skysight-inc/HackerNews huggingface dataset:
This is the worst reaction to a serious and interesting vulnerability I think I've ever seen on HN.

The problem being exploited today is that PGP isn't properly authenticated. PGP has an authenticator, but it's simply the SHA-1 of the plaintext appended to the message. Since even that SHA-1 was a later addition to the protocol, mainstream PGP implementations will process messages that lack the hash and decrypt the message. This is broken: a basic property of modern authenticated cryptography is not to present plaintext to the caller until integrity is checked. There are modern AEAD constructions that go through contortions to obtain that property.

The attack is trivial and obvious in retrospect. Attackers strip off the SHA-1 authenticator of a message and then flip bits in the ciphertext to inject HTML that, when rendered, exfiltrates plaintext.

The GPG project objects to the way this attack is characterized. If you strip the SHA-1 hash off a message, GPG will print a warning. But popular mainstream GPG clients don't honor that warning, which doesn't say "Stop, don't process this plaintext I am showing you", but rather "message was not integrity protected". The fact is, there isn't 1 cryptography engineer in 10 that knew exactly what GPG's behavior with a stripped MDC was or how they should check for it.

This is, to me, an almost perfect analog of the event where it was revealed that the curl API didn't check TLS certificates on CURL_SSL_VERIFYHOST=1, but that was OK because the man page said you should use CURL_SSL_VERIFYHOST=2 if you wanted checking. Sure, programming languages cast "true" to 1, and there was literally no meaningful distrinction between 0 and 1 in curl's design, and, sure, dozens of applications were made insecure by that design decision, but, really, it's in the man page, so they should have known better.

Is "don't render plaintext when an MDC isn't present in the message" in the GPG man page?

Other people object because this exploit depends on HTML email to function. It's a vulnerability with HTML email readers, not PGP! That's an even dumber objection. It is precisely analogous to the argument that BEAST and CRIME and Lucky13 weren't vulnerabilities in TLS, because, after all, they depended on browser HTTP behavior in order to function.

The right thing for GPG to have done was to not render plaintext at all if a valid MDC wasn't included in the message. To provide for compatibility and diagnostics in the vanishingly rare cases where it would be needed, they could have had a flag to restore the current insecure behavior. But, like curl, they did the opposite of the right thing, and now they're blaming downstream while implicitly doubling down on their own broken behavior. Not encouraging.

Finally: several people, including the GPG project apparently, are claiming that the researchers behind this work didn't reach out to them. But Werner Koch himself said that the researchers reached out on November 24th of last year.

This is a shitshow, but it's also probably going to be the best crypto attack of the year. Be careful dismissing it; I think that won't be a good look in the long run.
I can just as easily mount a weapon to my car and drive around killing people. How is this any different?
This might have the effect of gating news coverage by income and prevent lower-income people from being able to access news.
Why has it become so hard to convince people that they should care about others.
On top of all that, you also live in a world full of heavily armed and armoured impulsive brutes that will murder you and your entire family as soon as look at you. They may well have tried to do so pretty recently too.

Fortunately many of those people are foreigners or strangers, but they are out there, they want all of your stuff and it's only a matter of time before they come to get it. Or, you can team up with your family, friends and allies and go get their stuff off them first. Much of the time, these are pretty much your only viable options. Everything else that your community do - farming, crafting, trading - is largely geared towards supporting a defence/offence capability to keep hold of it all and stay alive.

