skysight-inc/HackerNews huggingface dataset:
I think his argument is competely backwards here. The R&D vs dividend decision is largely independent[1] from the decision about what to do with their patent portfolio.

The R&D vs dividend decision is just about the expected ROI and risk of R&D vs Qualcomm's cost of capital. (Like any other investment decision). Note that the decision is a spectrum from "raise money and do R&D" to "pay a huge dividend and do no R&D".

The disagreement between Qualcomm execs and Jana (or Broadcom) is that the former say they can deliver returns over their cost of capital by investing in R&D, while the latter don't think so.

Patent reform (assuming it makes patents less attractive), would only bolster the investor case, as it would make new investment in R&D less attractive. (Ignoring 2nd and 3rd order effects)

[1]: Once you figure out how much R&D to do, the licensing vs selling vs spinning off is largely a financing question. If you need more cash to invest today, selling some patents replaces issuing stock. If you need cash to pay a dividend, you can give shareholders your patents directly (i.e., do a spin off) or sell the patents and give them cash.
Excellent, great citation! Now, precisely what did the security researchers hack for their own gain, and precisely which computer's security was violated?

If we can call them "hackers" just because they ostensibly compromised their own hardware or software as a proof of concept for the vulnerability research, does that mean that all of Google's Project Zero consists of hackers and black hats because they get paid (personal gain) by Google to find security vulnerabilities?
Exploits in C/C++ to compiled JavaScript / WebAssembly
Glad to hear we've been useful! Looking forward to more feedback in the future :)
I reread it several times trying to understand how simply using GraphQL allowed you to eliminate the need for all actions / stores for your entire client side stack. It wasn't until I looked into Apollo that I understood what you had actually implemented.
The latter. It's for guarding against malicious JavaScript discovering secrets. In practice, the browser should have this sort of protection built in.
Clojure was built in 2007, so it's clear there have been some changes.
Recently move a bigger webapp to AWS elasticbeanstalk, I had to add a few lines to redirect from http to https. We still have a long way to go.

In case of https://lonelypage.io the cert isn't for the correct domain....
Samba fixed two critical vulnerabilities,update your version as soon as possible
The ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.
Well, fraud only if it were deliberately misleading. It seems highly likely that the MTA believes what it is saying, even if it happens to be misguided, and driven by the right motivations.
> Care to link a few?

From Friday, in which Turkey takes advantage of HTTP downloads to install spyware on YPG computers: https://citizenlab.ca/2018/03/bad-traffic-sandvines-packetlo...

From a couple months ago, where Comcast injects JavaScript into HTTP connections:
http://forums.xfinity.com/t5/Customer-Service/Are-you-aware/...
Probably olark and other chat bot crap can be added too. They are mostly used these days for pushy sales people to hook casual browsers.
Yeah, I'm not opposed to HTTPS. In fact, the reason I get frustrated is because, like you, I've dealt with it at scale for years. I agree it should be used most places, but what about static documentation sites? What about blogs? I've even used Let's Encrypt a few times, and it seems like a great service. But who wants to set up that machinery for a simple resume site?

That machinery has a cost. With every barrier we throw up on the web, it makes it harder to build a reliable site. I also realize this is an argument I've lost. It's so much easier to just say "HTTPS everywhere" than to examine the tradeoffs.

Oh well.
Redux is useful, just not as a primary store for model data.

For example, Found (https://github.com/4Catalyzer/found) uses Redux to keep route state. It's nice to use Redux in that context, because route state is global but also simple, not very hierarchical.

But for model state, Found integrates with Relay (https://github.com/4Catalyzer/found-relay/), because, as this article says, GraphQL reduces a lot of the REST/UI impedance.
Float-overs and ridiculous full-width bars are some of the most annoying "innovations" that have appeared in recent years. But I don't see why browsers have to do anything - the publishers clearly like the way their pages work and consider it worthwhile.

Blocking things like this is different from blocking third-party advertising in my mind. I should be able to stop my browser from contacting a third-party site.

