skysight-inc/HackerNews huggingface dataset:
So, basically, we're going to run all your code at ring0, so a single bug is now either a total DoS (kernel shuts down) or an exploit vector straight to ring0. Although they talk hypothetically about a defense for that involving the MMU, this is not implemented in IncludeOS.

The build should not be relied on to be secure either; certain classes of memory disclosure bugs could leak out enough memory to let you work out e.g. a ROP payload, which wouldn't require injecting any machine code necessarily. Plus, a long-lived machine, or a single instance deployed across many machines, would present insufficient diversity to protect against a determined attacker. The gist here appears to be the notion that their build diversity gives them most of their security, while they've eliminated most of the traditional defense layers (ASLR, DEP/NX, privilege separation, API isolation, etc.)

If the attacker gets her machine code running in the unikernel environment, it's game over no matter what. The machine code can just directly implement a subset of needed functionality without having to call out to unikernel functions.

In short - this post has a hell of a click bait title but really insufficient evidence to suggest that these are truly "secure".
Yes. It does.

Someone noticed that the 4 of the 7 hostnames that were assigned for authoritative names servers for .IO were available for registration. They registered them, and started receiving DNS lookups for .IO hosts from what appears to be actual internet users. Since the user had 4 or the 7, its possible that the majority of DNS lookups for .IO hosts would be sent and answer by the author's systems.

The author could have started replying with malicious lookups. "Oh some-sexy-saas.io? yeah, that's [evil IP]." "oh, billing.otherapp.io? what a surprise that site is also available at the same [evil IP]!"

How could .io sites have avoiding getting spoofed? HTTPS + HSTS would prevent the author from spoofing the DNS of that those sites and sending them to a server over HTTP thus avoiding the certificate errors.

update: I overlooked that sites would also need to leverage Public Key Pinning to be protected, since getting a valid DV cert for a spoofed cite when you control DNS would be likely.

https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
PowerBI is the best example, Tableau's stock price dropped 50%+ last year and I am convinced a big part of that is Microsoft stepping up their game in the analytics dashboard area, I covered this in my blog too. It's difficult to make predictions and if you are using these software solutions the only way to protect yourself and your organization from sudden changes in the market is to adopt an architecture that is as modular as possible. No software package or SaaS should be mission critical to run your business unless impossible to avoid to do so (ie Excel in finance).
>There is no "right to purchase an electronic device without replaceable parts".

It's part of living in a free society, which means you have the right to do what you want by default.

So by default, yes, you have that right to free exchange of goods and services.
This is semi-localized. You can have all of that on 40k. Delaying kids is wise for pretty much everyone, though.
https://en.wikipedia.org/wiki/Provable_security

You can prove that it's secure in that the algorithm itself does not leak information.
Yes, your initial summary is my understanding as well. Basically, top-level domains use fairly arbitrary domains as authoritative nameservers (in this case ns-a[1-4].io), and the company that manages all the .io registrations (101Domain) was allowing any arbitrary user to register four of the seven nameserver domains. So a malicious user could have purchased all of them and pointed ALL .io domains to any arbitrary server (for at least 4 out of 7 DNS requests).

It can't really be mitigated at the user level but it's already been mitigated by the registrar. Still though, jfc.
This song has lsd all over it
Market forces sort a lot out given time. The first iPhone was only 10 years ago. You didn't have to be an iOS developer. At the same time you don't have to be one in the future unless legislation comes along to force you to maintain your apps.
> In San Francisco the housing shortage and lack of support for new construction wipes out a lot of gains that come with higher salaries.

