skysight-inc/HackerNews huggingface dataset:
Correction: ALL production OS and kernels are affected.

"udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic [...]"

There is barely any OS that are >= 4.5 (only CoreOS on the top of my head).
Almost. I should point out that I do subscribe to the Boston Globe since that's where I live. The WaPo would be in addition- for that I would only want to pay a delta. This is a new revenue channel for them, not taking away the old one.
It's all there in the litigation if you care to look. You could start at e.g. https://www.propublica.org/article/2016-election-lawsuit-tra... and get to e.g. http://www.politico.com/f/?id=00000156-3775-d2b4-a3d7-b7fdaa...

"After years of preclearance and expansion of voting access,
by 2013 African American registration and turnout rates had
finally reached near-parity with white registration and turnout
rates. African Americans were poised to act as a major
electoral force. But, on the day after the Supreme Court issued
Shelby County v. Holder, 133 S. Ct. 2612
(2013), eliminating
preclearance obligations, a leader of the party that newly
dominated the legislature (and the party that rarely enjoyed
African American support) announced an intention to enact what
he characterized as
an “omnibus”
election
law. Before enacting
that law, the legislature requested data on the use, by race, of
a number of voting practices. Upon receipt of the race data
,
the General Assembly enacted legislation that restricted
voting
and registration in five different ways, all of which
disproportionately affected African Americans.

In response to claims that intentional racial
discrimination animated its action, the State offered only
meager
justifications. Although the new provisions target
African Americans with almost surgical precision, they
constitute inapt remedies for the problems assertedly justifying
them and, in fact, impose cures for problems that did not exist. "
Typically, a better approach is branch and bound search using a variant of R-tree or Octtree, especially with axis aligned bounding boxes or circles. Ray casting does not scale to many points while more advanced space partitioning does.

GeoHashing is a kind of binning technique.

Then there are manual volume hierarchies and partitioning based on similarity. Each solves a different problem.
Loss of coral reefs caused by rising sea temperatures could cost $1tn globally
Police Horse Chase: Superhero
> You must be new here!

I'm trying to work out if you're being serious.

user: ColinWright
created: 2676 days ago
karma: 83694

From https://news.ycombinator.com/leaders we have:

1.	tptacek
2.	jacquesm
3.	patio11
4.	ColinWright
5.	danso

So no, I'm not new here.

And yes, I'm aware of the problems you cite, and I'm explicitly suggesting a measure that could be taken to help fix what I see, and you acknowledge, is an irritation.
Do you ever take a step back and wonder how such a long list of: "academia, entertainment, high finance, big tech, wealthy industrialists, Democrats, journalists and media, and the unelected deep state" could possibly be unified?
> If you don't want to pay just don't watch the BBC TV channels.

You need a license to watch other broadcast channels like ITV C4 (not on catchup though) etc. I don't have one because I don't like the BBC's politics editorial positions.
Clearly it's a go-back-to-bed kind of day.
I would advise against Google Authenticator as a backup as it really defeats the point of a hardware token.

Google Authenticator stores the TOTP secret in plaintext on your device where the potential exists for it to be stolen. An adversary that exploits your phone can generate TOTP tokens as they like and ignore the fact you have a hardware token. If you are going to use Google Authenticator it is your weakest link and a security token buys you no added security, only ease of use.

The typical goal of a security token is to be able to assert: "No one can log into my account without this physical device or an offline backup token from my safe"

To acheive this consider a device with built-in TOTP support in addition to U2F. All current Yubikeys fit the bill here as as well as some Nitrokey models. Desktop or Android users can use the either USB or NFC devices but it is worth noting that iOS lacks support for either which means you would need a desktop or Android device to fetch TOTP tokens for an iPhone.

You can use the open source "Yubico Authenticator" apps to store your TOTP secrets in your key alongside your U2F secret. Now both methods use the same hardware and your phone/computer only get handed OTP codes from the key if present, but can't generate them itself.

Added bonus is now you can now use security token backed login even on the majority of sites/browsers today that lack U2F support.