Furthermore, staying alive when it gets real usually doesn't mean looking down a sight and pulling a lever, it generally means forcing a metal object vary hard and deep into someone else's body face to face. So you'd better gear yourself up to be ok with that, or at least become very good friends with a lot of other people who are.
Another Tesla catches fire on Swiss highway after crash
A Vintner’s Quest to Create a Truly American Wine
They already made the "Cheap Sucking Cash Grab..." back in 2015, and then its sequel in 2017. Next cash grab seems to be scheduled for 2019.
Yes, despite how good the Multicians website is, Bitsavers is the only way to use most of the software in the Multics distribution.

http://www.multicians.org/multics.html
Part 6 of Introduction to Aspose.CAD, an API to convert and export CAD files
First you're goddamned right I stalk all those shady people. And yes, I said something like, one of the management associates was charged with pimping out sex-trafficked women, I think maybe you should find a safer place to work.
Or, you know, SWF: https://aws.amazon.com/swf/
NordVPN sends data to Facebook
NordVPN on their website (https://nordvpn.com/blog/) states "How to stop Facebook from sharing your info with third-party apps" however their mobile app automatically connects via port 443 to edge-star-shv-01-lax3.facebook.com with an address of 31.13.70.1
Nowhere on their terms of service does it state they will share information to social media which kind of defeats the point of using a VPN.
https://ibb.co/f8NpbJ
In Austin, TX we've outlawed these kinds of bags. All grocery store bags are required by law to be sturdy enough to be reusable. This results in a few different things:

- Bags are heavy enough to not get blown away in the wind

- Half of the time, the bags are made of paper instead, meaning they're recyclable and (presumably) at least partially biodegradable

- The plastic bags that do exist are larger, robust enough to be brought with you to the store again and again, and at least at HEB they cost 25 cents, which discourages people from getting them unless they actually need them

Seeing things like this make me proud of my city.
A farmer can also feed people who are not in jail, an industrial prison complex cannot make people who are not in jail perform free labor. To the farmer/clothing producer the prisoners are equal to free people, to the stake holder of an industrial prison complex, they are not.
In a way that paywalls don't? I doubt it.
Our kitchen bin is the smallest in the house. We use the small sandwich bags that vegetables etc come in at the supermarket and dispose daily.
Monolithic ultrasound fingerprint sensor [pdf]
But they're not RTM's comments; they're clearly from someone analyzing the worm.
Unfortunately I don't remember the exact brand, but when I get home I'll at least tell you that. Theyre probably available online somehow but I get them from the local hardware store.
I'm fascinated by this outline.com. That's a pretty nice domain name...

Nice bit of mental gymnastics going on in the DMCA page and in their Terms of Service - you, the user, are considered to be the publisher of this material. That way their hands stay clean! How could they possibly know you're NOT the publisher of Bloomberg and the WSJ?

https://www.outline.com/dmca.html

"If someone else might own the copyright to it, don't submit it. Outline is for reading pages that:

you own the rights to,
is in the public domain,
constitutes fair use, or
you have consent of the copyright holder.

"

https://www.outline.com/terms.html

'“you” or “publisher” means the individual or entity using the Services'
> We have recycling programs

Not all cities in the US participate in recycling programs equally. The overall US plastic recycling rate is still only 31%. Many states (maybe most?) don't have a plastic bottle deposit program.
every single little thing that involves this company has to be front page finance news, it's so irritating. yesterday there was literally an article that said "Tesla model S rear ends truck" and if you click into the article, it didn't even involve autopilot....it was just a normal accident. imagine a headline that read "Toyota Camry rear ends truck!"

it's so fucking annoying.
The history of technology and the military in the US is more complex than the myopic "Military is Bad" style of arguments that have been vogue as of late. Preventing the US military from using that technology doesn't stop China or Russia from upgrading their systems to use it.
People have experimented with this and it's not very popular en masse.

A workable model might be something akin to a subscription service wherein you get 200 articles a month from WSJ/NYT/Bloomberg/Whoever for $10 and the revenue is distributed equitably after the provider cut.
9,984,535
Not a surprise. Sadly.

That said, what other unknowns might we find there from previous civilizations. __That__ could be surprising.
It could also buffer the ciphertext, doubling CPU time but meaning that message size is constrained by disk space rather than available RAM.
Yeah, I considered that, managers there are always trying to hire women they want to fuck and have heard anecdotes of interns who think using sex will get them a full time position. This was not that case.
> Interesting it survived this long.

