skysight-inc/HackerNews huggingface dataset:
This bug is not a very big deal, it can only be exploited by users that already have sudo access. The publicity it's receiving is mostly undeserved.
This wouldn't surprise me, although manufacturing lithium batteries is still a bit complex. The railroads already use all-electric drivetrains; short-range locomotives carry batteries only, while long-haul ones use diesel to generate electricity and power the drivetrain. The big advantage of an electric drivetrain is regenerative braking, which is just as useful in cars (think of the Prius and its remarkable mileage) as in trains.

Over the medium term, I'd expect to see a car market that looks a bit like the train market: all-electric cars for city driving, plus hybrids for traveling in the country or in underdeveloped areas. Fossil fuels will probably never go away entirely (certainly the military will always need them), but oil is good for things other than fuel; 100 years from now, I expect electric cars will be the usual option while gasoline-burning hybrids are an expensive curiosity.

(Or we might move to a mix of electricity and hydrogen fuel cells; Toyota's betting on this, since natural-gas refining releases waste hydrogen. Safe containment of hydrogen is harder than safe containment of gasoline, though...)
How does one avoid being locked into a mandatory binding arbitration agreement? For example, suppose I run a website that contains a TOS such that it requires visitors to deposit into my bitcoin account scaled by marketcap and a MBAA. When the Google crawler comes by, do I hit the jackpot?
You could've placed your content on a more known domain than random looking one for 5.7 like Medium. People have "mind score" for domains and funny looking ones aren't exactly easy to go to.
If firing is an option, why wouldn't they do so in the first place?
> at-home charging stations for apartment dwellers are just a not-thing

Not yet. The technology is absolutely ready, it's just stuck at the chicken-and-egg stage in most places. Anywhere you can fit a parking meter, you can fit an EV charger. Rolec produce a street light with a built-in EV charger.

On-street EV charging is ready and waiting for the demand. I think it's almost inevitable that every parking space will eventually have an EV charger.

http://www.rolecserv.com/ev-charging/product/EV-Charging-Str...
Essential Cheat Sheets for deep learning and machine learning researchers
Unlike other solutions, the software auto-caches and auto-invalidates SQL; it takes away a developer having to manually configure the cache. Heimdall works with both MySQL and Postgres
Good questions – the new facilities are improvements AFAICT:

node --inspect index.js

Or

node --inspect --debug-brk index.js

then open `chrome://inspect` in Chrome.

https://medium.com/@paul_irish/debugging-node-js-nightlies-w...
Are you sure? Super fast discharge and charge cycles are only part of the story. I have seen that the Nissan Leaf battery problems stem from heat, choosing a poor mixture of electrolyte and additives in the Lithium. Why do Lithium batteries die? By Professor Jeff Dahn - WIN Seminar Series[0]

[0]https://www.youtube.com/watch?v=9qi03QawZEk
Ask HN: What is the pay difference in H1-B visa holders and US citizens?
I recently read the following article and was wondering what is the pay difference in H1-B visa holders and American citizens? If you are an H1-B holder working in the US what's your role and annual
salary? It doesn't seem fair to me to pay non citizens less than citizens right?

http://www.washingtonexaminer.com/mark-zuckerbergs-crusade-against-nationalism/article/2624461
Maybe. I don't know. NEDC rating is what you can sort of get in slow city driving, and city driving is what a car with that sort of range is made for.
> It's not magic.

It's not a computer is probably apt.
> All other things being equal...

...but they're not. Perhaps one time in 50 you'll find a topic so well worn that you have choices between multiple mature, stable libraries with good APIs that lets you dig into the source code to see how nice it is (by whatever metric) to decide if you want to use it.

Perhaps what, json parsers?

I can barely think of any other examples.

It's a completely pointless metric.

The beauty of the API is far more important than looking into the implementation to see how it was written.

Heck, the library could be one giant regex on one line, but if the api is:

void *libfoo_random_meaningless_name(void *n, ...);

...there's no way you'd want to touch that library.

