skysight-inc/HackerNews huggingface dataset:
And, what's your proposed alternative for calculating a hash?

Btw, we treat hash changes very seriously in homebrew-core; they are never merged without a confirmation from the upstream. Unfortunately Cask apparently doesn't live up to the same standard, but Homebrew Cask is not really Homebrew.
We cannot produce an input that produces an arbitrary given hash. Here's an easy counterexample: the all-zeroes md5sum. That's an even harder problem than the one I've claimed is entirely not solved.

MD5 is still preimage and second-preimage resistant.
In addition to timing attacks, if the attacker supplied a non null terminated string, it could potentially cause a memory overrun. This may not be possible depending on how the string is handled on ingress, but if it is, it would likely have serious consequences.
Also JavaScript itself was designed to evolve in a backwards-compatible way. The way developers use JavaScript today is quite different from how they used it 10 years ago.

The idea that systems are fixed entities that have to be designed correctly up-front is wrong and is one of the reasons why the Waterfall model of software development has been superseded by Agile.

Good systems have to be designed to handle change. Change is the only constant thing in this world.
There is also a lady who is able to smell alzheimers.
It was actually 16
http://hackaday.com/2016/01/25/raspberry-pi-zero-cluster-pac...
What were each of them in a nutshell?
But you can reason about what any possible transaction can do by reasoning about all possible inputs to your code; you don't need to know anything about how other contracts were written, since even if they are formally provable, they could send you literally any input.

Edit: Rereading your earlier comment, I understand now - you're talking about other contracts your code calls, not vice-versa. In that case, I'd point out that you're totally free to either write those contracts yourself if they're not already provably secure, or write your own code such that it's formally proved to work regardless of what those contracts do.
Presumably 8,000 people
Practically, how do you go about that? Dig up old newspapers? Wayback machine?
Back in 2013, after a complicated break up, I decided that seeing photos of my ex randomly appearing with her new SO in our common friends posts was not helping me at all, and so, I left Facebook. After all these years I've not missed it one bit. You end up knowing who truly cares about you, as they will always reach you whether you are on Facebook or not.
> You really can't avoid Javascript on the web

WebAssembly is coming. So unless they need to code for the web right away, pick the best language for learning, and/or the most productive language, because getting relatively fast results is how you keep young people (unless they're natural programming nerds) interested.
Genocide?
Two in five people said they’d be interested in owning an autonomous flying car
As a lot of the comments on the Atlantic article point out, a ton of new-world foods are so embedded in the American diet now that we don't even think about them

- Potatoes

- Salmon

- Tomatoes

- Chocolate

- Corn / hominy

- Bison (less common, but it's not something I'd think of as "native american food"

If I got served grilled salmon with potatoes and cornbread at a "normal American" restaurant, it's not something you'd think of as Native American food, but it would be totally new-world sourced. Obviously there are losses in recipes / preparation / traditions, but it's not unrecognizable.
I'd assume it's to prevent your friend from being able to know that the extra kit was yours? Though if all your friends use their correct information - that information is still leaked, hence the need to distribute them to friends outside of the same social circle to minimise the chances.
What part was frustrating?

Reminds me of my university's slow-slow-slow Sun thin clients that they had all of the school in 2004. Logging in and getting into Netscape at peak times would take minutes. Luckily, I knew how to use Pine.
Happy to see this get more attention again. I highlighted it in last week's cron.weekly [1] too.

I'm still unsure of the viability at this point, but time will tell.

[1] https://www.cronweekly.com/issue-78/
> Also, fixed length hashes aren't strings.

In HTTP everything is a string.

> Using a proper cryptography library also might have saved them from using MD5.

HTTP, again. Browser sends MD5 whether you like it or not.
(note: head chef here). Most of my customers don't want traditional. They want something with a twist, or a full fusion.

Authentic is interesting the first few times, but if you take that authentic and mix it up well, you can get a much better end product. (the story did not that the chef tried this, and had complaints, imo the conplaints are from people who wanted to try our authentic - so he should have had both on his menu).