Extra bonus is these keys can be used for ssh without any server changes. Security token all the things :)
Building a Bank with Go [video]
Boobank (http://weboob.org/applications/boobank) is such a collection of scripts (althought mostly centered on french banks).
After his announcement, Vitaly answered to the team:
https://groups.google.com/d/msg/phantomjs-dev/S-mEBwuSgKQ/PQ...

> >Is there interest on your side in adopting Chromium as a runtime? There's some existing documentation [2] around the API and embedding, but admittedly, this would be some work.

> We are interested. But I am afraid not in the current state. Currently, PhantomJS heavily relies on Qt and QtWebKit. It's not that easy to adopt Chrome as a new runtime.

> But I think we could implement PhantomJS as a completely new (with the same API) project that will use Chrome - Phantomium!
Naive question here. What makes headless mode so difficult?
>Obviously the safety of passengers can not be ensured anymore.

Let's not be dramatic. Actual airline safety issues that lead to horrific deaths are not being discussed here. This is just piss poor customer service that could be encountered on any property (e.g. hotels that have overbooked, etc).
Lol, love commits that reference voodoo... https://github.com/nodejs/node/commit/d4d6986551
This is just golden...

"placing him in the middle seat between a married couple who were in the midst of a nasty fight and refused to be seated next to each other."

Crews don't even try to move them to be seated next to each others.
Fake accounts to collect intelligence? That's OK?
Looks like it's fixed (at least mostly) in bash 4.3?
Research by doctors such as Bart Roep at the City of Hope is the holy grail. Sensors like this already exists like the Freestyle Libre by Abbott.
As well, most bank OFX/CSV exports I've dealt with are truncated in some ways (e.g. truncated labels), which make it harder to really leverage sometimes.
Governments do fund some things directly – most commonly grants to specific interests – but one other area which helps is allowing staff to work on open-source projects. At least in the United States civil servants’ work is generally considered public domain so we don't have to deal with the IP concerns which many companies still obsess over, which is nice.

If you poke around https://government.github.com/community you'll find a lot of government created projects but checking those organizations/ contributors will often turn up a ton of forks of popular tools. One common thing is improving security defaults or accessibility, which are tedious but mandatory for government.

If you value this, make sure to let your elected representatives know: I'm sure they hear from the major contractors regularly.
On the other hand, the BBC were running this story yesterday about the risks of a low dairy diet for young people:

http://www.bbc.co.uk/news/health-39557687
Suppress generated JavaScript on GitHub diffs
My favorite use is automated browser testing. Examples:

- in Ruby, poltergeist (https://github.com/teampoltergeist/poltergeist)

- in Elixir, hound (https://github.com/HashNuke/hound)
Could be the reason.
Fantastic, this is what I wanted to be doing with the rest of my day.

EDIT: https://people.canonical.com/~ubuntu-security/cve/2016/CVE-2...

Looks like Ubuntu already patched it for all supported versions so I'm good since I'm patched up to date on everything.

I wonder how much stuff out there isn't though.
If it complicates your life, it's a bad device. My Echo does not do that, but that's probably because I only have a limited number of things I really want it to do, and it does them just fine.
NVIDIA will prevent you to buy gaming hardware and push you into buying the 10x more expensive ones.

There are 2 NVIDIA drivers. It turns out pinned memory transfers are 2x faster with the Tesla driver (vs the Geforce driver). This can matter a lot for some workloads. For some reason you can't use the faster driver with cheap consumer cards.

So, in my view NVIDIA is dumbing down performance for OpenCL and CUDA alike, and also slowing down the unavoidable OpenCL adoption.
http://www.foxnews.com/health/2014/04/15/too-much-animal-pro...
That's great news! Let's tell the organic brands so they can stop spending money on advertising.
And while people wait, you can already do a 'poor mans' headless Firefox thanks to SlimerJS and xvfb.

Phantomjs is less resource heavy if you're constantly spooling up and down lots of instances but I prefer SlimerJS w/ Firefox since it lets you keep up to date with a modern version of Firefox (rather than relying on sporadic QTWebkit updates from Phantomjs).

