skysight-inc/HackerNews huggingface dataset:
This is exciting for quite a few boards and notebooks, notably the new Pinebook Pro (RK3399) and the Asus C201 (RK3288) both benefiting from the Panfrost driver.

I wrote a bit a while back on Reddit regarding my experience with the C201 and Linux: https://www.reddit.com/r/linux/comments/bebm93/linux_on_asus...

Now with open 3D acceleration, the last remaining bit of proprietary code on the C201 is the WiFi chip. Not sure how much of an impact it'll have, but when Cypress bought Broadcom's wireless division it released the datasheet for this and many other chips (PDF): https://www.cypress.com/file/298141/download

Alyssa Rosenzweig is making amazing progress with Panfrost working at Collabora. Panfrost is now working with GNOME, two months ahead of schedule!: https://rosenzweig.io/blog/gnome-meets-panfrost.html
As so often, there’s a related XKCD, but not of the usual type: Time[1]. It’s probably the most ambitious XKCD project so far, with thousands of thoroughly researched panels.[2]

1: https://xkcd.com/1190/ and http://geekwagon.net/projects/xkcd1190/mobile/

2: https://blog.xkcd.com/2013/07/29/1190-time/
But do you actually believe the official version of events for Salisbury?
If you really want a minimum implementation that you can understand for educational purposes, perhaps you could try djb's original Curve25519 library to compute a shared-secret. It's extremely simple, a Diffie-Hellman exchange can be implemented within 30 lines of C by calling the library. I think nobody really uses it, but it's the reference implementation of the Curve25519 paper. WARNING: This implementation is probably not secured against side-channel attacks on a modern CPU, offline-use only. https://cr.yp.to/ecdh.html

1. Computing secret keys. Inside your program, to generate a 32-byte Curve25519 secret key, start by generating 32 secret random bytes from a cryptographically safe source: mysecret[0], mysecret[1], ..., mysecret[31]. Then do

mysecret[0] &= 248;
mysecret[31] &= 127;
mysecret[31] |= 64;

to create a 32-byte Curve25519 secret key mysecret[0], mysecret[1], ..., mysecret[31].

2. Computing public keys. To generate the corresponding 32-byte Curve25519 public key mypublic[0], mypublic[1], ..., mypublic[31], call

curve25519(mypublic,mysecret,basepoint);

where the constant basepoint is 9 followed by all zeros:

const unsigned char basepoint[32] = {9};

3. Computing shared secrets. Given someone else's Curve25519 public key hispublic[0], hispublic[1], ..., hispublic[31], call

curve25519(shared,mysecret,hispublic);

Done, you've just got a shared secret. Then you can use standard tools like OpenSSL or "gpg --symmetric" to encrypt the data using AES with that key.

But seriously, just use libsodium. It has received extensive audits, its abstraction model is easy to use and understand, while mistakes are hard to make.
> More and more forests are deforested for books.

[citation needed]

More and more forests are deforested for agriculture - for both growing plants and pastures for animals. Paper production is a combination of forest-sourced trees, but also recycled paper, wood waste from other industries, and trees planted specifically for paper manufacturing. I get conflicting breakdowns of the proportions, but a random source[0] I'm looking at says something like this:

"However, 39 percent of the fiber used for papermaking comes from recycled paper. Most of the remaining wood is obtained either through forest thinning (removing slow-growing or defective trees) or from lumber milling residues – materials that otherwise would go unused. Only 36 percent of timber harvested in the United States is used directly to make paper and paperboard."

That's not to say we shouldn't reduce our paper use, but I wouldn't sweat it too much when it comes to buying that book (especially if it's print-on-demand), or printing that article or code listing. Paper is a ridiculously powerful cognitive and productivity multiplier, still unmatched by digital solutions. I'd argue that paper use might be essential for humanity figuring their way out of this crisis.

If you want to cut down on wasteful paper use, fight advertising. The subsection of the industry dealing with physical advertisements is literally one giant machine for moving cellulose from trees into landfills.

