skysight-inc/HackerNews huggingface dataset:
There is no way the average technology user is going to understand the architectural distinctions of DRAM implementations enough to base their purchasing decisions on that.
ECC wasn't designed to protect against this type of failure. It assumes a low probability of coincident multi-bit errors.
Sounds handy! Can anyone speak to how it treats privacy?
It's interesting to think about the term "existing cultural icons". On first glance it seems like the term weekens the issue because it makes it sound like these are folk tale like things that somehow magically manifested. What happened though is that someone actually invented a story, it got retold over and over and evolved into what we have now. This would have been prevented by modern copyright. The original author wouldn't have allowed others to reproduce their work. The work wouldn't have evolved and probably even been forgotten.
The CCC stated also that they observed that companies take a more reactive rather than proactive stance regarding their IT security because they believe that they will be notified of vulnerabilities prior of public disclosure or attacks. This may justify not following embargoes and coordinated disclosure.
A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing the game.
Like an incredibly improbable statistic or too fast actions or something else.

This is a poor solution: it's the equivalent of blocking spammers by IP address. It works but will also lock out legitimate users.
That’s extremely cynical.
You wouldn't know who specifically leaked, just that it was either the exec or someone who received the forward.
This affects more than just cloud providers though; that is just one of the more high-profile implications of this potential bug.
Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps.

Prior to disclosure there will always be the possibility that some users are being exploited without their knowledge.

Therefore disclosure always improves the situation by giving those who could have been exploited without their knowledge the choice to take mitigation steps.

All of the "responsible disclosure" nonsense is just PR by companies who want to avoid the most obvious mitigation, which is for customers to stop using their products.
Entelo | San Francisco, CA | Full-time | Onsite

Entelo uses huge amounts of data and predictive analytics to help companies build great teams. Our ~30-person engineering team uses technologies like Ruby, JavaScript, Go, React, Kubernetes, Docker, Kafka, Spark, and Redshift, and we already have customers like Facebook, Netflix, Slack, and Paypal. We ingest and parse up to 2 TB of social profile data per day, predict when people will change jobs, match people to jobs, and more. We've recently had some great additions to our team, including Gaurav Kataria, former Head of Data Science and Growth at Google Cloud:
https://www.linkedin.com/pulse/from-google-entelo-gaurav-kat...

We care deeply about promoting diversity in tech and being pleasant, collaborative folks. Join us as we continue to grow very quickly and discover new ways to merge machine learning, big data, and full-stack engineering to provide value to our customers!

We're hiring for many roles including:

* Data Scientist

* Senior Data Engineer

* Senior Data Scientist

* Senior Frontend Engineer

* Senior Fullstack Engineer

* Senior Infrastructure Engineer

* Senior Software Engineer

* Software Engineer

If you're interested, check out our open positions at https://www.entelo.com/careers, or feel free to email me directly at tom at entelo dot com.
Location: Manhattan, NYC.

Contracts: No, full-time W2 only.

Remote: Yes.

Willing to relocate: Maybe.

Technologies: C/C++, C#, SQLite (team member), Tcl/Tk (maintainer), Win32, POSIX, mostly anything else.

Résumé/CV: Link and/or document available by request.

Email: joe [at] [put_my_user_name_here] [dot] com
Qualys Inc. (qualys.com, NASDAQ: QLYS) | Foster City CA | Full-time, ONSITE/REMOTE | $110k-$125k, RSUs, 401(k) matching, bonuses, health benefits

Qualys is a provider of cloud security, compliance and related services for small and medium-sized businesses and large corporations.

We are looking for a capable, motivated engineer to help us update and maintain our backend infrastructure. The ideal candidate has good knowledge of Ceph. A demonstrable ability to learn new and complex technologies is a substitute for this requirement. Must have a good knowledge of Linux, VM infrastructure, databases, and preferably some experience with an S3-compatible object storage system. Solid programming experience in a language such as Java, C, Go, or Python is required as is experience with networking, logging, and monitoring.

