skysight-inc/HackerNews huggingface dataset:
Well, perhaps two of the biggest political changes to influence these trends are the elections of Trump and Bolsonaro, so perhaps I'm right about the power of politics, just in the wrong direction :)
He’s saying that if you can get away with generating something like a random API key and just having the client save that, that’s much safer than using public key cryptography.
Vox appeared the other day, everyone began talking about the Spanish crisis as early as 2006 and it began in 2008. Podemos was born in 2014.
>To get an ICLA all legit while you are employed, run it by the legal department of the company you are employed by, and they can give you an idea if any changes to the agreement is needed (and of course, if you are allowed to spend company or private time on the project), and get it signed legally and on file for all parties involved. Done.

IME company legal departments are unlikely to indulge this kind of thing unless they owe you a favor.

Where they do, their blanket response is usually "no, now go away".

Ideally any solution to this problem should take account of corporate legal departments' aversion to extra work and risk.
I don't know about CLAs, but the way the FSF asks for copyright assignment isn't as careless as Eric makes it out to be. The FSF does require a statement from your employer that you're able to do the copyright assignment. I know of at least one prof whose university wouldn't grant that assignment and therefore the copyright couldn't be transferred. There was no "legal voodoo"; everyone was aware of what needed to happen and understood that it couldn't because the university didn't want it to.

Whether the FSF getting copyright assignments is helpful or not, I'm not sure, but it seems that it is: Hellwig's Linux GPL enforcement case against VMWare has so far hinged on him being able to ascertain copyright over the bits of code that VMWare allegedly violated, and last I heard, the court threw out his claims because they decided that git blame logs are not enough proof of his copyright ownership. If all of the Linux devs could collectively enforce copyright over their code as a single legal entity with single ownership, this particular obstacle wouldn't be there.

Edit: Just checked. Hellwig decided to no longer appeal. A second court decided to also not hear the case, on "purely procedural grounds", which I think again is about the question of copyright ownership:

https://sfconservancy.org/news/2019/apr/02/vmware-no-appeal/

On the other hand, it's good that VMWare has decided to become GPL-compliant anyway.

So, yeah, I think the FSF has a good reason to have copyright assignments, to avoid this particular obstacle.
However, if I turn the entire screen off, by pushing the volume knob in until it clicks, before stopping the engine, then on start-up the radio will be off, but so will the entire screen, which also controls navigation, bluetooth connectivity and the reversing camera.

My Subaru has the same behavior, minus the backup camera remaining off. In reverse, the screen turns on and displays the image from the backup camera. It turns off again once you switch into drive. It's certainly a solution to the problem I described, but it's obviously not ideal for all the reasons you've enumerated. Turning off Bluetooth, navigation, and (in my case) Android Auto is certainly a drastic way of dealing with this radio behavior.
> Poor mail notifications

Time for someone to write an Electron-based update to the venerable "biff"[1] program.

[1] https://en.wikipedia.org/wiki/Biff_(Unix)
There's a reason Kent State went down the way it did, and also why there's no US version of Tiananmen square. A radioactive crater isn't much of an economy, and the armed forces are made up of, well, you know, people who like most folk, don't enjoy shooting at people much like them.

The 2nd Amendment doesn't grant a right to bear arms - it prohibits the Government from restricting the right.
I think there was a discussion on Twitter a few weeks back between a flight passenger and an airline who at first told him he could "opt-out" of the facial recognition at airports -- only to learn that the airline doesn't actually scan your face itself for collection, so "opting-out" does nothing.

It's the DHS that has your face scan and they are allowing the airlines to tap into all of that facial recognition data and then "identify you" at airports through a new face scan against the DHS data. Your face profile has already been collected/created by the DHS.

