skysight-inc/HackerNews huggingface dataset:
You're absolutely right that

H(public || private)

may help against length extension (e.g., if we try to use H as a MAC), whereas

H(private || public)

certainly does not!

As stated, though, this is only a heuristic: depending on the application, we'd want to prove something about the construction under an appropriate assumption. (Frequently for Merkle Damgaard hash functions one makes some assumption about the compression function, e.g., that it's collision resistant or that it's a random oracle, and then proves something about the whole construction. This is the content of [2] in my prior message.)

A few things to note, though:

1. In my prior post I was implicitly assuming that info was short and/or fixed-length, whereas msg could be very long, but I wasn't making any assumptions about public vs. private. In the EdDSA case, notice that in

H(nonce_key || message)

nonce_key (the "info" string) is secret and message is public! So we might heuristically worry about length extension here, but it turns out not to be an issue.

(In more detail: this value is treated as a 512-bit integer r that is implicitly reduced mod the order of the curve25519 group, roughly 2^252, when computing R = rB. We can think of this modular reduction as similar to a ChopMD construction like SHA-512/256, which prevents length extension. Moreover, extracting r from R would require computing a discrete log!)

2. Continuing the above thought: in most instances when we try to use H in a MAC-like construction, the key is relatively short and/or fixed-length, whereas the message is potentially long. So in this case "appending" is consistent with "secret at the end."

(You're absolutely right, though, that my prior message was not particularly clear on this point.)

3. In many of the cases I was discussing in the prior message, both info and msg are public. So if we want to defend against length extension generically, we need some other approach regardless of the concatenation order. Usually one would use ChopMD, HMAC, or a prefix-free encoding; see [2] from my prior post.
Why is this, even though it was so prevalent in China as a key signal for testing?
It’s not just about you getting sick. By practicing social distancing you delay the spread of the virus. Even if the same number of people end up getting sick, distributing the sickness
in time helps reduce the load on hospitals.

If you instead change no behavior, it is likely that when you get COVID-19 you will transmit it to more individuals before you realize you’re sick and need to stay home.

Depending on the rate of transmission, your individual actions can actually result in hundreds or thousands of people not getting sick (or getting sick later).

Make your own decisions here, but don’t hide behind “it isn’t going to change things”
This was probably a one-line code fix in the end. I'm sure they added extra tests and guards, but at its core, this is a trivial change. I've worked at less-than-agile companies before, but if the turnaround on something like this is more than 24 hours, that's pretty bad.
You set the boundary at high profile, I did not. If I recall early, my original comment is "is surely causing something to change." I made no attempt to quantify how much, nor the rate, nor the acceleration of change.
sure, but in practice that ain't gonna happen. My point was about an average trip to a restaurant vs average shopping.

If we are talking about the scenario with the minimal possible risk a restaurant could still beat the shop. You are going to drive through or pick up a pizza that you order online, so you spend a few minutes per meal with a limited number of people, say, for 21 meals, you have contacted 50 people. No need to touch trolleys, bags, boxes of pasta that people sneezed on. At home you reheat the pizza in the oven to kill the viruses.

> The Institute of Transportation Engineers estimates that one Walmart super center receives 10,000 car visits per day
Can someone enlighten me on the effects this will have on the economy?

IANA economist, but it feels like I'm still relatively net-zero with my spending. My family didn't go out to eat, we spent less on gas, but we spent more on groceries at our local grocery store, and there's a little more in our bank account.

People in the hospitality/tourism industry are certainly going through a lot of pain. If people didn't spend money in those sectors, where did it go?
> VB6 was one nice thing - build 'a program' as you understand them in Windows. Why the fuck is it so hard nowadays?

My takes is because it's not modular enough. Sure it's easy to plop this and that components here and there, add events, etc. However as requirement changing each pages / sections need to be changed as well. Not to mention portability to linux or mac. That and we're talking about db access, drivers, and security (in memory data sniffing / tepering).

