skysight-inc/HackerNews huggingface dataset:
If an attacker has root access to your machine, he can easily:
* Extract passwords and session tokens from your browsers
* Keylog your system and wait for you to type a certain password
* MiTM your TLS connection to grab credentials

>This is not an argument at all. Let's consider the situation when individual service gets compromised. Attacker has thousands of salted hashes

Wait, who said they are hashed? Perhaps an irresponsible webmaster stored them in plaintext. Now, even if that service itself isn't very important, it's likely that certain users re-used the same(or a similar) passwords in more important services, such as Google.

Now, while you're right that using a single master password does pose a risk, there aren't other viable solutions to secure password authentication,
unless you;
Memorize a strong password for every service that you use
Never share passwords among the services
Don't store saved logins in your browser
Never link your services to your email (because then if your email account is pwned, your accounts in those services would be pwned too, another "all eggs in one basket" issue)

If you can do all of the above, then great, but most people can't.
Another well-known Jeff Koons sculpture is of Ukrainian descent
Google didn't enter the race. They helped a company with some calculations.
So many of the travel sites are owned by Priceline. Here is wikis list:

Booking.com
Priceline.com
Agoda.com
Kayak.com
Cheapflights
Rentalcars.com
momondo
OpenTable

I am surprised they haven't bought Expedia or the other major sites.
The problem with C's undefined behavior is not the undefined behavior itself, but that todays optimizing compilers use UB as a hint to detect "impossible" code paths which then causes the behavior to really become undefined and unpredictable, also many notionally UB constructions are used in lot of existing code, because before such aggressively optimizing compilers the results were somewhat predictable.

Many other languages have concept of UB, sometimes hidden by different wording, even languages that usually target virtual machines (ANSI CL uses the phrase "is an error" for essentially same concept). On the other hand for various VMs the undefined behavior is usually understood as "anything that does not compromise the VM integrity" and similar thing should be true for UB on CPUs (although you should read Intel's errata that contain "causes undefined behavior" as "allows privilege escalation")
Don't be disingenuous. That would require someone to actually read their papers, which would already be a net loss and a massive waste of time for everyone involved. Not to mention the amount of department politics which could be involved in this issue.

Look, not every paper is worth publishing. There are many ways to write noise that can pass for signal given the reader's level of understanding (e.g. crack pottery and "fashionable nonsense"). The usage of p-values implements self-filtering to some degree, and makes everyone better off by increasing the likelihood that at least some papers aren't complete nonsense. And that's good.

The only issue is that it is a much weaker constraint on publishing than it was previously thought.
In other words Windows 10 is making itself obsolete.
These are certainly the painfully obvious questions aren't they? Hartwig claimed that HTS can make existing designs either smaller or more powerful, so what about ITER?

And yet it isn't addressed, and it -- somehow -- doesn't occur to anyone in this MIT audience to ask. Even if one wished to argue that ITER is committed to a design and shouldn't be altered at this point it would still useful and compelling to at least compute how much better the ITER reactor might be... but nothing like that happens here.

I imagine that any person endeavouring to earn a place in fusion power research (at least at the university or government level) needs to be careful about questioning ITER design. At the moment ITER is the home of many of the worlds leading fusion power minds and all of the best funded ones, so you'd better have your ducks in a row. The fact that the question isn't directly addressed is probably an indication of just how certain the HTS proponents are about their proposal.

One of the best parts of the talk were the photographs of the unknown alloys ("tokamakium") being deposited on the surfaces of a tokamak plasma chamber. Interesting things.
Azure Stack: Microsoft's Secret Weapon in the Cloud That Amazon Wishes It Had
But I still often wonder about the motivation for those early downvoters.

And I'll still hold that this is acceptable curiosity.
Rate my IP
"emotional response"? really?

I'm not masking anything. If you would like to read between the lines, then by all means, feel free.

