skysight-inc/HackerNews huggingface dataset:
Is that around like 3000 compromised computers?

Nope, this could easily be done with far less. This is an amplification attack.

Due to the design of DNS and UDP it allows you to send a simple/small request to a poorly configured DNS server [one that open resolves for anybody - there are a lot out there] and pretend you are doing it from your targets IP address.

UDP is a fire and forget protocol, you send it a source address and it will reply to that address. With DNS recursion you can easily send a request which will reply to your target. The amount of data returned from these DNS servers and sent to your victim can often be a 50x larger than your initial request. The more open resolvers you find, the more damage you can do, without needing much more upload bandwidth from your host [relative]

eg:

You request from your host:

dig ANY isc.org @x.x.x.x +edns=0 == 64bytes

Response to your victim:

; <<>> DiG 9.7.3 <<>> ANY isc.org @x.x.x.x
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5147
;; flags: qr rd ra; QUERY: 1, ANSWER: 27, AUTHORITY: 4, ADDITIONAL: 5

;; QUESTION SECTION:
;isc.org. IN ANY

;; ANSWER SECTION:
isc.org. 4084 IN SOA ns-int.isc.org. hostmaster.isc.org. 2012102700 7200 3600 24796800 3600
isc.org. 4084 IN A 149.20.64.42
isc.org. 4084 IN MX 10 mx.pao1.isc.org.
isc.org. 4084 IN MX 10 mx.ams1.isc.org.
isc.org. 4084 IN TXT "v=spf1 a mx ip4:204.152.184.0/21 ip4:149.20.0.0/16 ip6:2001:04F8::0/32 ip6:2001:500:60::65/128 ~all"
isc.org. 4084 IN TXT "$Id: isc.org,v 1.1724 2012-10-23 00:36:09 bind Exp $"
isc.org. 4084 IN AAAA 2001:4f8:0:2::d
isc.org. 4084 IN NAPTR 20 0 "S" "SIP+D2U" "" _sip._udp.isc.org.
isc.org. 484 IN NSEC _kerberos.isc.org. A NS SOA MX TXT AAAA NAPTR RRSIG NSEC DNSKEY SPF
isc.org. 4084 IN DNSKEY 256 3 5 BQEAAAAB2F1v2HWzCCE9vNsKfk0K8vd4EBwizNT9KO6WYXj0oxEL4eOJ

<snip>

;; MSG SIZE rcvd: 3223 [bytes]

You start sending 100s of these request a second, the reply data builds up.
My traffic has lots of spikes. Some days I download HD video, some days I don't.

If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS?

Also CC numbers are 16 bytes long, would just get lost in all the noise..
Wouldn't it be easier to just take a backhoe to the data lines running to the bunker?
Six companies cashing in on Obamacare
I don't know much about git, but wouldn't it be possible to just build the push/pull mechanism on top of git? As git works, why not just use it already?
I don't think thats something that happens at the pick a profession level

no matter which profession you pick there will be administrators, managers, or partners who will be looking to exploit workers willing to take the shit rolling downhill

and in any profession there will be workers who are adept at standing up for themselves and not taking the shit rolling down hill

at somepoint you have to stop viewing your self as a replaceable cog, and stop letting others view you as a replaceable cog, and realize that if the people you work for a view you as such, you're better off working somewhere else anyway
Startups: why try to innovate when you can buy to innovate
Can someone explain why bricking an infected computer is a good idea?

I might understand it if the boot sequence just gives a warning with information, suggestions and a "Don't warn me again" option, but from what I hear it just makes the machine unusable.
Reminds me of all the +1 comments on GitHub issues. They add nothing to the conversation and you can easily subscribe to an issue by clicking the "watch" button.
The context you're missing is that this is basically a comparison between different languages that points out how all of them fall short. The message is not "I expect this.", it is "That language does that correctly, why can't you?"
lemon shows on their frontpage someone taking a picture of its VISA and putting it inside his iPhone.

What can possibly go wrong?

: )
Code a simple tcp socket server in winsock
I can't tell if this is hipster irony, or about how we should be excellent to each other.

Either way, I upvoted.
Maybe I should say, spikes in outgoing traffic.

