skysight-inc/HackerNews huggingface dataset:
> Lack of proof does not mean proof of nonexistence.

It is certainly evidence of nonexistence. Do you believe every single claim you've ever heard because you can't conclusively disprove it 100% of the time always? Of course not, you use your reason and assume that more positive claims are false until proven otherwise.
Yep. Except sketch still isn’t up to delivering the same level of usability that fireworks had.

Not to mention it was bundled in Creative Suite.
The case I think about the most is web fingerprinting. For example if the authorities in a country that funnels all external traffic through a point of mediation want to identify who is reading certain specific pages on wikipedia - they likely can.

The most effective forms of web fingerprinting focus on static resources; the two most prominent papers focus on Google Maps tiles, and Netflix videos, which were both collections of static resources that were compressed offline. Static resources are easier to target because the size of response is fixed, and the domains they're hosted on tend to be relatively free from cookies, auth tokens, query strings, and other noise.

In practical terms for attackers, it's easiest to focus on the images, CSS and javascript that your browser is downloading; since these are usually static, pre-compressed, and on CDN-hosted domains. This is pretty feasible against Wikipedia, but also Facebook shares, tweets, etc ... anywhere where you're viewing content that includes images or video.

O.k. so far nothing controversial, nobody would even get much of a paper published about this, we bucket it under "Traffic Analysis" and while it might shock the average internet user, cryptographers aren't surprised.

Where CBC vs GCM comes in is that GCM reduces the "cost" of these fingerprints and increases the effectiveness of the whole approach. If a webpage contains say 4 images, and an external CSS reference, that gives you 10 points of information to fingerprint. You get 5 request lengths and 5 response lengths. Given the spread of URL lengths and file sizes, it's pretty easy for that combination to be unique, or at least narrow things down to a small set of possibilities. With CBC enabled, each request length and response length is rounded to the nearest 16-bytes. That's not a huge amount of padding, more would be better, but it still reduces the uniqueness of the fingerprinting by an exponential factor. It's particularly effective on the request lengths, which are small to begin with.

Now with more requests, and a bigger graph, it's still probably possible to de-fuzz this; but my point is that in practical terms - when you have exact lengths, you just don't need to this. With exact lengths, you can ask a junior SDE to code this up for you in a few weeks. Someone who barely understands tcpdump and mysql can build this. With blocks and /some/ length hiding, the same person finds that they get less signal and have to correlate between more requests and pages, it might not even be practical for many sites. On principle, I think it's dumb to lower costs for practical attacks like this.
I'd also be interested in hearing a bit more about this.
There's no good way to get that data: podcasts are RSS feeds. You see IPs and user agents. How do they know who's a 30 year old male making $70,000? You an try to match IPs with advertising databases, but good luck getting any sort of real signal out of that. That data is all inferred anyway. Hell, I bet my cell phone has two dozen IPs over the course of an average day as I connect to various wifi networks and Fi switches carriers.

As it damn well should be.

That said, it's only a matter of time before carriers start tracking and selling this data.
Seems like the people were offered a mixed bag: Have some direly needed reforms now in exchange for cementing the power of the party, which was already solid to begin with.

Honestly, let us just keep Cuba a toy socialist country as it is and not boycott it. Otherwise, where would we point to when we want to show real world socialism? Assuming that Maduro is on his way out, of course.
Pi-Hole – A black hole for Internet advertisements
i have several which I often switch daily. They don’t take up much space so taking them is not a problem. Really big cards are often more expensive per GB and now you have a single failure point. Even reviewing pictures on the camera is a pain if you have too many.

Obviously this changes if you do 4K or 8k video. There a 1 TB is probably very useful.
The vulnerability applies to all DMA-capable devices (ie Thunderbolt, PCIe, wifi and NVMe chips on mobiles, on-chip peripherals like mobile basebands). Thunderbolt 3 makes drive-by attacks easier, but in principle the attack could be carried out from any DMA device (subject to practical limitations like reverse engineering of firmware). Our earlier attacks were done with PCIe and Thunderbolt 2.
Maybe something like a dashcam or security camera. Something where more hours of video footage retention is better.
Most companies collapse from within, they don't get trounced by competitors. Competitors come along with a new angle that seems innocuous at first, but then turns out to entail 'the thing people want'.

It's very, very easy from an operational perspective to focus on the data-driven decision to sell crap, to ignore fake reviews etc. because that's what sells 'today'.

But an A/B test (short view) does not capture users recurring behaviour, and response to that experience overall.

If the A/B test encompassed a 'year long study' they might find a different set of data: upset customers who don't come back.

Which could lead to systematic 'sand in the engine' that could seriously erode Amazon.

The only way this would be resolved really is if Bezos himself makes a pretty firm commitment to it, which is hard obviously because 'quality' is a difficult thing to put a number on.

