skysight-inc/HackerNews huggingface dataset:
Yeah the data must start with a specific prefix, but can otherwise contain whatever it wants. Anyways, even the shattered attack, which this paper says costs 11k to execute today, had a pdf specific prefix (the shown part is the same in both files):

$ curl -s https://shattered.io/static/shattered-1.pdf | hexdump -n 512 -C
00000000 25 50 44 46 2d 31 2e 33 0a 25 e2 e3 cf d3 0a 0a |%PDF-1.3.%......|
00000010 0a 31 20 30 20 6f 62 6a 0a 3c 3c 2f 57 69 64 74 |.1 0 obj.<</Widt|
00000020 68 20 32 20 30 20 52 2f 48 65 69 67 68 74 20 33 |h 2 0 R/Height 3|
00000030 20 30 20 52 2f 54 79 70 65 20 34 20 30 20 52 2f | 0 R/Type 4 0 R/|
00000040 53 75 62 74 79 70 65 20 35 20 30 20 52 2f 46 69 |Subtype 5 0 R/Fi|
00000050 6c 74 65 72 20 36 20 30 20 52 2f 43 6f 6c 6f 72 |lter 6 0 R/Color|
00000060 53 70 61 63 65 20 37 20 30 20 52 2f 4c 65 6e 67 |Space 7 0 R/Leng|
00000070 74 68 20 38 20 30 20 52 2f 42 69 74 73 50 65 72 |th 8 0 R/BitsPer|
00000080 43 6f 6d 70 6f 6e 65 6e 74 20 38 3e 3e 0a 73 74 |Component 8>>.st|
00000090 72 65 61 6d 0a ff d8 ff fe 00 24 53 48 41 2d 31 |ream......$SHA-1|
000000a0 20 69 73 20 64 65 61 64 21 21 21 21 21 85 2f ec | is dead!!!!!./.|

The shattered attack was about a so-called "identical prefix" collision, while the shambles paper's collision was a "chosen prefix" one. You can choose it in both cases, but in the "chosen prefix" one both colliding prefixes can be entirely different (and can be as long as you want btw, the attack doesn't cost more if the prefix is 4 KB vs 4 GB), while in the "identical prefix" case it has to be identical.
You don't have to look it up if you don't want to, but you should know the health risks of eating factory-farmed meat (regarding antibiotic resistance, among other things) are almost assuredly worse.
Interestingly, this follows the systemd people back in 2018 changing its seed-at-boot tool, systemd-random-seed, to write the machine-ID as the first 16 bytes of seed data to /dev/random at every seed write.

* https://github.com/systemd/systemd/commit/8ba12aef045ba1a766...

* https://www.freedesktop.org/software/systemd/man/systemd-ran...

* http://jdebp.uk./Softwares/nosh/guide/commands/machine-id.xm...
https://newsnowfinland.fi/politics/how-finlands-fake-four-da...

Fake news analysis.
I think most consumers are not very knowledgeable of chip manufacturers. A business guy buys Dell/lenovo, couldn't care less what chip is inside.

At most they might check if it has a graphics card, or number of cores
Yep. On gnome you can set it. That doesn't appear to be the case on osx. And it seems that for PIP, being sticky should be the default. I'm currently keeping safari open just to have a pip sticky window of youtube.
Qwant was proprietary last time I checked and didn't seem that privacy centered as they say

Also >France
But isn't the whole "Russian disinformation" thing in turn a way of discrediting information? Orwell was writing about this 80 years ago, it's never seemed more relevant.
Microverse | Remote only | Full time

Microverse is a global, distributed school for software developers that doesn't charge students anything until they get hired.

The company is backed by Y Combinator and other top tier investors from Silicon Valley, and the team works remotely from more than 7 countries.

We have full-time students in 70+ countries, thousands of applicants per month from ~200 countries, and graduates from Nigeria to Mexico that have increased their salaries by 2-10x after completing the program.

We currently are hiring for several roles: Technical Career Coach || Head of Business Development & Partnerships || Ruby on Rails/Full-Stack Software Developer || Admissions Operations Lead

We offer: Opportunity to join a rapidly growing company and shape our direction and organization || The opportunity to join the whole team at company retreats somewhere around the world once every nine months or so || Work alongside a fully distributed team that lives all around the world and is from 7 different countries.

