skysight-inc/HackerNews huggingface dataset:
Well exploit development is quite a broad topic - while the answers below provides answers that should pretty much help provide a certain perspective, I sure hope that this helps too.

Lets start off with Web-application security - the most common of attack vectors are detailed as part of OWASP top 10 - you can read more about specific attacks with simple google searches, there are loads of articles that do the same. In order to write exploits you can try the wargames which are present online, or download intentionally vulnerabile operating systems/applications and practice on them(DVL, DVWA etc). The techniques involved in finding these vulnerabilities include fuzzing, vulnerability scanning, source code audit and manual blackbox testing.

Another area of exploitation is that of binaries that run on a particular operating system. Such exploitation usually requires you to find the vulnerability using reverse engineering/source code audit and/or fuzzing. Writing exploits requires you to have at least a good understanding of the stack layout, calling conventions, asm and shellcode. Of course, in this case I am referring to "overflow" vulns and not logical errors.

In order to practice exploitation, you can try out wargames as they are an excellent resource. There are wargames for binary exploitation(smashthestack.org, overthewire.org), webapp hacking(hacking-lab, hackthissite.org, DVWA, and LOADS more) and crypto(overthewire.org and smashthesite.org have crypto wargames), linux admin hacking(hacking-lab has a few every now and then).

Exploit development requires one to have strong fundamentals and understand how exactly stuff works under the hood. There are quite a few books that you might find interesting based one your interests. If you are into webapplication hacking Id suggest "the tangled web" and "the web application hackers handbook". If you are into binary hacking id suggest "the shellcoders handbook"(there are so many more awesome ones but this ones the best to start off with IMO).

Please note that here I have answered the question "How to develop exploits" rather than questions such as "How do i develop the security mindset" and "How do I find security vulnerabilities".

Hope this helps.

[EDIT]

For purposes of learning do NOT use scanners(such a sqlmap), automation frameworks(for eg: msf for generating shellcode). While I think these tools are AWESOME, they should only be used once you have learnt how they work and when you reach a level that you feel you are unnecessarily doing work that could be automated.
What do you mean? Qunit testing? Yes. always.
See clap for an implementation, https://github.com/soveran/clap
I Didn't Want to be a Father
"Reliable" rumours of 125 GeV Higgs Boson signal at 4 sigma in new LHC run
Right now we have two full-blown working implementations:
- Python
- CoffeeScript

We have just started to port to Ruby and Lua. All ports live under `docopt` organization on GitHub:
https://github.com/docopt

You are very welcome to help us out with Ruby, Lua, and your favorite language :-).
Agreed! Almost like a freemium model for legal services.
There were several Nvidia employees in the room, I wasn't one of them because I missed the sign-up for the event. But my co-workers were there and they got the message, and I hope the message propagates upwards to the people who make the big decisions on this.

But Linus' message was a bit disheartening. Most of our crew would really like to open source everything we write. But then there's the fact that our code would reveal the secrets of our hardware. And the fact that Nvidia is a hardware company with a strong Windows background, so open source software is quite a strange thing in comparison. It kinda feels like being between a rock and a hard place.

When it comes to mobile software, Nvidia has been doing more open source work and upstreaming quite a lot of our changes. A lot of work has been done in the kernel internals and arm stuff. Not a lot of customer facing stuff but very valuable work if you're trying to build ARM-based system on chips.
Chinese RFC proposes separate, independent, national internets and DNS roots
I think Clap is good. But you can't beat the readability and succinctness of a DSL (docopt).
Great move by orrick.

Value ressource for entrepreneurs.
They level themselves above the cliché of a lawyer that gets his money just for documents (not saying this cliché really exists). Could turn out to become a brilliant marketing stunt - apart of just the pure PR they should receive now.

But the big thing could maybe come based on this move a bit later…
If this becomes successful and they are wise enough to iterate on it they could establish their documents as defacto (outline) standards for legal documents for (tech, delaware) startups.