For consideration for a remote position, the applicant should provide references that will verify he/she is capable of working remotely efficiently and reliably. Remote applicants must be willing to meet off-hours occasionally, as we have offices in several countries that we sometimes need to sync with.

Please send a short cover letter and a resume to jdavis@(our domain). Interview process will include a short coding exercise. No recruiters.
It totally is. Another point is to make no contributions during the whole meeting but at the end be the last one to speak, make sure to summarize what everybody has said. the meeting is yours and you are automatically the insightful leader.
The mysterious case of the Linux page table isolation patches
Alternate option, for those wary of AppleScript: option-click the Volume menu and select the AirPods when they appear.
There are many more options: Insert one of the many non-printing ASCII codes. Add an extra space, especially before a newline. Add or remove an extra newline at the bottom. Change punctuation where the choice is believable either way: Single quotes for double, commas for semicolons, periods for colons.
The same compiler (mis-)feature was also the cause of spurious crashes in Go applications (diagnosed about a month ago: https://marcan.st/2017/12/debugging-an-evil-go-runtime-bug/). Linus's comment is fun:

So yes, It's a terminally broken compiler from hell. I assume gentoo
has applied some completely broken security patch to their compiler,
turning said compiler into complete garbage.
Is there a non-paywalled link?
As the article notes, what Erlang has is Last Call Optimization, this is significantly more general than tail recursion optimization.
PoI - https://themerkle.com/what-is-proof-of-importance/

PoD - https://medium.com/research-center/nebulas-nas-ico-analysis-...

I'm not too familiar yet as I just started reading about it recently, but these two links should help you understand. They're short reads.
Ok, we'll add a network above.
A look back at Uber’s hellish year
Maybe they should put it on their homepage
There are many examples of hardware using unreliable underlying layers, countered with whitening/scrambling, redudancy and other data encoding tricks. What would make RowHammer imprevious to these?
None of the western companies have demonstrated an ability to "win" in Eastern markets, especially China.
Show HN: Returning the human element to stock investing
There is a direct parallel with how creationists have created lists of scientists who actively question evolution.

One response was Project Steve - https://en.wikipedia.org/wiki/Project_Steve a list of scientists with the first name Stephen, Steven, Stephanie, Esteban, etc., all of whom support evolution.

This list is far longer than any list of scientists that creationists have put out.

Similarly, the "roll call of scientists" who support the current rather pessimistic view of the human-caused effects on global climate, is far larger than the list given there.

Continuing the parallel, those opposed to evolution say that its supporters treat it as a "religion". I note Ivar Giaever says that of climate change, at https://en.wikipedia.org/wiki/Ivar_Giaever .

As another parallelism, many of the scientists who support creationism/are against evolution aren't from a background which is closely connected to evolutionary biology. (Eg, a physicist instead of a biologist or paleontologist.) That's "many", not "all".

Going down the list, Giaever started in superconductivity, and then went into biophysics. He now is an adviser for The Heartland Institute. The Heartland Institute received funding from Exxon, a fossil fuel business.

Robert Laughlin, condensed matter physics.

Frederick Seitz, solid state physics. He was founding chair of the George C. Marshall Institute, which received funding from Exxon-Mobil. Before getting CO2, he was one of the so-called "merchants of doubt" about the harmfulness of tobacco smoke.

Richard Lindzen, a bona fide climate scientist. You know that because they wrote "an atmospheric physicist" instead of a generic "physicist" like the previous scientists.

Fred Singer, another atmospheric scientist. Who "has been a paid consultant for many years for ARCO, ExxonMobil, Shell, Sun Oil Company, and Unocal" - https://en.wikipedia.org/wiki/Fred_Singer .

It's boring now, so I'll jump down the list to John Coleman, a weathercaster trained a journalist who, among other things, claims "the polar ice is increasing, not melting away" - an incorrect statement. He has never done any research in climate change. https://en.wikipedia.org/wiki/John_Coleman_(news_weathercast...

