skysight-inc/HackerNews huggingface dataset:
First-order logic is a formal language that can express statements like "Frank is the father of Sally" (or "fatherOf(Sally) == Frank"), allows variables as in "x is the father of Sally" (or "fatherOf(Sally) == x") and statements about existence like "Sally has a father" (or "It exists an x such that x is the father of Sally" [or "∃ x . fatherOf(Sally) == x"]) as well as universality as in "Everyone has a father" (or "For all y there is an x such that x is the father of y" [or "∀ y ∃ x . fatherOf(x) == y"]).

Using a complex enough formula in first-order logic, you can express a large number of things. However, it is not possible to determine all consequences of a first-order statement. So even if you know that some first-order sentence is true, there might be some other sentence that you would have to think very long about to find out that it is implied by your existing knowledge, after which you can say that you know it, too. But beforehand, you had no idea.

To represent this observation that knowledge is limited by reasoning capability, this system uses explicit operators "K<k>" and "M<k>" for "Using k reasoning steps, I know that ..." or "Using k reasoning steps, I still consider it possible that ...". A reasoning step basically looks like "x could be Fred, and then ..., but x could also be Frank, and then ..., or x could be ...". Statements that are limited in the number of times this is done can be checked automatically.

An example given is: The only thing you know is that Sally's father is either Fred or Frank, and rich. Then it can be automatically proven that "K<1> There is a person x who is Sally's father, and rich, and M<1> x is not Sally's father".

This probably sounds like a strange thing to say. How can "x is Sally's father and M<1> x is not Sally's father" ever be true? The important thing here is that reasoning steps for M and K always start from the known facts, so "M<1> x is not Sally's father" is true for any x, because no matter how hard you think, you don't know who Sally's father is, so it's possible that it's not x.

In fact, the example is intended to express "I know that Sally's father is rich, but I don't know who he is."
CANELO ALVAREZ vs. CHAVEZ JUNIOR PELEA COMPLETA
Self Design Corner Protector for Mobile Phone – Jugaad
Seconded. These wars may not be in the interest of the US as a nation or of the US people, but those who profit from it have been doing so for a long time and gathered immense power, and are not willing to lose the source of their power. It's a kind of self-sustaining feedback loop.
>> I would say that if the ear does not pick up the energy above 20khz, then it cannot be harmed either.

> Your eyes are also unable to see infrared, or ultra-violet, yet either with sufficient power will blind you.

Sufficient power delivered by IR radiation can easily set you on fire, regardless of whether the part of you that's burning was sensitive to light or not. And UV can do much nastier things.

But it's hard for them to have any effect without depositing energy. It's absolutely correct that if an ear, or anything else, doesn't pick up energy from whatever you're throwing at it, it cannot be harmed.

Why worry about hearing specifically as a target for ultrasonic damage? As you yourself point out, sound can deposit energy regardless of the particular physical structure it's hitting. Delivering enough IR to the ear will destroy your hearing, but not because of any property of your hearing or your ears. Is there reason to believe that ears or hearing are more sensitive to ultrasound than, say, your nose is?
Ask HN: Any value in HTTP/2 for small sites with local users?
I am contemplating moving a few of my informational sites to HTTP/2 since the more efficient networking model appeals to me. Because of my current setup this would require some effort to do properly.

I have proxied an existing tiny fossil site of mine behind Cloudflare to try http HTTP/1.1 and https HTTP/2 access side by side and cannot see much overall difference from local access to my existing http HTTP/1.1 sites. I am using tools such as WebPageTest.org.

My sites are simple and low traffic and non-contentious (no strong need for https), and I already make an effort to keep them small and efficient.

Should I bother?
As far as I know, it's only doing this for the primary (on-chip) network interface. /Never/ use the primary NIC if you have a Intel CPU.
It's because both colliding files have to be specially prepared by the attacker, before they are published on a download site or presented for signing by a code signing scheme.
https://www.win.tue.nl/hashclash/SoftIntCodeSign/

Which means, the published MD5 on on the Intel site would have to be the hash that the attacker created.

