skysight-inc/HackerNews huggingface dataset:
How did you validate it exactly? The first thing would be to validate the sha256 implementation used I guess. If it's true it's huge but I find it hard to trust a random github repo with such an extraordinary claim, especially the very vague "I developed an entirely new type of cryptanalysis theory to achieve this. It has a similar form comparing to differential analysis." Raises many red flags as far as I'm concerned.

Even if it's true I'm not sure I understand how broad this attack vector could be. Can we generate collisions for any given hash or just a subset?

Given that SHA256 is used in cryptocurrencies it makes me even more skeptical, it could be an attempt at making the market crash with some FUD I guess.
Gotcha. The gap between hobby-grade solutions and business-grade solutions blows my mind every time.
As thekaleb mentioned the creator seems to reference this symbol a lot in his games. Here is more of a back story (after some google-fu of course as I'm not very familiar with the games)

Seems like Keen 5 has it as an easter egg to reference Wolfenstein [1].

And Wolfenstein uses it since the game has a "Nazi Party" within it (if you fight them or fight with them I'm not aware of) [2].

Interesting quote from [2] "The inclusion of the swastika led to the banning of the conventional game in Germany, as cultural stigma against the swastika is high there."

[1] http://www.shikadi.net/keenwiki/Keen_5_Easter_eggs#Swastika

[2] http://wolfenstein.wikia.com/wiki/Swastika
> The next morning I woke up to a rather large number of emails congratulating me on having won almost every bid (lesson 1: if you win almost all bids you are bidding too high)

That reminds me of the economist George Stigler's observation: "If you never miss a plane, you're spending too much time at the airport".
Dupe: https://news.ycombinator.com/item?id=14655077
>would be compulsory

Well, in Russia there is no alternative. Everything, including Informatics\CS is compulsory for everyone :)

Now I'd like to the process nowadays. Because in 90s most kids didn't have a PC at home (I'm pretty sure my class had two kids with a PC including myself), so from the 3rd year we were taught how to use it at all and some games (you know that maze with a mole moving boxes to get out or something like that). Then Logo, Basic and even Internet at some point. But what now? Most kids use iPad better then their parents by the age of 7...
This is some very confusing UI.
The code sets up a sha256 state, then adds some input to sha256, and then demonstrates that the sha256 state is the same as it was.

I'd say that counts as a vulnerability. It doesn't mean sha256 is broken, but it's a vulnerability.

EDIT: All of this modulo a rigged sha256.py, of course
Interesting idea, but your own landing page is very text-heavy and doesn't have any screenshots of your landing page builder. A free trial or demo would be even better. There's no way I'd sign up for a $49/mo plan without a clear idea of what I'm buying.
Yes, this is possible, already I know with fairly large accuracy where the part is in the image and changing or texturing the background is possible. But the optical setup is quite complex and hard to replicate with a smartphone, that would need some work.
I posted this same suspicion yesterday. (https://news.ycombinator.com/item?id=14646881)

Russia is "range testing" its weapons in Ukraine.

The West and particularly the US should be very worried about this. The sanctions against Russia are dictating its policy and they have shown a willingness to escalate beyond what's been considered "appropriate" in the past.

I'll say it again here, a country will be made to surrender its policy due to crippling cyber-attacks. As has been shown in the past a western country will only fight a war as long as the citizens support it. When people are harmed and dying due to hospital shut downs, inaccessible banks, power companies offline, airplanes grounded and food shipping stalled - politicians will feel their arms have been twisted horribly but will concede. How well would Washington, DC function for weeks or longer without electrical power?

What Russia is preparing for is the equivalent of bombing cities until surrender (not the direct death, but the punish the population to cause surrender method). As far as I know, there are no international laws around it.

Best case is all sides escalate cyber-weapon "strength" to unthinkable levels and we enter a new cold-war standoff. But again, the nuke mutually assured destruction only could happen after nukes had been proven to be crippling...

