skysight-inc/HackerNews huggingface dataset:
Again, by "not side-channel resistant", they appear to mean "implemented with software AES that is already known to be vulnerable to side-channel attacks". The attack here is not especially tied to the CSPRNG construction; it's a straightforward application of an already known attack.

The legwork in the paper is interesting and worthwhile; they tracked down actual implementations and worked out the whole attack. But if you're going to go around gunning for something, it should be software AES, not CTR-DRBG.

I'm worried that people won't take that away, because "DRBG" is a weird NIST term that people might read too much into. But "DRBG" pretty much just means "CSPRNG". There's no relationship at all between Dual-EC and CTR.
I worked at a startup and designed the thermal battery and pumping systems for a solar powered milk chiller/storage system for the Indian market. About 500L of milk chilling & cold storage capacity, also storing solar energy as cold (not ice)
Depending on where you are, you need a whole bunch of insulation to not condense vapor on the outside of your storage, because condensation is a killer for efficiency. My system needed about 50mm of foam rubber for the worst case, around a 1000L thermal storage medium tank, which makes these systems very large.
Ask HN: How do you know if you can trust?
I've seen a lot of stories lately about detecting fake news and deep fake video and audio. I've seen contests for detecting if something is trustworthy.

How do we know if we can trust something or someone? I've been betrayed, more than once. I've been lied to and not known it until much later.

Is there an algorithm? Is that possible? Is it a cat and mouse game at best? Over the past year or two, it seems like Google is being gamed more and more. Business listings at the wrong address, the locksmith scandal.

Learning to lie is a natural and expected part of human maturation. Other species are known to deceive.

Is this a solvable problem? On a personal note, how can an individual learn to trust, if they believe it is impossible due to past experience?

I think this question is at the deep intersection of Computer Science and Philosophy, especially epistemology. If philosophers haven't solved the problems associated with the field of knowledge, justification, and truth, how can a computer? How can we believe a computer, programmed by a human, can properly distinguish true from false, when humans are themselves unable to do so with great accuracy.

And, if the above is possible, how do we know we can trust the prediction of the computer? It's already a well known problem that understanding the output of AI, as in, why did the AI choose this result, is becoming increasingly more difficult over time -- not easier. If we can't trust computers -- or people -- how can we trust the designation a computer will make about something's else's trustworthiness?
> All crypto is difficult to get right unless you're a crypto expert. RSA is not unusual in this regard.

Maybe all asymmetric crypto. Symmetric can be a lot easier.
For me, tenkeyless allows me to keep my mouse much closer to my keyboard which is significantly more comfortable. It's somewhat common to have long-term shoulder injury from using a fullsize keyboard and mouse intensively, like for gaming: https://www.reddit.com/r/Fitness/comments/a5ques/has_anyone_...
The referendum just gone is the second referendum though. The first one on staying part of the European community and common market was in 1975.
But that's not the point, is it? The point is that after 8 years, it's exceedingly reasonable for a standard to be superseded.
I'm <user>@google.com, among others.

I presume your talking about one of the two leaks via veritas. Those don't say what you claim they do. I also expect your assumptions about legal threats are wrong. But such claims are easy to make sans evidence, and they do feel good.
I don't think that's what's happening here. I think AirMessage is just functioning as an iMessage client by using the Messages app on the Mac as a proxy. It would be no different from sitting physically in front of the computer. You can only read the messages off the screen and you can only send messages through Message itself.
> You talk about git.apache.org being down, while you're willing to bring down the entire ecosystem across the board with your own special server.

