skysight-inc/HackerNews huggingface dataset:
> Adam Caudill, the security researcher who blogged about the mass misissuance last weekend, pointed out that it’s easy to think that a difference of 1 single bit would be largely inconsequential when considering numbers this big. In fact, he said, the difference between 2^63 and 2^64 is more than 9 quintillion.

Okay, but, that's because 2^63 itself is more than 9 quintillion. Where the search space was previously 18 quintillion, it's now 9 quintillion. Both of those are "big". The attack is 50% easier than "theoretically impossible before certificate expiration," which should still mean that it's impossible.
Hmm, the algorithm used was formal proven secure:

https://people.eng.unimelb.edu.au/vjteague/UniversalVerifiab...

> How can there be a trapdoor when the system has been formally proven secure? Any formal proof of correctness for any system makes some assumptions that become axioms in the formal proof. Scytl’s formal proof of security [Scy18] simply models the mixnet as sound, based on an informal interpretation of Bayer and Groth’s security proof. It does not model the proper generation of commitment parameters. We do not see any reason to believe there is an error in Scytl’s proof, but when the axioms are mistaken the conclusions are not valid. This does not mean that formal proofs are not valuable—at an absolute minimum, they clarify assumptions and explain the reasons for trust—but it does mean that they are not a substitute for broad and open public scrutiny. It is quite possible that there are errors in the implementations of other cryptographic primitives, that their details may not be modelled in the formal proofs, and that they may affect either privacy or verifiability.

There wasn't a better path to translate the proof into an implementation? How was the algorithm translated into code (Java I think)?
How? They changed their mind. No big deal. I'd say what it shows is a commitment to intellectualism above superficial factors like a prior company announcement. To do otherwise would be path dependence. So I see strength, not weakness.
Hope they get their costs under control though. That's the key to everything in manufacturing.
Node.js and JavaScript Foundations Are Merging to Form OpenJS
Oat milk is a pretty hot milk replacement, at least on the east coast. My grocery store has trouble keeping up with demand.

I’d be curious in a study comparing environmental impact of soy milk vs dairy. I suspect soy would still come out ahead, given how much cows eat and drink (not to mention what they excrete).
It's no more of a joke than assuming that software developers are going to take ethical considerations into account by default. Categorically dismissing the whole field of humanities seems like the arrogance of ignorance.
Sooooo all the big players depend on one CA PKI package: EJBCA - is that not a major concern ?
They're "the same cost" because anyone with account to $1M or $1B to break a cert generally also has access to $2M or $2B. No reasonable threat model includes defending against attackers that have 50% of the necessary capital to conduct an attack but not more.
I have to be honest, it sounds absolutely absurd. What kind of definition must a company be using for "senior" if they're willing to hire someone into that title with no prior professional experience? It's almost certainly title inflation.

Note this is not a comment about the quality of Lambda School. I've heard good things about it. But it's almost tautological that someone shouldn't be eligible for a "senior software engineer" title after they've graduated Lambda School, just as they shouldn't be eligible for it after they've graduated university. Such training is necessary but insufficient for being able to meet the level of responsibility you're given at that title.
It really does not matter what spin Boeing comes up with regarding the cause of these crashes.

The reality is in a very short space of time two 737-MAX have fallen out of the sky.

You only have to look back at the McDonnell Douglas DC-10 to understand once a plane gets a bad reputation, it is doomed.

For an example of how this can go bad so very quickly, here in Australia this issue has become so new worthy, it's now been revealed one our major carriers is planning to introduce the 737-MAX in November.

I suspect just that little fact is going to become a major headache for that particular carrier.
Fantastic work. You and the other founders should be very proud of what you’re doing.

This is exactly what the world needs more of. I recommend this to anyone looking to switch careers.
You really believe that a person with the same intelligence and drive who goes to say Stanford vs a mid tier state university will have the same outcomes in life? Unless this person has an exceptional will, this will never be the case. The kind of network that you will probably build at Stanford without noticing is vastly superior to the one at a mid tier state university. You probably personally know many people who've started up XYZ company, work for FAANG, top hedge funds, scientists etc... No one is saying that life is easy for a Stanford graduate, i'm sure any ambitious person will face a ton of rejection in their life time regardless of where they went to school but a lot of doors will open for you in your life time just because you went to Stanford vs going to UC Irvine.
we're talking about a plane model that is only 2 years old?
There was also a time just a few years ago when evangelists claimed JS/CS/etc. were just as fast as native (some said faster) and blasted you for suggesting otherwise, even when it was clear as daylight this was blatantly false. This mantra also suddenly just faded away once native compilers for these gained popularity. I guess reality hits you after some time.