Who knows to what other private companies the government is pimping out your "biometric identification data."
Apart from the 240V bit (vs. 120V in most other countries)
That's a different, but related concern. Yes deep dependency graphs have a big trust problem, but at the very least in that case you can use CSP and SRI to verify the integrity after the asset has been built. A compromised node module also has the mitagting fator that it slowly propagates as people update which doesn't make the attack as immediate and it gives people an opportunity to review the code as they update.

For remote third party JS that's included on many websites you have an immediate and direct remote code exec vector. For something central like Google Analytics this would be devestating.
Until the 80s we believed that we had unlimited supply of cheap energy. We no longer believe that.

This affected a lot of thinking, planning, and creativity. In the 50s-60s people dreamed of megaprojects. Now we look at a megaproject and go: "well, no. it will take too much effort and power with no tangible benefit".
Call center people are being cut out at both ends:

1. The type of people that would rather call than use an app are getting older and will eventually stop calling

2. The type of problems automation can solve is removing the need for a live person.
If it's a feature, not a bug, why are all the other countries outlined in the article choosing bands with greater range?

I just can't imagine anyone being happy with 5G if it doesn't work in your car.
> but tools like SRI and CSP stop these attacks dead in their tracks.

this isn't... usually true. in the case of this attack, the Javascript was appended directly to a 'known good' library resource[1]. Typically CSP whitelists based on origin, which would make CSP ineffectual in this case. Also, websites like BA have advertising, and it's nearly impossible to run CSP with ads unless you use the `strict-dynamic` directive, which whitelists any javascript loaded by your javascript recursively... including this javascript[2].

There are other, more uncommon modes for CSP which you might be referring to:

1. Nonce, which provides protection by ensuring each script has a server-calculated one-time-use token. This would not have any effect, as the script is part of one naturally loaded by the server.

2. Hash[2], which provides protection by checking the script's content against a predetermined hash. This possibly could be effective, but in practice rarely is. If the attackers could edit this script, there's absolutely no reason to believe either (1) this just updates the generated hash or (2) the attackers cant just update the hash. (this is essentially the same as SRI). Hash is potentially effective where taking advantage of a third-party CDN with known content that should not change, but by the look of the url: http://www.britishairways.com/cms/global/scripts/lib/moderni... the resource was not on a CDN.

[1]: https://medium.com/asecuritysite-when-bob-met-alice/the-brit...
[2]: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
Do you have any idea what got you banned?

Sudenote: I've heard that as a rule of thumb you shouldn't automate more than a few IG accounts from the same IP addr.
bplist00ÔX$versionX$objectsY$archiverT$top † ¦U$nullÓ
WNS.keysZNS.objectsV$class¢
€€¢€€€RanVldtext¢ËqÒZ$classnameX$classes\NSDictionary¢XNSObject_NSKeyedArchiverÑTroot€#-27>DKS^ehjloqsux„‰”ª­¶ÈËÐ  Ò
so great these crypto currencies. glad thats protectigg us from the fraudulent banks.
I have the GPD Pocket 2, and I have no issues whatsoever with the keyboard except that I got some dirt spots from the keyboard on the screen easily (via each key's 4 edge points). Like, worse than my MBP 2015's.

The infrared mouse works OK (I'd prefer the thinkpoint-esque knob of the original GPD Pocket), but you can also attach a Apple Magic Trackpad 2 on it. These work very well if you run a new Linux kernel and patch up some software such as Xinput.

I run Kali Linux on it (its part of my pentest equipment; don't use it for e-mail and such [1]). Slapped an Apple logo on it for the fun of it.

Can I recommend the device? Well yes and no.

Its an OK build quality, and if you apply thermal pads and some copper you can easily run the machine without the fan on all the cores. It does get a bit more hot on the bottom then.

Its a bit expensive now, I'd say, compared to say the current Raspberry Pi 4 plus a powerbank plus a monitor. Its just 2018 price and hardware. Perhaps look at the successor(s) such as the black version or perhaps the Max?

