skysight-inc/HackerNews huggingface dataset:
By "every typo squatting case" do you just mean researchers demonstrating the viability of the attack against various systems? A system that successfully defends against researchers but not against actual genuine attackers would be worse than useless. If I actually wanted to pull off an attack without anyone noticing for as long as possible, I'd just target a single package whose maintainer is on vacation.

I think the only way your key-signing mechanism would actually solve the problem is if we made it actively hard for new developers to upload projects to PyPI without a long vetting process. Some projects work this way (Debian, notably; I've had upload rights for a few Debian packages for years and still don't feel ready to apply for full access), but I think it's a poor match for PyPI's actual goal.
Depends on the system.

> An electric locomotive is a locomotive powered by electricity from overhead lines, a third rail or on-board energy storage such as a battery or fuel cell.

https://en.wikipedia.org/wiki/Electric_locomotive
Finally something that might create a commercial incentive for a lowered RF noise floor!
I think you can also just avert your gaze.
And now this post has been deleted from the HN front page... Edit: they've unmarked it
It's fairly common in West Virginia, google 'mountain top removal' for plenty of examples. EX: http://appvoices.org/end-mountaintop-removal/before-after/
Yes, I suspect this could be a part of the solution. They'll also need a way to simulate eyeballs, in order to fool the sensor that measures if the dummy is "looking" at the device.
If you live in the US that can't be true. The Interstate Highway System, state highways, etc. are government funded infrastructure that isn't funded locally. The mortgage market is also distorted/subsidized nationwide by the federal government. I'm not sure about sewers.
Cryptocurrency tracking and leaderboard for over 1000 coins
> It's not clear whether e.g. security cam footage will be sufficient fidelity to reconstruct a 3D face in enough detail, but this will be interesting to find out.

That would be NSA-grade security cameras, and based on the photorealistic masks they tested, even that shouldn't be good enough.
A rough guideline for me is to help advance humanity on its path of technical progress (because the life I love is because of technological progress); to help those living in poverty around the world (because after I die, chances of me being born into a poor third-world country are too high); and to reduce the threat of global warming (because after I die, I want to be born again and not be un-existent in a timeless void because our planet is trashed).

My reasons are selfish unfortunately. I'm also not extremely motivated to make a personal impact on my own, so I aim to earn a high salary so I can donate to people who know what they're doing.
My purpose is to honor, obey, and serve my Lord Jesus Christ.

Subordinate to that, my purposes are to love my wife, to love my children, to raise them well, to be kind and helpful to those I meet in life.

I live this out imperfectly, on all fronts. But that's my purpose.
Classified doesn't mean censored. What makes you think there aren't 100s of classified documents about this dating from 9 months ago or even before?
Torbrowser actually warns to not resize your browser as the resize allows people to fingerprint you
I like the idea of this. This would be very useful for versioned resources (e.g., images, JS, and CSS files) because it would eliminate unnecessary requests for them after they're cached.

The example of a 1 year cache time seems a little extreme, though. I think a month would be better.
On Twitter and Youtube I can find infinite amounts of content that advocates "against groups of people based on their race or ethnic origin, religion, disability, gender, age, nationality, veteran status, sexual orientation, or gender identity."

Jeez, you'd probably find all that in a single rap video. In addition to that, have you ever read Youtube comments?

There's clearly bias against Gab in this instance.
Two Ex-Googlers Want to Make a Lot of Viral Tweets
> The argument that we don't need or use local computing power is not valid. The nuance you are imagining isn't there. Of course networked services are incredibly valuable. But most of them would be useless without local client software and there are plenty of things we use mobile devices for now where online services are just a convenient adjunct to powerful local applications.

But the original argument is the reverse of that: they weren't arguing that local computing power was unnecessary, but that it would be insufficient because what people really needed computers for was to connect and do complicated things. The fact you use more processing power than they envisaged being possible on a microcomputer to do something as trivial as unlock your phone is a moot point to the "computer terminals do much more interesting stuff when they're connected to each other" argument that was actually being made.

I remember a time when that wasn't true, and could create and play with lots of interesting stuff on a computer with the hard disk space of a thirty second YouTube clip which didn't talk to other computers except reluctantly by floppy disk. Quite possibly you do too, and arguably that makes certain seventies computer magnates look silly. But even now when computers are several orders of magnitude more powerful and offer much better games, somewhat better graphics editing and frankly barely-improved word processing, most people use most computers to interact with other people or services or experiences online, and would have a lot less use for them otherwise.
> Sexist games don't affect people's sex/gender attitudes? Then what does?

People you grow up with. Parents mostly, later peers. Basically people that could have opinion on you that you care about. You tend to share their values eventually.
It's fitting faces to some kind of assumed model.

I tried it on a few Japanese faces; it basically gave them a Caucasian-looking side profile: big foreheads with over-hanging eyebrow ridges; big noses.