We have seen similar starting steps with Seedsummit[1] and Seriesseed[2] would be great if someone steps up to move this forward.

[1]: http://seedsummit.org/legal-docs/
[2]: http://www.seriesseed.com/
He also seems to have very ... sophisticated understanding of markets, supply chain maagement and logistics. that and a very healthy sense for risk management. One only has to tip his hat in the light of these operations. Which dosn't mean they don#t have to be stopped.

Maybe legalizing would help, but I'm not sure if legalizing heroine would actually do something good. what you have to do is to wreck havoc with their supply chain. But in order to do that you have to discard philosophie and biases first. Something I don't seen coming any time soon as long as politians all over the place only think in names in fugure hats.

As the article mentioned, removing Chapo won't do any good, the worst case ould be the zetas taking over his supply network and logistics, something that doesn#t thrill me a lot.

How you actually disruopt his operations, hard guess. At the minimum it would involve some serious leg work and analyzing. Continous analyzing and leg work. Again somethiing I don't see western law enforcement fit to do right now. and as long as intelligence is running their asses of in pursuite of some afghan hill billis that won't change anytime soon.

My 2 cents.
"In my country there is no problem in sharing copyrighted ..."

I guess that means that each e-book only has to be sold once in your country? The U.S. laws might be overly protective of IP, but that's an interesting problem for publishers who in theory need to earn a profit if they're going to continue as entities as well as for authors who need to feed their families.

This obviously wasn't a problem when the books were printed on dead trees, because you'd only share copies that had been purchased, and if you're friend was reading your book you no longer had access to it. Curiously, I could rent my copy of a book to you in the U.S. without violating copyright laws.
It's just when you have been around on the net as many of us have for so long you just realize that normally if something is too good to be true it probably is.

Yeah, technology isn't really revolutionising things that much. I mean, someone told me you could send a electronic letter around the world, instantly and FOR FREE! There's gotta be a catch. That's too good to be true.

And someone else told me that there's a phone company that does FREE online voice and video phone service all over the world. No way is that possible.

And then someone else told me about an online encyclopaedia that has waaaay more than my Encyclopaedia Britannica, but I don't believe them because they said it was free aswell. Can't happen.

(To quote Bill Gates) Who can afford to do professional work for nothing? What hobbyist can put 3-man years into programming, finding all bugs, documenting his product and distribute for free?

The internet is changing things.
Surely there's a better way, like disconnecting the external aerial that feeds the GPS receiver?
Count Sereno a Real Vampires web site
You may want to try working through Spivak's _Calculus_ [1] textbook. It is a bit more involved than most calculus textbooks used in universities today, so it will likely not feel like you are simply repeating something that you have already done. I would recommend this book to anybody who wants to brush up on calculus after studying it before.

[1] http://www.amazon.com/dp/0914098918/
Free, bittorrent to http downloads
For me, your new presentation worked brilliantly. The short while it took me to get what was going on, was exactly what caused me to keep reading. Granted, it is a bit of a bait and switch, but a pleasant one.

Great idea, great presentation!
Ask HN: How to setup a company in U.S. without being there?
Hi guys,
I am working on a startup, and I will need to charge users for my services.

I am in Egypt, and its not possible to have an international merchant account, or in other words, its very expensive..

So I would like to know, how can I setup a tax ID and EIN or whatever, so I can make a merchant account based in U.S.?

Is it possible to do that without having to be physically in the U.S.? Are there any companies that help do that?

Thanks so much in advance.
Intel has really stepped up in the past few years. But it's not too long ago when their h/w was pretty much unusable in Linux so their track record isn't very good.
Thanks for the tip! I'll certainly check that out.
The link to creative samples and the topic of icons was discussed here a couple of weeks ago: http://news.ycombinator.com/item?id=4031157
When the DSL (http://docopt.org/) was designed, the main goal was just to formalise that pattern-language used for decades in man pages and `--help` screens. So variations that are conventional (such as `UPPER-CASE` for arguments or `<angular-brackets>` for arguments) are supported.
i don't understand why someone would jam gps. if you want to disable your own transmitter, you can physically disable it. jamming is only useful to unilaterally disable someone else's transmitter, and i don't know why anyone would want to do that outside of a war...
Same here those Asus are way nicer imo.
Requesting feedback
Hey guys,

I'm new to HN. I'm just wondering how I'd go about requesting feedback on my site. It'd be invaluable to get some opinions from you guys, but I've posted in the past on a few relevant threads and been criticised as 'self-promoting', even through I was simply adding to the discussion.