If the proxy goes down, by default the command falls back to directly fetching.
Sema4 | New York City, NY | Onsite | Full Time - DevOps Engineer

My team at Sema4, a Mount Sinai company, is actively searching for DevOps (Site Reliability) Engineers for our Union Square location.
Sema4 creates software for patients and providers to better track Oncological and Reproductive health which means your efforts contribute towards helping others.
If you are passionate about LEARNING (first and foremost) Docker, Kubernetes, CI-CD, IaC, AWS/GCP and automation send me a message at your convenience at sean.turner@sema4.com
Well, German actually has the similar word "wandeln", which means something like "to stroll" and is often used in phrases like "unter den Toten wandeln", which can be translated as "to walk among the dead". So this is quite similar to the Dutch "wandelen" but used in different situations.
IIRC the card is still electronics which means that it will not work if there is no power or a failure in the electronics
Just buy the official power supply. It's probably better than whatever cheap junk you've intended to abuse your Raspberry Pi with.
Amazon testing payment system for Whole Foods that uses hands as ID
I've always been a fan of mechanical keyboards, I just think I type faster and better with them. I had an old Zeos that I used for many years, until my wife insisted I remove it from our shared home office because it was too noisy.

For a few years now I've been using a Microsoft 600 which seems very similar to the Amazon Basic, including the price range.
Actually I think it's easier to make cheap, mass produced device secure because you have loads of eyes to check the code.
I'll bite. Why is Apple harmful to capitalism? If you have an actual argument for that point, why is harm to capitalism a bad thing?
not having a real alternative to GIFs will keep them alive for another decade.
By real alternative I mean: behaves like an image, you drag'n'drop like an image, on your desktop shows the thumbnail of an image and when you open, doesn't open the video player, play just once and stops.
Abu Dhabi outcall escort 0563159104
Definitely not equivalent. Equivalent would be handing the gambler money to buy food when he's gambled away his house and car.
Also, wasn't Aurora Serverless created because of that problem?
How the Media Can Help Prevent Mass Shootings
Another indication that Tesla negligently over-sells, over-markets its autopilot, and under-educates buyers. (as the Jalopnik article mentions, buyers are referred to the manual for such details, which hardly any car buyer, of any car, ever, reads)

I like Tesla! I want them to succeed, I'd love to see them as a full contender in the auto-sales marketplace and a leader of EV vehicles when they go mainstream. But these failings, along with the ridiculous promise of full autonomy in the near future, are incredible irresponsible.
9/11 changed everything.
None of what I listed was idealistic. Don't work for free and expect to get paid or a job.
but still is what most people are used to... so in a sense, chrome is the default
RSA is pretty easy to implement, but hard to get right, PKCS#1v1.5 can be broken using padding attacks, and should not be used. OAEP is generally recommended.

The entire RSA suite (keygen, encrypt/decrypt, padding) can be implemented in about 300 loc[1]. Which is probably why there are so many of these 'walkthroughs'.

[1]: https://github.com/i404788/tiny-rsa
So if it's the norm to connect to unknown APs with SSID "eduroam" and submit your username and password, can I make a rogue AP that sniffs everyone's credentials? Or is this prevented under Enterprise, e.g. through a pre-shared certificate for the authentication server (which isn't run by the AP host)?

If the latter, can I make my own real eduroam AP?
> And the EU has plenty of previous on this.

The EU didn't have anything to do with the calling of referendum.

The voices calling for a 2nd vote are inside the UK.

>the facts on the ground have changed,

The facts haven't changed, they've just been established for the first time - big difference.
Technically it can pass a short bill that requires just a majority, but it then has to go through lords and is open to amendments https://www.instituteforgovernment.org.uk/explainers/early-e...
A second referendum would not solve anything. The original referendum should not have been called by PM Cameron. The core issue is one of national English identity. Scotland has its own Scottish nationalist party. Wales has its own nationalist party. Northern Ireland has two nationalist parties for good measure. But English nationalists have had to take cover in the 'broad church' of the Conservative and Unionist Party, to give it its full title. The trouble is that the English nationalists have always chafed under what they see as the heavy yoke of EU regulations. The 'one nation Tories' / Unionists consider keeping the UK together as an important ideal. The two factions have been fighting within the party for decades. It has now come to a head. PM Johnson is going for a break with the EU 'do or die'. Scotland and NI did not have a majority for leaving however.
It's a mess. It should not have happened. The UK is not Switzerland, it is a representative democracy, where Parliament is sovereign.
As an unintended consequence the UK could break up in the coming years.
Thanks to the demolition job performed by David Cameron, Theresa May, and finally by Boris Johnson, British society no longer believes in much of anything or takes anything seriously.
That’s a big deal and may change my opinion. My experience with chrome books is older than that. I’ll look into this. Thanks for the info.
So I guess in your mind, pro's watch tape of their opponents for fun?
> This "feature" should have an option to disable it.. at the very least.