Though I'm sure there are better methods that Intel could implement.
It's cool but certainly not a new thing. Just Google "spherical chess game".

I know because I instantly remembered seeing a photo of such a game in a tech magazine for kids when I was little.
I disagree with the article. If anything, it's much less severe than many people thought.

- It's a logic bug (authentication bypass) instead of a memory corruption. An authentication bypass is bad, but a full compromise would have been much worse.

- It's a bug in the opt-in AMT management, which means that the default config is not vulnerable.
I was not surprised to see that you're a lawyer at Google, so of course you think Google is doing the right thing.

As you know, what the CLA is doing is making sure Google can't get sued for patents or copyright claims on the software. That's what I meant by shifting the blame from Google to the contributors. Google can just say, look, we have this CLA here, so it means we didn't do it, go talk to the one who signed the CLA. Not our problem, says Google. So now it's up to the individual who signed the CLA to deal with whatever legal fallout happens, a person who probably has a lot less lawyers than Google to handle the problem.

If you really wanted reassurance that the code is being contributed properly, there are other documents that could be signed which would be much more two-way than Google's CLA. For example, GNU's copyright assignment includes a promise from GNU that they will always keep the software free, with GNU absorbing the legal burden to do so. KDE's CLA has a similar wording, talking about free software principles, and it's also optional for contributors.

Now I am going to be more adversarial and unpleasant. I don't like the Google hivemind. Google employees have a very uniform mode of thought on certain topics. This includes the beliefs that the GPL is dangerous and must never be used by Google unless forced to (i.e. only on software that came from outside of Google), that the AGPL is the ultimate evil, and that under all circumstances Google must be protected above everything. Google only legally cares about Google, no more. You can pretend like the CLA also benefits the other contributors, but that's not really the case. The external contributors could take Tensorflow, fork it away from Google, keep working without a CLA, and everything would be right. All that's necessary is the implicit agreement to the free license (for example, the clause in the GPL that says using the software grants you the rights provided by the GPL). Like you say, should a problem arise, all they have to do is remove the offending code.
Please stop saying the documentation is "total mess" and "absolute shit" because this is far from the truth. There is comprehensive documentation available for Nix[1] and NixOS[2]. There is an online search for packages [3] and NixOS configuration options [4]. Sure the documentation will be incomplete in places but that doesn't make it "absolute shit", I have found it to be very helpful generally.

[1] http://nixos.org/nix/manual/

[2] http://nixos.org/nixos/manual/

[3] http://nixos.org/nixos/packages.html

[4] http://nixos.org/nixos/options.html
I do this will FBreader on Android using Google TTS.
That seems like a reasonable plan to me.

The big question is, would that be "fulfilling enough or complex enough" for you?

Maybe the answer is yes. I suppose you won't know until you've been doing it for a while. Even if it doesn't satisfy you, Kafka is still a useful tool for your toolbelt, so the whole adventure won't be a waste of time.
Which is wrong, by the way. What actually happens is that a filter is installed on the NIC that redirects some packets (those addressed to the ME).
No, it looks like it's not getting enough attention. (Well, OK, it is not terribly surprising.)
Of course my points are based on generalizations and my value judgement is subjective. We are all ignorant regarding the vast majority of things - the best we can do is draw observations based on the information we have.

I am a member of a culture making a value judgement about aspects of another culture that are antithetical to my own. If enough people within my culture agree those aspects are a great danger then collectively we can outlaw them or otherwise oppose them.

My main point is that not all values are equally valid. Different values have different results when played out. They affect things like individual freedom, happiness and innovation. If Islam were to become the major culture in the West, how do you think that would affect our lives? Is that something you'd be ok with? If not, then you're making a similar value judgement.
Location: Karachi, Pakistan.

Remote: Yes

Willing to relocate: No

Technologies: - Web Development: PHP(Laravel), Django and Rails.

