skysight-inc/HackerNews huggingface dataset:
More and more lately I'm leaning towards the, "responsible disclosure is a bunch of crap" camp. You have to be "in" to get the news. Even if you're "in" security people love to play info war power games and withhold things because it tickles their jimmies, etc. And don't forget, you're deliberately keeping a vulnerability secret from consumers during a long period where you have no idea who else knows about it. If I'm a "user" or 3rd party and there's a critical vuln in some system I depend on, I want to know that I shouldn't use it or that I should take extra caution or whatever rather than being clueless in all in the name of the vendor's image.
One Million Dollar Paranormal Challenge ended in 2015 when James Randi retired. But, it should not be that hard to get something similar setup if you really want.

I am not going to dig that far into this but read https://www.snopes.com/fact-check/breatharians/ as a starting point.
I think it's interesting how VS Code jumped from 5th place among web developers in 2017 [1] to first place [2]. This made Sublime Text lose a place, putting it in third. If I were ST's Jon Skinner, I would not be happy about having M$ as a (free!) competitor.

[1]: https://insights.stackoverflow.com/survey/2017#technology-mo...

[2]: https://insights.stackoverflow.com/survey/2018/#technology-m...
> someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid"

Are you sure that all "old school" CAs wouldn't issue a cert for that?

They were never supposed to fight phishing. Domain Validation certificates literally validate… domains, and nothing more.

It would make more sense to prevent googIe.com from existing at the .com registry level, before any TLS is involved.
> Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.

A good way for companies to prevent this is to have a generous bug bounty program. Money is still transferred from the shareholders to the researchers, but then the company can impose conditions like delaying public disclosure for a reasonable time to prepare a fix.
> If the term is flexible, why the hard reaction to my flexing of it?

The terminology is not flexible, it has a well established meaning. If your bar for a black hat includes legitimate security researchers disclosing vulnerabilities in a way you don't like, you've just expanded the group of people we can call "black hats" almost arbitrarily. You're putting security researchers you have a normative disagreement with into the same group of people who commit actual fraud, steal identities and sell your credit card data.
What about hosting HTTP content because you verify GPG signatures upon download? These content would then be super easy to cache on the local network. HTTPS defeats this and makes it uncachable.

I hardly ever see people talk about this use case and how to solve it with https everywhere. AND it's super widely used: e.g. debian repositories.
> You can't possibly understand...

Oh, I get it. I've worked with lots of people like you.

You're lazy.

As an infosec practitioner, I'm the one that cleans up after the people who claim good current infosec practices are "too hard" or "impractical" or "not cost-effective", which all boil down to sysadmins and developers like you creating negative externalities for people like me. I have heard all of these arguments before. "Oh, we can't risk patching our servers because something might break." "Oh, the millisecond overhead of TLS connection setup is too long and might drive users away." "Oh, this public-facing service doesn't do anything important, so it's no big deal if it gets hacked."

That's irresponsible.

I'm not at all sorry that the wider IT community has raised the standards for good (not best, just good) current infsec practices. If you're going to put stuff out there, for God's sake maintain it especially if it's public-facing. If using the right HTTPS config is that difficult for you, move your stuff behind CloudFront or Cloudflare or something and let them deal with it. If you can't be bothered with some minimal standard of care, you need to exit the IT market.

And good luck finding a job in any industry, in any market, where anyone will think that doing less than the minimal standard, or never improving those minimums, is OK.
I'd take toxicity over censorship any day. The media machine & politicians have been going at it recently.

I wonder when being toxic will become illegal.
iPhone Backup Extractor 7.5.8 Crack and Activation Key Free
Sure, I can toss in 1,000$. But, the prize is not as hard as simply running tests like this.
How Decentralized AI will change everything
More importantly, they used the overcrowding excuse as a means to raise $800mm+ from New York taxpayers. If this capital wasn't necessary given the problems they cited were non-existent, this amounts to fraud.
Yeah. Otherwise it would not be possible to support multiple users on the same filesystem.
Yup! That's it!
Going to reply to my own comment here.

It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.
> Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too.

This. A long thread mostly advocating HTTPS everywhere and only one mention of this. Would any of the knowledgeable HTTPS advocates here care to comment on it?
I think that is a really anti-consumer way to read this:

https://www.bestbuy.com/site/help-topics/return-exchange-pol...
I'm not sure there ever was such a social contract, since the personal space you're describing is a very modern innovation. As late as the 60s, all offices were open plan offices, and single-room occupancy was simply what you got on the cheaper end of the urban housing market.
"You will also need the following Open NSynth Super-specific items" super specific indeed.

