skysight-inc/HackerNews huggingface dataset:
ROP: return oriented programming
ASLR: Address space layer randomization

Having ASLR is not bullet proof to remote code execution, e.g. iOS has ASLR for a long time and can still be jailbroken (which usually involves a code injection etc). The key is info leak, e.g. if you somehow can reliably find the memory location of open() syscall, the memory location of the whole libc can be inferred, and libc is usually large enough to construct a ROP chain. (I haven't work in security area for a long time so correct me if I'm wrong).

The researcher unable to provide a POC for vlc could simply mean it's hard due to ASLR, but it's not impossible.

Also: I believe ASLR is a compiler option (with a supported OS), it should be relatively easy for Kodi and Popcorn Time to start using ASLR.
> Of course that made them, for that time, unusable! So he had to toss them.

Honest question: your mother didn't bother to work anywhere, why couldn't she help him?

And I like this "he had to toss them", as they lived apart, and it wasn't a family's loss.
>It's all too easy as an expert to overlook the pain points that you've become accustomed to, or did not notice as they were slowly layered up over the years.

Same holds for the inverse: it's easy as a newb to consider everything as a pain point, even if it's a well designed procedure.
From the article:

"A few students—all of them white guys, Wu remembers—would hang around to ask about the research and to probe for flaws in its design. Wu still didn’t believe in ESP, but she found herself defending the experiments to these mansplaining guinea pigs. "

Was this race- and gender-related jab really necessary? (Honest, non-rhetorical question.)
I would want WhatsApp, map and uber, and a browser. That's all I need on move.
Same here. Please share on HN when you are done. I would love to read it.
every module was protected by ASLR.

Address space randomization is not "protection". It's a form of security by obscurity. The odds of an exploit working are reduced, at the expense of more crashes due to exploit failure.

It helps developers ignore bugs, since they can no longer reproduce them.
> trolls - state sponsored or otherwise pushing an anti-humanitarian cause.

I've seen this idea brought up a few times here in our community, and have been accused of it at least once for expressing an unpopular opinion.

I have such a hard time believing there's state sponsored posters who troll hacker news. It seems extremely tinfoil hat to me. Honestly folks we're not that important.
> Orders a beer.

Beer delivered, but at the center of the bar, not to the customer.

> Orders 0 beers.

> Orders 999999999 beers.

Bar room fills up with beer, drowning everyone.

> Orders a lizard.

Bartender yells gibberish at customer.

> Orders -1 beers.

Keg explodes in taproom.

> Orders a sfdeljknesv.

Bartender complements customer on their fine taste in Hungarian beer.
That's always been my biggest concern. It appears to have happened to Trump's team, which is very ironic because the republicans are supposedly the national security hawks that want this surveillance; but at the same time now the dems turn a blind eye because it happened to someone they despise.
I really enjoy the TPL library. blocking queue etc makes it pretty damn easy to understand, what could be complex code.
I couldn't tell you, a lot of it is just me becoming more experienced at setting its parameters. I made a few minor upgrades, but I don't think it took too much effort to get that quality out of it.
Simply calling students out for bad behavior is not usually a problem (though it can be in multicultural settings). Bringing them to the front of the room to humiliate them is another matter entirely. It denigrates them in the eyes of their classmates and sets them up for bullying by their peers by modeling that behavior.
Why is this down voted? It's absolutely verifiable. You can watch the keynote and then go read the headlines lambasting the decision. It's why the phone launched in Summer 2007 but the App Store launched in Summer 2008.
Show HN: Unlimited User Interface Design for Software Teams
Shit compared to what?

People really have no context...
Yup, using Vuex (thanks @kylestlb)!

Search is currently client-side only (using string_score https://github.com/joshaven/string_score). Eventually it could move to the server. Thinking about something like Elasticsearch.

Ctrl + Enter not working is strange. I tested on a variety of browsers and OSs. Can you message me at tom@meagher.co?
I think you misread my tone! Just noticed a < 1 year old account and filled you in, nothing more. Everyone else was just down voting, which I didn't think was helpful if you didn't yet know.
If that doesn't work (i've had issues with newer hardware), take RancherOS for a spin.