That said, it's hard to conclude how truly damaging this is. Once people are hooked on something, it takes an alternative for them to change their behaviour.
So now SD cards get DMA. Fun!
I also donate each year and don't care what they are doing with my donation, because the value I got from wikipedia overshadowed my donation greatly and that's a great deal already.
The rise of Docker is in particular a pity, as we were getting it right before with Bundler in Ruby, pipenv etc. for Python, Maven for the JVM and NPM for Javascript (well maybe not right in the case of NPM, but better than Docker regarding this point): We declaratively describe which semantic version of a dependency we need, lock down the specific version used for testing and deployment (in a .lock file) and have an easy process to update the specific version to the newest semantic version available and test it before redeployment.

With Docker and its procedural dependency declarations ("apt-get install this", "wget | bash that") we've lost all that precious version information and reproducibility.

Imagine if Docker was like Bundler/Maven/… but for Debian/Ubuntu repositories. You could deterministically reproduce an image from an easily auditable package file and basically do an apt-get update on the .lock file to fix the security vulnerabilities in the selected versions.
Quite the opposite. I'd call that solid evidence that they don't owe the market infinite backward compatibility. Nevertheless, those of lesser means will always seek out low-cost solutions like installing Ubuntu on a 10 year old laptop and they will be predictably frustrated when things don't work. When an incidental fraction of your audience is "all the world's poor and downtrodden", you're going to get a lot of people looking for solutions. To some extent that works in your favor: from those poor and downtrodden will very likely emerge some brilliant hackers and technical leaders.
The foundation has so much money that they could fully sustain themselves just from their endowment if they wanted to. They really do not need donations from the public and their petitions for money are misleading for the majority of people, who think they are helping to pay for editors (free) and server costs (minor costs).
Amiga OS 3.0 did it right, anyone else here remembers?
Congrats on getting this launched Zach! I really enjoyed our talk and the vision. Still hope we can find a way to work together at some point!
I'm not saying abandon multilingual capabilities, I'm saying Rather than defaulting to English, why not default to whatever the browser's OS is set to?.

This was in response to a comment chain suggesting that geofencing default language is a bad option, because of how inaccurate it can be.

> - In households where the parents are immigrants, very often the children set up the computer, so it's set to English, which is the child's preference, even if the parents don't speak English.

I fail to see how any default language setting will help in this scenario, assuming they've immigrated to an English-speaking geographic region.

> - The vast majority of our users accept the default language (English) when setting up their computers, even if they don't speak English.

I suppose this is one scenario where geofencing might work better than OS default language, but then again, based on my experience it's just as likely to be wrong. At least with English it'd be an interface they're accustomed to seeing, and would have better luck finding the website's language selector, rather than something more arbitrary :/
Not on Firefox!
I’m surprised they didn’t just state “Macromind, co-founded in part by Marc Canter”.
There is a school of thought that the thing we should strive to minimize are first time offenders, this goal leads pretty naturally into a correct assessment that extreme punishment is a valid approach.

I take issue with that goal though, I think we should reduce the chance of future crimes from both criminals and people with no prior history in an effort to minimize the harm done to everyone - this is where I see a reason to fully forgive people. If someone could assure you (and be genuine in it, without strange conditions) that they would never commit another crime, then the only reason left to punish them is to demonstrate to society that the crime they committed is unacceptable - and that means you aren't punishing someone to teach them a lesson but to teach everyone else a lesson, if you could make it seem like they were punished but let them live a normal life that would work just as well (assuming they were actually hidden from view)
I have worked, about 15 years ago, on a contract for a company that amongst other things produced automated roulette tables.

They had a large hall packed with those that would constantly spin up, drop the ball and record results. There was mathematician employed to check series for any statistical anomalies. I had few chats with the guy, I was quite impressed the level of detail and care to make sure the wheels are perfectly symmetrical and fair.

Most of the cost of the machine goes into making the wheel symmetrical. I remember something like 20 or 30 thousand dollars spent on the single piece of metal that becomes the wheel.
'My image has zero vulnerabilities! (it's a proprietary terminal that's reachable from the public internet)'.

The flip side of "this reports too many vulnerabilities" is "this reports too few vulnerabilities", it should always be made clear we are talking only about publicly known vulnerabilities, which is a subset of all discovered vulnerabilities, which is a subset of all vulnerabilities.
Tooth past, soap, food items like protein bars are so easy to order off the site. It is hard to imagine the challenge of hunting these items down in crowed stores to shop them my self. There are lots of items I regularly buy that are not review dependent and I will keep ordering them for the long term.
Me, personally, or as a discipline? As a discipline, remote viewing allows the practitioner to gather details about a remote subject (anything in the universe of which you can become aware) which is unavailable to the five senses due to distance, time, or obfuscation. For example, the CIA would use it to gather details about remote bases that they observe on satellite images and such.

