skysight-inc/HackerNews huggingface dataset:
There was considerable discussion on a previous submission:

https://news.ycombinator.com/item?id=2522220

That was over 900 days ago and discussion is, of course, closed, so if you have anything to add, you'll need to do it here. Even so, that thread may be worth reading.
so does this depend on your server? i've read your site - but i'm not clear if this routes traffic through your server or not
Am I the only one around here who tries to match every article with "Go" keyword with Golang?
> You are making the assumption that scenario one does not lead to an exploitable vulnerability

Personally, I'm making the assumption that scenario two will lead to a probably exploitable buffer overflow whereas the scenario one might lead to another class of exploitable vulnerability.

By significantly reducing how much time I have to spend focusing specifically on the buffer overflows of scenario two, I have more time to spend on the other logical errors that may lead to vulnerabilities in scenario one. It's not fail safe -- nothing is in the most extreme interpretations of the phrase -- but it is fail safe against one specific failure case, which is valuable.
How they obtain security code (cvv, am I right) from swiping card data? It's not stored on magnetic tape.
Lots and lots of really negative publicity here in the UK. It blocks rape support sites and sexual education websites better than it blocks porn:

http://www.independent.co.uk/life-style/gadgets-and-tech/abu...
Maybe not the sex offenders list, but there will be a list and it will likely be leaked in all or part.
Political gesturing.
- What proxies are you using?

- If you set up your own proxies: How do you handle the costs?

- If you use someone elses proxy: How do you make sure they always work for your users?

- Does you extension only proxy blocked traffic? How do you know what is blocked? Is there an official list?
A field guide to classic arcade design
I've been looking forward to this one! I have a soft spot for eccentric inventors that challenge the status quo simply by doing things their way and not blindly following conventional wisdom. Even if you disagree with them it's good to have your assumptions challenged, if only because it makes you aware of the fact that you have them.
I would go with that if it were opt in. But deliberately, its not. Have to ask why, and what that implies. The whole point is to humiliate people who want access to porn. It has nothing what so ever to do with protecting children. The UK gov is enforcing a morality on the UK people which frankly its rarely applies to its self.

Also, BT are going to or are blocking proxy and proxy info sites. Why would any one want to opt in to that? Clearly this the beginnings of mass censorship, which I see no logical end to.

All this coming from the party which claims to be about personal choice and responsibility.
I'm using Squid to serve proxies, albeit a modified Squid.

On your 3rd point, it has a list, as well a manual activation button. It proxies only blocked traffic.
Indeed it does, it uses proxies. Private proxies to be exact.
We are going through this where I work currently, a co-worker, a good friend, passed away on the 13th. We'd been joking the day before about what food item he was going to bring in the next week though we all knew what it would be.

While he had been sick for a few years, at times appearing in colors no human should ever appear in, he had been improving steadily and was in very high spirits. To say it caught us off guard is one thing, it caught his doctors and family off guard as well.

It is very odd to have lost two friends who just happened to be coworkers since I started at my current company almost sixteen years ago. I lost my former manager six years ago and this friend who recently died was on the same team.

As a group, those closest never ventured into terrible. Oh we hit the gutter for humor but only in how it relates to our other loss years before. Jokes/comments along the lines of "God probably needed help keeping so and so in line" or "Great, now they are going to team up and take over the place".

Mourning will really hit Saturday at the funeral, its possible that terrible is reached the days after that but only directed at those who don't come who should have come. You know the type, there people you work with who really don't care about anyone else but they sure make a show of it when someone higher up is around. Got them, should be interesting if suspicions are right.

Forgetting, well that won't be all the quick. We still bring up the name of the first to pass from time to time, some people have an over sized impact on organizations when they are alive and when viewed with the rose colored glasses of the past. Yet shouldn't we always only remember the good days?
Funny how they say "oh but the attack possibilities are limited" then proceed to mention all the weaknesses in the algorithm.

Well, if the algorithm is so broken then it should be trivial to break it even with their limitations.

