skysight-inc/HackerNews huggingface dataset:
7,712 Pulse Secure VPN servers vulnerable to CVE-2019-11510 worldwide
Weekly CVE-2019-11510 Scan Results
• Vulnerable Pulse Secure VPN servers detected: 7,712
• Unique ASNs affected: 1,690
• Unique hostnames: 5,054

This arbitrary file reading vulnerability allows sensitive information disclosure enabling unauthenticated attackers to access private keys and user passwords. Further exploitation using the leaked credentials can lead to remote command injection (CVE-2019-11539) and allow attackers to gain access inside the private VPN network (CRITICAL RISK). Our disclosure is available here: https://badpackets.net/over-14500-pulse-secure-vpn-endpoints-vulnerable-to-cve-2019-11510/

In the last week, a new proof-of-concept post was published demonstrating client RCE and how to obtain root SSH access to the Pulse Secure VPN server. This illustrates how CVE-2019-11510 can be exploited further to spread malware and gain a persistent backdoor into sensitive networks. Link: https://medium.com/bugbountywriteup/pulse-secure-ssl-vpn-post-auth-rce-to-ssh-shell-2b497d35c35b

Opportunistic mass scanning and exploit activity continues as well. We’ve detected additional hosts attempting to download "etc/passwd" and "etc/hosts" files from vulnerable Pulse Secure VPN servers. We've also identified compromised Pulse Secure VPN servers in the wild, so it's imperative to patch your affected servers.

Results are freely available for authorized CERT, CSIRT, and ISAC teams. Submit request via https://badpackets.net/contact/.

Total vulnerable Pulse Secure VPN servers by country:
🇺🇸 United States: 2,534
🇯🇵 Japan: 1,080
🇬🇧 United Kingdom: 531
🇫🇷 France: 315
🇰🇷 South Korea: 278
🇩🇪 Germany: 274
🇨🇳 China: 206
🇧🇪 Belgium: 181
🇨🇦 Canada: 175
🇨🇭 Switzerland: 163
All others: 1,975

World Map:
https://docs.google.com/spreadsheets/d/1m5UyE5eRZ8wN5lGUN0dwUhCtJPpqVIPcS_LTk_SToY4/edit#gid=1141509958
Why does the state need compensation? It’s an aquifer the state isn’t treating waste water and selling it to Nestle. Commercial water rates include treatment and all the infrastructure to move it around.

That’s similar to saying farms should pay the state for using soil.
Underpaid based on their skill-level?

The driver delivering your food or groceries typically gets a tip, but the driver delivering your package doesn't. It could actually be the same driver since they are now both gig-economy jobs.

Warehouse workers, retail store workers, even the cooks and dishwashers at those same restaurants make less on avg. than waiters/waitresses, and yet don't get tips.

Tipping is mostly tradition, it has to do with how 'close' a job is to an end-user. There is little logic to it.
Personally, I dislike having to plug in multiple cords. 3.5mm also doesn't transmit what you're listening to. I find that pretty useful to know. My phone screen is used for other things besides displaying song info.
*Investors Questioned Governance, Path to Profitability

That line is telling. Will investors and the board grow a pair and give Adam Neumann and his family members the boot?
What is bizarre is the agenda pushed on Hackernews all the time. Sorry bro, I come to a hacker site to learn about tech. I'm always going to point out when people are pushing an agenda.
That video had so much bullshit I had to stop. 1ms ping? Get a clue dumbass. Physics.
As I said, good numbers appear hard to find. Good luck even finding a good estimate of what percentage of uninsured care is paid for by the uninsured. The closest thing I found is that the insured and the uninsured tend to pay about the same amount out of pocket but the uninsured have consistently lower incomes so are spending a higher percentage of their income.

As a point of reference, I am uninsured and pay all my medical bills out of pocket. I have never received any uncompensated care (because I can afford it). I suspect that the uninsured pay for a much higher percentage of their care than people assume.
> How exactly will my 401k lose half it's value before I retire? Are capital owners going to stop making money or something?

