I believe that's the real issue. Any data from any couldflare site may have been leaked. Those domains allow Google etc to know which pages in their cache may contain leaked info, unfortunately the info itself could be from any request that's travelled through cloudflare's servers.
It doesn't have to be a secret crawler. Just one that wasn't contacted by cloudflare (I didn't see any non-US search providers mentioned).
I can only imagine what would happen if they just started stopping everyone on the freeway asking for ID...

Don't the police set up roadblocks which stop everybody if they're trying to apprehend a fugitive and they think said fugitive is driving in a particular direction?
> "...deal will increase its revenue outlook by around $8 million,..."

So $36 million/$8 million = 4.5 times sales

>"...40 million registered members..."

So less than a buck per registered user
> Would a Bitcoin ETF have those same type of warnings?

No need to speculate. The answer is yes, the COIN ETF has all the appropriate warnings. The risks are quite clearly spelled out in the S-1 as is standard with these sorts of things: https://www.sec.gov/Archives/edgar/data/1579346/000119312517...
So was the election! It was manipulated by Robert Mercer's quantitative investment powerhouse.
I know I could find out by checking DNS, etc., but I'd rather not have to do that for every web site I use... and I'm guessing Cloudflare doesn't publish a list of every domain name that they serve.
Sure we can. What language are you going to use?
I mean, it does if the culture is to turn a blind eye to managers that do this.

Of course, from what I can tell, there's far more than one problem manager involved in all this.
It's evidence, but it's not dispositive, especially in cases like Cruise, where the technicality that determines the outcome might give the defense a 60/40 edge after a court case that will itself cost many millions of dollars.
requesting a page with a specific combination of broken tags, when done through cloudflare, will cause neighboring memory to be dumped into the response. op suspects this is due to a bounds checking bug on a read or copy. one can imagine this can be potentially kilobytes of data in one go.

since anyone can put a broken page behind cloudflare, all you need to do is request your own broken page through cloudflare, and start collecting the random "secure" data that comes back.
You're trolling the thread and taking it in a partisan direction that is guaranteed to end badly.
gcache

http://webcache.googleusercontent.com/search?q=cache:Syesdur...
Do you know if git objects' size header was designed to deal with a possible collision or does it serve another purpose as well?

Just some context - git calculates an object's name by his content in the following way. Say we have a blob that represent a file who's content is 'Here be dragons', then the file name would be:

printf "blob 17\0Here be dragons\!\n" | openssl sha1
# => a54eff8e0fa05c40cca0ab3851be5aa8058f20ea

So the object gets stored in '.git/objects/a5/4eff8e0fa05c40cca0ab3851be5aa8058f20ea'
Everything is leaked, headers are common but full plaintext is leaked in some instances.
Getting kicked off the service for rejecting too many rides/being a jerk to passengers and getting low ratings/etc won't change human nature. It'll just change the nature of people who drive for Uber.
True, but I'd hope that NDEBUG is now widely recognized as being a horrible misfeature.
I don't think that's the case: from my reading of the issue I understood that the urls with query params were sent from CF to Google for clearing from the google cache.
$ host -t NS digitalocean.com

digitalocean.com name server walt.ns.cloudflare.com.

digitalocean.com name server kim.ns.cloudflare.com.
You don't consider Columbia's conflict with the FARC a war?
That is also correct.

This is when I found out the sender had reused my old two boxes, on February 16th:

https://board.byuu.org/viewtopic.php?p=38012#p38012

In hindsight, I should have guessed from the label they sent me that it was paper wrapped. But I still received that letter after having published the lost-package article.
Which means any user who has used any service which uses CloudFlare, right? At least in theory.
Express server with JWT authentication
> Guys, the bio side of things is incredibly complicated

I always find it amusing when physicists talk about how mind-blowing it is that at the quantum level, things aren't entirely predictable. Over in biology, that's the starting point for everything rather than the final frontier - you don't need ridiculously expensive tools to get to the point where you're finding unpredictable stuff.
To expedite this, you may want to email the mods directly via the Contact link in the footer.
Library and command line tool to detect SHA-1 collision in a file