The West needs to take this threat very seriously, or we'll soon find ourselves at the wrong end of the barrel of a new weapon.
The UI here is fascinating. I'm so lost, yet I'm so intrigued to keep clicking around.
This cutting-edge bandage could make flu shots a thing of the past
I didn't say that any given person was a liar or cheat. It seems clear to me that some significant fraction of the interviewing population is and I cannot tell the difference just by looking at you. So I must do something to weed out the liars and cheats from you.

I prefer to do something objectively testable and easy enough that most programmers worth hiring should excel at it. I also do what I can to reduce stress, I explain that I am human and make mistakes too. I explain that would prefer a two way dialog to a battery of questions. I also try to explain that I think requirements always have some vagueness and sometimes need clarification.

I am curious why I should be lenient on someone unable to seek clarification on requirements? Would you want want to work with someone who couldn't seek help on requirements? I have seen that person and at the beginning of my career I was briefly that person, it is not productive and can a sink project if that person is trusted too much.
I think that your company had to send its employees off to formal education in a classroom (or similar) setting is indicative of the problem highlighted by the person you are replying to. Your employees would not have been anywhere near as successful with some combination of textbook, lectures on video (e.g. on VHS), and a study group made up of other employees. Lifelong learning means being able to acquire new knowledge and skills outside of the traditional educational setting.

Often, a University will claim that its students are not there to learn specific subjects but to learn how to learn. A lot of that learning is studying and solving problems outside of lecture time. These are the skills which are lacking because of a cultural perception that learning happens in a class.
It's unfortunate that proof.py doesn't give an example of a message block that leads from h0 to the q._h constant.

I.e. Free-start collisions don't let you create two PDFs with the same sha256 hash.
Waymo’s self-driving van hits the desert to see if it can stand the heat
Unrelated question, but curious: why do your BART ads that say "I am a software engineer" have a fork bomb in faint text in the bottom-left corner?
Show HN: Ammobin.ca (canadian ammo meta seach site built using nuxt.js)
Interesting that they used ROS. I am surprised it was baked enough back then to be useable on a self driving car project.
Yep, all over the place:

https://searchcode.com/?q=ASCIIEncoding.ASCII.GetBytes%28sKe...

EDIT: ok maybe not "all over the place", but it's been done.
I've worked across a variety of industries, from warehouses to factories to big government bureaucracies to startups. I'd argue that the problem isn't that people don't have the curiosity to become lifelong learners. Almost everyone is enthusiastic about something (most people have hobbies they spend their own time on). The problem is that their workplace (and to some extent, society) don't reward curiosity.

If you're a programmer who works at startups, it's easy to think of learning as part of the job -- your tools and conditions are constantly shifting, which makes learning part of the work culture.

Unfortunately, most industries don't work that way. At a warehouse, you do the same thing from the first day you start to the day you leave. It's much the same in the government and at other large bureaucracies.

The problem here isn't with our educational system, it's with the modes in which we work. And to be honest, that's fine. Most people who work in industries that have static work conditions optimize for other things, like family time. It's also very hard to see outside of your silo and imagine a future where you're doing different work.

Most people are optimizing their life for right now, not their theoretical career 10 years out. Unfortunately, there are fewer stable lifelong factory jobs every year. This forces people to move outside their comfort zone, which makes lifelong learning necessary.

I don't have an answer to the problem, but some potential solutions are:

* Reward employees for taking time outside of work to learn skills

* Show people examples of others like them who have learned for motivation

* Find something a person is really interested in (not because it's a "valuable skill", but just because they think it's cool), and help them take small steps to start learning it

Basically, I think it's possible to help people transition to new careers further into their lives than you do. I don't think it's ever too late for someone to learn a new skill, if they have the right incentives.
5% cute and 95% terrible to navigate.

Worth noting that unlike other delays, The Model 3's target date was originally December and then pushed up. July is 5 months ahead of the original schedule!