If the author of a page wants to see a float-over then so be it. I can choose to close the tab and not come back.
That's good feedback - why do you think the available market is small?

That's certainly a possibility, but for now we're just really focused on making the product really useful.
The way to fix it is through enforcement of the SEC laws. We aren't going to combat fraud without proper enforcement. The industry needs more regulation because right now most investors are getting fleeced and getting left with nothing because there is a large pool of unsophisticated investors.

This solution would give SIA the ability to regulate these ICOs and that has even more issues (what makes SIA authoritative)? SEC regulation even though seems like a bitter pill for people who are in the cryptocurrency space is needed for things to actually get done since every fraud basically turns away investors that actually want to fund a real project.
They won’t ever issue EV certs.
You can golf away 8 characters by replacing

[].foreach.call(a, b) -> a.forEach(b)

... since the value returned by `querySelectorAll` has a `forEach` method. And 5 more if you replace:

'body *' -> '*'
I don't think that is the crucial difference. In a train or plane crash, hundreds die in a single event. But when a hundred people die in a hundred car crashes every day, the individual event is barely worth a mention on page 6 of the news.

It's the same mentality that means we have root cause analysis for plane and train crashes but for a car crash, SOP is pretty much to blame 1) whoever died or 2) noone at all, and 3) never the infrastructure.
Just ask an MD what test would be required. Then talk to some SV VC and/or set up a Kickstarter campaign. Then contact me.
Great idea, brick and mortar retail. That looks ought to help speed up your Amazon-sponsored demise. Amazon's return policy is so flexible it sets a very high bar for customer service
There's a great film that came out last year about the Japanese bluegrass scene. If you're like me and have had no interest in bluegrass this is an endearing introduction which really illustrates some of the deeper points of the culture from an unlikely source.

http://www.farwesternmovie.com
Anyone who is cryopreserved, but is viewed as a villian in the zeitgeist of the future, could end up being booted up into a personal hell for the amusement/vindictiveness of future people.

If a 'Hitler' VM was publicly available online, how many people would torture it? What are the ethics around torturing virtual consciousnesses of evil people?
Clients for this aren’t web browsers. Making browsers warn about them doesn’t break anything.
So it scrapes lots of listing websites and emails when there’s a good deal? What qualifies as a good deal? How does the were does the deep learning fit it?

Interesting idea, maybe you could put more info on the linked page.
Google DoubleClick issues causing slow load time in Europe
Opinion on smart contract platforms vs. Ethereum by cburniske
Yeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.
Great explanation! If you want a very detailed deep dive into Kalman Filters, I found this sequence of videos really helpful: https://www.youtube.com/watch?v=CaCcOwJPytQ

It's 55 short videos, each one going over a specific topic or example.
Here's the strongest version of the claim that I understand:

1. All of the relevant people, i.e. "the users downstream of bugs" are already vulnerable.

2. It's possible, maybe even probable (or likely), that people, other than the researchers that are disclosing the vulnerability, have also discovered the same vulnerability and, furthermore, that those others can exploit the vulnerability.

3. Every delay in disclosing the vulnerability prevents the victims from protecting themselves from any bad actors mentioned in [2] thru means more drastic than applying a patch or similar from the relevant vendors (e.g. taking the affected components offline or otherwise making them unavailable).

The argument hinges on the probable size of the bad actors mentioned in [2]. If you assume that the disclosing researchers are the first people to discover the vulnerability, then it would possibly be best for them to first disclose the vulnerability to the relevant vendor or vendors. But note that even vulnerabilities disclosed to vendors can be leaked to bad actors.

And if you don't assume that the disclosing researchers are the first people to discover the vulnerability, then not disclosing ASAP prevents people from protecting themselves.
The one that always sticks out is the certs’ extremely short expiration period. The IMHO weak rationale for this was mentioned in another thread here (See jjeaff‘s response upthread).

It would be nice if they simply offered two choices:

1. I love automation! Give me a 90 day certificate.

2. I understand the security trade-offs. Give me a 3 year certificate.
That's not a really fair way to put it as the signaling system is still the root cause of the slowdown.

