skysight-inc/HackerNews huggingface dataset:
So, because some companies are good at fixing things in a timely manner, we should make the public wait for all vendors? What about problems that are more architectural or design specific that aren't easily fixed, or can't be fixed by the nature of the discovery (math proofs)? What about vulnerabilities that seem fairly benign, but when used in conjunction with other benign vulnerabilities result in something greater (e.g. the ability to influence timing attacks)?

What is a serious problem is subjective. The right amount of time to wait is subjective. In both cases, there will be people that are unhappy with how they were or weren't informed. Instead of some select group of people deciding how important the fix is and when it will be fixed, announcing immediately empowers the public.
I'm not going to argue against your position on security experts' freedom to act because I do not think that any law (or societal taboo) should be made abridging their right to disclose in any way the results of their research. If there is any withholding, I want them to do it of their own accord because they are convinced of the merits of withholding, not because of anything else. So let's set that argument completely aside because there's no disagreement on that front.

Twitter is the equivalent of your local LUG in the scale of things. My mum is not reading Twitter for security news, or even at all. What my mum is doing, is having her stuff update. And my dad's no different.

It might as well be some presentation at DEFCON. I want my vendor to disable functionality that's vulnerable. And I want them to be given a chance to do that. If you feel you are adequately warning users by fully disclosing via a Twitter post then so be it. I think I've made all the arguments I have to make on the topic. If they are insufficient, then that is where I must leave it.

To anyone reading afterwards who may not be sure about my position, I feel positively about how this vulnerability was handled.
Google is one of 11 companies (the platinum level sponsors) that committed $5M to Vector. It's not a Google thing.

The researchers are Vector are free to pursue their own interests, and publish their work like any other academic. Their output is not owned by Google or any of the corporate sponsors.
Thanks for writing this, the post is super helpful! I didn't see anything about the circuit design/iteration process. Would be great to hear what software was used to design the circuit (if any) and how that eventually translates to mass production.
In business you're going to have to make some decisions were you will disagree with each other. Unfortunately this will carry over to your personal relationship. Personal to business disagreements will also happen. If you can, avoid putting extra stress on your marriage. It's hard enough to stay married in general. You can say the same thing for the business. Also, it's nice to remove yourself from the stress of work. It's going to be so much harder when your wife is going thru the same stress.

In short, don't do it. It's not worth the extra stress.
A defective battery is about as far as you can get from chip design.
I see two major possibility.

a] Russians hackers are the biggest problem on the internet causing billions of dollars in loss and are possibly being guided by the Russian state.

b] A narrative is being passed to justify all the negative publicity certain agencies have been getting. (We keep internet safe)

Of course, the story might be something else and the author of the article wanted to make it seem that way. But I think the choke hold on the internet has been getting tighter.

Maybe the power struggle that always existed is now shifting to the virtual world and I'm witnessing that.

Edit: Is HN fimiliar with phrack zine? Noticed today that it went bye bye as well. [0] phrack.org
The Shell Hater's Handbook (2010) [video]
I'm getting pretty worried about all this stuff. When did we lose the ability to discuss things with people who have a different stance?
I've heard many "real" computer scientists say the "C remains central to our computing infrastructure but still lacks a clear and complete semantics" line but I have no idea what they mean.

Can someone explain to me what this means to the academic-CS type? How can something with a parser & lexer not have "clear and complete semantics". If you have a computer language which has defined elements of the syntax how can you not have clearly defined meanings of combinations of the syntax?

Does someone have an example of a piece of C that is not "deterministic" (best word I have for this) to a lexer & parser?
I looked at one of the guilty pleas linked in the article (https://media.scmagazine.com/documents/290/vartanyan_guilty_...), hoping that it might contain more details concerning how he was caught.

Unfortunately, that information is not included. However, the plea has a section about "removal from the united states" (on page 4). I found this highly amusing, considering they went to great lengths to get him to the US in the first place.
So web content, notably blog posts, have gone the way of musical content. That is, the written "albums" no longer sell; the market just wants "singles."

