skysight-inc/HackerNews huggingface dataset:
well, that's misleading.

The spec says "don't put a tss cross page boundary". This might also have been the case in some x86 implementations, but surely they fixed that once that hardware virtualization was implemented.

They actually depend on the sane behavior: they trigger the double fault when the cpu spills the tss across a page boundary.

They mention the manual because according to the manual their idea wouldn't work, but it does.

Then they also say "We should test it", and the result of the test is "CPU translates DWORD by DWORD" (i.e. doesn't miss a byte^H^H^H^Hword)
And then a nice kitty to show how relieved they were from the good news! No dragons in the way.

--

(Unless I got all wrong, but this topic is not the simplest one to reverse engineer from some slides, did anybody find a presentation video? It would really help to hear somebody commenting those slides, otherwise is a nested puzzle.
And where is the patched qemu so one can play with that?)
I don't get the conclusion here. After determining that the majority in the poll result and the majority in the comments headed in opposite directions:

> I guess I was surprised because I assumed that the comments were more or less representative of the community (probably a naive thought), but they weren’t.

Apparently you also assumed that the poll result is representative of the community. Thus the conclusion that, since the comments look different, they must not represent the community.

But I don't see any good reason to assume that. Perhaps the comments represent the community, and the poll results do not. Or (most likely, I think) neither represents the community. I, for one, care about what shows up on HN, but I tend to ignore polls as silly wastes of time. What if most HNers are like me?
Airbnb’s key to success in the French market: offline engagement
I usually stay away from PHP trashing articles (I'm a php dev), but I completely hate the misleading and incorrect title on this one.

I started learning programming when I was 10 with the C How to Program book, and later switched to PHP because it was more USEFUL for me at the moment, and it still is. I've started learning Ruby (and RoR) and node.js, and I love them, but PHP gets the job the done pretty well.

It is not PHP's fault that he's lazy, avoided compiled languages and went after cisco stuff instead.
"EASY PEASY to use... much easier than papal, credit cards, or even cash!"

99.9% of the purchases I make do not accept Bitcoins. This makes them several orders of magnitude less useful for me than either cash or my VISA card.
Analog is the new luxury
One deficiency of the voting system is that you can vote for multiple items (try voting for every item on the page) so I would take the voting numbers with a grain of salt.
If it was up an hour ago, it certainly isn't now.
Android, iOS smartphones, tablets: China beats US
So what kind of integration did Twitter, Tumblr and Pinterest have with Zendesk? How much of risk are the users are with their passwords?
The Meteor guys are moving fast. This is awesome. I can't wait until all the current methods of creating web apps are obsolete.
love the site and 'What is LaTeX' and 'Why' are really informative for a beginner like myself
Swipe card here is very tedious and complex I must say.
I just spent a few minutes looking through the Indianapolis missed connections. It seems that a lot of them aren't "missed connections" in the sense that I would expect, but rather, "I'm tired of walking into an empty home," "When I was with you I felt at home," or "Please come home."

This is my first foray into the craigslist missed connections section, so maybe this is standard, but it seemed to me that they were more abstract and musing than "I saw you at Walmart and loved your neck tattoo."
As a developer using meteor, most of the changelog is a bunch of technical "jumbo humbo" to me. However, the full release notes said something about "performance" for some day to day operation, and that's all I need to hear.

I must note that meteor does seems to excel at being absurdly trivial to get things done. It also isn't quite of a heavyweight to learn as compared to other frameworks.

(I am working on a time tracking app that's coming rather nicely)
This is, AFAIK, because all of the standardized citation styles you could pick from require it.
The customers were Twitter, Tumblr and Pinterest. Wow, three of the biggest customers they have probably.