It's dockerized applications (as close as a VM as possible).
The Istio blog post is excellent, and provides a lot more detail. https://istio.io/blog/istio-service-mesh-for-microservices.h...
Exactly my first thought on reading the headline. "Oh, really? Then thanks for prioritizing my battery life and general UX over cheaper app development, Apple!"
Ask HN: Any Good Nlp Keyword Extraction API?
Sure, the current system is based on past choices. That does not mean it's a good system. I don't really care about Trump vs Hilary. I do care that because I moved my vote went from token effort to completely pointless.

If you look at the history of US presidential elections the map used to be a lot more fluid. Compare say 1972 with 1964: http://www.270towin.com/historical-presidential-elections/ And compare that with the string from 1992, 1996, 2000, 2004, 2008, 2012, 2016.

That recent trend is not by accident. Both party's have carefully crafted their message to maximize their chances of winning. But, that divide is all about minimizing the power of choice which is inherently corrosive.
Street-side and apartment complex chargers are amenities that are already showing up in cities. If the pace of electric car sales increases, I'd expect that to also increase.

Work parking lot charging is also an amenity with increasing prevalence and it certainly is possible that a person that owns a car primarily for a work commute will have plenty of opportunities to charge their car in the 40+ hours a week their car is supposed to be sitting in a work parking lot.
It isn't click bait. If you click through to the map and look at London, the owners are almost exclusively public sector or tax-evading shell companies in places like The British Virgin Islands, Panama, Jersey, The Isle Of Man, etc. None of these jurisdictions make company ownership records available, thus they can be considered secretly owned.
Yep. Some people apparently have never seen the table under https://en.wikipedia.org/wiki/Apostasy_in_Islam#Apostasy_in_...
What you care about is the maximum permissible exposure at close range - because it's entirely possible that a kid is going to walk up to your car and stick their face up against the glass. The laser beam will already be fairly wide (order of mm) as it exists the system, but it needs to be reasonably low divergence to give you accurate spatial information 200 m away. We should assume to be pessimistic, that you get the full beam into your eye (up to 7 mm).

This is really back of the envelope stuff, but there are lots of factors to consider. You could probably get away with even a 100mW laser with the right setup. Obvious disclaimer that you should respect laser safety and not trust someone's internet napkin calculations.

According to this you're allowed 1W/m^2 at > 1400nm for an accidental exposure (100 seconds): https://workspace.imperial.ac.uk/physics/Public/physicsdocs/...

Equivalently that's 1 mW/mm^2. So the question is, what power is the laser kicking out? A Faro scanner can put out as much as 20mW/mm^2 at 1m and their systems are thus Class 3R. So far, so bad.

However... laser safety ratings are given as "Under normal operating conditions". The laser is being scanned, and very quickly at that, so you'd only be getting very short bursts of light (I don't know if it's truly a pulsed laser). If you stared into the beam continuously you would have problems, but since the beam is only going to hit you for a fraction of a second it's unlikely to do any damage. And indeed Faro say that for practical purposes their system is eye-safe, even though it's got a stonking laser in it.

The tables say you can go up to 10^4 J/m^2 for short exposures and suppose we only have the beam in our eye for 10^-3 seconds (additionally the pulse length will be very short), you're allowed a light power of perhaps 1000 times higher. Maybe divide by a factor of 100 or so because you'd get several repeat exposures if you stood in the same place or if you're standing on a street filled with these things.

Have a look at Faro's manual, Appendix E for a real example of this kind of analysis: https://doarch332.files.wordpress.com/2013/11/e866_faro_lase...
+1, this is an amazing landing page.
dupe https://news.ycombinator.com/item?id=14410533
What's the vulnerability? C memory unsafety?
It's a common and disingenuous criticism that registered reports disallow discovery. They don't prevent you from doing exploratory analysis, they simply require you to display it as exploratory rather than pretending that was your hypothesis all along.
Teespring Undergoes Stiff Layoffs in Corporate “Restructuring”
I visited for a couple of months just before the war. Such an amazing country with beautiful ancient cities.