It has piqued my interest though, I think I'll see what traditional recipes I can find online and give them a go :-)
Really don't care. Food is food and to pay markup for flair, location, vibe, history, assortment, arrangement, reservation for daily substance is against nature.
Well, currently, nothing. But currently, the web is completely broken.

If you want web-applications to be powerful, and open, you also need to be able to have any web application to access any URL.

Why should only mail.google.com be able to access my emails, and not also my-little-opensource-webmail.com ?

To faciliate that, without also adding cookie stealing back in, you need to allow any website to open standard TCP sockets.
Why this former Facebook Messenger product manager is investing in AI
You don't need to fork the entire OS, though - just provide the relevant non-free packages on top of the regular OS.

Guix devs themselves have hinted that "adding impurity to a free OS is much easier than removing impurity from a non-free OS", so I suspect they may not be categorically opposed to the idea of non-free packages.
Say I'm looking to have a local Indian phone number that routes to the US -- either like Google Voice or Twilio. Do you offer something that could help with that?
Seriously, they didn't "hack into" 8,000 computers. They took over PlayPen, and then dropped phone-home malware on visitors. Then they identified users, based on their IP addresses etc, and arrested them.
strncmp and other API that treats the pointer to the string and its length as separable variables are not dangerous. They are much more secure than the non 'n' options.

With them you don't have to worry about lack of null termination as the n determines the length of the string.

Problem here was usage of them at all. Hashes are not really strings, memcmp should have been used or even better secure (that doesn't leek timings) memcmp should be used.

Problem here was just mistake in the program not in the C lib.
What's weird is IMAP has keywords, but they can't be used exactly like labels, no idea why IMAP hasn't been extended to include labels, seems rather easy.
The only actual counter-measure would be to take the extra step and calculate the SHASUM of the binary.

The shasum need to be digitally signed with a valid signature otherwise it can be manipulated as well.

ps. Ofc tools like littlesnitch and blockblock help, but keeping track of all the applications that try to access the internet is kinda hard these days, especially on a user machine.
The attacker supplies ""-enclosed string and the HTTP parser is supposed to verify this.

Maybe they used some in-place HTTP parser and that's why they didn't have zero-termination to use strcmp.

And btw, it's not clear if the code was C to begin with. I believe large chunk of ME firmware is said to be written in Java, which kinda makes sense for a network facing system considering how shitty string.h is.

It would be interesting if somebody found that they are using some COTS webserver, C/Java - doesn't matter, and see if there are some CVEs for it.
For the costs, they do not only get the license to use the ISA, but the whole processor design, as in the "source code" to the whole processor. As a licensee, you place that design together with any other electronics you create (or license separately) on a chip to create the device you want.
How number words may have changed us from zeroes to heroes
Penciblue & AARRC are Shutting Down !!
Hello,
It is with deep displeasure that we had the shutting down of Pencilblue - https://pencilblue.org/en-US/article/pencilblue-shutting-down.

Pencilblue has been a beautiful project, which we used in developing the African Academic Resource and Research Centre (AARRC). AARRC is best explained by watching this demo(s) - https://www.aarrc.info:3000/page/56a8f619d01e5cea4c064b5c

With a great sense of regret, we announce that AARRC will also be shut down in the next few days. Its archive (videos/demos, links, slides etc) will remain featured on its domain - aarrc.info - but the service will no longer be offered, at least for now.
Well, for Navajo food:

Mutton is too strong tasting

Elk is hard to come by

Fry Bread is greasy

Chicos (smoked corn) is impossible to find outside the four corners

Navajo Cake is like a weird sweet tamale

Piñon nuts are expensive and seasonal.
Ah, you know, Likud's mouthpiece i24 even have an Arabic channel
Jewel inflation used to be a big thing in the 60s and 70s, with watches advertising 70+ jewels,most of them completely non-functional. These days there are standards on how jewels can be counted and it doesn't occur that much. It's mostly only done by the cheaper brands.
The news.ycombinator.com site for one -- saves login on browser via cookie. HN reader android app also does this.
> but by the end of the day it's still at least 1% of the chip's selling price.