Apply here: https://angel.co/company/microverse/jobs/
Magnet Links on Invisible Arch Linux
I once made something similar for audio FFT waterfall plots: https://jo-m.ch/repos/waterfall-plot-webgl/

(Github: https://github.com/jo-m/waterfall-plot-webgl)
Most of my four years of college were lived in this state. I never knew at the beginning of the week if I'd still have food by the end of the week. Instead of studying I'd lay awake all (ALL!) night running a loop over in my head trying to figure out if/how the money would last to next semester. It really takes a continuous cognitive toll.
And the linked article showed you that, in practice, "a shambles" is perfectly correct English. It is therefore correct in a descriptivist sense.

Beyond that prefixing your comment by "downvoted" is frankly silly and only serves to derail the conversation IMO.
It's not about it being the same length, but the length of the data being part of the hashed data, which, Linus assumes, will likely make it more difficult to find a collision. He even says at the beginning that he hasn't had a look at the attack yet and is just making an assumption.
Ah yes chauvinistic men who feel entitlement to "pussy". You are what's wrong with the world. Women are people, not objects.
And every year we see news stories of HOAs inducing foreclosures etc on owners for $10 late dues, flying national flag, or painting a porch the wrong shade of white.

Gov't/HOA involvement & enforcement varies wildly. This subthread regards those thinking "1984" was a good idea.
On the Short Stories That Inspired a Russian Czar to Free the Serfs
I think you can make your own luck. Studying, moving to a high tech area, networking, working for a YC company, applying to YC all of those things increase your luckiness probability. Luck is being prepared right?
It's helpful to remember that the Bay Area is extremely expensive, and even more helpful to remember that some people have large families.

I could pretty comfortably raise a family of 6 on $100K in a midwestern city, or a family of 6 on $80K in the rural midwest/south. Without sufficient retirement savings, mind you, and my safety net would be non-exisent. I'd need at least another $30K-$50K on those numbers to build a strong safety net (remember, it's a safety net for 2 parents + 4 kids, not for one person...).

Doing the same in SFBA would probably require at least $250K. Maybe more.

> Surely you don't believe less than 1% of people in the US can live comfortably and have a safety net, do you?

The number is larger than 1%, but probably still smaller than you think.

The average American definitely doesn't have a sufficient safety net. IME, the average American raising more than 1 or 2 kids almost certainly doesn't have a sufficient safety net.

So, no, you don't need to be in the top 1% of earners in the US to have a safety net. But if you have a large family, you probably have to be in the top 10% to live comfortably and have a safety net and retirement.
Burger King Takes Bitcoin in Venezuela
Monorepos are a terrible idea.
Intel's tiny modular gaming PC
Was just responding to the "being forced to live in California" comment.
Perfecting, or at least very gooding, already perfected tasks is an important component to becoming successful in areas that are not so established. Highly successful people are very good at other tasks that don't make them any money. They might make world class pizzas, be a competitive Tae Kwon Do fighter, have sailed boats around the Great Lakes, shred on a guitar/piano/violin/theremin, etc.

If you become great at becoming great, then your odds of being highly successful improve dramatically.
Frameworkless JavaScript
I find this feature extremely useful in Chrome where I can run a YouTube video in PiP mode, then have it sitting nearly over a second terminal pane in my IDE while I'm developing.
I'm curious where the black market for something like that would even come from?
Proposals by Congress on how to make this vampirism illegal?

If this is an issue for you, vote in members of Congress who care about this. There's an election coming up this year. Your representative in the house will be on the ballot, and maybe one of your senators. Please find out where the candidates on your ballot stand on this issue.
The problem is it's impossible to separate "this changed it sucks" from "this is actually bad" since the messages are always the same. E.g. in this case you didn't even bother explaining why the new way works worse for you you just said "it changed, I left! Make note!" and I mean that's fine if that's what you actually wanted them to make note of but no company with competition is just going to keep every workflow the same for over a decade and wait for someone else to come out with a better product to replace them.
But eye tracking is a huge problem in itself, and, to my knowledge, it's not solved at all. I type this as I sit in front of my "15 notebook, and I need barely move my eyes to see the whole screen.

