skysight-inc/HackerNews huggingface dataset:
Having an RFC is better than nothing, and I don't see any obvious vulnerabilities in your scheme.

I've posted several places about being able to take the hash of the rightmost chunk and log(N) other hashes as a compact proof of file length for a hash tree root. (Including, I think, the posts I had arguing with the IPFS folks about using BEP 30 Merlke Trees.) That's handy, but there's nothing novel about RFC 7574 there.

However, 2^64 bits is a bit of an arbitrary limit. What's the justification there? SHA-512 and SHA-384 support up to 2^128-1 bits, and SHA-3 doesn't have such a limit.

More importantly, I don't recognize the names of the RFC authors from any cryptographic analysis. There's a big difference between a scheme that looks pretty good to a ton of random people who have looked at it and a scheme designed and published by world-famous cryptographers. Has your custom tree construct undergone formal review by qualified cryptographers? It looks pretty good to me, but if I had to bet by career on the security of a tree hash scheme, I'd prefer to go with the people who brought us Keccak/SHA-3 (and one of the people who brought us AES, despite its known weaknesses).
Honestly? Because we are new at press, and were pressed for how we might offer it in the near term.
I think some here believe that the weapon here is financial; to trade the stock.
What happened after the Shadow Brokers? Are we using dogs now to detect the Terminators?
This sounds just like the transcardial perfusion that I used to do on hamsters and rats in graduate school. After doing and witnessing hundreds of those I think I will pass, I'd rather rot. What's wrong with dying? I am a huge fan of living and of life, but as cool as it sounds to have my consciousness reconstituted in some server closet, being perfused with formalin (and whatever else) before I'm technically dead is not something I place a high level of confidence in working, and it also makes me viscerally uncomfortable.
Short-term, that's not the worst thing on earth when you've got a combat mission to execute, and you need working tanks.

Long-term, you're absolutely right. Somebody needs to solve the problem.
I’m very apprehensive about using something that doesn’t charge me but reads my e-mail.

Then again it’s a gmail plugin :P
This is too well organized and presented.

For what?

My guess is that this has to be financed in some part by a group of short-sellers.

What evidence do you have of that other than 'too well presented'? It sounds like a conspiracy theory, not a guess.
> He asked the firm to lift the ban, but it declined.

That's bad business. I think giving customers a second chance before shutting them out is a better idea.
Fair points. The thing that tipped in favor of GraphQL for the back-end was that it puts the client in charge of the data structure. I suppose you could hack something like that with REST but it would be difficult.
Our application is by no means narrow or simple and GraphQL (without Redux) has been perfect. I don't dislike Redux, we just didn't need it after switching to GraphQL.
> At the risk of all my karma, honestly, fuck off.

Thin-skinned immature response aside, what you lack is empathy. You can't possibly understand why someone would take my stance. It's your lack of empathy I despise. Look at the replies to my comment - people are losing their minds. It's this rabid dogma that frightens me, and frankly makes me hate the infosec community in general.

To you, security is the only thing that matters. I don't know where the moral righteousness comes from, but someday you'll realize that your black and white viewpoint should have been more nuanced.

Edit: The profane quote above was edited out by the parent, but clearly there is some animosity and instability there.
> When you buy something, the intention is for you to own that item. It isn’t a trial period meant to facilitate an in-home shopping experience. It’s tacky to make it a habit of regularly returning things where the reason for the return could have been prevented.

I think your knowledge may be dated here. Most higher-end stores I've been to in the past 5 years absolutely encourage that behavior strongly with sales reps suggesting you do so. They love it when my girlfriend is out shopping and brings back a dozen shirt options for me to try on, and then immediately returns 9 of them (heck, some stores even offer free shipping on the items you decide against). The store just made a sale on 3 items they otherwise would not have.

They of course don't want folks actually wearing those things out for a "trial" period, but they know they must compete with on-line options that operate in this exact manner.
Might the latter also depend on how you present it?

As far as I can see this is only an exploit of secure boot if you are already on ring 0 level auth. Making a whole webpage with lots of graphics and whatnot, sending press releases all over and in general present it like a security flaw on the level of meltdown seems .. false?

Probably court level material.. In any case it seems to have backfired as the stock is up.
is this the same guy that signed off on DRM YAY?
Charles Sheffield wrote a novel based on this premise.

"[H]e devotes all his energies for a decade prior to his freezing, in becoming an expert primary source on the musically notable people of his era. Assuming that if you become the world's foremost expert in any subject, and given infinite time, someone will want to write a book on that exact subject."