--

[0] - https://theconversation.com/is-the-paper-industry-getting-gr...
It was a Rails vulnerability (mass assignment) that the attacker used to accomplish this. It’s long since been fixed and doesn’t demonstrate an inherent security flaw with the “ruby world.”

https://gist.github.com/peternixey/1978249
> It needs to ask the system name resolution interface to resolve a name for it, and then run with what it is given

Despite me agreeing with your need for hosts to work, your suggestion here wont. As the others have mentioned the hosts integration is down way down deep in the code (libc and kernell.dll as far as I know) and is basically an automated part of getting the address of a name, which does a proper DNS lookup automatically (if not found in hosts), meaning DoH wont get a chance.

This means that FFox will need to independantly look up and parse the hosts file as part of it's DoH lookup, basically mimicking what libc is doing on 'nix boxes. It's what the other GPs are mentioning as a no-go/non-starter, whereas I suggest it's not hard to parse a text file.
Ladders ~DevOps Cloud Engineer ~New York, NY~Onsite~Fulltime

Ladders is the leading $100K+ professional community. We focus on the careers, professional growth, news and office lifestyle of the top 25% of the workforce. Our mission is to “lead the leaders” -- our 10 million members represent the leading people in their companies, their communities, and their organizations.

You’ll be deploying and configuring production systems while engaging in a variety of projects in an AWS environment.

Tech Stack: Kubernetes, Docker, Jenkins, Elasticsearch, Logstash, Kibana, Kafka, MariaDB, Couchbase, Bash, Java, Clojure, Scala, Selenium, AWS, EC2,

We’re a collaborative, team-oriented environment in FiDi with beautiful offices overlooking the East River.

Apply here https://jobs.lever.com/ladders or contact kpaolitto@theladders.com
> Conversely, if someone went to jail over this, at a net cost to the UK taxpayer, would the British Government be able to claim expenses from around the world? Has every other government that has citizens using BA chipped in to pay for the ICO?

I would think that is enough for at least 3,660 man prison years - so I guess a lot of people are going to go to jail for something which was just a mistake. But then again not surprising with UK being so dystopian and all. Glad I don't work there.
> It's been interesting watching the "I should work for a startup" to "I should work for FAANG" over the past decade.

I would be interested in your thoughts on this. Is it because of salary, opportunity or security?

I am outside the Bay area.
Which is great because they use something different than Chrome or Chrome mod. Same with Safari, they help slow advance of walled and closed Googlenet.
Mid-Year Certification Value What's Up and What's Dropping
Yes, so I googled "Curve25519 libsodium" and I still have absolutely no clue how to get this going.

I mean the first hit starts with this sentence: "Ed25519 keys can be converted to X25519 keys, so that the same key pair can be used both for authenticated encryption (crypto_box) and for signatures (crypto_sign)."

I have no idea what do to next.
What fruit starts with A and is found in red yellow or green? Please answer in 5 letters
Which is the most durable material for a table that I can select in an IKEA? They offer a variety of materials.
A friend of mine did something similar, went to Lowes and found a bunch of counter top someone ordered and for whatever reason didn't take at a steep discount, screwed it into the studs of one wall of his computer room and then used 2x4s in the front corners and another in the center of the center to act as legs. Sadly, now it is his boy's bedroom and he's no longer as cool.
From the article: “When e = 3, or a similarly small number, many things can go wrong.“

This seems to be an oblique reference to the attack you were referring to.
Indeed. If you're not a cryptographer then you shouldn't be rolling your own crypto. That includes selecting low level libraries, etc. You want a whole crypto system that's made by experts. Preferably one that's open to auditing.
So what is it? Just stop using RSA completely or stop rolling your own RSA? The article sends mixed signals on this, I completely understand the latter as bad but I have used the RSA framework within .NET to sign messages before and I don't recall it being hard at all.
I absolutely love these write-ups! Every time one comes out I read it immediately.

This doesn't jive with my recollection, though:

> The monochrome cargo vans of 1985 had improbably become the multimedia sports cars of 1993, all whilst sticking to the same basic software and hardware architecture.

I don't really believe that this was true until after the adoption of Windows 95 (and remember, Windows NT retained the older Windows 3.1 look for longer; well into the late 90s my college labs' Windows machines looked ancient). At the time, the Mac was the closest thing to a multimedia sports car (with Amiga being the hand-crafter multimedia Rolls Royce, to carry the metaphor too far): it was attractive and ran well. Those of us who used Macs back then look at Windows 3.1 and thought it was a joke; we didn't even think DOS was worth noticing.