Don't want to be branded as a spammer, so thought I'd ask first.

Thanks
_How To Solve It_ [1] is indeed a good book, but I think fjellfras is referring to _How To Prove It_ [2], which prepares students "to make the transition from solving problems to proving theorems."

[1] http://www.amazon.com/dp/4871878309/
[2] http://www.amazon.com/dp/0521675995/
From the draft,

«The main rules of the Autonomous Internet DNS are defined as following:

* Rule 1: Each AIP network itself has a complete set of Domain Name System, which support traditional domain name resolution within the AIP.

* Rule 2: Each AIP network has its own numbered name that is different from the others. The numbered name is taken as the default domain name suffix when the internal domain name of this AIP network is cited by external AIP network. And any IP node's external domain name is consist of its internal domain name and its AIP network default domain name suffix.

* Rule 3: When communicate between AIP networks, the access to IP node of external AIP network must use the IP node's external domain name.»
Contest Alert: Calling All Makers, Hackers, and Backyard Inventors
Would it kill the people at testico.net to display a one-sentence description of what their site does? I had to view HTML source and read the meta description:

"You can to put the icon you've created on your iPhone or iPad home screen, and generate automatic previews of standard icon sizes on the standard iPhone and iPad screens"
French Buffets Atlanta: Fine 18th and 19th Century Antiques in Atlanta
Fine 18th and 19th Century French Buffets in Atlanta. Visit our showroom in Atlanta and view 18th and 19th Century Antiques, French furniture, architectural accessories, mirrors, lighting, paintings, porcelains and more.
Marathon of errors: Install graphite on windows server 2003
I'm UK based and I think we do have a tendency in the UK towards low redundancy in key systems, mainly to save money.

For example, the London Underground used to have its own small power stations. These needed refurb/upgrade about 20 years ago, cost £12million, so not done, bridge to National Grid instead.

No big problems since, because there are several connections, complete failure would need almost complete black out in London, but unpleasant when it happens locally

http://www.dailymail.co.uk/news/article-556910/Power-failure...

http://www.newscientist.com/article/dn4108-double-failure-ca...

Perhaps National UK systems need more duplication and less reliance on central systems like GPS?

I've seen reports of a plan to use mobile phone based signals on railways to offset problems with antiquated wiring and cable theft...

http://www.rail-reg.gov.uk/server/show/ConWebDoc.8564

At present, when there are problems on the local commuter trains, we can fall back on 'sole possession of the way' although the drivers no longer have the brass tokens. The driver stops the train, gets out of the cab and resets the signal, which sets the signal on the next section of track to danger, so no other train will enter that section until train clears it. Not sure if they will keep the wiring that allows that in the future.
I disagree that OK/cancel are backwards. Placing OK on the left makes it a more deliberate choice. Thus the system can be more confident the user consciously chose OK, as it takes a smidge more effort to get there. OK/Cancel dialogs are (unfortunately) very common, it's very easy for users to become numb to them and just click whatever it takes for them to go away.

For similar reasons, Mac OS Classic placed the trash can in the lower right corner of the screen. If you had dragged something that far, there was nothing else you could possibly be shooting for. Therefore making the system more confident you were actually dragging that file to the trash. Which is one reason MacOS never asked "are you sure you want to delete that?" like Windows's recycle bin does by default.