If someone is interested in machine learning and music, I'd send them to: http://wekinator.org which is actually a research project rather than a marketing campaign one off, and can be setup, run, and played with in a matter of minutes.
Note that in this era, if a farmer wanted to move west in search of cheaper/richer farmland, you would do it in the winter. Without paved roads, loading all of your stuff into a cart and driving it in the summer would mean you could get stuck in the mud. It was a far better option to load a sled in the winter.

The King's troops, growing up in a climate where snow doesn't (well, in 2018. I don't know about 1756) really stick to the ground, probably indeed would not have expected this.
iFlicks 2.6.2 Crack and Activation Number for MacOS X
On the upside, it's not like they'll need physical bodies for their immortality. Just a quantum mainframe with an unlimited power supply.
Do you think those popups are created just to piss you off, or because they are profitable?
Worst offenders are iZooto guys peddling their crappy web notifications fixed position dialog all over the Indian news sites. Solves no purpose other than steal good amount of space on the screen. Waiting for either their junk product to die or Mozilla to release this blocker soon.
UPS could easily pivot; they have a ton of ex-military in their ranks. Only now do I understand why!
> Oh, so you know better than me what kind of content is on my site?

The content of your site is irrelevant. We do know that your lack of concern for your user's safety is a problem though.

I also wish that managing certs was better, but until then, passing negative externalities to your users is pretty sleazy.
So this apple/oranges thing is true and addressed in the article.
Have you used GraphQL/Apollo? It can do a lot of the things you're wanting:
- You can combine multiple data sources into a central datastore using GraphQL (REST APIs + DB queries etc.., that's one of the major benefits of it.
- Apollo on the client can manage local state as well as server state in one standardized interface.
- GraphQL is great for MVPs and Hobby projects but is used for a larger projects as well (Shopify, Github, Coursera, Facebook, Pinterest, Product Hunt, I could go on...).

I'd suggest you give it a shot, it's super fun to work with and isn't going anywhere anytime soon.
Great insight!
Chrome extension is our MVP actually - over time we will certainly expand to other platforms (or even have our own email client!). We're already in the process for setting up a Gmail Add-on (https://blog.google/products/g-suite/do-more-your-inbox-gmai...)

It also seems like we can keep going with a Chrome Extension for a bit - Streak, MixMax or even Grammarly are good examples of companies who are focused around a Chrome extension.

What other platforms do you think we could focus on? Where would you like to see us most?
I'm ready to demonstrate that if the money is right and the funding is credible.

Here's my suggestion for the approximate conditions:

1 week on water only, no food. Full medical and 24-hour video surveillance, and all kinds of tests (blood, urine, you name it) to show that nothing is wrong with my body. If I win, I collect the prize.

If you make serious progress in raising money, you can contact me at john_999 at gmx dot net
Proof of Stake: EOS, Cardano and Tezos: Sleeping Giants Starting to Stir
There are already services that do this. I've seen ads for a shoe service (name escapes me) and a clothing service (Gwynnie Bee).
My favorite part of the internet were always the small hobyist websites. The guy that has an encyclopedic database about Grateful Dead trivia, the other guy that collects pictures of plants. Those people are independent, they're not technical and their 90s looking websites are going to go under because of blanket security policies that don't concern them.
> Oh, so you know better than me what kind of content is on my site? So a static site with my resume needs SSL then to protect the other users?

Without TLS how do YOU know that the user is receiving your static resume. Any MitM can tamper with the connection and replace your content with something malicious. With properly configured TLS that's simply not possible (with the exception you describe in corporate settings where BlueCoat's cert has to be added to the machine's trust store in order for that sniffing to be possible). Hopefully in the future even that wont be possible.
One option is to run your own BIND instance configured however you like, and pay for one or more secondary DNS services to sync off it. You can even hide your own BIND instance from everyone outside your network and just point your NS records at the secondaries, if you’re worried about misconfiguration/DoS attacks/etc.
Nope. Trying to prevent such.
The Juicero founder is really into raw water
I've been looking at something like this to host a landing page for a book I wrote years ago. Great work, I'll give it a try.
I did a talk at a conference (it pops up on HN every year or so) that was basically storytelling from my semiconductor days. If I hadn't lived some of it, I would find it hard to believe.

My 'favorite' story was three years after I left the industry having to leave a movie theater because a characters ring tone was the one I had on my on call phone and it caused a panic attack.
Thanks for the info, that's interesting (I didn't know that). But it still seems like cheating :)
This is what wikipedia says:

A black hat hacker (or black-hat hacker) is a hacker who "violates computer security for little reason beyond maliciousness or for personal gain"

The personal gain part certainly fits with short selling the stock.
Can this be used for multi-level subdomains?

