skysight-inc/HackerNews huggingface dataset:
This is not a first. The USA made a nearly identical claim in this retracted story in 2016:

https://www.washingtonpost.com/world/national-security/russi...

A code associated with the Russian hacking operation dubbed Grizzly Steppe by the Obama administration has been detected within the system of a Vermont utility, according to U.S. officials.

... but ...

Editor’s Note: An earlier version of this story incorrectly said that Russian hackers had penetrated the U.S. electric grid. Authorities say there is no indication of that so far. The computer at Burlington Electric that was hacked was not attached to the grid.

Generally speaking, anonymously sourced stories in western news outlets about Russian hacking have a very high propensity to collapse or get quietly retracted days later. The DHS is particularly notorious for this: they also claimed Russia hacked various election related systems in multiple states, but the states themselves investigated and said the DHS was wrong.

I cite some more examples in this blog post:

https://blog.plan99.net/%D0%BF%D1%80%D0%B0%D0%B2%D0%B4%D0%B0...

Glenn Greenwald also wrote extensively about this problem.

So now we have an "unprecedented" story sourced to anonymous officials in the DHS, making the entirely false claim that this is the first time US officials have accused Russia of hacking the electrical grid. The cited evidence is a Symantec report that didn't name anyone in particular.

Is it possible Russia is doing this? Of course. I would be, if I were Putin. But I'd also be doing it if I were the leader of Iran or North Korea or China. Perhaps all of them are doing it.

Regardless of the truth, this sort of story should have no credibility with anyone by now. There have been far too many false stories about Russian hacking published for them to carry weight.
The struggle is real and eternal.
Have you considered looking at room rentals on Craigslist? If you're within walking distance of Castro (downtown), you may not even be at home that much, because you'll be steps away from the library, coffee shops, restaurants, etc. In a way, I think shared living can often be a form of networking, because so many people here work in tech.

I mention it only because in my experience, cheap studio rentals in MV are not worth the paper their leases are printed upon. They have thin walls, which are my biggest pet peeve. When you can hear everything your neighbors are doing (or conversely, have to walk around on tip toes to avoid irritating them), any privacy-related benefit of having your own place kinda goes out the window. Again, that's just my experience. When I first moved to MV in early 2016, I rented a studio for $1900 (a decision I ultimately regretted because of noisy neighbors/thin walls). In hindsight, I wish I'd just rented a room in a house from someone with a personality similar to mine (quiet introvert). Good luck with your search:)
Fair enough, but reducing the sum of a man's life to a single word describing his final few minutes maybe isn't the best system of taxonomy. He was a father and a husband for far longer than he was a murderer.
So what? 10000+ companies were successful with software not written in Lisp. Biz success is not decided by the programming language you use.
> as I noted I don't really think you're interested in anything except confirming your bias

Stop pretending you know what motivates my contributions, that's rude.

Bias? We're talking about a tech product, not immigration policy. I am not loyal to any brand, I own examples of most brands and will praise or criticise as needed, as anyone should. Brand loyalty is where you'll find bias, so perhaps take a look in the mirror.

"Duh" is a silly word to use on any occasion. When used as part of an answer to a question, you risk giving the impression the questioner has asked a stupid question. "Duh" does not mean "obviously".

If you're standing or sitting with arms folded then look down at the time, you may see a blank screen, therefore the primary role of your wristwatch is inferior to even those watches that require daily winding. And no, I would not describe a watch that requires daily winding as a great watch.

I look forward to vastly improved battery life in smart watches and more hybrid-mechanical or traditional digital watch design so that the watch part is not an "app".

It doesn't seem like you can discuss the product without going after the person, so hopefully this interaction is at an end.
its the Toronto Maple Leafs
Aren't these the same level as the Intel ME vulnerabilities? I'm basically assuming this is wonderful schadenfreude to see that AMD is basically no better than Intel at protecting this sort of stuff.

When I say "pedestrian" vulnerabilities, what I mean is that most users should wait for the patch to come out and apply it, but otherwise not panic. It's definitely not Heartbleed-class "you need to have patched yesterday and, if you haven't, you're already compromised."
I have, and really enjoy it. My previous go-to for frontend was TypeScript, but it wore me down. I am ridiculously productive in ReasonML with proper ADTs, (exhaustive!) pattern matching, immutability and other niceties. The superb type inference is also great for prototyping, and I could go on and on. Rust for backend and ReasonML for frontend is making me very happy these days. I think the community will only keep growing. I feel like I’m an extra in the filming of Revenge Of The MLs, and it feels great.
I'd rather have 5 very good programmers (using ANY language) than 50 code monkeys (using ANY language). The problem with the Lisp programmers is that they very likely would not be able to work as a team.
"This is about system software, so we will see lower level things [...] to show --in real source-code, not in small toy examples-- how things work, why certain things were implemented in a given way. You know, when software starts to become bigger, then the very clean approaches start to fail. You have to face compromises in order to make things work.."
They used Agora:

https://agora.vote/

(Aside: forgot to turn off my extension and so it appeared as, 'Sierra Leone just ran the first "Multiple copies of a giant Excel spreadsheet"-based election')

https://github.com/cynthiablee/blockchain-to-spreadsheet
By ripping off a BBC show to the point of hiring the stars.
I don't think rationality is the top priority for suicidal people. And I don't care how much you mulled on it or how many black friends you have so you can't possibly be racist—flippantly calling someone with mental health issues a "psychopath" betrays a huge lack of empathy and only serves to further stigmatize mental health conversation.
Haskell (and other functional languages) is also built on the lambda calculus. Lisp isn't special in that regard.
I cautiously applaud the progress.

Back in Ron Rivest's 6.857 computer security class, we spent some time on electronic voting. If you're not careful to get the privacy right, you open up more opportunities for coercion.

With anonymous paper ballots, coercion can and does happen, but it basically requires physical control of the polling station / voting booth to pull off.

In this case, anonymized ballots are put on a blockchain. Hopefully the system is auditable, but provides no way for someone to prove which anonymized ballot serial number belongs to them. Otherwise, the thugs can come to your house and either beat you or pay you your bribe after forcing you to reveal how you voted.
> thereby offering instant access to the election results.

...

> it is still unclear who won
You know stratum is a well-known protocol name?
Very cool company and one of the few in SV with a black founder
I hate to speculate on these things, in large because I'm woefully unqualified.

But I suspect that it may be due to his religious beliefs. He could've believed that he was going to being his children with him to heaven. Of course it's not a rational thought, even in the context of Christianity and their beliefs of afterlife, but suicidal people are rarely rational actors.
Not everywhere burns fossil fuels to produce electricity though.
And 10000+ other people/companies have made fortunes using programming languages other than Lisp. So what's your point?
You need 16 times the sample size to estimate an interaction than a main effect
How does it compare to Scantegrity [1]?

[1] https://en.wikipedia.org/wiki/Scantegrity
I also don't believe PG's claim. I know Common Lisp, Scheme and Clojure well enough to be able to say that. Also, lots of people/companies made fortunes not using Lisp. So PG's claim proves nothing.
Perhaps I'm missing something, but don't these vulnerabilities require root to exploit?
Because Rust-style resource management is not only about performance, but also about correctness. And the ML crowd cares a lot about the latter - rightly so.

I'd kill for a language with ordinary ML types for values (integers, strings, etc.), and substructural types for objects (file handles, database connections, etc.).
How do you provide anonymized ballots while at the same time guaranteeing that fraudulant voting is not taking place? It seems that being able to verify that a ballot came from an actual person authorized to vote (and not some bot) is key, but I'm not sure how to satisfy both.
I think there is a difference in denial --which I don't propose and overtly and outright saying I'm proud to be "...". Be comfortable with being "..." accept being "..." and not wishing to be anything else.

I hope people feel their heritage is "cool" but I'd rather not have people feel their heritage or a different heritage is "better".

On the other hand, I feel that there are some societies that indeed contributed more to civilization than others. I don't think that's deniable. But I mean as a person one should not feel "better" or "worse" than any other person because of heritage.
That's better than the alternative of not investing at all because Vanguard is not user-friendly. And I know that's possible because I have friends who were in that situation.

If you sign up with Vanguard, you still have to pick which fund(s) to buy. If you don't know anything about investing, that can be a daunting task. With Betterment, the only decision you have to make is the percentage split for stocks vs. bonds.
While HN has a liberal bias, it is worth reading and understanding the opposite side's motivation for their opinion. Instead of voting him down, it would be more academic to understand and engage in civil discussions.
I have a really hard time understanding suicidal people

Believe me, you don't want to understand. The only way you can, is if you've been there.

Imagine for a moment that you are in a hostage situation. Someone wants to kill you. They have the gun to your head, and you have no control over it. Maybe it's today. Maybe tomorrow. Maybe you'll get out okay? Nobody knows. Inside you're scared as hell. You don't like this one single bit. But you're bound, and you can only struggle so much. They have their foot on your back, standing over you. You're powerless. They're screaming at other people. Yelling at you. Acting irrationally. It only takes the smallest thing to set them off, and there's only so much you can do to stop them pulling the trigger. Sometimes they'll go away for long enough for you to get a rest. Maybe get some sleep. But don't kick your toe or drop something. You'll wake them up and you'll be right in the thick of it again.

