skysight-inc/HackerNews huggingface dataset:
1. This would require PyPI to provide computing resources to build the packages (for all OSes, if the package contains native code). And then, malicious packages would just detect the build environment and avoid exhibiting the unwanted behavior. I think I read that it's not unusual for malware to detect being ran in a VM and doesn't do anything suspicious to complicate detection and analysis.

2. I don't think `pip install --user` adds any significant security. A little bit - sure, but not much. A trivial injection into ~/.*shrc or ~/.profile (I don't think anyone would notice the file was changed until it's too late) would result in full system compromise on the next login and sudo invocation. Same goes if you have ~/bin or ~/.local/bin (or anything user-writeable) in $PATH.

And even with non-root access, malicious software can do a lot of undesirable things (e.g. send spam or steal user data).

---

I believe, signature-based trust (with mandatory code signing) is the way to go. On the first `pip install` ever ask "The package not-expect (1.2.3) is signed by The Spanish Inquisition (key: ...) and was audited by The Python Developers (key: ...). Have you verified the keys and do you trust a) this vendor, b) this auditor or c) both?", then it gets recorded in ~/.pip (for this machine) and ./requirements.txt or ./setup.{py,cfg} (for distribution) so future installations don't ask anything.

To get non-interactive mode (for CI or something), on must either pass something like --insecure-skip-signature-checks (so they mean it) or pre-supply all the trusted keys.

(Not ideal, of course - just a quick idea. Surely, it has a lot of rough edges to polish.)
I think by most accounts -

1) Google / Waymo is by far the furthest ahead in self-driving tech.

2) Self-driving is possible in at least certain circumstances in the next decade or two (already is to an extent today).

3) Transportation / automobiles is an absolutely massive industry. Even companies like Dana, Inc (maker of axles) have $4bil valuations. It's easy to see how a self-driving tech maker would be worth far more than an axle maker.

4) Software tends to be a winner-take-most industry.

Given 1-4, $1.1B doesn't seem like much. Even if by chance it doesn't turn out to be a positive ROI, it seems crazy to think the $1.1B was a bad bet.

And given current prices for self-driving startups (example, Gm's acquisition of Cruise for >$1B), the current market value for Waymo would likely be >$10B.
While we are on jokes about this, could you imagine if someone raised the argument back in November... "If California bans plastic bags obviously bums will poop everywhere, and hundreds of people will get Hepatitis until we bleach the streets."
No your cloth bags are not the solution. It's a trade off between immediate needs and future costs. I don't dispute plastic bags have many negative externalities however they are profoundly immediately useful to humans. There are massive unintended consequences whenever you impose a designed objective function on reality as a planner.

In regards to the questionable surfaces I don't dispute that either but it is irrelevant.

what the relevant issue is measuring the baseline transmission effectiveness from a outbreak source prior to the behavior change vs after.

It is a physical fact that a shopper, for example a horder, who can provide source bacterial matter has been increased in likelihood to bring a bag with such matter and then when checking out has an exponential increase in contact with others. There are documented cases of people using hospital bags for their groceries.
Usefulness of Useless Knowledge (1939)
"Retire?" Do they mean like retire to a federal prison?
Electric motors, like just about everything else, can get mechanical advantage through gearing. I.e. you can use a smaller magnet if it's geared to spin, say, 10 times versus 2 times per meter traveled.
Not all things are farmed like you seem to think. I own a commercial wild blueberry operation. Knowing this information, with less effort and cost, can improve harvesting methods and may do things like reduce the reliance on chemical weed mitigation strategies.
It requires a way more complicated toolchain because you have to use dynamic methods to generate references to the assets in HTML/CSS/JS.
They tried that in SLC, but it turns out that not everyone who is homeless wants to live in a home. I would imagine this is related to mental illness, but you can't just force people to move into a home who don't want to just so homelessness is "solved".
More you like your stupidity is in reacting with your conditioned liberal brain damage.
Wait you're actually running git on production boxes? Doesn't that mean your entire build toolchain also lives on production?