Right, but you cannot just consider the difference in royalty fees between ARM and another ISA.

For example, the STM32F* chips cost between $0.60 (STM32F0) [0] and $19 (STM32F7) [1].

You can't just compare the royalty fee here when thinking of lost revenue for the manufacturer. The ARM ecosystem is huge, and if ST switched to another ISA, they would probably lose customers unless the new ISA had an ecosystem that was as good or better than ARM.

Yes, the royalty amount matters, but customer preferences also matter. I doubt any high volume ST customer would be willing to switch to an entirely new ISA without the kind of ecosystem that ARM has for a few pennies per chip. And who is going to pay for the development of the tools? Unless it's someone like RISC-V, then they're probably stuck developing it themselves. Kiss goodbye to all the money you "saved" by not paying ARM royalties.

Furthermore, if ST switched to a different ISA to save the ARM royalty, what makes you think they would pass along that savings to the customer?

[0] https://www.digikey.com/products/en/integrated-circuits-ics/...

[1] https://www.digikey.com/products/en/integrated-circuits-ics/...
In the US. It's higher in France, for example.
Do you know org-mode? My question got downvoted but I suppose it means to do something like org-mode.
Just looked up RICO on Wikipedia and it has indeed been used in some dioceses to prosecute the Roman Catholic Church for the pedophilia and coverup that has occurred within the Church's clergy! The relevant excerpt:

"Catholic sex abuse cases[edit]

In some jurisdictions, RICO suits have been filed against Catholic dioceses, using anti-racketeering laws to prosecute the highers-up in the episcopacy for abuses committed by those under their authority[citation needed]. E.g. a Cleveland grand jury cleared two bishops of racketeering charges, finding that their mishandling of sex abuse claims did not amount to criminal racketeering[citation needed]. Notably, a similar suit was not filed against Cardinal Bernard Law, then Archbishop/Emeritus of Boston, prior to his assignment to Vatican City.[11][12] In 2016, RICO charges were considered for cover-ups in Pennsylvania.[13]"

So RICO can be used for both criminal and civil charges?
> Sure, might as well sue mother nature for the temperature rise.

Plenty of court cases have set precedent for how individuals and businesses operate in the future.

When a court makes a ruling, people know they can be held similarly accountable, according to the written law, in the future.

> What we're seeing is a force of nature, the legal profession cannot stop it, overall society has to choose to stop it, which means they have to choose to allow conservative voices.

That's not actionable. "Society must do x" is not something you have any control over. You can sue and convince culture to follow written law that way.
The difference is, you are no longer limited to functionality normally provided by AMT. Maybe AMT doesn't offer the ability to download arbitrary memory locations from the running OS and applications, with remote code execution on the ME you could do that. You could modify code running on the CPU on-the-fly and make it read files from disk to memory for downloading too - again, I don't think AMT can read disks, especially when the OS is running and using them concurrently.
Word embeddings from NMT models compared to word2vec
I know the guy who was writing the firmware. Some sources still exist, even though I couldn't find anything ROMable. It was publicly demonstrated using modified Apple ROMs though. The hardware was also subtly different, using a CAV 3.5 floppy with manual insertion/extraction instead of the CLV with assisted insertion/extraction used in the Mac.