Model 3 Launch

ANNOUNCED: MAR 31, 2016

TARGET DUE DATE: DEC 31, 2017

REVISED DUE DATE: JUL 31, 2017

I'm very excited. Electric transportation is one of the most moral technologies we can work on to get out of oil's malthusian trap. I have a lot of respect for Musk pushing the envelope as much as he can.
A 3-point plan to create tech jobs in the heartland
I hate stuff like this. I don't want to be forced to "take my eyes off the screen" when I'm in the middle of fixing something difficult or important. For fuck's sake. Not only is it patronizing and paternalistic, it defeats the whole purpose of coming to work in the first place, which, for me, is to get shit done. I'm perfectly capable of knowing and understanding my own limits, and I have my own techniques to "sharpen the saw," so to speak. I might take a power nap, or a walk or quick jog outside.

As an introvert, being around people socially at work like this drains the hell out of me. Sure, I can put on a happy face for the meeting, but it'll also take me an extra hour or two to recharge afterwards. Which is purely wasted time.

How is it "strengthening the team" when any introvert there is surely wishing they could just do their job without these sorts of social interruptions? These extrovert-centric assumptions drive me crazy, including at my current job.

Just because this sort of social extroversion makes YOU feel more connected, please don't assume that everyone else feels the same way. I feel FAR more connected to the team quietly working on difficult projects without interruption. If I wanted to socialize I'd do it on my own time and in my own way.
Nyetya Ransomware Attack Shakes Up Europe, U.S
The Rise of the Feminist-Adjacent Startup
You can google for existing sha256 collisions, nothing special in hard coding one.

Google it and you'll find the source, if it's a popular collision already published in papers.
ye like fat food and high content sugar drinks.
This is not a vulnerability in SHA-256. See:

https://en.wikipedia.org/wiki/One-way_compression_function#D...

"A notable property of the Davies–Meyer construction is that even if the underlying block cipher is totally secure, it is possible to compute fixed points for the construction"

That is all that has been done here.
Ta. I just tried it. If it's all the same with you I think I'll stick with Emacs. :-)

What I was trying to say is that these things are easier to do by hand in C than in Lisp, but more difficult to do algorithmically, and this discouraged people developing syntax-aware editors, and encouraged the plethora of competing C styles.

In the Lisp world, the difficulty of doing these by hand resulted in earlier syntax aware editors and the consensus on style.
who created this UI?
The free-food patterns don't apply on a company which is frugal by nature, e.g. Amazon
Am I the only one that finds the Boring Company the most interesting of Musk's current projects?

If he can pull off fastish, cheapish tunnelling under major cities we could see a renaissance in new subway construction in American cities.
Blue Apron significantly lowers its valuation with slashed IPO pricing
>Does anyone know how to stop junkmail?

Allow USPS to raise their prices?
that's also really interesting.

here's what i don't get: how should i weigh the risks of acute toxicity against the risks of carcinogenicity?

i take in caffeine every day. glyphosate, only rarely, and in truly minute quantities. i haven't yet ingested enough of either to die immediately.

but have i ingested enough of either one to get cancer? is one a more powerful carcinogen than the other, taken in the quantities i experience? etc
Does that mean the UI actually works?
You actually don't need parentheses--you can use whitespace. You give up the ability to add N arbitrary trees/nodes to one line, but in return you get beautiful, geometric code that's easier to reason about at scale.
Nah, it's not that simple. It cannot be that simple (but that's just my intuition of course). I do have a different mindset when my blood flow it strong after sport but it doesn't kick the creativity. On the other hand, travelling, or even taking the train, does trigger the wonder-sense.
Oh wow, now that is really bad. I would assume that would have to be a bug, but it seems like a pretty massive thing to overlook.
Created on FrontPage
The sha256.py in the attack repo matches https://github.com/thomdixon/pysha2/blob/master/sha2/sha256..... up to whitespace. I have not sure that it matches the NIST spec, but it matches wikipedia on emptystring...
Yes, but the rigged sha256 seems to produce the same results as a real sha256. And there's nothing obviously hinky in the code that I can see on cursory inspection. If this is rigged, it's rigged in a particularly clever way.