1. Outdated signaling system cannot handle current load at high safety threshold

2. Network could not upgrade signaling system due to lack of money

3. Network responses by slowing down critical paths and putting in more locks

4. System capacity drops

So yeah, you still need the money to fix slow things.
Can you outline the approach how this would work? It was my understanding that in order to use Let's Encrypt you needed a public facing server to verify ownership.
I would be so mad if I put in the effort to build everything only to be pay-walled at the end. Just, livid.
It's my recollection people heading west to Oregon and beyond would aim for making it to Independence Rock, WY before independence day in the summer to avoid having to attempt traversing the Rockies in winter.
> liquid capital in the form of Bitcoin, Ether

Not sure that you're using the word "liquid" properly. Show me how you can convert $50M USD's worth of BTC or ETH into USD in three business days or less.
Show HN: Robinhood Desktop
I think we agree with each other, then -- sorry for misunderstanding your initial post.
No, but that limitation is due to wildcard certificates specifications - not LE.
And web servers can even detect TLS MITM: https://caddyserver.com/docs/mitm-detection
Google says they explicitly don’t use web-browsing data for ad targeting. They don’t say that they don’t use web-browsing data to improve your experience with their various recommendation/prediction/autocomplete APIs. So there’s no guarantee that bad ad targeting implies YouTube doesn’t have a better profile on you.
Not only are car crashes less salient than train crashes, but also the converse effect: the inconvenience of car speed limits is more salient than the inconvenience of train speed limits, because you're the one driving.
I frequently shop at Home Depot. Last year I was remodeling my bathroom and I had some extra parts (unused) and I went to return them. I was mistakenly flagged by Retail Equation and several of the things I was returning were denied. It was extremely frustrating as I had bought thousands of dollars of merchandise and was literally trying to return less than $40 of stuff.

I asked to talk to the store manager, she said there was nothing she could do. To me, the real problem with these systems is that relying on them too much removes the ability for people to provide good customer service.

Fortunately for me, I don't give up so easily. I guessed the email address of the CEO of Home Depot and wrote him. The next day the VP of Loss Prevention called me and then called the store. They let me return my merchandise the next time I tried. ;)
How to define Product Goals?
I used to teach an AP CS class and we used repl.it extensively, kudos to amasad and crew for a great product that just works.
Dell Technologies Open Source – The Code Team
I can't even load the page, so your miles ahead of me!

If anyone at Cloudflare cares to take a look, here's what I get:

> Server Error

> Our network is literally on fire

> Ray ID: 3fb0bf524995797f

> Your IP address: 172.58.40.122

> Error reference number: 502

> Cloudflare Location: Seattle

2nd try had an Error reference number of 524, with everything else being the same.

Shenanigans like this are why I stopped using Cloudflare on my websites, better to have something I can debug and avoid a party MitM all my connections, than to gain a fleeting bit of "reliability" or "security" that Cloudflare supposedly offers.
Risking asking the obvious: What is stopping us from having autonomous subways, considering we are almost gonna have autonomous cars?
1. One of the exciting things about this specific project is that it's likely to be no longer necessary to run an EC2 VM behind your Cloudflare site any more - any computation can live entirely within Cloudflare.

2. If you're running behind Cloudflare, one pretty straightforward and common thing is to configure your web server to only respond to requests from Cloudflare. Since Cloudflare has its own WAF that's updated by a skilled security team, this decreases your exposure - something like Shellshock or the Rails mass assignment vulnerability would get dropped at the Cloudflare level before it makes it to your origin server, and nobody else can send you HTTP requests.

(At that point you can configure your machine for SSH keys only and reduce your attack surface to pre-authentication OpenSSH vulnerabilities.)

So I don't think you have two problems if you use Cloudflare. You are trading off one problem for another, yes, but for most people that's the right tradeoff.
It's either fraud (deliberate) or incompetence bordering on fraud. They have declining ridership, yet are claiming increasing overcrowding.

