skysight-inc/HackerNews huggingface dataset:
It's not about the inconvenience for WireGuard's author in writing a modified protocol document, "simply" instantiating the protocol with new primitives (or parameters, or any changes at all) means throwing WireGuard away as far as all the end users are concerned. For the sort of hobbyist "Hey, I hacked this together in five minutes, awesome" types running Wireguard today in a trivial pair-wise configuration this is no trouble. For a system with fifty thousand ordinary users this is a complete nightmare, and I expect what they'll do is consider that a lesson learned, no more WireGuard.

But perhaps at least some of them will try to muddle along as others have described below, let's try both versions and see what works. Then we don't need a flag day... Whereupon of course they've got a downgrade problem.

Because TLS has been such an overwhelming success there have been a lot of problems.

Let's start with BEAST. BEAST attacks the way TLS 1.0 does IVs. Is that anything to do with "complicated handshaking" ? Nope, not related at all.

Soon after that there's Lucky 13. This attacks CBC modes with a timing-based padding oracle. Handshaking? Nope.

How about RC4 being broken - Handshake problem? Nope, the RC4 stream cipher is just not as good as intended.

CRIME was a compression oracle, still not handshaking.

Coppersmith's and ROCA, as well as the Debian hilarity show that even minting private keys might be too hard, at least in RSA, for people to do it correctly. Once again, not related to handshaking.

Now Logjam really does come down to the complicated handshake, although it does also need a client which is a total sucker.

Some? Yes. "Almost all" isn't correct. Lots of problems with cryptographic primitives and implementation bugs, maybe WireGuard will be popular enough to have so many implementations and to have such a large number of researchers trying to break it...
The explanation is counterintuitive and it's one of those many Swift-ish things I've learned to be wary of. I find that Swift tries to be 'all things' and to often I get lost trying to cobble together a mental picture of what a class is supposed to be given all the various ways to annotate it.
The story mentioned: https://news.ycombinator.com/item?id=17081684
You’re kidding. I can’t even imagine something like this happening in business.
Gatekeep? What's that supposed to mean? What am I gatekeeping?
What we've learned over the past year or two is that everything we all used to worry about NSA doing, Facebook is ACTUALLY doing.

I was also one of those misled, and now know the NSA has controls and a democratic governance structure atop them (as do the other four agencies in UK, Canada, NZ, Aus) that restrict what they do for lawful, democratically-endorsed uses only.

Surveillance capitalism at Facebook (good description here: https://www.schneier.com/blog/archives/2018/03/facebook_and_... ) is a bigger threat to democracies.
You can see in-progress games on the page.
Can you point to a Mozilla announcement that says they'll turn on DOH by default in a regular non-experimental non-nightly release?

This is what Mozilla says in their DOH blog:

Our second effort focuses on building a default configuration for DoH servers that puts privacy first.

We are running a shield study where some Nightly users will participate in one or more experiments to help us build out a secure, cloud-based service that handles DoH requests. All Nightly users will receive an in-product notification about these studies.

Cloudflare is our partner for these experiments. When a shield study is active, Nightly Firefox will automatically use Cloudflare’s secure DNS over HTTPS service (though we aren’t using the famous 1.1.1.1 address). The first study will test whether DoH’s performance is up to the task.
Wow! Is this criticism actually real!? Or is this a conspiracy video?

In the past I found John Oliver humorous but I've recently noticed his bias and how he conveniently ignores certain facts in order to make a joke.

I would add that the opposition may fear for their lives and may want to avoid appearing in public near Maduro supporters. MSM tries very hard to make Venezuela appear to be like Russia - a sham democracy.
Without giving away more details than you feel comfortable with, could you share more about what the developer was fired for and how it made that executive safe face?
That wouldn't stop legal threats. Per Core Secrets leak, NSA/FBI both pay for and force backdoors in U.S. companies' products. They also share that information with other enforcement organizations per other leaks. Cloudfare are in a position to monitor lots of network activity. I'd be quie surprised if they weren't already backdoored.

If NSA/FBI aren't in one's threat profile, one might also be concerned about a court order over something having to do with copyright or patents. Damages for those can be huge. There's both legal and technical firms dedicated to pouring through data for evidence of patent infringements. Many licensing "agreements" start with evidence they find. I don't know much more about this. My wild guess is that they often start with tips from disgruntled workers or maybe those leaving for competitors.

These are main, three threats I'd be concerned about if sharing what I did with a U.S.-based provider. Double true for me given I'm in the jurisdiction of the enforcement agencies.
> Fang stocks have generated enormous returns relative to the S&P 500 though.

And yet trivial compared to what MS, Oracle, AOL, Yahoo and Amazon generated in the 90s (or 80s as well in the case of MS). The best part of Facebook's growth went to founders and accredited investors such as Peter Thiel, not the public markets the wider public could invest in.