And two, the body of the emails was not exposed, only the subject line. People typically don't but their SSN in the subject line...
...or just break them up. Is it worth the extra .8% to risk the entire system?
Just increased the VPS RAM to 1.2Gb, up again now ;) Not used to this kind of traffic...
I think so. Like most motion-capture systems, Vicon systems use high-frequency strobe lights to illuminate markers being tracked. IR strobing is definitely an option for these systems. I, too, am quite impressed that they worked in that situation, as the range on IR strobes is usually much worse than NIR and especially red ones. I suppose with the way the lighting is set up the cameras could have been in relatively close proximity behind the stage.
No password data was stored there - so zero. No passwords, password hashes or encrypted passwords were lost.
"Waiting 24 hours or more for the blockchain to sync..."

Wrong client. Try blockchain.info. Instant sync.

"You can purchase some bitcoins, which involves..."

Wrong method. Try BitInstant. Instant.

"Wait 50 minutes to get enough verified transactions..."

Could be a few seconds.
As a seller, you can choose the number of verifications you wait for. My web shop waits for the first only (fine for sub $100 purchases), so verification takes about 5 seconds.
If you wait for 10 verifications, well, yeah it's going to take a while, but you don't need that level of security unless you're buying a house.

"All of this would be completely impossible on a mobile device."

Er... Google "site:play.google.com bitcoin"

Loads of mobile wallets.
Good point- Can't argue with you there.
Surely this only holds until you want to convert into local currency?
This should've already happened, and should happen. The big banks can not be allowed to stay this big, otherwise there's almost definitely a repeat of the 2008 financial crisis in another decade or two.
I wonder if the author knows that "Letterpress" is a rather popular iOS game.
Author here: While it is true that with the current implementation, memory access is extremely limited (essentially one DWORD per page, or about 0.1% of the available physical RAM) that limitation can certainly be avoided. For one, you could shift how the TSS is aligned (and align them differently for different instructions), multiplying your address space by a factor of 10 or so. Furthermore, you could also place another TSS somewhere in memory (only a few of the variables need to actually contain sane values) with an invalid EIP and use that as a 'load' instruction.

The easiest way however would be to use the TrapCC mechanism to transfer control between bits of normal assembler code (perhaps repurposed from other functions already in your kernel), doing something similar to ROP. Of course, for additional fun, feel free to throw in BX's Brainfuck interpreter in ELF and James Oakley's DWARF exception handler. We might drop a demo of this soon, i.e. implementing a self-decrypting binary via page faults.
Presuming that the theory is correct, there seems to be two sides to this:

First, you're going to be transferring that money to the banks/institutions that lend to them. So the money isn't going away, it's just ending up as profit for somebody else (as compensation for them considering themselves to be taking on more risk.)

Second, the taxpayers going to get rid of that amount of cost in the form of risk; the averaged risk is paid by the taxpayers, it is just paid in bulk when the banks are about to fail.

This assumes the calculations are all correct, and it doesn't count in what indirect cost the economy would have from loans getting a bit more expensive overall.
> a basic, updated Ubuntu Server LAMP stack with a MySQL database

After just apt-get'ing that, the system is of course always vulnerable to the next as-of-yet-undisclosed 0day vulnerability in the base software.

As soon as you start adding useful scripts of the "P" variety (as in "LAMP") then you are at the mercy of those scripts not having any vulnerabilities.

If you wrote those scripts yourself, then yes, xss, sqli, rfi etc are all issues you need to consider. The OWASP pages could be a useful place to start getting a feeling of the most common pitfalls.
Some Airbnb Listings Could Be Breaking The Law
Yeah .. need to refine that user experience. Noted.
Sounds like Mike had a pretty crappy day. Interested in seeing how this unfolds.
So now Apple has a patent on aluminium color and black bezel?
Most laptops (and for that matter tablets) have a black bezel cause it provides a good contrast from the content on the screen.
When I saw the picture i thought "At least they won't say it looks like a macbook. It has a hard-edge look, from the pictures i looks like it has a dark tone aluminium color and it has that (admitetly awfull looking) hinge thingy.
But hey, it's a laptop and and it's small and silvery, Google made a Macbook clone...
> Now I want to try walking around imagining that my dream girl is watching me :-)