The last company I worked for did that and everything was much slower and fragile than it would've been had we deployed packaged artifacts instead.
> Why aren't credit reporting agencies already being sued left and right as it is under existing law?

Too Big To Fail, I think. They did eventually get sued for "robo-sigining", although personally I think everyone who ordered their staff to participate in it should have been jailed for perjury. http://www.marketwatch.com/story/us-breaks-down-93-bln-robo-...
> much more secure PIN

Is it? Before touch sensors became the norm people would put in their PIN every few minutes. It would get picked up by countless security cameras. You could talk to a stranger for 2 minutes and pick up their PIN if you didn't avert your eyes.

And most people didn't use a PIN at all, because it was too much bother.
Can Face ID feature still work in outdoor environment, specially under sunlight?
He said that everyone, men and women (and even children), were governed by subconscious sexual desires. In that respect he was pretty modern - or perhaps that thanks to his influence, we are how we are today.

But on the other hand, he did have detailed theories of male and female sexuality and how they differ. Those details (Oedpial complex, penis envy, etc.) are for the most part laughable today. But they paint an unflattering picture of both women and men, in different ways, so you do see criticism of him there.
FWIW I found a bunch of them:

[0]: 2 years ago - https://www.reddit.com/r/IAmA/comments/2qq95l/i_am_the_found...

[1]: 1 year ago - https://www.reddit.com/r/IAmA/comments/3zh78n/im_ken_lin_fou...

[2]: 9 months ago - https://www.reddit.com/r/IAmA/comments/5ha7sg/im_kenneth_lin...
Can't help thinking Face ID is something Apple had to do, not something they really wanted.

Reading fingerprint with/through the touch screen [1] sounds a better alternative if they ever get it working well enough.

[1] https://www.google.fi/amp/s/www.theverge.com/platform/amp/20...
Our ICO Makes It to Fast Company Magazine
Dump truck, not garbage truck. This one is transporting rock from a mine to a cement plant. It does not transport garbage. The mine is just on a mountain.

Again, trash is not involved.
Llbuild, a low-level build system
Well, considering how many people got rich off of Bitcoin, they're not wrong.

I disagree that bubbles are dangerous to Bitcoin. It's just the opposite: Bitcoin is defined by bubbles. I still remember selling five Bitcoin at the peak of $32/coin and feeling smug because it crashed to ~$12 after.

That will happen, always. The world keeps turning. It doesn't matter if you ban it when people can participate via localbitcoins in person. So there doesn't appear to be any way for people to stop it or control it.

I agree that putting your retirement money into it is a bad idea, but there's a wide range between that and putting in $2.
FPGAs are not a new thing. But FPGAs that are big enough and fast enough to outperform ASICs (in the networking context) is a new thing.

Re the title. It's perhaps a bit poetic, but it's not misleading. What else could the title possibly mean? It's either going to be about 3D printing or FPGAs. You can't seriously expect to actually download a physical piece of hardware.
A PIN isn't perfectly secure; someone can watch you enter it with a security camera or can tell which buttons you pressed from the finger impressions on the screen.
>Once you look at it, it will be unlocked.

I'd be impressed if this was the case. Looking at a phone <> a phone's camera being able to see your face straight-on.

Face-unlocking is not new, and it's not widely used. If they've managed some physics-defying scanners then maybe it'll be OK.
Preface: these are the questions of a CS student, not attacks.

What about java/.net/regex engines? Is it required that they exist outside the browser, or are performance limited to interpreting, or is there a better solution?