[UPDATE] Turns out this is not a vulnerability at all:

https://crypto.stackexchange.com/questions/48580/fixed-point...
It's a real pity, Dan was a super nice guy with his heart in the right place, the present owners are not in any way approaching this in a nice way.
Original DOOM 2 disks / 3.5&#034; floppies / PC
I don't have time to look at the details of this particular incentive, but I know from personal experience that many R&D tax credits do not require earth-shaking research to qualify.

I own two SaaS companies that have received R&D credits and I'm also an investor in a few other businesses, including an injection molding company, that have received R&D tax credits. The injection molding company mostly makes cups for gas stations. Which is not exactly quantum computing.

I used the same company to get all of the credits. They had a staff of tax attorneys, accountants, engineers, etc. that worked with us to see what we could qualify to receive. They looked at about 30 different programs to get tax incentives or reduce expenses. And they worked entirely on a contingency basis, where we only paid them a percentage of what we saved. They were very accurate in their initial assessments, and we have not been audited since receiving the incentives (/knock on wood/)

At one point, they commented that the bane of their existence (as tax incentive specialists) was misinformed accountants that thought you had to have an army of lab coats or a clean room in order to qualify.

I would agree, however, that Gusto is trying to drum up business.
It's not a concern at all. This is not a vulnerability.
- If you're a HackerNews reader you can probably figure out a technical solution to hide it fairly easily.

For sure. Hiding the panel was done within minutes of realizing that Google didn't provide a way to either redefine/block who fact-checks or remove the panel altogether. That doesn't change the point that Google should have provided a way to hide the panel for those who don't want it.

- Being able to choose who checks facts is pretty much the same as being able to decide your own (alternative?) facts, which is the problem they're trying to solve.

They're trying to solve a problem I didn't ask them to solve. I'll do my own fact-checking.
The concern I usually hear is not around the learning to program aspect. Instead, it's that fact that almost every other entry-level programmer is a college grad, and that hiring processes will be biased against older candidates.
On commercial pecan farms, the nuts need graded based on color, size, and variety. Currently, pecans are tumbled in rotating chutes composed of grates of increasing spacing, so that pecans are sorted based on size. Color and variety are not filtered, ultimately resulting in a lower sales price for the farmer. Your device could take this type of sorting to the next level.
These have packaged the process and tools but no one can tell you how to do it for yourself. Because at up to an expert level it is still a set of tools you use.
A lot of the advice/terminology: 'fast smoke tests', 'google ops stack', 'host your status page elsewhere', choice of load balancers, etc.. is stupid-hoc.

Do yourself a favor if you are going to do devops practice.

1. Write it from scratch.
2. Make it work no matter what happens before and after calamity.
3. Write the docs.
4. Leave it to beaver.
a rigorous "theory of change" (of the kind used by charities and the third sector) to decide on potential impacts and side effects

I see. Sounds like "very rigorous maritime engineering standards".
Duplicate https://news.ycombinator.com/item?id=14654696 .
I think you're confusing SHA256 with SHA1.
Teens weigh in on whether Apple is cool
BadicLly any profession with high levels of credential based regulation and supply constraining that reduces competition.

Dentistry is a great example that forbids even simple procedures to be done by non certified practitioners.
I'm amazed at this decision. Let's look at it in context:

--CBS wants to present a modern crew (modern to today's standards).

--CBS wants to have a female captain (showing diversity)

--CBS wants to have a black captain (also showing diversity)

But here's the rub. CBS now wants to show that it's leaders are more human than perfect, and show them in a negative light (not all the time obviously).

Pu that together, and you get that CBS is presenting a black female captain who is not as strong as the white males, black males, and white women before her.

I don't get it. Diversity is obviously a good thing, as Gene had a beautiful dream about racism being eliminated. Showing people as more human is understandable, even though Gene thought differently (I have no position on the topic). However, if you really want to promote diversity, why is the first time you decide to show leaders in a negative light also the first time you have a black female captain.