If you're using Casperjs, SlimerJS is virtually a drop in replacement for Phantomjs (though I worry about how long/well Casperjs will continue to be maintained).
It has someting to do with FAA regulations.

Basically, they own you when you step on that plane.
Has someone an idea why Twilio stocks are going "sideways" for months?
I use https://github.com/bfirsh/needle/blob/master/README.md for automated UI regression testing. Using a headless browser means your test suite can run faster and with fewer dependencies.
@PhasmaFelis: "Probably the part about ICBMs being controlled by civilians, which is definitely not true."

You contradicted me so I am going to vote you down :(

reply
User Testing Guide with Usersnap
It is still in beta version, but the final version will soon be released.

I don't think "last September" counts as "soon" anymore. :)
Guts to make the wrong technology choice
What is Clean Code?
How many people in the world have studied crypto? Radio and EE are both areas studied by a magnitude greater number of people at a serious level. Does crypto take a higher level of cognitive overhead to enter or do people only think it does? Is there a cryto structure similar to amateur radio?
Collaboration between Heads and Purism
I think this class of app really depends on a good workflow for updating the expected results so people don't fall out of the habit of testing because most of the changes are intentional.
They state on their website that the "code features" which by the way look very conventional [0] are inaccessible to clay. As far as I can tell, sticking in a separate string of clay under each ridge would work just fine, then its just a matter of stitching it together within the standard design.

Funny how the article on The Economist states:
"A 3D-printed key that can’t be copied"
While their own claim is:
"A 3D-printed key that can’t be copied by the masses"

[0] https://youtu.be/RSVzsWMfTtc?t=52s
Dupe: https://news.ycombinator.com/item?id=14105718
I had to re-check (twice) if the news in the satire column. I literally cannot believe you would kick someone paying your company $1000
This is innecessarily dangerous. It only would take a stroke of wind or an accidental kick to kill the biker. If this guy accept some ideas; such bike should be designed as a tumbler doll and add a seat belt for the biker. If you can mechanically raise the heavy piece to balance (lower) the upper part could even have a supercool mechanism to dismount or save low obstacles.
TL;DW: You can tap in your password, in morse perhaps? I watched only last few seconds of the boring video in Youtube.

- I am pretty sure that experienced morse operator can very easily learn your taps just by watching and listening.
Italian Antitrust fines TicketOne and others for 1.7m euro
We don't mind stuff that seems obvious because it may not be to others. Keyboard selection in the URL bar is supposed to work, for example.
Airlines seem pretty regulated already. Maybe there's another word for what you want to happen?
5 IoT Applications That Will Change the Face of Healthcare
Aplicativos que te ajudam a se exercitar e perder peso
Does it mean that virtually all (old) DNS servers could be potentially hacked now? If I don't run anything UDP based, am I safe?
I use RescueTime. Productive time is about 90% each month.

The reality is that 100% of my time, if meetings are included, is productive (excluding minimal breaks).

I feel sorry for the people trying to run businesses with all of these employees not working.

I'm a QA engineer. The most experienced QA engineer on a 3-person team (the other two have either more experience with testing but less with development, or vice-versa). I have waaaaay too much to do to get away with not working.

I do empathise with those for whom maintaining a high level of productivity is impossible because of how demanding their work is. I'm fortunate that I have so many different tasks to perform that if I don't have the energy to concentrate on something demanding, I can switch to something fairly basic.

I'm also fortunate in that, for me, problem solving activities are almost always energising. So if I feel like I'm getting burnt out I can dive into one of the tricky but non-urgent problems I hadn't got around to yet.
Done and merge request for 2.0 sent upstream.
6A Cheap Bladeless Fan
Two kinds of speed (or why I still like dynamically typed languages)
Travelling in the US or with US airlines is not looking very good right now. Not just the United incident(s) but also TSA, Trump travel restrictions, flights constantly overbooked, massively late etc.

I wonder if it will start impacting traveller and tourism numbers at some point. I think anyone who doesn't really need to be in the US and/or is planning travelling with kids is likely to have some second thoughts at this point.

