skysight-inc/HackerNews huggingface dataset:
This is getting a lot of play today on Twitter but it's not all that consequential in the normal setting of a ZIP file.

The flaw they're pointing out is that 7z's AES encryptor has a 64-bit IV (half the block size) --- not itself a vulnerability in block ciphers --- and uses a predictable RNG to generate the IV (for simplicity, just call it "time and pid"). 7z uses AES in CBC mode.

In CBC, you want IVs to be unpredictable; if you can predict an IV and you control some of the plaintext, you can in some cases make predictions about secret data that follows your controlled plaintext (this is an "adaptive chosen plaintext" attack).

This doesn't really come up in 7z's usage model; you're supposing someone integrates 7z with their own application, which, on-demand, encrypts attacker-controlled data with a secret suffix and puts it somewhere the same attacker can see the resulting ciphertext. Don't do this. In fact, if you're using ZIP archives in your application, don't use ZIP's AES at all; encrypt yourself with a modern mode. ZIP AES isn't meaningfully authenticated.

Having said all that: for the normal usage of an encrypted ZIP, this doesn't really matter at all.

It's a good finding, though! Cheers to anyone who takes the time to look at the underlying code for any popular cryptography. I hope they keep it up.

A more important PSA: unless you're absolutely sure otherwise, you should always assume any ZIP program you're using doesn't actually encrypt password-protected ZIPs. It's just as likely that it's using the old, broken PKWARE cipher, which is dispiritingly common due to backwards-compat concerns. It would be nice if there was a mainstream, built-in way to password-protect a file that you could share with someone else (or just stick on a thumb drive), but ZIP encryption isn't it.

Pentesters sometimes go out of their way to use 7z because it actually does encrypt with a real cipher. And, I guess for what we're doing with it, 7z is fine. But it's sad that it's the best common denominator we have.
I do tend to prefer to use markdown when I can, which is where OneNote is failing for me. A lot of our internal tools use markdown for things like interview feedback.

Do you have any example scripts you can share?
Me either in 11th grade. I was definitely just playing Ocarina of Time for the millionth time, looking at sketchy forums that claimed you could find the Triforce somehow.
So Oracle is worse than screwing over customers and just awful quality of their database. They are now actively screwing over their employees!

Remind me why they are so widely used again?
Even with silent electric motors, the noise from take off and landing from air displacement exceeds safe noise levels, and is far above nuisance levels.

I would have fast airships with high speed winches hovering over the pads, with the ends of the cables managed by smaller drones. This would enable the passenger drones to take off assisted, with their motors only providing control forces, until they reach an altitude where their noise at full power isn't such a nuisance.
'Surely'? Why must it 'surely' fit into a preconceived ideological straightjacket? (One who's adherents are like 90% white, FWIW).

The answer is that asian immigrants are a self-selected subset of 1.5B asians in asia.

The social justice mental toolkit doesn't have an answer to this anomaly. American census numbers and the assumption of a normal distribution within them don't square with the highly-motivated subset of Asians who immigrated.
It was much much different in schools pre 9/11. My high school was like a college campus. We could roam around the campus, eat lunch around campus, and all the doors were unlocked. Is it was easy to get in and no one would really question you during non class times like lunch.

Post 9/11 everything was locked down and continued to get worse.
In Common Encryption (encrypted mp4 files) 8 bytes IVs are a fully supported and documented. And sometimes preferred for compatibility. CENC mode even uses CTR, so the IV is simply incremented every block.
Picking the Brain of the World’s Most Radical Ceo: Zhang Ruimin
I guess I am missing something. I have a Pi-Hole setup at both home and office that serve as the only DNS for the entire network at both locations. I don't see ads, affiliate links don't resolve, and tracking/monitoring services don't capture my traffic.