- Automation/Scraping in Python Beautifulsoup, Scrapy and Selenium.

Résumé/CV: http://adnansiddiqi.me/profile.html

Email: kadnan(at)gmail(dot)com

A polyglot programmer who is always up to learn and implement something new. These days I am mostly into Laravel, Django and Data Scraping/Automation but not limited to it. Willing to learn and implement stuff in Go language.

I also write blog posts. Check my blog at: http://blog.adnansiddiqi.me

Thanks
Does anyone know how this compares to configuring Openbox? (and adding things like desktop icons, background image, conky, panel, etc)? From the perspective of a *nix power user, of course.

I already get my level of desired configuration through Openbox (with other programs), and retaining the benefit of idling at less than 450mb RAM usage and not having any unwanted components.
It's written in C. Why not a general purpose OS?
You cannot simultaneously please people who want new things and people who want nothing to change.
Amazing - I had no idea you were the person behind KnightOS, I've previously read a few of your posts and thoroughly enjoyed them (the one about the US election particularly hit home). Thanks so much
Indeed, there is never a valid reason not to use emoji.

(Though in this case, the communication medium is Hacker News. Shame on you, Hacker News!)
"An authentication bypass is bad, but a full compromise would have been much worse."

Given the authentication bypass essentially leads to full compromise, where's the difference, here?
Could you elaborate on the "stealing your cookies" part?

Cookies are sent only to the origin that set them and (except XSS attacks) are not revealed to anyone else. So who exactly is stealing them?
What worked for me was setting smarter goals. Instead of a X-books-in-a-year, I switched to 3-books-in-a-month, which is far more easier to track because I need to finish a book once every 10 days.

I track everything on Goodreads, and it has been working out great.
The article stops short of an explanation, because the explanation for the gap may actually be very simple. However, it is more fashionable to talk about inequality gaps without actually looking at the causes.

Poorer students are more likely to be lazy and not want to study, due to their upbringing and because their parents are also less educated and have more distrust in the skills that are taught in schools. Richer students' parents are more likely to be well-educated and thus to impose on their children that they need to study harder and take education more seriously.

This is not news or any revelation. Of course, some of the richest kids may also be lazier, but the big difference would be between the poor and the middle-class kids.
A lot of people waste their time reading the latest NY Times best sellers when they could be learning. Who cares how many trash novels you read? You might as well watch TV. Read for quality not quantity and pursue other avenues of learning. Kahn Academy has tons of excellent and free courses on YouTube. Or actually do things. Build something, plant a garden, fix your car, learn a language, write. Passive consumption is overrated.
"MD5 is not broken for the usage that you think it's broken for."

Correct; it's broken for everything since we've got the computational power to make it essentially ineffective.
Do you use NixOS as a desktop OS? If so, what advantages do you find over something like Arch? I understand the repoducability from configuration files are often touted as a selling point, but I'm not reinstalling my OS regularly so I don't really see the advantage.
You are think only of passive was of learning.
The other way to look at this is..

MD5 is known to be a poor option. And every few years the practicalities of attacking it increase. And when the type of attack described here does become practical, all we'll be hearing is one side saying "they had ten years to fix this" and another side saying "but experts we consulted said it was fine".

It is incredibly easy for whatever process builds a website with an MD5 hash of a download to instead display something else, so the cost trade off becomes:

Cost: Virtually nil
Mitigation: Currently minimal but has future potential

That a company would look at that and say "I guess we'll make a choice to stick with MD5" says something, even if it doesn't say the website downloads are easily compromised.

Alternatively, the parent comment could be pointing out that no hash signature that only exists on the download site itself offers value, and they would be better served offering a GPG signature or similar.
I am sorry I didn't highlight this in the question.

I didn't mean the in-house tools we build to make our dev's work easier, but to make it easier for the non-dev members of the company.

