skysight-inc/HackerNews huggingface dataset:
When I was looking to learn about how to systematically make secure software, I did not found all that great actionable information. There is a lot about particular hacks and vulnerabilities, lists of popular vulnerabilities categories etc. There are was one book dealing with architecture and such I found. Development quite clearly is not focus of security research.

A lot of advice, especially that found on blogs, was literally naive and felt like something written by someone who never even seen larger team working.
I'd want it to log that it's going wrong, and report that so that it can be fixed.
Your friend's eye color is defined by some genes. You don't need a gene sequencer to see what they are.
The question then becomes do they need us more than we need them?

I’d argue that the answer is yes. The key is organizing collectively.

I previously thought this was extremely unlikely. But a lot of the happy-clappy veneer seems to be coming off on the inside. Even this week with net neutrality, (within my tech-monopoly) the number of people who want to do something and are pissed off with:

”you don’t understand technology policy, monkeys; we have lobbyists, do anything and get fired”

... coming down from the top, is much larger than I’d expected.
I tried this technique with C++ but soon I realized it was a dead end. You try to build anything with C++ without some inner understanding of concepts like const, templates and STL, and I can bet things will blow up pretty fast.
It’s not even desktop users; most desktop users download Ubuntu and never touch anything, on reasonably common PC hardware. Kernel regressions mostly get caught in the Ubuntu betas or testing tracks (e.g. Debian Sid).

The typical user the kernel developers focus on here is a kernel developer: always running the latest kernel with a stable user space. I find it extremely narcissistic that they reject security improvements for billions of devices, for what essentially just makes developers lives easier,
I'm reminded of a recent security fix for IE11 that Microsoft pushed out earlier this year:

https://developer.microsoft.com/en-us/microsoft-edge/platfor...

It killed printing from iframes completely. Great that they solved the security problem, whatever it may have been. They also broke a major piece of browser functionality that a lot of enterprises rely on fundamentally. Hell, even printing shipping labels from eBay was broken, and so was hilariously Microsoft Dynamics 365. And our own product.

And the first response by Microsoft on this very link? "Won't Fix" and keep a major bit of fundamental browser functionality - printing a document - not working. "Do No Harm".
Show HN: A JIRA Capture Alternative
Also poverty. Not claiming that poverty is caused by addictive games but it sure doesn't help to spend money on what is essentially a gambling addiction.
The interesting thing part is this:

"Hikvision has been expanding in the Americas where it now has 8.5% of the market, putting it in the No.2 position. The Chinese government owns a 42% stake of Hikvision, according to a piece by the Wall Street Journal earlier this month on the security concerns of Chinese-made cameras being used in the US."

Article here:
https://www.wsj.com/articles/surveillance-cameras-made-by-ch...
No, if you disclose a data breach you get a small part (1-10%) of the total liquidation of the company before it goes out to pay the rest of the claims.

That creates an incentive for employees to cause data breaches and then disclose them for massive profit.
Best Workflow to Enjoy and Play DVD Movies on Samsung Galaxy Tab S3
Watch the episode of The Andy Griffith Show where the Howard Sprague decides to take the road less traveled.

(In all honestly, living on an remote island is better than being homeless on Market Street--I guess? It's too bad, I need to compare everything, to being homeless, in the great country of America?)
What's evil are the minds behind the tech.
In order to equate those, you would have to

1. either divide it by the market cap then and now

2. or divide it by the size of the order book(s) then and now

The first should give you a longer term view of the effect (I'd guess maybe a month?), the second a short-term view of it (within hours).
You didn't want this to be about our comments, yet you replied to my comment to criticize it? That's nonsense, unless you really meant to say "I didn't really want it to be about my comment."

This is more misrepresentation. When I posted the first comment, I didn't want it to be about our comments. The reason I gave the reply was the utter misrepresentation of my comment. Your reply was clearly meant to deceive people. Especially when you said 'Shouldn’t you practice what you preach here?' and then pretty much asking to provide a link for each sentence I said. While I was just warning people about people saying that linking to something helps it. Surely it is just more evidence that people take into consideration.

