skysight-inc/HackerNews huggingface dataset:
Certainly, but depending on the type of attack, that might not be of much use. In a targeted attack, the damage might already be done by the time the certificate is detected. Additionally, revocation as a whole is broken in various ways[1], not to mention that even with hard-fail revocation checking[2], you have a window of several days during which you can staple a "good" OCSP response, from before the certificate was revoked. (The exact lifetime is up to the CA - I think the maximum allowed is 7 or 10 days.)

CT, as currently implemented, is good at two things: Detecting misbehaving CAs, and detecting certificates issued by attackers after a server is compromised or domain is hijacked, assuming the domain owner is monitoring logs for such certificates. The Web PKI does not provide many tools that actually mitigate damage for the second scenario (unless you've deployed HPKP, which is on its way out).

[1]: https://www.imperialviolet.org/2014/04/29/revocationagain.ht...

[2]: Practically no mainstream browser uses hard-failing OCSP. Firefox supports the X.509 Must-Staple extension, which enables hard-failing OCSP, but Must-Staple has a glaring hole: If the attacker gains the ability to issue a certificate for the targeted domain, they can simply request a certificate without the Must-Staple extension. Must-Staple's usefulness is mostly limited to key-compromise scenarios.
Just tried it out, only one attempt and got good results!

Couple of ideas, you may already have considered:

1) Use a color-correction algo to help with tinted hair. Then use something like MASK-RCNN to get pixels of hair and get dominate cluster of color.
2) If lighting/shadows/environment causes so much trouble maybe have user rotate/tilt their head in circle-motion (like Apple has users do to train FaceID) then these run ~30 images through your algos and average the results? Maybe have torch on during capture to make the data more homogenous. (Or do once with torch, once without and train two different networks for both types of captures.)
3) If user manually overrides hair color show them your algos next 5 best predictions as other color choices so you can more easily retrain if user selects one of these other predictions. Maybe have them manually adjust bounding polygon of hair detection and even adjust image color correction sliders to show "what my hair actually looks like" (so you can train color correction).

Just some ideas. Cool product! Good luck!
Spotify version 1.0.69.336.g7edcc575, installed this morning when I read about Concertmaster.
You're putting a lot of responsibility on some regular people. Do you go around to Inuits quizzing them on Southeast Asia too?

Ordinary citizens do not vote on issues affecting an individual country. I'm sorry, you're just going to have to accept the fact that not all Americans are well educated.
yeah I've heard those kind of things about UK banks

its easy to get this problem in the US but I know how to navigate it here, all of my bank statements have the transactions as listed as BTC somewhere. Coinbase tx's have BTC in the statement line item, some of my OTC exchanges do too.
A number of donor-advised funds accept BTC contributions (and take care of converting to USD). This also avoids realizing capital gains, and allows it to be immediately converted to USD before the value crashes while allowing the decision of which charity to donate funds to to be deferred.
The bug response was laughable "yes with unrestricted acess to an account you can steal data from it".

This makes it sound like "with enough time and patience anything is possible"

But the steps described aren't even what i would call a hack. You could do them by accident if you were trying to log in to your own account under someone elses computer using chrome, in less than a minute if you're quick. It requires no technical knowledge and can be done with time to spare during someone's bathroom break.

Here's the process in a nutshell:

1) logout of their account in chrome.

2) login to you're account

3) lie and say you were the previous per person

This isn't a hack. There is no hack! This is a very small step above the "honor system" as your security!
What is a currency?
worth mentioning (that sort of main premise of the article that gets a little bit unnoticed in all the methodology discussion): all existing HWRNG are relatively low bandwidth - because they are bound by physical process, rather then endless spinning up of /dev/urandom. They all have to wait for physics to produce each bit, and existing chips don't have that much "physics" in them.

