skysight-inc/HackerNews huggingface dataset:
From the first sentence on Wikipedia, "Stefan Basil Molyneux is a far-right, white nationalist Canadian podcaster and YouTuber who is known for his promotion of scientific racism and white supremacist views."

Oh noooo...
There's also an ton of shops using literally no standard above the 8bytes+IDbits that CAN controllers spit out and accept.
This is really neat, you did an awesome job. I don't know why everyone is being so negative about this.

Hearkens back to another time...
That's what I understood based on the gun example. However the same would hold true for any deadly disease you develop, wouldn't it?
Anecdotally, it seemed like Hipmunk had nothing to motivate users to actually book through them. It was a great site to find what specific flight to take. The sorting by "agony" was great and I have never seen any other site have an interface as seamless as the sliders you could use to narrow down flights to specific windows of time. But once I had my preferred flight number, I booked somewhere else to get that mile bonus or whatever other incentive existed elsewhere.
From a conversation with Thomas Pornin, a plausible explanation given the details provided in the DoD advisory:

Given an ECDSA signature and control over the curve domain parameters, it's straightforward to create a second private key that matches the original public key, without knowledge of the original signing private key. Here's how:

To start with, you need to understand a little bit about how curve cryptography works. A curve point is simply the solution to an equation like

y^2 = x^3 + ax + b mod p

The "curve" itself consists of the parameters a, b, and p; for instance, in P-256, a is -3, b is (ee35 3fca 5428 a930 0d4a ba75 4a44 c00f dfec 0c9a e4b1 a180 3075 ed96 7b7b b73f), and p is 2^256 - 2^224 + 2^192 + 2^96 - 1.

To use that curve for cryptography, we standardize a base point G, which generates all the points we'll use. A private key in ECC is simply a scalar number k mod p; the public key corresponding to that private key is kG (the curve scalar multiplication of the point G times our secret k). Everybody using P-256 uses the same base point; it's part of the standard.

Assume that we have a signature validator in CryptoAPI that allows us to specify our own nonstandard base point. We're ready to specify the attack; it's just algebra:

Let's call Q the public key corresponding to the signature; for instance, Q could be the ECC public key corresponding to an intermediate CA.

Q is a point on a named curve (like P-256). Q = xG for some private key x; we don't, and won't ever, know x. G is the standard generator point for (say) P-256.

What we'll do is define a "new curve", which is exactly P-256, but with a new generator point. We'll generate our own random private key --- call it x' --- and then from that random private key compute a malicious generator G' = (1/x')*Q.

On our "new curve", Q remains a valid point (in fact, our evil curve is the same curve as P-256, just with a different generator), but now Q' = x'G', and we know x'.

Now we sign a fake EE certificate with our evil private key x'. Presumably, Windows is just looking at the public key value and, reading between the lines of the DoD advisory, the curve equation, but not the base point. By swapping base points, we've tricked Windows into believing the private key corresponding to Q is x', a key we know, and not x, the key we don't know.

I'm paraphrasing a shorter writeup Pornin provided, and the basic curve explanation is mine and not his, so if I've worded any of this poorly, blame me and not Thomas Pornin. The actual exploit-development details of the attack will involve figuring out in what circumstances attackers can swap in their own base point; you'd hope that the actual details of the attack are subtle and clever, and not as simple as "anyone could have specified their own base point straightforwardly at any time".

See also this related exercise in Sean Devlin's Cryptopals Set 8:

https://toadstyle.org/cryptopals/61.txt

This attack --- related but not identical to what we suspect today's announcement is --- broke an earlier version of ACME (the LetsEncrypt protocol).
Is anyone else seeing the strange lack of spaces? Multiple words throughout the blog post show up concatenated for me, so it seems like a weird transmission bug, not one typo.
> A USB that could plug in correctly both ways would have required double the wires and circuits, which would have then doubled the cost.

why couldn't they have used a notch / tab like other connectors do? not durable enough?
They alerted them after using it for 20 years to spy on us? \s
I rarely need same day flights or even short notice flights unless they're for work (in which case they would book the flight for me using their travel agent). As a result I'm flexible with the airline and travel dates and usually have months in advance to shop. Typically I'll set up alerts on Hopper as soon as I know I'll be traveling, and that will tell me the right time to buy. I'll often also look at the budget airlines sites themselves as well because I know a lot of them don't allow aggregators.
I really really want support for multiple browser profiles in Firefox. Multi-Account Containers are cool, but they don't allow me to change my bookmarks or browser extensions. This is the only thing left Chrome has over Firefox that I honestly care about.