Worst part is they screwed me over cause there's a clear spot on the top right due to attachment of the (touch)screen and in certain light / colors it is rather apparent. CS said they couldn't notice the issue. No warranty was provided. And even then I read about some people had to pay import tax once more receiving their (repaired/new) device but they want you to send the device without value (which means you could lose the whole thing if it gets lost). Typically Chinese.

[1] You could argue you shouldn't use such Chinese hardware for pentest purposes which is a fair point.
Poison a single common open-source daemon which is used in a lot of systems; That daemon will have access to all keystrokes, window content, etc.

> The reason for that is that people who use X also exclusively use trusted apps.

Well that's just not true. What does trusted mean? Most of the software on our desktops is unaudited. We don't have insight into the entire chain of deployment for more than a handful of applications we feel like keeping up with.

On a side note, that would be a wonderful service; A man-like utility which simply displays change-logs coupled with relevant source-code diffs. Reduces the surface of trust down to one party. Something like that would require financial backing, however.
Free Forest School Wants Kids to Run Wild
Zero of those cases were over lack of political correctness. First guy created a sock puppet Twitter account and was caught and requested a leave of absence and was later accepted back.

Second one used the n-word in class.

Third one named and shamed a student publicly on his blog.

These all stemmed from them expressing their regressive beliefs but action was only taken after they committed an action beyond expressing an opinion. And you've got 4 examples stretching back 6 years. This just isn't a widespread issue at all.
Yes I would be keen on the links to the research. Think in an age of big data and AI i think this is relevant.
The "Cryptographic right answers" series is an interesting page, that tells you what to do while still having a little bit of technical information.

There are multiple ways to "send encrypted data via an untrusted channel", none of which is perfect, but by descending order of ease of installation and use I would propose this:

- Use Signal or Wire to send that data through messages

- Use Keybase

- Setup an HTTPS server (the default configuration of caddy (https://caddyserver.com/) is good enough)

- Use the "box" function from NaCl, or libsodium, or Go's reimplementation. Those are all libraries, so it will require actual coding. But those libraries are all made so that misuse is very hard, and you don't need to know or even understand how the crypto works to be able to use it
FYI Wikipedia suggests that GOG.com has the originals and that a game called Contraption Maker on Steam is a spiritual successor by the original developers
>if we'd manage to manage our finances better

Pray tell, what does this mean?
Intersection Types in Java
> very prominent Perl advocates, but not necessarily all of the community

I agree, but my suspicion is that the larger mainstream community grew out of Perl being in the right time and place for a scripting language borrowing idioms from sh and C. Whereas the central figures directing Perl were always driven in the direction of eclecticism.
Perks of Being a Sociopath
How Unpredictable Is Your Subway Commute? We’ll Show You
The thicker one (in english) may be somewhat difficult to find.

https://www.worldcat.org/title/works-of-jh-fabre/oclc/316395...

As far as I can tell, there are 3 locations (one in The British Library, St. Pancras under a slightly different entry) in Worldcat, and nothing recently (re)published or scanned, apart from various selections concerning specific insects.

If someone knows otherwise, please do share!
The cities as they exist today may have been augmented and developed in part through European effort, but they are a far cry from what would have been there had the preexisting social orders not been intentionally decimated and if their resources had been spent on their own development rather than Europe’s. Your belief about African societies is a product of after-the-fact justification of the destruction and attempted erasure of the preexisting civilizations.
Note also the two icons for Facebook and Twitter on your site point to WIX profiles (https://www.facebook.com/wix, https://www.facebook.com/wix).

Maybe you can flesh out that scenario on the website to explain the process to a prospect. Putting a video out there so you don't have to do the operation with each client (one video that shows how the product can solve the problem).

What's the need for signing the word file? Why do they need to sign it?

Can I as a prospect directly click on an icon on your website or scan a QR Code and start a WhatsApp/FB messenger with you?
@dang, for dupe submission, is it possible to merge the comments from later submission into the initial submission?
Show HN: A website monitoring tool for front-end developers
X is very interdependent, and a lot of it isn't fully modularized. When you need to change the entire foundation, knocking down a few walls won't get you there.