What's the problem with the control flow of assembly?
I'd like to have a way to force If-Modified type checks on cached assets after a deployment, but not if no deployment occurred.
I highly recommend this 1995 Wired article about Ted Nelson and the history of hypertext: https://www.wired.com/1995/06/xanadu/
Some of the best engineers that I worked with have been Linguists, Music/Composition majors or Physicists.
Mods, can you change the link in the OP? For those who aren't familiar, Inhabitat is an extremely click-baity source and almost all their content is entirely credulous restatements of press releases or articles from other publications. As someone who follows sustainable architecture issues I categorically ignore anything they publish.
Hey Cliff, how can we help out? What specifically needs to get done?
Sure. Like most companies, Google settles plenty of lawsuits and only tries them when it has to or believes it has a high probability of winning. Precedent fear guarantees nothing. You could have said that about any number of cases that Google has settled.

There is zero chance that a law firm would take this pro-bono, regardless of the perceived marketing benefits, because it's simply too expensive.

It will not be financed by Google's enemies. If it's financed, it will be by a litigation financing company like Burford or Bentham IMF or something.
Patreon is fascist.
It is depressing. I cannot help but think that the same strategy will be applied to AI, IoT, and cars. It just is so inhuman. I don't care about scale, there is a certain level of handshaking and communication that needs to occur.

Worse, people don't get why I cannot simply call someone. That's how it works in everything else.
Retire is the new fire
This is pretty brilliant. Good job and thanks for the share!
Because our enemies even attempting to influence the election should be outrageous to a patriot.
A facial gesture to disable would go a long way here. Stick out your tongue => force passcode
I use ibus on Linux, it has an option in the advanced settings to "Use system keyboard layout". This applies the default layout to all other input methods.

Notably Ubuntu comes with Dvorak for Japanese as a default, an option I've never seen anywhere else. So there might be special support for your use case. This solution doesn't scale well though.

My keyboards also both have hardware output to Dvorak, which would probably be the best option on other systems. It's been too long since I've used other systems to have a better answer than that though.

From a brief search, hardware transformers do exist, but they seem excessively expensive (QIDO is $150). You can buy a nice keyboard (with the option built in) for less than that price.
So they weren't concerned about organic but radioactive spoiling ? I guess organic and simple material would degrade in Saturn condition anyway ..
We're on to the second generation, in my opinion, of a very destructive self-sustaining cycle. In the 80s, parents were taught 'latch-key kids' were neglect and they were 'growing up too fast' (a nonsensical idea). So they overparented. This was accepted by them gladly because when they were raised, things were very permissive and they remembered being those long-haired hippies that they had turned their backs on when they became stock brokers. They wanted to make sure their kids didn't get similar rebellious ideas.

So those children got over-parented. As a result of the degree of control they suffered, particularly during adolescence, they never developed a full adult maturity. Now they're having kids. And they're not mature enough to handle it.

Parenting is the hardest, but most rewarding, thing a person can do in their life. Your job (and most parents today would be shocked to hear this) is to take a child and turn it into an adult. Not a larger child. Mere aging does NOT cause a child to develop. Experience is the exclusive means through which new neural connections are formed. Intense and novel experience in particular is the most useful for development. In their absence, development does NOT occur. So as a parent, you have to expose your child to these things that will change them. The child you love more than your own life will be turned into an individual who wants to leave you and has no need for you. How mature do you have to be to put your own feelings aside and accept that this inevitable heartbreak on your part is in the best interest of your child and therefore you will pursue it actively? Very, I'd say.

The next time you hear a parent remark that their child is "not ready" for something, whether its watching a scary movie or dating or whatever, ask them what they are doing, as a parent, to MAKE their child ready for it. You will typically get a blank stare.
The one type of game that worries me is the realistic driver's-point-of-view car-racing game.

The risk of someone training themself to drive more dangerously seems much more direct than the "priming aggressive thoughts" stuff.
Think about it like this: mountains are places where deep mineral layers are pushed up into the surface, exposing them. It's where you find many of the dense, valuable ores without layers of dirt and non-valuable rock overtop. Mountains are actually great places to mine.
Interesting idea, but I find this (https://github.com/dosyago-coder-0/5-lines/blob/master/javas...) to be disingenuous, at best. That's a multiline function that has been minified. You can theoretically make any function a 1 line file if you minify it.

