skysight-inc/HackerNews huggingface dataset:
We considered listing implementations we tested and deemed secure, however this is really hard to do in practice. See also the answer in the second question in the Q&A.

Most libraries have several implementations of the scalar multiplication algorithm, which they choose from dynamically, based on build options, the chosen curve, the platform, the cryptosystem/operation being performed, the current phase of the moon, etc..

We tested the libraries listed here:

https://github.com/crocs-muni/ECTester/blob/master/docs/LIBS...

as we had those implemented and so testing meant just running our tools and analyzing the results. However, even this could have missed stuff, as at first we did miss the Java vulnerability, as we focused on prime field curves and did not test binary field ones. We then analyzed most other cryptographic libraries with ECC support one could think of, but only via source code analysis.

Regarding the stars, we put those in to give some context of why we listed those particular vulnerable implementations on GitHub. We searched through GitHub repositories mentioning ECDSA, ordered by their stars as a measure of popularity and analyzed the source code of their scalar multiplication for the vulnerability. One could choose just random hobby ECDSA implementations and list them as likely vulnerable, these are just a few that are worthy of listing because of their popularity.

Edit: We have added the list of tested implementations deemed secure https://minerva.crocs.fi.muni.cz/#secure-impl.
The feature is not ready. The only reason Tesla pushed it out this early is that they want to recognize some of the Autopilot deferred revenue in Q3 to mask a YoY decline in revenue driven by lower ASPs, which damages their growth story.
https://en.wikipedia.org/wiki/Wickard_v._Filburn

https://en.wikipedia.org/wiki/Gonzales_v._Raich
literally is literally my favorite
Also, a counterpoint: Shabbat is referred to in the text of Kiddush as a "remembrance of the Exodus from Egypt". There are various approaches to explain why this is (it's more obvious for the other holidays mentioned, but less so for Shabbat), but Maimonides' approach is:

"This difference can easily be explained. In the former, the cause of the honor and distinction of the day is given: "Therefore the Lord blessed the day of the Sabbath and sanctified it", and the cause for this is, "For in six days," etc. But the fact that G-d has given us the law of the Sabbath and commanded us to keep it, as the consequence of our having been slaves; for then our work did not depend on our will, nor could we choose the time for it; and we could not rest. Thus God commanded us to abstain from work on the Sabbath, and to rest, for two purposes; namely, (1) That we might confirm the true theory, that of the Creation, which at once and clearly leads to the theory of the existence of God. (2) That we might remember how kind God has been in freeing us from the burden of the Egyptians."
Maybe because 1) FB represents a level of success aspirants hold in high regard 2) FB is a marketing/monetization platform startups find difficult to ignore

I find it hard to get excited about this.. probably will get cancelled in 6-9 months after languishing a bit.
In the current political environment, allowing the government (just about any nation's) in via eliminating end-to-end encryption is a reduction to user safety.
The comment now reads "single-family-only zoning should be banned by federal law"

I distinctly recall it calling for a ban on single family housing. Considering that there are many replies calling it an overreaction and replying as thought it called for a ban on single family housing in general I would be willing to bet money it did not originally say what it says now.
I get a feeling that contentiousness works better with the normal post format that usually links to someones opinion on a subject that is obviously contentious here.
Homographs are words that are written identically. I don't understand what you're trying to ask - the etymology of a word is not at all relevant to how it's spelled.
Along similar lines of thinking it would be really nice if the young people would vote as consistently as the old people.

I'm in between generations and watching the old vs young bickering / division is painful to see... but I've also got a low tolerance for a lot of the "OMG boomers" stuff out there from folks who as a whole have a really poor voting record. Get in the game people....
The Golden State Killer was a cop that didn't have his DNA taken, and was used as a justification for cops taking your DNA.
Agreed.real value is Layer 2 swaps that are faster than coinbase without custody
> many parents were advised by doctors never to tell.