Microdigital made Sinclair clones (ZX-81, Spectrum), one Micro Professor clone and Prologica made Sinclair (ZX-80, 81), TRS-80 (III) and Superbrain clones, but never an Apple one. I'd be surprised if any of those was exported.
Composer also supports namespacing
I'd add joining a reading circle. Forces a monthly/bimonthly book on me I'd likely not have picked up by myself, discussions afterwards are usually quite insightful, plus you can frequent and support your local bookstore.
I've only ever used Facebook on one occasions: For a brief time after they opened it up for non edu accounts, at that point it was more or less identical to a German alternative, so there was no good reason to use it because none of my friends were there. I think that account might still be around but is tied to an email address I stopped using soon after. I kind of expected it to remain something used only by college kids and Highschool students, because it facilitates the kind of superficial, gossipy interactions that immature people tend to like.
What a terrific project! So many levels of challenges. How many different images of each piece was needed to before you could train the system?
Holy shit this is amazing.

Elegant, simple, powerful, web based.

Have deployed to Heroku/Firebase and will give this a solid try for personal and work notes.
If you're already doing things like bundling any javascript, image sprites etc etc, you're probably not going to 'see' much benefit. Hence the tools aren't showing much difference.

The big benefit you're going to see is if you are fetching multiple different files from the same domain. HTTP/1 would open and close a new connection for each request and had larger headers which were sent and received. HTTP/2 multiplexing allows a single TCP connection for all data from the same domain.

I used it on a site which by necessity had to download (stream) 4-50 large files on many pages. With HTTP/2 multiplexing, we saw huge performance improvements, but that is a special case.

It won't hurt you to use it, and I'm sure it is a good learning experience, but it isn't a necessity.
> In HTTP everything is a string.

Once you parse it out of HTTP it is no longer as string (or at least it should no longer be a string).

>HTTP, again. Browser sends MD5 whether you like it or not.

They are quite clearly doing verification themselves. They can use whatever algorithm they want.
One day, a machine will smell whether you're hireable :-(
Signing does help! Apple can revoke the certificate the instant the malware is discovered, blocking all future installs. Whereas Handbrake is going to rely on XProtect[1] which entails Apple refreshing all Macs in the universe at some delay.

While I'm at it, distributing through the Mac App Store would have added further protection against this attack on a couple levels. 1) It's harder to compromise with a MITM attack in the first place. 2) macOS wouldn't install an update signed by another party like this.

[1] "We have been informed that the process to update the definitions for OSX's XProtect feature started this morning, so this should start rolling out to machines automatically soon if not already."
Is C++ now going the way of PHP, where to have an actual working program you have to disable all the defaults in some mysterious but crucial ritual?
I spend most of my days doing things against nature.

I wake up on an engineered spring mattress, in a climate-controlled bedroom. I take a shower, brush my teeth, and apply deodorant to my pits. I brew coffee. I drive. I email. And so on.

Food is not food. There are all kinds. They vary in taste, in expense, and in healthfulness. Your comment could be used to bash different musical tastes just the same.
I think economics is in its vast infancy. It studies a highly complex system after all. It's constantly in danger of being coopted and manipulated toward ideological ends, too.
I doubt using Java would really help in this case, because in order to use Java they would have to port the entire JVM to whatever platform they are using. Doing this without introducing any security bugs is about as difficult as just doing everything in C to begin with. By the way, the fact that the issue was with strncmp very strongly suggests that the issue was in C code.
That's because you should get to fiction more. Education is not about acquiring more knowledge. It's also about acquiring experience, emotions, etc. Thus fiction have a lot to bring to you, and probably more than nonfiction ones.

Try the Count of Monte Cristo for example :)
Raftingo Rafting and Canyoning antalya
RAFTİNGO Antalya Köprülü Kanyonda yaz etkinliği sunuyor! Profesyonel rehberler, 5 yıldızlı nehir gezileri ve 1994'ten beri göze çarpan bir güvenlik kaydı ile ömür boyunca yolculuk edeceğinizden emin olabilirsiniz!
Bize Ulaşmak Doğa Manzarası eşliğinde Rafting & Canyoning Turları Hakkında Detaylı Bilgi ve fiyat Almak için http://www.raftingo.com/ adresine giriş yapın. Raftingo advanture Outdoor Trips
Apples and oranges. The companies that design the chips and pays royalties for IP are mostly fabless (with rare exceptions like Intel). The fabs are owned by separate entities like TSMC, Samsung, SMIC that specialize in the production itself. The fabs don't pay for CPU IP (they sometimes pay for some other basic IP to be able to offer them as standard to their customers, but that doesn't cover CPUs/GPUs).