So the blog version of "Stairway to Heaven" will become as rare as Bowie and substantive songs will be as tears in the rain.
I am gonna need sources. This anonymous he said she said shit between the 2 parties and papers is getting absurd.
The claims of partisanship rely on Wikileaks own claims to have information that they aren't releasing.

Assange has said they have information on Trump that they weren't releasing.
SFs malware installers should have served as a warning to all developers.

Unfortunately, there seems to be the same thing happening with GitHub - at least from a layperson's perspective. (same thing meaning that github has extraordinary mindshare in the open source community)

Personally, I'm usually surprised when I encounter an opensource project that is not hosted on github. There are plenty of other options, but github has entirely too much mindshare to be safe. The people currently managing it have proven trustworthy, and git's architecture makes it easier to migrate should that change in the future. But even if it's easy there is a cost in lost supporting data.

Developers need to support other tools so that the big dogs have a reason to play nice through takeovers or changing business climates.

I hope that Gitlab continues to grow. And I'd love to see at least one other VCS grow their footprint. Competition is good. Git and github are not without problems, even if they are the preferred option at the moment. The more competition there is, the more pressure they have to improve.

<ironic I have a strong opinion considering I spent exactly $0 on version control in the last 6 months>
And if you know 5, or 10, or 15 people with this lock, what then? Do you spend time helping them all? What about all the people that aren't your friends? You are helping your friends at their expense because you assume you are the only person to know about this. Is it more ethical to help your friends over the public at large?
Best Fighting Game Ever ?
Do you know that all letters in Iosevka are EXACTLY 1/2 em wide?

For ASIAN users, you can use THIS and preserve your perfect alignment.
Real time bidding. It is used to trade ads with exchanges. When you dont have your own ads from your sales team.
Do you think there's a market for an FPGA-based tutorials?

I think I have a good grasp of stuff necessary for this, but I always felt that it's a really niche business, even within the DYI/open-source community.

If you want to start doing anything, I found it's best to look at the popularity of the board. S3E Starter Kit is by far the best, since most of the people could afford it, and it's nicely support. Any other board: case by case basis.
If you want walled gardens, by all means build walled gardens. But don't imagine that you can prevent people from using other services. And talking about you.
What amazes me is the focus on Russian hackers when the much bigger threat is Chinese ones. They have a larger budget, a bigger incentive to steal American IP, and sense a huge threat from Trump that would justify spying to get a leg up in negotiations.

So why the focus on Russia?
A reminder of foreignness and a warning to avoid being arrested (Korea)
I'd just like to interject for a moment. What you’re referring to as Fuchsia, is in fact, GNU/Fuchsia, or as I’ve recently taken to calling it, GNU plus Fuchsia. Fuchsia is not an operating system unto itself, but rather another free component of a fully functioning GNU system made useful by the GNU corelibs, shell utilities and vital system components comprising a full OS as defined by POSIX.

Many computer users run a modified version of the GNU system every day, without realizing it. Through a peculiar turn of events, the version of GNU which is widely used today is often called “Fuchsia”, and many of its users are not aware that it is basically the GNU system, developed by the GNU Project. There really is a Fuchsia, and these people are using it, but it is just a part of the system they use.
Well it's good that I never said you were then.

What you did was try to break out a cheap rhetorical trick to try to paint anyone who expresses a concern about copyleft, knowing you could always back out with "well, I never said that..."

And of course in your most recent comment you did it once again, sneaking in a back-door assumption that people who would have a problem with copyleft are "fucking terrible human beings".

You should stop doing that. Because you aren't "a fucking terrible human being", right?

Meanwhile, I'm pretty sure I've had this exact debate on HN before, but:

We went any number of rounds of this with Django a while back, precisely because there's such a large gray area. I still don't honestly know whether someone could claim we've accidentally triggered the GPL by providing a database backend module in Django that can talk to GPL'd MySQL drivers. We've just navigated as carefully as we can, there.