Of course it doesn't applied to all kind of apps, but those who need constant changing are the one who pays Microsoft bills.
thanks !

the thing that ever so _slightly_ ruined it (for me atleast) were the eyes of the characters. they were just plain and utterly white without any blood-vessels. once i noticed that, it became kind of hard to ignore.
that pandemic was h1n1 too
IIRC Apple syncs (or can sync) your clipboard data to the cloud, which is an issue if you’re copying passwords.
Elixir isn’t any more statically typed than Erlang? More modern in many ways, yes, but something like the goals of Typescript over JS are quite different.
The joke is implying that the reason ISPs employ data caps is because packets are a finite resource.

They're not, and the practice makes about as much sense as buying your internet by the minute.
> People won't see a realized benefit for years, even decades.

This is how people get seduced into being eaten alive by interest payments, and how lenders make a fortune.

Understanding compound interest and the time value of money is a big part of how people move up financially, and how not understanding it leaves people at the bottom tiers.

For example, that mere "few thousand" can be applied to buy down the principle, which will have a sustained benefit to you for the life of the loan, and you'll pay it off much earlier.
I still type badly after years of practice and trying to touch type. I just hit wrong keys quite often! I’ve quit caring.
Yup. Early revisions of the 64C had the glyphs on the fronts of the keys, but this was later cost-reduced to having them on the tops.

This is also one of the differences between the "Aldi C64" (breadbin case, but beige keys with front glyphs) and the C64G (beige breadbin case, but beige keys with top glyphs). Commodore loved to mix and match components, too. Some C64Gs have the brown keys of the earlier breadbin C64.
It's the same from me. I've been trying to talk people into worrying & caring about this for the past 3 weeks in my social group. From the standard "This is just a flu" to the brainless "I don't share your opinion" to now people not caring because they are not in the age bracket that gets affected the most.

We're at "just" 2 deaths and slightly over 30 confirmed cases, but we had the gates open for way too long and just this week people coming from Europe is "asked" to quarantine themselves, but the government doesn't want to suspend classes.
Depends on the code. If it follows a pattern, then it might even be simpler as the pattern bay be identified without seeing the whole.
Could it be that people just don’t bother to place a reservation if they feel like restaurants won’t be busy due to a virus, but they still go there
> A solution to this is to re-design this api so that it allows developers to query for specific matches, but requires user-action to unlock them I.e. I can passively ask "does the clipboard contain a photo?" or "does the clipboard contain a url in the *.facebook.com domain?" but in order to get the contents I have to prompt the user to manually paste.

I fully expect apps to try to leak information bit-by-bit to the greatest possible extent.
It's a 16th century word that is now extremely rare.

From the article, OED definition 3 for "char": https://www.lexico.com/definition/char#h69854260165380

The main article on tea in the history and origin section has some of the earliest attestations in English cited:

"The first record of tea in English came from a letter written by Richard Wickham, who ran an East India Company office in Japan, writing to a merchant in Macao requesting "the best sort of chaw" in 1615. Peter Mundy, a traveller and merchant who came across tea in Fujian in 1637, wrote, "chaa – only water with a kind of herb boyled in it ".[45][46]"
FWIW: I'm not super anti-restaurant personally. I think a certain amount of social contact needs to be allowed (because it's inevitable) unless the numbers are clearly showing a huge risk (and they aren't yet -- cases are growing fast but outside of Milan not at a level where you're likely to see a sick person on a regular basis).

That said: your analysis is wrong. You can be contagious without showing symptoms, so the risk your assessing is NOT your "personal risk". You're increasing the risk to others too simply by being around them.
I'm glad. Maybe they'll get more popular and cheaper. Not sure about the US availability, but getting a good one in Australia is non-trivial. And that's before looking at more premium imported brands like Toto. I wanted one for a long time, but they're just not affordable.
I guess I was unclear. It's not about language choice.

Far too many programmers simply don't know ANY scripting languages. So the concept that they might want to write a quick script to do some task is simply not in scope AT ALL.
'yum cha' in Cantonese → "drink tea"
It’s going to be basically totally over in a few months, maybe more.