Another similar example: MacOS classic placed the close button of Windows on the opposite side, on its own. Again, if you are clicking there, the system is more confident that closing the window is what you're really after. It's interesting to note that OSX did away with many of these well thought out devices.
I liked that he likes the open science publication movement. I think he would be a great advocate for it .
really? i think he ages very gracefully, even looks younger than 43
Waiting for a new category in Google Adsense, next to "content based ads" and "interest based ads", will we soon see "disorders based ads"?
As for studying proofs, _How To Prove It_ [1] is indeed a good book. You may also be interested in _Book of Proof_ [2], which is available under a Creative Commons license. (You can download the PDF for free, and you can order it from Amazon [3] if you want a hard copy.)

[1] http://www.amazon.com/dp/0521675995/

[2] http://www.people.vcu.edu/~rhammack/BookOfProof/index.html

[3] http://www.amazon.com/dp/0982406207/
s/sellers/vendors/ ... lets not forget who created the bugs in the first place, then failed to find and removed them, and finally shipped a dangerously malfunctioning product! (Alien Invaders from Mars -- http://www.antipope.org/charlie/blog-static/2010/12/invaders...)

[edit: more pithiness]
Yes. At the margins, it's a complicated argument. But many people and institutions have purchased Morris's work for hundreds of thousands of dollars, and she has shown all over the world.
Wouldn't Node be helpful here?
I think it is worth learning both. Clojure is more "practical" in the sense that it is dynamic, impure and gives you access to the huge JVM library ecosystem, which is a huge advantage for real world projects. Haskell is pure and extremely elegant in an almost mathematical sense - if you want to learn the "true essence" of functional programming then it is ideal. Overall, Clojure is my favourite because of the practicality and the fact that it is compelling for other reasons (Lisp-style metaprogramming, interactive REPL development, code-as-data philosophy, concurrency features etc.)
But that wouldn't be all cool and minimal :)
Faster XML iteration with ElementTree
The burden of proof is always on the one making the claim, not on the one refuting it. See Russell's Teapot, et al.
Ah, finally. I found that site a while ago, didn't bookmark it and couldn't find it again.

Thanks.

Any others that are similar?
In danish pink is "lysserød" literally "light red", though pink is more or less taking over.
Ah, sorry, that was just a joke, the logos came with the theme. I'll remove them asap, thanks.
Phones gain ability to learn by touching through NFC
First, APIs are simply features exposed for developers' use. A map function not supported on a device, means the API isn't supported neither, and if your 3rd party development needs this API, it needs this function, namely access to this feature.

Second, you are confining yourself to fragmentation from a developer perspective, and fragmentation matters for other purposes too.

Third, your Android example is flawed; to just shuffler your argument; a function developed for Android 2.3 can run on 2.3 and later versions. And you only need ICS, in case you need a new "built-in feature" available in ICS. Alas, an ios6 app benefiting from new maps, won't work in a substantial proportion of ios devices.

Fourth, the other side of fragmentation is diversity; and you may write a corporate app, for a pen based samsung galaxy note, with a giant screen and give it to your sales users.
All 10 of them?

Less fun edition: I'm sure it is. As it is with Linux based 3D render farms. Do both of those represent a large portion of Nvidia's income or an insignificant one?

I presume it's the latter: there are billions of desktops/laptops but only several thousands of scientific computing / 3D rendering installations. The fact that Nvidia doesn't seem to go out of its way to help people using Linux seems to corroborate that.
It would be cool to have a website or script which helps find words or sentences in a given ipv6 range.

I did find a blog post[1] about this by Pingdom in 2009

[1] http://royal.pingdom.com/2009/02/06/ipv6-playtime-hiding-sen...
Fair point. To be honest, I just picked the first smallish country I could think of with a stable economy.

Thanks for that data. I guess I still just see tens of millions of dollars movement everyday and think "hey, it's obviously popular somewhere". C'est la vie.
The sun doesn't make a funny face when the banana flies through. And where's the wind indicator?
Just reading the article rather than relying on other sources, this sounds like the sort of report used to justify one or more additional government contracts in the name of "national security".