It sucks, I know. Decades of hard work "gone". But think of it this way, isn't it often said you shouldn't be afraid to throw away old prototype code? X is a decades-long foray into graphical computing, but perhaps it's time to throw away the prototype and start over with what we've learned from the process.
From the reporting I've read, primarily by RiskIQ, in both the Ticketmaster and BA case it was not the origin servers that were compromised in which case SRI would have been effective in so far that it would have required the attackers to compromise the origin servers too at which point it's all game over anyway.

So I would assert that SRI would have stopped both these attacks.
Yes, you need some foundational source of trust, but you were going to communicate that public key one way or another. If you don't trust that medium (let's say it's WebPKI TLS and an adversary gets a bad cert from Comodo somehow), the adversary could just lie about the public key too. A MITM adversary that's in a position to unseal and reseal libsodium secretbox messages can also do that with libsodium box.

(For everyone else: just because I'm playing along with this misissuance scenario doesn't mean I don't think ~everyone should trust WebPKI.)
the URI: http://www.britishairways.com/cms/global/scripts/lib/moderni... doesn't look like its on a CDN
Because that is how those culture’s experienced it, and that is also the terms around which Europeans justified their actions.
I like IEC 60309 best. 480V 30A three phase IP68/69k rated plugs and sockets? No problem with pin-and-sleeve connectors. Any food processing plant you go to will be full of them. Probably not a great choice for a table lamp, though.
This seems to explain how it works: https://www.kernel.org/doc/html/latest/admin-guide/ext4.html...
It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks.

It depends on what you're using them for.

If you're talking about static resources loaded from something like a CDN -- in other words, a situation where you also control the intended content to be downloaded -- then SRI is potentially useful. But how could that sort of system work if you rely on a payment service to supply the client-side scripting that runs behind the credit card form on your site and turns the user-provided card details into a token of some sort?

For example, if you use a service like Stripe, you're almost certainly loading a script from their servers that they control to run the card details form on your site. Between PCI-DSS rules and the obvious need for Stripe to be able to deploy changes quickly in the event of discovering a vulnerability, you can neither self-host the equivalent script nor provide any useful checksum or similar that is guaranteed to remain correct.

I suppose in theory Stripe could provide an API that you can access from your servers to fetch the current checksum for the current version of a resource like https://js.stripe.com/v3/, and then you could render your link to that script with the integrity attribute included when you serve your page with the card details form, and as long as no-one breaks anything with a cache or the like then that might work. I'm not quite sure what attack vector it would be guarding against though, since any scripts like this will surely already be served over HTTPS and therefore trigger warnings if anyone without Stripe's cert tries to serve them via some sort of MITM attack.

So SRI and the like take care of some aspects of this problem, but given you might be relying on a lot more external services than just (presumably relatively careful) ones like Stripe, it doesn't solve the whole problem.
They introduced pines, a fast-growing tree that can most rapidly remediate Ireland's contribution to global ecological disaster. Which would seem to upstage concerns about the machines that manage the trees, or that other (insufficient) carbon measures were affected (bogs). Such arguments are a little like rearranging the deck chairs on the Titanic.
A few examples of real world coding problems and tasks
> At rank 39, we have 8675309, which I personally didn’t recognize as being particularly noteworthy. However, with over half a million collected uses, it clearly is meaningful to many.

Is this value there due to some stock value in some well used piece of software such as a cookie notice plugin for Wordpress?

I had not realised this was a '42' grade special number before and I wonder how it is so popular in CSS.
Yes, these are implementation specific problems. I think the article wasn't saying "just use ECC instead", it was saying "use ECC instead because it has a widely recognized and standardized implementation path that's proven secure, in contrast to RSA."

