skysight-inc/HackerNews huggingface dataset:
For what it's worth, DoubleFine put out a great version of Grim Fandango for mobile.
Yep! I run an LG V20, and I love the audio from it- it has a really nice DAC setup that's kept me from needing to buy expensive headphones / earbuds.
docker = bash script + unshare + MANY unneeded limitations

But the nicer packaging and simpler model make that new layer of abstraction useful.
None in that case - insulin is perhaps the worst specific case to cite. https://en.m.wikipedia.org/wiki/Insulin#History_of_study
I remember that in DVB-S (maybe T/C too?) streams there is a constant bitrate, with additional empty packets (PID 8191 in MPEG-TS). Removing those usually results in a ~30% reduction. But I can't imagine that Netflix or Amazon uses such null bytes.
That might be an interesting problem for a generative adversarial network. Train it based on some large corpus of faces and then refine it based on searching for the input vector that most closely matches the original image and then just change the pose in that input vector to generate a square shot of the face. In theory this would give you not only some generated face, but some reasonable space of facial features that the discriminator couldn't reject. I.e. beard / no beard if the chin was obscured.
This exactly. I wish the original article had this conclusion instead of trying to tell people how to "do it right", especially when the problem is people not understanding cryptography to a sufficient level in the first place.
> TLS 1.3 no longer supports RSA

This isn't entirely true, is it?

AFAICT it no longer supports RSA as a key-exchange algorithm as earlier versions did, but it certainly supports RSA authentication. The only systems that used that for TLS I've known in the last 15(ish) years were government systems that specifically wanted to prevent PFS in their logged connections.
Uhm, speed of light differences in a modified crystal lattice are constant nonlinearities reasonable to produce. They do not need high intensity light, but they would need additional circuitry for scaling. Plus the network would have to work on phase angle and not magnitude. Mostly Kerr effect (high voltage) and cross wave polarization (e.g. given Pockel's cell) are useful there.
Sunsetting Bosun (monitoring system) at Stack Overflow and Call for Maintainer
> Trail of Bits recommends using Curve25519 for key exchange and digital signatures. Encryption needs to be done using a protocol called ECIES which combines an elliptic curve key exchange with a symmetric encryption algorithm. Curve25519 was designed to entirely prevent some of the things that can go wrong with other curves, and is very performant. Even better, it is implemented in libsodium, which has easy-to-read documentation and is available for most languages.

(it's unclear from the text whether ECIES is implemented in libsodium or only Curve25519, the internet seems to believe nacl (/libsodium) implements its own superior variant of ECIES called crypto_box)
For not too much more, you can buy a shell bank in a much more established economy or had one created for you.

All those draconian AML rules on individuals make no sense in light of that.
Why your Indian e-commerce portal needs localization
Man, that is a long formula! Not something that would pop into my head while spreading nutella.
From what I read, the NSA has not recommended most crypto protocols due to quantum computing. However, they still recommend having a large key size as being one of the biggest factors in having strong crypto. So why not use RSA with larger keys?
Granted, I'm not an expert either.
Let me put a source against this so people don't state the obvious about large enough quantum computers not existing and such: http://blog.bettercrypto.com/?p=1917
nss-tls is "at the OS level". It makes getaddrinfo(), etc', use DoH behind the scenes, so applications are transparently migrated to DoH.

I think you missed the nss-tls README and think nss-tls is not at the "OS level".
The citizen scientist efforts are the best that internet has to offer , crowdsource scientific work by breaking it down into basics that can be quickly learned by the interested lay person and yet keep it interesting enough to get repeat engagement. I participated in this program and it was fun, though i enjoyed other such programs more like galaxy identification on Galaxy Zoo.
I've been doing this since the 90's: go to any home building supply store and purchase a "shower wall", same thing described in the article. I remember my first one was far larger than my entire wall, and it was $7. I just used screws to mount it.
I also did this at a visual effects company when I was hired, the staff thought I spend a fortune covering my office walls with whiteboard, but after I explained the entire studio soon was all whiteboards.
Yes. Stop entirely. Developers in fact MUST NOT use ANY crypto primitives directly. "If you're typing the letters A-E-S into your code, you're doing it wrong." You WILL do something subtly (or not so subtly) wrong and it won't be secure.