Believe it or not, markets go both up and down. While it's true that the S&P 500 has shown great paper profits most of the time, for the longest time, other markets haven't been that lucky:

http://www.thebubblebubble.com/wp-content/uploads/2012/05/ni...

We haven't seen the end of a historically unprecedented low-interest phase yet. Even without a breakdown in nominal terms, at current rates of asset price inflation, a million dollars might not afford you a porty-potty in one of the better areas of the country.

> It's not what you earn, it's how much you have left over after you pay the bills.

Generally speaking, purchasing power in the US is higher and the tax burden is lower. Of course it really depends on where you live. If people earn more, prices will be higher as well. There is cheap housing in the US and expensive housing in Europe. You have to compare "similar" cities, e.g. San Francisco with London:

https://www.numbeo.com/cost-of-living/compare_cities.jsp?cou...

Also, for socialized healthcare, you will generally pay more than 10% of your paycheck, however high that may be.
Why would you need to explain why someones hasn't got a promotion? As an employee, you can expect a raise, sometimes, or a golden watch, maybe, after x years of service. But there is no reason to promote someone just for doing his job, no matter how good or how long he has been doing it. On the contrary, it would be dumb to do so.

edit: typos
Wouldn't you be much less personally identifiable one hop upstream?
A really fantastic essay. Thanks for sharing.
This is an awesome case study. Thanks for sharing. I was having trouble coming up with good use cases for this, but this makes a ton of sense. It's basically like a much more advanced, better Firebase/Lambda/Google Cloud Functions/Azure Functions.

I am in the same boat. I often build apps that are pretty much 98%+ clientside, but there are just a few routes I need for the backend that would add a lot of value, but if I were to create those I can no longer sleep soundly at night because suddenly I have to worry about online storage security, pingdom checks, deployment pipelines, etc.

Now I get where this could be really, really useful.
I'm not sure how one would go about addressing this problem. While it could be argued that Big Pharma pushed for psuedoaddiction more than necessary, that doesn't necessarily discount what the patients were saying. From the article, it sounds like a doctor with experience with the patient could distinguish between addiction and psuedoacction well, but the doctor also wants to avoid bureaucratic oversight and risk causing harm to their patient.
He needs a bar which he admits he doesn't have..
Well, I don't write one-liners that are meant to be maintained either, but I don't put my piped commands of grep, but, sort and uniq into small source files either. They're meant for different things. There is conceivably a case for small one-off programs just like a chained shell statement, and that's what a one-liner is for.

For a really simple case, leveraging a module in the language to do the heavy lifting and do something per line. If I want robust CSV conversion for a TSV, loading up a CSV module in Perl or Ruby and letting it act on each line (after appropriately split on tab, and with the newline removed from each line, both a single command line switch away) is a very small one liner that's appropriately leveraging the language to do something that's hard with common shell utils.

There's a whole world of ways to leverage a powerful ecosystem with the built in one-liner features of Perl and Ruby. If you don't often find yourself doing a lot in the shell, then I can understand having a hard time imagining a case where it's not always better for a small source file, but for anyone whose responsibilities also entail a fair amount of system administration tasks, it can be extremely helpful.

If for nothing else, the number of times I've used autosplit or a nice regex to parse a complex line into an appropriate SQL statement I can output to another file, check, and then run is quite large. These often amount to a single regex and print per line, and are on some other log portion I've already grepped out, so generating the boilerplate for the line looping is actually more code than the actual statements that need to run. Add to that the times that there's no maintenance needed because the scripts are used to fix a one-off problem, and there are specific use cases where one-liners make sense. For a lot of people's workload, that might not be the case, but I definitely see the cases where it is.
>If it were that simple people before Piketty would have reached that conclusion earlier.

Perhaps you've heard the expression, "The rich get richer while the poor get poorer"

What Piketty did was put extensive data and a pretty rigorous methodology to work to explain why. I've not read a critique that undermines his main conclusions in a meaningful way.

