skysight-inc/HackerNews huggingface dataset:
Agreed. The title is misleading...there were no domains 'taken', which would imply a change of ownership, especially in the context of a registrar.
> Is flexlm comprehensively cracked yet? It seems like a juicy target.

I see cracked releases of flexlm software all the time (eg. autodesk products), so it's definitely being cracked.
Veritasium did a video about Planet 9 [1] with one of the authors of this article, Konstantin Batygin. It also features David Jewitt with opposing arguments regarding the existence of Planet 9.

[1]: https://youtu.be/pe83T9hISoY
100% - fix that insulin resistance first and the others will follow.
When I was a customer, screwing up a parking page isn't the kind of mistake my employer was paying them not to make. My employer was paying them not to let outside groups change our domain's DNS settings.

But that was for domains we were actively using. I don't even remember if we had a parking page on the domains we only had to sit on; if we did, while it wouldn't have been great, it also wouldn't have been a big deal for them to show something attacker controlled for a little while. Parked domains weren't in active use, didn't have links going to them, and probably shouldn't seem credible to others.

I think we might have set up the parked domains to just redirect to our main website, but yeah.
It's worth noting that it isn't a magic bullet - it only hardens against certain classes of kernel flaw. If the kernel is compromised, it is trivial to extract the secrets (this may seem obvious, but the strength of the feature has been over-hyped by some publications)

https://github.com/JonathonReinhart/nosecmem
You're giving me flashbacks to the bad old days when Opera was the only competent browser for Windows Mobile devices. What made them the bad old days? They only had a trial version, and some time after the paid version didn't come out the date limit on the trial version expired, so thousands of people turned the dates back and sacrificed the entire "organization" category of PDA functionality just to keep using a good browser.

I believe a full version of Opera was eventually released but it took a very long time.
In the age of NFTs this makes for an interesting story. But I’m really unsympathetic to the claim that there is some kind of scandal going on here.
But still, if they mapped alert calls to being something like a <div> overlay (which you can still do in the iframe), wouldn't it solve the problem without breaking compatibility?
it doesn't verify control over the CNAME from the person creating the bucket, that's the criticism, instead it lets any AWS user claim it. (The usual verification method would be something like requiring a TXT record to be set with a secret that's tied to the bucket, and I guess for route53 users they could integrate settings from there)
It's easy to do searches on 74,000 numbers. Unpack them into an array and do binary search. No need for prefix trees when binary search will do just fine. Much simpler, too. The unpacking process is trivial if the list is packed using the method described above, where diffs are stored, not whole numbers.
It's "trivial" to you, for sure, but as many have noted it's not intended for "advanced" users, but for a target audience who happens to be not computer-savvy.
It’s easy to judge the unvaccinated.
So it's like Xeon Phi but RISC-V?
Thanks, in my native language I only heard it being called degree Kelvin. However you are right.
This is actually quite important.

Some tasks that are seemingly simple in a normal programming language can sometimes be impossible to achieve in SQL (e.g. dynamically generated columns...)
I've used Linode and Vultr for many years with great results. They are both reliable and have very cheap plans with high bandwidth speeds and limits. They are also a lot easier to configure vs messing with real hardware (which I used to do in a former life).
Barclays Bank has the worst user interfaces of any financial application I’ve ever used. Everything they make, websites/apps, are laughably bad.
No, the Israel study is vaccinated vs previously infected. The study I pointed to was vaccinated and previously infected vs only previously infected. I was responding to an assertion that vaccination offers no benefit to the previously infected. The article you reference confirms the point I made. Here is the quote from the article:

"Giving a single shot of the vaccine to those who had been previously infected also appeared to boost their protection."
"You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following:

a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.)"
What's remarkable to me is that Fowler is telling an interesting story about a technical decision, includes an entertaining diagram, but in the end doesn't provide any proof either way.

There's not a single piece of hard data in that article, not even how many of his colleagues are making the specific recommendation.
Behind the Mic:A Personal Peek Into'70s FM Classic Rock Radio-Pt. 2,KLOL/Houston
What's the method of attack here? Bob at some point stops using the site and deletes the bucket but not the DNS entry, and you notice that and create a new bucket with that now-available name?
It sounds like an incomplete model if groups aren't themselves controllable objects. I think they are punting to host MAC for that?