The main novelty factor of "camera noise HRNG" is that we effectively leveraging 12M micro HRNGs in parallel - thats where that firehose of entropy is coming from.
Sweet, sweet vengeance has been unleashed upon the Dalek: https://www.dezeen.com/2017/12/13/k5-knightscope-security-ro...
Do you know differently or it's different in your area - https://news.ycombinator.com/item?id=15919075 ?
Rome reached it's maximum size in 117 AD, the fall of the Western empire is considered to be 476 and the fall of the Eastern empire was 1453. The time between Rome's period of conquest and the "fall" is longer than the US has existed.
And that they have no monitoring to detect breaches.
If I can suggest, COBINHOOD offers zero-transaction fee trading not to mention it is highly secure. The launch is on 18th December but you can read more about them here: https://medium.com/cobinhood/how-the-crypto-world-can-improv...
At least one important thing will happen as a result of this person's effort. Probably many great things no one expected.

The world needs a lot more people like this. The example being set here should be emulated by many others.
>the biggest proponents of UBI are ultra wealthy.

How do you know? How many poor people have you asked?

(P.S. Don't assume that everyone who reads HN is wealthy.)
Presumably a resume that lists malware development experience, would be being floated mostly past companies looking for a malware developer.
It's the thats-not-my-problem response that worries me the most.
Ah, I guess I sometimes forget just how lucky I am to be an EU citizen.

However, there's still a plenty of nice places that don't ask too many questions.
Zmap – the Whole-Internet scanner
When an attacker can gain access to your unlocked computer and have time to logout/login your browser, you should not expect anything on the desktop is safe. Personally I don't see this as a security bug.
Check out Synapse.AI basically answers your question to data + ML models -- in a decentralized way.
The best argument I heard against was the stifling of innovation and it turning into land lines, which turned into useless monotech who refused to change without a form 37-41B, which most certainly did not exist. I can't argue that, as they're all hypotheticals, as all of these exist in a world of hypotheticals, including my original statement, so these types of discussions turn into sticky wickets super quick.
One wouldn't even need to generate those 10k images.

Simply integrate the code together and generate on the fly. Much faster and simpler!
All: please try to avoid going into partisan rabbitholes.

We detached this subthread from https://news.ycombinator.com/item?id=15916464 and marked it off-topic.
I worked for other adware maker in IL (left after couple of months, when I realized how the company actually makes money), it's pretty big industry here since we have a lot of adtech and endless appetite for easy money. AMA.
Only 17 million US workers with a population of 320 million. That can't be right. Maybe 1/100?
Oh god, thanks so much for this. I've literally just been testing on prod and praying that it works.
I agree with everything you said except the double taxation of dividends.

Australia has probably the best system in the world for dividends. We use a franking credit to offset the tax paid by the corporation so effectively we have no double taxation of dividends.

I've never seen the point to any double taxation and I applaud any government willing to help citizens and business work around double taxation.
Vue based simple podcast player
The trouble is: it's not a VM, so what you are asking for is not passthrough, but driver support.
The equivalent of "net neutrality" for cars would be "road neutrality"; any car can drive on any road, regardless what the contents are.

If you have a dog in the back seat, you can still drive on every road. Cat? Same deal. If you have some railroad tracks in your trunk, which obviously means you might be competing with the roads, well, you can still drive on them.

That's the more "honest" comparison.
I have zero problem with HN being of financial benefit to YC. In fact, I have repeatedly said that I think this is exactly why it is able to sustain a standard of excellence.

HN becoming the personal platform for the new YC president's political aspirations and personal pet social theories does not appear to me to be of any financial benefit to YC.
It would be acceptable for your local Chinese food restaurant to serve their landing page without https. But a bank? of all things? A FUCKING BANK?.
SNAP, section 8 housing, disability, and other programs are still necessary under UBI unless UBI is absurdly high. If is that high, then the sick/elderly/disabled are hugely disadvantaged relative to those who are not - not a desirable outcome for me.

We should overhaul our existing programs to provide graduated phase outs instead of creating new entitlement programs.