The internet is not safe for banking, and I don't see any way it can be made safe.
We don't have to talk to everyone the same way we talk to children. I have female friends who are, in fact, pretty, and I tell them this because it makes them feel good to hear it, and it feels good to say it. (And yes, I know this is true, we are close enough to know each other well enough to share this kind of thing.)
Then it's your fault for not acting to neutralize those risks.
If you ever tried to handle any mail server at all, you would recognize that you have choice in using spamhaus (or any other DNSBL).

These people have put in place a high quality method to discriminate spammers. I've been around since their beginnings, and their list has been incredibly successful (very high quality) for me, compared to njabl and other "dynamic" lists based on honeypots, or backlash entirely (say hi to spamcop).

You would also recognize that you can just as well tag the message with "likely spammminess" for use along the chain, and people would still complain that your "legitimate" message was tagged as spam by SOMEBODY, while you wouldn't complain if it was tagged as spam by a learning algorithm.

In short, people would complain anyway, except that spamhaus is doing real damage to the spammers (as in "the mail really didn't go through") and reducing their revenue, and thus forcing them to come out which such measures. Not that they will accomplish anything anyway. Spamhaus helped stop a lot of known/professional spammers, and I applaud them for that.
it's about comfort zones, my 17-yo will take out the trash, but only to the screened in porch, not to the can. He also won't walk around the corner to get the can if it is still in the driveway, he will leave the trash exposed to racoons on the deck near where the can is supposed to be. Comfort zones...
Ah, thanks for those answers.
Ah, yes, I completely forgot that the Huffington Post is completely infallible and that everything published on that website is complete and total fact and certainly not opinion.

I do not think "pretty" is objectifying in the slightest. "Sexy"? Yes. But telling someone they're pretty is a benign compliment. Is it superficial? Maybe. Of course, superficiality has many facets. I would call the endless stream of weight-loss programs that are so heavily advertised as having a negative influence. I would call the magazines promoting extremely thin models and calling them "ideal" as superficial.

But telling someone that they're pretty is benign. It doesn't flatter the ego over a certain age and it certainly isn't objectifying.
This. A thousand times this. You nailed it. People here don't give a damn about freedom. They don't care if it keeps getting taken away, because their lives aren't affected directly. When it starts, though, they'll get up in arms about it.

People do care about freedom. There are a lot of folks who love the 2nd amendment. They just need to care more for the other amendments instead of just the 2nd amendment.

Part of this problem stems from the horrendously broken public school system. Kids are not taught to think for themselves, rather, herd mentality is not only the norm, but it is encouraged! Why do you think so many people vote consistently Democratic or consistently Republican rather than independently? Why do you think half of the country still believes that there's a (supposedly "loving") giant bearded man in the sky deciding whether people should suffer eternally or be on cloud nine?

Why do you think you have critical thinking skills?
post how much you hate your job, your company will find out and make your wish come true :P
Relevant blog post from CloudFlare:

http://blog.cloudflare.com/the-ddos-that-knocked-spamhaus-of...
“Piracy Is Progress” Billboard on Times Square Divides Artists
First off, I'm not sure what you mean by saying that telling someone they're pretty 'works' or 'does not work'. There is no underlying goal here than making someone smile if only for a second.
You could just post it on someone's wall, but I think by posting this link its saying that you came across this website and the first person you thought of was them. Plus it's cool to see your name in the middle of the screen center of attention.
This story doesn't mention that Spamhaus is protected by CloudFlare and we took a beating from this attack. At some point I'm hoping the full technical story about how the attack morphed from our infrastructure to Internet infrastructure can be told.

Also, http://openresolverproject.org

PS Technical details: http://blog.cloudflare.com/the-ddos-that-almost-broke-the-in...
White House Asks China to Stop Hacking, "What Hacking?" Says China
I use Tru (formerly Truphone) which covers UK, US and Oz, I assume through the sorts of deals that these guys have pulled off.

It's a fabulous idea but badly executed (despite the fact that they have raised oodles of VC money) with poor call quality and slow (2G) data speeds. Still, so much easier than buying a SIM in the US. Also, has the wonderful property that you can call someone who is physically in the US on their UK mobile number for free for both parties - for which incoming call (for those of you who don't know how backwards the US cell market is in comparison with regulated Europe) a US cell customer would normally have to pay!