Not just interesting but discouraging, in my opinion. This unconstitutional rule affected billions of dollars of commerce for a quarter century. The legislators who passed it and the president who signed it (G.H.W. Bush) face no repercussions, so there's no disincentive for future law-makers to do similar things in the future.

I'm not sure I'd support something so extreme as having court review of unchallenged law, but it makes me consider it...
Analogue signal and image processing with large memristor crossbars [pdf]
Ive followed Q pretty closely for the last few months. How are we determining falsehood when most of what Q does is ask questions and insinuate things that are (by his own admission) to come true in the future “FUTURE PROVES PAST”?

Are there examples of blatant falsehood you can point me too? I am fascinated by this and would love to read any good analysis you’ve found. I’ve found so much written about it to be lacking in specificity and original sources.
If you're in AWS, SWF and StepFunctions are great for starting and monitoring task completion / failure for long running processes, either interconnected or single.

You can write your own code to long poll in either and do work as it's needed, but with StepFunctions you can wrap lambdas to give a little more visibility and error handling.
We do not allow any clothes or items with a character in our house. So no shirts, no undies, no dolls, no toys. Most toys are more neutral, stuff like meliss & doug wood blocks.

Not surprisingly, non-character stuff tends to be way better quality.

We do have a few items from gifts over the years. Our 2 year old calls a gifted Minnie Mouse doll "Elmo". Makes me proud.
"pv" is a favourite of mine for single command progress indicators
Raymond Hettinger Lecture Notes on Pycon 2018 [pdf]
As a Conversion Rate Optimization consultant I couldn't agree more. We have specific domain expertise and our clients need us infrequently. We also have a large library of wins and can quickly help them get into the high performance zone (and dramatically increase revenue) without them directly incurring the time and expense--A/B testing is expensive from a media buying perspective. But we eventually hit diminishing returns and at that time it is best to end the engagement and move on. If you are curious, here's a case study:

https://moz.com/blog/cro-case-study
Show HN: Amazon is littered with fake reviews, see through them – Freshdill.com
Training a Speaker Embedding from Scratch with Triplet Learning
Sorting the strings by length, or lexicographical? Length sort wouldn't work for the prefix-oriented nature of the comparisons. Lexicographical sorting and a binary search involves pointer chasing, and doesn't provide any way to fast-path the negative match lookup.

If I'm getting called a trillion times on a hot-path, but only a million of those times I'm receiving a module name (search string) I'm interested in, then it behooves me to have the fastest negative match logic possible.

As it stands, the final assembly version can negative match in about 6 cycles, prefix match in about 14 cycles, and worst-case false-positive negative match (where three strings need to be compared, but there is no match) in 21 cycles. The CPI for the final routine is reported as around 0.266, which is pretty close to the optimal of 0.25.

I think you'd struggle to meet that performance with anything that relies on pointer chasing. I do comment on the likelihood of a log(n)-based algorithm overtaking performance when the data set is large enough here: http://trent.me/is-prefix-of-string-in-table/#other-applicat...

This particular use case wasn't intended for prefix matching against large data sets though, and thus, wasn't optimized for that.
Reusable grocery bags and tell the cashier you don't need bags when you're only buying a few things (just carry them out). Cashiers always default to putting even one item in a bag but just need some prompting to not do so. My wife goes so far as to take things out of the plastic bags and leave them for the odd occasion that the items end up there during checkout. Small trash cans usually don't need to be emptied every week, unless they contain organic matter. And when small cans do need to be emptied, you can often dump them into your larger weekly trash bags.
The review quality on Amazon has gone down significantly over the last few years, especially in the electronics category. I needed a way to search for products that allowed me to quickly identify real vs fake products. I couldn't find anyone providing this search service so I built it myself. Any and all Feedback would be appreciated.
Thanks for the explanation, TIL :)
Curious if GPU is suitable for similar tasks? Any successful GPU based json or http parser.
Just a word of warning. I signed up and their signup process requires you to link your card or bank account with stripe. And then the nightmare starts when you want to have access to the account at stripe. Stripe says you need to contact moonlight, moonlight says you need to contact stripe. I asked both of them to cancel my account. Moonlight replied that they cancelled it but stripe says they still have it and I can't get it cancelled. So yeah once you sign up your payment account is at the will of moonlight website.