If I recall correctly, the protagonist intentionally leaves tantalizing bits out of his books, so future historians will want to wake him up to ask him personally.

https://en.wikipedia.org/wiki/Tomorrow_and_Tomorrow_(novel)
It's really discouraging that not even your own started page doesn't support SSL...
That's still very much a premium feature and not at all commonplace, based on my friends with PPL and the trade shows I've been to.
Just added the extension. Curious why you need access to my calendar?
Oh man hahah, that's gotten dark real quick! Promise we're not trying to do that
Users flag stories that they don't think fit the site guidelines. That's all that happened here.

I get that you disagree. People disagree about this all the time, often strongly. I doubt there's a single story that every user agrees belongs on HN.

The only unusual thing in this case is the drama you've created about it. We can debate whether a CIA director nomination belongs on HN, but there's no question that the above submission and your comments are breaking the site guidelines. Those are at https://news.ycombinator.com/newsguidelines.html. Please read them and follow them when posting here. They're written the way they are for good reasons, based on over ten years of running this place.

No one's questioning the importance of major political stories, by the way. Of course they're important—much more important than most of what gets posted here. That's why we need flagging. Otherwise they would take over the site, and HN would be a completely different place.

HN's mandate is to gratify intellectual curiosity. Not all political stories are off topic, but the ones that only stir up outrage, however justifiably, and don't also gratify intellectual curiosity, are not a good fit.
I bet you mean http://shakydraw.com, HN discussion here: https://news.ycombinator.com/item?id=14606544
“You can't do data science in a GUI” – Hadley Wickham
Citron Research? Total hack and the premise that they provide the market a value is a stretch at best. Sometimes right and lots of times incredibly wrong but makes money on investors panicking immediately.
Good idea; a nit on terminology:

NFAs and DFAs have equivalent expressive power[1]. For this application, you probably want a determinized DFA (one without epsilon transitions); that's constant time on the input string. (It's still not as fast as Boyer-Moore.)

Backrefs let you write PDAs, which are more powerful than either NFAs or DFAs.

PCRE2[2] implements DFA-based matching. The cited page says it's slower than the NFA algorithm (although presumably a lower complexity order); I think because of lookaheads and capturing.

[1] Michael Sipser, _Introduction to the Theory of Computation_.

[2] http://www.pcre.org/current/doc/html/pcre2matching.html
Show HN: ArXiv Papers – open source React Native app
I wish I had this summary quite a few years ago. I ended up buying aeronautical software textbooks and trying to glean the information from those to figure out how to integrate multiple IMU inputs.

I learned that real world IMU use in navigation is pretty ugly and has to be supplemented due to constant errors. This can be particularly difficult when flying. In my case I used other sensors, such as a GPS. But a strictly IMU-only approach to lengthy navigation is, AFAIK, impossible.

Either way, good write up.
People here seems to be mentioning short sellers being connected to this research as if there's some sinister collusion going on.

This is the entire point of short selling, and SEC encourages this type of activism. It allows people who can provide expert knowledge to profit off a trade if it can reveal damaging and legitimate information about a company

For example, a short seller last year revealed (through extensive research), that Valeant Pharmaceuticals was stuffing its channels and faking its finances. He placed a huge sort sell and went public with the damaging info - tanking the stock from $270 to $12 and made a ton of profit off of it: https://www.nytimes.com/2017/06/08/magazine/the-bounty-hunte...

Without this incentive, why would anyone bother to reveal damaging info? You're placing your self as a target with no reward. The payment is the natural balance of the market.

So yes, this research firm is connected w a hedge fund, and they have a very vested interest. But that doesn't make their claim untrue
The local store in Apollo (at least the current version) is actually Redux (and a good use case for it IMO). In our experience it hasn't been to hard to manage and it's nice that you can still use the Redux DevTools to inspect the state.
I am sorry but no one is stopping you from discussing the ramifications on other platforms like Reddit etc, or messaging like whatsapp or on phone with friends or family. What you are currently asking is HN to enforce you viewpoint on what should be discussed.
I've only used GraphQL (with Relay) on fairly large apps but in my experience the number of apps that don't benefit from some sort of client side state management tends to fall into a very small window.

Introducing state management doesn't come for free, of course. That is an extra layer of complexity that you have to reason and maintain. And if your app doesn't need any client side caching or you don't envision a need to have shared state between your components maybe you don't need to have something like Redux. But I feel like the use cases for those sort of apps tend to be pretty narrow.

edit: Another commenter mentioned a good point that gets to the heart of your question better than my rambling -- You are still managing state in your app - just with Apollo instead of Redux.
But security researchers don't exist in a vacuum: they're part of larger society. If the security researcher subgroup has a code of ethics that diverges too far from the popular perception of what their code of ethics should be, I could see popular pressure to bring them into alignment (all the way up to using the legal system).

I'm not saying the non-security researcher users on HN have an opinion representative of the public as a whole, but this comment and a previous question asking another user what security research they've published may point to such an ethics disconnect between security researchers and the broader populace -- or simply a disregard for the concerns of the broader populace. I think it would be beneficial for security researchers (or any professional group) to listen to ethics concerns of the broader group they're a part of.