Also you hyped up the harm that an article could cause, yet you had no trouble trying to discredit me, quite hypocritical really. Are you saying the article could cause harm because you believe it is convincing?

My motivation was very plain and transparent. It was to have have people notice the 'trust my description but I won't show it to you' logic be criticized for the harmful garbage it is.

Anyway if someone misrepresents what I said, I will sometimes reply.
Honestly when I see other libertarians speaking against net neutrality I suffer a lot. Good to see at least there is one other that understands the pro-nn arguments
Fixing 19 years old bugs in FreeBSD
A free burner phone service for receiving sms and calls
Linux is a modular kernel. I'm not aware of a single thing you can't disable or make modular during config/compile.
I woudn't like to be the guy who's medical equipment killed him by slowly decreasing his oxygen levels due to buffer overflow either. If you're in this kind of business you take responsibility by discovering and fixing bugs which would go unnoticed otherwise. And if the life of your patients really depend on your equipment then having a redundant component within your device is a must.
Yeah, head first Java was really good.
Yeah, I guess that unlike the tobacco industry there are actually parts of this industry that do something positive for the world. Perhaps Big Social is a better term, or Big Gaming (AKA the AAA Industry...) depending on what problem you want to focus on.
I read the Ben Rich book "Skunk Works" about 15 years ago. I've never forgotten the ending.

Towards the end of his life Kelly Johnson suffered from dementia.

They wheeled him out on a runway and there was a fly-past of SR-71s.

Ben asks Kelly "Did you see that? They were saluting you!" I was bawling when I read first that and I am tearing up now. Talk about Epic Men.
Please let's not. It's off topic and we all know that it won't lead to constructive discussion.
And still, most of those who "manage" that, have still done tons of other shit.

2000 years later "let him who is without sin cast the first stone" remains controversial...
There are many good books on security architecture. The technical details change every week, but the fundamental approach does not change.

"Security Engineering" by Ross Anderson is a must-read:

https://www.cl.cam.ac.uk/~rja14/book.html

(it's freely available, too)
You have no 4G in NY?
So what happens when your browser crashes? I experience that on a regular basis. Id' rather have my browser crash/killed instead of slowly overwriting my filesystem buffers or corrupting my stack pointer...
Other than that browser are multi-thread/process applications. Usually only a single tab or a plugin crashes unless core browser process is affected. Most users would accept the trade off between crashed browser and infected/corrupted system.
Telling people "I demand that you do it" or even "do it, or else" is a symptom of a greater problem with said person. I don't see how waging battles with this type of lead in commit messages is going to help me.
About zippy. Licence says :

Copyright (c) Regents of the University of California and individual contributors.

On the wiki home page, we have :

Author
Wei Zhang, Facebook, Inc.
Mohaned Qunaibit, University of California Irvine

So basically, this is half owned by FaceBook... Right ?
I tend to have opinions that run contrary to Y Combinator's business interests. Combined with me being entirely too provocative sometimes, my comments are (understandably) flagkilled by default.
Incredible, I learned something about myself today.
I do think it's odd that the Soviet government knew we were sending planes through their airspace for surveillance purposes, and the US government knew that the Soviet government knew, but the US government decided that the US population shouldn't know.

When Powers was shot down, the US started with the cover story that it was a weather research aircraft. Then Khrushchev was able to embarrass the US by revealing that they had Powers, evidence that it was a surveillance plane, and demonstrate that the US had been lying to the public.

So, why did the US government lie to it's own people? Why wasn't in their best interest to talk about it publicly?
That's fine if you want to operate a proprietary platform, however you should be held liable for what your users do with it.

Facebook etc want the control of a private operator but the protection of a common service, which seems wrong.
So one of Linus' main points in this series of posts is that failing loudly is actually not always better than failing silently or quietly, and it's really annoying when people come in making that assumption without thinking. This is also something that he is constantly repeating and ranting about, and it's arguably one of the reasons why Linux is so successful.