Use high-level constructs designed and peer-reviewed by cryptographers who know what they're doing.

Basically: use libsodium.
You seem to forget that Domain Name Resolution became a problem after the more generic Name Resolution (ie Novel/lanman/NetBIOS). The Generic Name resolution system used lmhosts, which became hosts to more easily associate IPs and names. [0]

> Originally these names were stored in and provided by a hosts file but today most such names are part of the hierarchical Domain Name System (DNS).

[0] https://en.wikipedia.org/wiki/NetBIOS#NetBIOS_name
the design is 100% Korean, the first project was produced at the Ukrainian border for 4 months in factories rented to the Tagaz group, then the group closed and the project was forgotten until we bought back the rights
It’s Official: This Is Now the Longest Economic Expansion in US History
I grew up with Sierra adventure games in the 80s and they hold an incredibly special place in my heart. I love reading these articles about what was happening behind the scenes so thanks for posting.

Despite my extreme level of nostalgia for those old games (I installed KQ3 a few weeks ago just to visit Manannan) I find them unplayable today. I think the last Sierra adventure that I honestly enjoyed was probably KQV. When I look at the list [0] of their releases I think the last Sierra adventure game I ever bought was probably Dagger of Amon Ra.

By about 1991/1992 I was beginning to move on to other genres. When more open games like Microprose's Darklands and Origin's Ultima 7, Ultima Underworld, and Privateer were released I switched over and never looked back. I haven't played an adventure game for more than a few hours since.

I often wish I could travel back to 1989 and sit down in front of my IBM PS/2 30/286 and fire up The Colonel's Bequest or KQIV and experience the enjoyment that I felt with those games one more time.

[0] https://en.wikipedia.org/wiki/List_of_Sierra_Entertainment_v...
>Fabre tells how as a boy in the 1830s, up until 7 he walked only barefoot and only wore year-long a ragged shirt that dropped to his knees;

This was still the reality for my grandfather and partially for my parents(in Romania villages), in villages most clothing were made by hand by the women of the house including planting and processing the plants for the fibers used.
Yes, I don't understand why he supposedly kept the account 'secret' (why not run two, one for the demo and one for... whatever else!?).
E.g.: Theaters don’t allow entry without tickets.
It may well be that the insurance companies are less likely to get their minimum security demands for agreeing cover ignored than the internal managers looking to spend more money on security.
My current driver's license photo is over a decade old and doesn't expire until 2023. At least when I renewed my license they didn't want to update the photo of me when I was 16 and just renewed it for 8 years. In theory I'll probably need to update my photo then, but as it is right now I look nothing like the photo on my driver's license.
> The common denominator in all of these parameter attacks is that the domain of possible parameter choices is much larger than that of secure parameter choices.

Parameter selection isn't any easier in elliptic curve land. In fact, by the point that I believe you can make an educated choice in elliptic curves, you can also make a reasonable choice in RSA parameters.

You have to:

1. Pick a curve. Which ones? You'll have to know. This article tells you to use Curve25519. Do you know if they're right? Not really. Is a Koblitz curve over GF(2m) a better choice? You sure can't tell. You'll have to rely on other people's guides, e.g. [1].

2. Pick a library that supports the curve. This can be easy if you're on the beaten path, especially in C. This can be very hard on off-beat languages, which are generally stuck wrapping OpenSSL (and then typically have a weird interface to match as a cause of having to wrap C).

3. Interoperability concerns: Sometimes you don't actually control both halves of the software. You'll also have to pick something that plays nice with other things.

And all of this is putting the cart before the horse. Programmers must first understand what kind of algorithm they need, only then they can make a choice of the actual cryptographic solutions, e.g. Crypto101[2]. I firmly believe that a basic working knowledge of cryptography is a hard requirement for a programmer that touches code going into production.