Am I being too sensitive, or do you think this will cause issues, too?
Travel... sleep on the beach... drink the whole weekend and show Monday to work, straight from the bar... fight with the police... have all the fun you can get, do all the crazy stuff for the next few years, because once you get married and with kids, you won't be able to... There are no memories from money in the bank and from sleep... Enjoy!
Phil Jackson Is Out as Knicks President
Plus the bridge of one star destroyer which we've also seen as potentially disastrous for the ship.
"due to complaints from EU-based comparison shopping companies who claimed Google was unfairly suppressing their results in general Google search"

Replace "comparison shopping" with "image search" or "text result answer".
Heck, replace it with "marketing spam company".

It's nonsense. This is why the US definition involves "does this harm consumers", not "does this harm businesses".

Businesses are harmed anytime anyone competes.

This is one of the reasons that the west tends to view the European approach to antitrust as "making it up as they go along" and "targeted at non-european competitors". Because they pretty much never go after european companies, and the rulings seem completely arbitrary depending on the whims of the current commissioners.
Funny, I think it's part of a semi serious "brutalist" trend I've seen pop up these days. Taken to the extreme there.
None that I would use in production (as a sysadmin)
He pretty much has to respond positively. Otherwise people would shit all over him for not being a "good sport."
The foundation of the movement is getting rid of ops.
"There's a lot to be said for sticking through a few months of uncertainty when it works out to be a great job in the long run."

This. You have to know when to hold 'em and know when to fold 'em. It's not easy with startups to decide which way to go due to the uncertainty inherent in new businesses. I would tend toward hold if the following is true:

1.) The company is meeting a real market need even if it's not doing it very well. The tell: customers 'get' the problem you are trying to solve and want to talk to you. If they stick around but complain a lot about the product that's actually a good sign.

2.) You can afford to lose your job. Getting to a payoff involves some tolerance for risk. Investors take the same risk with their money.
That, and you'd waste a ton of time because in such a re-run you'd be looking for a very limited number of parts from a much larger bin. So in the end you'd run around with bins rather than picking the parts from pre-sorted and binned by color and type parts. Either way it is a boatload of work.

The closest I've come to this is where you identify which sets are present in a batch by doing a trial on a sample (that's a pretty easy statistical job), and then sort directly into sets starting from the largest sets down. That way you reduce the parts count very rapidly. So, I did this for a bit and now have 18 60 liter crates of almost complete sets which all need to be manually completed and checked. Again, not profitable.

If you just want to do this to keep busy it is easy, if you want to make more than what you could make by flipping burgers it is surprisingly hard.
Obviously bankers
Help me understand what you believe the problem is with the gap that exists when the notebook is closed.
Ah, great link. I was not aware of this "feature" of SHA256:

>To abuse this property you need to get the state of the hash to match a state you get when running the decryption of the blockcipher underlying the compression function. Finding such a match requires a meet-in-the-middle attack with cost 2n/2 and thus isn't cheaper than finding a collision.
laie makes it sound like they found two things (free-start collision attack and circular hash attack).

I agree the free-start part isn't very interesting but I don't think we have enough information to confirm or dismiss whether the circular hash attack part is novel.
Netscape and Sun Announce JavaScript (1995)
At some point you can completely reverse entropy and re-create the original sets :-) But in terms of just selling off excess Lego looking at the mix of the builder sets would let you figure out a sort of SKU you could put together and sell on Ebay or else where as a 'builder pack 1', 'builder pack 2' etc.
Is the Brain Augmentation Hype Justified? Here’s an Expert’s Take
I would much rather see all bills and amendments put under a public version control where everyone could see who is adding what in real-time.

This transparency would really help out democracy in my opinion.
IIRC dnsmasq still listens on all interfaces for some reason
I think the resources of the employee are more the constraint than the manner of education - especially on the low end of the salary scale, both money but also available and/or ofsettable time. Without support of the employer, especially hourly employees would have a much more difficult time re-training.