I'm looking at this whole situation without passing any judgement. Looks to me like we have a classic case of a company completely failing to execute properly on an idea.

Did they fail? Yes, spectacularly. Was there malicious intent, or some form of intentional shady practice going on? I think the current evidence doesn't support that.
I don't think Norvig was all that excited about it either (or at least whatever excitement there was may have worn off): http://norvig.com/python-lisp.html

Though I guess it is probably better if he describes it himself, https://news.ycombinator.com/item?id=1803815
Thank you so much! I really appreciate the feedback. That sounds like a great idea I will work on that functionality the coming days and keep you posted. I did that yesterday from reading your post.
> We’re on the HN homepage, with 900 upvotes, and passionate comments. All great, except for one thing: we are the scourge of the internet. How did we get ourselves here?

Well it's not surprising, is it?

From the outline article:

>> Then he blew this reporter off. “I apologize in advance that I can't answer any further questions,” he wrote. “I need to focus on other parts of the business, including continuing to improve the product for our users, and conflict like this is always doubly distracting.”
a comment from someone on hacker news 288 days ago, sounds like a credible source alright
I have a hard time with the idea that SpaceX sits somewhere around $12B and Tesla around $50B (with most people arguing even that is absurd).

So to value Priceline at $100B is insanity.
Onenote for detailed logs on a specific issue (bug/feature/research)

TFS for tracking effort in a sprint. And I no longer take notes -- our sprint planner takes notes in individual user stories.

Todoist for task management outside of TFS (and also for personal tasks)
Why is this a throwaway account? Hipmunk is not an OTA, they are a metasearch site. When you find a price on Hipmunk, it's just a price from one of the OTAs like Expedia or Booking.com. Even when it's branded as a "Hipmunk" price - it's powered in the backend by one of the OTAs (white label).
> If a researcher reports a qualifying vulnerability already found internally by Microsoft, a payment will be made to the first finder at a maximum of 10% of the highest amount they could’ve received (example: $1,500 for a RCE in Edge, $25,000 for RCE in Hyper-V)

Wow. I guess this kind of functions as hush money? To make sure they don't reveal the issue before MS patches it. But still, this seems like a good move.
Not a huge fan of subscription models, but if using password manager software, it seems like an appropriate pricing model. You expect/demand the software vendor to be consistentsly up to date on best security practice and vulnerability patching. A subscription model gives more incentive to provide this due to the risk of losing future revenue(subscribers & reputation) in the event of a failure.
>They do now, as part of a society that includes advertising. That word of mouth comes as a result of people being aware of things.

Word of mouth has worked fine long before mass media advertising became a thing.

Is our society and economy dependant on advertising? Absolutely. Has it always been this way, and must it always be this way? Not so much.
http://blog.wizsec.jp/2017/07/breaking-open-mtgox-1.html

He is guy who has been identified in MtGox hacking
It's good to see the bounties increasing to the range you could get on the open market.
RELRO: a (not so well-known) memory corruption mitigation technique (2009)
Outside of the title being misleading, I'm sceptical. It's one thing to have the hardware for research, and completely other to have the expertise for the research.

Google entered the self driving cars research, and we have yet to see them driven around.

This heavily reminds me of Intel and their diversification, up until recently, they were in IoT, makers market and what not. One solid push from AMD and they jumped out of everything way too fast to track.

Google seems the same with the nuclear fusion. They have the advertising money to throw around, but that just it, they are in different segment, and from investing side I'm more inclined to stay away from their stock then buy it.
> Company needs users.

sure, that's fine

> Plugin has users.

Still no problem here.

> Plugin does things company's flagship product _could_ do (and it is _free_).

Yep, all kosher.

> Company reaches out to Plugin developer and they come to an agreement to add support for the flagship product into the Plugin, but the new support is _not_ enabled by default.