The profile manager (about:profiles) comes so close, but it's just not as elegant as Chrome. Starting Firefox with the profile manager also causes issues when the OS tries to open another Firefox instance.

They have a Firefox sync profile badge now. Just give me the option in that menu to open a new Firefox instance with another profile. And when the OS tries to open a webpage, just use the default profile - or even whatever profile I opened a page with last.
I have been using this for a while now, it's pretty good, but I always had trouble separating Gmail and Google search. It's necessary to add accounts.google.com and mail.google.com

I think I can't isolate Google search to ours own container.

I'm also using strict setting and cookies are cleared when Firefox is closed, and Gmail and accounts domain are white listed.

The UI of this addon could be a little better.
The interesting thing is the "Agony" sort has almost become standard! Skyscanner, Momondo, and others all default to a "Best" sort that takes into account flight length and prices.

Google Flights also does this for the first few results it returns, before returning a bunch of flights in price sort order.
Oh no kidding, you're BookWithMatrix? Shooting you an email, your website has been life-changing.
Just took a quick look at Wanderlog and it looks awesome - exactly what I want out of a trip planning tool.

Great job!
Hey, hackers!

I and my friend are working on a side project, that’s similar to reddit in the core but will have different features built on top. It’s focused around creating like-minded communities. Everchat (https://everch.at) will be a place where you can send encrypted text and voice messages, images, videos, files, and more, free from any regulation.

Our mission is to secure, protect, and empower the Internet freedom, and the freedom of speech in general, and our vision is to build the most secure group messaging out there, but the time (and hopefully our future community) will tell.

Right now, you can support us with subscribing to our Product Hunt Ship page (https://producthunt.com/upcoming/everchat) if you have a Product Hunt account, or reserve your user ID directly at Everchat (https://everch.at).

All feedback is welcome, and I’m hoping to open up some Internet freedom- or content regulation-related discussion within the thread. :)
Seconded. Once I figured this out my days of plugging USB cables in the wrong way were over.

Look for the two little open holes on the face of the plug and you're golden
SpaceX tests black satellite to reduce ‘megaconstellation’ threat to astronomy
The fact that the difference is 10ms and 8ms respectively suggests that the speedup of attribute access isn't what's showing up in your measurements. In one case we access the slot "a" once; in the other case we access it five times. How can that be a 20% difference?
Microsoft sends out fix for major Windows 10 security flaw detected by U.S. int
In this case, you could argue that if you don't know what CAN is, this tool is useless to you. Not all technical documents detail this kind of basic information. I routinely see tools for some technology that don't explain what that technology is. Maybe this is a bad idea, but if you don't work with widgets, then you probably don't need wiget-tools. CAN is a really big deal. It needs no more introduction than USB or TCP/IP, though maybe it would be a good idea to describe what those do too. The fact that you've never heard of it, doesn't make it some niche thing. I constantly see stuff I've never heard of on hacker news, that someone in another industry would assume "everybody knows about".
The last thing I would want is a peripheral whose data connection was on a MagSafe connector. It’s specifically designed to be able to disconnect easily by accident.
Video gaming has already taken over? Are there media formats that rival it from a revenue standpoint?
I've only ever seen female B connectors on peripherals. Do they make motherboards that have them?
How can he be a white supremacist and a Jew at the same time?
Why does this need to be a "service?"

Why not just write the e-mail in your current e-mail client and then store the draft in its own folder?

People have been doing that for centuries. They'd write a letter to themselves and then store it in a box somewhere instead of sending it.