If by some ungodly anti-miracle you're stuck implementing your curve yourself, you'd better be hiring external help. Ideally, however, you can use an existing, respected library. What is a "respected" library? Well, now we're back to “you'll have to know”. Expect to spend upwards of a dozen hours getting to grips with the basics.

(Incidentally, public key cryptography has always been an implementation nightmare. ARX ciphers don't scare me as much and most hash functions seems fairly reasonable to implement, but public key cryptography is when the bignum math hell comes to bite you—and with elliptic curves, you also get “moon math”, as the article so aptly puts it, to go with it.)

[1] https://news.ycombinator.com/item?id=20382244

[2] https://www.crypto101.io/
Been doing this for decades. FOrget $100+ whiteboards. For < $20 have a 4X8 sheet or cut it down to any size you like.
Same here, especially considering the 3 men are alive and may read the title it's a bit rude.
It's doable for sure, but making an auto-posting bot for instagram isn't easy right now. How did he post without access to the business API, and I don't think the "Private API" is the answer, I've gone down that road and had a few accounts banned because of it. This is clearly just an attempt to boost their LinkedIn blogging ambitions.
Actually, if you use the SHA256 of the image as a reference for the FROM (ex: tomcat@sha256:c34ce3c1fcc0c7431e1392cc3abd0dfe2192ffea1898d5250f199d3ac8d8720f), and if there is no tag associated to that SHA, there is a chance that the Docker Registry will garbage clean it. The Docker Inc garbage cleaning frequency is not very documented.
Similar way that TicketMaster were attacked ... that wasn't fun.
Maybe if Hurd decide to rewrite their kernel in rust I would give a s@#!, but since it's still a none usable kernel after decades of debugging and development, maybe it's ripe for /dev/null ?
Lost Palace of a Once-Mighty Empire Unearthed in Iraq
Using tagged upstreams is a good idea as it puts you in control of forcing an upgrade.

Best combo is to pin to a specific tag, that you periodically update to the latest stable release, and also allow overriding via a build arg. Anyone who wants the bleeding edge, say for a CI server, can run a build with “latest” as the tag arg.
Trust as a Currency
Why Experts Are Wrong About AV1 Being Slow
Thanks for the clarification, I've updated the description
You mean a company monetizing an open source project gets funding. Why do we persist in the 1-1 OSS project-company mapping fallacy
You'll get rate limited and then banned pretty quickly with these in my experience. Having a real phone and using the strategies you see in clickfarms with emulated input is the best way.
We recently switched from Slack to Mattermost and love it. My only gripe is that replies show up in the main room thread which makes catching up on posts almost impossible.

There is a request to implement collapsible threads[0] but I haven't seen any new updates address this.

I'm hoping this new funding round amps up a few developers to take on this much-needed feature.

[0] https://mattermost.uservoice.com/forums/306457-general/sugge...
I highly recommend checking out https://github.com/docker/buildx . It’s still in tech preview but it’s an exciting look at the future of docker-build.
Deutsche Bank staff sent home as 18,000 job cuts begin
We've been using a combination of Discord / Telegram / Google Meet instead of Slack and haven't had any problems. There are lots of great alternatives out there.
I think the argument is to stop using it.

The problem with RSA is that it's easy to understand and easy to implement well enough to work in the sense of "my test cases verify and reject my good and bad signatures", but extremely hard to implement correctly with respect to a host of subtle number theoretic attacks against prime generation, key selection, and bit banging that have been successful in the wild over the past few decades. Given the number of attacks that have been found and their subtlety, it seems likely that there may be additional holes yet to be found in any given implementation.

There are other options that may be harder to understand and implement, but the trade off is that if you get them to work at all, you have probably done it safely (or more likely used a library written by a cryptographer that did it correctly) - Digital Signature Algorithm (DSA) for signing and Elliptic Curve DSA (ECDSA) and Elliptic Curve Diffie-Helman (ECDH) for key agreement which allows for encryption (via a symmetric method).
The conclusion is to stop using RSA entirely. The article argues that RSA parameters are so easy to screw up, even if you're not implementing the algorithm yourself, you're probably introducing security vulnerabilities by choosing parameters that leave you open to vulnerabilities that you've never heard of which will allow attackers to retrieve secret keys. Instead, you should use ECDSA with curve 25519. If you use that algorithm (obviously not rolling it yourself, but using a well-tested open-source implementation), you're much less likely to introduce vulnerabilities accidentally through bad parameter choices.
We wrote a blog post for that: https://latacora.micro.blog/2018/04/03/cryptographic-right-a...