Fun factoid: Even if roles aren't explicitly compiled to ACLs -- which is really an arbitrary implementation artifact, not a design requirement -- a lot of ABAC systems (and their policies) like these can be provably converted on-the-fly. This matters bc (1) it frees up implementations to be things like in-DB RLS policies (so you don't need to leave the DB for authorization decisions, as recent Google-clones and auth startups slow your app down with), and (2) you can send the policies (vs ACL 'binaries') to friendly verifiers like Z3 for fast and easy interactive analysis/querying/auditing/verification. We wrote a paper showing XACML -> BDDs for that ("Margrave") in what now feels like the stone age, and AWS more recently redid it for IAM via Z3.

IMO, getting this into postgres could be a pillar for a really awesome DBaaS/PaaS startup: imagine Django or Rails w built-in scale-to-zero multitenancy & rich collaboration, which are normally a PITA
I've built a desktop app where you can load a CSV and start writing SQL on it. A lower barrier to try it out might be helpful in learning SQL.

See: https://superintendent.app
> On privacy, it's impossible to pretend that Apple is anywhere near as intentionally terrible as Google is.

The parent comment of the thread said "Apple doesn't care about consumer privacy", in response to the article's claim about Apple's values. It didn't say that it cared _less_ than Google. You're literally the only one in this thread talking about the relative amount that they care, to the point that you're just arguing with yourself.
Your question doesn't make sense to me. You keep going off on tangents about possible interpretations. Can you go StackOverflow for me here and provide the minimal complete form of your actual question?
I found a similar issue in a huge, very popular site. Thousands of root domains ripe for the taking. I sent a heads up to the company in question, but never got a reply--
I remember when I got my vote ballot in Mail while I was living in Denver.

Then I remembered I was not a citizen.
A more respectful title, "My late father's journal".
The Vietnam story is definitely an interesting datapoint. They went to Vietnam, had easy access to heroin (it was a war zone, certain civilian rules no longer applied) and fell to the vice. Not sure why you discount the possibility that the primary motivations of cold turkey quitting heroin were the elimination of easy access to heroin and the stigma of living the rest of their lives as heroin addicts.

Prison for drug use is cruel punishment, but therapy & community service (hello Portugal) are entirely reasonable (and effective!) approaches to the problem.
Thank you. This seems to suggest that the black-hole mergers picked up by LIGO must have involved an unseen third participant. Or is this required only for supermassive black holes to merge?

Is there any rational hope of picking up (e.g.) periodically varying red-shift of secondary radiation from the (presumably large) collection of black-hole pairs stuck in parsec-range orbits? Is there any process tending to align the rotational axes of accretion discs on bodies in this condition?
Small anecdote, I saw a girl’s life get saved by someone being smart enough to have an in-reach on them. Snowmobiling accident, got a helo to pick her out of the Idaho backcountry. No doubt in my mind she would be dead or severely disabled had it not been used to contact help.

Instant buy if they built iridium into an iPhone for emergency use… also… if they do that, invest in helicopter and life flight medical companies.
Is "clip art" an unfashionable term now?
Would they still keep their own separate static IPs then?
>we should mandate some form of this technology so we don't waste foundary output on throw-away parts (planned obsolescence).

That's not planned obsolescence. Planned obsolescence is INTENTIONALLY rendering a product unusable/undesirable in order to sell more product. A prime example is changing the chapter questions in a college textbook to force new students to buy new books that teach the same thing.

Things that are NOT planned obsolescence but people mistakenly think they are include cheap inkjet printers (they last as long as any reasonable person should expect).... or NOT including an expensive oxide layer regenerating heater in a THUMB DRIVE that's only intended for casual file transfers, not long term storage of frequently changing data.

Ans really, does it make sense to MANDATE a complex heating scheme for flash drives? The way drive capacity and usage continuously scales upwards, old drives would be pointless long before they died. Do you REALLY still use old 32 megabyte flash memory in today's age of terabyte drives?
The best way to make money now is by borrowing a ton of money long term and investing it into property. Doesn't even matter what kind. Source: every single Russian oligarch, who borrowed eye watering amounts of money just before hyperinflation hit, and returned kopecks on the ruble.
This is a long article. The central suggestion is that there should be limitations on what people can do with content that enters the public domain.

I think some of the interesting aspects of this article can be exposed in a small hypothetical parable.

--------

Let us suppose that I go to an estate sale. I buy a box. Inside this box are 80 year old photo negatives from a well-known photographer. I scan these negatives, enlarge them, digitally correct some of the problems due to age, and then produce a photo book from a selection of these photos. The photos are old enough to be in public domain, so I sell my photo book and don't have to worry about sharing profits with descendents of the photographer. I make millions in profit.