So you have tipped your hand a bit because you are confused that I would talk about antibiotics. That comment alone has revealed to me that you have no idea what you’re talking about and are probably 14 years old. The way that covid appears to kill most people is by upsetting gas transfer in the lungs and secondary bacterial infections, pneumonia. The treatment for which is antibiotics and an oxygen line. Both of which are plentiful, do not require special skill to acquire or administer.

Im not even going to talk about testing because your head might explode. Washing hands and staying at home, which you contradict yourself by refuting and then recommending under different names, will blunt the impact on hospitals. But it’s important to remember that worst case scenario, we are still here as a country and as a race. That is a luxury compared to how it could be next time. I will give it to you alarmists that we were not prepared at all and we should have been. We were very lucky this time.

Now school is cancelled for you so go play counter strike.

https://www.sciencedirect.com/science/article/pii/S089684112...
I made a quick visualization based on this data: relative number of coronavirus cases per state and restaurant performance from 3/11-3/12
https://twitter.com/LechMazur/status/1238701800997490690
How would the password manager know which app you’re going to paste the password into?
- Writing to the clipboard is not the same as reading it.

- Apps can and should let the user paste it themselves. (Examples #1 and #3 offer only slight convenience at the cost of user privacy and security.)
Actually that person had not yet tested positive when they got on the plane. They were awaiting the test result and found out when they landed that they had tested positive.

https://abcnews.go.com/US/jetblue-plane-passenger-diagnosed-...
Yes. They play on a heavily modified client as well.

https://www.engadget.com/2014/01/17/wow-archivist-wow-in-chi...
Which is unfortunate, because the latter requires full access to photos.
I saw that too. He isn’t a virologist and also is hawking his book. And he’s not very articulate or dispassionate. And he still hasn’t contradicted me in any way. Not unambiguously.
Kudos to OpenTable for publishing this data.
I've used OpenTable a few times before - I will even more going forward.
if you start talking about them causing pandemics that cause millions of deaths, you start approaching a situation where it could be argued it'd be moral to bomb them to oblivion, even if that led to a war. maybe not with china since they have nukes, but for every other SEA country? idk.

I feel like this makes me sound like John Bolton, and that's kind of scary.
A guide for caring for Covid-19 patients at home
There is a thing, called Presto. It has GSheet connector and many other connectors. Why don’t use it?
This doesn’t work everywhere; there’s been more than one occasion that I’ve had to copy/paste a password out of Settings because the system hasn’t detected a password field or gives me incorrect suggestions.
Being Forth-inspired, you might expect left-to-right...? It’s more of Forth-with-arrays than APL-with-stacks.
This is currently a matter of legal debate, but I don't think platforms can be held accountable for (most of) the actions of their users. A large part of what would be considered "destroying the fabric of society" - fake news, vitriol, intellectual sophistry, racism, sexism, hatred, etc. - predates Facebook. People have been nasty to each other since time immemorial - a better interpretation is that online dialogue, once the rarefied purview of a select group of well-educated academics and students, has caught up to offline dialogue, rather than deteriorated it.

Algorithmic feed curation has added an element of insularity, but people have always formed communities around what they think and care about. Failures to educate, to inculcate critical thinking, to distinguish between truth and falsehood - these are not the shortcomings of social media not its responsibility to fix, but rather the fault of broader educational and corporate systems that prioritized vocational knowledge over inquiry and examination. We brought our own cudgels - social media is simply another area to bludgeon each other to death.

Facebook can and should be held responsible only insofar as it has directly and with intent manipulated information - I don't think this has happened so far. Attempts to try and make Facebook fix what other systems were supposed to do are examples of first-order thinking - it's more effective to improve schools and colleges, offer opportunities for socioeconomic mobility, and reduce costs of living so that people can be healthier, smarter and more capable, so that they are less likely to begrudge offline or online.
CP/M was developed on TOPS-10 and copied a lot of concepts from it. I can't immediately tell whether or not this is an example, but for any given eccentricity of CP/M it's a good bet that it came from TOPS-10.