To put it another way, the only solution is already known - build critical systems which are not dependent on continuous access to GPS signals. One cannot prevent jambing of a widespread consumer system - the asymmetry of costs and knowledge is too far in favor of the jammer in any civilian case (military solutions to jamming are another matter).
If there are sensible defaults and a technology doesn't use them "by default", then that is a failing of the technology, not the benchmark.
Mostly they don't. And more of them would do so if potable alcohol was orders of magnitude more expensive.
I looked at your comment history and every one was a marketing message. Just for some context, everything you "added" to the discussion was about your site selling brand experiences. It really came across as self-promotion and spam. If you want feedback open an ASK HN or SHOW HN post asking for exactly that.
I don't like the way the author glibly compares his subject with startups like Facebook and Netflix and seemingly seriously uses real notions of economics such as 'cartel' and 'capital-intensive'. ("Sinaloa is both diversified and vertically integrated, producing and exporting marijuana, heroin and methamphetamine as well. ") It's frankly disgusting.

Of course economics is the study of how people behave with money and resources. You can make these comparisons - just as you can study the economics of lynchings and torture by slaveowners to assert ownership over their property, the practices of the East Indian Company, or the (taking out touchy subject - think of warmongering; not saying such a thing exists). But please don't do it "straight" or without any irony. This isn't economics. This is death and murder (or war etc).

The economics is important. But it's not the economics that keeps me - or the Coca Cola company or your uncle Jack - from arming up with an uzi and "diversifying" into this "sector". Have some decency.
I wonder if this has to do with the spatial aspect. Americans use that awkward imperial system, which makes it really hard to easily chop up distances.
Almost all other countries use the metric system, which makes it very easy to understand dividing lengths.

Remember that for ordering and numbers many people use a 2-dimensional line to represent things in their head.
I don't really understand. Isn't the "cohort analysis" part of it how the data about the gyms that cancelled was extracted? That shouldn't affect how you compare the results once you've made changes. I'm also not sure I understand what you mean by "comparing a pre-change cohort to a post-change cohort" because we're not comparing the cohorts, we're comparing the cancellation rate among the whole list of customers.
Thanks for the feedback, these are some of the things I forgot to add.
I wish I understood myself well enough to know why I had to read it through until the end.
Programmers – Are you working too much?
Tumblr Over WordPress - modern world is about making life simple?
That's one of the quintessential characteristics of invention and technological progress: using things for new functions they have not been designed for.

You know, like using computers not to do math but to leave comments on a social news site.
This might help

http://blog.freshdesk.com/how-to-incorporate-a-us-corporatio...
http://www.reddit.com/r/math/comments/eohrr/to_everyone_who_...
What is the benefit of using phantomJS in this case? I understand that it is very useful if content is dependant on JS running.

But that doesn't seem to be the case here. With Python I would have used a parser like lxml or BeautifulSoup (and I'm sure there is something comparable for JS) coupled with Requests async methods. That would probably not only end up with shorter and more concise code, but also be a lot faster.
I think tools that generate or pass records or rows of data should certainly have the option of providing a schema based output as well. In addition to "find ... -print0" providing either of "find ... -proto" or "find ... -json", assuming the schema for the json is known as in a /usr/share/SOMEWHERE/find.json-schema or similar, is really appreciated. And let's not go overboard with this, as there are many cases where parsing is genuinely the sanest approach.
I read the first 8 or so, then clicked "view source"....
Yes . Modal Dialogs with Yes/No , OK/Cancel are becoming old... :)
Html 5 Indie game - Sweet Hunter seeking fund on IndieGoGo
It's not an RFC, it's an Internet Draft (which anyone can submit without review), and anyway it's offensive and incoherent enough that nobody will take it seriously, and it certainly won't make it as an actual RFC.
I found that article here in HN some months ago: http://www.pluggd.in/incorporating-company-in-usa-from-outsi...

There are some useful info on that article. Nevertheless if someone has more info I would like to know different perspectives on that topic.