On another note, I would also assert that abusive actions by vendors do not excuse abusive actions by researchers (and vice-versa).
It's really interesting that their web site says you only need to show ID if you don't have proof of purchase (and it's only in the fine print at the bottom, the top indicates you need it in any case). I recently had to return a defective router ($350) and the receipt said I needed ID to return it. Of course, you don't get the receipt until after you purchase the item otherwise I would have just ordered the router from Amazon. Anyway, I did not want to show an ID, I had my receipt, I had only bought this thing a few days prior, it was broken, and I didn't want my driver's license in yet another set of databases just waiting to be hacked. However, the customer service person was super nice and didn't even ask me for my ID.
GDPR: How small companies can get ready for it and why you can’t just ignore it
Not an accountant, but my understanding is that the retailer is collecting the tax on behalf of the state. Thus if they're explicitly stating they're not refunding the sales tax, they have to give it to the state, because those funds weren't theirs to begin with.
>The internet developed without it. We've never really had it

We did have it. Defacto net neutrality, enforced by a competetive ISP market. It worked. And once we started to lose that, consumers absolutely did feel the impact. Remember when Comcast throttled bit torrent?

>If you're worried about centralization, net neutrality won't help much. Facebook and Google are large enough to crowd out other players with or without net neutrality.

Sure, they can still dominate under net neutrality. It's just significantly easier without it.
This is not a very accurate comment. Async code, cooperative scheduling, threading, and shared memory are all completely independent. You can have any combination of those.

It comes down to this: Mutual exclusion is a requirement for concurrent operations.

This can be accomplished with mutexes (usually how thread-based implementations work), cooperative scheduling (how some async implementations work, but not all), shared nothing architectures (one request per process, actor/CSP model), among other approaches.

There are plenty of hybrids out there. libevhtp is a threaded async web server. It screams. Erlang presents a no shared memory model along with an aggressive scheduler, allowing for one request per process designs, except in this case a process is extremely lightweight. Golang does something similar with goroutines, similarly lightweight units of execution.
Infrastructure collects solar data allowing prediction of available solar energy [pdf]
We just released it two weeks ago, so we're just looking to get loads of feedback as we're improving our tech to finally create a business version of it.

We've got no plans whatsoever to sell anyone's data - we'll be a good ol' regular SaaS product for business with a free version for personal use.
Btw, your HN search result page links to all of the references that you THINK what the term "Responsible disclosure" means. Be it "coordinated disclosure" or whatever else, I don't care. But I don't think it's ethical to disclosure the security vulnerabilities to the wild without contacting the vendor and given them a timeline (should be MUCH LONGER than 24 hours) and the benefit of doubt first.

Hypothetically speaking, if you are researching vulnerabilities solely for the intent of money (because you can sell to them to 3rd parties or your side hedge fund business can profit from disclosures in the stock market) then shame on you, because you are doing the society a dis-service and gaining on everyone' losses. To me, you are as evil as those hacker who utilize them.
The reason we haven't announced an EOL for ACMEv1 is that we won't announce one until we are confident we won't cause the kind of meltdown you describe.
The killer add-on for Firefox is Containers. This lets me run multiple instances of Gmail without them knowing about one another. I run Facebook and Twitter in another container and they don't know about anything Google.

My default profile is not logged into Google or Facebook or anything similar and uses DuckDuckGo for search.

You can set URLs to always open in a container. That gives me the benefit of cookies without having every website being able to detect them.

Firefox is fast, at least as fast as Chrome, for me. I did lose some extensions but the trend is very positive.
Having a financial incentive to mess up AMD might explain why they only gave 24 hours' warning, though.
I've been doing Scala professionally for a decade (so definitely not limited to Spark). There was a clear correlation between Scala jobs being higher paying and more interesting than what I was doing previously.
Yes.

During the American Revolutionary War where the Americans moved the artillery from Fort Ticonderoga to Boston over the winter of 1775-6 (still an era where the military response to winter was to hunker down somewhere and wait for spring before doing anything), and then proceeded to install them on heights overlooking the harbor overnight.

In WWII, the US managed the astounding feat of supplying the majority of the logistics on what was effectively three separate fronts (North Africa and later the Western Front via the semi-interdicted Atlantic, the Eastern Front via the Northwest Staging Route and Siberia, and the Pacific Theater, including mainland China via the Hump). It was the experience of The Hump that led the military to try relieving Berlin by air, which almost everyone thought impossible at the time but instead turned out to be a smashing success.
Running a business on the assumption that customers will share your morals and ethics is a recipe for failure
I can't think of any way that could be possible. In the end people who are comfortable enough to rip the source and setup/maintain hosting probably wouldn't need the service.
How to simulate everything (all at once)
I wrote that in anger, and almost right away removed it when I calmed down. Please see my current comment.
Workly: A really simple way to move a stand-alone function/class to a web worker
Having worked in a call center for 3 years I can assure you it doesn't take 1 month of intensive training. It takes a variable amount of time to get up to speed depending on how much you are asked to think.