In retrospect, I actually have a lot more respect for DOS now than I did then: given what it was, it wasn't actually bad, and it enabled some neat programs. If I were teleported back in time, I might get a DOS box. But there is no way I'd want to use Windows 3.1 again — give me a System 7, 8 or 9 Mac anytime!
Like Google Assistant?
These two articles might help:

https://paragonie.com/blog/2019/03/definitive-2019-guide-cry...

https://latacora.micro.blog/2018/04/03/cryptographic-right-a...
I didn't follow the thrust of the argument.

One obvious response, with recent news in mind, is "I'm protesting against the US treatment of foreigners in concentration camps." Or "war with Iran" or any number of things with actual protestors.

So, quoting the end "I leave with this question once more: What are you protesting against right now? And what do you need to embrace it? "

What does it mean to embrace concentration camps? Or to embrace war with Iran?

It's like there's a different definition of "protesting against" than what I understand.
I stand by words mean things. If you can recover in any way, it's not a brick. In this case it is a boot loop and there's no reason they should not have used boot loop to describe the condition.
confirmed: Microsoft Will Join the Private Linux Kernel Mailing List
GraalVM: The holy graal of polyglot JVM?
Backup and updating the core applications.
Great to see this, as I'm leaning the Fulcro/Pathom.

The idea of server-side rendering is fascinating. With correct abstraction, there's no extra code required for every component at all. And there's no more ad-hoc client-side script in order to rescue back-end HTML anymore.

It's just annoying currently it's only easier on Node.js until WASM decades arrives.
That’s true to an extent, but “almost exclusively” gives very little agency to the people. India, Pakistan, and Bangladesh were colonies until the middle of the 20th century.
I would argue that the comment was more about long term crypto vs one choice.

A random person on the internet advising which curve to use (which I don't even know what that is) can be insecure as well.

And even if it's a secure choose now it may not be in a few years.
Yes!

To be fair the official documentation Dockerfile best practices does mention this (although it also gives contradictory advice).
Voice of Optimization (2018) Explain optimal strategies
For India location, we are currently hiring RoR developers, having experience between 1 to 4 years.

Let me share the career section with you so you can easily navigate the current requirements.

https://www.spaceotechnologies.com/careers/
See also video of presentation: https://www.youtube.com/watch?v=NbE5huZS-wU
Not only is this literal kiddy level sh*t, it's not even machine learning!
Something similar has been done. The Three Gorges Dam in China. https://en.wikipedia.org/wiki/Three_Gorges_Dam It caused huge ecological change and Chinese government force relocated numerous residents.
That's why you develop in Common Lisp. The language specification is 20 years old and is never getting updated. Your software will work forever!
This was a boot loop condition. The person reporting it clearly knows this and yet confused the issue by saying "bricked." Bricked is non-recoverable.
Something about a lake on a hidden island burried deep beneath the ice is really poetic.

Perfect setting for a children's book. Or a bond villain.
That's assuming the vehicle doesn't have other means of locating itself, such as GPS.
Not if you have a diesel car.
Weechat is king.
https://github.com/weechat/weechat
Early-Stage MVP: My Experience as a CTO
Yet another example of supply chain attacks. How do businesses seriously allow their devs to pull code from outside sources, it blows my mind. Npm, Ruby gems, etc etc etc.
While the rule for devs is, "never roll your own crypto", what is the authoritative resource for what we should use?
I did this too:
https://youtu.be/OtbXS2W_cbM
But I used a board covered with laminated white stuff (It came that way as part of a merchant display). It is the greatest top ever!
Best Confluence Alternatives in 2019
We've heard this before. Yes.
Developers using this may decide not to use this gem. Ruby gems in general may lose trust.

If the goal of the project is adoption than do not ignore that group.
How to Fix the Public Education System
Cost-benefit studies and the desire to privatise everything? Most of the proposed megaprojects were, like the Space Race, more demonstrations of national power than coherent plans. It's not a coincidence how China and the Soviet Union were big fans of megaprojects.