It's amusing that almost the same can be said about NT: for any given eccentricity of Windows NT it's a good bet that it came from VMS, since the two had the same principal designer.
I'm honestly a bit surprised about the amount of people that are stocking up on food.

What is your motivation for doing so? Is it because you assume essentials will be unavailable because of other people stocking up, or because of eventual pandemic related supply chain issues?

Maybe I'm naive, but I just can't imagine that because of the pandemic society will be collapsing to a point that it becomes hard to obtain the food I need for me and my family.
Yes, I completely agree with your assessment. For this reason, I prefer separating workloads. Cloud providers make this really easy with managed sql and key value datastores.

In datacenter there are good options using high availability storage arrays and vm systems. I don’t see that kube was ever meant to replace that for this workload type.

I know some have this overly simplistic idea of “one platform only”, which I don’t agree with. I see no reason not to use the correct tools as appropriate for the task at hand.
> average person with a smartphone could realistically generate several blocks a day,

I seem to recall the proposed staking minimum being around $200,000...

Eth's administrators must have a kink for kidnapping.

It's far from clear that "PoS" can result in a system which is both secure and decentralized: https://download.wpsoftware.net/bitcoin/pos.pdf ... the limited academic work attempting to demonstrate such things have done things like assume that users were using a lossless ordered reliable broadcast medium (which is equivalent to assuming they were communicating over a consensus system). While the history of ethereum has demonstrated that in spite of claims to the contrary in their investment prospectus strong decentralization isn't a feature of the system, there are still many practical challenges even achieving faux-decentralization with PoS. Practically speaking this challenge is demonstrated by the fact that ETH's operators have continually pushed back their promised migration to PoS. Moreover, as was recently demonstrated with "steem" PoS can also easily be abused to rig outcomes just like that above concern with mining.

So I think its far from clear that this is a temporary issue. Instead, to me it looks like PoS has turned into a never-arriving panacea being used to excuse all sorts of serious flaws in the ethereum ecosystem in addition to ethereum itself.
We adapted the CDC Flu Surge model to estimate the effects of COVID-19 on US hospital resources. Many assumptions detailed here but combined disease and population with hospital bed and occupancy data to help prepare for where the largest shortages may occur if things were to get bad
Which isn't foolproof. I just tried to change my Apple ID password[1], and the password manager will only auto-fill the password field, not the verify password field, even if you invoke it with the cursor in the verify field. The only option is to copy and paste the password (or manually copy a 64 character password).

[1] I'm fairly sure I've copy-and-pasted my Apple ID password recently - I had to reauthorise my Apple ID (I think I was changing payment details), and there was no option to use the password manager (might be pre-iOS 13, so I'm not sure if that's still the case).
Eastern Oregon had one of those, used from 1985-97, paired with one in California. (What frequencies?) After the cold war, WP says, it was used by the Border Patrol.(??)

https://en.wikipedia.org/wiki/Christmas_Valley_Air_Force_Sta...
At least temporarily during the epidemic, the Chinese government has banned the raising and consumption of wild animals. However, it appears the ongoing trend in China is to eliminate these practices.

https://fox5sandiego.com/news/china-makes-eating-wild-animal...
These things are only temporary disaster relief. This is completely different from waiving all student debt.
Finding a problem at the bottom of the Google stack
One good way to find these apps is that they’ll often throw up a “Pasting…” alert if you have clipboard sync enabled, as it tries to fetch your Mac’s pasteboard contents.
Right, Elixir has hints rather than being truly statically typed.
If you are quarantined, your food selection may be severely restricted. I'm sure you'll be able to get food, but it may not be the food you normally like to eat.