That said, if you mainly travel to the US and don't want to deal with T-Mobile or Virgin or whoever, I heartily recommend them.
What's driving the location of manufacturing?
Definitely about being excellent to each other.
Paypal runs on 80 THOUSAND servers? And it takes hours for me to even get a quarterly transaction log prepared for download?

That just boggles the mind....
"In this case, Spamhaus's Domain Name System (DNS) servers were targeted"

This is blatantly wrong, the DNS system and poorly configured networks were used to target and attack Spamhaus.
This is because the primary goal of most malware writers is not to make the machine unusable, but to hide the malware and use the machine to spam, DDoS, collect site and bank credentials etc.

Also, you can go and turn secure boot off to boot your infected machine, so it's not really bricked or unusable.
That would suggest US medical research companies are not properly compensated by their European customers. I don't think that's the case :)
Is anyone in the startup world using OpenStack? If so, how is it working for you?

I'm always skeptical of abstractions but it'd be great to hear about any real world experience.
Incidentally, today I decided to Pimp My Vim and installed a whole slew of plugins and spent an hour screwing around with my .vimrc.

Jedi seems to work as intended, but it crashed occasionally so I uninstalled. I'm fairly certain that if you really want autocomplete, you can get it working with vim.
"Cryptography Worst Practices" slides by djb
When judges can't do math, justice suffers.
The technique of fetching remote content into JavaScript is dangerous. JSON is no more dangerous than any other JS.

Executing foreign code with eval is bad. Parsing foreign text is not. It was a problem when people misused browsers to conflate them.
Incomplete lambda forms? Facepalm.
Some interesting discussion on Reddit about this, too. Especially the top comment.

http://www.reddit.com/r/technology/comments/1b2m4l/fbi_pursu...
Why the hell is "The God Delusion" in the mix? That is not a programming book, it's a social commentary about religion.
When you have to get a job, you can't simply get an interview with a blank resume. If you want to take the MCAT, you can't just walk in to the exam hall with zero medical knowledge.

Why shouldn't the same go for voting? Education is paramount for a good democracy. If the national education system doesn't work, even fixing it is futile because there are already so many indoctrinated and uneducated voters in the population. The best option is to weed out the uneducated ones from the educated ones.

The political education test would be similar to a test you take for naturalization: it quizzes you on the party system, how the nation was founded, what the Bill of Rights specifies, et al.

Right now the only qualification to vote is citizenship. That needs to be changed.
I used to use Eclipse before switch to vim definitely. My memory skills have been improving a lot since.
140 Characters is a Joke
http://news.ycombinator.com/item?id=5449287
When I was using eclipse, I found VRapper[0] a decent enough vim plugin. I also agree with you about IdeaVim, it's a good vim, and it's been open-sourced[1].

[0]: http://vrapper.sourceforge.net/home/

[1]: https://github.com/JetBrains/ideavim
You don't need to do that; the US already kills anyone they want to as it is.

You don't even need an internet connection for them to receive virtually zero criticism for blowing you up with a drone-launched missile.
Railsboys
NO, NO, NO!

This is like CCTV footage or GPS records. Its either mine and just mine, or it is freely available to everyone for everyone.

A camera that overlooks a park and is freely streaming to the web is a social benefit, allowing mothers to check the park before taking children down, and so on.

A camera overlooking the same park and is only streamed to the CIA is a tool of an oppressive state.

Lets keep the free society, it has done us well for 200 years
I don't get it. Why is something at the UI level coupled to a server-side framework?
Not defending the article here but most of the comments so far are along the lines of "only contributors may complain." Instead of just being silly by only saying that, please tell us why you object to the points made in the article as a few have done.

That's the only way a decent conversation can happen.
Descriptive terms immediately describe the goods, or some important characteristic of the goods. Trademark law does not protect descriptive terms unless achieve "secondary meaning" in the minds of consumers. That is, trademark rights accrue when the public comes to associate the descriptive term with a particular company rather than the product in general.

[...]