I have done (something similar to) this for the better part of my life. Such a mindset leads you to really go out of your way to push yourself.
very cool - thanks!
My guess is that if there's a battle of wills that's going to occur, the game will win. It's easier to change a name on a web project than an iOS game. There's months of advertisement that've gone in to Loren's Letterpress at this point.
GitHub's Boxen open sourced
Funnily enough, I just wrote something similar in node[1] and one of my mates has just written one in Go too. Great minds, or something :-)

[1]: https://github.com/benrhughes/crashdown
Yeah I guess because I read the TC article first, I had a better idea of what Padlet was before getting to the site.

After seeing the above comments, I went back to the site with a 'blank slate'. I actually don't think too much needs to change as a bit of vagueness can allow people to freely decide what the service is and can help you guys out as well.

However, I believe there needs to be some sort of central mission statement--something as simple as a googledocs for websites--so that first-time visitors know the main goal. From there, they can surf around and make the site what they want but at least you guys have stated your message clearly. Hope this helps a bit. Good luck!
Not overly so, but it does make it hard to be discovered or searched for, especially with the months of links and reviews for the iOS game boosting it in search engines.
Gotcha, well, coincidentally I run a code sharing site, and I'm not sure I would be able to organize code snippets on Padlet in a way that makes sense.

But I think I'm just not your audience. I think you have something here, I'm just not sure what it is (and your messaging indicates that you're still fishing around a bit yourselves... and that's OK).
> ... Because it is in the best interests of a debt-laden and debt-fuelled state to support those entities which can maximize further debt creation.

How exactly?
There was a talk on 29c3 about this. Abstract:

https://events.ccc.de/congress/2012/Fahrplan/events/5265.en....

video:

https://www.youtube.com/watch?v=NGXvJ1GKBKM
If Tumblr Made A Commenting Platform
The backend is more complicated, involving databases that determine your creditworthiness, plastic cards, communication networks, monthly billing, fraud prevention, ...
Not every critique is based on "emotional hurt."
ABCL, a common lisp running on the JVM is getting better and better by the release. It's java interop isn't quite as polished as clojures, but it is usable, and you get Common Lisp, which I like slightly better than clojure.
Louis Vuitton Handbags Outlet,Louis Vuitton Astry,Louis Vuitton Wallets
That was a mostly prescient and enjoyable blast from the past. One thing though I was glad Gibson was wrong about:

>"It will probably evolve into something considerably less random, and less fun"

While his point was/is true of many systems and organizations, the internet is one example that has really outdone itself in terms of sustaining an unrelenting resistance towards a global monoculture.

Perhaps, like some older HN users here, when I go looking beyond the walled gardens of social networks, I feel just as fascinated by what I read today, as I did in the mid 90's.
First, thanks for disclosing this.

Second - and any incident response team will tell you this - patching and removing the backdoor is not enough. You have to wipe that machine.

It's not uncommon for an attacker to leave multiple backdoors. Even if you don't think they got root, you have to wipe it completely.
We already let banks print money. What's another $83 billion?
Ask HN: Are there any programmable drones in the market?
I am looking for programmable drones for academic research. If they are open source much better.
On the tenant side of this, we have rented both through and agent and directly from the owner. The latter has been by far the best in our experiences with lower rent for higher quality space.
Let's keep your theory of Apple being first to market here. Since Samsungand LG have the displays does that mean that Apple should be able do register this overly broadly-defined patent that will prevent other manufacturers from using Samsung's and LG's technology? Other than in phone, tablet/monitor, eye-wear and wristband formats, are there any form factors that can be invented? The answer to both is NO.
Such broad patents should be rejected, especially when someone uses components from other manufacturers and when those components are so essential to the design properties.
Spend it on bitcoin merchants! Then cash $300 more meat dollars into BTC

Don't speculate, keep the currency flowing : P
What a short-sighted comment. Dig a little further down. If this is their reponse to an issue that affects three customers it sends a message that every customer is important. Their reponse makes me, a potential customer, trust that they take these matters seriously.