I see UBI in general as having far more perverse incentives than welfare does right now (and they are bad).
Not on macOS. Both are identical and use Yarrow to generate pseudorandom numbers.
Please don't take HN threads on generic ideological tangents. They are extremely repetitive and so don't count as interesting here.

We detached this subthread from https://news.ycombinator.com/item?id=15916381 and marked it off-topic.
Not everyone can get hired by a name brand company. No need to rub it in
Some pitiful Vimming right there. From holding down `h` for 30 seconds to go to the beginning of line to using :wq instead of :x.
It gives better anonymity that way. If unspent change went back to the same address, people would be more inclined to reuse the same address over time, which makes it easier for someone looking at the blockchain to identify who's paying who.
TL;DR:

Since Go does not have any decent error handling system, regular code will tend to have convoluted if-then-else blocks, thus the author proposes simple, effective ways to simplify them, so you can enjoy Go and keep handling exceptions as if it was early 1960s, but without the hassle of using punched cards.
It would be consistent with the funding though.

>funds made available for injury prevention and control

Say that research shows that more guns => more injuries. It would be reasonable to then hypothesis that gun control could lead to less injuries (injury prevention) and that would bring research into effective methods of gun control into their scope. (and the verification that it leads to less violence).
(Mineral) Mining company announces intention to pivot to cryptocurrency
The copyright for Linux (the kernel) is not held by a small number of people or organizations. There are many contributors with copyright notices all over the tree. I don't think he could relicense if he wanted.
I hear you.

I was pulling my hair out the other day trying to find my Microsoft credentials in LastPass. I was searching for "microsoft", "office", "outlook" etc. until I finally found them under "live.com".
Could you please expand on how you think colonialism is to blame? I don't see any suggestion of that in the Wikipedia article.
You are correct, but since backwards-compatibility matters more in the Windows world than correct, it will likely never be changed.
Maybe I am under-thinking it, but why not just gray out and obscure those regions of the graph (or whatever) with a label "Different Driver"?
This is a publicly traded company, (albeit a penny stock) and the thinly-traded shares spiked on the news: https://finance.yahoo.com/quote/AXQ.V/chart?p=AXQ.V
The way I view something like YC similar to basic income is that equity or a dividend from equity owned is like taxes being paid. The important things have to be very clearly defined in order to make a fair judgement call on any plans/experiments that people want to try.
I waa going to ask why we all fetishsize dystopian futures and the I read the tweet.
Apple's annual profit in 2015 was $50 billion. Divided 1 million ways that's $50,000. So Apple literally can offset 1 million unemployed, at least in a good year. (And really, it seems arguable that they could offset 2-5 million depending, since people certainly live on less than $50k/year.)
Also is pretty active on his (very good, IMO) technical blog:

https://brandur.org/articles
I suppose you could say the same about those who worked on Intel ME, Computrace[1], and maybe other DRM technologies too?

Personally, I can refuse an offer from Google or Microsoft because I do not agree at all with their vision, regardless of how much they want to compensate me, but it really is a difficult situation to be in --- people get asked to do things which are against their personal beliefs all the time, and there may well be other reasons why someone would work for such companies, so I don't find it unusual that he would try to make the best of it.

[1] https://news.ycombinator.com/item?id=2500472
Rageposts are not cool here, regardless of how badly someone or their company messed up. If you keep posting like this, which we've asked you repeatedly not to do, we're going to ban you.