I very much doubt the elegance of the implementation is a metric that should be used to pick a library; there are far more important metrics to look at.
Skin in the game seems to be a large factor. Government workers tend towards better job security (less of a stick) and don't tend to get bonuses (smaller carrot) than private sector.

This is of course by design, since favoritism is generally acceptable in a private organization but (the perception of it) poison to govt roles.
Sorry but you could have limited access to the slave to prevent writes... there are legit replication strategies that allow you to write to multiple nodes, master-master, etc...
Very cool! I'm interested to see how easy it is to create pivots on the fly. We use react-pivot[1] all over the place, but it needs js to set them up.

[1] https://github.com/davidguttman/react-pivot
"I agree that the language is very poorly designed. It seems the designers add any feature that they think will make it easier to write code, regardless of its effects on readability or security. "

That's exactly what they do. It's why it succeeded at original goal, got popular, and is currently a mess for folks who've seen better-designed things. Further, I'll add that it doesn't appear to have been designed at all so much as a hacked together pile of features that were useful to the author at the time then extended over time. Just like C was when I researched it.

It's even worse than the two of you think. It gets worse during the times they tried to "design" some aspect of it. The hashing of names was worth bookmarking:

http://news.php.net/php.internals/70691

re static analysis

I had one project on that saved back in the PHP 5 days. What's the current state-of-the-art in static analysis tools for PHP in both commercial and FOSS? And does that sub-field have any that can prove the absence of common, severe errors like Astree Analyzer does for C and SPARK for Ada? The PHP equivalent of severe errors anyway. Especially anything allowing code injection.

"widely-used Ruby library in which one of the API functions normally expected some kind of object, but if you passed it a string instead, it would call 'eval' on it for you and use the result. This "helpful" behavior was not documented."

When eval will happen or whether risky constructs like that are used at all is one of the things that would be on my list of requirements for static analysis tools. I should be able to spot those kinds of issues in one pass before using a library. In theory anyway.

"My point is that there's more to educating the masses about writing secure code than just telling them not to use PHP."

It takes some books and practice. Also, you can get pretty far telling them to use Airship CMS since it was designed for security. I don't know anything else about it, though, since I don't do web apps or PHP.
The simplest fix might be a mandated license for streaming old content where the royalties go to a collection agency and can be claimed by the rightsholders when they finally show up.
"Plus, there are no interesting problems to solve there."

This is laughable and short sighted.
I actually think one of the best cases for an MBA is for a techie who wants to expand their business skills. When someone who does an undergraduate business degree comes back for an MBA, they're really wasting time going over things they already learned, just to gain a credential. For a programmer, though, an MBA could be your first exposure to fundamental stuff like the basics of finance, accounting, and marketing. Heaven knows they don't teach us about compound interest in high school.
You don't need to bind `console.log` by the way (at least not in any recent version of Node.js or browsers).
Sudo can be configured to grant very limited access to specific users, to run specific programs, run as privileged-but-not-superuser, etc. [1]

[1] https://www.sudo.ws/man/1.8.15/sudoers.man.html
Wait until the "OPEC" of lithium emerges from the coming price wars... If you don't think that will happen, I have some land in Yuma, Beach front.
A Not-So-Common Guide to Financial Success
DNA needs to be compiled into a protein in order to 'do' anything. DNA is the source code, proteins are the molecular machines built by the code. And every organism uses a similar compiler. So the DNA has to be put inside an organism before the DNA source code can be 'compiled' into a biological machine (a protein). Interestingly at the level of the compiler, almost every organism on Earth is capable of compiling most others' particular DNA into a protein (with a lot of exceptions).

Most purchased DNA that encodes a protein comes in the form of a bacterial 'virus' called a plasmid that can very easily be given to e coli - and it makes billions of copies of that DNA with very high fidelity in a few hours (https://en.wikipedia.org/wiki/Plasmid). This DNA can then be purified from that e coli in physically appreciable amounts and then be put into other organisms for ultimate usage. If you're purifying a chemical or a therapeutic the DNA is often put into yeast or e coli. If you're doing research, there are a number of 'model organisms' the DNA can be put into to supplement the genes already in the organism you're studying - including human cancer cells.