Here are some photos I posted a while ago from a similar thread:

http://imgur.com/a/gkqlj#0
Is there any difference between securely erasing a TrueCrypt partition vs forgetting the password?
From the Atlantic article.

"It’s no wonder women in the U.S. hold just 13 to 22 percent of the doctorates in engineering, compared to an already-low 33 percent in the sciences as a whole."

The info cited is in an Excel spreadsheet with this footnote:

"Degrees in engineering include degrees in all areas of engineering--for example, chemical, civil, electrical, and mechanical engineering--as well as degrees in general engineering."
This is Samba, not the Windows implementation of SMB.
Codecool coding school boosts expansion abroad
Women couldn't wear pants!!??? Was this an airline? Or maybe the service industry??
My read of the documentation also indicates a large overlap with linkerd. Hopefully one of the creators is around and can do a compare/contrast.
> I also can't get this to work. Or figure out what it's supposed to do.

1. Paste a key from https://console.developers.google.com/apis/credentials into the "API Key" input

2. Paste channel/user URLs into the textarea, one per line

3. Click "Refresh", it will show five latest videos from each channel: https://vgy.me/tfseJu.png
I don't know if this is still the case (haven't cared much about the mobile market for a few years), but what the Android and Web markets were missing that made iOS a necessary target was: users willing to pay money for apps. I don't recall the exact percentages, but many mobile app companies were reporting that iOS users made up 20% of their users and 80% of their revenue. Something like that.
I gotta admit that is pretty dang cool. Thanks for the video!
There was a lot fewer users four years ago so perhaps some people felt a stronger connection with those early users.
Why would anyone drop the Beverages table? I'd think the first target would be the Customer_Tab table.
Unless you're talking about a text based browser that can share 1.5MB of memory - it sounds like you're looking for a smartphone.

Whatsapp is probably the only app I could see them adding in.
> Same holds for the inverse: it's easy as a newb to consider everything as a pain point, even if it's a well designed procedure.

Sure, that's why I noted as much with my last sentence. :)
That's what I do at the moment. I have an open window of ST3 at all time with a bunch of notes in there.
1Writer[1] is the best I've tried, assuming you're using Dropbox for sync.

[1]: https://itunes.apple.com/us/app/1writer-note-taking-writing-...
> Personally for me, the benefits from using services provided by Google or any other company outweigh the risks of my information falling into the wrong hands

Which benefits? Most of the services Google provides can be replaced for free or for very small amounts of money -- and without giving up your privacy.

Is saving $50-100/yr really worth granting Google the right to store and abuse your data forever, or the risk of your data ending up in the hands of criminals?
I was afraid to ask that same question, given the colorful metaphor provided
Seeing so many new cool projects done in Vue makes me wish I used it instead of ng2 for my pet project. Ah well, I'll keep it in mind for the next one
I hate wearing shoes, and I'd look crazy going barefoot in my office. I compensate by wearing really light-soled vans and no socks.
I disagree with the author that "the Hybrid approach is the right choice for your next app".

Speaking from personal experience, the time it takes to create workarounds for UIWebView/WKWebView is only slightly less than the time to get familiar with Swift/UIKit. With knowledge of mobile paradigms it is easy to pick up Java/Android.

The advantages of creating two separate native apps are designs that fit each individual platform, better battery life, and overall better performance.

The author's time to market using hybrid development was less than the time it would've taken to learn iOS/Android native development and ship. However, the time difference is not as large as one may think. By continuing to invest in hybrid app development the author didn't learn valuable iOS/Android native app development skills and created an app that isn't as performant or designed to fit each platform.
Who's to say that NSA did not blackmail Obama into expanding its powers or relaxing oversight?
Info of fixed versions:

Debian: https://security-tracker.debian.org/tracker/CVE-2017-7494

Ubuntu: https://www.ubuntu.com/usn/usn-3296-1/

Red Hat: https://access.redhat.com/security/cve/CVE-2017-7494
She was an artist. Making money isn't a requirement for something to be work.
It depends on how you view it. Baking everything into the application logic works if you have a homogeneous stack. When you start going down the polyglot route, with 5-6 language runtimes, multiple databases, it becomes really really hard to maintain all the communication logic (discovery, load balancing, resilience) in the app code.