Completely unrecognizable after turning more than a few degrees from front view.

Which is not to flame the project---nice work!---but as a potential improvement for certain applications, it would be useful to simply have these details as parameters that could be interactively tweaked.

Being able to adjust the overall roundness of the face, and prominence of the chin/forehead/nose would probably go a long way.
Artist Creates First Ever Individual Coin Offering for a Tulip Token [pdf]
>How is TV better than an iPad?

One of the few compelling arguments for TV is that it's excellent for teaching language to first learners. My wife and I have a bilingual family, English and Japanese, but we live where there are no Japanese speakers my children's age to socialize with. A subscription to a few Japanese TV channels has been instrumental in passively supplementing language acquisition. It's the only reason we have a TV in the house at all.
>I think we have decided the answer is yes.

When did we decide this? To my knowledge it's still a debate.

And IMHO, we shouldn't force anyone to sell/buy anything from/to anyone.
One of the authors here. You are very right in saying that the there aren't many details. This limitation, we believe, is due to a lack of large, high quality training sets. The data we trained from was very smooth, which means our method is unable to pick out features such as wrinkles and dimples.
How to Become the Best Programmer in the World
This leads to an obvious question: "why did the programmers not always just embed the font?".

And it turns out that the answer will probably be, "well, we asked the lawyers, and you need rights from the font owner to do so, and it makes files bigger, and most stuff is in whatever Microsoft Office uses as their default font this year anyway."

And so we're torn between "yes, of course the designer who built the font should get paid" and "a sane default became a checkbox because of US copyright law".
German foreign spy agency BND attacks the anonymity network Tor
> static 3d-printed would not work

right, but adding in fake eyeballs should do the trick.

For inspiration, check out how these guys fool Samsung's iris scanner:
https://www.youtube.com/watch?v=4VrqufsHpS4
I think what's likely is that the articles are being flagged by HN members (and possibly down weighted by mods) as not something that can be constructively discussed on HN. If you've looked at the discussions, they've produced far more heat than light.

As for being a dupe, it is in the sense that the same topic has been introduced multiple times:

https://hn.algolia.com/?query=equifax%20music&sort=byPopular...
I don't have a link, but an implementation of your project did make the rounds on YouTube and/or Twitch a while back.
Some blamed the NASA hack (this day 30 years ago) on the Russians at first.

(And that actually wasn't off by much, see the KGB hacks).
My wife and I bought a house in pre-car suburb that was exactly what we wanted: dense, public transit, lots of places to go on foot (doctor, library, municipal building, 3 separate shopping districts, hardware/general store, dozen parks and playgrounds, &c). We wanted a good school, but weren't willing to sacrifice our way of life, and we found, I think, the perfect spot. (We love our neighbors too, but didn't know that until after we moved in).

When we looked at places I gave an immediate veto if there wasn't a sidewalk or if there wasn't a trolley stop a within 10min - 15 min walk, or a bus within 5min. Our elementary school is an 8min walk, the middle and high schools are about 20min. We only drive when public transit would more than double the amount of time it would take or if we need to go where there isn't transit. My wife will also drive for the large grocery runs each month, but the week-to-week is put in the stroller and carried home.

We enjoy this. Cars drive us nuts, not to mention the hassle of parking.
incubator cam, baby crib cam, baby sitter cam, pre-k... kids today grow up under constant surveillence and it would be wrong to think they as a group will have the same ideas of privacy any of us do. This will be perfectly normal for the next generation.

I've heard of religious folks using cameras on kids
surreptitiously and then catching them in lies and saying "God told me you..."

Brave new world.
How to hack FaceID:

You'll need:

1. 2 phones (at least 1 with an IR camera, such as another Iphone X)

2. a helper app

3. access to 10+ photos of the victim (Facebook typically)

4. a small mirror

With the helper app:

1. capture the suspect's phone's unique IR dot pattern by shining their phone at white piece of paper, recording it with the helper app (the helper phone needs an IR camera of course, such as another Iphone X)

2. makes 3d model of persons face from the FB pictures

3. generates 2 animated videos of their face, 1 just a normal color video and another with the dot pattern applied

4. now you need to show the 2 videos to FaceID, using the mirror to show the correct video the the corresponding camera
Please don't create accounts just to post unsubstantively like this.

https://news.ycombinator.com/newsguidelines.html
Also featuring another Canadian legend, Dan Ackroyd.
I always assumed having video auto-play allows for ads to run in between videos playing. Maybe some sites see that and (woefully) assume it is a good way to increase audience engagement. Either way, I totally agree it is a horrible experience for the audience.
Ooh, one eye open to disable would be great!
Meanwhile the autoplaying video ad with sound on that page has no pause/stop/mute controls. Exactly why "Pushing advertisers to create a better browsing experience seems like it’s good for everyone" will never work unless browsers draw some lines
I think the bigger problem is trusting yet another company to store your personal data securely.
The less info out in the wild, the smaller chance of it falling into the wrong hands.