Reminds me of that friends episode when Chandler tries to quit the gym LOL.
The idea that women are cyclical cuckolders bites the dust
Yeah... consultants really do bring a lot of value for things that are complex, infrequently performed step functions. Of which there are a lot within a company.

But ultimately, when you’re talking complex software implementation, you need folks who understand both the business context and the tech context at a deep level. Those people tend to be consultants, either working independently or employed by a major firm (or more often recently, working independently and brought in by a major firm).

The job you’re often doing here is switching between multiple business (HR, finance, IT, etc) and technology (application, network, cloud, service, etc) layers. You really DO need MBAs, about half of whom are former engineers with 5+ years of experience. This is complex work that takes nuance and soft skills. If companies could do it themselves, they wouldn’t hire us to come fix their broken Workday/Salesforce/whatever implementations.

There are a ton of us too. My MBA program 7 years ago was teaching modern ML/AI (with profs from the school’s top-ranked CS dept) and DevOps. The MBA has become far more tech focused than it was in the past; I would expect modern coursework to include some intro to cryptography if not cryptocurrency.
The problem is that a lot of what happens in American prisons really is absurd, Kafkaesque, sadism apparently for its own sake, and yet this hasn't actually led to the reductio. When we know that other approaches are better for society in that they lead to less recidivism, and are also less painful for the criminals, and yet continue to push in the opposite direction, it's reasonable to ask if there are any limits to our appetite for inflicting pain. If we can't even ask, then imo that is what prevents the meaningful discussion.
li-ion battery lifespans are generally calculated in power cycles. They don't really age with years...

Generally, power cells have about 300-500 power cycles until there is a significant drop in performance. This is one of the major faults of EV that is often quoted, as some parts of the batteries aren't recycled. So, you're essentially trading the co2 pollution to toxic waste.

maybe you should check the facts before you spout nonsense yourself?
Thanks, I didn't know that existed! I might have to cut a corner off my Unix guru card :)
You can read more about the release in the latest blogpost that breaks down some of the major additions to the server:
https://blog.heroiclabs.com/nakama-2-0-scale-for-millions-of...

Disclosure: I work at Heroic Labs.
I agree.

You can't blame the news though. If the news headline was "Toyota Camry rear ends truck" you would not have clicked on it :)
Agreed about how useful paper can be.

I’ve settled on a hybrid approach: I take my notes long-hand, but each morning the first thing I do is type them all up into an Org mode file. This gives me the best of all worlds: the tactile benefits of paper & the long-term search & archival benefits of electronic records.
But wouldn't it be a breach of contract and not a tort? There may be other torts involved, but I was only considering the issue you brought up with breaking their contract terms.
Ids are getting much harder to fake with REAL ID requirements, and a lot of jurisdictions are very tough on bars that serve to minors even if they had a fake id.

An easy way to deter fake ids that was pretty common even a decade ago was to have off duty cops checking ids, so that being discovered can result in jail time instead of just getting kicked out.

They even have apps now that can detect most fake ids.
You mean:

gzip < source | pv > target.gz
A vital guide to the Canadian encryption debate
It might be worth a small increase in CO2 emissions to reduce plastic pollution TBH. We have other ways to offset those extra CO2 emissions, plenty of waste to cut. But once plastic and particularly microplastic pollution is in water and the food chain it's going to be nigh impossible to remove it.
We spent a long time shopping around (ETL tools, Airflow, Luigi, etc.) And eventually found Argo. We are in the process of migrating our home-rolled scientific JS based workflows. https://github.com/argoproj/argo
Siri listens for a hotword, which is tremendously easier than running general speech detection models all the time.
Their assembly implementation can be improved, at least when targeting modern hardware.