A five-bagger is nothing when you're cherry-picking winners.
This doesn't seem to be about default implementations on protocols, I guess they do actually do virtual dispatch so you wouldn't hit this bug with default impls. The main issue is that we have an extension method on a type with the same name of a member of that type. So it can always be statically flagged whether or not the method is used anywhere else. This is easily reproducible in any language that supports extension methods (C#, for instance). I wonder if that could be useful at all.
Quick note about secondary financings. Not targeted at you per-se as much as the large quantity of HN comments that seem to not understand the nuance.

You can't include primary and secondary financings in the same total, because you would be double-counting. That would be like measuring a public stock on its total volume traded, not its market cap.

For example:

- Investor A invests £100M into Uber for 1M shares

- Investor B buys those 1M shares from Investor A for $400M

- Investor C buys those 1M shares from Investor B for $500M

There has been "$1B in fundraising" but:
(a) only $100M went to Uber and;
(b) the market cap of those shares is $500M
I'm also interested in knowing these communities. My brother is transferring from storm conversion research to data science and statistics.
> a single application that has had 35 years to get its shit together simply won't work well?

It's because the people that like emacs don't like Windows. You would see why if you would try something else. If you want emacs to work well on Windows, do it yourself. Nobody owes you anything.
I think the benefit here is that the moves are public, so people can easily spectate ongoing games and review old ones. That is difficult to solve by email alone
That sounds like quite a bit of work, haha. I don't plan on going there myself. :)

I'm not sure if clients even have functionality to integrate? Most have an 'open in browser' option that I guess could work, but you'd still need a session with the AP provider. (And those APIs probably all differ too!)
Took liberties with our interpretation of a third party TOS so that we could utilize a product. I surfaced this to leadership when I realized we were not in compliance, but we kept the outcome of what we needed from it, although we did cease to use the tool. I chose less career friction over fighting further.
In my experience, mortgage originators rely on box-checking to get mortgages to pass. They make no decisions; it's an amoral, automatic process which happens to be much less efficient than it could be as the industry clings to the idea that homebuyers need to talk to someone on the phone and the people in seats are actually necessary.

Around 2013, WF Mortgage denied me a refinance on a property. It was my primary home (high-rise condo) when I bought it, then it became a rental. The reason for the denial was, my condo unit was in the same building as a hotel (downtown in a city), so it was labelled a "condotel". This was a shock to me. After researching condotels, I explained that the definition did not fit my property, but it didn't matter to WF. This was frustrating to me because WF originated the original mortgage when I purchase the property in 2007, and I never missed a payment. The refinance would lower my payment significantly due to lower interest and a large chunk of the principal that I paid down. They did not care at all. They all but told me to fuck off and stop calling them. It was like they wanted anti customer loyalty. I used Quicken Loans for the refinance--no problems.
I have literally never seen a consulting engagement where this wasn’t the case. I’m sure they exist, I just personally haven’t witnessed it.
CloudyNights/Astrobin for astrophotography
I also like that while The Orville is set in a post-scarcity society, the characters aren't the shining bastions of humanity as Star Trek characters tend to be. They're basically just doing their best, and have some very recognizable flaws.
It is amazing that you throw away working and functional Kindles around when other parts of the world having one of those is extremelly expensive. Kudos for "America", where everything (I mean everything) is disposable.
This is a classic warmup for an ensemble of actors in a play. We used to do it with our eyes closed as well.
The median US household has $12k/year in disposable income. That is income after all other taxes and living expenses -- housing, transportation, healthcare, food, clothing, etc -- are paid for. In other words, beer (or investment) money. You can build a real investment portfolio from that basis.

The assertion that Americans do not, on average, have money to invest is a false one.
I'm chronically ashamed by the degree of tolerance to shoddy work in our field.

If software engineers were held to the same standard as civil engineers, people would go to jail. I empathize humans make mistakes, but I've also known programmers who just don't care about striving toward perfect, bug-free code. In some cases it's just a job not a passion, in others they're overworked and learned it doesn't pay to go slowly and correctly.

Kudos to all of you true craftsmen out there who do take care and pride in the quality of your work.
True, foreclosures need to be initiated. What should a bank do about a mortgage thats 3 months delinquent? Should they just stop collecting?

If its possible that they can reasonably modify the loan to terms that make repayment feasible, they should as it's a win-win, not because they are contractually obligated to in any way. But if given what they know about the property and the borrower's income, there is no feasible way to mod the loan, prudence requires that they foreclose.

This "bug" mistakenly put people in the wrong category.
It was a feature set that was supposed to provide additional reporting views and expose data to customers when queried. Turns out one exec had some very embarrassing transactions that emerged from this and he wanted that info suppressed and the person who leaked it fired.