You can even see that problem get worse as people leave. Fantastic dev I worked with moved from Seattle back to India. She said that yes, she made more money in Seattle, but cost of living was so low in Bangalore that she effectively made a lot more money there. Coupled with her family being closer, it made perfect sense.
So that user(studio owner,musician,etc) select the instruments or equipment that they have, maybe as autocomplete.
Of course they did. But what can you do when Google and Facebook command almost all of the traffic on the internet?
Ask HN: How did you find projects to contribute to that were not your own?
It is well-known that contributing to other people's projects (e.g. open source) is a great way to get some experience. How have you found projects to contribute to in the past?
Infographic: Blockchain Opportunities for Every Industry
That's not fair to the manufacturer. No company on Earth can fix security holes in every version of their software that's ever been released. It would take a small nation's GDP to do that. Even Linux doesn't fix security holes in old versions of the kernel.

What this would cause is for there to be one "product" such as "Windows" that Microsoft keeps up to date forever. They release patches and you apply them. The version never changes and everyone's machine is running the same product, but some of them are out of date and could be updated easily via Windows Update.
I've always seen it written "Mac" and not "Mc"

You are right though: https://en.wikipedia.org/wiki/McMansion
Because when the question asked is, "Why is this story on HN?", there's no way to tell whether you're asking "Why is this non-technical, non-belonging story here?", which is highly disfavored, and "What precisely interested the submitter about this story?", which is, well, not terribly important.
I described what I actually witnessed happening to my children in supposedly good California schools. It fits a pattern that has been frequently seen over a long time with a variety of technical subjects that were pushed to schools, starting with the New Math debacle back in the 50s and 60s.

I'm glad that you personally had a better experience. I believe that I described something closer to what we should expect to happen with such initiatives.
Then building a business where you stick all the employees in a distraction rich open floor plan.
You're exhibiting either a woeful lack of knowledge about medicine, or you have a particular axe you want to sharpen repeatedly here.

1) Medical doctors (including psychiatrists), police, social workers, judges, and other trained personnel all can lock someone up for a brief time (and with all sorts of legal protections and due process) if:

a) They are a danger to themselves or others.

b) They are unable to care for themselves.

Please tell us your alternative plan for dealing with those issues.

2) I'd love to be drill a hole in your well-protected cranium and stick a needle in your brain to obtain a sample to diagnose major depression, schizophrenia, or PTSD. Just a small sample, ok?. Let me know if you're ok with that. And if you think there are "objective biological tests" for most common illnesses that are diagnosed and treated, day in and day out, by physicians, I'd invite you to accompany me to clinic where, off the top of my head" we'll see tons of upper respiratory infections, real chronic pain without any demonstrable pathology, "ear infections", etc. This is the bread-and-butter of primary care physicians, and we don't order "objective biological tests" in order to diagnose and treat "medical illnesses" - in many cases because the tests simply don't exist, or are too expensive or too invasive.

But perhaps you'd care to explain to the sufferers and their families that we can do nothing for them without your "objective biological tests".
Misleading title: it isn't about the Polaroid (POHC) but rather about relying on regular (sometimes relatively infrequent) ’snapshots’ of a firm's performance.
easy way to mine them?
What's with the one char classnames? Are these auto generated?
Treat this like:

> I was able to hack/gain control over the majority of the servers that serve up authoritative information about who owns what records on the .IO ccTLD.

A "poisoning" if DNS is serving up untrue information via DNS records. This could point your bank site to a phishing site, or it could just point your bank site to a blackhole (or just point it at Google.com or something).
While a company has to give you a few weeks notice in Germany (unless you're fired without notice because stole something etc.), they can simply send you home with pay if they don't need you anymore or don't want to let you near sensitive data. I've seen multiple people who were fired and told to clean their desks and go home (but they weren't escorted out). But a least they got some paid time off to search for a new job.
Automate Your Affiliate Marketing Efforts [podcast]
You can access the other languages column using the icon below the title of the article at the top.
According to the source study these are the things they count as "homeless", 14% have at least one of the items below...

Any of the below items:
– Thrown out of home: 6%
– Evicted from home: 3%
– Stayed in a shelter: 2%
– Stayed in an abandoned building, auto, or other place not meant as housing: 4%
– Did not know where you were going to sleep, even for one night: 8%
– Didn’t have a home: 2%

I think any of those are VERY BAD as far as impact on academics is concerned. Whether these actually constitute "homeless" is perhaps not the most important issue.
But VNC is video streaming, right?