In addition, other big fans of the photographer ask if they can have access to my scans of the photos. As they're in the public domain, is there a requirement to give others free access too?
Another way to think about this is that the service is a static IP for $99/yr and the rest is "free", i.e., optional. Perhaps the majority of users will be attracted by the "free" stuff, but a minority might see a static IPv4 as having many potentially useful advantages for personal computing.^1

This is how I view the internet. I pay for access, and this gives me access to, among other things, the web, and various "free services" offered on the web by so-called "tech" companies.^2 There is no obligation that I have to use them. I can choose what I think is useful and ignore the rest.

1. Previously we have seen the static IPv4 address marketed by ISPs in the US as a "business account". Personal use is not contemplated.

2. But the IP addresses we get from ISPs suck for things like running a smtpd. We need solutions to this problem besides "tech" company middlemen.
I think there were many many people on the fence, however freenode's new leadership repeatedly made it impossible to stay. To name a few.

Forcefully taking over control of channels that mentioned libera.

Completely banning irccloud users.

Network banning people mentioning libera.

And then dropping the entire nickserv chanserv databases whole setting everything back to square one.

---

I think if freenode did nothing at all, there would have been massive fragmentation. I would like to think the crazy and erratic behavior in the end was to facilitate a smooth transition.
8 Bits of history: My first game is still available on the internet
I would compare to a mix of a Xeon Phi and a product like http://www.greenarraychips.com/home/products/index.html but with higher power consumption and a more standard ISA.
Show HN: JSON Component Renderer
The tool specifies clearly that the number is safe to call (not to be called from).

In your scenario (“ just tell the customer to always call them back”), which number should the customer call back?
At the risk of not being helpful: I have some json files that are updated weekly that I keep under source control in git. The week-to-week updates are often fairly simple, but git was showing some crazy diffs that I knew were way more complicated than the update. I soon realized that the data provider was not consistently sorting the json arrays; when I began sorting the json arrays by rowid everytime before writing it, the diff's were as straightforward as expected.
I think I don't understand the problem you're encountering, because this solution seems too obvious.
And not just not computer-savvy, it's also about making it painful enough a business will pay the license fee rather than trying to jump through hoops to work around licensing problems.

If it has to execute on a PC, there is a way to break the protection. It's simply about making it too difficult to bother trying to break the protection.
Yup. It's just a cliché of modern life. You hear it at train stations: "For security reasons, <anything>".

It's the same in medium-size and large companies with "legal". All you need say is "Oh that's required by legal" and no-one applies any rational scrutiny to it because for some reason the "legal" and "security" departments are considered to house minds far superior to those of anyone else.
> Krishna’s whole purpose for incarnating is said to be a mission to “unburden the Earth” of these Kshatriyas and the ceaseless conflicts they brought to the world.

Facinating. I've never heard of this interpretation before. Do you have any sources that discuss this? A quick Google search didn't show anything.
This is a case where I don’t think it matters how large the market is, but rather the perception of how valuable the bullet point is.
I’m curious: how do people verify the security of such low-level pieces of infrastructure?
I would like the definition of "boring".

Most of my day job is spent reading C++ (I write some, too) and it is more terrifying than boring. Understanding when certain errors can (and do) occur and when to optimize for performance over readability is really, really hard.

I believe that Rust, Go and TypeScript have gained a lot of popularity because they are boring to read. Even OCaml has gained a ton of popularity because it is boring to read.

C, C++, python and JavaScript: not boring to read, you constantly need to be on your toes.
Cars too. I learned to drive stick on a Honda Civic without a tachometer, but I learned to do without and tell what state the engine was in purely by its noise and vibrations.
> And no, it cannot be that the side-effects you're worried about haven't happened yet. If they happened, they'd happen within weeks of the vaccination.

What evidence is there of this?
Facebook et al have been working hard at convincing "normal" people that cloud is a dirty word. They have been more successful than one might think, judging by some of the questions I get from non-techie friends.
> Ditzel explained, were running x86 servers with open PCIe slots, leaving Esperanto an opening to enter existing datacenters through a high-performing PCIe card.

Brilliant move

> the entire chip would consume just 8.5 watts ... Ditzel said, one chip would take about 20 watts

This seems to contradict each other.
'for the taking', ie: they were vulnerable to a domain takeover. The title is entirely accurate. They didn't say they were 'taken'.
"All" fintech? Not remotely true. Lots of fintech is written in C#, Java, Haskell, Ocaml, and more.
Facebook isn’t a censor. Proof: we’re having this conversation. I don’t expect to convince you, but I find it ridiculous that I’m being asked to prove a negative because an affirmative position was extended and you’re not willing to critically examine it.

If FB is a censor, they’re extremely bad at it, and not authorized to be good at it.
I feel it hard to understand the truth with so much propaganda from Uber and Lyft that muddies the water.

