skysight-inc/HackerNews huggingface dataset:
My entire, multi-year record of personal and financial information has been leaked and stolen at least 3 times, most recently from Equifax. In addition, certain of my passwords and financial and personal details were leaked at least a dozen times that I know about by various stores, restaurants, apps, and online forums.

The consequences to me, personally? Not much. I haven't been blackmailed, I haven't been impersonated, jailed, or driven to suicide.

And in this, I am not unique, not unusual. Probably at least half of the adult US population has had all their information leaked just like mine was. The overwhelming majority of them suffered few to no consequences.
> I'm not sure what's risky, expensive or time consuming about that.

"replying to their email"

https://jacquesmattheij.com/so-your-start-up-receive-the-nig...
“not necessarily anything substantive but a sign that you're in the club.”

That’s most of what this stuff is, you hit the nail on the head. Normal people don’t talk or write in ‘patentese.’ Some of it is just an optimal way to be extremely precise in written English, but a bunch of it is just accumulated cultural nonsense. Good point.
What are some common exit strategies in the industry? It seems like early startup options for employees are more of a lottery ticket than retirement plan.
Not a 'good idea', but it's partly because the same password is used for telephone banking. And people seem to have trouble with typing long passwords on numerical keypads.
Truckers need $750k of liability insurance (but usually have $1M). For individual drivers, they are required to have liability, but it varies by state (and in some places a lot of people flaunt the law).
You're assuming they'd be using that to filter people out, but they could simply target ads emphasizing different aspects of the company to different age groups. 'Great kegerator!' for twenty-somethings and 'Great 401k match and relocation packages!' for older groups, or something along those lines.
>There was absolutely nothing wrong with the cookie law.

Really? The cookie law, however well-intentioned, could never have been useful. The simplest reason for this is that you can never know if a site is not complying with the cookie law or simply doesn't set cookies. The only way to be certain of this was to use the already existing browser mechanisms for dealing with cookies. In other words, the cookie law would never have done anything even if companies handled it exactly as intended.

Implementing the cookie law costs money and time. It costs developer money and time, and it costs the time of consumers, because some developers are always going to get it wrong simply by virtue of not knowing everything about the law or how to handle it. They will hear about it from third parties and not know how to handle it and simply follow the first steps that tells them how to handle it.

The way the cookie law went should have been expected. It shouldn't have been a surprise to anyone that it didn't do anything and it simply wasted people's time and money.

>This law doesn't 'actually suck', but it can be made to 'actually suck' and then we all lose something of value.

Then we're pretty much guaranteed to all lose something of value. In IT you should expect things to go wrong and for people to abuse the system. Because inevitably that's going to happen.
Would you kindly elaborate on which part of that link is relevant to this kind of letter? The PDF there only relates to what a citizen can do when you don't answer the letter.

How does that make the letter irrelevant? Responding to the letter rather seems to be the first countermeasure against the authorities' involvement...
You're declaring voluntary and involuntary segregation to be the same. I can read Black Enterprise or the WSJ. I can't read something deliberately hidden from me.
Would this affect certificate-validating clients doing DNS-over-HTTPS to 1.1.1.1 — doesn’t it have an ipAddress certificate and demand HTTPS resolution only?
You've missed the boat. It'd be akin to White Enterprise magazine checking the race of buyers before a purchase can be made or the ad being seen. That's obviously unlawful.

The question is whether FB is immune from the CDA (depends
Cryptocurrency in Croatia
Annotation tool to understand links between disease, mutant RNA
The author claims to have written an implementation of it themselves.

From the article:

> This last one is my implementation of Google’s new hash table. Google hasn’t open-sourced their hash table yet, so I had to implement their hash table myself. I’m 95% sure that I got their performance right.
Remembering AOL’s FDO91 Programming Language (2012)
Why I Removed UN from Wikipedia Page IT Risk
At https://en.wikipedia.org/w/index.php?title=IT_risk&diff=prev&oldid=843491234 they, the UN demonstrate they just don't care by forgetting their own stuff.
Since code audits are mostly conducted as an art rather than science with rigorous methodologies, I assume most vulnerabilities locations are just derived from experience and "poking around" work.