The Go 1.13 Release Notes lead off with documentation links for how to disable and otherwise configure this:

"See https://proxy.golang.org/privacy for privacy information about these services and the go command documentation[1] for configuration details including how to disable the use of these servers or use different ones. If you depend on non-public modules, see the documentation for configuring your environment[2]."

[1] https://golang.org/cmd/go/#hdr-Module_downloading_and_verifi...

[2] https://golang.org/cmd/go/#hdr-Module_configuration_for_non_...
I cant tell if you are naive or just ignoring the conveniently that cash is also an asset. In deflation, it is a better asset than stocks. In negative interest rate environment, it is a better asset than bonds.

Please end this discussion
The lifetime of most electronics is much longer than 2 years. The only thing I need to replace regularly is headphones.
The only gap in your understanding is that nigh on 100% of the MPs that claim to want to prevent no deal in fact want to prevent Brexit altogether.

Clearly to rule out no deal is by definition to accept whatever deal the other party deems to give you.
USB-C is a revelation - power, display, storage, all through one cable.
>Parties can expel members who vote against the party; this is normal.

If they're required to vote with the party then why are they there at all instead of a single party representative casting multiple votes? How does a party ever change its mind about anything if its members can't make their own decisions?
Applying the bug fixes in a dependency I'm using when a new version of it is published… [1]

Sarcasm apart, I wasn't talking about features. But cargo is a really well-designed package manager. I've been using Rust full-time for 2 years now and it had never annoyed even once.

[1] the sarcasm was referring to the Minimum Version Selection algorithm used by go's package manager, which is a really bad case of NIH from Go's teams who decided to throw away a thriving community work to do their own stuff, ending up with something different from what everybody else has been for more than 20 years. And unsurprisingly, it's really bad…
People don't understand any more about the deal (or lack of one) than they did before they voted. They've just been subjected to endless Y2K-scale hype for an extended period of time.
The Spiral Pump a High Lift, Slow Turning Pump
You can use PHP on AWS Lambda if you wish.

If you use Lambda instead of Docker, you don't have to mess with container orchestration.
Well, you go to C++ for the climate; you go to Go or Rust for... the company!
Doubt either of our grandchildren will ever use Perl. It is truly an arcane language that has no niche and no new application written in it.
Note to Future Self: Is there possibly any relationship here between this phenomena of water in spiral pumps, and other phenomena of electricity, in coils?

Maybe not, but at this point in time, I haven't done any research along this path...
If street crime had lesser penalties than the profit of said crime, yeah, I'd be pushing for harsher sentences, yes.

That's pretty exclusively the purview of white collar crime behind a corporation though.
My theory is that a bunch of entrenched network engineers just really like subnets and IPv4 and NAT and don't realize how mostly unnecessary it is in an era of cloud infrastructure and IPv6.

My grandchildren are still going to be NAT'ing.
I blogged about this here:

https://writing.kemitchell.com/2018/11/04/Copyleft-Bust-Up.h...

If you're interested in network-copyleft more generally, make sure you compare AGPL to OSL:

https://opensource.org/licenses/OSL-3.0
Map proves Portuguese discovered Australia: new book – Reuters
"The reason repeating referendum questions rubs people the wrong way is because you're changing the rules under them."

No rules are being changed, and "people" is obviously too broad here.

"In a referendum, you are asked a question. Should Brexit happen, or not. Not 'Should Brexit happen, oh, and if we don't like the outcome, should we have another referendum?'"

Who is "we" here? The folks who want a new referendum are those who regret the outcome of the first one for various reasons, including being lied to.

"if the government didn't like the result, they'd just delay transitioning power to the winners, and would instead host another election? And another one? And another one, until they win?"

It's not "the government" who doesn't like the result. This framing is invalid, and frequently intentionally so.