I could buy a simple chain like this (https://github.com/dosyago-coder-0/5-lines/blob/master/javas...) as a one-liner, but not the RNG.

The seq() function is a little more impressive for being just "five" lines.
And 10 years later everyone will be using glasses to correct the "looking at an 8K postage-stamp sized display" syndrome.

Not possible without some magic holographic technology.
Wait until you find out that some of the best security folks didn't major in anything!
It's not new but they're doing it differeny. Craig said in the article that as long as it can see your eyes and nose (maybe mouth too?) it can see enough to unlock. You don't need to be square to the phone.
Dump(er) truck, not garbage truck. This one is transporting rock from a mine to a cement plant. It does not transport garbage. The mine is just on a mountain.

Again, trash is not involved.
At the train stations in Paris, they have pay toilets and people beg for change outside them so they can use them.
NOT SO FAST!!1
Fun! It would be nice to see what price we bought the currency at in Trade History, plus what our current profit is per currency.
Jason Scott Talks His Way Out of It: A Podcast
> e.g. I use the terms "Flag" instead of "Boolean"

I'm not familiar with THT and this is a nitpick, but doesn't this contradict the first principle? Pretty much every language I've ever used has some notion of "boolean", and I don't know one that uses "flag". Don't want to bash, just curious how that decision was taken.
I think we can all be fairly confident that a key feature in Apple's flagship new phone will work in sunlight, yes.
I think it's important to take a step back, take a breath, and look at this rationally.

Look at what actually happened. Equifax was using the Struts framework. This is a very safe, popular choice. They were using what everybody else uses.

There was a critical vuln in the framework, and they failed to update their box for N months. But we're talking only a few months. N is very small -- maybe four? And yeah, you can argue that four months is an absurdly long time to have a known critical vuln in production. But I guarantee you that most people reading this work at companies that are similarly vulnerable. Attacks are simply rare.

Whatever company you work for, if you do not have regular pentests, you are no better off. And even if you do, it's overwhelmingly likely that you've overlooked some lonely outdated server that's still running on your network because Bob set it up a year ago and forgot about it and oh look now you have a pivot into your whole network.

It seems very strange to choose this one company and crucify them just because they lost your data. Everybody is insecure everywhere always, and we've learned to tolerate this by pretending it's not true or that it doesn't exist or that it's not a big deal. But you know what? It is true. That truth will continue to manifest itself in the years to come. No matter how much you'd like it not to be true, your stuff will still get stolen. Usually you just don't hear about it.

Yes, it was stupid for them to have everybody's PII attached to that one webserver. A single point of failure should never result in compromising the whole system. But think about how that architecture would work in practice. A customer service rep still needs to get at most of your data. It's a credit bureau. Where would the data be stored in a way that a remote code exec wouldn't be able to snag it?

Equifax's crime boils down to "they failed to run the equivalent of sudo apt-get upgrade on their framework." When you're managing a fleet of hundreds or thousands of machines, this is a situation that almost all of us have wound up in. If we can't get it right, why do you want the execs' heads to roll? Are you sure you won't be next on the chopping block?

Think about it this way: the time between "someone discovered a vuln in Spring" and "the attackers stole 150M credit reports" was just a few months. Are you sure Equifax wasn't a victim here? Someone threw a cinderblock through their window and made off with their trove of data.

Except of course, it wasn't a cinderblock through a window. It was completely silent. Even if your firewall is great, you can still smuggle data out of a network using DNS alone.

Food for thought.
Wow, that's really horrible. I have a file sitting around with a couple of newlines in the name just so I can see how many programs don't cope with it, but I hadn't thought of using a lone combining diacritic.

If anyone wants a command to make one, try

touch $'\U035F'

(using U+035F COMBINING DOUBLE MACRON BELOW for no particular reason, see [1] for more)

[1]: https://en.wikipedia.org/wiki/Combining_Diacritical_Marks
Sorry, I meant the trouble and expense of including the TouchID sensor in future phones once you already have FaceID on them.
Isn't that crazy?