But the person holding you hostage, is yourself. It's a part of your mind. And it will sap every bit of your energy to try to fight it. The healthy part of you doesn't want any of it. The healthy you doesn't want to hurt anybody. But sometimes you just can't fight it any longer. It's daily, monthly, yearly, conscious waking nightmare.
Yes, the parent comment was equally stupid. Parent comment doesn't wage the longest war in US history without ever voting on whether or not to wage it, make me pay for it, and then blame roads.
According to Trail of Bits :

"There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers (see https://www.usenix.org/system/files/1401_08-12_mickens.pdf, Figure 1)

These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing."
- https://blog.trailofbits.com/2018/03/15/amd-flaws-technical-...
There's also M1 Finance (https://www.m1finance.com/), which is all about long term investing. Commission-free like Robinhood, but it also has fractional shares. Makes it even easier than Robinhood to manage a well-balanced portfolio.
> Am curious if it is legal to fund security research to find flaws in a competitors product.

It’s legal. I’ve been hired to do it before.
Education is not a team sport. If kids want to be nutters that’s their problem, not the responsibility of well behaved kids to reform them by proximity.
My problem is not the security aspect of it, it’s the economic warfare part of it. CTS was shorting the stock. They were security trolling. Everything has a bug right? Find a bug, short a stock. Profit.
What do you mean by "access"?
They're definitely useful, and I can cobble them together to get lots of otherwise tedious and complex parsing tasks done, but when I come back to them a week later I have no idea what the hell the pile of wingding vomit I wrote was supposed to do.

I find myself writing simpler ones and tying them together with app code just for sanity's sake.
Wouldn't change my feelings much because it doesn't do anything to address my current problems with the system. I would bet the same amount I pay in taxes that all it would do is increase the demand for money by agencies without any increase in accountability or thriftiness.
No, this is a first. It's the first time the US has publicly blamed Russia through official channels, as opposed to leaks to the press. The original alert was published by US-CERT:

https://www.us-cert.gov/ncas/alerts/TA18-074A

and has more interesting technical details.

It's true that both this and previously reports technically involved "anonymous officials in the DHS", in the sense that alert doesn't name any specific officials, but the phrase "anonymous officials" is usually associated with leaks, not official announcements...
I feel like we're playing a dangerous game, escalating towards war. We've interfered with each other's elections dating back to the cold war. I'm not saying it's moral, but we should maybe reexamine our own actions and what we're willing to sacrifice before asking for things [extraditions] for things we're also guilty of.
>>"The computer at Burlington Electric that was hacked was not attached to the grid.

Not exactly what you said, they hacked a utility computer but not one connected to the grid.

>> story sourced to anonymous officials in the DHS

This is Reuters so odds are that someone @DHS made that claim. Even if Reuters screwed up, DHS would probably call AP and deny the claim.

What should be said is that USA almost certainly does the same, and it makes sense to be able to shut down your adversary once "war" starts.
Fair enough, but I really think the benefits of advanced regular expressions are underappreciated in non-production and even non-application contexts. Laypeople (and occasionally even developers) are impressed when you show them how to search through a document or file system using a really complicated pattern, where it would have taken several iterations of data manipulation to achieve the same result without using advanced regular expressions.
People from Unit 8200 aren't too private about. They have a pretty good reputation for founding big, successful companies.

https://www.forbes.com/sites/richardbehar/2016/05/11/inside-...

https://en.wikipedia.org/wiki/Unit_8200#Companies_founded_by...
Airbus CIO: We dumped MS Office not over cost but b/c Google G suite looks sweet
From your source:

> "All exploits require the ability to run an executable as admin"

> "There is no immediate risk of exploitation of these vulnerabilities for most users."

> "These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features."

Sounds pretty pedestrian.
Julia lover here. I love having math at my fingertips and the ease of writing x’x\x’y. I like writing numerical code, knowing I can change types later and it will likely work. Still, I miss tab-tab from ipython for method completion from time to time and I work all day in mostly C++.
Thanks. I'm trying to not be HN typical and reach for hyperbole. I'll think on that.
And the US mens curling team won in Seoul, featuring 4 guys from Minnesota and 1 from Wisconsin. Although it's a small state, Minnesota is a powerhouse contributor to winter sports like curling and hockey for the US.
They YPG International communications page:
http://ypg-international.org/contact/
What does the software stack look like for these?
Russia cannot afford a war. It simply doesn't have the money or military to go against USA and Europe. And, no, China is not going to help them out
IMHO utilities need to realize that their business model of the future is to provide load balancing services and backup power to customers as much as it is to sell electricity. If they wait too long to start acting and keep fighting decentralized generation, they risk losing their value proposition as more people install batteries at home.