Obviously you can also take the opinion that this should have never happened and question their competence and security. I personally weigh their response and transparency more than the issue itself, but it may seem easier since the impact to overall customers was relatively small.

Their response seems to have been handled well and may even generate some positive PR. That may change if it turns out to have been one of the recent Rails security flaws.
This is the part that gets me, as I've been saying this for a while -

Left unchecked, the superbanks could ultimately require bailouts that exceed the government’s resources. Picture a meltdown in which the Treasury is helpless to step in as it did in 2008 and 2009.

Makes one side seem a little less important to me.
That's an interesting theory. Doesn't it stand to reason that if that were the case, then in a situation where low-content comments were acceptable, the same people would post low-content comments which disagreed (e.g. a simple "No.")?
The rising price just makes me laugh. I "invested" $1,000 in BTC during the early hype as it was approaching $32.00. I told my co-workers how cool of a concept it was and that my investment was sure to pay off with a skyrocketing price.

After months and months the price drops and drops. My $1,000 is worth $200. I go through a ridiculously long process of proving my identity to Mt. Gox and Dwolla just to get real USD back at 1/5 their original value.

Now if only I had kept it in there for the long haul, I'd have my $1,000 back.

It's precisely this volatility that personally makes me skeptical of it truly reaching a critical mass of any sort.
IMO, one of the best ways to learn is to just start something and dive in. Pick a platform (I like Grails, but there are plenty of good ones out there), buy the corresponding book (eg, "Grails in Action" or "Teach Yourself Ruby on Rails in 21 days" or whatever) and start going through it... once you know enough to start making changes to what the book is showing you, just start an app of your own. It doesn't matter what it is, and it doesn't matter if it's any good or not, this is just a learning exercise.

Also, as controversial as this link was when it was posted a couple of days ago[1], I think you could do worse than reading through esr's "How To Become A Hacker" essay[2].

Our very own pg also has some excellent essays and articles[3] you might want to read.

If you're interested in getting involved in an open source project as part of your learning initiative, here's a shameless plug for what I'm working on:

https://github.com/fogbeam/Quoddy

https://github.com/fogbeam/Neddick

If you're interested, clone either or both repos, and join the Google group[4] and I'll do my best to answer questions and help out.

All of that said, I believe that one of the defining characteristics of a good hacker is a high level of innate curiosity, a strong desire for self-motivation and self-learning, and a naturally high level of persistence and determination. Given that, a good hacker will find a way to learn to hack, whether anyone else helps or not. So, yeah, asking for advice and help here is a Good Thing, and looking for mentors is always a good idea. But, in the end, don't rely on somebody else, just dig in and do it. If you get stuck on a specific question, ask on StackOverflow, or a relevant Usenet group, or mailing list or IRC channel or whatever. But read "How to ask questions the smart way"[5] beforehand. :-)

[1]: http://news.ycombinator.com/item?id=5248742

[2]: http://www.catb.org/esr/faqs/hacker-howto.html

[3]: http://www.paulgraham.com/articles.html

[4]: http://groups.google.com/group/fogcutter-dev

[5]: http://www.catb.org/esr/faqs/smart-questions.html
You could go as far as to say the problem is not so much Too Big to Fail, though that produces its own problems, as Too Interconnected to Fail.