Isn't that what they say? "Oh SHA-1 is broken", great, show it.

Of course, the capability to do that may be worth more than getting the $200k from the contest
Most of them require you to enter the CVV code. A lot of online stores will ask you to provide that code as well.
That's Moxie Marlinspike, developer of TextSecure.
#DRUNKBARTENDERGOESHULK
Sheryl Brindo Hot Pics 
Sheryl Brindo Hot Pics
Just remember that Knight Capital episode. Algorithm ran amok, they lost a decent chunk of money (460M US$!) and were bought out a couple of weeks later (http://en.wikipedia.org/wiki/Knight_Capital_Group#2012_stock...).
Can you give examples of how incorrectly using strlcpy leads to vulnerabilities as severe and as common as buffer overflow?

Thanks.
There's a UK ISP called Andrews and Arnold that will give you a filter free experience with the caveat that you have to filter your own network, but they are not really a home ISP as such.
We kind of do.

The tendency is to say that it either incorporates a lot and becomes very valuable and the de-facto international store of value and currency (as well as representing a number of assets such as stock or estate property) or it goes to zero.

It's volatility is certainly decreasing as times goes by and the big picture is certainly positive as things stand although I agree that it would take a simple coordinated move to ban it in the western world to take it down.

Yet this has not happened yet and I can't stop but wonder why given what it has happened to Liberty Reserve and we have seen coordinated moves for far less (Kim Domcom with Mega for instance).

It would be enough for it to be regulated such that tax or vat needs to be added and bitcoin would immediately be heavily affected.

Furthermore we do not know who created bitcoin and their real motive.

In my view it is much better than the current central bank situation but it seems there is a side of it that means it has no one accountable.

Should mining ever get compromised (if it is not already) it is not really clear to me that we would even notice.
FDA Announces Policy to Phase-Out Antibiotics in the Feed of Food Animals
We have known since 1943 that bacteria can mutate and become antibiotic-resistant. In 1945, biologist Alexander Fleming warned that the misuse of antibiotics could make bacteria resistant to it. We have had decades of warnings, yet we failed to act.
Given the fact that federal employees are paid by tax payers (the employer) then the tax payers should know how much they are paying them.
Thanks for the link. I was on my toilet computer and I still haven't got the copy-and-paste business down on that thing.

I really appreciate how he writes his articles. More people should do this, with the interactive illustrations.
If you are going to switch to some different API in the hope of no longer having an exploitable vulnerability, how about just using a real string library, rather than trading in one class of bug for another one that you are hoping is less dangerous? Preferably, one where you can also store embedded NULL characters in the string, and thereby aren't also subject to strcmp failing to protect you from yet another class of exploit (due to C programs often truncating strings after null characters, which is a pretty common attack surface) due to using null-terminated strings in the first place?

FWIW, if people want to say "this API still sucks and users still have to be really careful when using it, but it slightly decreases a specific class of error" that's one thing, but that doesn't mean it "fails safe", nor is the panacea that people make it out to be: it is seriously dangerous for people to keep proselytizing that strlcpy is so fundamentally more safe that it can be used with reckless abandon (which, as I point out in the other comments I've made in this thread, is precisely what has happened due to the dogma that "strlcpy is secure and strcpy is not").
- So traffic must be really cheap, where you host your proxies? How much is it?

- Can you tell us how much traffic you had already?
Does anyone know if the so called Cameron filter, blocks HTTPS/SSL sites?
I'm finding this a bit strange. As far as I am aware you have to opt-in to the porn blocker on existing packages. The chances are its already going to be off for most people, especially those who know how to use a chrome extension.