Now I see a similar issue with security experts preaching that merely possessing a single piece of software with a single thing they classify as a 'vulnerability' implies you will be murdered within the next 24 hours, and it seems they'll happily DoS your computer, get you fired from your job, take your second newborn, and blow up your computer in your face if that's what it will take to make you finally feel real danger. Not sure why it takes people so long to see that reality isn't black-and-white, but better late (hopefully) than never.
I've noticed a trend in older folk where they get halfway into a sentence knowing they don't know the name of what they are referencing only to ask those around them for help identifying the reference on the way to making some other point, e.g., "That's like that time in It's a Wonderful Life where _______, gosh, I can't think of his name. What was the guy that was in that movie? Oh yeah, James Stewart. That's like the time in It's a Wonderful Life where yada yada yada"

I'm hopeful that voice recognition assistants will help the burden during Christmas visits :D
That company has hired 20+ Lambda School grads, two hired as senior.
Just to be clear - "mississued" in this case doesn't mean they were issued to someone who doesn't control the domain. The issue is they were issued using a 63-bit serial number instead of the minimum 64 bits. (The software these CAs were all using was generating 64 random bits, but setting the first bit to zero to produce a positive integer.)

The reason CAs are required to use 64-bit serial numbers is to make the content of a certificate hard to guess, which provides better protection against hash collisions. IIRC this policy was introduced when certs were still signed using MD5 hashes. (That or shortly after it was retired.) Since all publicly-trusted certs use SHA256 today, the actual security impact of this incident is practically nil.
US high school senior here. Made a throwaway for this.

Seeing this makes my blood boil. Not only is it essentially an open secret that the admissions process actively discriminates against Asians and other high-achieving ethnic groups--and gives a massive leg up to legacies, children of donors, etc.--these people thought they were good enough, by virtue of their wealth, to bribe and cheat their way into these top universities (and some of them, honestly, shouldn't even need cheating to get into!)

I've worked my tail off for the past four years (if not more) to weasel my way past the racially biased admissions office, and now I see this--brazen corruption from the elite whose egos ride on their trust-fund children's college acceptances.

After my personal experience and now this, I've come to a conclusion: the college admissions process in the US is fundamentally broken. This case isn't just an aberration--it's a pattern.

I shudder to imagine just what my children will have to go through.

</rant>
"mail fraud" is a catch-all charge that most fraud cases fall under. Think of it like a fraud * wildcard
This is the CAB Forum rationale for serial number entropy[1]:

> As demonstrated in https://events.ccc.de/congress/2008/Fahrplan/attachments/125..., hash collisions can allow an attacker to forge a signature on the certificate of their choosing. The birthday paradox means that, in the absence of random bits, the security level of a hash function is half what it should be. Adding random bits to issued certificates mitigates collision attacks and means that an attacker must be capable of a much harder preimage attack. For a long time the Baseline Requirements have encouraged adding random bits to the serial number of a certificate, and it is now common practice. This ballot makes that best practice required, which will make the Web PKI much more robust against all future weaknesses in hash functions. Additionally, it replaces “entropy” with “CSPRNG” to make the requirement clearer and easier to audit, and clarifies that the serial number must be positive.

[1]: https://cabforum.org/2016/03/31/ballot-164/
Why the Amazon River Can't Be Crossed by Bridge (2018)
We also have a part-time program that's for people who need to keep their 9-5 job while going to school.
I'm working on a file sharing product, for the niche use case of sharing documents between family and professional providers (lawyers, accountants, etc).

Documents are mostly emailed to recipients at the moment (unless they're too large, in which case... um....). The main problem we see is that you end up storing documents in email attachments on your email provider, and using email search tools to try and find documents.

Would this end up the same, only with all documents ending up in the Downloads folder?

Am I wasting my time working on creating a cloud storage sharing solution, and be better working on a method of organising files on the drive, that can also send them to other people?
Then you had a bad time & you commiserate over drinks?

Basically every class I had in college was graded amongst your cohort. Is that odd?
As a non technical person, who is about to fly an 80 ton vehicle for extended distances, local backups of WiFi dependent data is not likely to be a major concern.

Especially if (a) it’s not part of your extensive checklists, which would reasonably be expected to be included if it was important, and (b) you’ve lost WiFi in other planes before without losing your flight plan.
None of the people I've encountered--save one--ever came back to me saying they were not.
The wealthy have the income to test prep for high scores. The poor don’t necessarily have the time or money to focus as much on test prep as the rich. Your method may exclude a population of the poor.
When you are born into privilege (kid of a celebrity), you are afforded the best private tutors and academic resources that money can buy during you academic career, starting from childhood. Assuming you are born with a neurotypical brain, you are at an advantage over your less wealthy peers from day one whether you perceive it or not.
I felt sad...
CT principles would surely demand they do some public facing declaration?