What are the instruction being sent to the browser? "paint this text" here, "paint this surface" here, etc?
Phew! Thanks.
Yes, track cyclists do indeed lift, but it seems OP is an endurance cyclist.
Heh. I think they tend to phrase it ".. so as to appear to have taken leave of [their] senses", to leave open the possibility of sanity :)

http://www.uniset.ca/other/cs6/2001EWCACiv789.html is a good example of a case where a government decision was overturned on Wednesbury irrationality grounds. (Ctrl-f for "judgment of the court" and start reading there)
That a new fridge is more energy efficient than an old one is not the point, because, of course, you can always choose to have a new one while the old one still works, for whatever reason. The point it: that things was built in a way that it lasted 60 years.

This is not only about electrical stuff, but also, say, simple mechanical kitchen tools: they break easily today. Like a cheese grater. The one my mom has is 50 years old and almost as good as new. Stained a bit, maybe, but works perfectly. She got it from her mom as a present. It's sheet metal, relatively cheap stuff, but still decent enough quality made to last long. They tried to make it simple, durable, and affordable.

Today, you can choose between cheap things from plastic, which will break soon, or fancy polished shiny stainless solid steel with bells and whistles, which are really expensive and which may last a wee bit longer than their plastic siblings, but these things are still made to look good, not to last long. You can bet there are small plastic pins hidden somewhere that break off soon, probably due to some unnecessary bell or whistle. This is the pain of today's products.

[edit: language]
When AI tries to be human things get weird.. this whole project, not just the TedTalk

https://youtu.be/ZvzQ1gHTng0
No, the web browser is all-righty. It has become the universal VM, so it's only natural that it is as big and slow to compile as an OS.
Not to mention that many are owner-operators, meaning they own the truck itself.

This may slow the adoption of self-driving trucking for smaller companies (many larger companies do own the truck), but it will hurt the drivers that much more when it happens.
This guide will be relevant until OS compositors fundamentally change from just dealing with bitmaps. Which is unlikely to happen anytime soon.

And doing UI layout on background threads breaks the basic design of pretty much every UI framework, web or native, which are usually single-threaded.
Show HN: A customer service tool for ticketing, self-service and feedback
Are you using Zendesk or something similar?
We created Helprace: http://helprace.com

We tried to kill many birds with one stone with this software. Mainly combining customer service with feedback. If you run a business and need customer service software, would you pay for this? Why or why not?

We spent 6 years on this and last week redid the website - also pushed 1 year's worth of updates. What do you think?
My father certifies hospital gas systems in the US. He's measured CO2 levels in urban areas around 498ppm. Hospital air, the air piped to patients, has a limit of 500ppm. Soon hospitals will have to put CO2 scrubbers on their air supplies just like astronauts.

Maybe head mounted CO2 scrubbers will become fashion accessories for the 1%.
More than anything, I am excited about the possibilities this opens up. A lot of fields that DARPA touches with its funding-filled hands turn into a technology that defines the future, from the internet to self-driving cars to GPS. Exciting times we live in indeed!
> You have to plough each year before sowing

You must not be familiar with modern farming. Most farmers do no till these days. They never plow - ever. The first seven years of no till they do see less yields than their counterparts that plow, but after that the advantage of non-distributed soil mean they get better yields. (more profit ever before we account for the fact that plowing uses a lot of expensive fuel)

Nothing is simple, but there is a reason most farms and all the big ones are no or limited till.
Ever wonder how Bitcoin actually works? (math animation)
Looks like obfuscation
Not at all. If I have a small computer, even a smartphone, running Linux, there is no problem. Except that its screen is too damn small, and demand for AR headsets never took off.
1. You can murder your spouse with an STI. Mental illness do not necessitate murder.

