skysight-inc/HackerNews huggingface dataset:
You just do the best you can. Totally secure is a myth. As a smaller company, however, you have an advantage that your footprint is much smaller and easier to reason about. The larger you become, the more software you have to run, the more you have to manage, the more lucrative an attack on your systems will be for the attackers.

That's why in security we don't play the blame game when someone gets hacked. We know it could happen to any of us, might already have happened, and we're all doing the best we can with the resources we have.
Firewalls Don't Stop Dragons
This has been happening for years, especially in the "botnet community". Either someone takes down someone else's botnet through the same bug and patches it or figures out a bug in the botnet and caps it for themselves (for example, getting ops in the CNC channel). I think Microsoft has even done in cooperation this a few times; it's dubious legal territory.

You can see some historical examples, both recent (Mirai had some viruses that went around closing the bug), as well as further in the past (there's one that escapes me, it must have been around 2010?)

I wish I could cite more, I'm going to spend some time researching this and make a list for myself, it's surprisingly interesting!
> OK, well, I've worked on lots of systems -- across three different companies -- where this feature is essential.

Here's an actual real life example: Chrome uses this in Chrome Sync feature that allows you to sync your browser configuration and state across various devices. The feature is implemented basically like this: Chrome sends its version of state to server in a proto, and the Sync server reconciles it with the one it has saved, updating both according to which one is more recent. The feature fundamentally depends on the fact that the client won't drop the fields it doesn't know, because it would then be data loss for some other more recent client who knows these fields and synced them to server: if the older client dropped these unknown fields, it would be an equivalent to syncing in an empty value of this field.

Original designers of proto3 (the most recent protocol buffers definition language and semantics) actually decided to drop the unknown field preservation, for simplicity reasons. This made Googlers so unhappy that an internal doc was created listing many internal use cases for this feature, and after discussion, this was added back to proto3.
When you want to gather people's personal and private information and pretend it was a breach.
> you'll "defang" the URL

Wow, that's a phrase I haven't heard in ages.
The Secret to Aging Well? Contentment
I can't swear that developers are setting updates to reengage users. My first suspicion would instead be that very frequent updates without obvious impact are either bugfixes, or somebody running/settling A/B tests via pushed updates.

That said, I have seen mobile game devs show daily user charts that rise (relative to installs) after updates. It wouldn't shock me if people had decided to capitalize on that.
Population density is what it takes. Hence your current predicament.
This assumes all tracking is equal. I don't care if they track what I read and engage with on their site, that's how they learn to make it better. That's sort of like complaining that a store owner pays attention to what items you look at in the store. Of course they do that. What we don't want is them following us around when we're out of the store to see what else we like at other places.

The simplest way for WaPo to achieve this without having to deal with any adbockers or trackers would be to use an in-house system served from their own servers. Unfortunately, since they also have a free subscription where they do track people, that would mean two systems which would be redundant, and the in-house one also probably takes a lot of effort and manpower. Unfortunately, that leaves subscribers not knowing exactly what is being tracked and who is doing the tracking.

I mitigate this by using ublock and a container tab for news sites in Firefox. I would prefer to know this isn't needed because WaPo did the right thing, but I would still do anyways, as just because something shouldn't be needed for protection doesn't mean you shouldn't do it anyways if the cost is small enough.
Facebook Says Hackers Stole Detailed Personal Data from 14M People
Could you please clarify your comment?
To answer a different question of “why don’t we see more hacks of smaller orgs?”

- Facebook is an incredibly juicy valuable target, worth investing time in

- FB has a very complex application and massive codebase. Your Django web store is far more straightforward

- smaller orgs can get away with not reporting, and don’t get visibility when they are compromised
>Everyone's posting it because you are wrong. A calorie is a calorie. If I eat 500 calories surplus a day, i'll gain ~1 pound a week.

Bullshit. A calorie is an incredibly crude metric of energy when it comes to human metabolisms. Our stomachs are not furnaces.

Try eating 500 calories surplus of gasoline or wood.
I don't follow. If anything it makes the parallel story easier to publish as a sort of "me too" (no disrespect.)

Maybe it takes away from the firmware hacking version of the story because now folks are looking at components as being the source of hacks and not the firmware on the components, leading to a false sense of security when they invest mightily in analyzing components with X-rays? I could see that outcome as being plausible. If the ultimate outcome is simply to change corporate priority towards futile component verification and away from firmware verification then indeed the firmware verification vector remains safe for the attacker.
So you're saying the defaults should be setup for the unusual use cases like you describe, even if that means we get botnets of millions of routers?