Not to mention climate change. If there is to be a megaproject, it has to be an anti-climate-change one. Otherwise we're engaged in the worldwide megaproject of making earth slightly less habitable.
Secure email provider Tutanota launches free encrypted calendar
Long live ADB and long dead Bixby. :-)

I don't have a Samsung phone, I read your page mostly so I could see what it entails. That was hilarious to read. Thanks for the good article!
>Okay, followup question -- when was the last time anyone saw the key change and actually did freak out?

Less than a week ago, a server of mine rebooted due to an unannounced power outage. This particular server just stores some backups and didn’t have proper monitoring, I didn’t know it had rebooted. Normally mere unannounced power outages have me shitting bricks, switching hosts or at least extensively verifying the pre-boot environment.

Trying to SSH into the box I received the host key mismatch error because the server boots into dropbear for LUKS. It took me a few minutes to figure out what had happened, but until I did, I definitely fully assumed that my host was up to something really bad.
Would a Java app, suit your circumstances?
http://www.econtalk.org/robin-feldman-on-drugs-money-and-sec...
As someone involved in the PKI ecosystem, the biggest thing stopping ECC from being adopted widely is:

- AWS, which has incomplete ECC support https://docs.aws.amazon.com/elasticloadbalancing/latest/appl...

> ACM supports RSA certificates with a 4096 key length and EC certificates. However, you cannot install these certificates on your load balancer through integration with ACM.

- Heroku, which is still RSA only https://devcenter.heroku.com/articles/keys

Edit: not sure why the downmod so I've added references.
I think this needs some clarification. From my reading of the issue the Modernizr library and its NPM entry were never compromised, instead the version hosted by BA on their website was overwritten by the hackers with one that exfiltrated the sensitive data from the payments pages.

Not only is the version of Modernizr used on the BA website extremely old (2.6.2 was released in 2012) but for hackers to be able to modify hosted scripts demonstrates an extreme lack of care; I wouldn't be entirely surprised if they just hadn't updated the CMS hosting the script.

Some people have been saying that anyone could be caught by this but I do think that the lack of process to allow this sort of thing to happen warrants this sort of fine.
It depends, In my last big company (>2000 tech + product), engineers would switch teams every 15 to 18 months on average. Ofcourse there were more desirable part of the organization, where switches would be much less.
> I can clean my dishes in 10litres of water. On the other hand dishwashers on an average requires 12-20 litres of water. The tip is do not use running tap water.

What's the correct technique to ensure the dishes end up being clean, and not just thoroughly immersed in a bacterial growth medium that's made of water and dissolved food? Or am I being too paranoid about sanitation here?
Sound doesn't travel in a vacuum.

Bass traps work by eating up the energy in pressure waves that hit them, there's a lot of waves that don't hit them.

Which means that bass traps are only good for minimizing resonances inside an enclosed room, not to stop bass from reproducing through walls or materials.
Handling Missing Data for a Beginner – MCAR, Mar, MNAR, Imputation Methods
I think this would be a good starting point for what you are trying to achieve: https://libsodium.gitbook.io/doc/public-key_cryptography/aut...

The first example shows both sides of the communication. The public keys are shared (but you want to make sure that you have the correct one, for example by meeting the recipient in person and comparing the keys).
The library defaults in libsodium are already chosen to be secure (using Curve25519 and secure algorithms).
"Reversal of control force", not "reversal of controls". There's also section 25.175, which stipulates "The stick force curve must have a stable slope at speeds"... and gives speed ranges for climb, cruise, approach, and landing. For example:

§25.175 Demonstration of static longitudinal stability.