In either case, probably time to clean house and get rid of the "better safe than sorry" crowd.
Study Tackles Neuroscience Claims to Have Disproved ‘Free Will’
That's one scenario. Or maybe they run out of funding and need to shut down. Maybe they end up needing to shut down an old API before everyone is ready. Maybe they have a bug and issue a bunch of subtly broken certs (say, not enough entropy).

It's a concern whenever a large portion of decentralized infrastructure has a single centralized dependency. Even if that dependency is awesome and doing great work right now.

Ideally, there would be several free CAs that all used the ACME protocol. But somebody's got to pay for that and somebody's got to go through the effort of setting it up when Let's Encrypt already works really well.
I'm confused, they definitely mentioned the what was decrypted. It was the "Knowledge is Power" using different types of fonts decode his initials.

Thank you for the high res photo, it was cool to actually be able to see the close up lettering.
Dan Guido is backing up their claims.
A perfectly viable option that is called 'shadow mastering'. dns.he.net lets you do it for free.
Project Zero practices responsible disclosure. They do not make money from the exploitation of the companies whose software/hardware they find flaws in. The difference is very stark and you are being deliberately obtuse.
Disagree strongly. Qualcomm agreed to license their patents in a fair, reasonable and non-discriminatory (FRAND) manner in return for having those patents included in wireless standards, and then turned around and broke those agreements.

And that's really only the tip of the iceberg for the shenanigans that Qualcomm has engaged in. By spreading FUD, they were instrumental in ensuring that the US used their CDMA standard rather than the (arguably superior) European GSM standards which they didn't have any patents on.

IOW, patent trolling is legal. Qualcomm's patent trolling was so egregious that they've paid billions in antitrust fines and lost lawsuits.
One week is not enough. I have fasted for a week myself. That's easy. You mentioned "couple of weeks" so six or 8 weeks would be more appropriate.
Formula 1 teams ? Moving all that equipment around the world, a lot of times on tight deadlines must not be easy.
ICO: Initial Coin Offering

https://en.wikipedia.org/wiki/Initial_coin_offering
You just need public facing DNS.
> "Unheard of"? People have dropped serious vulnerabilities with _zero_ warning before.

Individuals sometimes do this, security companies very rarely - and both are shunned by the infosec community at large when they do so, as this is very unethical behaviour.

They registered the domain a couple of weeks ago - why give AMD only 24 hours notice?

In this case it does seem highly likely there is some stock market skullduggery afoot.
Unless of course, you are running Exchange. In which case it's not supported :(
A lot of the new work we do at FarmLogs is built with GraphQL. We've been running some critical apps with it and in a lot of aspects its a real joy. That being said, nested HoC's and the way it is used on the web is not ideal. Perhaps we are using it incorrectly there, but the documentation hasn't been a lot of help.

> You can combine multiple data sources into a central datastore using GraphQL (REST APIs + DB queries etc.., that's one of the major benefits of it.

Would love to see the docs on this because I have yet to find it!
There is far far more incentive for AMD and its partners to understate the severity.
Poor initial implementation combined with fear.

The DC Metro used to have a semi-autonomous mode that's been turned off for years since there was a glitch that caused a crash.
Show HN: Super-lightweight jQuery alternative
Do you know where the line is between what e.g. Citron Research is doing and what is considered slander? (I assume they walk a very thin line in order to not get sued)

Their Shopify video [1] for example is not the typical „research report“ with lots of specifics but more of a personal opinion with rather broad accusations.

[1] http://citronresearch.com/citron-exposes-the-dark-side-of-sh...
> It’s meant to be an exception during the sales process (not a normal condition) and offered as a courtesy, not a defacto right.

It is a defacto right in many situations in many countries. In the UK for example, if a good is sold sight unseen via "distance selling" (mail/phone/online etc), sale of goods legislation requires you to provide a refund for any reason whatsoever if the item is returned within 14 days.
I know "great artists steal" but man is this cutting it close compared to Scott's Cheap Flights. I mean, you even took the same copy text.