My experience has been that it took about 30 minutes to setup and I don't see ads on the internet, nor do my family or team.
Linus's law says that if enough people look at something, the bugs will appear. But often not very many people are actually looking at the source code of open source software. So there is no contradiction here.
http://www.luxottica.com/en

in NL there is a documentary about this company and how much of influence they have on the market. Interesting, though if true, worrying
it isn't what, it is where. It is in SV. I don't know what it takes here to be in 1%. A former colleague got a unicorn recently - he probably would qualify. Half-a-mil does seem to allow to be a middle class here. At least this is what neighbors working at Google, FB, etc. and some friends/acquaintances from other places are.
> From what I've seen, there sure are a lot of not so great developers working in the valley. At least judging from the copycat designs, the clumsy UIs, chronic UX issues, etc. from typical startups I don't think that the grass is greener over there in any meaningful way.

This is not the fault of "not so great developers", this is the fault of "agile development".

Whereas a decade ago you could go into a store and buy an AAA game, you could expect that it was free from major bugs and generally playable from start to 100% on decent hardware. Today? Gonna be happy if the patches on first run are not consuming more space than the original game itself and you don't have the feeling that the game you shelled out 50$ for is not just a green banana that ripens at the customer.

The same is valid for general software and especially web apps. Time-to-market is everything, who needs a QA department (it can all be done by developers in their spare time / overtime, no need to hire persons who know how to write proper testcases), who needs a proper ops department (the people who actually know about how Linux operates, what security is and what ACID means, compared to full-stack devops developers who cost a tenth of the money a good DBA or system architect can command) and if it works in a half baked A/B test (cheaper than running user studies or, heaven forbid, actually inviting power users from your target market to fly to you and show you how they use your product) then it gets rolled out indiscriminately to all your users. And when the pile of layers of shoddy bugfixes and other general crap (e.g. foundational architectural issues) finally collapses after a couple of years, the original creators have long since jumped ship and cashed out. It's definitely not sustainable.
I'm a developer and I prefer matte screens. Here's why:

Comfort: I don't need to adjust myself or the screen's position depending on the light.

Power saving: My brightness can be lower, because it's not competing with reflection.

To me, these greatly outweigh any advantages of a glossy screen.

On thing which may be important: I require a dark desktop theme.
If it's identical to consumer hardware, then there's no reason to design it to be easy to open. But a developer laptop will be opened.

(I might be attacking a strawman, but I detect in your question a suggestion that more consumer hardware should be user-serviceable. There's a difference between being hostile toward serviceability and simply optimizing the design for manufacturability, aesthetics, cost, and reliability, any of which can conflict with other metrics such as serviceability.)
70+ Tactics for Building Great Company Culture
> You use the MMU

Must be nice to have one of those! Cortex-M* does not.
Hadoop Release 3.2.0 available
You can go out today and very easily buy a much smaller mass production sailboat. That would have been a pipe dream many years ago.
https://www.heise.de/developer/meldung/Apache-Hadoop-3-2-0-v...
That book is one of the most useful engineering books I have ever read. Top quality theory with practical application.
Read Eliezer himself, 4 years ago: https://www.reddit.com/r/xkcd/comments/2myg86/xkcd_1450_aibo...

The "meat" of interest here for those too lazy to click (I encourage people click through, though, really, and maybe even take a glance at https://arxiv.org/abs/1401.5577) is probably this long parenthetical:

> (But taking Roko's premises at face value, his idea would zap people as soon as they read it. Which - keeping in mind that at the time I had absolutely no idea this would all blow up the way it did - caused me to yell quite loudly at Roko for violating ethics given his own premises, I mean really, WTF? You're going to get everyone who reads your article tortured so that you can argue against an AI proposal? In the twisted alternate reality of RationalWiki, this became proof that I believed in Roko's Basilisk, since I yelled at the person who invented it without including twenty lines of disclaimers about what I didn't necessarily believe. And since I had no idea this would blow up that way at the time, I suppose you could even read the sentences I wrote that way, which I did not edit for hours first because I had no idea this was going to haunt me for years to come. And then, since Roko's Basilisk was a putatively a pure infohazard of no conceivable use or good to anyone, and since I didn't really want to deal with the argument, I deleted it from LessWrong which seemed to me like a perfectly good general procedure for dealing with putative pure infohazards that jerkwads were waving in people's faces. Which brought out the censorship!! trolls and was certainly, in retrospect, a mistake.)