Failure to "police" a mark by stopping infringing uses can result in the loss of protection.

https://en.wikipedia.org/wiki/United_States_trademark_law#De...

Two sponsors on the website, yet numerous parties issuing press releases:

https://encrypted.google.com/search?hl=en&q=world%20back...
I don't agree on WEBricks verbose headers being a problem. It should not be used in production anyway and during development getting lots information easily is obviously very useful.
A well-orchestrated DDoS attack sends packets at the rate of the noise floor of each "owned" host involved. Such a spike should be undetectable.
Doesn't the menu of possible code transformations become somewhat large after a while? See also the comment somebody made here about the problem of huge code bases. (I understand that these are usually inherited, rather than created, but they are still a problem, not a virtue)

Does the IDE have a menu item / command to move 3 lines up into the end of this if/else block?

There are 2 ways to look at this problem, specialized IDE vs generalized editor. Both are right, at times. (I personally like to use the vim plugin within NetBeans)

Oh, example of moving the lines just after an if/else into the block:

(assuming sitting on the first line of to-be-moved text, which is just after a close-curly or end line)

Delete the 3 lines: 3 d d

Move back up 2 lines: k k

Paste the 3 lines: p

Indent the 3 lines: 3 > >

9 keypresses, no reaching for the right side of the keyboard, let alone a mouse. About is fast as you can think it, the block of lines disappear, the cursor moves back to the new block, the lines reappear, and then slide right. (ignoring the clumsy autoformat that most IEDs, er, IDEs want to inflict upon your code, I'll do the indent myself, just 3 keypresses)
previously @
http://news.ycombinator.com/item?id=5439770
This doesn't extend to financial transactions generally, just ones flagged by banks as "suspicious."

"Financial institutions that operate in the United States are required by law to file reports of "suspicious customer activity," such as large money transfers or unusually structured bank accounts, to Treasury's Financial Crimes Enforcement Network (FinCEN)."

I find it a little bit hyperbolic that people are calling the end of the republic at the proposal that intelligence agencies have broader access to financial records they already have access to anyway--financial records that only cover certain kinds of suspicious transactions.
I work between Emacs and IntelliJ pretty seemlessly. Bread and butter editing is done in IntelliJ, which has Emacs keybindings that I've tweaked to match my Emacs customizations (generally after the recommendations of Steve Yegge). But then I can drop into Emacs for the same file and line when I need to do more heavy duty transformations. Here's the IntelliJ setup:

File > Preferences > External Tools

Program: /Applications/Emacs.app/Contents/MacOS/Emacs

Parameters: +$LineNumber$ "$FilePath$"

Working Directory: /Applications/Emacs.app/Contents/MacOS

Then I map a key to open this (Cmd-E)

On the emacs side, I have the following to pick up changes to an open buffer that were made in Intellij

(global-auto-revert-mode 1)
Miles-Driven Could Replace Gasoline Tax, LaTourette Says
Can we at least link to the original article: http://www.businessinsider.com/a-dangerous-sign-for-vmware-p...

I'm stunned by the extent to which the forbes.com rehashing of articles crest the front page compared to the original articles.
Is that 80,000 physical or virtual servers though? That ratio could easily be 10:1 if it is the VM count which is more what I would be expecting.
Yes, please.

Not just for the awesome read but this seems like a data point for the global internet. Very much of interest.
Why I am Having A 2 Factor Authentication Easter Party.
The picture is clearly Photoshopped. Light in the background is coming from the right, while light on the team is coming from the left.

Edit: talking about this picture: http://cyberbunker.com/web/images/swat-bunker.jpg

Edit2: I think it's more difficult to determine if it's real than I thought.
Vizify on beta testing, early users, and Techstars
Of course, I agree with you that the goal should not be to add sensitive information to session cookies. But if it's possible to encrypt, and it might provide an attacker with information, why not? I'm interested in the trade-offs. Here's the pull that adds it, I believe: https://github.com/rails/rails/pull/8112/commits
Because it takes a few minutes of time you're already going to spend implementing it for a someone to change it?
I agree that it is misleading.

The charts show the average cost for each country, then for US it emphasizes the outrageous edge cases.