It's a good thing we've cured all genetic diseases then.
The ‘1984’ ad should be re-edited so that the protestor running down the aisle with their hammer stops running when they realise that Apple disabled their hammer.
The working document linked to by this press release:

https://bitbucket.org/openid/connect/src/default/How-Sign-in...

Since September 2019 all spec violations have been addressed by Apple, as recorded in the next section. The section thereafter - "Peculiarities" lists specific implementation choices by Apple that differ from what most implementations provide, but are not spec violations per se.

The previous HN discussion about the spec violations:

https://news.ycombinator.com/item?id=20311000
> nobody should face any consequence for having it.

Nobody ever faces any consequences for having any opinion, but many people very often face consequence for expressing some opinions, in some forums and under certain circumstances. For example, politician are commonly voted out of office, losing their job in the process, for expressing some opinions, and here in the UK even ordinary party members are commonly expelled for expressing some opinions. So even in free democracies, we accept and even expect certain consequences for voicing certain opinions, by certain people, in certain forums, and under certain circumstances. The decision of what those consequences are, and who, why and when they would face them is often made by a particular relevant institution. So it's a matter of degree, not of principle.
So I don't currently use Apple products, does this mean that people can use their own OpenID Connect identity providers with Apple (like if I run an Open ID Connect server at idp.example.com, I can add it as an authentication source) or is this just for using Apple's Identity Provider to allow your own apps to log-in via your Apple account?

Open ID Connect is essentially a an OAuth2 implementation. The original Open ID 1.0 concept, where you could use any identity provider with any service provider, is pretty much dead:

https://battlepenguin.com/tech/the-decline-of-openid/
interesting project. I found and had a play with pyqt just recently and quite liked it. https://github.com/pyqt/examples
According to the article most of its participants were using nicotine and marijuana products in oil forms but nothing was controlled for. Also they don't know what is causing the problem. Just that a few people who vape have lung damage from something resembling chemical burns.

"The findings were published on Wednesday in The New England Journal of Medicine and involved samples from 13 men and four women whose ages ranged from 19 to 67. About 70 percent had a history of vaping marijuana or cannabis oils."

"Medical investigators have been unable to identify exactly what is causing the lung damage, or even how many harmful substances are involved. They do not know whether the source is the liquids being vaped, or a toxin released from the materials used to make vaping devices. It is also unclear whether some devices used in vaping may be defective."
That's an interesting position, I would expect clickbait to be more important on the normal posting format, because users are being asked to go to some external resource for reading.
I think the two meanings of "oversight" are not quite interchangeable. One is a mass noun (used without an article): "better oversight is needed"; while the other is a count noun (used with an article): "it was an oversight". So "because of oversight" sounds odd to me; I think it would be "because of an oversight", which would unambiguously indicate the "error" sense.
I was at Google for 2 years and liked "Testing on the Toilet" plus it's spinoffs "Programming on the Potty" and "Localization on the Loo" pretty useful. Especially for someone like me who came from much smaller companies where a lot of best practices or tools they wrote don't exist.
>In the real world, the shape of cows is not a sphere, nor even a closed-form equation. And real organization care about blame, and as the saying goes, shit rolls downhil

The difference is that in the real world, organizations exist that don't merely blame the developer, and aren't really that rare. To give you an idea, I simply don't work for managers that are focused on blame. I probe this during any interview I have, or for any position I'm considering. It's on my list of "Life is too short to put up with this."

I don't have trouble finding jobs.
I will try this today with my own personal kanban board. I do find myself with cards moving back and forth a lot. The way I've dealt with "Cancellations" is I have a list called "Waiting" where I stick tasks that are blocked. Sort of like pending review but it could also involve waiting for a resource, a response, etc.

I think if I implement cancellations with details it could help me figure out what processes are broken that caused fires(i.e. this report is suddenly due, overriding everything else. Did I miss a memo? Do we have a solid process for anticipating these sorts of reports in the future? etc.) I could then go back during some planning time to view what needs some brain time.