You're not going to define one set of secure-by-default rules that's going to work for everyone. Rather, you want to try to define a set of secure-by-default rules that work for most people. Then but the burden of reconfiguration and maintenance on those with unusual needs, rather than the majority.
So you said in your only other comment. Hacker News is a community site and it's not just to promote something, so could you please participate community-style instead?

https://news.ycombinator.com/newswelcome.html
Doesn't that just tell you that most (web) designers aren't using IE 11, because that's the audience for webflow.com?

It's an interesting statistic, but it's not news, unfortunately, and doesn't really tell us anything about either the big picture, or help people whose audience does include a lot of IE 11 users.
Ahh, we have Avacado Mayo and Chipotle Mayo that has no carb, low cal, and great for keto too. I think those run by Millennial created startups... Maybe millennials are busying creating companies which are funding those taxes people are complaining about being lowered and also figuring out that they are being over-regulated and the reason they want business friendly representation in government.
The collections with any connections between elements are not exactly fitting the ECS model, which works best for independent components. When I was thinking about it back in the day, I came up with a Component Graph concept (implemented in [1]), which has the data locality similar to ECS but doesn't have a notion of systems.

[1] https://github.com/kvark/froggy
And expressing negative biases seems to be very common in the HN world. Say what you will about JS, I didn't see a single person being rude or dismissive towards another person during this conference.
"20 mph" (slower than the fastest 100m sprint, but faster than the fastest half marathon) would be more clear of an example.
CSS Grid only works in select browsers to begin with.

https://caniuse.com/#feat=css-grid
Well let's not jump to conclusions so quickly. Reading Facebook's report it states that their vulnerability was within a feature they developed. A smaller company is likely to have less complexity in their software. Less complexity == less chance of vulnerability typically.

You can't be perfect. And you likely have less talented engineers than Facebook can afford, but if your software doesn't provide these sort of bridges that Facebook developed then that's one less point of exposure you're testing/fixing/securing.
The post seems to suggest the number to be concerned about is 30 million users who had access tokens stolen. Seems to downplay the 400 million users who had their profiles leaked.

"They used an automated technique to move from account to account so they could steal the access tokens of those friends, and for friends of those friends, and so on, totaling about 400,000 people. In the process, however, this technique automatically loaded those accounts’ Facebook profiles, mirroring what these 400,000 people would have seen when looking at their own profiles."

Seems a lot more like this has leaked the privacy of 400 million users, but Facebook are trying to focus on the smaller 30 million (though granted, those are more seriously affected.)
Not really a full replacement, unfortunately:

> For security reasons, we serve HTML files with Content-Type: text/plain. We recommend using GitHub Pages if this is a problem.
Yes. The analytics is another key issue. AMP for example ads analytics.
> penniless and dependent on the institutions she viewed as failures of the human spirit.

Link?

She died in her Manhattan apartment [1], not some government funded facility. And colleague Leonard Peikoff [2] was heir to her estate, including the copyrights and royalties on her works.

[1] http://www.literarymanhattan.org/place/ayn-rands-apartment-2...

[2] https://en.wikipedia.org/wiki/Leonard_Peikoff
So the record header has 2 bytes for the payload size, and the handshake header has 3 bytes. Am I correct in thinking that the 3 bytes of the handshake header is superfluous? Isn't payload size limited to 2^16 bytes
Update on the Hubble Space Telescope Safe Mode
You're talking about the tpu v1, not v2 or v3, so no.

Also, there's no need for assumptions when you know what's going on in the design team.
One function of UBI has never been clear to me: if everyone has X, then no one does.

Applied to UBI’s case, the baseline of $0 has been “lifted” to say $1500; wouldn’t that just cause the market to increase prices proportionally, until $1500 is effectively the same as $0? Specifically, those baseline goods/services where that $1500 targets?

I would imagine luxury goods wouldn’t change much, as those spending in the area won’t change their spending behavior significantly with a fresh $1500; but a poorer community certainly would, and I would expect the market to match
Never thought I'd see this on here...There is no need for all the complications like IF, etc. This game is only about your caloric deficient and surplus.
I wonder if a lawsuit for slander could work, either against the original creator of the list or media that reported about it.

I'm all in for supporting women and fighting sexual harassment, but this kind of bullshit has to stop. Successful lawsuits would deter false, spiteful accusations like this, and provide appropriate compensations for the accused.
I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread.

As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability.

We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.
Initial Network TS implementation landed in GNU libstdc++
Thanks for this, I'm doing a modified fasting regime + keto + crossfit. I started at 515#, 5 weeks ago. I'm 485 now. I have a smaller stomach from surgery in 2012 but I only lost 150 pounds after surgery (650-500). I've been yo-yoing between 450/510'ish.

My daily diet is basically a 8 carb protein shake with 60g protein around noon. Then the equivalent of 2 hamburger patties and 1/4 cup cheese for dinner. My calories rarely exceed 800 though. I feel great -- more energy than ever, and I have 0 hunger, I have to force myself to eat.