Think about a smartphone - do most users want it to crash and reboot, even if some error (which could end up being a security issue) occurred? The answer is no, absolutely not. The crashing and rebooting itself isn't really that helpful. Reporting the bug to the Linux developers _would_ be helpful.

Some people do want the frequent crashing behavior and that's okay, but it's not okay to make that decision for everyone.

Also, users might expect minor breakage if someone somewhere makes a mistake, but that doesn't mean it's okay. That's like saying if someone always washes their hands before eating, it's okay if they get sick, because they were expecting that they might get sick.
The Indian companies battling drug-resistant superbugs
>These sexual harassment allegations are almost entirely arising in contexts where sex should be off the table.

Humans are not Vulcan-style compartmentalizing creatures, and no rule can stop love (and lust, contrary to puritanical religious-derived beliefs, lust is also ok), etc 100% from emerging. Tons of very happy marriages and relationships started in professional settings.
> Amazon offers thousands of “skills” (voice-activated apps) that let users do a range of things (including buy stuff from Amazon). The Google Home Mini, which debuted earlier this year, is similarly endowed.

Is there a store for Google Home apps? I have been trying for last couple of days with no luck.
>It's that the code has been RUN BY USERS for months. If it's been [...] in grsecurity for five years [...] It only means that hardly anybody actually ever ran it.

Subtle burn towards Grsec, I laughed a bit.

In all seriousness, I think Linus is somewhat on the right track. Security Patches should foremostly not break anyone's workflow (maybe except the evil haxor's workflow) and rather print a warning until the exact implications of a full Terminator-mode patch is understood. Because people won't upgrade to kernels that break their workflow and a warning in the kernel log is better than a vulnerable kernel.
OWASP Top 10 - 2017 [pdf]
25 Free Checklists Collection for Startuppers
Please, if anyone takes old hardware images, do put them on Wikipedia Commons, where there is a shortage. Recently I donated a bunch of old systems and peripherals to a museum in Australia. Before doing so, I photographed them and uploaded the images to Commons and was shocked to find how few existed! https://commons.wikimedia.org/w/index.php?title=Special:List... (scroll down a page or so)
Run the First Edition of Unix (1972) with Docker
Addressing a few points raised in comments:

1. The drumbeat of criticism against major information-technology-centric, largely media-based firms, has been palpably increasing. As a long-term critic, this is oddly disconcerting. Calls for regulation are increasing in the US and elsewhere. Critics include numerous former (and some current) employees, or executives, of major tech companies, including Sean Parker, former president of Facebook.

2. The dynamics and interactions of media, the public, tribalistic impulses, and politics (as well as other phenomena) are an ancient study, though one apparently not much focused on by many working in information technology: programmers, system architects, sysadmins, DBAs, network engineers, designers, UI/UX specialists, product managers, etc. Which is ironic because that really is our melieu.

There's a very large literature on this topic and I very much recommend getting up to speed on the topic.

MOOC ICS has a good, fast-paced introduction. I've been commenting on HN and elsewhere of my own explorations: Robert McChesny, Noam Chomsky, I.F. Stone, Marshall McLuhan, H.L. Mencken, Walter Lippmann, Gustav la Bon, Davic MacKay, Cicero, Aristotle, and Plato are among the authors I'd recommend.

First video (apologies, I cannot find the playlist link):
https://www.youtube.com/watch?v=QhGPbjxy2F8

3. "Technology" is a tremendously unsatisfactory term for the many meanings and connotations we give it. It's become synonymous in large part with "inforamtion technology" (though writ broadly it concerns far more). But if you do look at information technology, that field can largely be divided in two: media, directed at collecting and directing information from and to people, and cybernetics, directed at monitoring and managing non-human systems (including technical, engineering, financial, and governmental systems). Looking at each of these more closely even those distinctions start disappearing over the underlying similarities.

But the upshot is that a tremendous amount of what "technology" is is really the new "media". And yes, Google, Facebook, Twitter, Reddit, Wordpress, Spotify, Snapchat, and similar companies are largely media or communications companies in the same sense that Western Union, AT&T, RCA, CNN, or Time-Life Publishing, are. But bigger, faster, and with orders of magnitude more audience.