I get the impression that this was created for other, more illegitimate purposes, that has nothing to do with "Cameron's porn blocker"
To pick a nit, that is a strange meaning of the word "universal".
I was both bemused and disturbed when it seems the entire female population went nuts for 50 Shades Of Grey recently. On my commute on the train on the way to work, you would see them twirling their hair, chewing their lower lips, writhing in their seats, sometimes even (subconsciously I'm sure) rubbing themselves. Can you imagine what would happen tho' if a bloke was reading a porn mag or watching a movie on his laptop? There is a huge double standard in play here.
Why not just read the book? It's $10.99 on Kindle, or free from your local library, and will take a weekend to read at most. You're bound to get a few good nuggets out of it. Also a relevant related resource is the 'How to Build a Startup' course on Udacity by Steve Blank. (www.udacity.com/course/ep245) Good stuff!
On the other hand, rephrasing the question away from "Is it worth reading..." it would be great to hear feedback as to what parts are most relevant and/or differences of opinion.
Android ION Memory Manager
Saw some patches related to 'libion' (such as this one https://android-review.googlesource.com/#/c/70220/) sitting in the Gerrit code review queue recently and decided to figure out what libion is.
You can, for example, set up an aggregate audio device in the audio input/output config panel to enable all inputs and outputs to work at the same time. So it's not unreasonable to think that the internal mic could be activated even with something plugged into the jack.
As much as this is a brilliant idea (opting out could possibly be recorded)

I think the general consensus of the government right now needs to change, I seem to recall a hacker game from years ago (maybe 'Hacker Evolution') which described in it's prologue: "The world has been divided; governments censor and restrict access to the internet that was, hackers and technologists moved away from traditional means of communication and established the undernet..."

This kind of dystopian path is what we're on.
We should not hide, we should not have to.
if we do, then law enforcement will go unchecked and start penalizing us for simply hiding our tracks.

I can easily imagine a world in which using Tor becomes illegal, accessing the internet with a non-licensed browser, or having a method of tracing back to the point of origin (behind NAT) for ISP's.

ultimate accountability, ultimate censorship- possibly even having to get some form of license to even get access to the internet.

British people often forget the monopoly BT/Openreach have, it ties in closely to government (probably since they were state owned)
it would be very easy for them to enforce these kinds of legislations, and of course, when they do, they'll be doing it under the banner of 'whats best for the public'

They've taken filesharing.
They've taken sexual material. -and forced you to identify yourself-
They will take more.

there are inherent problems with even identifying yourself like this; what if another extremist party got into power. "those people, those are the perverts, we'll incarcerate them", or, assuming a 21 year old guy grows up and becomes a candidate for prime minister, the current administration could accidentally leak that he bypassed porn filters.

no, hiding should not be the default, patching should not be the solution.

I will fight, I will not stop.
and should I lose, I will simply leave this country and it's countrymen.
the EU convention lists internet access as a human right.

I find it ironic that we have more censorship now than some known human rights violators.
In what world is that a double standard??? Enjoying masturbation and sex toys while disapproving of pornography seems like a healthy and reasonable stance to take.
Do “swipe” terminals require CVV? Also there mentioned: “The data breach did not affect online purchases, the company said.”
I added a pod for it, if anyone is interested. Also hoping I didn't do something bad. I set the license and contacts as from what I could find for the other libraries.

But I suspect I might have have too high of versions set for the libraries. iOS 7 and OSX 1.9.
Let me know if that should be changed :)

I'm quite pleased that they did it properly by going through the NSURLProtocols so any library that is an abstraction of those will benefit from this.

EDIT: I also rewrote their tests for XCTest, just for kicks and replaced their project with a workspace that used the pod locally. I'm sick and bored :& - my version of eating ice cream and being in bed (which I am)
Mothers Scrimp as States Take Child Support (2007)
Unlocking the scrolls of Herculaneum
I really don't know how well the required operations execute on a GPU. I've only skimmed the RSA 768 paper to find that line.
Yeah, I meant it blocks sexual education sites; I've corrected it now.
nope, it's opt out by default.

existing customers get a choice page, but new customers will have to phone in.
The ones I never see.
the cost and the possibility of prosecution for supplying illegal material are two obvious downsides to this - keep in mind that uk law makes bestiality porn highly illegal for instance, whereas it's legal or easily available in other parts of the world - and also something that people are sometimes curious about
I'm a student at Berkeley. Here's my list:

learn Vim.