Here’s an article explaining how to use new instructions to implement large integers multiplication: http://www.intel.com/content/dam/www/public/us/en/documents/...
Thanks! Joe Walnes should get credit for the underlying HTML and CSS and site design and whatnot... I lovingly pilfered[1] his websocketd[2] site a while back for PyParallel[3] and liked it so much I decided it to use it for this personal site as well.

[1]: https://twitter.com/joewalnes/status/567495778349113345
[2]: http://websocketd.com/
[3]: http://pyparallel.org/
Indeed - but I do not think it's related to the question. The question here is: how do I - as a developer - implement a workflow? Still there are numerous BPM solutions, but often overly sophisticated. You have AWS SWF, but complicated to use, Airflow but in Python only, your own implementation using queues, database, etc... Look at the diversity of answers: there is no obvious answer right now.
This inspired me to write a haiku:

Maybe life's purpose
is to trash its home planet
then get the fuck out
Process modeling requires some reading up front, I think. Integration into our application was relatively easy - activities implemented as Java classes with a reasonably good API.

As for results, we are quite happy with camunda. No issues with performance, incident handling, etc. We have about 100k new process instances/day, with 5-10 steps per process (3 different processes), some of which run over multiple days.
The heart of TFA:

Holden, however, reveals documents that indicate on one occasion he risked leaking information of such potential magnitude that the FBI might well have taken drastic action against him had he been discovered. Certainly, it imperilled the cooperative relationship between the two nations regarding weapons research – by revealing that the cooperation was, in fact, only going one way.

The researcher details a 1944 meeting at Berkeley, California, between Oliphant, Nobel laureate Ernest Lawrence and the military man in charge of the Manhattan Project, General Leslie Groves. At the fiery meeting, Groves – usually a very discreet operator – let it slip that there were some parts of the research that were not being shared with the British.

An imminent visit to Washington DC by one of Winston Churchill’s closest advisors, Lord Cherwell, was to be an exercise in misdirection. Further, Groves revealed, after the end of World War II the US intended to ensure that nuclear weapons manufacture and the storage of nuclear material would happen only in the central portions of North America.

Secretly appalled by this, Oliphant – Holden plausibly suggests – stopped work almost immediately and then travelled, perhaps for three days on a train, to the British embassy in Washington DC, and there sent a confidential memo to the British authorities, blowing the whistle on the US intentions.

Was putting nuclear weapons manufacture and storage in the central parts of the US part of keeping the technology secret?
There are as many kinds of nulls as programming languages. Cixl [0] doesn't derive null from every other type, instead Nil and all other types derive Opt; which means that user code may specify Opt to accept nulls or any other type to have nulls automatically trapped.

[0] https://github.com/basic-gongfu/cixl#optionals
We approved what these apps did for our benefit originally. Now we got caught and will unapprove them for no stated reason because it might be embarrassing.
This isn't such a case. The court is not basing its opinion on immediate outcomes. This isn't like them declaring something constitutionally protected so that people can begin doing it the next day. This is them saying that governments are able to regulate, but only via means dictated by the court. This isn't about returning power to the people. This is about shifting power between various branches of government. Some of those branches are more hamstrung than others. By moving power to a branch that is unable to use it (ie a legislature chronically unable to pass laws) the court asserts its own power as kingmaker.
Colly 1.0 release
Well, defunct is a little harsh since its succesor Pure really is quite similar: https://agraef.github.io/pure-lang/
I had previously written precisely about this idea:

https://outlookzen.com/2016/06/18/we-need-cruel-and-unusual-...

Let's just say it wasn't well received. Few people presented any logical arguments against the proposal, but the majority found it "unpalatable".
>Spinning an obviously false narrative that somehow still ropes in more and more people.

Literally posts things that happen VERBATIM days later. "obviously false narrative"? Hardly.

https://i.imgur.com/mEb9p0Q.jpg