A more fair representation would show all 3 segments for all countries. With the data presented, if we look at just the average costs the change is still significant but not as dramatic and shocking.

Healthcare costs are a real issue and is totally jacked up in the US, but representations like this take away credibility from the argument they are trying to support.
A watch is good for utility and fashion/status symbol, however I would argue that a smart phone is not remotely on the same level as a watch.

An iPhone or any phone isn't going to make statement compared to an IWC or Patek or most watches.
I think the onus for this one is on ISPs who don't properly filter outgoing traffic. It's pretty simple, really, you have a block of IP addresses you allocate to your customers, any outgoing traffic with a source outside of this block should be dropped. A simple iptables rule on the router handling that block would suffice.

There is no legitimate use case for sending traffic with a spoofed source IP. I'm simply amazed that ISPs who should have the technical knowhow still haven't eradicated all kinds of network attacks that rely on spoofed source addresses(of which DNS amplification is only one).
Devtrepreneur
CORS does nothing to address this problem. If you expose private data via CORS or JSONP you face the exact same problem.

CORS solves a different problem, in that you don't have to eval 3rd party code. If the remote service provider gets hacked, then your site may not get compromised.
Problem is, if I'm good at negotiation they can negotiate me down by saying "we can hire someone who is worse at negotiation than you".
Ahhhhhh

thank you

So, if for example, HSBC is helping drug money launderers to move money around for years, and never flagging it as suspicious (they are regular customers) then the CIA does not get the SP.

Ah well, nothing to see here.

My apologies for the earlier rant
The article says 10,000 servers, so maybe there's an 8:1 ratio
I also enjoyed their "thumb my nose at the SWAT team" attitude.

However, realistically speaking it would be very, very simple to get their attention. With one shovel: http://online.wsj.com/article/SB1000142405274870463000457624...
Sometimes, the IDE way of doing things seems to assume that your project is one of the "lifetime employment" variety -- that this is the only project and/or language you will ever work in the rest of your career, so you can take an "infinite" amount of time and setup customizing operations to just that one language and project, vs get in, hit hard, get out and move on.
"I've thought about it more, and I think my question is more appropriately, "why are corporations so sex-negative"?"

Because of power hierarchies. It is in their best interest to find behavior of a sexual nature inappropriate, fairly independent of context.
Email tax?
I think the objectionable part is where government agencies, with no oversight (they just claim it's to protect 'national security' when congress asks), are given full access to the financial records of every citizen.

Just a guess though.

The FBI having previous access is not a justification for giving it to every agency. Finally, having a problem with this doesn't mean you don't have a problem with the FBI having access.

You may be late to the game but some of us have been complaining about this since the first version of the Patriot Act. Just because you decided to jump in now doesn't mean the criticism of these moves is new or somehow leaving out the previous expansion of government access to previously considered private data.
Hands-on with Mozilla’s Web-based “Firefox OS”
Asm.js-compiled Turing drawings
Not quite sure what you're getting at here.
it is on mine and it's all that counts. unless what you mean is that it doesn't work without an X session on remote hosts, but in general I don't work on live code.

'The real power of vim is its proven staying power' is a non-argument, today I work on stuff that didn't even exist 10 years ago, there is no guarantee vim will be even usable for the sort of work you will be doing in a decade, and for sure there is no guarantee it will be the best choice. both vim and eclipse are here to stay for the next years and both have a lot of support.

there are lots of reasons to learn/use vim, but a 10 years longer historical consistency isn't one.
I don't see why it wouldn't be. We live in high tech times. Cyber warfare is nothing different then physical violence.
Why do you think you have critical thinking skills?

Well, he's the exception of course!
Spamhaus can be a real PITA to deal with, all in attitude "squeal like a pig, or you'll end up on the blocked list - bitch!"

Been there, done that, got the t-shirt.

What can I do to provide extra firepower in the ongoing ddos against them?
It's not about China. It's about the military doing it's job, which is the enforcement of political policy by means of violence. There is a broad spectrum of possible responses to an attack ranging from "ignore it" to "nuke it". Computers don't change that.

A more direct answer might be this: What if an enemy hacker was attempting to compromise battle plans for an impending invasion? I suspect the military would try to stop that effort with violence if there were no easier way.