Personally, I've been able to identify basic blind targets (from a target pool such as https://intuitivespecialists.com/target-pool/) and started training in earnest, but soon abandoned it as an egoic pursuit in order to focus my attention on raising my consciousness through traditional spiritual practices (meditation, psychadelics, self-inquiry, lucid dreaming, etc).

There is a lot of fun that can happen when you've silenced your mind, sit still, and close your eyes for a few hours. :)
Cool but a bit too easy.
The pot should get split three ways.

The toolmaker gets a cut. This usually happens in the process of buying the tool.

The buyer of the tool gets a cut. This happens, perhaps excessively.

And the worker should get a cut. The worker who knows how to use the new tool is worth more than the worker who only knows how to use the old tool.

It seems, however, that the workers getting a cut is where the process often breaks down.
Well, they have used it a little, but it’s hard to use it enough.

You need to ensure that different network cards can’t see each other’s buffers, for example, and that will not be an easy change to most OSes.
Should be great for browser games at the very least...
Was just about to post fakespot.com -- I've used it to great benefit in spotting some of my purchases that didn't have a reasonably priced, stand-out name brand to choose from (HDMI -> RCA audio splitters, or as mentioned in this thread, good bluetooth wireless earbuds.

Amazon is consistently allowing multi-hundred unverified 5 star reviews for new products to persist, and my wife and I are starting to drift to other, more reputable resources. After a decade+ of Prime membership, this is a really disappointing betrayal of trust.
>Cuba is not without its problems, but much of what you describe is not unique to a third world country.

>I'm not claiming socialism is great or anything - there was a potato shortage while I was there

But the point is that the countries that were third world a half century ago but have since raised themselves up to developed status did so through free market economics, while the socialist dictatorship countries like Cuba failed.
I recently purchased one at a Kroger (store branded). It is good to know that Costco will also stock them soon.

Buying them at local stores has most of the benefits with less of the ecological impact or high costs. In fact the one I purchased had less overall packaging than buying the parts individually, there was still a price premium however.
> "My app only exposes port 80 so I don't care about local exploits," is not a good approach to security...Am I crazy

Well no, but they're not off-base either.

Security is best implemented through a layered approach.

Security is also an exercise in risk analysis and mitigation.
Yes. https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dha...
I've tried various meal kit programs, chiefly because of their various free offers, and almost all of them start out strong and then their food quality declines overtime. My biggest complaint is not cost but the low quality of most of the food itself.
Even though it takes even longer, I've used rsync with bandwidth limiting to get around thermal issues during large reads.
I've read Andrew Kennedy's email. This line hits the point for me. His argument is reasonable, sometime it's impractical or hard or costly or all the above to upgrade all the systems to meet regulatory compliance and the newer and stricter and safer security standards.

It is vital to financial institutions and to their customers and regulators
that these institutions be able to maintain both security and regulatory compliance
during and after the transition from TLS 1.2 to TLS 1.3.

One example of that is the NIST's recommendation on password policies. Most of the time the regulatory mandates are outdated and it's hard to bring them up to speed, in the mean time, as a financial institution you simply cannot have your IT system incompliant, even that means having a less security practice.
I think it's accurate. There is no doubt about it. I also don't see that there is anything is wrong with it. I think you have simply internalized modesty memes, but that ultimately makes you ignore fundamental motivations which in turn leads to dysregulation.
Why not give each user or account on a given service their own warranty canary?
I also don’t think it’s interesting long term. It may be interesting to learn cooking but once you know a little you see quickly that going shopping is not that hard. I want either ready made foods or cook from scratch but not this weird thing in the middle.

Is this the “uncanny valley” of food preparation? Almost looks like it but not close enough.
> That’s where making one-off meal kits available at retail locations like grocery stores and membership clubs comes in; according to Seifer, moving beyond the mail-order subscription model seems pivotal to meal kits’ long-term viability.

This is the money quote. The people who subscribe to these things and figure out cooking is not hard and just requires a bit of initial guidance are almost certainly going to keep recipes and do their own shopping. And now that it's proven viable and so many supermarkets deliver groceries, they're going to swoop in and eat mail-order kits' collective lunches.
In non-sequential order. :)
You absolutely will, because very few people's personal moralities align with our societal ethics. Laws _generally_ align with what we have found to be ethical, but they lag behind and there are plenty of cases where they've diverged.
Can I claim "K's rule"?