Recently Canada's girl guides cancelled all trips to the US: http://www.telegraph.co.uk/news/2017/03/14/canadian-girl-gui....

I wonder if this is a first step of a large trend yet to develop.
I have managed to watch about half of that program. I can understand why they did not broadcast it.

Really, really good, but more scary than anything I have ever seen in my life. So-called "Horror movies" are fairly tame in comparison.
I'm appalled by how this frontal assault on human dignity is shielded by law. What many of us learned this week is that it seems to be perfectly legal to bump off poorer or less privileged people specifically from a plane.

This is boat allocation on Titanic all over again.
Huh? I'm running Arch Linux on kernel 4.8 (latest in repos is 4.10). Ubuntu 16.10 has kernel 4.8.
I have not used United in many years after a major cluster f.. on a trip. Things like this were supposed to happen sooner or later. This airline hast a total "FU" attitude regarding customers. It is the only airline that I insist of not using.

Regarding the boarding, this was posted by a lawyer:

[Edit: This is about the recent incident, not this HN post]

1. First of all, it’s airline spin to call this an overbooking. The statutory provision granting them the ability to deny boarding is about “OVERSELLING”, which is specifically defined as booking more reserved confirmed seats than there are available. This is not what happened. They did not overbook the flight; they had a fully booked flight, and not only did everyone already have a reserved confirmed seat, they were all sitting in them. The law allowing them to deny boarding in the event of an oversale does not apply.

2. Even if it did apply, the law is unambiguously clear that airlines have to give preference to everyone with reserved confirmed seats when choosing to involuntarily deny boarding. They have to always choose the solution that will affect the least amount of reserved confirmed seats. This rule is straightforward, and United makes very clear in their own contract of carriage that employees of their own or of other carriers may be denied boarding without compensation because they do not have reserved confirmed seats. On its face, it’s clear that what they did was illegal– they gave preference to their employees over people who had reserved confirmed seats, in violation of 14 CFR 250.2a.

3. Furthermore, even if you try and twist this into a legal application of 250.2a and say that United had the right to deny him boarding in the event of an overbooking; they did NOT have the right to kick him off the plane. Their contract of carriage highlights there is a complete difference in rights after you’ve boarded and sat on the plane, and Rule 21 goes over the specific scenarios where you could get kicked off. NONE of them apply here. He did absolutely nothing wrong and shouldn’t have been targeted. He’s going to leave with a hefty settlement after this fiasco.
Roundup usage has been so ubiquitous for decades now so this is very worrying. I am much more concerned with Monsanto's GM food patents/diminishing biodiversity/pollution threat than this. I have no issue with GM science btw. NONE. (re:'GMO safety /mutant food nonsense') I wonder if this is a sly segway from Monsanto. Given a choice between Monsanto Roundup everywhere and Monsanto GM everywhere I'll take the former.
> I worried when Google bought DoubleClick many years back if Google would become as bad as DoubleClick.

Me too, but not so much about the content ("ads is ads", I used to think), but about privacy and the relentless tracking that DoubleClick was doing. And oooh boy, did that omen ever come true.

Another thing was the moment when I realized the implications of having a giant Internet-wide ad-network implemented in the form of injected third-party javascript. I mean, at first it seemed real clever. This wasn't a big thing back then, just yet. Originally ads were just clickable image links with an affiliate code in the GET parameter and http-referer tracking (which already provides an advertiser way more info about their audience then a printed ad in a magazine would, so yes that is more than sufficient for advertisers who honestly want to advertise instead of spying on people).