It's no secret that if you already have a pile of money or capital assets you can put those to work for you which will also generate income and you will come out ahead and faster than someone without the same pile of money.

Cf https://boingboing.net/2016/08/23/bill-gates-net-worth-hits-...
I thought XMR had high transaction fees?
I don't disagree, you and I could probably sit down and hammer out a much different plan based on our preferences. But neither of us are running for president in 2020 are we?

This goes back to the denial thing being more about time and money than the abstract notion. We don't have the time to wait for better plans or options anymore. A bad plan this election cycle is vastly preferable to a better plan in 4 - 8 more years.

There is a 16T command-and-control option on the table in 2020. There is no carbon tax and/or nuclear option on the table. We have to address reality not our preferences for a hypothetical ideal.

Even if Bernie's plan turns out to be a disaster, that's a failure we need to get through as fast as possible so the public accepts a carbon tax funded nuclear renaissance as a plan B. Which again, may be your and my plan A, but its not where either the candidates or the electorate are TODAY.
In order to do that, the electronics inside the drone would need to be susceptible to the electronic noise. Sure, RF shielding from a military grade perspective is difficult, but for this purpose, copper paint surrounding the electronics enclosure may be sufficient. With GPS denied, inertial and visual navigation would be required. Inertial navigation quickly succumbs to accumulated error, but if GPS signals are stopped (jammed) just a few minutes before impact, INS will probably work, given a calm atmosphere, there won’t be much noise inducing turbulence. Visual navigation is much harder, but the advances in machine learning are making this problem trivial.

RF interference is likely the best defense, as quality RF shielding is difficult, especially at extreme frequencies.
In my experience, companies that have a policy of type 1 promotions are not to be trusted with one's career.
I wouldn't even bother with Hackintosh (unless you are building iOS/MacOS apps). Been running Pop!_OS at home for a few weeks now, and although there have been a couple hiccups (alsamixer to fix one, kernel update and drivers for wifi the other), it's been the best desktop Linux experience I've had in years. Been mostly terminal/server/docker instances for about 5 years.

And although there are some options for better Windows experiences (WSL, Docker etc), I'm using Linux at home... laptop is an ageing late-2014 rmbp (though nvidia, so updates are borked) and stuck with Windows at work.
Started january 2016, so I’m almost 4 years in. I’m actually thinking about dropping some consultancy clients so I can focus even more on my own projects.

I get that it’s not for everyone but I grew up on a farm so I kind of got used to the quietness early on I guess.
what's this? are you retarded or something?
In many states this is no longer true, owners must make up the difference if the worker gets insufficient tips.
I’ve bought and sold a bunch of vintage camera stuff on eBay, and it’s mostly been okay. Just a hobby type thing for me. Not much in the last couple of years though. A couple of times there were minor issues. The fees really are bad, though.
Based on the examples he gives, physicians seem to have a disappointingly unsophisticated response to the word “addiction” or to any signs that point in the direction of it. Even if you are physically dependent on a drug and respond poorly to having it withdrawn, you’re not addicted in the clinical sense unless you’re engaging in problematic behavior. That nuance seems to be lost on far too many doctors amidst the current moral panic.

I wish that we could have a more nuanced response to the true horrors of the opioid epidemic. But perhaps even highly trained doctors aren’t capable of more discretion. To be pessimistic and reductionist, the only options are “make drugs harder to get across the board” or “make them easier to get” and we’ve chosen the former. That may help with the opioid crisis, but it has its own costs.
You can configure this in KeePass as well, I've done this for a few sites I actually use a lot. But I can't be bothered for every single service that decides to re-invent login.
The SFC isn't a bunch of randos -- they handle the administrative end of things for a whole bunch of high profile foss projects:

https://sfconservancy.org/projects/current/

Half of their staff has worked for the FSF in the past. More than one of them has given a keynote at the FSF's anual conference. These folks are tightly integrated into the bits of the free software movement most closely associated with RMS; the fact that they've come out and said this is a big deal.
There are multiple treaties at play here, at the very least, like the Berne Convention and subsequent treaties about copyrights, and the Mutual Legal Assistance Treaty between Canada and Germany: https://www.treaty-accord.gc.ca/text-texte.aspx?id=104860