The 'pull the certificates from the browsers' thing demands people from these companies maybe recuse themselves from conversations?

(this is public trust process stuff, not technology per se)
Typically with crypto you want to stick with one major industry standard implementation that is strenuously verified. It's probably more concerning if everyone's using their own.
that's a shitty incident report and a sad thread if there's this kind of activism internally while shit is on fire.
the federal penalties for crack were indeed more severe than ordinary cocaine, and black legislators championed the laws that made it so:

https://slate.com/news-and-politics/2016/02/why-many-black-p...

crack cocaine did incredible damage to urban black communities, and the laws were a reflection of that. obviously the laws went on to do incredible damage in their own right as well.
This is laughable. As they scale, they will get 10-20% deadbeats that avoid paying, minimum.
Yeah. You just explained why I haven't talked to hardly anyone on Facebook chat anymore. I don't know that they're actively wanting to chat, just that they're on Facebook, possibly just passively browsing things. I still ping people on Facebook chat, but only if I need to ask them something or want to share something I discovered with them specifically. I used to chat with several people every night in my youth. I don't have quite as much time to do that anymore, but I do have some time. I'd love to know who actively wants to talk with people.
I think that's a slight misrepresentation; developers don't want to invest the (significant) effort to run without JS, and some end-users are unwilling to take the risks with allowing arbitrary code execution in their browser. But I doubt that developers (generally) don't want to support noscript; if it were 0 effort than I expect it would be common. And such users aren't happy that they can't access a lot of sites, they just find the tradeoffs unacceptable.

That said, aside differing biases I'm not convinced that we actually disagree.
Let's not let the minority become the rule. I have only had one person ever come back to me claiming they were a non-native English speaker when having made the mistake over many years of correcting people.
You might not have heard about European universities (though maybe that's just because they tend to be named by city, so ETH Zürich, Paris etc. doesn't stick as a university name like "Harvard" and "Yale" do), but you probably have heard from people at those universities: Albert Einstein, Marie Curie, Werner Heisenberg, Nils Bohr, ...

I didn't pick contemporary names because the closer you get to today, the less likely you are to know such names unless you are specifically interested into their specific field. You can look them up, though.

No doubt American universities are not less prestigious, but to think that nothing of relevance happens outside of the US, well... You might have heard of CERN at least. ;)
I think it's because mail used to be the predominate means of interstate commerce so most federal fraud charges would focus on mail naturally due to volume.
All directions? No idea.

Each house has a ~circular track and has a different frequency? Then unless you're asking about right this second it's the two houses on the adjacent tracks, or whichever one of those has the closest track to mine.

They live on that ring. It's really easy to figure out neighbors with concentric rings.
Syllabuses are here, fyi: https://learn.lambdaschool.com
I for one am COMPLETELY SHOCKED that rich parents are able to get their kids into top colleges using their money and influence. Wow, how long has this been going on without anyone realizing it? Wow.
This is a great video that does a concise and understandable of the main theory for the issue that occured on the LionAir flight: https://www.youtube.com/watch?v=zfQW0upkVus

It was very helpful for me to understand exactly what "runaway trim" meant. Essentially, it's a force (down or up) on the elevator on the horizontal stabilizer. The pilot still controls it from his yoke, but the more trim applied the more it pushes the result in a given direction. If the system applies trim consistently to push the nose down (to avoid what it thinks is an imminent staff), it will progressively more difficult for the pilot to counteract that and pitch up. Eventually, it's too much to handle.

This situation should be easily detectable, from what I understand, due to large wheels moving visibly in the center console, and the pilots can counteract the trim in a known procedure.
I highly doubt any of them will experience any negatives from this. The rigging just goes that deep in society. I doubt the costs will outweigh the benefits. This will continue just with different coordinators.
The big issue is that the app store rules forbid it.

> 2.5.6 Apps that browse the web must use the appropriate WebKit framework and WebKit Javascript.
AIM was a walled garden too wasn't it?
> since they purchase the product upfront.

That's not actually how retail works. Products are shipped to stores first, then are sold, and only 1 to 3 months later are the vendors paid.

Unsold products are simply returned with no risk to the store.

On top of that vendors will PAY stores for better shelf space, and will even be willing to stock the shelf, for free, for the store.
Facebook Reverses Zero Hedge Ban, Says It Made a “Mistake”
I use Hangouts to chat with people via my desktop over SMS. Only with my core group of friends though. I used to chat with all sorts of people. There's this one random guy that pings me whenever I pop on Steam and if I'm not busy I'll chat with him for awhile.
lol this needs more visibility
Why would what someone’s family did change anything about if a student deserves anything?
Hi p1esk, RNNs can be more tolerant to noise because they can learn transient or dynamic attractors. If the inputs move an RNN into an attractor, small changes due to noise make little difference to the state.