Additionally, if the virus is rampant in your area, you may not wish to go to grocery stores and risk exposing yourself.
They came to a fairly solid conclusion that we’re looking at an elevation of spillover events two to three times more than what we saw 40 years earlier. That continues to increase, driven by the huge increase in the human population and our expansion into wildlife areas. The single biggest predictor of spillover events is land-use change—more land going to agriculture and more specifically to livestock production.

It was avian influenza in the 2000s. What you saw with avian influenza was a direct consequence of how much poultry was being produced to feed people

So meat eating is not only a big driver in climate change and antibiotic resistance but is also dramatically increasing the likelihood of these crossover pandemics. It's time for us to quit our toxic addiction to meat.
> The encoding still isn't ready for user driven content sites.

YouTube has lots of AV1 encodes. You've probably watched AV1 encoded content without realising it. Here are a few of examples. To verify that they're AV1 encoded, right-click on the video and select "Stats for Nerds". I'm playing them in Firefox 75 beta.

Halo trailer: https://www.youtube.com/watch?v=Fmdb-KmlzD8

Despacito music video: https://www.youtube.com/watch?v=kJQP7kiw5Fk

Porsche Taycan commercial: https://www.youtube.com/watch?v=92sXWVxRr0g

For some videos YouTube has AV1 encodes up to 480p, others are up to 1080p, and some are up to 4K.
> a centralized micro-grid which would be many small grids using a single authority.

So a single ubiquitous solution that everyone uses... a SaaS company, but for neighborhood energy infrastructure? Quick, someone ping Elon.
The Fiat 500 Is Back, and It's All-Electric This Time Around
Not doing illegal shit and spitting in the faces of technically intelligent potential complainants.

They're playing nice now so Windows 10 spyware gets accepted.
> We know now that COVID-19 is not airborne and is spread by droplets

What?! It was only, like, yesterday when I heard that "we know" pretty much the opposite. I'm less and less convinced "we know" anything at all.
Apple Employee tests positive for Covid-19 in Sanata Monica
There's actually an open-source VB.NET compiler and runtime available already. The Mono project is sponsored by Microsoft.

https://www.mono-project.com/docs/about-mono/languages/visua...
I'm not sure I am understanding

> I imagine one way to do it is to make the attacking request to a redirect. Since the back-end conflates the attacking request and the next request (or a portion of the next request), you can get that next request, including the headers (i.e. cookies) as the body/payload redirected to that external site. If the attacker controls that external site, they then can see the cookie data.

Are you suggesting that if the backend server was setup as an HTTP proxy, you could get the backend server to proxy the merged request somewhere else?

That's true, but it seems pretty unlikey that the backend servers would be setup that way.

Although i think i might just be misunderstanding what you mean.

> Another way would be to make it so the next request is the content of a param which is displayed in some manner. For example, if it's the content to a message post to a slack forum.

I.e. you're suggesting basically using this as a CSRF attack to post part of the victims request (including secret cookie) somewhere public to retrieve later?

I think this would work in certain situations but would be difficult to pull off. Its a bit more complicated because if the site was using csrf tokens you would need to make sure the victim request was a POST with a token,but that is easy enough - retry until it happens. The bigger issue is the request body would be kind of malformed. If the endpoint you are posting to accepts application/x-www-urlencoded (and not json), i imagine its interpreted super liberally. I guess the biggest issue is if ; is considered a form field separator (since user-agent usually has ; in it). I think some standards tried to promote that, but i dont know if webservers actually implement it. If they do,it would be very difficult for the attacker to control the name of the form field, and thus actually get the part they wanted publicly posted
I can't speak for others, but I stocked up simply so I could isolate my family if the virus becomes common in our city. It's about 2 weeks of food for 4 people (me and 3 kids).

I don't anticipate the need to isolate but I figured I'd play it safe. I thought this was what others were doing, but now that I think of it I'm just assuming people think as I do. I personally didn't buy 40 rolls of toilet paper.
Structural OCaml Editing in Emacs
Given a silverlight impl just got hn three days ago... We live in incredible times
I came here hoping for this instead: https://knowyourmeme.com/memes/the-tea