The feature worked as designed, and this exec was the one who pushed for it to go to market despite all warnings that a review of the depth of exposed data was needed first. Nothing was ever leaked, as I mentioned it worked exactly as we were instructed to build by the product managers and our engineering lead.

The outcome is the outcome scoped for.

Fwiw many engineers left after that moment. We were already at odds with leadership and when they showed their colors in that incident it resulted in nearly the entire engineering department bailing.

This never made it publicly, it was an internal product demo to the whole company leading up to launch. To my knowledge no customers or media outlet caught wind of the transactions or the internal coup that resulted.
Chess over JSON over HTTP :p

Next in your ChessOver episodes, try Chess over XML over TCP with XMPP Pubsub!
Also a good way to learn an editor like Vim or Emacs
Modern browser are basically OSes not by coincidence but because they are basically used as OS replacement. I think Tanenbaum (citation needed) wrote that an OS basically does two things: abstracting the HW and managing resources.
Browsers do the latter as much as an OS
I second that. Facts aren't binary. Just because we have a lot of data doesn't mean that we automatically are able to derive truth from it.

IMO any kind of system should be viewed through it's edge-cases & statistical outliers. It's where usually the truth gets questioned and often breaks down. Look at any system (social, political, etc) and the truth becomes unfortunately very fuzzy.

GEB has a lot of good points that should make one question the truth in every waking moment. If one were to attempt finding the truth (whether it's the ultimate theory of everything in physics, or why a person is the way they are in psychology) then you're always dealing with infinite complexity.

We're all Strange Loops
Basically lots of tracking of users and reselling that data in extremely detailed ways. Whatever the marketing team demands or you're fired, that kind of environment.
Does the trackpad response on one of these installs "feel like" a Macbook trackpad?
Colaboratory, a free cloud based Jupyter notebook environment requires no setup
You're saving on haircuts and shampoo.
It seems this is what you get when you decide dynamic dispatch is a demon that must be cast out. :/ It's a good example of Swift's at-times-infuriating insistence on chasing performance at the expense of developer ergonomics. That said, I'm sure it will be mediated eventually (although probably with more compiler annotations).
Which are almost zero home network of non technical users
Making the Move from Graphic Design to User Experience Design
Show HN: PJON v11.1 an independent, decentralized, open-source protocol
It's not a logical fallacy, though. There is just no evidence for it, and we understand intuitively how far-fetched it is. But it's certainly _possible_ that institutional bias explains those results. It just happens not to be the case.

If we're looking for a general logical fallacy, it might be something like, "Using the mere fact of theoretical possibility as a way to justify unlikely beliefs, or as a counter-argument to strong evidence." I'd love to know if there's a term for that. It comes up everywhere.
You're welcome! Honestly, I adapted almost instantly. When I first started the IF, it was harder the first few times (just your body getting used to it), then I was fine. I do get somewhat peckish, more so later on the Thu diet day, but I have strong will-power (indeed, I've yet to miss a week during the past 2.5+ years, but that's just due to discipline, not regimented: I think it'll be ok to miss some period of time, e.g. due to vacations or illness). Comparing to 500 calorie days to to zero-calorie days, the latter are definitely easier. My added rationale is that if starving weakened cells kills them (whether or not that is true, then so much the better. Overall, I am in excellent health, but I've lived a reasonably healthy lifestyle (exercise: walking mostly later years; nonsmoker; v. v. occasional social drinker; ...). :-) Ancillary benefit: reduced grocery bills! :-P
Nice try, FBI.
The IRS allows a 50 something cents per mile business expense deduction. And if you run some numbers that’s a pretty good ballpark for the cost of operating a car.
Almost all trains have unions. Unions will fight tooth and nail to keep their jobs
Fighting spam on freenode
Worked on an automated system to skim tips from crowdsourced 'contractors' without them realizing it was being done. Don't worry, legal says it wasn't technically against the law and the fine print of the contracts said we could do it.
Or can you say that it's inevitable due to population growth and inflation?
Technically, all the messages castling.club itself generates are all public, but the rest of the thread can be private depending on user settings.

One thing that's kind of cool: Each message and game detail page can also be requested as JSON using the Accept header. For messages, ActivityPub actually requires this. But for castling.club, these documents also include SAN and FEN for the chess moves and board states. And there's a JSON-LD vocabulary to describe it: https://castling.club/ns/chess/v0

That's a very technical advantage, I suppose. And how beneficial that is in practice (outside chess) remains to be seen. :)
Maybe the solution could be to keep them in both versions, digital one for reference and a physical one for learning and retention.

For the digital one, one can just copy and paste, use abbreviations, templates etc. so it doesn't take a lot of time.

Obviously the physical notes are only necessary in learning new and hard material. For example one might keep a notebook for C programming, Assembly, Basic Algorithms, Discrete Math etc.