master iOS and release several apps.

learn devops / sysadmin.

gain experience with SQL/Postgres (as opposed to just hacking together something with MongoDB, the easy way to do things)

My background is in iOS and JavaScript web (Angular.js, Node.js).
Forgetting the discussion of the merits or otherwise of Telegram - I just wanted to say that that is a very written article. A clear argument built on clear explanations of the various models.
You mean that? http://www.reddit.com/r/Bitcoin/comments/1t9buu/sky_broadban...
HTML5 Image Editing in your browser
Don't worry, it's just linkbait. The article is two full pages of wild guesses on what they think is blocking it.
Animated Optical Illusions (video)
With a very valid challenge.
Could you change the link to the single page view: http://www.nytimes.com/2013/12/22/magazine/ebays-strategy-fo...
Substantial discussion:

https://news.ycombinator.com/item?id=6927905 (tau.ac.il) (92 comments)

Other submissions:

https://news.ycombinator.com/item?id=6938536 (dailymail.co.uk)

https://news.ycombinator.com/item?id=6935289 (tau.ac.il)

https://news.ycombinator.com/item?id=6933255 (slashdot.org)

https://news.ycombinator.com/item?id=6932445 (slideshare.net)
Oh no! Someone on the internet says my highly upvoted analysis is.... "weird"!

What a worthless comment.
Why aren't they a home ISP? They have a product called Home::1 that is only available to home users. http://aaisp.net.uk/broadband-home1.html

You have no obligation to filter your own network, but you can if you want.

(A satisfied customer)
Nope, it's opt-out for new subscribers and existing subscribers have to choose to opt in or out. There are many reasons why someone would want to use this extension. Sexual abuse support sites are currently being blocked by the filters, so a child being abused by a family member could use the extension to find help on the internet, despite the abuser having the porn filter on. Or a chap who has been pressured into opt in in might just want to have a wank over some internet porn - it's not illegal.

If nothing else, it shows how broken the whole mess is. Opt-out filtering is ineffectual, often targets the wrong sites, and was basically introduced as a sop to a vociferous minority who would rather go back to Victorian standards and sweep all this nastiness under the carpet, than have an actual discussion about pornography and sexuality.
Don't you need a GoAwaySalmond to cover Scotland? I thought they had a separate law.
Holiday shopping infographic - Across the Board
I agree. I went to 4 different schools in 3 countries before settling in a 5th school in the 5th grade.

Moving around was never something I gave much thought - it was just how it was. And I really appreciate the perspective on cultures and life it has given me.

I can imagine it being much more traumatic in your teen years - when you start becoming more entrenched with friends / relationships etc.
Oral History of Adele Goldberg
Yeah you're right. Extinction of our species is not really something anyone should speak passionately about. We should all just be non-chalent. Ya know, like middle schoolers trying desperately to be cool.

You are actually so threatened by what I'm saying that you feel the need to follow me around on HN and add your worthless 2 cents. It's actually rare to see your kind of empty, mindless blabber here on HN. But it does make me laugh.
It is the perfection of God's works that they are all done with the greatest simplicity. He is the God of order and not of confusion. And therefore as they would understand the frame of the world must endeavor to reduce their knowledge to all possible simplicity, so must it be in seeking to understand these visions.

-- Isaac Newton
Not clear, but I am wondering what that "a king crossing the middle line is a win" rule will do.

I have suspicion that that can lead to very early wins. "Move pawn, then rush king to fifth row" might be beatable, but I guess there are quite a few "recklessly run for row 5, and just make it" paths in the search tree. An easy way to counteract that may be bringing the queen and rooks into play early, but I would exchange them and then start the race for row 5.
Why do we see his comments then?
Have you taken part in Telegram contest design?

> How large is the prize?