And the less-directly-media-oriented companies -- Amazon, Apple, and Microsoft -- still have media-like components, though they play in other spaces as well.

4. The current tech giants didn't invent disinformation, misinformation, distraction, propaganda, and manipulation. But they've made it vastly more powerful, targeted, sophisticated, large, and rapidly-evolving. They've also denied this up and down and blue for years, with all the credibility of the lead, asbestos, tobacco, automobile, CFC, coal, and oil industries. Which is to say: nil.

Not inventing a problem doesn't mean you're not embodying or exacerbating it.
That's not a shortage. That's just a time lag. It would be a shortage if nobody trains to become a construction worker because of price controls like minimum wage or maximum wage in an alternate universe.
>>It's not normal for someone known by everyone around them to be a harasser to be able to continue their acts.

I recommend reading "The missing stair"[0] for an account of how normal this actually is.

[0] http://pervocracy.blogspot.com/2012/06/missing-stair.html
The article accurately tells my story, of how I was trying to force update my service worker after updating a few pages, and ended up using this nasty hack (I think) when we install the service worker - self.skipWaiting(); from what I understand, this skips and let's the new Service Worker (with the latest cache version) install and skip the waiting phase.
And if they pull a Logitech (https://arstechnica.com/gadgets/2017/11/logitech-to-shut-dow...) I guess you'd have at least a tiny spot on the floor which will be very clean.

If you could reverse engineer it I would fake the control server (e.g. have a router that will spoof DNS) and have the spoof server be in your network. I wonder if the server does anything more intelligent than relay the messages from your phone, or if it has SSL...

Hah, man-in-the-middle for a vacuum cleaner. Welcome to the future.
I don't think that's particularly relevant in this context. Of course I can only speak for myself and what I said, but I can speculate on what I think the parent of my post was thinking, and both are something roughly like "this is just one more example of an ongoing thread of reporting, both 'editorial' and 'news', which is pushing a specific narrative regarding the tech industry and popular perception of same".

In that regard, that this specific article is an op-ed is an insignificant detail.

Even more so when the author writes it as though he was reporting "news" and not just an opinion. I mean, you get stuff like this:

Not long ago, tech was the coolest industry. Everybody wanted to work at Google, Facebook and Apple. But over the past year the mood has shifted.

Note how that's presented as an affirmative statement of an absolute fact.

and

Some now believe tech is like the tobacco industry — corporations that make billions of dollars peddling a destructive addiction. Some believe it is like the N.F.L. — something millions of people love, but which everybody knows leaves a trail of human wreckage in its wake.

OK, nice use of the weasel word "some", but still, this read like he's reporting facts, not an opinion.

And so on.
I can passively sniff all traffic and know where my users are going that is a big deal. Having a ip -> DNS mapping is a lot of work AFAIK, sure it can be done, but executing a get_hosts_by_ip() on every https packet is hard. In contranst this is enough to get all hostnames from SNI:

tshark -T fields -e ssl.handshake.extensions_server_name

I do agree that there is more things to consider about privacy, but the call for al websites to be encrypted is so naive. If that is what you want it would be enough to extend chunked http with an adler32 on the end of each response/chunk, and it would be a lot easier to work with than TLS.
Has anybody quantified the efficiency gains from using emacs to do work rather than conventional means? Are there certain areas (e.g. Mail, todo, notes,calendar,scheduling) that gains more efficiency than others?
40 Gbps and 100 Gbps Ethernet standard was defined in 2010 [1]. Google "buy 100 Gbps Ethernet" and you will find it is real, although currently is geared primarily for datacenters.

[1] wikipedia.org/wiki/100_Gigabit_Ethernet
Coding Boot Camps Are in Trouble, but New York City Has a Plan to Shape Them Up
Plug: https://github.com/thoughtworks/talisman
the man depicted in the animation is explaining only to women

the actors behind the cartoon are reading a script written by someone...are you fooled by the puppetry ?
I've never tried it on Windows so that might be the issue. Windows is still somewhat a second-class citizen wrt Emacs and Git. Not as bad as is the past and getting better every day but still noticably worse than on a Unix.