And no, it is not some sort of simple, settled, well-understood thing, so maybe you could stop presenting it as if it is? That'd be great.
If I'm having a rational discussion with someone who disagrees with me then I'm automatically a troll? I tend to feel the trolls are the hordes of people calling for me to be executed or using nothing but insults instead of contributing meaningfully.

Everyone is free to their own worldview, shutting down discussions with "I hope you get raped in hell n*" isn't what I call a different worldview, it's what I call an arsehole.
It might seem standard among some circles. And i have learnt them on the floor. But could never find a book or blog which describes some more examples. I was curious if others had any ideas to share.
Do you mean the Lightning add-on[0] that is now bundled with Thunderbird [1]? I don't know if it's available as a stand-alone app. I use Thunderbird but not Lightning.

[0]https://addons.mozilla.org/thunderbird/addon/lightning/

[1]https://support.mozilla.org/t5/Calendar/Integration-into-Thu...
These two are not mutually exclusive.
A strong reason for why I use Xubuntu instead.
Not to mention its a giant monopoly that has very little regulation that matters when you have no choice but to use them. Theres only a few outcomes this will play out to in my mind. Either things will get so bad theyll be split up and/or regulated as a public utility and such, or there will be some sort of big revolution / revolt / underground market (think tor, mesh networks, etc.), OR the populace will be made more docile than they are now big brother style until one of the first two options eventually comes to pass in the wheel of life.
Example of undefined behavior: What arguments will f be called with?

int i = 0;
f(i++, i++);

More examples here: https://www.cl.cam.ac.uk/teaching/1415/CandC++/lecture10.pdf
Why do you dislike ligatures in your coding font? Just curious.
Phrack.org seized by FBI
Yeah I feel like it's turning AI into a bit of a joke amongst other theoretical computer scientists.
Enemy of my enemy leads to very odd coalitions. E.g. liberals + intelligence community against WH vs liberals against intelligence community post-9/11 (and before). I think this covers that type of phenomenon [0]. "Russian hacker" is just the new nightmare of the mode.

Also, Xi Jinping is visiting Mar a Lago soon. Would probably strain talks to play that move before the meet.

[0] https://libcom.org/library/when-insurrections-die
Yes! Fixed. Sorry, we usually don't miss those for that long.
There's a bunch in Hacker's Delight.

One that comes to mind is XOR-swap. It's cute, but it's likely slower than using a temp var.

Some of the integer population count algos (1's counting) are clever.

Also, original Doom source has some neat tricks.
Bandwidth: How First Nations Kids Built Their Own Internet Infrastructure
We are part of a team consisting of highly efficient developers and
hackers.We carry out services like,upgrade school grades, Get passwords
for all social networks like Facebook,Instagram,Twitter,Whats
app,Line,Skype Hack, We also delete unwanted online pictures and videos
on any website,clear criminal records,hack bank accounts for transfers
and credit card top ups,application hacking.We do custom software and
web development in php, java, asp.net etc.We have 100% records from our
client as well as highest repeat hire rate,and a refund policy we work
with,our work speak for ourselves, we provide a perfect software
solution to all clients.We believe in mutual growing with client and
hence we work as a technology partner and consultant for our clients.
Contact us .............raphaelnunezhacks@gmail.com
text +13238351741
Do you have any source on India not having top research talent? From my understanding India has good amount of research and tech talent but it suffers a lot from brain drain to US universities. Especially students graduating from Indian institute of technology, national institute of technology + many more. In fact if you look into student (masters, phd) profiles of top US engineering schools like MIT, CMU, Stanford etc. most of the Indian students there have graduate degress from those Indian schools and they are in huge numbers. (who eventually end up at these companies or starting their own)