The biggest issue he describes is that, when implementing RSA, most of the parameter choices are necessarily private to the developer, meaning the dev is expected to supply good parameters on her own, when "good" means in terms of heavy math that no non-cryptographer can be expected to know. It's not just key size--there's a bunch of bad choices a dev can make, many of which are hard to recognize as bad choices.

Secondarily, many of those bad choices are driven by implementing RSA in constrained environments, where they're a tradeoff to achieve performance goals--so known-good techniques or algorithms are actually rejected.

ECC, by contrast, is almost all public parameters, so the security community can provide (and already has) known-good parameters that are provably secure, and a dev can simply choose a known-good configuration for their implementation to go with a well-regarded library like libsodium.
Have a quick read of Wiki or google and make your own conclusions. From my POV I appreciate his historical contributions but he’s been pretty aggressively against inclusion in tech. Has said a lot of misogynistic and anti-gay things and is very unapologetic about anything he’s said or done. He wants free/open source community to be like it was in the 90s again, and seems pretty anti-progress in anything that’s softer than code.

That’s my 2 cents but everyone has their own interpretation.
The flipside of 1. though is that cached images can't be hijacked and have vulnerabilities injected, or from a non security standpoint, have breaking changes introduced which mean the image no longer builds and/or runs how you're expecting.
Max 32 bit signed integer in decimal.
Note: I am not a cryptographer nor a security developer but I am fascinated by security and crypto.

I was all onboard with this articles premise, that good crypto is hard to understand and RSA requires you to make choices about crypto that can easily you screw things up.

Then I read the "So what should you use instead?" section:
> "Developers could theoretically build an ECC implementation with terrible parameters and fail to check for things like invalid curve points, but they tend to not do this."

Is this not exactly the authors complaint about RSA? Granted there's fewer places to screw up, but still, you're required to specify a parameter that most developers typically don't understand the ramifications of.
American Flag blowing dandelion shirt
Right, the fix would be some form of govt regulation to break the bifurcation or maybe more social net support.
Eric Raymond has some questionable beliefs in my opinion, and this is likely what OP is referring to.

I'm a big fan of The Cathedral and the Bazaar. But currently Eric Raymond has come out as a climate change denier, a racist, and also has pushed some odd conspiracy theories.
Your cultural expression of truth is not justification to socially lash out at others. Whether in the name of science, god, or some other ideal, the act is violent.
Since you have to "log in" to the store with your Amazon account when entering, it doesn't matter if you're masked. Whatever you carry out will be billed to your account.

There is no need to catch these people, they're customers, not thieves.
He's an outspoken misogynist and homophobe.
Note also that the typical residential electric service in the US is actually 240V split-phase; the distribution transformer secondary winding is center-tapped, with the center tap grounded and brought in as the neutral. Phase-to-ground is 120V, phase-to-phase is 240V. Normally, 240V is reserved for heavy-draw appliances like large air conditioners, ovens, arc welders, and so on.

In some apartment buildings, commercial properties, and densely-populated neighborhoods, two phases of a 208V three-phase supply are used instead, which still yields a 120V phase-to-neutral voltage. Large appliances often have a wiring option to operate on 208V.

[ETA: The second hot wire is usually red, and 208V three-phase systems use black, red, and blue for the hot wires.]
To prep for that quantity of offboarding without anything leaking is pretty impressive.
It looks like a CMS that is being repurposed as a CDN. I would bet the path https://www.britishairways.com/cms/ resolves via a gateway to a different set of servers than the main BA site. So for all intents and purposes it’s a CDN
Volts make no difference to heating your coffee. That is all about watts which is mathematically volts times amps. Lower voltage, higher amps for the same time to heat your coffee.
This might be a better starting point: https://paragonie.com/blog/2017/06/libsodium-quick-reference...
Considering it's enabled by default, i'm really curious why you would want to do that.
it was the government that caused this in the first place. I always wonder why people suggest this, when the "cure" to the ailment is more of the disease.
Payment Types Catamorphism
Dont forget “art”!