… and there's the problem, that's not what happened. First it's not entirely clear, but it's implied that they paid the developer to add support for Kite, that may or may not be OK, but at the very least it raises some questions. Secondly, they made Kite the default choice when installing the plugin, and also had some shady dark patterns in the chooser dialog to try to bias people towards using Kite while downplaying the risks it poses.

Even with all that, that's not what really got people furious, all that, although shady, isn't really wrong per say.

Where they went wrong, was when they then went out to a different plugin, that had nothing at all to do with the product the company was offering and shoehorned extra functionality into that plugin specifically for the purpose of showing their products ads to users. To be clear, they chose the plugin specifically because it was popular, not for any other reason, this was PURELY a marketing driven decision. Had they picked another plugin that did something similar, I.E. showing links to docs for libraries being imported, and then worked with that developer to link to their docs that showed the ads that might be one thing (still a bit shady), but no, they wanted to get the most ad impressions they could, so they added a completely unrelated feature into an existing plugin. Further muddying the waters, they didn't just "partner" with the developer for a "business relationship", they straight up hired the guy, which raises all kinds of questions about their relationship to this open source project.

This was a perfect storm of bad decisions, they started out making some questionable decisions, nobody really noticed and they got good results back, so they decided to crank it to 11, and then when people did notice and called them out on it they initially doubled down and then finally went into full damage control mode.
Stories like this are part of the reason I never went into academia. It's amazing how many highly educated people are judgmental and inflexible, and in academia one person like that can sink you. As an engineer in the private sector, worst case scenario I can find a better team/company to work with.
The Big IT Transformation Is Now Underway
Kemp Virtual LoadMaster Runs on Azure and Now Azure Stack
But then you're not answering the question, which is also bad.
Booking.com has spent a huge amount of money aggregating inventory at mom and pop hotels throughout the world, especially in Europe.
I interviewed with Kite a number of years back. From that experience, I am entirely sure that they really had no malicious intent with any of this. That being said, I did tell them that IMHO they were severely underestimating the privacy concerns of developers. Looks about right.
An apology that starts with 4 paragraphs of self-congratulation is not a real apology at all. Nothing of the article reads as being genuinely regretful of the strategies taken - it's just sorry for being caught.

>Unfortunately, while trying to make programmers’ lives a little less complicated, we instead made them more complicated.

Barely an admission of guilt, and even that can't get past without patting themselves on the back for the noble cause they 're profitably working towards. Yes, Kite, your pay-for service clearly has my best interests in mind. I forgive you for being too stupid to grasp your superior approach. How about actually finding fault with hijacking projects for advertising in the first place?
In fact you can pay under the market, a bit, if you treat your people like humans, develop them, stretch them and insist on a positive working environment (no rudeness, fair dos for everyone even if they look, talk or smell different). People will not switch away for minimal reward and considerable risk of being landed in a dead end with a bunch of sociopaths. Also many people realise that their current track has 5/10 years of seniority to build - and then that's your lot. The option of switching to management or to tracks like architecture or even non-functional work like finance or intellectual property is attractive to many people.
Waze allows using the phone speaker for nav directions, even when connected over bluetooth. Google maps doesn't have this option. My cars bluetooth won't autoswitch over to the nav bluetooth audio when directions are coming in when listening to another source.

Waze traffic avoidance is also far superior.
I feel that pain on the splitbrain docs. That's my number one complaint about their API's - I'm never sure if I'm on the newest. That said, there's a "familiarity" to them... once you figure out how things changed it's easy to quickly determine the age of a code sample.

You should try the custom runtime again! It's come a long way since Beta.
Retroactive 'Openness' is not open. Openness is when you let us know before you do shit like this, not after you're caught.
What is strategic value to the manager that is not hard work and delivering result? I'm asking sincerely, since I do hear a lot about the lack of correlation between hard work and promotion. I want to understand.
Pen and paper. Digital tools still aren't flexible enough to capture the full functionality of pen and paper.
> GUIs are objectively better for every single task

If they are objectively better for every single task, there will be metrics and studies that prove this objectively. Kindly cite these studies and metrics. I don't think they exist.