It's a miracle that over the existence of AdSense, nobody ever managed to XSS the entire Internet. Even if that can be attributed to the AdSense team awareness of their unique position of responsibility and engineering quality control or something; We still dodged a bullet with that one, because it just so happens that it was the Google that came into control of the largest XSS vector in history. But having quality control and a culture of responsibility didn't cause becoming the largest and gaining control (it just means they got to keep it, because it hasn't gone horribly wrong--for which we are lucky). A while back I read a comment on HN arguing (though I'm not sure if they realized) that whether something is a "good product" depends more on how well it is marketed (and therefore finds its way to people that can use it) than it depends on the quality of the product. That's horrible, but like too many horrible things, also true in some sense. So it just so happened that the ad-network that was marketed best and became one of the largest and most successful, also happened to be one that was of sufficient quality to not break the Internet.
> even a life-saving sensor wouldn't be able to make a several-hundred-dollar gimmick worth buying

What a curious set of priorities.
Also, we know now that it's illegal to remove customers after boarding, unless they do something illegal. Saying no isn't illegal.
This book helped me a lot when I was severely depressed. I too had irrational thoughts of dying and running away, and the practical exercises in the book helped me to get my thoughts moving in a better direction so I could feel better. I remember going for a walk (exercise is supposed to help, right?) and trying to think of something I like. I drew a blank for like 10 minutes - that's how bad off I was. I finally decided I liked my car - hey don't judge, it was something. I know well that feeling of trying to make yourself feel better and being unable to. For normal ups and downs in life that approach works. Not for depression.

When I was most severely depressed, it felt like I had fallen into a pit of soft, soft dirt. The more I tried to claw my way out of it, the more I would only dig a deeper hole. By learning to change my thought patterns, it was like having the hole I was in shrink until I could just step out. It is hard for someone who hasn't been there to understand. Those who suffer try so hard, but it just doesn't work.

Today, I am fully recovered and have been for years. There is hope that people can be completely healed.
Arch is on 4.10.9
No, it's not legal.

Edit: See lawyer quote from tiatia.
United CEO Oscar Munoz defends employees in letter
Red Hat (RHEL 5/6/7) not affected: https://access.redhat.com/security/cve/CVE-2016-10229

Highest impact is on Android: https://source.android.com/security/bulletin/2017-04-01
btw. I don't talk about the forced TLS stuff.
besides I'm working in a company who sells boxes for intranet's (where deploying TLS for domains is not always easy, lack of proper DNS or other things, etc...)

The spec has just a lot of edge cases especially when handling state/what exactly is a specification violation.
Especially handling clients who opened a connection and now are in closing state, can be really really tricky to handle.
On the implementation side the Statefulness adds a lot of overhead, that HTTP/1.1 did not had (besides other flaws) I think HTTP/2 was a little bit rushed, but I guess HTTP/3 will clean up some stuff.
I don't work in the IoT department but they use our chips and I can guarantee you that if you make security a legal requirement my company will not hire more engineers, they will hire more lawyers.
Yes but arch is not a serious production/server os. Although some of you may do it.

Most servers/business run on (not the latest) redhat/suse/debian/ubuntu and derivates. They dont have kernel versions that recent.
Why can't I favorite this comment.

Of course, giving mental health advice on the internet can be dangerous. This is of course not a magic recipe (advertising it as such may lead to people thinking "if this doesn't work for me, I'm broken") but I believe for some people your advice might be very helpful.

What you describe is the state of mind I had going out of a long lasting (1y+) depressive phase: "Fuck depression. These thoughts are not me, they are a parasite in my brain trying to kill me and I will identify and fight them."
er, they're getting skewered in the media. United is paying the price for their mistake.

If they're regulated, next time they drag someone off a plane, they'll say "We were just following the handbook and were in accordance with federal regulations. Take it up with the FAA"

So no, no need to regulate the industry.

Also, the body you want to regulate them (the government) routinely does much, much worse to people.[0]

[0] https://www.amazon.com/Rise-Warrior-Cop-Militarization-Ameri...
I gather from the original statement by Mark Shuttleworth that the decision to cancel further development of Unity version 8 was a business decision based on not continuing development of the phone/mobile converged UI.

I suspect (and hope) that Canonical just ignored the 'vocal minority' and carried on! Otherwise no-one would ever try anything new.

I'm just wondering slightly how much of a Chandler the Unity 8 project was...

https://smspillaz.wordpress.com/2017/04/06/vale-unity/amp/
Even if it would be legal that does not make it right.