Like *.subdomain.example.org?
about:preferences is the page you end up at when you select the "Preferences" option from the menu.
I find a couple things irksome, if not malicious.

1. The link to the privacy policy comes AFTER you take all my data.
2. If I uninstall your extension you have it programmed to give me an exit survey, but it doesn't prompt me to revoke access for your app from my account? So you can continue to read all my communications. At the very least tell me how to remove it when I uninstall your extension, or fill out your exit survey. Don't just hide the fact that you retain access indefinitely.
3. You are appending your marketing to the bottom of every email regardless if it used your product or not. Thats crap, I don't want to spam every single person I communicate with. Let me opt in, or only append when your plugin is used.

I get its a prototype, I get the "potential", but it seems you put 0 critical thought into making the app safe.
https://blog.torproject.org/tor-heart-qubes-os

https://blog.torproject.org/tor-heart-whonix

https://blog.torproject.org/tails-36-out

But I fully agree the main site should make the risks of TBB clearer and promote Whonix/similar.
The current research in Neuro is that a memory a synaptic condition, in that some synapse is structured in some way in relation to other neurons. There are W-many GABA receptors and X-many vesicles, Y-many AMPA receptors and Z-many neurotransmitters. Each receptor is in some state of flux in terms of it's age and other chemical modifiers on the protein. The synapse itself is tethered in some way and has structural proteins in it (not all of which are known these days). The astrocytes and glia that surround each synapse are also modifying the region, including some uptake/downtake of receptors and neurotransmitter vesicles (cool, very recent stuff). Additionally, the cells themselves are regulating the synapses in relation to the other synapses in the cell and the extra-cellular environment. Note: not all neurons 'fire' via synapses, some are just directly attached to a cell's soma (main cell body where the nucleus is). It's Bio, everything is crazy.

Still, that synapse is thought to be the main modification area of neuronal firing, in that it acts like a classical memristor. So, though electrical activity is not required and lightning/shocks can be sustained (by some miracle), the 'self'/mind is the network of the synapses (GIANT caveats apply here). Also, even under heavy anesthesia, the neurons are firing and active, jsut not coherently.

If you can preserve the synaptic weights, their dynamics, and their network, you should be able to reconstruct the 'mind' of another person. However, that is one instant in time and space. You'd need to know where pretty much every ion was and it's momentum, and I'm pretty sure that's impossible (Heisenberg and all that jazz).
This resonates with me because I recently decided to start writing about what I've learned in my software engineering career as a way to give back to the programming community.

I've wanted to start writing for a while but I never knew what to write about from a technical perspective. Then I realized there's a ton of soft skills I've learned over the years that have helped me advance my software engineering career that I could write about and not have to worry about publishing code that contains bugs or that will get critiqued to no end.

I just started writing and figured that maybe someone would find it useful. I started a newsletter and have been promoting it here and there and it's been growing every week. Take a look and subscribe if you'd like!

https://exponentialbackoff.substack.com
This is common with every large organization.
Also, https://aws.amazon.com/certificate-manager/
I think I first saw one of those nearly a decade ago: it was definitely high-end, catering to men, and all designer labels. I honestly don't know if it survived or failed because the category isn't interesting to me.

Returns are the problem: returns may not get the nice discounts for shipping, they require manual review of the products (are it the correct SKU, the correct size, is it in a resellable condition, etc.), restocking and reinsertion into buyable inventory, etc. And then refund processing, which may take 7-10 days or more.

But it doesn't address the problem of renters: they won't buy a subscription box if there's a monthly fee associated with it. They like being able to get new shoes, clothes, and accessories to wear once and then return for free. Identifying renters and either directly contacting them to change their behavior (this is high touch, but the company culture encourages this) or removing them as customers are the best solutions I've seen to date.
> I was always wondering why in the US this was different and always found it a bit strange. But I do understand now.

To promote the lottery."So and so won, I saw her on TV, I can win too" is a lot more convincing than "Someone from another town somewhere won".
Then you ban the person. And your credit card will drop you too if you keep doing charge backs.
I can't load the website. All I see is this :/

https://i.imgur.com/NONTuSs.jpg
The browser launches the first N popups and then offers to block the rest. No problem.
Very interesting, I haven't really thought of it that way.
Do you mean we essentially lower the barrier to you starting to write an email?