I refute the quoted statement with two words: headless servers. Oh, and REPLs. And CLIs embedded in so-called GUIs. In many cases, GUIs contain command-line emulators. Think of, say, Wireshark's filters, or any JavaScript console.

Maybe you are railing against text-mode displays, as opposed to terminal emulation programs that use graphics to emulate a text-mode display?

> Given a proper choice...
No true Scotsman...?
For most people on HN, the all-in cost of operating a modest car (~$12/hr https://www.nerdwallet.com/blog/loans/total-cost-owning-car/) is significantly less than the cost of their time while they're in it. And for most people, car is the fastest way to go. So I don't see how the cost is baffling to you.

Yes, some people like to multi-task their exercise by biking (although then it's much harder to multi-task your audiobooks), and yes some people have short commutes that are slightly faster by bike, and yes some people just enjoy biking. But for most people, transportation is about fast reliable transportation, and if you're on HN your time is likely worth several times the car cost.

(Obviously, people can spend a significant fraction of even large salaries on a luxury car, but that's a personal choice that doesn't have much to do with economical transportation. It doesn't make sense to tell someone driving a Mercedes that they could save money by riding a bike.)
Anchore Navigator 2.0 Beta is now available
Yeah my issue was that it was originally able to be set to "only while using", which they disabled without notice. All of a sudden my location was being shared 24/7 without any warning or permission.

I don't mind contributing location data to the betterment of the app, it more comes down to a battery life and transparency issue.
I don't worry so much about that. I'd hope in the modern world that everyone understands that no one really means everything they say when dancing around the "where do you see yourself in five years" kind of interview question.

My reason for not leading with salary is basically that I'm going to be asking them for the high end of what I hope I've accurately ascertained to be their range, and I'd rather the first impression I leave them with be "we have to get that guy" rather than "is he really worth what he's asking"?

Yes, it costs some time I suppose, but I find there are very few activities one can engage in that are more lucrative per hour than correctly doing a job hunt. I can eat the time if need be.
How often do people rely on wireless phones compared to landlines? Do you use the internet more than a landline phone? The landline phone system is a utility, but Verizon wireless shouldn't be?

Capping certain websites is not price discrimination, it's website discrimination; Verizon promises a certain amount of GB per month on our phones, and capping certain websites for me when I'm still under my monthly data limit has nothing to do with my data limit and everything to do with discriminating against those websites to my and their detriment.

If you're fine with corporations turning the playing field into an uphill slant against you based on their preferences regardless of yours, then please argue for them capping limiting certain completely-legal websites they don't want to treat fairly.
oh you're right! it must have been cached.
Wow, I am amazed. Was actually expecting to be bombarded with false positives when I proxy via one of my servers to check that IP - but 0/100 all the time so far.

Maybe it's broken the other way round? ;)
Shell script, markdown files and MacDown markdown app

$ today
created TODAY-20170726.md

- https://github.com/erikj/bin/blob/master/bin/today

- https://macdown.uranusjr.com/
Can you explain more around how you transition between sitting and standing with your setup? I'm imagining either a laptop or you collapse/expand the boxes?
i can't be the only one who thinks he got elected because he's extremely good looking.
Sabre is one of three. I think more of Priceline is powered by a competitor.
Google might try to become the conglomerate of all forward-facing things but it is somewhat funny to see how through it all, it's their advertising revenues that form the core of the business.
I'm really excited to finally open-source Chromeless. We've used NightmareJS and similar tools before to run integration tests but these basically added ~20min to each build. With Chromeless we were able to reduce this time to under a minute!