Some people took it a step farther and would write the letter, and then burn it if they were angry. Very cathartic.
> FPS gaming with a keyboard and mouse isn't coming with you on your phone for the morning commute, and no amount of technology is going to change that because the main barrier is you won't want to play that game on your morning commute with a bunch of people around you, noise, and being unable to immerse yourself (even for reasons as simple as needing to remember to get off at your stop).

PUBG and Fortnite are both wildly popular mobile games. I see people playing them on the bus all the time.
>I want to build something once, and ideally use it for the rest of my life (or maybe 20-50 years to start off) without having to worry about having to update something or other or risk losing something important down the line.

I can't be willing to build personal stuffs on unstable or proprietary grounds either.
To me it's like building your house on an iceberg or in a prison.

For server side software we already have some relatively safe grounds in that regard,
but for GUI I only know of frameworks with no clean API to abstract away their implementations,
and which come with much dependencies and idiosyncrasies that can be hard to implement efficiently
on top of other libraries. OpenGL is an API, but it's complex (designed for efficient 3D)
and doesn't cover everything (windowing, mouse/keyboard events, basic primitives, text, images, etc.).

That's why I designed BWD:
https://github.com/jeffhain/jolikit/blob/master/README-BWD.m...

Currently I'm building a toolkit on top of it (BWD just has a graphics (canvas), it doesn't have "components").
I saw a smiliar but totally different scenario in a Stockholm suburb a couple of years ago (I guess the practice is still there):
An old lady was in front of me in the line at the grocery store and paid with her card, and the clerk took out his notebook and entered the pin code. It was like the two keys to a vault. Neither of them could do the transaction without the other. I hope the notebook didn't keep the code together with an identifier, but I found it really cute.

With contactless today I guess you can solve it with just one person, but I really liked the two-factor.

And the community service, of course.
"Having to embed" them means it's more easily automated, and screws are cheaper than a flex cable and two sockets.
Define "brutal"

Booking has made money off travel hand over fist this past decade. It's highly competitive, sure, but for a reason since hotels pay massive premiums to these websites to drive sales.
Wow, thanks for that tip! That's an awesome use case for this addon.
I can create a blog to anyone who wants one for their own using gatsby, netlify cms and github pages. It will be free to use and host. People can access your blog via your-blog-name.github.io. I won't charge for it for the first 10 people who reach out.
Would electrifying hull, or making some high frequency electric zaps to the hull make these barnacles to fall off/not to attach?
(just thinking out loud, it is probably have been tried given how common this problem is...)
I can't imagine that either, but this isn't a case between Stefan and Mailchimp, this is a case between Stefan and Nandini in Tort Court where the requirements are much lower:

1. The existence of a contractual relationship or beneficial business relationship between two parties.
Stefan is on mailchimp

2. Knowledge of that relationship by a third party.

3. Intent of the third party to induce a party to the relationship to breach the relationship.
Tweet: https://twitter.com/nandoodles/status/1216903968439357446

4. Lack of any privilege on the part of the third party to induce such a breach.
This is on Mailchimp's TOS

5. The contractual relationship is breached.
Tweet: https://twitter.com/Mailchimp/status/1217073200414306304

6. Damage to the party against whom the breach occurs.
This remains to be seen
It's interesting to me that you equate masculinity to physical strength but nothing else of value
https://google.com/flights
A lot of Unix utilities date back to Bell Labs, at least in spirit. Many had to be rewritten due to AT&T becoming dickbags with the licensing back in the 90s.

Stuff like cat, sed, awk, od, dc, head, vi, echo, sh, uniq, diff, sort, and so on.
True, the doctor example is really just supposed to be segue into thinking about how a direct message could work. Although, perhaps facing death and recovering turns you into the kind of fellow who will live their life in a vastly different way leading to a longer life?
Working for someone vs. doing your own thing
The EMI resilience is one of the big reasons why it's used for automotive applications.

Many (all?) CAN standards transmit on redundant copper, in opposing polarities, making it really easy to identify a signal vs noise. https://en.wikipedia.org/wiki/CAN_bus#/media/File:CAN-Bus-fr...