Now, of course it isn't required that people be trained in field X to provide useful input or counter-point to that field. My point instead is that if the criteria for a "roll call of scientists who've actively questioned climate alarmism" is so broad as to include people who have never done any scientific research in the field, or in the case of Coleman, never having done any scientific research at all, then you need to have a similarly inclusive definition when coming up with people who support "climate alarmism."

It is a much larger number. Just like Project Steve.
Wouldn't you need backwards compatibility anyway to avoid the need of upgrading all the services at the same time?
You can also enlarge the default font size similar to desktop browser. Can not do that on Chrome, Firefox and Safari. Reading this site on UC is much easier on my eyes.
The state of affairs of Linux and smartphones is pretty grim outside of MTK world too.

https://fosdem.org/2018/schedule/event/hwenablement_mainline...
If this guy can figure this out, anybody with the means and motivation to write such an exploit is already working on t.
2019 Nio EP9 Chinese EV Hypercar Review
Hi everyone, I made this coming soon page for a product I'm working on. I'd love to hear initial feedback on the page messaging and the idea of the product, just need to make sure that everything is clear to fresh eyes. Also trying my hand at some growth tactics, hence posting to HN. Thank you and I appreciate any and all feedback.
A quick search does not inspire optimism:

https://citizenlab.ca/2015/05/a-chatty-squirrel-privacy-and-...
Many schools issue a card or PIN that is used to buy lunches. You can't tell who is getting assistance and who isn't, unlike the old days where the kids on assistance used punch cards and everyone else paid cash.
Resolved, managed to get the data back, don't have a postmortem yet.
No, not AWS. Xen was called safe. All the other KVM providers and normal linux servers in Intel are called out. arm, sparc, s390 were called out as safe, as they provide two seperate translation table registers, only intel provides only one.
The default Python allocator experiences a lot of fragmentation over time, leading to sparse memory packing.

Dropbox implemented a custom allocator with different types and sizes getting their own arenas, leading to long term memory stability. Even controlling all their own code, processing millions of file paths, metadata, and buffers inevitably lead to memory leaks.
... disenfranchised. 200k in Milwaukee alone.

This claim is based on taking the difference in turnout between 2012 and 2016, and then attributing it entirely to a voter id law change.

Note, even though she lost Wisconsin during the primary to Sanders, she assumed she would win it anyway during the election. So much so that she NEVER visited the state even once during the election... the first time a major party candidate has skipped WI since 1972.

In comparison, he's a map of the 2012 events.. blue and purple are places obama visited, turquoise is biden.. a dot means multiple events:
https://www.google.com/maps/d/viewer?mid=1djIi5ol21yzrnXDr2A...
Journalism by peer review and open access and open data.
The front page is not very obvious, no.

My mind did go to debugging tracing, but the exact form of debugging tracing is not very obvious from the front page.
the discussion about the difficulty of testing microservices makes me wonder how the programmers in 20 years will look at the currently modern systems that are being built now. Let's say the system has been in use for 10 years, everybody has moved on and now you have to make extensions or bug fixes to a legacy cloud/microservice/multi-language/multi-server/distributed/queuing/ system. At first look this makes updating an old COBOL system where you have one big codebase in one place look easy in comparison.
That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous.

You take what clues you can get and you push the fix. This is what all their users not named catbot want.
Thanks to MTK datasheet leaks (try finding the docs for Qualcomm or even Broadcom stuff...), and the easy rooting (no locked bootloaders), "hackability" is actually quite high. You can also find the source code pretty easily even if it's not officially released --- a lot of these Chinese smartphones are based on the same hardware with only cosmetic differences.

The culture/ecosystem is very different: https://www.bunniestudios.com/blog/?p=4297
Maybe legitimate users shouldn't use the name of a hack as their account name.
The guys working on Jaeger are very helpful on Gitter.
I'm not actually single and looking anymore. I've been dating my current girlfriend for the past two and a half years, who I met on OKCupid. Also I was sorta kinda that 'person who knows everyone', or at least as much as anyone was. I went to a lot of meetups across many different groups that interested me. I ended up being the organizer for one of them.
The data has been recovered, no post mortem yet.
I had this happen to me once (and only once, I learned my lesson). Our professor gave us a PDF with the problem description and it had a bit of code in it we were to put into our final program. Well, when I copy and pasted it some of the spaces copied as non-ASCII space.
This particular detection seems very unlikely to ever have a false positive. The noise about false positives appears to be coming from the authors of the cheat software themselves.
Why would you set your username to the name of a known cheat though?