Any good faith view is possible to express thoughtfully if you want to, so if you want to comment on HN, please do it that way.

https://news.ycombinator.com/newsguidelines.html
In a mostly unrelated sidenote, I'd love to experiment with this in a simulation of my hometown. The city is pathetically dependent on cars in it's culture and urban planning. I'd find it interesting to apply crazy taxation to automobiles with all of the revenue being funneled into public transport.
Opening the Google AI China Center
Venezuelans Seeing Bitcoin Boom as Survival, Not Speculation
Is any security software that easily bypassed?
I followed out this logic, and concluded that all pages on a site have to be encrypted, because someone may try to navigate to the login page from any page on the site. If the attacker can intercept one page they can lead the user to their own site (possibly even HTTPS, but with the wrong certificate). In a perfect worlds users would always check which certificate they're trusting (and have a plausible way to check who it belongs to) but that is not the real world.
A more compelling exploration of that analogy would be the state taking land to build a road through eminent domain, and then selling or long term leasing to a private company to build a toll road. The corporate owner of that road then signs an agreement with certain car companies (say Chevy) to have discounted tolls for that brand of car, while raising tolls on the other brands to prohibitive levels.
They should at least have to go to an effort commensurate with installing a keylogger or something like that. Just navigating a few windows to get to see your passwords -- that's just wrong. Anything that has what's supposed to have a secure login shouldn't be exposing passwords like this.
You're mistaken. Paying reviewers would only cause a conflict of interest if it biases reviewers in a particular direction. Which direction would that be?

Paying the reviewer doesn't incentivise them to accept or reject only to actually do the review. As it stands, in many fields reviewers are far from experts in the area they're reviewing but only in the same general discipline. Papers sail through review without proper statistical oversight, because what statistics expert is going to spend their time reviewing psych or bio articles when that's not their discipline?

Well if we paid people to do what amounts to some of the most important work in science, maybe we'd get actual experts to do it!
The document is awesome, but the animated backgrounds are distracting.
I see what you mean and understand the confusion. Though I think it is called what it is because it is a distinct Windows subsystem, with various kernel drivers and modules, that are for Linux processes. The substytem is still Windows (using Pico providers and processes), and so it is therefore not a “Linux Subsystem”.
> I don't have any issues with a company...

This isn't just a company. This the Society for the Prevention of Cruelty to Animals (SPCA), an organization dedicated to preventing the mistreatment of pets, buying or renting a robot to mistreat humans. How messed up is that?
If America is so noncompetitive why are 8 of the 10 biggest companies by market cap based in America? The other 2 are in china.
I'm not sure I understand your question, but there are multiple addresses for the 5K btc transaction to that address.
I think the main point is to explain this kind of issue to non tech people.

A bit of programming, but most importantly, general concepts required to understand this kind of issue should be common knowledge.

For me it falls in the same category as the people putting an IP camera to watch their son sleep and broadcasting it to the whole internet. This kind of issue should be understood by them.

In this case, if the "banking manager" was aware of how security works, the issue would not have presented itself in the first place.
Hostgator, to give one fairly large example, does support HTTPS, but only their expensive option, not Lets Encrypt.
Why do these kinds of investigations only ever stop at the perpetrator of the attack? In rushing to market, these IoT companies pushed out a defective, insecure product. Such an attack would not be possible without vulnerable hosts to hijack, so why aren't the IoT hardware companies investigated or fined?
I started http://www.manypixels.co last week as a side project while being a digital nomad in SE Asia.

It is a service that offers unlimited design services for bootstrapped startups (though we actually have one VC funded startup as a client).

This side project generates about $3k weekly revenue currently (though I have only one week worth of data), and about 20% of that is profit currently (though I should be able to increase that closer 30-35% in the next couple of months).
The review process at the "prestige" journals in many disciplines is garbage. This is a known issue. Competent experts simply don't have time to do the reviews, so they end up being farmed out to graduate students and post-docs if they get done at all. I had one paper get rejected, because they couldn't find anyone to review it! By the time a reviewer is found, you're often the action-editor's last desperate pool of 5th-tier people who are sort of maybe vaguely related to the topic area.