In some call centers, you will be following a script about 90% of the time and that takes very little training. In others you actually have to think and troubleshoot issues, those take a bit more time to get up to speed on.

All that being said, I can assure you that you do not want to work at a call center. I'd take whatever programming job you currently have over the call center I last worked at. For whatever reason, call centers attract the worst kinds of managers in this day and age.
I love the Commandant's attitude. He seems to get it.

I've come across many Marines in my personal history as a diplomat brat (Marines protect all US Embassies abroad) and worker (the best boss I've ever had is a Marine). I've only met one I don't respect and/or admire, and he was drunk and belligerent on the Metro (not towards anyone in particular, just being a loud ass).
> but to saying that a project needs it implies that you cannot succeed (whatever your idea of success is) without it.

Sure. I think a lot of people are also defining succeed as "be somewhere or something I still want to associate with in the future."

There have been a few high profile projects that have gotten themselves into hot water because of either unwanted behavior by some that wasn't corrected (or they didn't have a good policy to point to for correction) or was too strongly corrected (different people have different thresholds, and without a clear concept to point to, even if somewhat vaguely defined, some people tend to go nuclear before a warning shot has been fired, which is also unfair).

We may at some time get to the point where communities are including too many general and positive policies, but I don't think we're there yet. In the meantime, when correctly followed they provide help and protection to people on both sides of whatever issue they are concerning.
That blog post was actually a pretty interesting quick read. I had no idea the actual launch player base was 50x the expected value. The in place upgrades were impressive too.
Thanks so much! Really happy to hear that you like our idea.
Please shoot me any feedback you have at filip@easyemail.ai. I want to make sure you have the best possible experience!
> How do you explain cults?

People have strong drive to belong to an in-group. There are multiple experiments that assigning random markers to random people and making them participate in certain activities lead to "group cohesion" effects and people start assigning deep meaning to those markers, despite them being completely random. Cult is just when people take it to the extreme - likely because they didn't find satisfaction for their in-grouping drive elsewhere.

> How do you explain the effects of advertising?

Which specifically effects? It's mostly brand recognition, aka availability heuristics - if you have brand A, B and C and you heard before that A is good, you're more likely to choose A than unknown B and C - and just plain informing people things like brand A exist. And a touch of in-grouping ("if you drink Coca-Cola, you are in a group of cool people"). And a tad of signaling ("if we have money to but expensive ad spot on TV, we must be a successful company that can afford to create good product, would not disappear tomorrow and values its reputation so we would not cheat you").

> How do you explain the uniform levels of discipline achieved by basic training

They are not that uniform, but again in-grouping plus other guys will be literally shooting at you (though research shows a lot of this shooting is much less targeted than previously thought).

> How do you explain phone scammers? How do you explain the success of the public relations industry?

That's plain persuasion, with various ethical fences either present or absent.

> Everyone of these consists of people being programmed or brainwashed in one way or another.

Again, if by "programmed" you mean "persuaded in something, in which they most likely inclined to believe from the beginning due to selection and grouping effects" then sure. People can be persuaded to buy a shampoo especially if they wanted to buy one already, and people can be deceived especially if they're already out to look for something the deceiver seemingly offers, and people can be blind to arguments especially if those arguments challenge their prejudices.

The only thing different here is tobacco smoking - that's physical addiction, it is a different mechanism.

> If you're interested in reading about this, there is a book by a psychologist named Robert Cialdini, called Influence, the Psychology of Persuasion.

Yeah I know about Cialdini. It has a lot of nice tricks, but it's not magic. It's much less magic then it's made out to be. And yes, reframing and anchoring is one of the tricks. If you watch Trump carefully, you can see all these tricks employed, he does it all the time. He didn't invent it of course - expensive stores have been putting items with outrageous prices on prominent display for ages, to make regular item prices seem lower in comparison. It does confuse some heuristics for people. But anybody is capable of approaching the prices - or Trump - rationally and see the actual price. There's no "programming" to prevent it - if one makes minimal effort, one can always do it.
It depends on the retailer. Nordstrom's encourages this kind of behavior -- salespeople there make sales by telling the customer they can return stuff if they buy it and find out they don't like it. On the other hand, L.L. Bean has recently added restrictions to their return policy because it was being abused.
I’ll channel my inner patio11 and say that a business that cares about saving $9/mo vs Squarespace isn’t going to be a valuable or long-term customer. Pricing is about defining who your customer is, but also who your customer isn’t.