Next week Credit Karma could just as well be on the front page of the news for being hacked.
Real time BTC to USD GDAX market display
Show HN: A pure-Ruby implementation of systemd's sd_notify(3)
Right, so it is basically a "middle man" which modifies the manner in which the cargo comes down the hill under gravity.

An escalator that moves people down could conceivably work without any external power source other than the people.
> it tried to read the people setting the phones up on the podium.

This sounds annoying. With Touch ID, unlocking the phone is a deliberate action. With Face ID, it sounds less predictable.
This is a surprisingly substantive piece. I'm hopeful that it will foster high-quality discussion on HN.

It's a central problem. It feels like being mired in quicksand. If you try to ask right-leaning folks about the left, and left-leaning folks about the right, you get hatred. I haven't seen many presidencies but this seems like a new phenomenon.

The problem is that it's almost impossible to stay neutral. I've always held the belief that both the right and the left are dopey in their own special ways, but both have valid points that we should learn from. A sentence like that is easy to say in isolation; who wouldn't want to learn from valid points of view? But you know how it goes when you try to talk with anyone about X if you mention X is believed by "the other tribe."

Why does this happen? I don't know, and I'm not sure what to do about it. The underlying problem is that the volume has been turned way up. It feels like there's no room for quiet people anymore.

Maybe in this thread we can avoid talking about any specific political problem and try to come up with meta-strategies for dealing with the current political climate. How do you live well when the world wants to draft you? That's the crux of it: you're either fighting for Trump or fighting against Trump, and those who do neither are suspect.
The url you posted above returns a 404. It looks like http:fehu.live works.
> criticise the powerful

The idea that 'whites' are a homogeneous "powerful" group is as naive is it is prejudice. The standards apply to everybody or they don't apply at all.
They tested it against lifelike face masks, I doubt that would work, fortunately. They mentioned an IR camera, wouldn't be surprised if they're checking temperature as well.
Any mine that is at a high altitude relative to where the ore is taken. Even if you have to move the ore up a bit to get it out of the mine, then there is a long trip down.
Which is why having those people "invest" in Bitcoin is crazy and risky both for them and for Bitcoin.
It's marked as "dupe"

Edit: it was unmarked, thank you Scott
Platforms Are Not Equal: Why Airbnb will always be a better business than Uber
Sorry, it was an overly snarky comment.

I don't think any basic income proponents are suggesting that it be funded as a purely net-additive expense on the budget. I wasn't necessarily suggesting that we can get basic income while keeping all existing social welfare by cutting other non social welfare related expenses.

I'm just saying that a more equitable amount of public interest in a Pentagon that 'lost' 6.5 trillion in funny accounting would be helpful to basic income too, in a supplemental way. I didn't mean to let it exclude discussions on a 'primary' way of funding basic income on the budget.
>Is there a utility that makes side loading easier?

Yeah, it's called "The Play store banned my favorite app." Like youtube downloaders and ad blockers. That's a good way to make users ignore the scary "unchecking this box could damage your device" dialogs. Once you get a sizable base off the Play store, that can be used to promote all the valuable things the Play store doesn't permit.
Did California plastic bag ban result in San Diego's current hepatitis outbreak?
I work with a talented and diligent colleague who started college as a CS major but switched to music (and a minor in geology). He participates in hardware hacking CTFs for fun and runs circles around me.

I also work with another colleague who had a scholarship to his undergrad for music, who switched to CS. Not as technical as the first colleague, but is very good at systems thinking.

A third colleague is a superb SME who understands security policy, compliance, and risk management (with a CISSP and actually using it); he was an architect and interior designer before switching careers... and is in a band. :)

Music isn't a bad background to have in IT or security fields from my perspective. Issues with anecdotes aside, I don't see the issue here if a person has demonstrated growth and expertise in the field.
There is absolutely nothing wrong with having a music degree then going into tech. I have a CS degree but I worked with a lot of talented and smart individuals who either didn't finish college.

That is true in general, however in this case we know there was a major breach maybe one of the biggest ones, now all of the sudden having a Music degree _and_ seemingly not having relevant infosec experience doesn't look too good.

Had there been no breach, fine, nobody would have noticed and everyone would have given the benefit of the doubt, even say "How nice, they could pivot from a different degree etc."

Moreover what looks shady is that they changed their last first name to M. instead Mauldin in LinkedIn profile. Their interviews have been taken down etc. If they had experience and this was just an unfortunate example, they would have stood by and defended and explained what happened. The weasily hiding looks shady like they are hiding their incompetence.
Maybe it's user-settable.

