skysight-inc/HackerNews huggingface dataset:
Stolen Ethers from MyEtherWallet and IG:shanefr0mmaine
This is the story of my stolen ETH from MyEtherWallet and the culprit:

This morning I tried to enter the BAT ICO using MyEtherWallet. I had 20 ETH in my account. Later this evening, I wanted to transfer my ETH away and to my dismay, they weren't there. This was strange. This led me down a pretty interesting chase.

This is the account history of MyEtherWallet account: https://etherscan.io/address/0x7aaafe93355498af4E6Bf33267168c4e5E27408C
A transfer in, two attempts at BAT ICO and a tx-out for 19.88 ETH: https://etherscan.io/tx/0x21fcf9025650b3e8bc68da56c1e1755869ee754da8bce29255500a89710280a4
The last transaction out was the fraudulent one which I hadn't done.

Who was this transaction to? An account with hash of public key: 0xe847F9abc3C8986De276648224E916821BD7D68f. This account basically sends the transaction forward to another account 0x8271b2e8cbe29396e9563229030c89679b9470db. A quick scan of the transaction reveals that this account is receiving a lot of transactions constantly and currently has over $1.6M in ETH.
Who is this account transacting with? Well, some of the connected accounts (outgoing tx) have similar amounts of ethers – emptying accounts all the time. This is HUGE and been going on for a while!

Who owns this fraudulent account? A quick Google search and I land on a Poloniex conversation between zyplok and smallbit concerning a microtransaction from the same account gone awry. Zyplok owns the account. Who's zyplok and what does the internet know about zyplok?

Well, a lot! For starters, Zyplok.com is a "bitcoin mining" system run by IG:shanefr0mmaine. A few more searches later, the github (https://github.com/ar7ik) and an address in Portland, Maine.

So what's next? While zyplok depletes a ton of accounts, I'll report the activity to Poloniex, Kraken and the other exchanges. And zyplok, if you're reading this, can I get my ETH back please? (new address: 0x8D707851d45Efcc6553fF4ABfE93B20003920aab)
I've always wanted to try one of these out since hearing about them a few years ago. Does anyone know of anechoic chambers that people can tour, specifically in the Bay Area?
"Meanwhile, in the Soviet Union, Nikolay Basov and Aleksandr Prokhorov were independently working on the quantum oscillator and solved the problem of continuous-output systems by using more than two energy levels. These gain media could release stimulated emissions between an excited state and a lower excited state, not the ground state, facilitating the maintenance of a population inversion. In 1955, Prokhorov and Basov suggested optical pumping of a multi-level system as a method for obtaining the population inversion, later a main method of laser pumping."

https://en.wikipedia.org/wiki/Laser
The primary task of a programmer is to abstract, not instruct. But everyone does that also.
Yeah, still rolling out.

As for extended memory, as I clarified elsewhere, while you can make a 2x24 it won't be saving you money compared to having the cores. I forget if this is made clear in the docs, but via the API this is laundered through machine types as custom-2-24000-ext.
I think the rule is not very precise written down (e.g. I do not believe that a firefly nudges its clock multiple times within one cycle, just because it has multiple neighbors).
Ummm, most modern cards can go far above 5000 miles, and definitely longer than 2500 miles. If you have an old beater from the 90s, it might be a good idea to change it every 2500 miles but definitely not any car made in the past decade.

https://www.edmunds.com/car-news/tips-advice/stop-changing-y...

"One GM car Edmunds drove went 13,000 miles before the monitoring system indicated the need for an oil change. We sent a sample of that oil to a lab for analysis. The results showed that the oil could have safely delivered at least another 2,000 miles of service."
I veer back and forth between thinking that this is absurd and that it makes good sense.

To wit: someone proclaiming "I'm a doctor" or "I'm a lawyer" and then providing medical or legal advice, without a medical or law license, probably wouldn't be too surprised if they got into trouble. It wasn't that long ago when being an engineer was in the same class. Saying you were an engineer usually meant that you had qualified as a Professional Engineer, which in most states requires work experience, a mentorship or internship with a practicing PE, and a knowledge test.