If you look at public penetration testing reports [3] seeing there mostly is no section about methodology, it's reasonable to assume that there are rather no true common standards or bodies of knowledge to find security vulnerabilities.

For some application security fields like web application security there are at least some semi-rigorous catalogs [1,2] which can help you to conduct more comprehensive code audits or security tests/audits.

As already mentioned there are already tools which can help you to conduct more professional and thorough code audits through static security source code analyzers or dynamic analysis tools (e. g. valgrind for memory related bugs or afl as an fuzzing tool example). These tools are focusing on implementation bugs, design weaknesses still have to be evaluated manually.

In my opinion the discipline of software security assessments hasn't grown up yet, but there is definitely research going on to improve the situation, e. g. [4] for a research example on finding bugs statically.

[1] OWASP Testing Guide v4: https://www.owasp.org/index.php/OWASP_Testing_Project

[2] OWASP Application Security Verification Standard (ASVS): https://www.owasp.org/index.php/Category:OWASP_Application_S...

[3] https://github.com/juliocesarfort/public-pentesting-reports

[4] Modeling and Discovering Vulnerabilities
with Code Property Graphs: https://www.sec.cs.tu-bs.de/pubs/2014-ieeesp.pdf
Dear Toyota
There are plenty of older college students. There were lots of grey hairs in my night classes.
Not everything that looks encrypted, is encrypted
Ask HN: I get 10% for each client i aquire
What is a good way to aquire clients as ux developer for the company i work for?
Come to Google. At least here in our Waterloo, Ontario office we have plenty of very smart and capable engineers continuing to write code and be respected for it well into our graying years.

I myself am surprised how fast I went from 'youngest guy on the team' to 'oldest coder on the team'. But it hasn't been a liability here.
In the sense that if you are "on Fb" you're old by definition I guess.
I think it’s more common to crack the passwords offline from a breach. Enough people reuse passwords that you can then directly try a persons password on multiple sites, without the need to guess.

I think I’ve had this happen to a few old accounts of mine that reused a simple password that had been leaked. (Of course I can’t really verify how the hackers did it, but it seems likely to me)
I moved to NameSilo as well few years ago.
For an hour or two, usually. Then it goes away. When it is possible to edit the title, you will see an |edit| link under your submission.
Thanks! Not a complete rewrite, but definitely a refactor of all the logic for playing audio and syncing audio between users (and some UI changes). I would also need to do a dive into each platform's API specifics and make sure they give permissions to pause, search, seek, and play.
It seems like these guys added lighting to the visualization of CT volumes and decided to call it "Cinematic Rendering" or "CR" for short.

I'm not sure what possessed these people to take 40 year old techniques and decide that they could come up with a hyperbolic name and a new acronym then not have everyone just roll their eyes.
Adding bash auto-completion to scripts
Wait what? What did you just do? Did you just claim that most people above 40 are argumentative anti progress coders? Or did you claim that most people who are claiming age based discrimination are such? Either way, how can you back these statements?
No. Its paywalled. But I work on making Emulation systems for a living. So, I know this for a fact.
The article in question: https://news.ycombinator.com/item?id=12383012

It's fun to think about, but the presentation played fast and loose with a few concepts. Sparked some lively discussion because of that. I really like the idea of needing to count random memory accesses as costing more than sequential accesses when analyzing algorithms in a big-O-type notation.
Companies need to apply the same judgment as they do for basically anything else related to running a business. How much do I need to do to comply with this regulation? How do I respond to that?

I mean, it's not like businesses worry too much about people's livelihoods when they lay them off. It's just a business decision and the laid off person needs to deal with the realities of the situation. Now, business owners need to do the same when it comes to the GDPR decision.
Become an expert on the Cobol/PL1 of 2050, maybe?
Employee Video Birthday Greeting Cards
>>I think the cost of not having this law is much higher.