I think this is the case for how many times a passcode can be entered before the phone is wiped.
Impressive, but I'd be interested to see if this approach works well if you add extra images (i.e., stereoscopic).

Notably, the shape/depth of my nose is very, very wrong.
> One operation from over 50 years ago is your example? Back then the spooks were doing far worse, conducting operations against domestic civil rights groups.

Or torturing Americans civilians for eh... testing whether interrogation techniques would work on the real enemy(tm) as well.
> Key X is on the company approved key list, key y is not. Your argument just fell apart.

A minuscule amount of people are going to bother to do something like approve keys. Security for the minority can already be achieved by those companies mandating their developers use DevPI and mirroring trusted projects from PyPI to DevPI (or similar system).

Complicating the system further for something that, for practical purposes, does not improve the security of the vast bulk of people is not a trade off we're willing to make. Package signing will come to PyPI, likely in the form of TUF which is strictly superior to the trust model provided by PGP for package signing. It hasn't done so because nobody has had the time to do it yet.

What you seem to be missing about my statement both in blog post and here is not that package signing is not worthwhile, but that a lot of people like yourself seem to think that all you need to do is add signatures to a system and suddenly poof it's secure! That view point is common among inexperienced developers or people who don't commonly think too hard about how secure systems are designed/made.

The reality of the situation that adding signatures is painfully easy, but that without a coherent trust model backing those signatures you've achieved nothing but adding more complexity. Determining a trust model (particularly one that works for the majority) is the hard part, and you can't just wave your hand and wish it better.

> Sonatype has turned this into a rather nice business. It's not a volunteer project for them. You expect me to believe it's impossible despite solid examples to the contrary?

Is it impossible to turn PyPI into a business? I don't suspect it is no. However I don't want to do that because my personal risk tolerance doesn't have room for giving up a stable job with health benefits for something that may or may not fail. Others are free to try that if they want of course, but given the lack of people stepping forward to do that, it doesn't seem like anyone else is interested either.

> Blaming the victims.

Stating reality. PyPI is not a curated repository and the end users is responsible for their own security while using it. If they wish to outsource that responsibility there are a number of Linux distributions that are happy to do that for them as well as companies like Enthought and Continuum Analytics who provide curated repositories.

> It's also not achieved by doing absolutely nothing at all.

Good thing we're not doing nothing at all then. Luckily for the Python community we have actual experts and not arm chair cryptographers who fail to understand even the basic fundamentals of developing secure software.
That had me pause as well. I'm still a bit dubious. Given potential energy is mass x grav x height, since the vehicle mass cancels top to bottom. You have load mass x grav * height of "extra" energy on the way down, which if you convert at 50% efficiency to charge would be a quantity of energy E which on the way up, if you have a 50% efficient power train would take the mass of the truck to the top of the hill. That suggests that the truck can carry 4x it's mass down hill. But in the phys.org article [1] it says it weighs 45 tons and can carry 65 tons. That is 44% additional mass. And because its linear 44% "additional" potential energy at the top. Which has to be converted twice (mechanical -> electrical, electrical -> mechanical).

I'm not expecting them to meet their goal of producing excess energy.

[1] weighing in at 45 tons when empty plus 65 tons of loading capacity -- https://phys.org/news/2017-09-e-dumper-world-largest-electri...
Suburbs don't have to be substantially less dense. Heck, I think there are neighborhoods in my nearest city (Pittsburgh) that are less dense than my town just outside of it. Mine was built before cars were a given and when the trolley was a given.

There are "exurbs" which are just abominations of low density and bad design. There are some lower density suburbs, and yeah, neither of those are sustainable.
And in testing I can't have multiple profiles open at the same time.

You can, it's just not easy to discover :( Edit your Firefox shortcut and add "-P --no-remote" after the command.
The 50:1 is before any filtering of résumés or anything. We don't have any unreasonable expectations around working hours or overtime, we aren't a company that has limited runway, and we aren't a bro-grammer company, so I don't think we are being "unattractive" or anything like that. What we ''do'' have are specific technical requirements - experience with computer vision or computational geometry or GIS data or some related field, modern C++, git, bonus for experience with TDD/CI. We get a lot more female applicants for the C++ generalist positions, although still like 10:1. Oh, and this is in Europe. Not sure if that changes anything.

And I'm not a hiring manager, I'm a senior engineer who at the moment is wearing a different hat half the time. I'm not sure I'd trust any point of the funnel to non-technical people when it comes to hiring technical people. There are too many potentially interesting things that could be mentioned that someone who doesn't have a deep understanding of the field would discard good candidates out of ignorance.
I read that, and I still don't understand the point the article is making about how Mastodon is different to Twitter.
The tickets are a drop in the bucket of the total cost for a traveling family vacation. And it IS hard to save and spend at the same time.