I'm hoping this is maintainable and that I can keep the momentum up. My wife has a baby due in January (our 2nd), and I want to be able to do more with the family/kids and be around for them. Luckily I have no co-morbidalities, I just did a full physical -- everything is perfect # wise blood pressure, lipids, vitamins (except D deficiency). But, I'm 38, that could change. My heart could get stressed from the weight in a few years... I've been seeing a therapist for depression, and a doctor for ADHD, and now doing a good fitness regimen.

Last year I was depressed with very dark thoughts, this year I feel great and in more control.
The question isn't about the problem but the approach taken to solve it. Did you debug it methodically or try-and-error or brute-force? Did you ask others company-internal or external for help? Did you communicate with others so they can escalate or re-delegate (take the burden off your shoulders)? Did you work overtime, all-through-the-night or make other sacrifices?
But once you have to have a filesystem, it's a nice model.
Many people don't like this but it all boils down to calories in calories out. All human bodies work pretty much the same way with some slight variances due to disease and genetics. Fasting works because it restricts your overall intake.
>Sure, at a super granular level, different foods affect you differently, trigger different biological responses, etc.. etc.. but if you zoom out, the details just don't matter. If you're under calories, the weight will come off.

Not true at all.

A gallon of gasoline has over 30,000 calories, yet you won't gain weight from drinking it,
Instead of throttling, you could also consider doing incremental brownouts where you drop requests for the first ten minutes every hour. PyPI did this recently when they phased out TLS 1.0, which worked really well IMO.
Show HN: Sound – A security-focused, experimental web framework
Case in point: I’ve not met a single person who (in addition to measuring calorie intake) captures all the content deposited in their toilet, and measures it all every day in a bomb calorimeter :)
The key things that got my team to switch to Yarn were (a) the lockfiles didn't keep changing formats when running installs and (b) workspaces for monorepos.
Likewise, no one has the right to restrict density on property they don't own.

Property owners have actual rights...they are listed explicitly on the deed or easement. Buying a property does not and never will confer the right to restrict other people's decisions of what can and can't be done on their property.

Society may decide on those restrictions together. But it is a bad precedent to give some parts of society more power than others when deciding on those restrictions, and it is in no way "entitled" for a member of society to complain about the results of this trend or want to fix it.
I know Java, Erlang, C/C++, Ruby, Python, Javascript, have dabbled in Scala, Haskell, PHP, Perl, and Racket. Of these, Javascript was actually the last I learned and used professionally.

I like Javascript. I hate DOM manipulations in the browser, and browser based differences, but Node on the backend is generally a pleasure to work with, and far, -far- better than most of the languages and ecosystems I've had to deal with. I prefer Erlang (well, and Elixir) for larger projects with complex concurrency/distribution/fault tolerance requirements.

Yes, Javascript was always hated. It certainly has some WTF elements to it that deserve some hatred. But for a straightforward, easy to learn, get things done language that doesn't lead to a lot of bloat, doesn't force you to be concerned with things you shouldn't have to be concerned with, etc, it's actually pretty solid, and I suspect a lot of the hatred has to do with the argh of the browser, in which no language will help you.
I had libraries hidden, so I had to check: there's both: the Documents folder, and a library that contains just that folder by default. So yeah, that seems unnecessarily confusing.
<- This, concurs with our experience.

When we profiled our string OT implementation on a single 2-3 GHz CPU, with 2-3 CPI (Cycle Per Instruction)), it was able to handle about 10M transformations per second. On a half dozen of OT based system I've worked on, the OT implementation was never where we found the real engineering complexity or the performance bottleneck in working coeditors.

The significance of using string-wise operation model in OT is under appreciated and can't be emphasized enough for real world systems. The first string-wise OT transformation functions can be traced back to Achieving Convergence, Causality Preservation, and Intention Preservation in Real-Time Cooperative Editing Systems, 1998. We also found that skip, insert, and delete can improve compression of string edits.
Thank you for sharing! Congratulations on your bet.
400,000 not 400,000,000
Possible scenario:

Someone noticed a spike on Sep 14th which was a Friday. Person A probably sent an email to Person B asking for information. Person B finally replied to ask person C on
Monday. Person C gets looped in Tuesday and assigns Person
D to take a look at it. Person D is finishing up a task and starts looking on Friday. Everyone thinks this is fine as the issue is probably just a front-end bug that's causing looped requests. It's not considered a security issue yet.