Today, just about anyone can be an engineer. Heck, I call myself one most of the time when people ask me what I do. I've asked around my office, and we do indeed have two or three PE's out of a thousand-odd "engineers"; all of them are in their 50's.

It feels like the engineering societies are fighting a rear-guard action, when they should have gotten ahead of the game if they really wanted to protect the term. Much like Realtors(TM) have done [and yes, the word is trademarked by the trade association and is always supposed to be capitalized]

However -- the real absurdity is that he was speaking on his own behalf, not falsely representing or advising clients for money. To me, sanctioning him for doing some solid math and physics is ludicrous overreach, and clearly the court agrees.
At Logan, your face could be your next boarding pass
I cut you off because you basically said "and if we see this thing that is defined as invalid, we treat it as invalid". Which is something that all UTF-8 parsers do, so there's no point in calling it out like this is special behavior.
I'm sure the victims of the insignificant terrorist actions within the US take comfort from your categorization.
One of the things I miss from growing up in rural Virginia.
As tptacek points out elsewhere, if this is a concern for you, just use SHA-512/256. It's just as misuse-resistant, practically guaranteed to be in any library that would bother to implement SHA-3, faster by a mile, and has been the target of significantly more cryptanalysis.

There are zero practical reasons to choose SHA-3.
How We Built Smart Voice Activity Detection Using Adaptive Custom LanguageModels
No, you're right in that it's perfectly legitimate for multiple parsers to behave differently here. But if there's one behavior that nearly all parsers have standardized on, that's very valuable because it makes it a lot easier to use two different parsers without a problem.
Ask HN: Uber account hacked, what is the way to resolve?
Hi, My account has been hacked, email address, phone number and name are changed. Charges are being made against my credit card from Russia. When I email support they say my email address do not match (duh!) and mark the issue resolved! Any idea what to do ? I have cancelled my credit card. How to convince Uber that its actually been hacked ?
I've heard rumours that, in contrast, the laserdisc release had the actors' commentary au naturale -- it's almost worth trying to hunt down a player and a copy, as I've never seen a rip published.
And most likely more ride-sharing companies should be supported (included whatever Waze ends up becoming).
No, m4 (mostly) is a specific architecture. There were things before it like m3.

I'm not saying it's hard to understand what to do when new ones come out, but for each architecture there's a new machine family. GCE has only historically provided n1-whatever and you got whatever CPU platform we had in that specific building.
I would also add that drivers shouldn't be getting extra as right now drivers aren't the ones subsidizing the lower prices.
That's probably why it's so successful. Pockets get lined and the deal is seen publically as a moral victory.

It would be politically hard to oppose the arrangement without looking pro-Tobacco, or at least without getting smeared that way by the beneficiaries...
> I mean, I could just as easily call German separable verbs "particle phrasal verbs"

Not really, because particle phrasal verbs exists primarily in English, with apparently a small handful of occurrences in some Romance languages (such as Lombard or Italian).

Your argument is basically "if I call this one thing by another name, I can pretend it's actually something else", but you can't actually do that because that's complete nonsense.
Although culturally Turks prefer the middle asia hun and monolian origin narrative, they are genetically mostly descendants of the anatolians who happened to live and breed there already for many millenia. Those people didn't suddenly disappear. This contrast between culture and genetics is confusing to many turks (me included)
I don't know about other cities but in teh Bay Area prices are pretty evenly matched.
Following house of cards? US elections? Remember WW II? Where they had just a tiny bit of info on a specific group of people (their faith, and registered address) and used that to the max to commit genocide on them?
Think that'll never happen?
Question to the Muslims on HN: how do you feel about having all your personal data stored by corporations and the government?
A device using the linux kernel (or Mach kernel in iOS) doesn't make it a "Unix" or "Unix-like" system, despite that same kernel being used in other truly Unix-like systems. The user land (aka GNU in most Linux distros) is what makes it a Unix-like system. That doesn't mean GNU isn't relevant, it means what you considered a "Unix-like" system was overly broad.