There are certain kinds of 'gene therapies' where the DNA is actually put into living human cells, often that have been harvested, and then put back into the person. This enables the genetic code for the new tools/proteins to be incorporated as a therapy.

The physical insertion of DNA into an organism is called "Transfection"
https://en.wikipedia.org/wiki/Transfection (or transduction, or transformation for various particulars).

The general concept when applied to human health is called "Gene Therapy". https://en.wikipedia.org/wiki/Gene_therapy

The manipulation of DNA as a tool to understand the mechanisms of biology can be termed "Molecular Biology". https://en.wikipedia.org/wiki/Molecular_biology
We still have the occasional steam powered traction engine go past our house. We live on a very steep hill, so there is a lot of stoking to get up pressure before they attempt it. I'd say we see them 2 or 3 times a year. Really cool beasts.
> Anecdotally, microbenchmark-style code regresses slightly, real-world code improves by as much as 2x.

Curious, any hunches as to why?
I don't know Linux internals enough to be sure, but maybe this bug is a big deal because it would circumvent logging (even remote rsyslog daemons)? I.E. a sudoer could do nasty things on the system while leaving little to no trace?
What does that mean: "polyfilled with asm.js"?
How exactly did Mozilla win this fight? WebAssembly was inspired by Mozilla's asm.js and Google's PNaCl. Also, the team working on WebAssembly are from Mozilla, Microsoft, Google and Apple. The real winner here are users because we now have a standard among all major browsers.
>Suppose a dollar of this loan has an expected value of 99 cents for the bank, while generating $2 worth of taxable economic activity at a 10% rate.

Apart from miscalculating the expected returns or mispricing the resulting goods and services, I'm having a hard time imagining a realistic scenario in which increased economic activity from a capital injection can result in increased tax revenue to the state but not increased interest revenue to the lender.
I wonder if it is disorienting standing or walking on the movement isolating floor.

There's a (thought?) experiment you can do where you put someone inside a fake room built like an overturned box, and then jerk the walls in a random direction while the floor stay still. You get disoriented and fall over. Or the more common experience where you're on a stopped train and the train next to you starts to move, and it takes you a minute to figure out which of you is actually moving.

I'd have to imagine standing on the isolated floor while the rest of the building moves would be similarly confusing.
What a great story, thanks for sharing.
Having an object cache is one layer. However, caching SQL in conjunction could speed up application response times, depending on the behavior of the workload. I have seen the performance increase by 4x by caching SQL.
Battery capacity is also improving as well as the speed of charging. So a 350-400 mile battery that can be charged in 5-10min would be good enough for 99% of use.
The way the market works though lets say 30% of the cars changed to electricity. Now some gas stations will be unprofitable so would change to charging stations or close down. It would become more inconvenient to find a gas station to fill up so more people would shift to electric as that is good enough for their daily use. The cycle would just accelerate the demise of the gas car I expect 2030 electric won't just be cheaper but more than 70-80% of the vehicles on the road. This does not take into account AI or self driving cars as if that happens majority of car owners would be corporations like Uber/Lift that would look at long term costs not upfront costs. Where repair and service cost savings some electric cars are already going to be cheaper in the next 2-3 years let alone by 2030.
Would you like a better voice memo app? Me too
If you haven't yet, read some of James Clavell's novels. Shogun was fascinating, as was Tai-Pan - I've been meaning to get through the rest.

The shogunate and the Meiji period are very, very interesting periods of history, and under-represented.
I'm aware, but the in the end that's a relatively uncommon configuration, and would still usually require the users password increasing difficulty of exploitation even further.