Edit: this plus more is all covered by the LW wiki's page someone else linked, check that out too if you really care. https://wiki.lesswrong.com/wiki/Roko%27s_basilisk
> The problem here is, we don't even know what "fair" means.

Maybe, but we know blatantly unfair algorithms when we see them. And we see them.

e.g. Remember the AI recruiting tool that automatically rejected women because that's what it learned from the input data?

https://www.theverge.com/2018/10/10/17958784/ai-recruiting-t...
Some context left out of this article suggests internet access is a big deal for this place and they went to pains to establish good internet access to begin with:

Here's how a tiny Pacific island got better Internet than the US

https://www.pri.org/stories/2014-08-01/heres-how-tiny-pacifi...
No, my argument is that "it's just numbers! they don't have a soul!" is not a valid defense from accusations of racism, because the statistical systems can be racist in their design, and there is no "racist meter" you can apply to check. The only way to know if a system is fair or not is to check whether the results you're getting are the ones you want.
Venezuela's Maduro cuts off U.S. relations after Trump backs opposition leader
The Tesla strategy was to make margin on premium EVs while the big names ignored the concept. Then to transition to mass market EVs before the big names could squash Tesla. We're getting right into the crunch point where everyone is coming out with an electric car. There are a number of entries selling at or around 10k/year, according to this listicle: https://insideevs.com/lists/10-best-selling-electric-cars-us...

I'm also curious to see if Tesla holds the lead it's earned in the US EV market.
A default install of Slackware from a 2.4Gb .iso will give you a similar environment that is reasonably functional on an X200 similar to the OAs. I actually use an X220 which is slightly more powerful but same ballpark.

x4 inflation over 20 years?
BitTorrent creator Bram Cohen breaks ground on Chia's “better Bitcoin” protocol
I'm out of the loop now, but it used to be like everywhere else (HN included) - you follow the posts and participate in comments, and after a while you suddenly find yourself to be an established community member.
"Virtue Signaling" or "SJW" as derogative implies useless or hypocritical sense of the terms. Of course it's a good thing to signal positive virtues or fight for social justice. Used negatively, "virtue signaling" implies that one is using perceived virtue as a way to dog-whistle for a specific tribal group, for a trendy but ultimately counter-productive virtue. It is disingenuous and not the point of actual virtue, which is selfless and not using virtue to primarily increase one's social standing. Like SJW is used for someone tilting at windmills and going out of their way to attack someone for views which are only 'bad' through a lot of mental gymnastics. Like the phrase "make america great again" or "freedom fighter" can ostensibly be a positive thing, but in actual practice is often used to disguise negative things.
Zeplin (YC S15) Is Looking for Product Designers in San Francisco and Istanbul
I think that implies a symmetry that doesn't exist. Vanishingly few people care about effects but not intent, because intent inevitably leads to effects. This creates a continuum, not a mirror image: consider neither, consider only intent, consider both. Those on the left mostly consider both, with a few considering only intent. Those on the right mostly consider only intent, with a few (racists by any definition) considering neither.

Your formulation also misses another very important nuance. I don't think most people on the right don't consider effects. They mostly know that such effects exist, and quite often feel bad about that. However, they also believe that addressing only intent (or "procedural fairness") is sufficient to make those effects go away, and that more assertive measures create "reverse discrimination" and/or infringe upon liberty. I'm not going to argue whether they're right or wrong, but it's not about consideration. "Strategy" might be closer to the mark. Most on the right (not counting the true racists) do want to end racism. They just reject the left/center prescription for doing so.
In order to create a situation where people have equality of opportunity, it's often necessary to ensure that the individual had an equal outcome that creates the necessary starting state.
You may have a secondary DNS. Sometimes that isn't even intentional as ISP modems automatically upstream failed DNS regardless of the local DHCP settings (I'm looking at you AT&T Fiber)
It's a very good reason, and in some cultures even has become an integral part of communal life:

https://www.smithsonianmag.com/smart-news/this-japanese-shri...

process and operational knowledge is the most valuable form of knowledge we possess. It is the only form of knowledge essentially only obtainable through practice, and we're always only one generation away from losing it.