I think that figuring out where exactly I look on my screen is impossible problem to solve, since I always clearly see at least 3/4 of the whole screen. You can only guess where exactly on this 3/4 property of my screen I'm really focused.
Agree!

The only thing I missed from the ordinary Firefox on Android was that Firefox used to have a brilliant hack with the sharing option where they would show the two most frequently used options (+ a sharing button to access the rest) instead of just one or just the sharing button.

This saved me a few seconds again and again and again.

Wonder why no one else does that?
Soylent Is Not Healthy – Let’s Create Something Better Together
I'm just horrible with acronyms because I work in IT and the health industry, previous the security industry. They all have acronyms and the same acronyms. So they all mean different things to different people. Acronyms are a lazy person writing and you have to be "in the know" to know what they stand for. 100 years from now, no one will be able to understand them.
Finally! Been waiting for functional pinch zooming on macOS and Windows for ages. Thank you Mozilla team!
Fortunately, there are still some places to work without such drawbacks but shhhh - they're a secret.
No, it's considered entertainment.
It loads pages slower, too. Once they actually load though, performance is on par.
Look at Asus's new line of premium laptops. All AMD Ryzen 4th gen. Ryzen 9 CPU's have been out of stock for months as enthusiasts and professionals are jumping at the value of getting 16 cores for ~750$. I think the tide of the market is shifting significantly, especially in consumers minds.
Here's a transcript of that talk:

https://diyhpl.us/wiki/transcripts/sf-bitcoin-meetup/2015-02...
> [It] should have been added as a button on the standard video controls and as part of the right click menu

It is in the right click menu, under "Picture-in-Picture"
Most of this advice is not actionable. It falls into the category of such advice as "take breaks and have fun, but not too much" when the initial question was how much is too much. That is to say, you don't know more after hearing the answer than you did before.
What is the realistic best-case scenario? Has anyone demonstrated that well-written Rust code should run faster than C, or is the hope simply to get performance parity with C while maintaining memory safety?
It was inspired by Firefox Test Pilot experiments performed about a years and half ago - https://blog.mozilla.org/blog/2018/06/05/latest-firefox-test...

It's actually quite convenient to watch a video while you're browsing elsewhere (e.g., a passive video you aren't intentionally watching all of but also trying to do other things). I didn't think I'd use it but every once in a while it's nice.
2020 Design Forecast
When I’m using the Chrome tools, I miss some FF features, when I use the FF tools, I miss some Chrome features.

I generally like the FF tools better nowadays, but Chrome’s are a bit faster.
One thing that might make it easier for you that you might not know about: about:profiles
It's complicated. There is in fact a hidden option that makes the web browser less unique, but using it has side-effects such as retrieving pages in English with UTC timezone, noticeably reducing the browser view point size, breaking WebGL, break some JavaScript using <canvas> and most notably, making the web browser noticeably slower. It's not something that a web browser can afford to have without informing the user of the consequences. Not to mention without additional measures, this is unlikely to help much against fingerprinting.

You are probably better of using Tor Browser.
What about the fugitive plugin for vim?
VCs are amortizing the risk which increases the probability of success. It's a strategy to improve the odds and give yourself better luck.
BCH forked off to reject the SegWit+RBF add-on that ain't Bitcoin. Replace by Fee has caused ATM hacks and breaks trust in 0-conf. BCH upgraded version holds consensus among its users & fees are low as P2P Electronic Cash System was designed to have had.
Meetic (Match Group)| Front End JavaScript – Paris, FR| Remote 1d/Week
Do you know Meetic, Match, OkCupid or Tinder? That's us!
In 15 years, 8 million couples have been formed through Meetic. Dating services available in 15 languages, in 16 countries and answering millions of searches per day.

We are looking for 2 Front End positions to join a 10 people’s community in Paris:
- Lead Tech React : very good experience in React, lead and tech management
- Senior React JS developer : about 3 years of experience in React JS

Our stack: React.JS, ES6, Redux, SASS, Jest, Webpack, Gitlab, Artifactory.
Our organisation: Impact Teams, scrum, AB Test, pair programing, KPI driven.