That said, once I took a Uber ride and the driver strongly urged me to support Prop 22. According to him, he (and most of the drivers) works for multiple companies. It would be impossible for them to continue do so if Prop 22 failed to pass, and they would have a large income drop. It seems to me that the view is his own true belief.

The article seems to have proposed many downsides of Prop 22 for drivers, but it didn't address his concern. Would be nice if someone could give a more two-sided view.
I have had my iPhone “too cold to work” while snowboarding and “too hot to work” a few hours later hanging out by a fire.

Something people should consider when they read the words “rugged”, it’s not always about cracking/breaking.
That is indeed my current conclusion of the least-ethically-bad viable monetization. Purely cosmetic.

However, paid status is not really a big hook for single-player games, you need to be able to show it off! This means that the game must be designed primarily around multiplayer interaction, which is fine but limits a lot the kinds of games you can implement with this monetization.
Or famous freeware synthesizer by Matt Tytel.
I do. In fact, pushing someone out of a car only hurts one person. Not utilizing your resources for good hurts thousands, maybe even, millions.
Addressed in the snipped text
Data center on chip
The target audience of FLEXlm is large companies with the ability to pay for many licenses of expensive per-seat software. For instance, MATLAB, AutoCAD, and various commercial FPGA and hardware design tools (Altera, Xilinx, Synopsis, etc.), etc. use FLEXlm.

So the threat model isn't really folks who are pirating any of this software off random warez sites and finding a crack - those users wouldn't be able to pay for a legitimate license anyway, so it's not like you're really losing profit from them.

This is more of a "locks keep honest people honest" licensing scheme. Your IT department is unlikely to set up a large-scale system for distributing cracks, so it makes sure that a company that can afford it and is willing to pay for it is paying for the right number of licenses. But just like mostly-well-meaning people might wander into a place without locks, mostly-well-meaning people might "temporarily" forget to get a proper license for a new hire and then forget to ever fix it, or put the software on a shared drive, or never get around to doing the paperwork to buy a renewal, or whatever. Having any license-checking scheme at all makes them remember to do that.

MATLAB, for instance, currently sells a "standard" license for $2,150, not counting annual support costs. They also sell a "home" license for $149. By doing that, they're already banking on the fact that no serious company's IT department is going to just buy a bunch of "home" licenses and save themselves 93% of the licensing cost. They clearly don't need the DRM for the last 7% to be foolproof.
I would have advised the same thing. And advised prosecuting everybody involved in the torture regime, including those who also ended up involved in this attack.

Also, "cajones" isn't a word.
When AWS, Azure, or GCP Becomes the Competition (2019)
It's not quite so simple; I need to insert smaller audio files into a larger file at specific time codes.
FlexLM is still used all the time. I wish I knew enough to crack it, just to know how. I'll bet it's fascinating.
The system you're imagining might theoretically be possible using blind signatures, like the Ecash system invented by David Chaum. My understanding is that if you tried to spend the same coin twice, it would necessarily reveal enough information to allow the network to discover who the private key holder was, and invalidate their transaction.

Your final conclusion is correct, though. Any system which relies on people having to trust specialist auditors to tell them whether the "correct" software has counted the votes is a system which is fatally vulnerable to FUD and conspiracy theories, even if by some miracle the hardware and software were all open source and worked perfectly.
Oh please do share some nice tips in this regard
As someone who lived through, and ran a startup during, the era of 1999-2006, I would say that at the birth of a new industry there is often a period where being first is a huge advantage. But it's important to realize this is a small window of time. In most industries (cars, telephones) it is at most 20 years, and it is well known that the Internet consolidated much faster than other industries -- we went from having nothing to having 30 search engines to have one monopoly during the years 1990 to 2008.

If you happen to be alive and working during the first 10 years of some new industry, then working fast can be an advantage. Just realize that such an era is an exception. There is no need to make a fetish out of being fast, for most industries, most of the time, there is no particular advantage to being fast, and it can be a detriment in the many mature markets that demand quality first.
> The US Navy has conducted multiple detailed studies on AIP submarines.

Indeed, and the technology has continued to improve. Thus, the linked article and related discussions.

> They're an expeditionary force and they need fast, high endurance submarines which can cross the Pacific Ocean in a matter of days or escort a nuclear-powered carrier.

Nobody was suggesting they could replace their hunter-killer fleet with AIPs. What was specifically discussed in-name was using them in their nuclear ballistic missile role.

> And even for the nuclear deterrent mission they lack the necessary submerged endurance.

I'd suggest you read the linked article before responding using outdated information. They now have four week endurance up from under a week many years ago. This was a valid critique, this isn't currently a valid critique.