It's like a one-wire serial signal, but redundant.
Install and Configure WireGuard on Raspberry Pi (and Others)
> How do you solve the "won't read my emails" problem ?

Just encrypt locally before sending.
If you use dietPI on your raspberryPi you can easily install VPN, pihole, and much more.
If you trust your home network / ISP / Government more than you trust the Starbucks (or any public) network, you get to at least transfer your risk.

But you also don't get much more than that for using a paid-VPN, you just transfer the risk of being snooped on to their network/ISP as opposed to your own. Same with running a node on AWS/Digital Ocean.

VPNs do not make you anonymous. A shared VPN might give you some plausible deniability but it's hard to trust that your specific traffic isn't being logged.
Wow, my mind is blown right now at how well you captured this feeling. I also worked at McDonald's at 15 and it was thrilling to be working a real job for the first time in life, and see the inner workings of a corporation perfected over 50+ years, notwithstanding the terribly bad for you product.

I also remember working the order taking window and getting into the flow of quickly finding the items after you master the educational part. In a way it's like lego-building or very simple programming.
WireGuard Setup Guide for iOS – Graham Stevens – Grh.am
I’d go as far to say that the majority of the applications people use today that aren’t strictly business productivity tools are, more or less, games. This includes social media, fitness trackers, etc.
And I've seen a fair number of peeps playing minecraft on ipad too, so you have a point.

They are separate, partitioned instances of the games though, tailored for the format.
Yeah, it feels like it has a lot of potential on paper, packet does a lot of stuff well that Equinix probably was thinking "why aren't we doing that? why isn't that us?"
It feels like one of those cases where you really want that vision to survive at scale.

Making it easier for Equinix to leverage its resources to get people cloud-y style capabilities that isn't attached at the hip to the other clouds sounds like it would be a pretty good thing. And for Equinix themselves, being able to expand their direct offerings without stepping directly on the toes of the other cloud giants that are also its customers is likely always a good thing in itself.
For a medium that has growing revenue, the major players and properties are attempting increasingly manipulative, desperate, awful, and addictive mechanisms to squeeze more revenue.
Or its boring, corporate parent got bored of its fun, little, upstart adopted child. I can't read press releases of this kind without thinking "soulless corporate decision based just on money". Maybe Hipmunk was making $$ but the corporate parent wanted it to make $$$.

Too bad. Hipmunk had a lovely UI and was very useful. I hate how acquisitions (and acquihires in particular) cannibalize and destroy awesome little products.
Every time this comes up, everyone always dismisses it by just pointing to about:profile or the launch flags, but in my opinion those are weak excuses.

Chrome made profiles a first class citizen and they're an absolute pleasure to use. I literally use them every day. Firefox having a bunch of buried half baked UI isn't really an answer to that.

I believe Firefox is a better browser overall. Only this (profiles), the terrible bookmark/history experience (wtf is that?), and the developer bar are the remaining weaknesses.
NSA finds major security flaw in Windows 10, free fix issued
The code is very out-of-date by now, but check out the old Ubiquity project https://en.wikipedia.org/wiki/Ubiquity_(Firefox) Before it died, they even had complex internationalization support that could handle different subject-verb-object orders and typed autocomplete.
Show HN: Cookiecutter-Django-rest now supports Django 3.0 and Python 3.8
https://eprint.iacr.org/2019/779 - Paper on the fun things you can do with signatures, including a write up of the Let's Encrypt Attack discovered in 2015 and some more recent attacks.
While I think games are an underused medium for advertising and promoting, I'm not sure about any claim of it "taking over." Mobile games on the rise and all that, blah blah. From my own experience, as my purchasing power has grown, my gaming time has declined. I did play a lot of Breath of the Wild. However, I have another couple of games I'd like to play, but I just don't have the time.
This criticism is unspecific to the idea of "everything is a system". You are criticising models for being a models.

Sure enough, models are problematic for various reasons, a few of which you have enlisted.

It's just an entirely different conversation to have.
For those looking for replacements, Google Flights and Skyscanner have been mentioned in this thread... But also consider checking out Great Escape[1]. It has a neat UI.