This reply is a bit overly pedantic and I apologize, but you kept pushing so I wanted to clarify.
No it's not.

What defines a language? In the absence of context, I can't give you criteria for where the line is between a language or a dialect. But that doesn't matter, because the most important definition for "what's a language vs a dialect" is "how is it perceived by the world?". If the entire world thinks that Spanish and Portuguese are different languages, then they're different languages. It's that simple.

This isn't circular because I'm not saying "they're different languages because they're different languages". I'm saying "they're different languages because people say they're different languages".
Yes, my rant tag was trying to be a subtle admission of the bias.

I'm sure there were some good aspects of the MSA that I failed to mention. The restrictions on marketing is one that comes to mind without a lot of thought.

I think the biggest problem (that I remember) was money getting allocated to pay for things other than programs to help the original victims.
"Many" is untrue. I'm a huge Java fan but FX never picked: https://www.codenameone.com/blog/should-oracle-spring-clean-...

Enterprises still use Swing and some have touched FX as Swing is in maintenance mode and they don't have a choice.
Capitalist, so called "meritocratic", system doesn't actually value education or knowledge, it values ability to convince other people about being educated or having knowledge.

There is of course nothing wrong with doing one thing for years. Japanese built a successful, innovative economy just around that.

It's just another form of self-deception. You have 1 year in 20 different skills, therefore sure you must be more productive than the human that has 20 years in one skill.

Guess what - likely not.
It really depends on the country from which you are calling and country to which the call connects.
Letter: Wonder Woman
That would be a dangerous precedent.
I'm not sure labeling as "crazy" is fair or helpful. These substances are addictive and many people got them prescribed by their doctor whom they trusted.

Lab experiments with rats might be pointing is towards what we have to do to mitigate this at least somewhat. Experiments showed that rats in a healthy social environment are much less prone to opioid addiction than ones living in isolation or having lived in isolation. See https://en.m.wikipedia.org/wiki/Rat_Park. I finds it easy to imagine that the same is true to some degree for humans. I wouldn't be surprised if the effect was even stronger on humans. We are very social animals after all.
Microsoft and Qualcomm Announce Always Connected Mobile PCs with Snapdragon 835
You said it yourself, though. You were more productive by LOC but you weren't more effective. There's a reason we don't start out as senior devs and regress into juniors as we age. The more we know, the more we know about the things we don't know.

At the same time, don't let that experience weigh you down. Try to embrace breaking out of your comfort zone like you did when you were young.
That's not me.

The point is that this variant parser accepts many things that are normally errors and turns them into faux-surrogates, so it's worth restating that it rejects surrogates in the source file.
It should be quite easy to see the value of optimizing compilers. Compile your program with optimizations turned off. Now make it as fast as your release build again, while still keeping them off. For much of my code, I think this would take years.
A cryptographic operation making sense to you doesn't make it reasonable. H(password) makes sense to a lot of people, but we're not going to sub in Argon2 for every use of a hash function as a result.

I'm with you on BLAKE2 as a solid choice, but at least it has an advantage in some areas over SHA-2 (speed, margin of security). SHA-3 has no advantages over SHA-2 (particularly SHA-512/256, which is going to be available in any library that would bother to implement SHA-3).

SHA-3 is slower, has been the result of less cryptanalysis, has less battle-tested implementations, and is less widely supported. Practically the only thing it has going for it is a higher number.

You will be hard-pressed to find a respected cryptographer advocating general adoption of SHA-3 — being in the field, I'd wager you'll find 100 who encourage developers to choose SHA-2 for every one who backs SHA-3. Case in point, in this thread alone you have Colin Percival and Thomas Ptacek coming to the defense of SHA-2, not to mention Adam Langley authoring the original post.
> ...it values ability to convince other people about being educated or having knowledge.

This is just life in general.
ONElogin... there's your problem right there.
You want to use setImmediate rather than process.nextTick.
Where's HN Stories?
No, partly because fireflies take a certain amount of time to "charge" so jumping mid cycle might not be plausible physically.