One of the main reasons for lack of research in India is lack of funding. Its nothing compared to US universities. But that does not imply it lacks talent. In fact primality test in polynomial time was founded by computer scientists at IIT - https://en.wikipedia.org/wiki/AKS_primality_test.
Not the parent, but I’ve had an issue where the fi ligature occupies just one character width, which looks very wrong with an otherwise monospace font. If the ligature is done right (resulting glyph is double-width), then I would probably like it.
Yah sure - hit me up jh@<ourwebsitehere.com> (where ourwebsiteher is discordapp)
Right. Even at the top of the shit pile you're still standing in shit.
No, it's not. Not wanting to recruit MBAs doesn't cause a lack of diversity in hires. It's possible that a preference for hiring MBAs, does, though.
The ability to have a rational discussion comes from a place of [typically white, male] privilege, though. If you are being sexually harassed, racially discriminated against, or are otherwise in a psychologically unsafe position, you're not going to be in a position to "back up your opinion with facts" or "explain why you feel the way you do" or even listen to someone who calmly, rationally explains that "he's never made me feel uncomfortable", or "why didn't you report [being raped to the police] / [being discriminated against to HR]" or "I don't see race".
This is great, this comment deserves to be at the top. Let's not criticize the original article, and instead celebrate that its publication resulted in a crowdsourced solution. I love to see the community coming together to provide knowledge to us all. :)
I don't see this as a problem. If I had tons of money and knew someone (by any connection) who was doing amazing work I would definitely chip in.
Perhaps, but if the alternative is either incredible fear of the technology, or the technology potentially killing humanity, then "making great strides in a select few fields" seems quite good.
3 Ways Microsoft Plans to Make You Rich
> Dynamic Analysis. Run the executable and watch the contents of memory as the program unpacks itself

Of course nowadays the makers of fine malware detect whether they are running inside a sandbox, and won't activate.
VPN can sell your traffic data too
Oh yeah that's another use of Hyper-V, somewhat similar to ARM TrustZone. It's used to implement "Credential Guard".
Yes, I also wonder why? "Russian hackers" is popular catch phrase. Reinforces that idea that this is more play on the same notion.

But on the other hand, maybe they were always a bigger problem and out of reach, and the agencies finally have an excuse to nab some while there is all the hype going on.
My sincerest apologies for that unthinking statement - losing statehood is always much, much more than simply the words 'losing statehood' - it almost inevitably includes war, strife and famine. And certainly every one of Poland's six million or more lost souls, each of those dislocated, wounded and in all ways harmed by war, was a loss to someone's mother, brothers, father, sisters and friends. Were we able to find these lost souls and somehow bring them back we would certainly do so. But words and acts fail: we are but human, not gods, and so Poland's loss, as well as the losses of all involved, will always weigh upon us heavily. What was lost was incalculable and irreplaceable. Who knows what we could have been had only it not happened?
Here is your disclosure: Everything you do on the Internet is recorded and sold.

Satisfied?
It was recently put to me like this (I'm not sure I agree with the analysis completely, but I think there's some truth to it, at least in the perceptions of the two countries):

While the Chinese are certainly sometimes nefarious in their online activities, their goal, as you mentioned, seems to usually be gaining IP. The perception is that Russian hacking is usually more (a) directed at stealing directly from the populace (credit card phishing, etc), or (b) directed towards political ends (see recent American politics for examples). These effects are both more visible to the general public and politically damaging. Thus they receive more focus on the political stage.

To me, (b) seems like the real differentiating factor.
I am currently waiting for my MATRIX Voice to arrive.

https://www.indiegogo.com/projects/matrix-voice-open-source-...

I have a Spartan 3AN dev board, another Spartan6 board, and an Arty. I was using Xilinx ISE free version to develop for the other boards until I bought the Arty. It came with a one year license for Vivado. I did not know that activating the Vivado license locked me in to developing only for Arty. ISE will no longer synthesize for any other target. I strongly dislike the closed nature of their software licensing.

I am retired but the last 10 years I worked writing VHDL. I can kind of read Verilog and understand what it does but do not know it well enough to write in it. The systems I worked on were for oil well logging. My circuits went down a 16,800 ft. hole where it was 350° F and the pressure was over 7000 PSI. Production quantities were typically less than 100. We used no bigger an FPGA than was needed to keep power at a minimum as there was no way to dissipate heat. Also the circuit boards were quite small since they needed to fit into a housing less than 2" in diameter. Frequent design changes were needed but all ran on the same boards.