Thanks for suggesting this!
I know some people who eat vegan to avoid a number life threatening allergies, so it's not always about ethics. It usually is, though.
I would gladly move to any country that did not have this police ability in a heartbeat. There is no level of security that can justify to me anyway, even the most mundane aspects of our policing activity.

The problem is that police don't actually make anyone safer, they simply create order for the state after something has occurred. I have never once called the police and had them actually do a single thing to help or solve the problem I was facing. Yet I can recount countless instances of them harassing me for nothing? Why is that? Maybe the fundamental notion of 'secure vs liberty' is flawed if we aren't actually provided with more security.
I was one of them for 24+ years.

At least, for my experience, if you look significantly different from your family then you start to really question things and want to do DNA testing ASAP.
Reminds me a bit of React-Native-Desktop, which also uses Qt.
You’re using words like “targeted” and “vulnerable” to imply there’s some kind of harm being done here, which is laughably false. Just because something strikes you as wrong (for whatever ridiculous reason) doesn’t mean it’s actually wrong, let alone “gross and deeply unethical.”

Are osteoporosis researchers unethical for “targeting” women?
Wow, I honestly didn't even know that had a name. I worked at a place that did this but I just thought of it as "the only time I've seen Agile actually work".
All of the videos I have seen of the summon feature have been pretty bad. A lot of time the vehicle can't seem to figure out what to do. I imagine that will get better with time, but if I had a Tesla I wouldn't be using it now.

I'm surprised they released the feature as-is.
You mean, should free advertising-subsidized services even exist?
> This is the same in any statically typed language

Surely not in any statically typed language. Languages like Java cannot encode the same useful information (or rather, you cannot force them to) as languages like Haskell. Specifically, you cannot make them enforce lack/presence of IO in their types. Most mainstream statically typed languages cannot do that, in fact.
I'm really glad this stuff is being researched, male stereotypes like that have never held true in my experience.
Mapping Online Hate: A Scientometric Analysis on Research Trends and Hotspots
If we're positing users clever enough to modify the client, then such users could also just modify the client to scramble all CP images so that they would not be detectable via fingerprinting and can only be descrambled by a patched client.

People sending CP through whatsapp/FBM are not clever. If they were clever, they wouldn't be doing that. The justice department is not primarily interested in catching clever criminals, at least not via this particular mechanism.
Of course, but I'm having trouble understanding why this works on an infinite number line. Say you flip over a 2,387,290,723,013,172,348,238,987: what do you think is the right guess?
There's quite an interesting discussion of this phenomenon called "The War on Sensemaking" worth watching/listening if you can sit through more than 10 minutes of discussion.
Economic growth is scored through productivity gains, not more people.
Broke the bank: disastrous IT migration corrupted 1.3B customer records
https://www.bettermotherfuckingwebsite.com/
We have one small piece written in React. It will be replaced when the Angular is finished being moved to Vue, and all new dev is in Vue. It’s a nearly 8 year old bundle of over 56 and counting HR apps and is a feather in our department’s cap for how much money it has saved.

I wanted to move to React initially but after adding a single new app my boss hated the syntax and we switched to Vue. Vue is good too.
There are ways to run trusted code on a client using remote enclaves (provided it is supported by the local CPU)

https://signal.org/blog/private-contact-discovery/
> Who prioritizes?

The same people that did before.

> Kanban seems very chaotic

Business is very chaotic. Admittedly, we (where I work) are a very bare-bones team, so we are quicker on our feet than a larger organization.

The main issue we would run into with "sprints" was that the business world-view didn't stay fixed for 2 weeks at a time. There was always something that came up and got bumped in priority. This led to people feeling disappointed that "we blew the sprint".

In reality, "the sprint" doesn't matter. Solving business problems matters. Kanban (Wikipedia says it's just japanese for "billboard" i.e. "big priority board") is just a way of explicitly stating the current priorities so that you can react to them.