We can witness the huge cost of rediscovering this knowledge in space exploration right now.
jpmcglone and dgzl were proposing the opposite of that. Newspeak eliminated words so that some ideas simply could not be expressed. They propose adding words so that dissimilar things can be distinguished from each other - to expand the things that can be (clearly) expressed.
Relative to other things like travel, commuting, home energy usage, electronics, etc, I'm guessing the environmental cost of a pair of glasses is very, very low.

It is important to focus on effective actions. For example, a lot of people think that somehow recycling affects climate change, which (AFAIK) is not true in any meaningful sense. That isn't to say one shouldn't recycle -- there are plenty of reasons to do so in many cases.
All these articles seem to assume a 5-7% return yoy. Has anyone been able to manage this? My investments have consistently shown -3..+2% over the last 5 years but granted they are spread over world equities and bonds.
I have a Dell monitor which does video, audio, power, and a couple of USB ports over USB-C. It’s easily the best setup I’ve ever had just for the convineance in being able to plug in one cable and immediately have everything I need working.
I think you're right. Just unplugging and kicking the kids out the door just isn't effective, ultimately. I think that's true mainly because it takes all of the parents in the neighborhood doing the same thing. Otherwise, your kids end up outside with no one to play with because all of the kids their age are still inside attached to their electronic devices. I think it's much harder today to create alternative activities than it used to be.
Monotonically increasing CBC IVs are in fact not fine; you have them confused with CTR nonces, which need single-use rather than unpredictability. See Bard for more details of the best-known attack on predictable IVs. If you're going to try to take someone down a peg, be right.
I wouldn't qualify myself as lazy for choosing not to read that book. :-) There are a lot of books out there!
The vast vast majority of laptop users still have USB A peripherals. Apple was a decade too early (to their detriment) going full USB C. They're helping the USB C ecosystem, at the cost of dongle hell for their users.
5 O'clock news: Are your kids outside? They are about to be murdered. Then raped. Then murdered again.

6 O'clock news: Hear about how one child out of 70 million in the US was viciously attacked by strangers because they went outside.

10 O'clock news: Did you send your kids outside? You probably just murdered them!
Most common phrase heard on police scanners in areas with unencrypted systems: "Call me on my cell."

So the practical upshot of encrypting public service transmissions is minimal.
This is a long shot, but have you tried disconnecting the battery for a few minutes? My son's XPS 13 got into a situation where it was permanently throttled at 400MHz, and a random angel on the internet had tracked it down to a hardware safety that had triggered and could be reset only by disconnecting the power to let some low-level thing clear itself out.

Since you have a newer model, they might have BIOS-level throttling that the OS knows how to override, which would mean that booting would be super slow.

Worth a try -- good luck.
I recently built an app that outsourced the entirety of the account creation, email validation, MFA and authorization to AWS Cognito and AWS ELB. All I have to do is verify a signed JWT passed in by a header by the ALB (and configure all that stuff and automate it into CloudFormation).

Never building this infrastructure again. What a huge time saver.