"It's also not clear that in the past three years, a single person living on the British Isles has changed their opinion on the matter of whether or not Brexit should actually happen."

It is extremely clear that many have. If not, there wouldn't be so much pushback against another referendum.
PAX | San Francisco, CA or Toronto, ON | Onsite | https://www.pax.com

PAX is a leading consumer technology company that designs and manufactures premium vaporizers for safe and responsible consumption of legal cannabis. PAX devices are compatible with the PAX Mobile App that allows consumers to bring control, predictability, and simplicity to their cannabis rituals.

To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/pax-labs

Recruiting Contact: molly@pax.com

Our open positions:

* All Roles: https://grnh.se/8d25e6c71

* Senior Android Engineer (SF): https://boards.greenhouse.io/paxlabs/jobs/1490605?t=8d25e6c7...

* Senior iOS Engineer (SF): https://boards.greenhouse.io/paxlabs/jobs/1563916?t=8d25e6c7...

* Senior Full Stack Software Engineer (TOR): https://www.pax.com/pages/careers?gh_jid=1696011&gh_src=8d25...

* Senior Data Engineer (SF): https://www.pax.com/pages/careers?gh_jid=1786704&gh_src=8d25...

* Infrastructure Engineer (SF): https://boards.greenhouse.io/paxlabs/jobs/1671812?t=8d25e6c7...

Tech Stack: Cloud Foundry on AWS for hosting all servers, Akamai CDN, Java 8/Kotlin used on all backend services and APIs, RDS (AWS MySQL) used for account data storage, AWS S3 used for raw storage, RedShift used for analytics, React.js used for web based front end clients (including dashboards), Swift for iOS, Kotlin for Android, Python for Data Science
Isn't it required by Amazon Affiliate to have a warning on ALL pages that link back to Amazon using affiliate tracking? Isn't it also required by federal law as well?
One day, when it has proper generics, interface validation without compiler error tricks, and an usefull portable UI library, it might be a better Java.
__attribute__((format(printf, ...))) makes printf every bit as type-aware as I need it to be. Put that in the standard instead.
Publish isn't necessary for the Go version, since the model is on-demand pull driven. godoc.org is the same way: there's no way for private code to end up there unless your private code is actually public.

The privacy concern is entirely that Google may see the name of some module you attempted to download.
Yeah, on second read I agree with you. I'm just wondering why the public PoC disclosure before that team had more chance to fix. The arduino-esp8266 folks are super popular in the ESP community.

By my read, the fix is still open in that repo, tracked by the follow-up issue: https://github.com/esp8266/Arduino/issues/6436
Yes, but it won't be rich people, and if they're not rich, are they even really people? It makes you think.
Because there are some huge, genuinely great benefits to using it. No one really cares that much but, when the difference between the two experiences is as great as it currently is, it really affects the conversation.

For example, we don't really pressure friends to buy iPhones but we legitimately have a separate conversation group for just iOS users from the main SMS group chat so we can send images, video, or other media at full quality. Most of us are pretty tech savvy too so we're not really keen on using WhatsApp or Telegram or any of the other dirty data apps.
497: left 26, up 27, right 30, up 33, left 36, up 41, right 44, up 45, right 48, down 51, right 52, down 55, left 62, down 69, right 74, down 75, right 76, down 79, right 80, down 82, right 87, down 93, right 98, up 102, right 104, up 105, right 106, up 107, right 110, up 113, right 115, up 116, right 122, up 127, left 130, up 133, left 136, up 139, left 142, up 143, left 144, up 147, left 150, up 153, left 154, up 155, left 160, down 163, left 165, down 167, left 177, up 178, down 183, right 184, down 187, right 190, down 193, right 195, down 197, right 200, down 203, right 205, down 206, right 208, down 215, right 220, up 223, right 224, up 225, right 226, up 227, right 229, up 230, right 236, up 237, right 238, up 240, right 242, up 247, left 252, up 255, left 258, up 261, left 263, up 265, left 266, up 267, left 268, up 269, left 270, up 271, left 272, up 275, left 276, up 277, left 282, down 285, left 286, down 287, left 293, down 299, left 303, down 309, right 311, down 312, right 314, down 315, right 316, down 317, right 318, down 323, right 328, down 333, right 334, down 335, right 340, up 343, right 344, up 345, right 346, up 347, right 348, up 349, right 352, up 353, right 355, up 357, right 358, up 361, right 366, up 371, left 375, up 377, left 378, up 379, left 380, up 381, left 382, up 385, left 387, up 389, left 392, up 397, left 404, down 407, left 410, down 412, left 415, down 421, left 425, down 426, left 427, up 428, left 429, down 435, right 438, down 439, right 440, down 445, right 448, down 449, right 452, down 457, right 458, down 459, right 464, up 467, right 468, up 469, right 470, up 471, right 474, up 475, right 476, up 477, right 478, up 479, right 480, up 482, right 486, up 487, right 490, up 495, left 497
Show HN: Ivan Chub's Homepage
If your electric car doesn't have any power then you have bigger problems than not being able to get inside it.
Name Translation from C to Swift
From the article (if you scroll down to the Camera section and expand it):