Not only that, but in my experience people tend to screw up these setups most of the time allowing easy root shells without sudo vulns.
IJ is really one of the most wonderful books ever written, it was a long read but extremely rewarding. I love how it comes full circle, you get to the end and want to read it again. But most amazingly the central event of the plot is completely absent and up to the reader to figure out. The digital version makes the footnotes much much easier.
What kind of version number scheme does Scala use where breakage is allowed in point releases?
Sure, when it's summarized like that, it sounds bad, and it maybe bad. But compare that to this slightly expanded timeline summary from reading the actual filing[1]:

The laptop in question connected to Google only 3 times between March 2, 2015 and November 25, 2015, despite being configured to connect every 15 minutes. ~ 2 hours on Oct 22, ~2 hours on Nov 20, and "briefly" on Nov 25. (My interpretation? It was almost always off and not in use).

Windows was reinstalled on Nov 26th.

On Dec 3, searched were done on Google's internal search system for how to log in and setup access through SVN to the driving car project ("chauffer").

Tortoise SVN was downloaded and installed on Dec 11. It then "downloaded over 14,000 files from the SVN repository". (My interpretation? A SVN checkout of the entire repo was done).

A USB card reader was attached on Dec 14 for about 8 hours.

On Dec 18, the laptop was reinstalled with Goobuntu (Google's custom Ubuntu).

The machine stayed on and checking in to Google normally from the time of the install until Dec 21, when it received a "machine certificate", within a minute of which it was not seen again on Google's networks, despite being configured to connect every 15 minutes (My interpretation? It was off again).

The filing goes on to talk about some Google drive exports of documents that don't necessarily look good for Levandowski.

My purpose here isn't to convince anyone that he's innocent, just to point out that Google's allegations are worded in a way to cast the most suspicion while being technically true. Through the omission of the timeline it sounds like his actions were all taken at once, which looks a little more premeditated, when instead it was over a period of a couple weeks. It's entirely possibly that Levandowski purposefully obfuscated his actions by spreading them out temporally, so this isn't evidence he didn't do what is alleged, but I think it's important people have the facts before making judgments based on Waymo's lawyer's accounting, which is obviously as beneficial to Waymo as possible, as should be expected.

1: https://www.documentcloud.org/documents/3515476-Declaration-...
You could sell it to me....or you could add me as a co-founder and I will monetize it.
>"Most internal combustion engines are only good for ~200,000 miles"

Interesting and I think that figure is is generally accepted and I believe this is due to shear stress on the engine block no?

I know older cars that came out of Detroit when engine block were cast iron could get up to ~300k miles(the slant 6 comes to mind) but I believe nearly all engine blocks in recent makes are aluminum now.[1] The referenced article says there's parity between now between the two but that doesn't correlate with my own admittedly limited and anecdotal observations.

[1]http://articles.latimes.com/2000/oct/18/news/hw-37969
Taking the fifth is not automatically a sign of guilt despite what some people might think.

As I understand it it's not out of the realm of possibility for a lawyer to advise doing so even for completely innocent clients. It's not hard to get tripped up on the stand and sound guilty even when you aren't.
That you can run asm.js code on wasm.
> usually require the users password increasing difficulty of exploitation even further.

Unless the user themselves is the perpetrator. They know their own password and the superuser believes that the system restrictions will grant them only the limited access that they specified.
This bug isn't a big deal because it only affects a relatively rare configuration that is very often otherwise vulnerable anyway.

Linux privesc bugs generally aren't exactly a super big deal.
You still have to figure out what "intelligence" is, and how to transfer, manipulate, or otherwise encode for it. I don't think we have the tools to actually transplant intelligence yet. We are in the early stages of understanding it at all. The field of "optogenetics" https://en.wikipedia.org/wiki/Optogenetics has been a powerful genetic way to help start along that path to understanding how brains work, to what extent a mouse is intelligent, and how to affect neural processes.
As far as all electric I agree with you but for hybrids you have some nice choices. For example, the Ford Fusion hybrid and plugin use the same chassis as the Fusion non-hybrids. Some people even remove the hybrid branding:

http://www.fordfusionenergiforum.com/gallery/image/581-2016-...
I think at this point we've established just how few people this bug impacts.
Category "Auto and Vehicles" ? It is interesting to note that the people on the seismically isolated floor are not swaying with the video (it is explained that the camera is mounted to the non-isolated part of the building so it appears the server room floor is moving when instead it is the building that is moving).