2. It is the opinion on the behavior as being good or bad that is subjective
And in 20 years there'll be a whole new set of doomsday predictions and this'll be forgotten.

https://encrypted.google.com/search?hl=en&q=earth%20day%20do...
What's MRes?
How Elon Musk Proved That Thought Leadership Is the New Patriotism
Yes. Always have an easy problem in analysis & coding, like constructing a simple Boolean predicate from some comparisons. You will thank yourself later when you don't hire the fantastic-looking candidate who had absolutely no idea how to work the problem.
Image sizing is a tricky issue. When ebooks started to become a more mainstream thing, image size in the file was limited by the vendors, and also we sometimes had third-party licensing restrictions. Over time, of course, devices got more memory and higher-resolution screen, so larger file sizes are allowed, or even desirable. However, consistent behavior is still elusive. And that's even assuming optimal coding on the part of the publisher or whoever is doing their conversions; they may be using files that are not adequate for the higer-res screens.
Because this isn't about individuals. It's all about the whole society and the environment it's in. See also tragedy of the commons.
Yup. But sometimes sourcing an old thing at a good price is hard. It's further made difficult by misguided environmentalism like e.g. cash for clunkers that end up removing a ton of functioning old stuff from the market and forcing extra manufacture and purchase of new stuff.
> It found that 13-14% of students were homeless ...

Incorrect.

The study actually found that, "63 percent of parenting community college students surveyed were food insecure and almost 14 percent were homeless..."

That 14% is therefore a percentage of a percentage of a subset of those surveyed.

Meaning it only makes up 8.82% of "parenting" students, alone, and we are never given what percentage that the "parenting" subset comprises of the whole.

So the headline should really read, "Less than 8% of community college students surveyed are homeless."

Where homeless can mean thrown out or evicted from a previous residence, stayed in a shelter or abandon building, car, etc., or actually had no home or idea where to stay.

While the study is worthwhile, the USA TODAY article is worthless.
I sure hope anyone who's mining Bitcoin isn't also complaining about climate change. Also, electricity costs and various other externalities (depreciation of the machine and inevitable waste handling) are never accounted for.
No complaints on the sp4 trackpad here
I think it is not just a minority opinion, but just plain wrong.
Namecheap is still the big one that only supports SMS 2FA for me. It has apparently been a big engineering project to add TOTP support so they've delayed it for many (4+) years. They did recently blog they were pausing all other development to add TOTP support but there has been no progress update and their initial promise of "in 60 days" has since passed...

https://blog.namecheap.com/authy-based-2-factor-authenticati...
walk to the car, drive 5 min, find parking. same in reverse. at least 30-40 min wasted. esp during the winter.

i hate commuting to downtown toronto, but it is hard to beat the Path, abundance of pubs/restaurants and constantly bumping into people i used to work with (aka stay in the loop). there is no fricking loop in mississauga.
Seems like a pretty broad definition. So if your parents throw you out and you go live with your friend or grandparents, you're homeless? I have the same general question for all of those points.
Lean hogs.
FizzBuzz itself is too well known, but the world is full of other trivial questions that can filter out the no-hires.
And, while this is a more minor rebuttal, it's still worth saying: it's totally incorrect. Modern exploits (for definitions of "modern" meaning "written after 1999") do not care if you have a shell on your system.

The author has presumably confused the concept of a POC, which is an exploit reduced and simplified for the consumption and understanding of laypeople, with that of a real exploit.
This would be helped by the landing page actually explaining what this is and what I would do with it. A central collection of technical links shouldn't be how you introduce a project.
>How about "the community is better here than Reddit's default subreddits", then?

Well how about, "the community here is better than the community on Twitter"? That makes about as much sense. Who cares what Reddit's defaults are? How is that relevant to anything at all? If you want to see discussion of, say, bluegrass music, you're not going to find it on Reddit's defaults. But there's probably a subreddit for it.

>
shallot_router 25 minutes ago | parent | on: Ask HN: Are there sites that are like HN, but for ...