What's funny is I'm not even sure if I mean that accusatorially or admiringly. Maybe both.
If ETH Isn’t a Security Then Nothing Is
Because of jobs?
It's already a thing, first example that comes to mind is line 14 in the Paris metro: https://en.wikipedia.org/wiki/Paris_M%C3%A9tro_Line_14
Looks awesome Amjad, keep up the great momentum!
It is also in part a factor of the way procurement works, many beancounters still can't grasp that needs vary and problems happen, so you get a budget, if you come up below budget you lose the extra and may get your next budget lowered to match, and getting more budget is a hard fight.

As a result, departments want to have a budget as close as possible to a worst-case scenario, spend the entire year thrifting in case something major occurs and then have to blow it all up right before EOY.
No, they are not "shunned by the infosec community", no matter how nice that narrative sounds to you.
I'm mainly just trying to solve an issue where I've got end users who think there's a security problem because they've typed www.myorg.example.org instead of myorg.example.org and the wildcard DNS entry in Route53 picks it up...which directs the user to an Insecure error.

Trying to figure out how to get Route53 to stop the wildcard at the top level or get a wildcard cert that will go down the path.
It's likely drawing bypass air.

Here's a prefilter for a tractor or something:

https://www.youtube.com/watch?v=_P3u7wgiy-c

It's using air flow to blow the particles out before they hit the filter. If I understand correctly, the part in question does similar, pulling debris out of the intake stream without being in series with it.
DC Metro use to but then there was a major accident that resulted in them reversing the system. They plan to eventually make them driverless in the future.
Great idea! I’m looking to invest in real estate and have found the hardest part about it is surfacing interesting deals. If an AI can be parameterized to search for me, so much the better.
Question for freelance and digital nomads, how did you get started?
I'm curious about this traveling the world + freelancing lifestyle. How does one find new clients? Are there blogs/articles with experiences of people that I can refer to?
You could, but the wildcard cert makes it much easier...

"One cert to rule them all, and in the darkness 'bind' them."
But issuing 3-year certificates would disqualify them as a CA: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-...
I agree, but I am curious if you have any suggestions on how we should be handling disclosure?
If you are willing to sit inside a metabolic chamber then feel free. https://www.pbrc.edu/news/making-an-impact/?ArticleID=344

The problem is not incentive, if you can demonstrate this that's not going to be a problem. People have spent 100 billion+ trying to break physics demonstrate it's wrong and money would be plentiful.
A look at what led to world’s worst listeriosis outbreak in South Africa
This could be useful. I find it interesting that the two examples of cheap houses on the front page are in areas that have had severely damaging weather but I guess you could find cheap houses there. Will I get notifications for places in Detroit as well?

I think this site will work in many cases except the best. The best cases come from finding an owner before they list their home, which is pretty rare. When there's a service that does that I might consider signing up.
Doesn't that lead to an explosion of the number of sql views and backend controllers/endpoints?
You can do that pretty easily on any of the major exchanges.
Let's Encrypt uses the Public Suffix List (https://publicsuffix.org/) in their issuance process to handle those sorts of cases.
Truecaller app is dangerous warns Egypt's Minister of ICT
How much of a priority is supporting automated tests? I'm trying to think about how a repl would interact with a test runner.
Great article! I've also been learning Verilog -- albeit in an academic setting -- and it has been an interesting experience. I discovered that you can do surprisingly complex things in Verilog (at least, from a digital logic point of view) using less code than I initially expected!
Should I apply to YC for the 4th time or nah?
This is will be my 4th time applying to YC. 2nd time with my current startup. I'm debating if it's all worth it or not...
I mean.... technically... now she runs all CIA black sites.
Logojoy does this. It's incredibly effective I imagine.
Reminds me of story of a local Taekwondo Great Grandmaster named Moo Young Yun. After well over 50 years of training and extremely high accomplishments, he walks into the gym one day and exclaims how he finally is starting to learn how to throw a good punch.