They make a little progress on Friday, but are out of town in Tahoe for the weekend. Monday the 24th rolls around and they finally figure out that it might be an attack and report back up the chain, a process which took 24 hours. Now it's the 25th, which is 11 days later.
I believe autophagy doesn't kick in for the first 5 days, so if you want to preserve all muscle mass, that's the window to stay under. Once you go after that, the changes aren't that dramatic either, so you'll recover whatever muscle loss you incur fairly quickly as long as you're fasting while still having fat reserves. Once you're out of those, fasting is a bad idea, in the sense that you will start dying.

https://www.amazon.com/Complete-Guide-Fasting-Intermittent-A... - another book by Jason Fung that covers water fasting more in depth.
I don't judge you, but* you're naive to believe what someone says, not what they do.

* this is where you can usually tell someone is judging

And your metaphor of the poor as children you wouldn't steal candy from is exactly the kind of ideological superiority i'm talking about.
This is reductio-ad-absurdum. Follow the money - how much money does Mozilla make from Pocket - probably a small % of their overall revenue. How much money does Google make from Ads? Close to 90%.
4 Adoption Hurdles Blockchain Payment Processing Apps Need to Face
That's a questionable approach you took, since Lenovo has been caught in the past shipping laptops with spyware. I actually bought the same Thinkpad a few months ago (beautiful machine btw), but I had to return it as I couldn't get myself to trust a computer manufactured by a dishonest company, in an authoritarian country. It felt just so uncomfortable.

At the end of the day, I still trust Apple the most, since they have a huge reputation they need to maintain, although I recognize it's not an optimal solution, as they might very well have weaknesses in their supply chain, or become dishonest at the request of some higher authority.

On a related note, it appears we don't live in the era of personal computers anymore, but rather personal interfaces. Most people are comfortable getting a mobile interface they control, while the computation and storage of their data is performed by somebody else.
Facebook has lost 30% of its value since July
Google is near universally considered one of the gold standards of infrastructure & application security.

So besides applications, infrastructure, distributed systems, reliability, money & security what have the Romans ever given us?
A lightweight and modular front-end framework developing fast web interfaces
MySQL Adventures: GTID Replication in AWS RDS
Nah pretty sure that'd just give you massive diarrhea.
This post was also discussing lunch where, presumably, eating while driving is less of a big deal. (Though, yes, some Americans eat in the car a fair bit which makes sandwiches and the like more suitable.)
In this case, the ambiguous statement is repeated 3 times in the article.
I suspect Lampert the Sears CEO is losing money, Lampert the hedge fund manager is making it via a slo-mo takeover of Sears assets from other Sears shareholders.
Visiting LinkedIn website and Android tells me LinkedIn want access to my microphone ... nothing in the web page about mic usage, just visiting the homepage ... scary.

Good that Android catches this now though.
Eh... it's not quite that simple. Checking the firmware before it goes into the device is not the issue. It's after the firmware is in the (integrated) device that it's an issue. How do you check that? You have to boot the device to calculate the CRC. Now assume that the device's bootloader is compromised and that the device actually has more internal storage than you thought. Now what? Ensuring correctness of firmware to verify the device won't do something you've never seen it do is quite difficult.
It was firmly tongue-in-cheek. I assume he was being lighthearted and fun. He seemed a pretty funny guy and a good presenter.
Public anger in China spreading as property prices drop
Yes, it's not good for the use case you described. That's what I intended to say with my comment on "generic searches". If you are looking for something very specific like a piece of code that resolves your OOM error or a uk seller of a xkcd hoodie then it's better to add !g to your search.
> Most of the issues I've had with Chrome can't be changed with flags. Do you have anything to back up that statement?

Until you specify what those features are, all one can do is show you where to change flags. Now you've resorted to using letters to tell me. Do not compute.
We provide discounts for startups and researchers. Definitely contact us. Pricing is based on query throughput but it's definitely affordable.
NPM and Yarn have made a nightmare out of our project. We have 50 direct dependencies. The lockfiles only lock your direct dependencies, any transitive ones can change at any moment, making our CI builds fail when something works locally. And they don't actually check integrity -- that v1.5.0 of ABC is the same as v1.5.0 from a month ago.

I saw Yarn added last month a hash of the (hopefully) source of the dependencies -- that's what we need.

Despite using lockfiles, some transitive dependency changed and we decided it was best to upgrade the direct dependency, requiring a big refactor. The alternative was to fork the library and maintain it ourselves -- which I am refusing to do from this point on. We have about 10 forked 3rd party libraries. No more.

I feel like I spend 30% of my time just trying to upgrade/maintain the current builds because some stupid loosely semver'd dependency changes, rather than writing new features.
Eyes in the sky: 5 ways drones will change agriculture
Photos: How Tools Start a Revolution (2016)
As an office worker, I really wish I could get stuff like this here. There's very little that fits the intersections of "fast enough to get on a lunch break", "reasonably healthy"†, "more or less fresh", and "has a mix of flavors and textures".

† Especially this one - there's lots of food carts but those are a long way away from 'healthy'.
Dang. They should have advertised that more. That's a good idea.