How about "the community is better here than Reddit's default subreddits", then?

>Reddit has exactly the same problems as the ones you describe HN has, even in specialty subreddits populated with experts. People always think expertise in one field extends to expertise in others.

That's not true. Subreddits are narrowly focused on specific topics. Go to a genetics subreddit and you're not going to see any discussion of civil engineering, because it's irrelevant and off-topic. HN and similar programmer forums are different: they have all kinds of science/tech articles thrown together in one place. So the only time you'll see experts making ill-informed comments on Reddit is when some side discussion pops up, which just isn't nearly as frequent as on here where non-programming topics are discussed all the time as prime topics, or when non-experts (e.g. programmers with a side interest in that topic) join that group and join discussions.

The fundamental problem with HN (as well as similar sites like Slashdot and Soylent) is that they're general-interest forums, so they'll always have this problem. But I contend it's worse here (and those other two sites) precisely because programmers, due to their autistic nature, have a much worse problem than people in other fields in thinking they're experts in everything.
If you think Java or Ruby is bad, don’t even try looking at the JS ecosystem.
Yeah, but this is not what most people think of when they think secure, is it? That is, this proves that people have to actually break an algorithm to know what it is protecting. This does nothing to show that an algorithm is unbreakable.

(As an example of my understanding, rot13 does nothing to randomize distribution of characters, so it "leaks" information about what it has modified. This sort of leakage can be proven as absent from your algorithm. Anything else is a bit tougher.)
> As he actually has a point.

The sensitivity of the human eye goes way beyond 30fps. Studies have shown that viewers can distinguish between modulated light and a stable field at up to 500 Hz. As a more practical example, many reviewers have noted that the new iPads' 120 Hz refresh rate has obvious, visible benefits for scrolling and animations.
You are misreading my comment. I didn't claim anything negative about Leaf or Prius. The Tesla S is an absolutely better car than Leaf or Prius. And since it costs much more, it should be. If we weight for price, that depends on your price sensitivity.
I completely agree with you. Their bluetooth products were amazing and so well designed with great UX! If they had just stuck with those and continued...the possibilities were endless. Spotify integration out of the box like with Amazon Echo? Whole-house audio solutions? You name it. The Jambox and mini jambox are still the best and only bluetooth based speakers that I own.
Mirror: http://www.cetusnews.com/life/How-to-Get-Old-Brains-to-Think...
Do they have bone-conduction mics?
Just a heads up that some of the titles it uses for the cases are NSFW
They also point out that substantial performance gains are given by using 'will-change,' as in the following.

.app-menu {
-webkit-transform: translateX(-100%);
transform: translateX(-100%);
transition: transform 300ms linear;
will-change: transform;

}

And I'd point out that the authors are specifically stating that animating transform+opacity (via a 'transition') are more efficient than things like left, top, bottom, etc.—because those properties affect the layout stage, which is earlier than the composite stage (where the transform+opacity properties operate), and subsequent stages have to be recalculated.

They also discuss different ways of structuring DOM trees to create the same animation which have performance trade-offs.
There's a difference between the frame rate at which the human eye can process images, and the frame rate at which the human eye can detect that there was a change.

In a 60 fps stream, you can insert one image that is way off from the rest, and it will be detectable. You have to go around 100fps for that "blip" to go unnoticed.

So when it comes to transitions, high frame rates actually do matter, as that makes the difference between something smooth & natural, and something that appears jagged & visually annoying.
> Rising costs of living are pricing people out of the system.

Officially, inflation is only 2% a year

https://data.bls.gov/timeseries/CUUR0000SA0L1E?output_view=p...

I find CPI to be genuinely curious basket. Where are they finding housing, college, and health care that's only going up 2% a year? Certainly not the west coast where 10-20% annual increases are routine.
KALSR's not the same as ASLR (although ideologically related). ALSR has been around for a good number of years in userspace via randomize_va_space sysctl

(edit I presume that's what the poster above mentioned re: per exec)