So what this line does (which is in the section of code where a flash alters the fireflies around it) is that after advancing the other fireflies clocks, if any are over 1 then it puts them in the right state to flash on the next time they're evaluated. If you mod it, then you would have the logic:

"if I'm a firefly and see my neighbour flash while just about to flashing myself, don't flash but reset my clock to part way through the cycle"

rather than

"if I'm a firefly and see my neighbour flash while just about to flashing myself, flash as well"

Edit - setting it to one ensures that each neighbour can't keep adding to the clock, advancing it to a random point in the cycle.
Acquisitions? Lobbying?

An acquaintance started a mapping company, and Uber snatched it up almost overnight. Although I expect a lot was paid in stock, which isn't included in these losses.
I disagree with your first point, if you're using Instagram you're accepting it will be using a lot of data. Further, part of the thing that makes Stories a great feature is the smooth storytelling that would be lost if a "Download this video" button appeared.

I completely agree with your second point however. Make it more like Snapchat and have both types of direct messages; ephemeral and permanent.
> They are looking for tiny vibrations that are produced by capacitors on electronic circuit boards as current passes through them. These can make the components on the board produce annoying hums that can be off-putting for consumers.

I'm so glad to hear Microsoft is taking that serious. Do you still remember the humming capacitors of the very first MacBook? Awful. Or the ones we still get nowadays in USB power supplies and other cheap gadgets?
Ohhh old school, FLIP was fun! David should upgrade to APIC.
TL;DR "Optimizing compilers are still good to have because they are cheaper than programmer labour needed for hand optimization"

The original DJB presentation, which this is a response to, is very good and interesting.

It would really be nice if the field of compiler engineering started to address the obvious neglected areas, like optimizing memory layout and data types/representations based on partial evaluation / profile feedback.
It's always about cashing checks.
Mark Zuckerberg is in love with the coco coco
This looks awesome. Finally I can get a chance to sample homemade cuisine.

Keep it up ...
Not really any details in that post. As a company offering a Cloud IAM I would expect some top notch security and while I understand that doesn't mean they would be "hacker proof" I'm surprised they need to go through an independent firm just to figure out the how and the extent of the intrusion.

This happened less than a year ago, too! https://www.onelogin.com/blog/august-2016-incident
KSP doesn't have Lagrange points.

I mean, it's understandable, the n-body problem is hard.
https://reek.github.io/anti-adblock-killer/

Or use uBlock Origin, which supposedly has it integrated (I'm not sure, as I'm using AdBlock Plus)
Wrong and wrong. I took one to the airport today, I called thirty minutes ahead, and it cost less than a metered fare.
I took a look. What level of critique do you want?

I think with a decent amount of effort, you can out-compete (as a product) all existing solutions except HelloSign. However, I would expect to run into serious issues convincing companies to switch. You would probably want to specifically target the new company / tech-savvy startup market, which I think are very underserved by the painfully antiquated leaders (DocuSign, RightSignature), who are targeted towards people who feel more comfortable with "enterprise"-style solutions.

Our major issues were:
- We needed to provide our own styling, etc, for integration on a responsive website. Existing iframe solutions used the provider's styling, and did not work well on mobile.
- We expect to send out many more documents than get signed; thus, HelloSign's per-API cost would be to expensive for us.
If length extension attacks are a problem, you're using a hash function for something which a hash function is not intended to be used for; you probably wanted a MAC instead.
Don't go roamimg through old bitcoin threads on Reddit then.

You'll find grave yards of people that panick sold during the Mt Gox meltdown. There was this one guy who dropped his entire life savings on bitcoin when it was $850 and then sold at $350. I think the math turned out to be in the multiple millions had he held the same amount today.
My apologies.

In any case, here's what OP said:

> Well, that's not the full story: to have this transparency property, we also need to ensure that when some U+DCXX occurs by means of a valid UTF-8 pattern, we nevertheless treat it as invalid. I.e. there is a rule that if the UTF-8 decode works, but a U+DCXX code-point emerges, then we retreat to the start and drop a byte as a replacement character, as if a bad code had been seen.