> HEIF Imaging

> Support for new file format (.heic) to save still images.
Disclaimer: Not my site. Submitted for a friend.
Actually it does make a difference. If an employee accidentally commits a CSV file with customer private data, are you actually suggesting that it should not be possible to remove it?

I disagree. The quicker that the personal data can be taken down, the less chance there is for someone to discover that personal data. I can't imagine any large company being comfortable with developers choosing technology that makes this harder to deal with than it should be.

(I am not at all suggesting this scenario is ok, simply asking how one would deal with it if the scenario should occur.)
Vaping lung disease symptoms: Here’s what the CDC says to watch out for
The EU can much more easily absorb the loss, and has more reason to care about the terms of the deal in terms of it matching the trade agreements with other partners of various levels. It also has more to lose if it gives the UK a sweetheart deal. Not a great bargaining position, really.
What are you talking about? We're the second biggest contributor to the EU.
N1570 6.7.9p11 says that the constraints and conversions for simple assignment apply to scalar initializers.

6.5.16.1p1 says that, for pointers, "the type pointed to by the left has all the qualifiers of the type pointed to
by the right".

In this case, the right operand is a pointer to a const-qualified type and the left operand is a pointer to a non-const-qualified type.

(Without this restriction, you could silently discard const qualification just by assigning or initializing a pointer, which would largely defeat the purpose of const.)
The closest to that model is Tidelift, though last I checked, they still sell only add-on assurances, not permission to use the software to begin with.
Trust is not something that you can establish instantly. Trust is something that is built and diminishes over time. I would look at trust as more of a percentage of certainty rather than a binary value. It's not a solvable problem in the sense that a single source, (ie newspaper) has many authors that come and go that increase or decrease trustworthiness. People are inherently fallible so they will always be untrustworthy to some degree.

I once had a theory that you can use computers to prove lies during courtroom testimony by finding conflicting statements using prolog. However, the lack of confliction doesn't mean it's a true statement.
I think Lambda is more like Uber and Docker more like Rent-A-Car.

With Uber you don't have to drive, they just fetch and deliver you and a few things you have on you.

With Rent-A-Car, you can transport much more stuff, but you also have to drive yourself.
Aurora Serverless also handles connections. The problem of having a burst of 1000 concurrent invocations accessing your databases still exists even with VPC access
There's a scale to these things.

A free vote allows an MP to vote against their party with no consequence.

at the other extreme we have:

A three line whip, which is literally underlined three times, are votes and proceedings the government considers important. Traditionally manifesto promises and last votes on major bills. Voting against a three line whip can result in removal of the whip, ie expulsion, but traditionally even this has been rare. Parties have usually had a few MPs well known for voting against them on some issues, and managed to keep them on as MP. Throwing out 21 when you lose your very first vote is unprecedented.

Mind you, losing your very first vote as PM is unprecedented. :)

https://www.parliament.uk/about/mps-and-lords/principal/whip...
I see a very simple solution to the Irish Backstop: Give Ireland back.