1. https://greatescape.co/
After almost 40 years of doing this, I can agree that you do get better at it. But perfection never seems to materialize.

Even if I get better at it, a lot of my younger coworkers do not. So the phenomena seems to continue.
Chile is much better when compared to Brazil in terms of equality. Brazil is ranked 8 most unequal (tied with Botsuwana) whereas Chile holds the 26th position in the GINI index [1].

We can expect Chile to drop positions since its economy is going downhill creating massive unemployment. Inequality will increase as people from lower middle class will move into poverty as we've seen in Brazil since 2015.

[1] https://www.indexmundi.com/facts/indicators/SI.POV.GINI/rank...
I always liked the Hipmunk branding :-)
That's how I learned about it as well.
At last! somebody else who is prepared to be honest about their fear of maths, and mathematical notation, and people who leap from "its just like school maths" to referring to the intimidating maths you skipped or failed in school and university.

Its just like maths: requires deep brain structure wiring you may not have.
Free speech is a theory that doesn’t describe anything that actually exists, and it’s used as a crutch to support weirdly political points of outrage.

You can’t say what you want without consequences anywhere in life.

This makes me think of “How To Win Friends and Influence People.” Saying exactly what’s on your mind will rarely get you the ideal outcome you are after.
It supports dead simple hard real time bus arbitration of messages for one.
For what it's worth, I think this is the thing that USB-C has really gotten right: it works both ways.
Wanderlog looks very cool, but you might want to take a look at how you’re pulling your header images. Planning a trip to Vietnam and got welcomed a B/W header image of the Vietnam War :/
The quality of the guests is amazing but the host is extremely off-putting and difficult to listen to.
AppSec as a Requirement in the Development Process
I'm trying to build a platform for this:

https://epiphany.pub/@shi-yan/introduction

or maybe this?

https://github.com/realworldocaml/mdx

markdeep ?

http://casual-effects.com/markdeep/
Nice. Now my wife and I can both stay logged in to our email. I've wanted this feature for 15 years. Now, bring multi row tabs back and FF will be awesome again.
Ask HN: I have built an email-based service but how to enable it for users?
I am moving away from Gmail. However, I miss some features: auto creation of calendar events e.g. for flights.

So in my own time I built that functionality from scratch, initially tested with Fastmail. It's a service that can e.g. run on EC2. It uses IMAP to fetch emails, parses html/text content to get the information, connects to flights tracker APIs to get airport and flight information, then creates the calendar events using CalDAV.

An event looks like this: https://i.imgur.com/DyE78Bs.png

I have made it work with these types of emails:
- Easyjet
- British Airways
- Kiwi
- Lastminute
- Gotogate
- Airbnb
- Eventbrite

I'm planning it to extend to more airlines, other time-based events like Meetup, cinemas, restaurants, and so on; anything you can "book a time for". Also I will test it to ensure that it works with more email and calendar providers.

I'm really happy with how it works for my purposes. I have spoken with a few people and they have shown interest in using it, and I have thought of various ways of getting them to use the service...

Which way accessing emails would be better? What would you prefer or be comfortable with? Your answers will help me decide what to work on first. Each has ups and downs, trading security with convenience. If I have enough time I will implement all:

- provide IMAP login details for your email service (this is how it works for me now but I expect not many people will be happy with that)

- create an email filter for your client to forward relevant emails to the service e.g. "from": donotreply@easyjet.com" "subject": "easyJet booking reference", then get an invite for the event (I quite like this one)

- browser extension for your email client

- get the source and run the code yourself on your machine / server after plugging in your own config

- something else?

I'm looking forward to hearing your opinions and thoughts about this.

Thanks in advance!
I'm pretty sure some Apple USB had a notch. But I think it wasn't to help to plug it in, I think it was to ensure it was directly plugged into the computer without using a cable extension. But I don't remember well, it's only speculations.
Local journalism’s demise leaves us vulnerable
Google Cloud allows bring your own anycast ranges mapped to global load balancers.