And many jobs that lead to personal financial gain very rapidly are concentrated in and around city centers.

This means that most people are playing the 250k+ game and not the 150k game.

And all they are doing is bidding on how close they want to live to work usually.

Now imagine all of the good things you could put that money towards that isn't just rent-seeking.

Things that will result in wealth/value creation (better medicine, better technology, higher median net worth).

And then cry a little inside, because despite the technology existing for many people to work remotely, the 500 companies who control most of the world's wealth generally don't allow it.
no, that's where the poor and disadvantaged retire to. and the occasional disgraced public servant.
If we just had the right system we could solve the problems.

Some people just don't want us to have the right system.

The right system is the solution.
Unpatchable Flaw Affects Most of Today's Modern Cars
> A deeply arrogant and ignorant notion.

This sentence is quite arrogant in itself.

> If you think this was about FUD you really don't understand why people protest React as a core component inside WordPress.

Then please explain what this is about? Numerous other posts in this thread (including mine) have explained that you are strictly better off with the PATENT grant. I have yet to see a post that explains why this is bad without FUD.
What were they thinking in the first place? It was a stupid move to begin with.
paywall:

http://www.facebook.com/l.php?u=https://www.wsj.com/articles...
The F-16 values are from actual aircraft operations. I don't know what an MBT is or how it relates to aircraft.
Authoritarians can abuse it all with equal ease.
Right, all things considered they're still less carbon intensive than and ICE car, especially with a few hundred thousand miles on the odometer. People seem to conveniently forget that an ICE car requires a lot of carbon to manufacture, and then creates even more with every mile driven. So even at the start the EV is ahead (or as your source says, within 5 months it's ahead).
I thought it was well established that timing attacks could identify the user? My understanding is that if you remain on the network, domains ending with .onion, you're still able to remain anonymous.
For those who can read German, here's the original with a lot more information including cited documents and graphs and charts. https://netzpolitik.org/2017/geheime-dokumente-der-bnd-hat-d...
Encryption for low data rate systems is actually a very easy problem. I have sensors in the field which transmit a 64 byte package once a day only 18 bytes of which is data and is encrypted. the encryption an one time pad in ROM which lasts the life of the device (8 years) the device does not receive.

I agree encryption is totally necessary for medical/sensitive data or two way devices but for other cases (such as irrigation data) no encryption or an encrypted ID is just fine and a problem that does not need to be solved.
There people living in the streets pooping in bags.

And you think we just need more safety nets?
Completely agree. Future generations will marvel at the fact that we didn't figure out that having large populations living in poverty would create hot zones for contagious disease to spread from. The Ebola outbreak that showed up in Dallas a few years ago comes to mind. Poverty needs to be eliminated worldwide ASAP to prevent the next pandemic.
Please stop breaking the guidelines. We've already asked you several times and we ban accounts that won't post within them.

https://news.ycombinator.com/newsguidelines.html
Why do California lawmakers compress a year's worth of bills into five days?
CarGurus Files for $100M IPO, Reveals Growing Revenues and Profits
Wait until the first flu season in Chicago with the bag tax it will be this year.

The politicians will have dead babies and elderly on their hands. It will be obvious in 5 years when some researchers realize that suburbs nearby don't have the bag ban vs other idential demographically areas within city limits do but somehow flu rates are statistically significantly higher and since they won't be able to find any other explanatory variable. ... oh shit.

I just watch people for 30 mins and saw some crazy ass shit so people could save themselves 7c.
Hang up doggy bag distributers on telephone poles downtown - sure just give me an afternoon.

Also, fix the homeless problem. - https://imgs.xkcd.com/comics/tasks.png
One might be tempted to think that our schooling systems which were designed and optimized to provide workers for the manufacturing world might need some retooling for an age in which the world has little use for rule-following folks content to stand on a line pulling a lever all day...
Somebody didn't read the article.