> As a manager, how do I know how long a task should take?

You still break down big tasks into small tasks and estimate them. The planning process isn't really any different than with sprints, it's just that you're more free to make trade-offs in real time.
I don't think it's dumb at all, I bet it does count as an ingredient to an overall compelling post.

Ignoring a fact like posting when a large number of users are potentially active does appear detrimental to the goal.
Great writeup. Once again, physical access owns. This line stuck out:

> The attack required 11000 signatures

For a smartcard, this seems rather impractical in the real world. My Nitrokey has 1938 total signs after a month of usage, signing every git commit to our company repository and using it to authenticate over ssh (gpg-agent)
Instagram's New App: Threads
I don't think it's marking hyperbole, but being itself used hyperbolically.
Improving Quantum Computation with Classical Machine Learning
Xi Jinping in China: https://en.wikipedia.org/wiki/Anti-corruption_campaign_under...

bin Salman in Saudi Arabia: https://en.wikipedia.org/wiki/2017–19_Saudi_Arabian_purge
I wonder if it's because they didn't want user code to have access to browser APIs, to avoid inadvertently growing dependencies on them.

edit: they explain all the rationale here and it makes a lot of sense to me:

https://www.figma.com/blog/how-we-built-the-figma-plugin-sys...
Thanks, a paper is being prepared with the full details and an improved method. The sensitivity of the method to noise (one bad inequality in the lattice can make it not find the key) is really worth looking at, as that would improve the number of signatures necessary for the attack severely.
The top of https://bellard.org/quickjs/ is the changelog and each release is versioned by date.

Nobody's a fan of the quirks of JS, but you can almost entirely ignore them and only use the good parts.
Swaps are already operational in testnet and we demo'd them at various public presentations. Its currently in beta testing and will be launching in a few weeks into the app. Re: business model, product is free to use but there is a maker/taker commission in swaps. In addition, some users can run the node for swaps, that generates passive income without any hardware investments.
Why bother. Motivated community will just use their own encrypted tech to communicate.
This isn't just life, it's a business that failed to live up to its contract.
What a great way to convince even more of my contacts to switch to Signal :)
It's not necessarily the lack of interest, but instead the absolute choice to not consider it at all.

In terms of biology plenty of humans thrive on vegan and vegetarian diets.
What I find really strange is that the murder of one US/Saudi journalist is apparently worse than the mass murder being carried out by Saudi Arabia and US in Yemen. Why is that? Is it because Saudi Arabia did not get explicit approval from US to murder Khashoggi? Or is it only because it could be used as a political point against Trump?
> I really don't want to try out synthetic haeme or whatever

It's not synthetic, though. It's real heme in real leghemoglobin produced in yeast instead of hemoglobin in animals.
Is nVidia no longer one of the two biggest GPU vendors?
No worries, and I understand your concern. Yes, there is a neighborhood arterial (2, actually) as the only routes to the office park. To be fair, they're arterials with 30mph speed limits (no driveways on them), which, frankly, makes the stop signs all the more galling. (they were specifically called out in a traffic study of that neighborhood as the WRONG way to control traffic on that type of road).
The best part of React is the virtual DOM, the templateing technology is not novel.
A third party observer cannot read the messages as they pass through the whatsapp network, but Facebook can read the messages at both ends.

Facebook has said that they don't do this outside of Australia, where it is required by law, but come on, are we really going to take Zuckerberg's word for it?
And also vicious physical assaults. They can leave people injured for life.
What is the latest "most secure" crypto I should be using?
In some places these are called Engineering Project Managers, in others they are Technical Program Managers. You may think they are worth All The Money but let me assure you they usually make far, far less than the developers :-)
It doesn't increase financial stability, it's a sign that you've achieved it. Though, a married man may seem more hirable to a company, since they can presume he needs the income to support not only himself, but his family.
"Why do we let these arguments have force at the national level but ignore them at subnational and supernational levels?"