Take a look at AirBnB's smartstack, Yelp, Lyft's Envoy mesh. These are all polyglot applications, where the communication aspects are abstracted out into sidecars.
Tech IPOs – An Insider & Outsider's View
No. Other forms of property can a) be manufactured and b) be moved. Land is unique in that both are impossible. As result, each piece of land is unique because of what it's close to (not what it is, as with other forms of property). That means that if you want an alternative equivalent product from another supplier, it's impossible. All the other bits of land are in different locations, and you can't get a new bit from a factory.

This means that if you want to a) live walking distance from your parents (free childcare, so your partner can work and you get double income) and b) be able to commute to your place of work, there are certain number of qualifying pieces of land and no more. If someone already owns them all, you have no other choice but to buy or rent one of those. No entrepreneur can undercut high land prices with a cheaper equivalent, therefore it's a monopoly.
To be honest React Native is Electron for mobile. On Android it starts custom Chrome engine in it.
Check out this Article ️
People wear socks in the office??

In NYC it's similar in winter -- people keep light flats or flip flops on their desk and trade snow boots for those during the day.
2.2.6 is deployed.
Not a complete comparison, but here's[1] a breakdown of Linkerd vs. Envoy (the L7 proxy that sits at the heart of Istio)

[1] https://github.com/lyft/envoy/issues/99
Notes on Building Noise: A JSON Search Engine Written in Rust
Yeah, I think the author is kind of out of date. Even people who go the cross platform route nowadays don't use Cordova, where PhoneGap went to die, they use something modern like React Native, which doesn't have the HTML performance penalty.
> the crisis of representational democracy, populism, ...

Oh jeez what a travesty - the people getting what they want rather than a focus on "everyone but us first"!

> xenophobia, the surveillance state, terrorism, ...

Yes a reasonable fear of mass immigration from places that don't vet their refugees well enough isn't a legitimate concern and should be mixed in with an actual fear like the surveillance state.

> last 40 years against dreaming up Utopias

Venezuela is doing pretty good with their attempt at a utopia.

> But I believe core values will be tolerance,
> individual right

Choose one.

Sorry bud, I don't mean to be rough. But I'd love to see the world through your rose colored glasses.
I've been hearing a lot of good things about Phoenix. I do web application development for a living, so I'm interested in learning more about it.

I decided to take a look at the official getting started guide. Looks pretty good. I like how rigidly everything is organized. Though, there are some things that put me off a bit:

* There are a lot of dependencies just to get a simple hello world app running.

* I need to have a Db installed even though the application doesn't touch a the Db? Does that mean the Phoenix stores its configuration in a Db? I don't like that. I try to keep config in file format.

* Honestly, working with ecto outside of initial model creation looks kind of nasty. I could be looking at this wrong though.

* I've never been a fan of functional languages for one reason: Too many damn symbols in the syntax! It appears that Elixir definitely does a better job having an understandable syntax compared to say, Haskell. That said, the one operator that always gets me is `|>`. I understand what it does, it's just difficult to type and I always felt like a simple `>>` would make sense as well as be easier to type. This is rather nit-picky, but I write a lot of code, so ease of syntax is actually a very important consideration for me.

* There seems to be a lot of lock-in if you want to use the CLI tools. What I mean by this is that the CLI tools, specifically `mix` seem awesome. However, it seems like that in order to use them, you need to use a very specific set of libraries. This isn't necessarily a bad thing, but I wonder if this would effect long-term flexibility.

* Did I mention the dependencies? It seems like every CLI command requires dependencies to be installed. This could be my own misunderstanding or a failing of the guide.
Yeah for a lot of this review I felt like my response would be "isn't that the point"? It's obviously not for everyone but the simplicity or lack of features will be a good thing for a certain audience.
Man, wouldn't it be awesome if there were something to inform the reader what is meant by "hybrid app"?

...because neither "hybrid" nor "app" is an ambiguous term taken on its own.

Hey, look, here's some niche API, that few people are familiar with, but blame Apple about... something. Get mad about it!