And if you are VAC banned because of it, you can still play your games on non official servers. "Less evil DRM" if you will.
When did HN become so... radicalized? There's nothing inherently wrong with these companies being big. The problems are with them being too board. Should Google own the creation of content (Blogger, Youtube), finding content (search) and transmitting content (fiber)? Should Comcast transmit content (TV, Xfinity) and create content (NBC, Hulu)? This is where the problems arise like conflicts of interest, diminished competition, etc. We saw this clearly in Argentina, when as soon as the government started working on legislation to prevent the telecoms from becoming monopolies, since they own newspapers and TV news, they started bombarding the public with negative press.

It shouldn't be hard to regulate this. Just split them up.
Sure but no change was even required. Once the public realized the intent might be to use the plane as a bomb the attack vector became meaningless.

No one will ever hand the plane over again, even if the attacker claims to have a bomb.
Parabol | Brooklyn, NY | Full-Time, Onsite or Remote | https://www.parabol.co

Parabol makes software for distributed organizations. We enable cross-functional collaboration and clarity by syncing teams in a single daily dashboard with a weekly ritual. Our embedded prioritization process improves team transparency, efficiency, and operational growth.

To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/parabol

Here are our open roles:

- 2018 Spring Engineering Intern: https://drive.google.com/file/d/0B08vOIWAskFlNXVzMlBfU3ZsNXc...

- 2018 Spring Design Intern: https://drive.google.com/file/d/0B08vOIWAskFlNmYtWGIteUxhXzA...

- Senior Designer: https://drive.google.com/file/d/0B08vOIWAskFlYkNjZkFxbm1IS3c...

- Senior Full-Stack Engineer: https://drive.google.com/file/d/0B08vOIWAskFlellPZ3Z2N0dSNzA...

Tech Stack: Our tech stack is very future-forward and designed to enable Google Docs-like realtime collaboration. From back-to-front: rethinkdb, redis, NodeJS, GraphQL, Relay Modern, React using ES2015+
I don't think this makes much sense, just looking at China (where I have some insight). You can easily run Chrome (default install) on a <$150 = 1000 RMB phone from Lenovo/ZTE/BLU. Below $100 today performance quickly drops to unusable.

https://www.phonearena.com/news/8-best-cheap-phones-under-15...

I'm suspicious that the numbers also include non-smart phones, just because of the 430M size, use of the word "mobile", and discussion of a browser from 2004 that predates the iPhone. Further, to the extent that compression is important, I'm suspicious their proxy-compression is a bigger deal for people looking to save money on data (and governments looking to monitor them).

What Google needs to look out for is UC becoming a default App since Alibaba and Alipay are already huge in China, and they could pay for it. Most people don't care about what browser is pre-installed on their phone, if it just works. Of course an Indonesian or Indian company could do this just as well as Alibaba.
Practical Examples in Data Oriented Design (2013) [pdf]
By that same token, use of sudo is a legitimate signature of the malware.

That said, its a really shitty signature with lots of false positives -- catbot is exactly the sort of strange names I assign to hosts or projects.
I dont really understand why Baidu, WeChat etc. are allowed to play in outside markets like US/India when China is closed off from outside markets. The Chinese case is special and might be better of with special treatment.
I would also add:

Have a deadline by which some task before the committee must be completed.

Have a single decision-maker for the committee.
There have been reports talking about security issues in UC Browser [0] for a while [1] now [2].

It was also removed from Google Play Store [3] (although temporarily).

Kinda surprises me to see it as the 'dominant' browser. Maybe people are indifferent.