Because nations already exist and are they are accepted. Sometimes their borders are accepted too.

Around 2015 I had a conversation with a Slovenian who told me that if I didn't like the new population density in my city then I could move to Wales.

It's unlikely that I would be allowed to build a wall around Worcester or that London would be allowed to create a high tech system for identifying, catching and repatriating northerners. (Although a Chinese-style social credit system might work.)
Probably it is just laziness: if the next closest place to go for lunch is few miles away and your office cafeteria goes vegetarian then you simply find few least bad vege options and stick with them.
Not really.

If a sibling or parent sends DNA sample X, they do not know what your DNA is.

If someone also provides DNA sample Y, they can know that it is the DNA of a relative of X.

But...is that really worse than normal life? That's approximate not admissible in court. And DNA or not you can already figure out someone's associates a hundred different ways.
Eh, if you aren't married, why bother getting your own place? Especially after living away at college for 4+ years, it's not so bad to come back home for a while.
It is a lot easier from a technical standpoint if the group you pick is not already in tech. Replace "rails developers" with something like "antiques collectors" or "massage therapists" or "arborists" any other profession that isn't saturated with software options already. These people all have smartphones and computers but probably have only crappy options for how those tools specifically accelerate their work.
We’re Getting Ripped Off
Oh wow, very interesting. Are you a PhD who works in this area too?
Can't check chapter and verse on the standard right now. Will you take cppreference[1] as authoritative? See the section on data races. The C11 memory model only differ minimally form C++11.

[1] https://en.cppreference.com/w/cpp/language/memory_model
Okay, but starting teacher salaries in CA are in the low $40s. Try living in SF or LA on that. I know my friend was teaching for 8 years and got a job in LA for $80k, but she left to go to Vegas because they pay a lot better there ~$100k, plus no state tax, plus it's way cheaper.

So, yes, maybe median is not bad. But starting out -- especially in a city -- seems really bad.

Especially when you factor in almost all of these teachers have college debt of about $30k+ to pay off...
Yes, managing software development is generally hard and there is no silver bullet. But I do think that the methods that I commonly encountered before Agile were better in terms of both developer stress and software quality.

Interestingly, in many ways they also weren't all that different from what Agile is intending to bring. They still involved something analogous to "sprints", they still allowed for course correction and pivoting during development, and all of that.

Agile seems to position itself as the opposite of "waterfall", but outside of large corporate environments, I'd never seen a shop that actually used waterfall as described by the Agile community.
Indeed, as I responded to the other mention of this, I think engagement with organic subject matter is different than the engagement that comes from asking introspective questions like this one.

That's my personal opinion right now, I could be wrong about it philosophically.
Thinking more hard about it I can't really say that electron is pretty much an anti-pattern.

The idea/strategy behind chrome is simple though sophisticated:
1. Move all the software to the cloud.
2. Have a browser which pretty much lets you do anything you could with a regular OS from generating sound to using various input devices, to secret management, to displaying 3d content, etc., etc.
3. People will use the browser for everything from document writing (gsuite), to movie watching (youtube) to gaming (stadia), to file admin (drive) without every needing to install anything locally ever again.
4. You are now owning the OS market with win/mac/linux only serving as a VM to run Chrome which is essentially the portal to 99% of the Software your userbase uses.

Tinfoilhattery and cynicism aside, I don't think electron, where you actually try reverse the browser into its subservient state as a simple "app" is a sound strategy. This clash of philosophy really shows in the technical shortcomings of electron. If you want an actually interesting project create a small thin runtime that allows you to build html/css/js user interfaces rather than trying to make Qt great again by porting it to chrome.
Athena’s IDProtect Smart Card and Middleware Approved for US Government PIV/HSPD-12 Deployment

https://www.securetechalliance.org/athenas-idprotect-smart-c...