There are criminal copyright infringement laws in both countries...
But the lawyers here cannot actually force the German state prosecute anyway, and it seems they did not file a criminal complaint anyway, and even if they did the prosecutors' office would most likely deny prosecution against EasyDNS since they are only a service provider and not a direct party to the alleged infringement. The prosecutors' office would probably even deny a prosecution against the actual perpetrator because it's just about a single image and thus a minor infraction.
So right now it's just a civil matter.
GM's Search for In-Car Tech Lands on Google
CA generally has a heavy tax burden. There are other "blue states" with lower tax burdens but the original comment was right on... generally middle of the country is cheaper.
Well, I'm super impressed. I wish I could do half of what this guy can do.

But he needs to be careful not to overdo it. It's fun and exciting to get all this tech up and running. But at some point, it becomes a drudge. And burnout is right around the corner.

I would say that if he can farm out as much as possible and focus on marketing and sales which are the drivers for most company's continued success. In a sense, he has by using the cloud but what he's doing is way too much for one person.

I used to be a laid back kind of guy and would get irritated when I was hurried and clearly there was no impending death. But now I understand that the limit lies within us. At some point, we all give up. There are those that take a long time and there are those that give up relatively fast but giving up is part of the process. So we are in a hurry to get as much done before we decide to stop what has not been successful. By putting so much burden upon your self you make it so much more likely that you will give up before you find success.
I've found the tradeoff is in favor of using ECS, Kubernetes or something similar. The docs aren't too bad now. It is great to be able to build/deploy a docker image and not worry about how it gets out there, and what might go wrong with that system.
> I like the flow of your question: “who is using any of these”… “except for the ones people actually use” :-P

Yeah, it was kind of clumsily worded. I get why people use the ones that are the only options for their respective target platforms (browsers, microcomputers, etc). I don't understand the advantage to using compilers besides gc, although your comment provides some clarification.

> To answer your question directly, I don't know any large projects that use them, but they exist. Which means that there is an alternative. Unless Google goes full Oracle, that is.

My question wasn't whether or not there is an alternative, it was simply "who uses the alternatives and why?".
I'm not questioning that the behavior happens, or that it is detrimental and the addict knows that to some extent.

I'm objecting to using the word "choose", which has moralistic implications in addition to being of questionable utility in a functional sense of describing the behavior.
> You're thinking on an individual level, presumably a god has all of humanity to think about

That's even worse! All those dead children are just a way for the privileged people to understand how good they have it. Be grateful for what scraps I give you and reduce yourself to your insignificance, peasant!
"pen-tester" -- this reminds me of the times "pen testers" have literally stalked people and broken into their houses.

Breaking and entry and stalking, are both illegal for very good reasons. Pentesters who do this without consent are acting unethically, breaking the law, and putting themselves and others in danger.

If a pen tester really believes physical compromise is something that should be tested, they absolutely cannot do it without consent of the involved parties. If the business reduces the value of the test by changing security rules during the process that's their own wasted money. If you want to be testing employees you need case by case consent - again, if they changing behaviour during the test, it's simply the company's money be wasted. A company cannot tell the pen testers to target employees without the both informing and getting the employee's consent.

I continue to think people calling themselves "pentesters" while doing this kind of nonsense give actual professionals a bad name.
> I was asked how much the log was "worth" so that they could justify the cost of the extra hardware.

You answer that question with a question, how much is a one month delay in shipping worth to you?
Devil's advocate position (mostly from a book, "Dreamland", about this topic):

"Pseudoaddiction" is deliberately defined such that it's indistinguishable from actual addiction. The concept was popularized by Purdue Pharma, who were trying to market OxyContin.

At the time, providers were averse to prescribing opioids because of addiction concerns. Purdue created the "pseudoaddiction" term to teach providers that just because someone looks addicted, you can keep prescribing them opioids anyways.