The solution severely confines the space of operation, by straightjacketing web service provisioning to a narrowly defined set of procedures, and thus I think it's unlikely to be less costly than the problem it seeks to solve.

Creativity does not flow from this kind of central planning. I believe the blind spot that GDPR advocates have is that they don't fully grasp the scope of what they don't know and what has not yet been discovered, and thus they don't fully account for the cost of laws that inhibit the innovative processes that lead to discovering new ways of providing goods/services.

The responsible way of addressing privacy concerns, that would have been far less likely to undermine liberty and have other negative unintended consequences, would have been to develop user friendly anonymous browsing technology, like Tor-enabled browsers.
Ask HN: Why does everything break immediately when starting a new language?
Many years ago, when I started python, nothing would compile or install. It took many hours to get used to the virtual environment, different versions of python (2 and 3), and then the libraries to get hello world working reliably.

When I first started ruby, the rvm on the machine had not been updated. Got everything up and running, and then a new update in rails broke the hello world example.

When I started VueJS, npm simply would not install everything I needed. It kept telling me it was broken. I finally realized that it was running a slightly older version of nodejs and that changed everything.

Why does it take so many hours just to get the first basic hello world up?

Sure, after you've played with it, you know exactly what happened so well that you ignore the issue.

Its not the bother of learning it, it just seems something is fundamentally wrong with development if our tools are like this.
I love this app!

My only problem is that it’s too fun — I have a hard time using it at work because I get too engaged chatting, saving great tracks and adding my own to a channel.

Next I plan to use this at the gym to keep myself and a few friends workout playlist in sync.
I'm late to this party, but I agree. We hired someone who was explicitly a "Kubernetes" expert, because we were investigating Kubernetes.

What we discovered is that this meant they understood kubectl pretty well, and could write the yaml files. He didn't understand anything under the hood, so we had to re-discover everything.

And, ultimately, if you want to get a feel for how complex k8s really is, try and use their documentation beyond the very basics. It's contradictory, incomplete, and behind by a version of two sometimes. It was fun building a set of automated interactions with kubectl and its cousins from the web documentation, only to find it doesn't work because the actual binaries expect different arguments.

Or the API libraries if you're feeling particularly brave: a set of these horribly complex, dynamically generated files. Oh, some of them will be alpha, others beta, others beta2, etc. The version depends on the function you're using. Have fun!
Did you catch some of the comments yesterday (in the thread about Intel and age discrimination) poo-pooing the relevance of experience in software engineering? There is your answer, right there.
Agreed, sounds like expert witness work. And if at an IPR trial, it may seem a lot like examination and it’s at the PTO, could see the confusion.
I guess it would the founder path, consultancy, moving to a bigger company, moving to a company where seniors are valued... and of course focus on maintenance for deep pockets.
Note that Pai worked for a couple of years at VZN, as a relatively junior person just a few years after graduating law school. He then spent a decade in the public sector, before becoming a partner at a law firm.

Which raises the other issue: many regulators go work at law firms, who benefit from more regulation, not less. Those positions are generally also more lucrative than positions in the regulated companies themselves. So there is good reason to believe that the incentives are aligned toward overregulation, not underregulation.
A while back, I started tracking some basic notes about my behavior and wellbeing. Mostly I just covered very basic notes on how I'd slept, what/when I'd eaten, what else I'd consumed (i.e. caffeine, theanine, vitamin D, alcohol), and whether/how I'd exercised - plus how I felt at the time.

The results were really interesting, and having that subjective value matched with objective context was great for predicting "how will I feel if I do X, Y, and Z today?" I'm sure I was still losing important data by not seeing multi-day effects, gut biome status, or a million other things. But the predictive power was fairly high, and I'm convinced it was better than nothing.