Read about open positions and apply here: https://careers.smartrecruiters.com/MeeticGroup
As a former documentary distributor, I've been thinking about creating a fund, with enough capital this could help make more high-quality docs about science, technology, and culture (not politics or celebrities). Enough people here could probably make this viable if there were interest. Most funds are non-profits.
For simple cases mutexes and such can be much faster and simpler. Channel based constructs are good when they model the problem well as streaming or queuing.
I guess it might qualify as "original research". Still, very entertaining. Thank you.
> This is how the system has worked for a long time, and the data has always been public. It doesn't get abused much, despite and including Cogent's recent spam to the emails that appear there.

It gets abused plenty (I get tonnes of spam to an email address that is published nowhere and is used for nothing except the RIPE whois db), and Cogent's spam is anything but recent. Cogent has been doing this for over a decade.

I expect spammers to be spammy. I expect reputable companies to behave in a reputable way.

Cogent sales people do their best to ensure that nobody confuses Cogent for a reputable company.
You can argue about patents, but trying to copyright APIs is on a whole new level. It would be utterly disastrous. Regardless of Google's motivations, their arguments here are completely 100% in the right and we should support them -- if not for Google's sake, then for ours.

It's counterproductive to drag a company over purity while it's currently the primary fighter against an existential threat. It's polishing silverware while the house burns down around you.

Yes, Google could do better (particularly on patents). Yes, some of Google's arguments are hypocritical. But openness is a continuum, not a binary state, and it's not helpful to turn away imperfect allies at this time.
2019 Reflections – The Good, Bad and Best Parts
> - Give me a setting to autoconfirm all cookie consent requests and lobby for a legally binding do-not-track header. Cookie consent was well meaning, but it has turned out to make things worse. Let's move on.

Most of those are implemented in JS, so NoScript goes a pretty long way to fixing this. It would be nice if Firefox somehow auto-detected them, and other useless pop-overs, and nuked them.
Benchmarks would be interesting, in the sense that it would help make sure that the translation is doing the same thing, but it wouldn't say a ton about Rust vs C in a more general case. This translates to unsafe code, which means it's not really representative of Rust generally.
Yeah I'm still a little pissed about not getting the green bar for payments (and definitely about not being able to see 'https' to verify it).
Testosterone Treatment in Men W Age-Related Low Testosterone:Clinical Guidelines
This is seriously so cool! I love simple clever tools like this. And playing with the sliders lets you do lots of cool effects too.

I wonder what happened to Greenland, though? It's just... not there.

Also -- especially for printing -- an "export to SVG" option would be amazing.
see https://support.mozilla.org/en-US/kb/firefox-dns-over-https#...

edit: there is also the canary domain https://news.ycombinator.com/item?id=21825443
I just upgraded my iMac to Catalina, and noticed this rather serious issue with Firefox:

https://bugzilla.mozilla.org/show_bug.cgi?id=1606620

Basically if you have an external screen (possibly related to it being low-DPI and main screen being Retina), context menus don't work properly, if at all.

It seems it got even worse in 72 than it was in 71 - now I'm not even getting a context menu in the wrong place, it's invisible (maybe off-screen?).

Hopefully someone who works on Firefox can see this and fix it - it's making Firefox nearly unusable as is :(
I just bought a Thinkpad T495 with a Ryzen Pro 3500U, and but for the display, I think it hits the points made in the blog. Cooling is good, it's far from a clunker and comes in an even slimmer model (T495s), and the battery life so far has been a revelation (knock on wood) compared to the Dell XPS 15 9650 it replaces.
Evicted offers a great view into a topic that may be new to many HN readers
Ask HN: Someone registered my personal name as a domain name to extort money
Someone's registered my personal name as a domain name and blackmailing me to extort money. What are my legal option to get that domain?

Laws in my country is not well defined and legal route will take a lot time. Is there anything I can do by approaching the domain registrar and web host? I am broke and don't have enough money for a legal fight
As an aside, I recommend run.Group [1] as a replacement for WaitGroup. It implements a very common pattern where you have N goroutines that should execute as one unit (if one fails, everyone else should abort) and allows you to the final error. Similar to ErrGroup, but better.

[1] https://github.com/oklog/run
> The problem is, is that git will happily destroy history.