[0] https://citizenlab.ca/2015/05/a-chatty-squirrel-privacy-and-...

[1] https://citizenlab.ca/2016/08/a-tough-nut-to-crack-look-priv...

[2] https://tech.blorge.com/2017/11/27/uc-browser-believed-colle...

[3] http://www.hindustantimes.com/tech/uc-browser-app-vanishes-f...
Realistically most of us will never be in the position to make 400k or more. Once you are at that level you are part of the "in" crowd but most of us will always be replaceable cogs in the wheel.
I don't know if it was an experiment but there were signs prominently posted advising all travelers to keep their shoes on. My companion also did not have to remove her laptop before screening, but they did pull her aside to look at it after the X-ray. There were no bins, passengers were expected to put their phones and loose change into a pocket of their carry on, then I just walked through a metal detector and it was done. The line was very long but moved extremely quickly. There was a dog working the line, so perhaps it was an instance of this: https://www.usnews.com/news/articles/2016-06-24/shoes-on-fee...
Neat concept, though I do wonder whether you'd go nuts if your site turned out to be extremely popular. I can imagine the sound being something like a machine gun firing if you tried this on say, Hacker News.

Still, seems like it could be fun to play around with none the less.
My son loads your site while studying for math olympiad. He used to work along with a Spotify list but now prefers listentothe.cloud, thanks a lot.
RaspberryPi got hacked, collected the malicious binaries.Please report this
Ask HN: What biographies/memoirs to read in 2018?
SEEKING WORK, Prague, Czech Republic (think Germany) | Remote OK

Full-stack engineer, consultant. Focusing on virtual assistants (chatbots) currently, but able and willing to work in other areas.

"I have one goal: To produce a significant return-on-investment for you and your business."

I'm a software engineer, but I also studied a business school, which puts me in a unique position for solving your real business problems that lie behind the lines of code.

My engineering experience includes creating a brand new content delivery network for a filesharing service, developing new low-level network protocols at one of the largest Internet companies, or creating a Machine Learning tool that analyzes Facebook posts.

Additionally, as an author of a book for new and aspiring managers, I know how to work with people. And how to finish stuff, because writing and publishing a book takes quite some grit.

Website: https://tmoravec.com/
Email: ted@tmoravec.com
Github: https://github.com/tadeas
LinkedIn: https://www.linkedin.com/in/tadeasmoravec/
CV: https://docs.google.com/document/d/1G5bymuIyi7wDd58s67jzwcsJ-JUljf0mfr0vie7_OwU
Not at all:

1. Even Google itself is too big. It needs to be broken up further.

2. Management control needs to reside in separate individuals. You cant have two different companies having the same/common management control.
'Shoe Dog' added in my list
>and then throw in a legitimate company like Apple or Google to make it "Facebook and Google" are cancer.

This is very much a matter of perspective. Prior to Apple launching the app store as a walled garden for ios and then launching it on macos proper, it was generally an untested assumption that users would not be willing to accept such a software delivery model.

Prior to Google, it was assumed that it would be unacceptable to require people sign up to and give personal details for access to software. Most software licences were distributed by emailing codes to the user. The web app with mandatory registration was usually only seen in enterprise grade portal-based software.

Today, the standard software experience requires so many accounts that /average users/ are turning in desperation to password managers to corral the hundreds of accounts they need for their month-to-month computing, and Microsoft has moved from "next-next-done" installers to actively pushing a walled garden on the population. Despite Android having full support for distributing packages as .apk files that can be installed without the app store in the exact way you would use an msi or a deb, I would anecdotally say less than 5% of apps are offered for download from their creators websites in this traditional fashion.

Sure seems like the tumors are metastasizing to me.
The factoid about San Francisco in the article confirmed my perception that American cars are just not very popular is actually a distortion of the Bay Area bubble I live inside of.

Edit: from the narrow view of my kitchen window in West Oakland I can see 2 Toyotas, a Subaru, a Ford Focus and the VW e-Golf in my driveway: 20% American. There'd usually be another suby in my driveway, but my son is home from college and borrowed it.