If that's the case, that's a fascinating insight - thank you so much for sharing it!
A guy who had been in the air force told me about their electrical generators. They used them to set up temporary air traffic control installations to guide fighters to targets and stuff. The generators would kick off after X hours of continuous operation, to protect them from destroying themselves (due to heat, I presume). That's standard on civilian versions of the generators. But the air force wouldn't buy them unless there was an override. If you need that generator so that you can control the 10 more minutes of an air battle, even if it destroys the generator, you can get it.
yeah those incomes are telling
I imagine archaeologists of the future will talk condescendingly about us the same way we talk about the ancient Egyptians and their quaint belief that things they did to the body would have some kind of effect in the afterlife.

Nonetheless, here in our time, it brilliantly crosses/combines...

funeral services, a highly lucrative field

scifi, including all its expansiveness

the desperate compensatory technological hubris of people who know deep down that the world is quietly going down the shitter

and/or narcissism (on which nobody ever went broke)
The story I got was rather different; first that the safety measures were implemented in a ham-fisted manner and secondly that they failed to model or recognise correctly the overall effect that the measures would have on carrying capacity, and they are still failing to recognise it.

I don’t know how fair these accusations are, of course.
> According to Bloomberg’s Model 3 tracker, by the end of the week Tesla will have shipped it’s 10,000th Model 3. As of March 13, 9,793 Model 3’s have shipped and they’re shipping about 100 cars a day. So, unless the production line is shutdown, we’ll see that goal by Friday. More importantly, Tesla’s goal is to reach a production rate of 2,500 Model 3’s a week by the end of this month, a rate of 10,000 cars a month, with the goal of doubling to 20,000 cars a month by the end of June. It seems like a near impossible goal within 3 months, but shipping 10,000 Model 3’s seems worthy of celebration this week.

If you didn't read it, this is the whole "article".
Maybe, but I've also heard ads for Squarespace on terrestrial radio.
Businesses don't have to transact with people that cause them to lose money.
It's like one apt package and one cronjob away. I think some acme clients even do the Cron handling for you. So, like one command. There is a really great acme client written in bash which is incredibly painless to set up.

Literally in the time you've spent thinking about and composing your reply you could have implemented free, secure TLS for your users.
The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model.
My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for many reasons.

http://www.podinatutorials.com/
If it's actually someone attempting to make money on a short or to benefit from a working relationship with a competitor, then a bug bounty program does nothing. No one can run a bounty program that pays out anywhere near as much as the information is actually worth to an adversary. Bug bounties work to engender a bit of good will among researchers and to provide some incentive to an otherwise neutral party to play ball. They don't mean shit to a hedge fund or a competitor in a multi-billion dollar industry.
Intellectual Property and patents are capitalism. Capitalism has always required exclusionary property rights to function, and these property rights have always been allocated and enforced by the government, starting right at the Enclosure of the Commons. Without government intervention, capitalism cannot exist.

Without IP and the artificial scarcity enforced by it, capitalism simply cannot function for digital goods. In particular, "digital capital" cannot be accumulated, because all digital goods can be replicated infinitely.

https://en.wikipedia.org/wiki/Enclosure
We, collectively, seem to accept car accidents because we think we can avoid them with good driving skills. Train accidents leave us helpless, and we can’t cope with that.

The whole concept of ”bad things happen to good people for no reason” is extremely hard to bear. Somehow this reminds me of people who believe the right diet will protect them from cancer, the right prenatal care from birth defects, etc.
Java Exceptions and How to Log Them Securely
Prayer Times Orlando Florida United States of America
This is probably one of the very few topics I may be able to add value here on Hacker News.

As a service, the USMC are approaching bottom up innovation very seriously. https://mobile.twitter.com/marinemakers

The USAF is also very active in bottom up innovation.

Another program is Hacking 4 Defense founded by Steve Blank, Pete Newell, and Joe Felter(leave of absence now performing role of US Assistant Undersecretary of Defence for South & Southeast Asia).

Pete Newell(retired Army Colonel) stood up the Rapid Equipping Force a numbe of years ago to rapidly accelerate the development and deployment of tools to mitigate IED related casualties.

Hacking 4 Defense(H4D) is running across a growing number of University campus to solve complex Defense problems using the Lean Start Up methodology using a modified lean canvas called the Mission Model Canvas.

https://www.h4di.org

I am working to expand the use of H4D/MMC down here in Australasia.

Happy to share more if anyone is interested.

It’s great to see Marines given the latitude to experiment.

It’s also great to see the often inaccurate stereotypes of Marines being rigidly disciplined and inflexible in thinking give way to the reality that Marines have very often conducted comprehensive tactical experimentation and innovation.
You should let the user go through the entire process of creating the page before you ask for money. Then they have the extra desire of wanting their finished thing.

(I started building a site and put in a form, only to be told that was a paid thing. Closed the whole thing and immediately came to write this.)