I've aliased magit-status in my shell and it spawns a new Emacs instance (no demon) and magit in a few seconds.
Hug Machine
Multiplayer games in Group Facetime
We (the engineering classes / actual technologists) need to do more to brighten the line between the technology and the motivations and incentives of the people putting up the capital (and the executives/lawyers/lobbyists they control).

I don't really agree with the article, but this is an awful defense. Abdicating responsibility and shifting blame is what gives the tech sector a bad name.

A quote comes to mind, and seems to fit quite well: Now I am become Death, the destroyer of worlds[1]. It's hard to know what Oppenheimer should have done differently in this circumstances, but at least he faced up to his part of the responsibility for what he had done.

[1] http://www.wired.co.uk/article/manhattan-project-robert-oppe...
7 Tips on How to Shop Baby Girl Winter Coats
Flower prints are my favorite kind of print. I think its classic and can be added to pretty much any outfit.?this is cute, oh my goodness! So adorable! Jollyhers' babysoft knits, aww-inspiring quality and color-coordinated sets make outfitting baby easy. Cute, colorful, fresh and modern, Carter’s is your one-stop shop for the best value in baby clothes for boys. Add sporty accessories, like a hat, socks or sneakers, and she’ll have everything he needs to get his game on.get ahead for the holidays with up to 10% OFF as you order + FREE SHIPPING on thousands of items
Up To 70% OFF Black Friday Sales! Enjoy this big sale to shop Jollyhers Stylish Warm Girls Coats,keep your little girl warm and dry to through out the winter.It's important to find the perfect one that your little girl loves. When she’s hanging around outside with friends for an afternoon, her coat is going to be her statement piece because she won’t be taking it off.Moreover,You can also use 10% OFF Code HAPPYFB to buy any precious kids clothing in Jollyhers.
Jollyhers is a fashion kids clothes store, we offer Little Girl Winter Coats/Girls Special Occasions&Party Dresses and Cool boys sweater/jackets,designer stylish,high-quality materials,reasonable price,and free shipping.
Welcome to visit your fashion designer & stylish Kids clothing shop on https://www.jollyhers.com/girl-coat-jackects-167 now!
The person at the other end of the conversation would disagree with this sentiment:

"Thanks. Still, I'd prefer Linus yell at me than other folks trying to do similar work. If I can shield anyone from this abuse, then maybe they won't give up on kernel security development. Digging Linus's actionable feedback out of the ad-hominem attack can be challenging." [1]

[1] https://twitter.com/kees_cook/status/932694978366619648
I don't think this is fair characterization.

Errors are less likely to be actual exploits in servers too. When the kernel panic is caused by faulty driver failing network hardware, or user land software failures, it can take down multiple servers or all of them at once.

Most of the information in servers is private but not sensitive. You don't want anyone have access, but correct functioning and security warnings are more important than maximum information lock down.

btw. I don't see reason for not having kernel option to turn warnings into kernel panics.
I want both.
Panic in a test/development kernel, do not panic in a production environment.
It's been years since I've consumed a square API, but I found it amazing when I did. Thank you for your work, even if it came after I used it.

Do you think that the Square API hit the level of design just because of the people involved? Or are there organizational factors that played into it? I.e. was good API design seen at the top as a good reason to take longer with a release? I really want to find suggestions to take into my company.
I wrote the email that prompted this quite civil response. I'm very pleased with the outcome, because I think this clear statement of his position is a lot more useful for people to work with, rather than just assuming Linus hates security or something.

I interpreted his response in practical terms as essentially being the following. Patch set merge 1 has "report" as default and "kill" as a non-default option. Patch set merge 2 has "kill" as default and "report" as a non-default option. Patch set merge 3 removes support for "report". This way we have the best of both worlds: we eventually reach the thing that actually adds real security benefit, which makes security folks happy. And we don't break everybody's computers immediately, allowing time for the more obvious bugs to surface via "report", which makes users and developers happy. Seems like a reasonable process to me.
you actually don't believe that they delete your data, do you?