No, people will happily destroy history. Git is just a tool.
You may well be assured Eastern Europe seems quite different at present moment from what you described now with lots of IT money pouring in nearly every single EE country, many countries tax less than 30% on salaries, and less than or around 20% in corporate tax. So maybe pick another place to relate with.
True, I am on Windows 10 as well. If anyone needs to change it though, that is the related setting to check in about:config.
A huracan seems like an achievable car after a number of years at a job like that. A Bugatti does not.
>there are a ton of dangerous or complex jobs that can be simplified and made safer with this technology.

Honestly, this is a good point. However, just to play a devils advocate, for emergency situations you don't need a real-time brain computer. You can just measure the adrenaline level or heartbeat rate (which is trivially easy with present tech) and on once it jumps, you shut down the whole machinery.

My point being, complicated brain link is not needed to send what is, essentially, a "SOS" signal.
Parallel Task Latency Calculator
I love it and use it multiple (25+) times per day. My only wish is that it kept the interface from whichever player the videos comes from (eg. YouTube's, Netflix's, etc., especially for subtitles & platform-specific controls like Speed)
This similar to the way I have looked at it - working hard will generate more chances of being lucky.
With good developers, unit-tests and code-reviewers, we don't need debuggers
Small Businesses I Wish Existed, 2020 Edition
Your devs might develop perfectly well behaving stuff just to see it get totally obliterated by loading 3 external tracking scripts through Tag Manager, three different pixels and 7 external contact form/chat bots/newsletter popover scripts from their CRM/ad platform/whatever crap marketing wants.
Take comfort that extra control and maneuverability from social exposure is mostly moot if you already know and do what you want. It sounds like you're saying that better social media presence can improve job prospects, and that might be true, but a portfolio and experience is still king here.

If you're fussing over a blog regularly but hate it, you've included that in the destiny in question. That experience is not divorced from it. Just a question of what you're willing to compromise.
It does make sense.

Targets worth attacking at a high financial cost will most likely be the first to take measures against this attack.

The kind of target that takes a longer time to switch most likely isn't worth attacking unless it's a very cheap and fast operation.

And the longer you spend developing an exploit, the less viable the attack will become.
> I identify with nothing you said

> I would say the first time I lost the fears you mentioned

These statements seem self-contradictory.
> To truly substitute pork this industry will have to become as massive as the pork meat industry is now.

Meat has 2 levels though, you need the industry to feed the pork too. If you skip that step and directly feed us, that's much less production.

> And that means, among other things, a huge increase in already high demand for coconut and palm tree oil

If it does require more coconut and palm tree oil, then that's what we will fix next.
I took a happiness course once. It said that instead of chasing status, we should chase flow. The idea being status is dependent on what others think, which is inherently unstable, while flow is joy for yourself.

There’s a book I read, can’t remember name but basically it said instead of chasing recognition, we should chase knowing. Recognition was lots of random strangers liking some surface thing about you. For example I like band X - if I saw them in public I’d want to say “hey I love your music!”. Or conversely, I think band X sucks, and I want to say that. It’s a shallow opinion held by many.

Knowing is respect by people who have the authority to actually evaluate your talents. In this case, it would be experienced musicians. What do they think of the band’s music? These people actually have the relevant experience to evaluate your work. If a group like that admires your work, it’s a deeper, more satisfying “like” than a bunch of random people. Yet we are typically wired to chase the approval of the masses.

These things can be hard, I certainly don’t do them all the time, but it’s helpful direction if you can relate to this article.
It's not just the sites you are asking to deal with that friction, but also every single individual user who ever signs up for anything on the internet.

That's a lot of friction. Too much.
The suggestion is that Vladislav Surkov [1] is behind this playbook.

[1] https://en.wikipedia.org/wiki/Vladislav_Surkov
Definitely the CPU. A fridge will use +/- 200 watts. The TDP on these chips is upwards of 250.
Direct link: https://www.netlifystatus.com/incidents/njmz2677n7zw
Regarding #3 you might want to check out the "I don't care about cookies" add-on.

I use I on Firefox mobile and desktop - don't know if there's a chromium version.

Almost forgot I use it which is the most positive review an add-on like this could receive.
I was listening to the NYT Daily podcast yesterday and they were talking about the Soleimani funeral and how Khamenei voice cracked and openly cried while delivering a prayer. I thought that was pretty amazing and rare for a world leader, especially a strong man type.