But this whole paragraph is wrongheaded. A U+DCXX codepoint cannot occur as a result of a UTF-8 decode, because it is defined as invalid. Even just that last bit there, "as if a bad code had been seen"... a bad code was seen! This paragraph makes me question whether OP actually understands UTF-8 decoding at all.
https://github.com/yudai/gotty is a good place to start figuring out how they're implemented (tty streaming server + termjs type thing).
Mexico in the Full Light of Day
> taking increasingly more challenging and essential roles

What is a "more essential" role? Higher in the company hierarchy? I would bet that a guy who knows how to fix 20 year old system, behind the scenes and without fanfares, is probably more essential for your business, than just another suit talking bullshit like he did in his last gig.

The problem is right here - there is no "essential". There is only work that needs to be done. It's always better to have somebody who has deep knowledge of the problem to do the job. And it takes time to get that knowledge.

There are no shortcuts, like, doing "high-level" things. No, you actually suck at your job, because you have superficial understanding, you just reframed so it wouldn't be obvious.

I am not against people doing high-level things. What I am saying is that being tricked into thinking that this is somewhat more important, though, is at the core of this stupidity. It isn't more important, it's a trade-off.
Interesting choice — I love the NYT Public Editor's work and was actually just about to add her column to my media literacy / filter bubble project, Read Across the Aisle. Many people have never heard of a Public Editor and have no idea what the position entails. From a media literacy standpoint, this column offered a behind-the-scenes look at why certain decisions were made, how journalistic standards were applied, and the pros/cons of alternative options.

In this time of political discord and journalistic polarization, I am surprised and disappointed that such an esteemed paper would decide this position is no longer necessary.

I hope the NYT keeps the existing archive online, and frankly I may still add this archive to my media literacy app — even though the underlying stories would become increasingly stale over time. IMO, it is that good!
I'm disappointed at the lack of figures.
I think the use of an independent firm is supposed to reassure everyone that they are taking it seriously and aren't going to brush it under the carpet. It's the same reason why companies use independent firms to do penetration testing etc, rather than simply stating that these are managed internally.
Final Cut Pro 10.3.4 Mac Cracked – Crack4Mac
I had the chance to tour this room and it is a pretty cool experience. It's not like it's completely silent - when you speak or make noise you can hear it, but there are no echoes and everything is just kind of muffled. You hear the sound and then it quickly disappears, very similar to how you hear when your ears are pressurized right after take of. It's like taking the flavor out of voices, or making a picture/video dull.

The coolest part was when they turned the lights off and locked the door. The only thing you hear then is the awkward movements of other people as they make noise just to make sure they still... exist.
I do sometimes wonder about giving every customer separate databases and putting in firewalls (of varying kinds) between each piece of infrastructure, using vault to manage and grant access, check summing changes to peoples accounts (and possibly requiring some obscure system for reading info in each database), and in the end making everything very difficult even if a hacker gets root access to one machine, say, inside your application. Ideally they wouldn't have access to everything.

I'm terrified for example of taking in copies of peoples Passports or Social Security Numbers as part of creating Stripe managed accounts; I'm responsible for confirming they are who they say they are, fine, however I don't want to keep copies of passports lying around on my servers forever. Is it sensible to delete them after they have been reviewed by two people? Should we encrypt them after use and store that encryption key lookup in a separate instance of vault on a different network/AWS account?

Firstly, startups don't have the resources usually to dedicate to these things and secondarily there seems to be a need for a standard set of principles in building less hackable applications. Getting behind the giant metal door should not be enough to become completely compromised, but is there a solution, guide or standard or once I launch am I constantly going to be looking over my shoulder wondering when the breach will happen at Stripe or Google or my own company? It's only a matter of time right?
Effective Tensorflow for non-experts (Google I/O 2017)
For $499, a Drone for Beginners
Thanks for the save -- I can see my email in my profile and assumed it was visible to others, too.