My company used Okta. We ended up cancelling it as it did not seem to offer any value whatsoever and was crazy expensive for our 300-odd users.
Really nice work. I just started using Julia and the Flux machine learning library a few months ago. Julia is great for numeric processing - I would say much better than Python except for the deep learning libraries like TensorFlow I rely on for work. That said, for my personal projects I have been using Flux and Julia and am happy with the ease of setup and the dev environment.
Could you please provide some links to how she "just" learned what a marginal tax rate is or other examples of her shallow understanding of issues?
It's my government, too. I'm a naturalized citizen, so you're assuming correctly. But please, can we stop the "cages" propaganda? Those photos were from the Obama years and they were debunked again and again ad nauseam. https://www.businessinsider.com/migrant-children-in-cages-20...
No one's going to waste resources putting source code on the server dude, they'll host it somewhere else and then something will happen to it or they just won't see the need to give the source to anyone because they're the only people in the company who understand it anyway etc.
Brings to mind the advocacy of William Horatio Bates:

https://en.wikipedia.org/wiki/Bates_method
The killer cards in question, both mine and the one in the Dell laptop, use the ath10k driver. I had some problems with other cards (e.g. QCA988X as AP) but not with this chip specifically.
I watched a fascinating talk a couple of years ago by a guy who learnt in detail how various cars' computer systems work and communicate, (mostly by studying them directly, and reading the chip info when he found out what they were), connected to them, and eventually could play racing/driving video games with his car i.e. with the steering wheel, pedals etc. I can't recall the name, but I'm sure that would be useful and answer most of your questions. Maybe someone on here will know the talk I mean. (Can't see it on googling 'hacking cars talk' videos 20mins+ .. but that finds some interesting stuff)
What are the most common questions from /r/personalfinance?
Taking credit when you can't pay it back doesn't just hurt the bank - it hurts you too.

Getting loaned money is not a right, and if you are irresponsible, it's harmful.

So if lending more to a certain segment of the population hurts the bank's profit, I'd also expect it to cause more problems for that population segment too.
VanEck SolidX Bitcoin Trust ETF Listing Withdrawn [pdf]
Contrary to what you read online, very few people should discuss those concepts in contrast with each other. Almost all of the public debate is contained in the former. Therefor being for the former doesn't really say much, at all, and any encyclopedia will tell you why.

Edit: I will make it easier for you. If you do not understand most of this page[0] you are ignorant of one of the most fundamental debates in society. If you do you would understand my position. The wikipedia version might do as well [1]. It is ironic how people who don't "believe in outcome" are often ignorant.

[0] https://plato.stanford.edu/entries/equal-opportunity/
[1] https://en.wikipedia.org/wiki/Equal_opportunity#Theory
Do you believe getting rid of accessible parking spots makes things more fair...?
Here I was hoping for actual "old hardware"...sigh.

I'm in the process of refurbishing, possibly with some custom upgrades (ESP8266 wifi-serial dongle would be interesting), of a TRS-80 Model 100.

Days of runtime from a handful of AA batteries.

True, I won't be able to do anything modern with it - but that's kinda the point.
I hope that Pixelbook 2 will be released soon with smaller bezels and more up-to-date hardware. Then switching from a Thinkpad running Fedora / Ubuntu to a Pixelbook will be a no-brainer to me. I think that ChromeOS is the most secure OS at the moment, and a Pixelbook is like an iPad Pro and a Macbook Air combined. Which is exactly what I want for work and leisure.
I don't think it's that good counterargument. The explained problem was treated as simple mapping - this value causes that result. It spends a bit talking about what statistics mean, but unfortunately doesn't discuss the idea of confounding variables, which influence both sides of the equation.
I'm sure we are simply talking about different kinds of research...

Just like I'm sure 20 years ago a market researcher was convinced he was doing "pure" research...
I am also interested in equality of opportunity- but how do I measure that everyone has an equal opportunity to achieve something? How do I measure the opportunity to consume nutritious food? The opportunity for access to the same healthcare?
I see...so your shop with a great policy seems not to have learned about these things called test environments eh?
So basically, it's a cheaper helicopter?

Don't get me wrong, if safe enough and cheaper, it could open new usages, hopefully beyond "now, this 'big project manager' can also take it, it's not anymore reserved to the CEO". Usages like medical emergencies could actually be really useful. But it's hardly a progress for the masses and a solution to traffic congestion.
Dogmatism.
A non-touch screen 4k would be my preference, but I suspect they won't ever offer it, despite the power implications you mention.