Recurrence can help with robustness in some other very important ways as well.

Citations for this dates from the 80s and 90s. I don't know the best reference offhand. You could look at some old Hinton stuff if you're a fan. Lots published on this.
When I got my wisdom teeth removed, I regained conscience in the middle of sobbing. I remember feeling a strange disassociation because I didn't feel any pain or know why I was intensely crying.

During the procedure they split the roof of my mouth from stem to stern and had to stitch it back together.

When I got home I looked at myself in the mirror and realized I had a bad black eye.

I wish I could have reviewed footage of whatever cage match I was involved in!
Curious what he did with his life after USC given the windfall he received, any idea what he's up to?
Thats true.

One benefit of the old days is you knew all other participants were sitting in front of a desktop, with a full keyboard. You knew they weren't say: driving, or boarding onto a flight, or paying a restaurant bill.

A problem with features like "Apple allows you to SMS from Desktop" is you still must use lowest-common denominator conversational approach.

All these modern apps have greatly increased the frequency of our conversations, but overall lowered their quality.
The way that white supremacy works is that black people are penalized even in the small enclaves where they constitute a local majority. Note that the laws that punish crack (used by lower income black people) 100 times more harshly than powder cocaine [0] are federal in nature.

[0] https://www.aclu.org/other/cracks-system-20-years-unjust-fed...
Can you think of a better car analogy? I'm genuinely curious.
What’s the documentary?
> Then you had a bad time & you commiserate over drinks?

The dynamics are a lot more complicated than you make it seem.

> Basically every class I had in college was graded amongst your cohort. Is that odd?

I've also had classes that were graded on a curve. But that doesn't fully capture the dynamics.
You can always move to China
10% of a $50k net salary is far less than my student loan payments would be out of that same net salary.
This is I think what is very very close to the truth. Some pilots are trained on the MAX, but later, untrained pilots are arbitrarily assigned to these planes. I am not sure that even emails help - with the amount of newsletters, and ad mails we receive, this email might be missed, or even when read, its importance might be missed.
Beyond all of that, if it's a trivial change, click edit on the upstream repository, edit the file, save+Pr and you're done... the fork is all inline. I submit docs changes all the time right in the github web ui.

Cleanup for forks isn't always great, I can admit that, but you can create an org for temporary stuff, and just nuke everything there on occassion and put your forks there for temps.
This is why so many articles pick up on "the most dangerous cities" and St. Louis leads the pack but most of these "news" articles are oblivious to the city/county division. Most of the residents who would call themselves St. Louisans do not live in the city of St. Louis but do live in one of the 90 municipalities within St. Louis county--as I do. However, most of the crime statistics come within only the much smaller city limits.

There is a movement now to combine the city with the county which would make St. Louis the ninth largest city in America. Crime statistics, obviously, would no longer be headline "news" for tabloid journalism.
It doesn't have to be bribing others to take the exam for you. I heard that they write down the questions they got asked during the Verbal part of the exam and collect them so other students can memorize them and get good scores. It's been happening for quite a long time actually, a professor of mine told me the same when he went to school in the 80s or so.

On a side note, the notion that a private company conducts all these tests for profit in order for students to get admission into schools quite bizarre and laughable to say the least.
I love how people love saying Amazon doesn't have a monopoly in retail when that massive category includes the sale of all consumer (and some producer) goods.

Amazon has 70%+ market share in many sectors of retail, such as books. But because it's only a fraction of their business, it seems like nothing.
Suppose so but doesn’t it become one well to poison? It just surprises me a bit (mainly because I was NOT familiar with EJBCA and have moderate awareness of PKI)
They were thinking this is how you get ahead because that's how a lot of people get ahead. Not to be cliche about it, but there is rather a lot of corruption in the upper echelons of society.
NSW Electoral Commission confirms iVote contains critical Scytl crypto defect
TPG Founder implicated in college admissions bribery scandal
This reply wins the thread: https://twitter.com/Jozzzzef/status/1105479189334032389
Again and again, the problem with PKI is not the tech, but the agents. We need an authorityless solution.
that's a very interesting idea! let's build it :D
I believe you. But there is also significant title inflation at that specific company. There is no reasonable definition for "senior software engineer" which has qualifications that can be met from scratch in nine months. What are their "junior" engineers like? Do they have a title between junior and senior?

Like I said, this isn't a comment on the Lambda School. It's a comment on the idea that this occurrence isn't absurd, regardless of whether or not it's rare.
Flexible Machines Could Save the World - Veritasium [video]