At the same time, they lied with statistics to tell doctors that opioids only caused "true" addiction in less than 1% of cases.

Thus, the brunt of the message was that if you see addiction, there's a 99% chance that it's not real addiction.

Many doctors were convinced. Now the nation is dealing with an opioid epidemic driven by OxyContin.

Pseudoaddiction exists. But actual addiction also exists, and it's more dangerous and more likely to happen. Being afraid to diagnose "addiction" because of "pseudoaddiction", is just FUD.
It's pretty smart from a marketing point of view. It gets everyone on HN riled up and so lots of comments and upvotes whenever they post.
The major cities being designed without children in mind
I am an (inactive) addict and I don't find it to be moralistic or questionable in utility. It's the correct description.
California has a very complicated relationship with water. Because most of our state is a desert, water rights are something people literally killed over until pretty recently. Strong water rights are codified into our laws, and they mostly have to do with land ownership. You own the land you own the water underneath.

It makes it really easy for Nestle to take advantage of laws written for farmers 150 years ago.

We're slowly changing the rules about water so that we don't destroy California farming but still have water left in 50 years.
>Amazon says it operates in fiercely competitive markets, it represents less than 1% of global retail and its private-label business represents about 1% of its retail sales.

While the graph towards the end of the article indicates Amazon captures ~35% of online retail in the US

What a disingenuous way for Amazon to communicate - I hope the people their original quote was directed to saw right through this.
Only if you consider $0.002-$0.006 per transaction high. The protocol has been significantly streamlined over the years.
>he's doing is way too much for one person

You have no clue what is "too much" for the author of this post.
Good on you for the disclosure - but anything good you say is going to be ignored because of it :-)
Can you explain why 1ms ping is not possible because of physics? Otherwise this comment comes off as rather rude and unhelpful.
There's been dozens of these products. Some have even been supported by Google, Facebook, and Co.

Nobody uses them.
There’s an app called Opener that lets you open third party apps in the relevant pages quickly. Not as fluid as Android but still quick. Personally I’ve been very happy with iOS since the switch a year ago. I’d like to point out that the biggest charm of the gestures is that it’s essentially system wide, including third party apps. Swipe to go back and tap to scroll up are just too convenient and natural for me to go back.
No, the article goes on to explicitly state:

Data also shows the platform recently overtook competitor eBay, once a powerhouse in this space, in terms of quarterly sales.
What counts as advertising?
> They’ve killed the non Touch Bar MacBook Pro, while the industry laments the Touch Bar’s existence.

‘The industry’ is not Apple’s customer. Apple knows who they want their customers to be, and it makes the products that it knows they want. I’m mostly expecting them to release a smaller iPhone. But for most of your complaints and the same old complaints that get posted in every Apple thread on HN, Apple doesn’t care about them, because HN commenters don’t represent what the market actually wants from Apple.
Yeah I heard you, but it's terrible as a decision, and honestly your opinion shouldn't be allowed on HN without huge caveats that you clearly have no relevant experience in mobile development.
Supposedly es4x (powered by GraalVM) cracked the top-5 empower benchmarks, while no other Node/JS frameworks are in top-20/top-30 (iirc):

https://www.youtube.com/watch?v=JUJ85k3aEg4

The assertion in the ^ video (from the es4x author) is that node programs hop across the http/libuv/v8/etc. boundaries all the time, and that's the majority of the overhead, not actual business/program logic.

So, es4x sitting on graal brings all of those http/event loop/js runtime infra projects into a single optimizing VM.

My memory is ~fuzy on the details, but I believe I got our apollo server running running on es4x a few months back, and the latency was ~double node, which was still impressive IMO, but I didn't see the amazing gains that the author does. Not sure why.
Physicist probably. Maybe work in a national lab? Not sure if I’d like being a professor.

Physics or math are probably likely for me.
Had to fight off with this very argument when people kept suggesting that I don't need to read the Old Testament before getting to the Revelation: https://news.ycombinator.com/item?id=19955193