Static longitudinal stability must be shown as follows:

(a) Climb. The stick force curve must have a stable slope at speeds between 85 and 115 percent of the speed at which the airplane—

(1) Is trimmed, with—

(i) Wing flaps retracted;

(ii) Landing gear retracted;

(iii) Maximum takeoff weight; and

(iv) 75 percent of maximum continuous power for reciprocating engines or the maximum power or thrust selected by the applicant as an operating limitation for use during climb for turbine engines; and

(2) Is trimmed at the speed for best rate-of-climb except that the speed need not be less than 1.3 VSR

These are transports, not fighters. The basic idea is that you want it to be harder work to make a sharper maneuver, and want the aircraft to naturally level out. If the force required decreases for a steeper pitch/roll/yaw, then the plane will naturally want to intensify the maneuver. It's like a car with oversteer--let go of the steering wheel and it will make a sharper turn. As the article cited said, the FAA and Boeing's test pilots weren't happy with the yoke forces in certain situations.
For general tech news Hacker News serves me well and is basically the only site I browse on a regular basis. I also monitor a couple of other specialised feeds, e.g. https://modeling-languages.com and https://www.allaboutcircuits.com.
It's not simply that they were designed to be secure - they utilised mathematically justifiable constants.

See https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number.

There's actually a counter example on that Wiki page - the highly complex numbers used in the NIST curves, for which no path to derivation was publicly provided.
Is there a good reason for them not to launch a bug bounty program?

The cost of doing so would be significantly cheaper than any future fines, and would reduce the chances of future breaches.
Fair enough, but if you're advertising online with any of the major companies today, there's no way to do so effectively without instrumenting at least your landing pages and conversion pages with advertising tagging.
The E programming language [0] for secure distributed computing. A language that makes it very easy to reason about what permissions your code actually has, by implementing the object-capability security model.

[0] https://en.wikipedia.org/wiki/E_(programming_language)
They're legally required to because of money laundering legislation.
For example, I am of the leaning that one line should do one thing only, and should be explicit

I agree. And this is actually the very reason why I can dig into a 5 year old, reasonably complex bash script of mine and successfully maintain it.
Miraculous VS Code Tools for JavaScript Developers in 2019
Bond yields inverted. If the recession doesn't hit in 2020 economists are going to be studying this to extreme; because that's a 1:1 measurement for predicting recessions.

Canada for example has around 170% household debt to disposable income. If it was at 100%, it means the interest on the debt owed is exactly the same amount as how much you earn. You don't get to spend and you don't get to reduce your debt, you are only paying the interest.

At 170% you're incurring significant more debt every year and you have literally no chance of reducing your debt.

Household debt typically is mortgage, car loans, and student loans.

What are the 3 major articles you constantly hear about?

Housing is unaffordable; aka mortgages are too expensive.
Car manufacturers closing plants and laying off significant numbers of people.
How about the crippling student loans? You know the debt you literally cant even bankrupt.

There's a certainty that the recession is coming in 2020. The thing that is interesting is multiple times now in history the governments of the world prolonged or attempted to prevent these debt cycle recessions. It 100% of the time has made the situation worse. Usually resulting is far worse recessions.

There's also another factor. There is a depression every 50-100 years or so. We're due for one.

There's 1 way to potentially see a depression coming. Social tensions spike far worse than during a recession.

Don't know if you're following US politics... I'm pretty sure we are seeing this right now.
You said SVG twice now, but I don't see what is obvious about it.

It's an XML document that should be easier to figure out than a raster image format such as jpg or png.
Is Google captcha some kind of sick joke
Is google captcha some kind of sick joke.

It pops u and asks me to pick all the fire hydrants. I do. I do. I really really do. I pick every last fucking one of them. Google craptcha ignores this obvious fact and now asks me to pick all the traffic lights. Im a grown assed man. I know what a traffic light looks like. Now I pick all the fucking traffic lights every blasted one of them.
Now google cuntcha ignores me and torments me with yet a new test. Pick all the street crossings. I know what a street crossing is. Im still a grown assed man. Those black and white colors give them away.i pick them all. And Low and behold big fucking surprise google tortcha ignores me and throws up a new test.

What the fuckedy fuck fuck kind of fuckery is this. What sick fucks came up with this. Please for the love of god and all thats holy . Please get google captcha or google gotchahaha off your websites. Its a sick joke by google to drive your users insane.
There are a lot of differences that Samsung adds into their firmware that many people seem to like. Particularly if you get one of the Galaxy Note series devices, it goes well beyond what I would consider "very limited differences."
For the most part I just want it to be less than half-broken. And to have buttons for things that are IRC commands. In Thunderbird the compose window has white text on a white bg at the moment, for instance.