To answer your specific comments: firstly, you don't need public key crypto. If both you and your sender can agree on a secret key, you can use secret key crypto just fine. For that, use libsodium's secretbox.

If you really need public key crypto for some reason, libsodium's box is what you want.

What's the "untrusted channel" here? Is this really about encryption in transit, or encryption at rest?
A Superb Weather Site – Free and Donation Supported
> CVE-2019-13053, an attacker can inject any keyboard input into the encrypted radio traffic of the Unifying keyboards without knowing the crypto key used. To do this, the attacker only needs to have temporary access to the keyboard in order to press some keys.

or you know, ask the nice bank lady to type this "magic key combination" for you. Yes darling my name is little bobby tables.

>CVE-2019-13052 is not being addressed either. The attacker can decrypt the encrypted communication between the input devices if he has recorded the pairing process.

Oh dear, did the keyboard I am currently jamming stopped working? I have same model! my son/nephew told me you need to pair them. Ill just sit here patiently while you do that.
This list is the sort of corporation-serving drivel that all of us should have come to expect from people who can't think beyond their own experience to save their life. The majority of climate change comes from corporations. This list doesn't address our most grating problem, which is what we've collectively allowed some other people to screw everything up for the rest of us.
I make skimfeed.com my browser homepage.
Then have another developer or consultant handle that part of your project. It seems like you misread a non-existent imperative in the article that "anyone can crypto with these 3 easy steps". They made no such claim.
Xilinx Acquires NGCodec to Deliver High-Quality, Efficient Cloud Video Encoding
Where are they going to get access to the diffs of the patch? iOS is closed source.
Nonsense: many countries have left the CFA Franc (like Guinea, Madagascar and Mauritania), and others have joined (like Equatorial Guinea or Guinea-Bissau). Some have left and joined again (like Mali). I wonder if you have actual example of France actively working against countries trying to leave? Or even a pointer to countries trying to leave?

I'm not competent to judge whether the CFA Franc is a good currency or not for the countries using it. No doubt it is a compromise with good sides and bad sides. The obvious good side being that it certainly makes trade easier within the CFA Franc zone. The obvious bad side is that the Euro top priority being fighting inflation, it can hinder exportations from countries that are not very competitive. A complaint often heard about the Euro from European countries (especially France, sweet irony).

Hopefully African nations will manage to create their very own currency, and will manage it well.
Elegantobjects.org
With libsodium you still have to choose parameters though not that different from other crypto libraries(including .NET)
Perhaps an ignorant question, but given that when I travel I have to bring a seemingly endless array of plug adapters, which power standard is the "best" and how do we get rid of the rest?
Follow Up After an Interview
Bollocks, no one has a large enough quantum computer yet. What is known to exist is just small numbers of qubits, and they are extremely expensive to run.

Key sizes are an attractive subject for bikeshedding. You can endlessly argue about whether better performance or stronger theoretical brute force resistance (e.g. billion years vs million years to crack) is more important.

And yet, it is a silly thing to care about. Read the article, it does not even mention this topic really.

It's all about implementation vulnerabilities, and how RSA is fundamentally resistant to correct implementation (requires padding, etc)
The point it seems they're trying to make is not necessarily avoiding planting trees, but to not introduce non-native species of trees. The article mentions the opponent's claims: "acidic needles and smother wildlife", "saying carbon-soaking bogs were damaged", and "diesel-emitting machines often felled trees prematurely"

Since the article doesn't reference any studies or statistics to back up either claim, it's hard to tell, but a lot of people here agree that Ireland's environment could benefit hugely from cutting down or outright outlawing the harmful practice of bog cutting, and introducing non-native species to an environment can often be harmful.
I use to live a few blocks away. While I don't miss the US, I do like Pike Place and downtown Seattle.
> Parameter selection isn't any easier in elliptic curve land. In fact, by the point that I believe you can make an educated choice in elliptic curves, you can also make a reasonable choice in RSA parameters.