Add to that that the majority of papers in many disciplines receive virtually zero statistical oversight from an actual statistical expert, and... well... you begin to wonder what service the existing journals are actually adding. Marketing and sales?
Textbook examples of recursion (1991)
Do you immediately convert to USD (or whatever currency) and spend, or do you hold as an investment?
I very much doubt this is the case. In 2011, over half a million businesses were started each month in the U.S. in addition to the 23 million small businesses that were already around. Seems unlikely to assume these were all from well to do folks with a strong safety net.

Source: http://censtats.census.gov/cgi-bin/nonemployer/nonsect.pl
Idea to 8,340 Page Views in 48 Hours
I was educated in the 90's and not on a typewriter. I use two spaces.

There's likely more at play than just typewriter vs non-typewriter.
I imagine the results would be just brutal, and no surprise to anyone.
I didn't learn how to type on a typewriter, but it was still considered proper formatting to use two spaces after a period when I went to school, and I used two spaces after a period for a really long time on the internet. I finally got out of the habit awhile back.
1. I made http://www.manypixels.co last week - a design service for bootstrapped startups (though we have one VC-funded startup on board). Currently generates ~$3k weekly revenue (though I only have one week worth of data).

2. Today I launched http://www.getremotejobs.co (You pay a fixed fee, we send you remote jobs) - I coded a few bots that actually search for job offerings which are likely to accept remote and got a lot of success with it as I was freelancing, so I decided to productize it and try to see if I could have some passive income with it! Currently 0$ income for this one but have not promoted it yet.
I think this is only true if you adopt a very narrow definition of "successful entrepreneur".

If you're looking at non-US, or non-technology entrepreneurs, I think you'll find that this conception of an entrepreneur doesn't fit. (E.g., see this article on global entrepreneurial activity https://grasshopper.com/blog/where-do-most-entrepreneurs-com...).

Even if you're talking about non-US, tech entrepreneurs, I also think this definition falls apart. The many, many new super-wealthy tech entrepreneurs coming out of China and India grew up in a time when neither country was particularly rich.

People engage in entrepreneurship for numerous reasons, but I think it's foolish to discount the sheer number of people who do so out of financial necessity, i.e. the need to earn enough money to put food on the table and support your family.
Houdini: Demystifying CSS
I am not going to use such an insecure payment method.
Or just people with one or two possible broadband internet providers (80% of Americans?).
This is not a new phenomenon, though the ease of the exploit might be new. I remember a while ago you could go in SQLite and look at the file Firefox stored all the saved passwords in, for any user. That exploit was fixed, and this one likely will be as well. I agree with other commenters, the most disturbing thing about this is the blase attitude of the response.
I'd prefer C-INTERCAL or LOLCODE
It won't when using architecture specific instructions like AVX512.
As far as I can see there is only one dynamic visualization and the rest could have been handled with static images, but they don't work with javascript turned off. Even the dynamic one could be a static image and progressively enhanced with javascript. So I stand by the overused comment.
DJB retort on this is now stuff of crypto hall of fame:
https://gist.github.com/tarcieri/6347417#file-gistfile1-txt

> ---
Cryptographers are certainly not responsible for this superstitious
nonsense. Think about this for a moment: whoever wrote the /dev/random
manual page seems to simultaneously believe that

(1) we can't figure out how to deterministically expand one 256-bit
/dev/random output into an endless stream of unpredictable keys
(this is what we need from urandom), but

(2) we _can_ figure out how to use a single key to safely encrypt
many messages (this is what we need from SSL, PGP, etc.).

For a cryptographer this doesn't even pass the laugh test.
--- <
in exchange for warm fuzzy feelings? wtf are you talking about?
Likewise. Learned 'typing' in 2nd grade in '95 alongside logo programming.
Ideally you scale costs to increase profit. If you could increase retinue from thin air then you're not actually scaling anything. But, in a scalable model you invest more in your leverage be that advertising or whatever and you get more revenue which assuming a good cost structure directly results in profit.

Facebooks problem is they can't scale because they already own the market and there are profitable new customers available. If they spend more on advertising they simply get less profit because their costs go up without increasing revenue.