If that happens I could see them setting themselves up for a big political fight against their customers as they try to maintain their business by force/law.
> I run a threadripper on my home box that holds keys that need to stay private. Is there anything I can do to mitigate venerability or should I start a painful key rotation process and keep them only on my MBP until a patch is out?

Yep, you should consider them burned. Also make sure you stock up on tinfoil too as you’ll need to make sure the fresh replacement keys don’t get mind read from a distance.

</sarcasm>

In all seriousness, what part of this situation would lead you to think what you’re saying? There’s been good coverage of what it’d take to exploit these vulnerabilities, so I’m not sure what lead you to this line of reasoning.
Quick Heal Total Security 2017 Crack and Activation Key Free Download
You might want to look into Quick Base.[1] It is actually the little known elder statesman in this space and includes a lot of features Airtable doesn't currently support. Specific to this thread, one of them is Webhooks.[2] And while the product uses an autonumber for keys by default, you can change it and then import/update against your designated key.[3]

[1] https://www.quickbase.com

[2] https://help.quickbase.com/user-assistance/default.html#abou...

[3] https://help.quickbase.com/user-assistance/default.html#sett...
A programmer saying they are terrible at regex is like a mathematician saying they are terrible at algebra.
A totalitarian government blocking a service is a good sign they are unable to break its security and thus use it as a surveillance tool. It's a great advertisement for ProtonMail.
That's true, most people likely won't know what they're doing. But it's possible to spend some time, pick up something like The Intelligent Investor by Ben Graham, and invest a little yourself. Ordinary people can sometimes have investable insights that most players in the market are not aware of.
Any restrictions at the time of disclosure?
>There is no immediate risk of exploitation of these vulnerabilities for most users. Even if the full details were published today, attackers would need to invest significant development efforts to build attack tools that utilize these vulnerabilities. This level of effort is beyond the reach of most attackers...

ToB is right to say this, but it’s not at all uncommon for very serious security vulnerabilities to be “beyond the reach of most attackers.” Browse through Google Project Zero’s blog for examples.

> These types of vulnerabilities should not surprise any security researchers; similar flaws have been found in other embedded systems that have attempted to implement security features. They are the result of simple programming flaws, unclear security boundaries, and insufficient security testing.

Again, correct. However, that describes most serious security vulnerabilities. I’m a security researcher; at this point I’m nearly immune to astonishment about how bad simple programming errors can be. ToB is not insinuating the impact is small, they’re reminding the community that serious problems emerge from seemingly innocuous failures.

For example, I’ve actually witnessed a two-factor auth and password reset system utterly fail and compromise the login interface. A developer wrote “!= 404” instead of “== 200” for the status code handling logic. They forgot the 2fa microservice would return a “429” after five incorrect codes triggered the rate limiter. It was literally a one-line fix. Mistakes don’t get much simpler than that unless you make a typo or off by one error, but it still allowed every single user’s account to be arbitrarily compromised. These mistakes are extremely easy to make the lower down the stack you go.
A source emailed me his life’s work. Then, he ended his life

A pardon expert emailed me his life's work. Then he killed his two sons and himself.

I'm not from USA. I had no idea about this story. When I started reading the article, I started with a feeling of sadness. It always makes me sad to know that someone was facing a problem so great that only saw end their own life as the only solution

If I had started reading the second title, from USA Today, I would have started with the idea that it was the last moments of a monster. And a feeling of anger instead of sadness. It's unbelievable how titles, and photos, can mess with the way you'll face a story you're just beginning to read.
OSSC: a low-latency video digitizer and scan converter
His name is pretty Anglo Saxon, he had a solidly well off Canadian childhood and he has previously lived in Russia, France, and Austria.
That's why the $0 commission is such a key feature. They know people enjoy the emotional high of seeing the green numbers in their account when they open the app. This isn't a tool for high net-worth individuals, people that want "traditional" (Vanguard, Wealthfront, Schwab) wealth management investing with long-term planning, or advanced traders looking for Bloomberg terminal-esque features. This is designed to allow the average person to play with their money and see if they can "beat the market". It's like a fintech online casino. It's not gambling per se, but it definitely has a lot of psychological overlap with it for many of its users. With the addition of crypto trading, they've basically just opened up their new slot machines to the public.

I played with the Robinhood app before as well, but stopped using it after a couple weeks because it's just more of a novelty than a dedicated investment platform with all the features I want. I can see how some people that don't want all the complicated financial markets stuff would enjoy it though. If people think $0 trading is a short-cut to becoming a millionaire day trader though, they are in for a very bad time.
"how many black friends you have"

I feel like I'm mostly being reasonable in this discourse. However, on this point, fuck off.
This. interactive brokers provide the best user experience for most portfolios. Very useful app.