I stopped eventually though - because as you say, the tools available are just too clunky for tracking anything other than diet and exercise.
Is the BGP hijack over?
Containerization should have fixed the loading/unloading times decades ago. It should only take a few minutes to pick a container up off a railcar and hitch it up to a truck to be driven the last few miles to a store.
Thanks for the feedback! Fulfillment - I plan on just manually ordering coffee to people once per week. If it gets to be too much work that'd be a great problem to have :)

I do ship internationally, and if for some reason I can't I would send a gift card instead.
Good point, I think it’s really on the honor system with the threat of invalidating a patent in some later litigation.
From http://judy.sourceforge.net/doc/10minutes.htm :

> From a speed point of view Judy is chiefly a 256-ary digital tree or trie (per D. Knuth Volume 3 definitions). A degree of 256-ary is a somewhat "magic" N-ary for a variety of reasons -- but mostly because a byte (the least addressable memory unit) is 8 bits. Also a higher degree means reduced cache-line fills per access. You see the theme here -- avoid cache-line fills like the plague.

Sounds like a neat data-structure made with cache behaviour in mind. I'm not getting much out of the creator's attempts to explain it, but there's a Wikipedia article: https://en.wikipedia.org/wiki/Judy_array
If all they do is hope, then they might be screwed.

If you tally the score today, I think it's a win. A few companies may have folded, but a billion or two users have gained a little more insight and control over how data about them is used. But like I said, it's too early to be very confident about this.
Facebook doesn't collect explicit race information, it's inferred from user behaviour. You can choose to do the sorts of things on Facebook that black people do, then advertisers will think you are black. Just like you can choose to read Black Enterprise, and advertisers will think you are black.
Oh hey, thanks!!
For more Irish cred, one can of course include an apostrophe as well as the other means mentioned elsewhere in this discussion. Verilog is quite useful in this regard, because of the way that one writes hexadecimal constants.

John 003'hdeadface Smith. Known as "six" to his friends.
I'll deal with that when it happens. If I'm going to run my business based on everything that could happen with 0.001% probability then I would not get anything done at all.
Has the hijacker previously hijacked other prefixes in the past, or is this a one-time event for them?
It is the same in the US. All trucks that transport across state lines has to have an electronic log. Tickets issued to the driver can be noted on the saftey record of the company and if there are enough violations, especially of certain types, the companies authority to transport can be revoked.
Dreamhost has this since forever for free, along with many others, why is this even a HN post, seems more like a late-arrived commercial ads to me.
ICO: good practise
Just to save other users some time, it seems like sinopia is no longer maintained, and doesn't work on Node 8

https://github.com/rlidwka/sinopia/issues/456

Verdaccio, mentioned in a sibling comment seems to be the recommended replacement ...

https://github.com/verdaccio/verdaccio
Well, if you control the host behind the IP, you could have any CA issue a challenge, and successfully pass it (e.g. if Let's encrypt uses the erroneous routes).

So no. The only thing protecting you would be to have the expected hash of the certificate you expect to see (TOFU - Trust on First use, though you're screwed if you didn't contact 1.1.1.1 before the incident!).
Wait, choline as a cause of feeling depressed? This one is totally news to me, can you point me to any more info?
Ireland is an entirely different matter: it’s hard to find people on LinkedIn for example, since many of them are only in Ireland due to being hired by corpos with huge offices over there.

That’s not the case for London as people don’t generally move to London purely for a better salary as companies don’t get a tax discount over there.
> it's disabled by default

Fair enough, but it wasn’t always like that.

> “Vote for your favourite packages automatically". It's voting, not spying

That’s just playing with words. What it does is exactly the same: provide the upstream author statistics about what is being used and not.

Surely you can’t mean that this is a serious argument.
That is shockingly low. My normal car insurance without any extra add-ons covers up to £20 million($26 million) in 3rd party damage, and I believe EU mandates that every car insurance, no matter how cheap, has to provide at least 5 million euro cover. So even the most basic, 3rd-party-only, shit car insurance has to cover you for up to 5 million euro, by law.
>I think the ridiculous thing is every mom and pop site and blog and website needs to be gdpr compliant? insane.