I must admit that I've never tried to print my digital notes, which I keep in org-mode and export to pdf using tex. I guess that could also help for studying. You could take notes with hand, highlight things, put stickers on it etc.

I am planning to purchase a laser printer with refillable toners to print books, papers and my notes. I don't know why but having a physical copy of things help me learn them much easier. It could be that it is the only way I learned in school.

On a sidenote, during highschool I could only write essays with real pen and paper. But now I'm used to firing emacs and writing prose. Maybe I could also train myself to read textbooks on a computer efficiently.
I would argue the opposite. US backing of Japan has allowed them to maintain an insular chauvinism relative to their neighbors that has put them in weak diplomatic and economic position when faced with China. If they had instead become more tightly coupled with their neighbors like Korea and Taiwan, they’d be in a much better position to check the power of a rising China (think Germany within the context of the EU).

Of course this isn’t entirely Japan’s fault, as the US funded and backed right-wing nationalists in just about all of these countries, so they could play them off each other as was useful to their interests.
That and the fact that his last popular role was an animated poo, which probably made a return to Trek seem like a big step up.
http://lesswrong.com/ although I wonder if it's still considered niche.
>How did you get magit to not be slow as hell on Windows?

By using mercurial :-)

Had no idea magit is slow on Windows. Any idea why?
That actually sounds like a pretty reasonable amount, given that the borrowers likely had close to 0% equity in the homes they owned.
so? you think most Canadians cross the border to go to the doctor? pretty laughable
Which is false.
Why is that? Is it because of low pay?
What ethical issues? The pigs? We kill 300k every single day in the US...that's 3.5/second.
In my first job out of college i worked at a big consulting company on a project at a company that used interwoven teamsite cms.
Teamsite was a cms written in Perl, JavaScript, and Java with lots of xml sprinkled in. It was a horrible system.

I blogged about it on my personal blog. All the posts were about how to solve issues I had using it. This was before stack overflow.

After I had about 10 such posts I wrote a post titled "interwoven teamsite sucks" and linked all the other posts there.

I started noticing traffic to that post from specific ips accross the country.

A week later I was pulled into a meeting with the top see directors and told to remove my blog.
Interwoven was an Accenture client.

I removed it.
This is why the bugs are made non-exploitable by construction rather than by doing a bunch of work to show they're non-exploitable. There's an information asymmetry at work: the injector can craft all bugs in such a way as to ensure their non-exploitability, but the attacker has to laboriously prove the non-exploitability of each one.
I've done a lot of work involving scraping, data analysis and reversing private API access from mobile applications. A lot of this work is legally defensible (if you do it correctly) and not particularly unethical. After doing a bunch of this type of work I started to accrue subject matter expertise in the area that led other companies to come to me with more questionable projects in mind. I turned down many of these, but two projects stand out to me as unethical or borderline. In fact, this was the reason I eventually stopped working with these companies.

The first project was for a large, (now) well-known fintech company. They needed to develop login integrations with consumer banks to acquire customer account information for verification purposes. But many such banks didn't particularly want to grant them any special API access. More importantly, these banks typically forbid scraping and made it explicitly difficult by implementing JavaScript-based computational measures required on the client in order to successfully login. I helped this company develop methodologies for bypassing the anti-scraping measures on several banking websites. However, I stopped working on this because 1) I felt uncomfortable with the cavalier way they were ignoring banks' refusals, then using the reversed integrations and onboarded customers as a bargaining chip for more formal partnerships, and 2) performing huge amounts of analytics on customer data acquired as part of the account verification process.

The second project was for a tech startup working on insurance and credit analytics. This company is one of several that popped up in recent years to use machine learning and social data in order to develop a more "complete" credit score (in their eyes). They had an impressive team of machine learning researchers but their data acquisition team was comparatively mediocre. So I worked with them to improve their acquisition methodologies for a variety of social media websites. I stopped working with them for three reasons: 1) fundamentally, I lost faith that their product was actually generating a meaningful signal over traditional means, 2) I was worried that the data they were collecting might introduce spurious correlations or illegal biases, and 3) if any team was going to do this correctly, I didn't think this particular team was the qualified one to do it.
Because it's been a nagging question of mine...would you have any general guidance on where to find historical weather forecasts for a particular location? I'd like to look at how accurate the forecasts were n days out, but I'm not having any luck so far. I can grab historical actual temp data, buy I can't figure out what the weekly temp forecasts were 3 years ago today.
How does one even stockpile butter? You can't hold onto it indefinitely waiting for more favorable market conditions. The butter is either available or not. If not, the socialist government has screwed up.
Toilet plunger on head for easy narwhal/unicorn costume
I'm betting this will take the form of a clipshow where old Picard and Riker get drunk in a vineyard and remember the good old days.