Most of the data centers I've looked at in the Bay Area just bolt the racks to the floor and are done with it assuming, I presume, that it is the shifting on the floor that damages the hardware.
Sure. I'm not coming in on the side of Uber, I'm just calling into question the idea of taking Google's initial allegations, and the assumptions that are often made from them, as evidence instead of the actual filing which paints the story slightly differently.

Personally, I suspect we'll eventually fine out that Levandoswki - and others, check the filing - did steal trade secrets.
I was specifically disputing the claims that Chrome Apps are "one of the best things that happened to Linux desktops in a long time" and that they're noticeably more secure.

Taking Soundcloud as an example, Clementine (and probably most media players) can stream it just fine. Having a Chrome App is nice, but it isn't providing anything that isn't already available. I'd even say the Chrome App is a step backwards, because with Clementine I don't need a separate app for every music service.
Moreover - this is biology. Biology is messy. Mistakes are the reason why the system works (evolution). To say that off-target effects were unanticipated is nonsense. Rather - how many off target effects will there be, can they be predicted, and can their effect be predicted.
That keeps your data safe, but (and I'm guessing here) quite plausibly means filesystem writes may likely start failing, causing services on the affected server to start failing. If you need uptime during an earthquake, then that's not sufficient.
JetBrains DataGrip comes close and supports many different SQL dialects (it's also comes with IntelliJ as the SQL plugin).
Pentagon Tests Anti-Missile System Over Pacific Ocean
I'd love to see a video of that
Right. Some people use sudo as a way to avoid having to provide setuid programs.
Sure...

I forget HN is USA car culture with no public transit until hyperloops magically happen! This is a cultural difference, you Americans can't even walk unless it is a hike up Half Dome or something, walking to the shops is just not allowed - jaywalking they call it?!?

In Europe we have trains for going direct to city or town centre, with plenty of stops in between. I spend quality time with my phone on the train journey there, I arrive alive rather than tired out by breathing the exhaust from the car in front, as happens if you 'sit in traffic' warming the planet. Furthermore, I can drink sociably when out on bike/train - I don't have to ride the road to the station on the way back and I don't have to be the boring driver who cannot go with the party. I also don't disturb people revving an engine late at night or risk the lives of others at the wheel of a two tonne machine. I don't take up parking space or impose on my hosts that they provision parking arrangements for me. As for the sweat thing, that is not a problem on a bike, however, trapped in a tin box, sat on a seat that never gets washed, with 360 degree greenhouse, that can be bad for the sweat thing, even with air-con. I am also not tied to an invisible cord to the car, only able to make a certain amount of paces from it, free rather than chained to all this moral baggage.

Dry cleaning? Basic 30 wash for me. Drip dry. I go to weddings, interviews and posh business things, I am even on first name terms with the guy in the dry cleaners, but my needs for dry cleaning are not in your American league of consumerist normality. The idea that I could not do my dry cleaning because I didn't have a car - I so would love to have that problem rather than laugh at those that do.

Shopping. Do you Americans eat your own weight in food every 168 hours? Yes growing children do need mountains of food but you can get all that stuff delivered these days and you can pick up really fresh nice food on a daily basis from better shops than that big box store you Americans have to drive to.

...ah backs.

Back injuries happen in many ways, IMHO those that don't cycle are headed for back injury from spending too long sitting down, sitting in cars and putting on the pounds.

I know you propose 'cars for all' as the only real world way, but what about blind people? Tough for them. Or people with no arms maybe they should just stay at home. That excuse for 'must have cars' is sub-par for HN logical reasoning.
200 miles in 5 minutes would be fine for most uses. About 5 minutes per 3 to 4 hours of driving. 25 extra minutes on a 1000 mile trip.

(Tesla seems to be at about 45-60 minutes for 200 miles with their Superchargers...)
I love how IntelliJ uses it :)