Every (web) technology will eventually be called a PHP reinvention.
Perhaps their definition of their customer has evolved to focus on resellers/manufacturers, and we, the public consumers, are simply a crop to be farmed?
But you aren't paying for the editors and only a fraction of the donation goes to covering server costs. The Wikipedia project does not need your money and the foundation has enough money to survive indefinitely if they'd cut costs.
> a handful of flawed or limited studies

Compared to the studies which have been done to support the current eating guidelines the studies on fasting have been wide and deep. Most current eating guidelines are based on a mix of "we though it sounds good", "everyone knows that fat is bad", "my friend from coca-cola told me that and he knows things" or "someone paid me to do the study and made it pretty clear that my future funding depends on the results".
FWIW, we use Gitlab to help protect against this: we use its CI scheduling to rebuild our base images on a regular basis. Our Docker image builds are managed via CI, and we have a schedule set up to rebuild them with --no-cache. This keeps our base images fresh without slowing down most marginal builds during the workday.

You could obviously do this with cron, as well, but if you already have a CI pipeline managing your base images, it makes sense to set up a recurring build.
i.e. as long as it exposes all the facts/criteria it uses to arrive at each decision/verdict or reallocation of resources/manpower.

Of course, every rule or law would have to be initialized by humans in the first place.

Simplified example: "Murder is bad.", but after the AI observes enough cases where the victim attacked the killer first, it may present "But not when in self-defense." as an amendment, along with its reasoning, which again would have to be democratically approved by humans for it become a default condition.

It could even retroactively apply such new rules to all past cases, better than a human-run system, fixing wrongful convictions etc.
Meal kits are doomed but fully prepared meal delivery services like freshly are here to stay. Even if freshly itself dies I really think Amazon is going to expand into the pre-made meal market.
> What disturbed me the most was how many Cuban scientists I met who truly believed the Cubans would cure cancer for the entire world if it weren't for the American "blockade."

But don't these scientists know that they are way to lazy to cure cancer anyway because in socialism, people have no motivation to work?

> When I was there (in 2014 or 2015?) Cubans were allowed to "own" real estate but the government could force them to "sell" the property at any time, at the price specified by the government, and only to the seller selected or approved by the government.

AKA eminent domain?

> https://www.dailymail.co.uk/travel/travel_news/article-52738....

Seriously?
Exactly. This is an area I think many technologists tend to glance over: "They paid how much to a 'brand consultancy' to replace an M with a P??"

And while these types of things can get "fluffy", if this branding change results in just a small percentage of additional people becoming more aware of the broader goals and projects of Wiki(m/p)edia, it was money well spent.
Exactly!

The fact there is a boundary between what is reliably and repeatedly observed in reality, and what science can explain means we need more people doing experiments on themselves to give scientists more data. If everyone tried enough Remote Viewing to have success (not that much work) the materialist paradigm would crumble.
What's so odd about Voodoo being popular in Cuba is that Communism, the philosophy of the government, is militantly atheist (as Marx said, "religion is the opiate of the people.")
I think you can be called gin if you're flavored with any botanicals, doesn't specifically have to be Juniper.
> That being said you call it a health tool, and then say it produces stress, which has been documented as being extremely detrimental to health.

The dose makes the poison. Not enough stress has been shown to be extremely detrimental to health too (Fitness training produces stress. Take your pick of studies showing that you should still do it).
This line of reasoning is insane to me. For the most part, police act as a deterrent against crime, not as an actual barrier. Police tactics are geared toward making them more of a deterrent, making their presence felt by everyone around as much as possible. So calling the police because you've just been robbed is not likely to achieve anything (I've had two cars stolen, and in both cases the police never achieved anything).

If police aren't a deterrent from car theft (as carjacking is a pretty common crime), then we are encouraging that behavior by doing nothing and calling the cops. Conversely, if the average person, during an attempted carjacking, opened fire on the attacker, it would be a major deterrent. There would be almost no repeat offenders (I have been shot at, and it is terrifying).
> If you use it on multiple windows, doing `scratchpad show` multiple times causes one window to appear, then disappear, then next window appear, then disappear... and it does this across workspaces.

You need to create a keybinding that calls `scratchpad show` using a window class qualifier to target the app you want. That's the key to making the scratchpad useful.
Indeed, good point.

The dates there for Russia etc are accurate, but seem very late for the western countries -- in some places it essentially disappeared centuries before it was legally abolished. (I don't have a great link but e.g. "Serfdom was de facto ended in France by Philip IV, Louis X (1315)," https://en.wikipedia.org/wiki/History_of_serfdom )

Barbary corsair slave-raiding also only stopped in 1830, when France decided to invade.
Yeah, it would have to be someone 'borrowing' or stealing a laptop that's running and has you logged in.

If I'm reading it correctly, any newer Mac with T2 chip and full disk encryption would not allow data to be exfiltrated unless a user were logged in.
Great Job congresswoman! This is a good start, but more has to be done. Equifax and the others should not exist imho. Where is the accountability? These entities have to much power and too much data on us.