The even more ridiculous thing in my opinion is that these mom and pop sites are not already GDPR compliant. What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?
> He is currently doing good work, but he still leaves a lot to be desired as a humanitarian, it's more self serving than it should be, but than again, Gates just wants to let us all know that it's his world and we are just living in it.

I can rarely discern my own motives for an action with any great certainty, impressive that you're so accurately able to assess his.
Most radiologists don't seem interested. I don't know if it is due to work flow, being used to thousands of sliced orthogonal CT readings or both, but the idea alone doesn't seem to get anyone excited.

Also on the workflow aspect I think no one wants to wait for something that takes longer to generate, longer to load, and possibly can't be shared as easily through epic or some other software.
Meh. I'm way past that unfortunately. ¯\_(ツ)_/¯
I would say there is a different expectation of privacy. When I am executing arguments on my command line, I am not expecting it to get collected and sent anywhere.

Does it happen in other apps? Sure. But I would not expect my command-line builds are phoning home what exactly I am doing.
> Trying to make exceptions for that .01% of the time a "gray area" can exist, while ignoring the real harm to society caused by the 99.99% "deliberate misinformation".

The .01% is enough of a basis for a lawsuit. And grandstanding by the right claiming the company is biased (never mind that almost all "misinformation" is right leaning, so it's likely the .01% false positives are also likely right leaning). I would absolutely not want to be taking on such risks from a business perspective. If it's societal good we're aiming for, let society (elected officials) figure out how best to achieve that. Do you really trust for-profit organizations to not have their "editors" swayed by customers?
First mistake? PC Financial.
If you can do it without the surgery, do. Think of back surgery as a temporary partial fix with a high failure rate. Best avoided until you have literally exhausted other options.
Cracking MaGuS’s Fate Zero Encryption (2012)
I found this an interesting and useful tutorial, but I observe - so many submissions, so little discussion. Why no love from the HN crowd? It's a mystery ...

https://news.ycombinator.com/item?id=17127410

https://news.ycombinator.com/item?id=17103976

https://news.ycombinator.com/item?id=17073966

https://news.ycombinator.com/item?id=17052732

https://news.ycombinator.com/item?id=17040160

https://news.ycombinator.com/item?id=16930893

https://news.ycombinator.com/item?id=16876216

https://news.ycombinator.com/item?id=16802800

https://news.ycombinator.com/item?id=16727972

https://news.ycombinator.com/item?id=16727227

https://news.ycombinator.com/item?id=16715032

https://news.ycombinator.com/item?id=16656841

https://news.ycombinator.com/item?id=16535189

https://news.ycombinator.com/item?id=16508524

https://news.ycombinator.com/item?id=16499361
Everything about the facebook falls apart really.
Not in the places where top tech companies are willing to go to.
Hello, author here. The app is still taking shape, but hopefully the gist is clear enough.

Podcast apps are typically organized around subscribing to shows, but I wanted something where I could focus in on particular topics. For example, I listened to most of the "PWA" episodes while working on this prototype.

edit: typo
It’s like someone posting a “Turn left for Highway 123” road sign right next to a legitimate “Turn right for Highway 123” sign. Traffic snarls result, since most drivers don’t check the DOT security sticker on the back of both signs and find it missing from the fake Left one.
does the threat model require anything more? i haven't really been exposed to consoles since i was a kid, but i don't get the impression that end users do anything terribly sensitive on them. i thought that whatever security existed was mainly intended to combat piracy. if the majority of the risk falls on sony, i don't really care how well they secure the device.
> What could they possibly be doing that makes not abusing a handful of user's privacy an insurmountable issue?

Nothing. Doesn't mean they have nothing better to do than respond to letters and regulatory enquiries. (To be clear, I'm not disparaging regulators asking questions. I'm simply observing that such questioning-and-answering has a cost. That cost is reasonable for a large company. It may not balance favorably for something smaller.)
That's not correct, anyone could 'accidentally' do this to every other provider. It's not a special weakness of cloudflare.