This seems to be poorly understood and critically important. Too big, too connected, and too many people making the same bet at the same time with too much leverage. This will happen again unless something is done. And they went and made it worse...
Another thing to worry about is something better coming along. As soon as it does, bitcoins will crash and never recover, since their only worth is they are better than anything else for making anonymous secure trades. If Ripple or soemthing else begins to take off, that may change.
Facebook Employee Laptops Hacked
I'm not sure a poll like this is an adequate sample to draw any conclusions from. Regardless of what the HN community at large would prefer as the result of that poll, it doesn't surprise me in the least that the people who are afraid of change, and thus have the most to lose if the Yessers win, are those who speak up. They already feel invested in the current way HN works, and so they're willing to spend the extra bit of effort to try to preserve that. However, people who would like to see reddit-style AMA aren't as invested in that idea, as it's a new one for HN, and thus have less incentive to spend the extra effort and comment about it.
One does not have to resort to theoretical environmental cost calculations to conclude that ethanol uses up more energy than it produces. Yet I do not see insideclimatenews.org complaining about the sheer bulk of fossil fuels it takes to produce ethanol.
I think Paparazzi probably have the most interesting adaptive control algorithms and sensor fusion code, although their community is perhaps smaller than other open-source flight control solutions: http://paparazzi.enac.fr/wiki/Main_Page . I guess they're not strictly hobbyist since as a university project, various contributors also publish several papers a year.

Pretty much everyone in the open-source arena (Ardupilot, OpenPilot, Paparazzi, PARIS/WiiCopter) experiments with various filtering approaches and sensor fusion strategies.

One interesting challenge is that more sensors increases cost and hobbyists are often cash-strapped (especially after crashing a lot!), so sensor fusion isn't as heavily pursued as adaptive control and basic filtering strategies for 6-axis input.
Washington University accidentally sets off emergency alert system
You might be able to get a discount if you find a building which is worse than useless. For instance, an abandoned grain silo in the middle of a city that no one wants to store grain in is useless and also horribly expensive to tear down. So you might be able to buy it for less than the cost of an empty lot in the same area (which could still be quite a lot!) because the people you're bidding against would buy it and bulldoze it.
DHS honestly makes me embarrassed to be an American. We could kill the whole thing tomorrow and it would make zero difference to public safety.
Bill Gates Calls On Microsoft To Innovate More
Xamarin 2.0 reviewed: iOS development comes to Visual Studio
What an oddly specific parody.
Awesome, I'm in Minneapolis too. That site is really cool, but I really wish they would rework the image navigation.
Wow- Lemme say first I didn't think there were many St. Louisans on HN. Thanks for sharing a bit about our growing startup community.

I've been in that building plenty of times- most recently for startup events- and the lobby + 13th floors definitely have a languished feel to them (12th floor has been better refurbished and has a lot more activity). I had absolutely no idea, though, the rest of building was so empty.

Quite a bit different from my childhood: that was the flagship downtown Famous-Barr department store . . . where they decorated the window displays every Christmas . . . getting nostalgic here.

*Ever been in the WU tunnels (not just the big one between Duncker & January halls)? Pretty expansive system right under students feet that most have no idea about :)
They're not talking about a one time thing, but a perpetual artificially low cost of capital afforded only to the largest banks, basically at the cost of everyone else.
Shmoocon will release the video of the presentation in a bit, until then here is our talk at CCC http://www.youtube.com/watch?v=NGXvJ1GKBKM
Yes. BitPay has one.
"There are only three meaningful things you can do with a computer with specs like this: development, design, or gaming. And yet ChromeOS can't do any of these things."

If ChromeOS wants to do these things, they need something like Pixel.

You got it the other way around.
Not gonna lie, I just spent several minutes trying to figure out what context sensitive notifications for Android had to do with hacking the chromebook.
5 cent ideas in $10 sentences is pretty much describing half of HackerNews.
Absolutely agree with this - it's venture captial. They're taking a risk, sure you should be responsible with their investment, but it's a risk. They're not buying guaranteed success, if they were I'd imagine it'be a far larger pricetag than what they paid.

Best of luck, but definitely do _not_ feel guilty.
It baffles me why people are using tools such as PhantomJS to do website scraping. Is it really necessary to have the whole WebKit engine running to parse and traverse the DOM tree?
Made in NY - Why Your Startup Should Be, Too
Interactive map shows where Apple sources materials and manufacturing