I was referring to all those web UIs we build in companies for our internal tools to use to service our customers, help our sales guys achieve their targets etc., In other words, we could just think of them as an UI with the production DB's slave in the backend which allows the internal teams to consume/edit data. Think of user management tools, log analysis tools, sales trackers, fraud trackers etc.,
I find this an list amusingly technology obsessed. I notice none of these points mention the actual GUI or desktop, or any of it's features :)
The JavaScript Event Loop: Explained (2013)
You actually can - you form a standards body around a protocol, good libraries for talking to it, and convince other people to build against it. GMail doesn't map very well to IMAP, and actually managed to pretty much kill personal email clients, when it could've been the best-of-breed implementation of a new standard for everything it does. People who want a more conservative ui can have one, and people who want to put up with gmail can do that.
SEEKING WORK - Remote
Developer/Manager with many years of programming in different web technologies.

I am specifically looking work in:

- Web Development: PHP Laravel, Django, Flask.
- Automation/Scraping in Python BeautifulSoup, Scrapy and Selenium.

Visit http://adnansiddiqi.me/ to learn more about me and my work. I also blog at http://blog.adnansiddiqi.me

Thanks.
https://www.dailydrip.com/topics/elixir

This course is free, recent and take you from beginning to the end.
The ME itself is not compromised.

Arbitrary code execution on the ME would mean total control of the host, i.e. privileges above any software you can run on a computer.
They can't. Prove me otherwise.

Even if they have plaintext password (which is often not case), this is just shasum. Feel free to guess which password (and which exactly scheme) I used to generate my password for news.ycombinator.com, if (of course it's now not like that :) it is:

bb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82

You have now (after hacking whole hackernews db) access to my password ONLY for the hackersnews. Which was the original goal of the method: to use different passwords at different sites, which if compromised (password), do not reveal scheme used to generate it for different sites.
I was agreeing with the facts in the parent comment, rather than the theory presented in the article.
Obviously facial expressions combined with illustrating sound sequences to resolve ambiguities.

- Hello, I believe MEEP.js is the best, but at work we use MOOP.js for its speed and flexibility. Other popular choices are WEEEEE.js, BLEEEH.js and WEEOOHWEEHOOWEEBLUB.js. Hope I’ve helped!

- That’s great! Thanks a lot!
BBC unfortunately still has plenty of elitist or colonial shade. Articles showing most news from other countries in poor light or fault finding is its forte. Other day I was rummaging through news of 1999 about Google/Larry/Sergei. Bbc has mentioned it's a breakthrough tech but much of article was dedicated in mentioning that google only indexes only 10% of web. And the tone was on negative side. Peter thiel's rightly says that most of Western Europe only reacts to its progress.
That's not entirely true. It's broken in the sense that for every hash given we can compute an input that produces this hash. Constructing a useful input (in this case a working exploit) is much less trivial. The complexity depends significantly on what the desired input should look like. It's easier for input that have the property that they can ignore chunks of the input (googles PDF example), but still hard for others.
Cache of frontpage that's not down, from ~30 seconds ago: https://web.archive.org/web/20170507072845/https://lumina-de...
As expected, the Fastmail pitchmen are out in full force anytime the word email is in the topic.

As the article stated they have a choice of Gmail or Exchange.
Static analysis involves things like partial evaluation, dataflow analysis, and type inference. None of this is covered in the T3X book.
I'm "double Bantu" - as a Kenyan I speak our national language Swahili, and I'm also from the Bantu Bukusu tribe of Western Kenya on my father's side.

This migration history is even more complex because the migration was in waves - Bantu who went to South Africa later migrated north again, meeting Bantu who were already there from earlier migration. You can tell this from the fact that some southern African languages have closer linguistic relationship to some East African ones, than they do to other Bantu languages in their region.

My dad (Bukusu of Western Kenya) once met a gentleman from the Venda tribe of South Africa, and they conversed in English for an hour until the South African got a phone call that he answered in Venda. My dad understood practically every word that was said on the phone, and they each discovered this tribe they'd never heard of before had more language overlap than their neighbouring Bantu tribes back home.