About Samsung, they're on both sides but with separate legal entities.

The licensing cost IS usually significant to most fabless companies, who come in many sizes. Most are not as big as Apple or NVidia. The fabless model comes from the very high cost of a modern fab, it allows sharing a fab through many fabless design houses.

ARM has the reputation of being cheap, because the typical IT/software people compare them to Intel. And yes, compared to Intel most anyone is cheaper ;) But in the embedded space, which is cost sensitive, ARM is not cheap. It's like what IBM and Microsoft were in IT: nobody got fired for choosing them, and they come with a very powerful ecosystem. Something they make client pay for.

In front of ARM, one can find good technical competitors depending on the target market (MIPS, Cortus, Andes, Beyond Semi...). But MIPS ecosystem is smaller, and for the others waaaaay smaller.

RISC V has an opportunity in time to provide a good technology, backed by a strong ecosystem, for lower costs. In the embedded space at least, this is a very powerful combination.
> i use it in production
> i use it for hobby projects
> i have played with it
> i have never used it

Clojure survey had something along these lines
It's person dependent in my experience. Some people NEED structure in their day and need the 8 hours or 10 hours or however many you require for the work. Most don't have a business owners mindset and just want to stay busy all day and clock out.

I know I can work whenever, but most people have been conditioned to put in hours through a lifetime of previous employment and it's extremely difficult to break the habit once it's ingrained.

I know I've tried giving many employees lots of runway, but in my experience, hourly and even piece work (commission) employees can find a way to make a 1 hour task fill the 8 hours instead of efficiently working out of it and moving on if the incentives aren't there to break them of it. Others will abuse it and not get the work done.

It can be frustrating.
Android and iOS alternatives: where is the competition?
This might be something to do with effect of not winning every time: it's studied method to get and keep us addicted. You will get a bigger dopamine hit when only some of notifications are "wins" like tagged photo etc. Slot machines are a great example of this along with other gambling.
> After fifteen years running my own mail systems, I have finally given up.

Same here. I've been hosting my own e-mail for two decades (as of this year) and I gave up earlier this year. My spouse's e-mail to friends who use GMail--something like 80% of them--would, every couple of months, disappear into the recipient's spam folder or sometimes just disappear entirely. My logs would show a successful delivery but the recipient couldn't find the message anywhere. Occasionally messages would start going into junk in the middle of a conversation.

Nothing I changed would permanently fix it. I'd send from a different IP in my block (something.something.194 instead of something.something.193) and mail would flow again...for a couple of months and then stop. My domain registration predates Google's existence by 18 months. I've been sending from the same IP subnet for six years. My colo provider is actually so small that I'm the only customer left on my "neighborhood" /24 (they've recently asked me if I want the entire block routed to me for the lulz). I have SPF, DKIM, and DMARC all set up and they've not changed for at least two years. The amount of mail outbound from my server is (was?) so little that I could tail the outbound mail log and keep up with each message being sent.

None of that mattered. I even signed up for Google's Postmaster Tools but, and this really cooked my goose, I send so little e-mail that I don't qualify to show up on their reports. I tried contacting Google but hahahahahahahahahahahaha--wheeze--hahahahahahahaha.

No other recipient had a problem with me. Messages were successfully delivered to Microsoft and Yahoo just fine. Only Google had a problem with my e-mail.

I finally caved. Google has SO MUCH of the e-mail market that unreachability to them is a catastrophe...and they know it. I don't have the leverage to make them play nice.

Thankfully, Fastmail does so I've changed to them. For the first time since February 1997 my MX doesn't point to my own server and that makes me a little sad.