I am currently working on a processor design that I call NISC. The set of all opcodes is the null set. It's a single instruction machine that does a move instruction with two operands, Source Address and Destination Address. I have considered putting the specifications and design on the internet as open source but am not sure where I should put it. Would anybody be interested in seeing it and where do you think I should put it?
> AHAHAHAHAHAHAHAHAHAHAHAHAHA!
Java getting practical considerations right. Oh, I so needed a good laugh.

Please don't post like this here. It degrades the community, takes threads into flamewars, and discredits what you're arguing for.

We detached this subthread from https://news.ycombinator.com/item?id=14008093.
I would suggest https://raft.github.io/

That has a nice, interactive visualization along with links to the paper itself, implementations, and talks about raft.
I don't know what it is about this font but it doesn't feel monospaced.

Using this font I constantly keep second guessing myself as to where I've placed whitespace. Maybe I just need to use it more, I don't know.
> Something to allow to apply different versions of php to different nginx server blocks

Since Php v5.6 the Upstream (Debian) packages of PHP support side-by-side install.

Install the versions you want, and then use a per-php-version apache config file you include in the vhosts you want it for:

Enable proxy_fcgi:

a2enmod proxy_fcgi

php5.6.conf:

AddHandler proxy:unix:/run/php/php5.6-fpm.sock|fcgi://localhost;php5.6 .php

php7.0.conf:

AddHandler proxy:unix:/run/php/php7.0-fpm.sock|fcgi://localhost;php7.0 .php

Edit: brain-shart. You want nginx. Similar concept - point to the correct FastCGI socket in each block.

So each block would be then:

5.6:

fastcgi_pass unix:/var/run/php/php5.6-fpm.sock;

7.0:

fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;

Etc.
The article is somewhat odd in that it implies this is a new thing, or even recent.

At least one of the stories and featured photos (guy with the yellow car) is of a Russian hacker the US picked up in July of 2014.

There's a news story from 2015, but it mentions the guy was picked up from the Maldives a year earlier.

http://www.businessinsider.com/notorious-russian-hacker-kidn...
nice work. a large family like this is very well suited to be a variable font[1] -- even the slabs could be an axis.

1. https://blog.typekit.com/2016/09/14/variable-fonts-a-new-kin...
I have seen many couples break up after co-founding a failed startup. Granted, this is at the college/university level, and it sounds like you have a bit more experience under your belt.

But do make sure that you both accept the risk that the startup could result in your divorce and in business failure.
This is great. I've got some relatives that love this garbage and there's things in here I hadn't heard about. I can picture the author being totally surrounded by this shit :)
- FLAVOR: Ubuntu Core

- HEADLINE: Modern V8

- DESCRIPTION: Node.js, PLV8, and Chrome all require a modern version on V8. Ubuntu ships with 3.14, which is 4 years old, and does not support modern Javascript. Bringing this to something modern (5.8+) would be a huge win.

- ROLE/AFFILIATION: maintainer of PLV8
Yes, I'd find that far more interesting than conspiracy theories and moralizing.
To be honest, Iosevka is not suitable for the current VF specification, because that it does not support changing glyph topology while changing parameters.
I'd assume it would be

f(1, 0);

Because function arguments are pushed in reverse order in C and funnily enough, GCC actually does that even though that's crazy. But clang catches it as an "unsequenced modification".

I don't think that's a good example. The C standards make no guarantees about unsequenced modifications so relying on them is the programmer not using C, it's the programmer using a language derivative implemented by their compiler.

Why do people say "C remains central to our computing infrastructure but still lacks a clear and complete semantics" when the standards are very clear about what it allows? If you use something it doesn't allow you can't blame the spec for that.
There's a book called "Dreaming in Code" which actually details how hard this problem was for a real project that ultimately failed. Good book for anyone who wants to read an account of a writer who followed an entire software team through the lifecycle of a product.