It's fascinating if you consider just how big an area we're talking about, and how much opportunity existed for other languages to wipe out Bantu dialects. I'm no linguist but I think Africa has a propensity for multilingualism that has kept these tribal dialects alive, and aside from DNA this gives the strongest evidence of the past migrations of Bantu people.
I like that seeing my name being mentioned
Yep, even if they had used memcmp/strncmp correctly the AMT would still be vulnerable to a timing attack here, which is probably even easy, because it runs on a low-power system with, I assume, not much background activity.
I would love to try Native American food, but there does not appear to be anything in my area (Atlanta) that serves it.

Kind of a chicken and egg problem, it would seem.
While I agree with most of your comment and am writing this on my NixOS desktop, installing is a breeze only if you don't want to encrypt your root partition or don't want to use it on a macbook or something that mature OS'es usually do quite nicely out of the box.

I have my bookmarked set of gists to guide me through these things and it took me days to get it right the first time.

Also nixpkgs are a bit of a mess, you usually get a version of a package someone has bothered creating a PR for. This might be very old or bleeding edge. For specific versions you can be SoL. It is of course fairly easy to have your own .nix of the package and PR's are usually accepted quickly but the repo usually doesn't keep previous versions.

And then there is a whole world of pain regarding language specific packages. Python is especially painful for me.

It took me ages to find the page which hints at nix-shelling projects but this is a pita and requires a completely new workspace setup that is not compatible with people that don't use Nix.

Regardless I love NixOS, but to say this is perfect, not even close.
The alternative would be to bundle a terminal, I think - a window manager that doesn't offer a way to run programs, is a window manager that fails as an interface.
The author has strong opinions about the security of standard TLS/SSL. He activated client side certifications for good security. The setup is mentioned in one of his blog posts, his opinion in another.
Well yes, if you want to look at features then you'd look at the features page: https://lumina-desktop.org/features/

It's in the same dropdown list that lists the FaQ page.
Could you share your config and workflow? I'm a heavy Vim user and I've dabbled with VimWiki and Taskwarrior but never got proficient with them.
For devs using higher level languages it is more like:

1. "It must be my code" -- minutes of debugging

2. "It must be in our codebase" -- hours of debugging

3. "Third party library or framework" -- If library use a different library, if framework accept the bug and work around it whilst cursing framework choice.
> RISC-V is amenable to a wide array of microarchitectural decisions

As is ARMv8. Applied Micro, Broadcom, Cavium, Huawei, Nvidia, AMD, Samsung and Apple are all architectural licensees with radically different microarchitectural implementations. For example, Nvidia is Transmeta code-morphing style implementation. Also, Intel and AMD continue to innovate in the x86 space.

At this date, RISC-V has no fundamental advantage over any of these architectures and then has the fundamental disadvantage of not having access to their IP. You're lining up against Usain Bolt and your advantage is that you're wearing organic cotton. That's just not gonna work.
bb05f766a74e6bf722136eaca97d9beb1fcc8f59d47c2d9e6eb1667d57c4cb82

That's not the point. The malware would have access to your complete machine, possibly with root privileges, what holds them from reading your master password with a keylogger when you type it in?

It does not provide more security against trojans than a password manager.
doesn't what? The suspense is killing me
CMU uses G Suite so they do have support and their email is not "datamined"

>Unlike Google’s consumer offerings, which may show ads, we do not collect, scan or use your G Suite data for advertising purposes and do not display ads in G Suite, Education, or Government core services. We use your data to provide the G Suite services, and for system support, such as spam filtering, virus detection, spell-checking, capacity planning, traffic routing, and the ability to search for emails and files within an individual account.
There are readers that can do that. Minihack as example.
Actually those Perl books are cleverly written and fun to read (like much of the official documentation) as opposed to the dry literature of many other programming languages. You may like Perl or not but that is a fact.
Here's a pretty good article on exactly this question: https://www.abine.com/blog/2013/23andme-without-violating-yo...