OMG.

SUCH APP.

WANT DEVELOPMENT.

MUCH RAGE.

HYBRID APP.

WOW.
IBM's announcement: https://developer.ibm.com/dwblog/2017/istio/
Why not link to something that explains it first, like an overview?
> Mark Zuckerberg: Our Biggest Mistake Was Betting Too Much On HTML5 https://techcrunch.com/2012/09/11/mark-zuckerberg-our-bigges...

I think Hybrid has it market and it makes sense for some apps, but for medium/big companies you probably end up with a native app (or a hybrid app with more native).If the app is native you can do more things in the device, there is better documentation for how to do complex things and you don't have to use Javascript. Swift and Kotlin are much better languages to use for apps. But I think the main point is that apps, nowadays, most of the logic of the app resides in the server, so the apps are only front ends. And to make a nice front end with smooth animations it is easier to do it native, because animations are different for every platform, so there is not much code to share.
You realise Russel Barkley had a brother with adhd who died in a car crash?

He's extremely negative about adhd.

There has been evidence to suggest greater skills in other areas - the research isn't enough yet as it's only a few papers. But Russel barkley always jumps on any notion of improved skills and smashes it with as much passion as he can. I can understand why he hates adhd.
Exactly.

https://en.wikipedia.org/wiki/Land_monopoly
Now the stigma is pretty much gone and tattoos are basically ubiquitous. I'd imagine future generations won't find getting a tattoo to be as exciting. I suspect the fickle Instagram generation will be much more into temporary tattoos.
If you're familiar with the black and white movie "To kill a mockingbird" the dad/lawyer wore a seersucker suit. Its hard to explain verbally, its like silk-thin corduroy. And how to explain corduroy fabric to someone not a child of the 70s.. um...

Lets just stick with seersucker is like 3-d silk but its actually very fine cotton. Its about as thin of a fabric as you can make that's not translucent.

Also traditional "real" seersucker suits were unlined although "fake" modern seersucker suits are lined.

Fitting a seersucker suit is non-trivial if done right because too tight and you'll roast and too baggy looks bad but there's this magic size where you get maximal cooling while still looking awesome. Being a cotton its so "fun" to deal with the shrinkage.

Its also not fun for the tailor/mfgr because they put a lot of work into faking thickness in the lapels. Here you are wearing something lighter than a polo shirt in total, but the lapels will be cut to appear 1/8 inch thick. Again, this was "real" seersucker and modern "fake" seersucker might be pretty warm without air conditioning.

It feels like wearing summer weight pajamas, its actually very comfortable while being stylish.

Also digital video/photo algorithms famously don't work well with the higher contrast seersucker colors.
You have to go to the standalone Levi's retail stores to get the good jeans. The stock in department stores like Macy's is lower quality
Top Gun 2 Officially Moving Forward
> So, outside of giving your data to government agencies, you're saying the worst thing Google can do is use ML to turn you into a consumer-zombie?

Or a political zombie. Did everyone forget ad-tech's role in the 2016 election?
25 Fast Growing SaaS Companies That Should Be on Your Radar
Ask HN: Where do you store the backup of your password store
I've been using a desktop based password manager for years (KeePass). It dawned on me a few months ago: I backup my password store on a personal FTP account which access is protected by a complicated password that I can only retrieve from the password store itself.

So if I were to loose access to my primary password store (say, in a house fire), I would loose access to the backup as well. I have a few copies of it on a laptop and USB drive now but if they are all in the fire it wouldn't help.

Asking to reset that FTP password wouldn't work either since my primary mail address for confirmation purposes is also behind a password that is only in the store.

The only solutions I can think of is to use a second memorable master password to protect access to the backups. (Or the same master password since if it is compromised the backups are useless anyway). Or a memorable password for the recovery address.

What is everyone else doing?
Last week, I attended PyCon in Portland. Two keynote speakers were from academia. Both speakers touched on challenges that scientific communities are having with regards to replication. One attempt to address this challenge is by using, and sharing as reference material, Jupyter notebooks (Python) used during research.
If you're interviewing at several different places within a short timespan, that could arouse suspicion.