Here is btw a demo playground to try it out: https://chromeless.netlify.com/

Let me know if you have any questions :)
Posting this as I've just learned about it due to this commit enabling it by default (on supported platforms) in the Rust compiler: https://github.com/rust-lang/rust/pull/43170
How to start Web Designing
even thenm if you really are worried about latency, AWS isn't the place to be...
So I have none of those frustrations as a 2016 GTI owner. Google Maps is wayyyy better than the built-in nav. If I searched for an address on my phone or even my laptop the address is already in my list of recent addresses in Maps and I don't have to even voice search for it. Although voice searching rocks and I dread having to enter an address in my wife's Odyssey nav interface through their knob interface. Then there is traffic routing which is also way better than what comes with the built-in nav. I can voice search and call a business from the same interface while I'm en-route as well.

I do wish that they would add the ability to have a real weather app in the ecosystem. After moving from the west coast to the midwest where they actually have real weather that can be spotty and fast moving it'd be really nice to be able to pull up an up-to-date weather radar view to see what's coming at me.

Now, there are the bugs....such as occasionally when I call someone it switches to the speaker on my phone vs. my car which is really annoying. It used to crash on a semi-occasional basis but I haven't seen that since I upgraded to a Pixel. Occasionally I do have to reboot the phone when it fails to connect. That is probably the most annoying one.
Good to know, but I know they were on the other sites that do that, and specifically mentioned Priceline as having some sort of contract that allowed them to undercut them, and I can't find anything online to back that up.
Ok, we changed the title to the first sentence of the article, which basically says that.
TextWrangler and NV.
One big reason: educational games have fallen out of favour within school systems. Many teachers were simply using them as incentives, rather than using them as guided educational tools. Without the guidance, these games had minimal value for learning. Of course, the value of the educational content also varied a lot. Even the good ones depended a lot on rote memorization, which cyclically goes into and out of favour among educators.

In this case, the other issue is that Minecraft is pure entertainment software. It may have educational value, but the origin of the game makes it a hard sell. (Civilization and SimCity faced similar problems.)
That max hyper-v payout of $250,000 reminds me of the TV Trope Just Cut Lex Luthor a Check

http://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorAChec...
Escaping the Distraction Economy: Seven Steps to Reduce Distractions
Getting it cleaned by somebody who won't steal your stuff is a challenge. They can just say that it was taken by the renter.
Show HN: Working with hierarchies in a NoSQL database
Not to mention roasting potatoes, corn, or even eggs in the coals of a fire, which is a close relative to using a dutch oven.
Its about time. I hope the incentives stay strong enough, and dont require hoops to jump through. otherwise the gray/blackmarkets could out-bid the bounty and cut the red tape to incentivise their own acquisition of the exploits in question.
When Priceline started the Execs at Travelocity laughed at them. Today Travelocity is a brand of Expedia and just serves up Expedia content.
I thought that the scripbox gets the commision from the Mutual fund company and not from the customer's investment. So how is that the customer's loss.
https://scripbox.com/help/if-i-am-not-charged-any-fees-how-d...
I would say yes.
High level abstraction between React and Redux
I think it's ok for Priceline Group Inc. to be referred to as Priceline for short.
Security and upgrade paths play a massive role.
Please don't insinuate astroturfing or shillage in HN comments unless you have evidence. The use of this as a standard (and toxic!) trope in internet arguments is something we definitely need to stay away from. Much more at https://hn.algolia.com/?sort=byDate&prefix=false&page=0&date... if anyone wants to read about HN's take on this.

We detached this subthread from https://news.ycombinator.com/item?id=14858440 and marked it off-topic.
Bullish: Increasing access to technology for blind people
If you go to Tech Shop or Maker Faire in the bay area, you'll see a lot of people doing art as an integral part of what they're doing with STEM.

Totally fine if that's not you.
No, that'd be more like Ctrl+L. Ctrl+K is specifically for your default search engine, wheres Ctrl+L and F6 work for links and other search engines as well.
Every time you compare a bug bounty payout to the price of vulnerabilities on the open market, tptacek dies a little inside. Please, think about poor Thomas.