The differences, according to the article:

1. RSA looks easy, so developers are tempted to roll their own, not so with ECC

2. almost all RSA parameters are necessarily secret, making it harder to peek on supposedly well-designed systems and know what to select (or even how to select), ECC parameters are public and other users can be used as examples
>Right now when Spain buys oil from Norway (EU member and European Economic Area member) they (have to?) use US Dollars, which is insanity from the perspective of both countries.

Instead of converting from Krone to Euros and vice versa, you convert into the largest, most stable, most liquid currency on the planet. What is insane?

>Ghadaffi wanted to trade oil for Euros and we all know how it end up.

Ah yes, Ghadaffi, Sadam Hussein...good men overthrown because they wanted to "trade oil for Euros".

Wait; why couldn't they again? What, precisely was stopping them from dealing in Euro, besides the seller or buyer of oil demanding to be use USD? Right, nothing.

The idea that the US forces people to trade in USD as opposed to it working out that way because it's a stable currency of a powerful nation is a fallacy that won't die. Just like within the country, you are free to trade in whatever the hell currency you want...if you can find a willing counter-party.
It's not the only solution but it's the best one. I'm not abrogating responsibility, but actually saying that if we all put the same effort into cohesive non-partisan political action, we'd get a lot more achieved in a shorter amount of time. I can stop taking flights but what about pressing govts to stop jet fuel tax subsidies, halting airport expansion plans, removing tax incentives for business travel by air and increasing funding for zero/low emission alternatives?
Well I didn't say they're not used, just not as much by everyday laypeople and the media. The article for this thread makes no mention, for instance, and out of the top 5 DuckDuckGo search result news articles for "ridgecrest quake" [1], only one of them contained the words "intensity" or "Mercalli". Mentions of shindo values in Japanese news are ubiquitous.

[1] https://heavy.com/news/2019/07/ridgecrest-earthquake-damage-... https://losangeles.cbslocal.com/2019/07/04/6-6m-quake-strike... https://edition.cnn.com/us/live-news/earthquake-california-j... https://www.cbsnews.com/news/ridgecrest-earthquake-aftershoc... https://www.latimes.com/local/lanow/la-me-ridgecrest-earthqu...
That's basically irrelevant to the point the article is making. The article's basic gist is that RSA implemented perfectly is fine, but that actually getting to that perfect implementation is hard and there are an incredible number of gotchas. And because the basic idea behind it is simple, then devs tend to try their hand at DIYing it./
The textbook e=3 attack is Hastad's broadcast attack (on textbook RSA), which is much simpler than the e=3 signature verification problem. (So the article is right that _lots_ of things go wrong, 'tptacek's example is just more exciting and mine is easier to grok :-))
I think if you're interested in learning about the foundations and basic theory of asymmetric crypto systems, implementing your own RSA is a fun weekend project. Just never use that implementation or suddenly think "now I can write my own crypto for everything!" And also strongly consider using anything other than RSA for real work.
I find it odd that docker pipelines don't cache all the layers by default. That is to say, that they don't push all cached layers to a central repository. I'm not even sure if it's possible.

Is there a reason why this would be bad? Clearly you'd have to clean the old cache layers regularly, but I'm more concerned with some layers taking very long times - the caching seems required.

Though I suppose if you set up your CI system to store the caches locally then you get caching, and it's more efficient as you're not downloading layers. So maybe that's just the "right" way to do it, regardless. /shrug
Thanks. Good pnumnomic (sp)!
And their closest trading neighbor Benin.
Udocker also use Proot: https://github.com/indigo-dc/udocker

I used it on a server where I was not root to be able to launch docker containers.
GraalVM has a community edition that's fully open source. There's nothing more to worry about there than with any other open source project.