I think the "prize" is obvious. Breaking this "unbreakable" 896bit-RSA + no auth + no signature + MD2 + XOR is a necessary condition for the Telegram contest to be taken seriously.
The non-standard strlcpy can easily be replaced with the standard snprintf. Both can, and almost certainly should, be replaced by a library that takes care of memory allocation for strings. Even a simple one will obliterate all of the problems that the usual style of C string handling has.

(http://blog.liw.fi/posts/strncpy/ is my rant about this. Others have made the point better, of course.)
There's not one filter, each ISP can implement whatever they like.
Oh I took that part for granted. Sorry. I don't know how it is implemented, and this source is not a scholar paper, but worth looking.

http://randomoracle.wordpress.com/2012/08/25/cvv1-cvv2-cvv3-...

> Swipe transaction are perhaps easiest to describe. The data encoded on the magnetic stripe is static, formatted according to ISO7813 in three tracks, with the third one typically unused. One of the fields in this track layout is the Card Validation Code (CVC) or CVC1. which serves as a cryptographic integrity check on the track contents.

I think that makes sense from someone who doesn't understand how the security of credit card works. But if online purchase requires one to give up the cvv code, then verifying a physical card would also require one to be able to read that code.
they use openreach.

it's possible that openreach will be doing the filtering eventually, A&A have no say.
Employees are generally forbidden from discussing their salary. Most places I've worked, it has been told to me at promotion and raise time not to disclose my salary to other employees. It probably isn't enforceable however, just the goons trying to keep that info private that they want private.
This question is difficult to answer, because in its curtness it fails to ask the real question, which is "does claiming this function solves the security problems of strcpy lead to more of fewer exploitable vulnerabilities". People really need to be paying much more attention to their strings, and preferably using real string libraries rather than these low-level memory primitives as if they were a high-level string library. People also need to be paying close attention to these APIs in all cases where they use them: you don't get a "free pass" to write a bunch of string manipulation because you are using these l-function variants.

We then also have to take into consideration that actual stack overflows are nowadays rare with strcpy due to compilers being able to automatically swap in __strcpy_chk whenever sizeof the stack buffer is known at compile-time. Humorously, swapping strcpy out for strlcpy in these cases will take a situation where the program aborts when the buffer overflows (which isn't perfect, of course, as you might be able to use that to DoS part of a system that you need to temporarily go away while you attack something else) and replaces it with strings that randomly truncate their values at different points in your program's logic.

Heap-allocated buffers are still problems, but are also much more difficult to deterministically exploit. However, randomly truncated filenames, usernames, or keynames offer tons of opportunities to mess with program logic: get a system to verify properties of one path (which can be made arbitrarily long using a cyclic symlink) and then access another one, for example (which is incredibly common due to everyone's misconception that you can use a buffer of size MAXPATHLEN to store a complete path...).
Jingle Bells in Pure CSS
Pebbling a Chessboard [video]
Tor.

except where your exit node is another machine in the UK, or you need faster than dial-up speeds.

How long until this is also illegal?
Canadian Man Builds World’s First Wooden Bitcoin Wallet
Some strong claims in there for not really proving that the protocol is indeed "terrible".
Behind Airbnb's legal fights, grassroots activism
Here's the original Nanex source in question:

http://www.nanex.net/aqck2/4500.html
In general "faster without optimization" is completely meaningless because it doesn't mean fast with optimization, which is what actually matters.

Example: Average code written in node.js is typically just as slow as, say, PHP (in fact node.js was 3x slower than php in techempower benchmarks). However, it has potential to be much faster when optimized whereas PHP doesn't reward such optimization almost at all.
so the only option that will leave people at the end will be in fact (oh irony!) terrorism.
Looks like Mohit and team are finally out of stealth mode. Great bunch of guys, and the product is quite simply AWESOME.
Amazon announces new high I/O EC2 instances
She probably didn't like that he was getting it on without her.
Yes, I do. I have a PHP app that can be CPU bound (lots of ML baked into async threads). It has been a godsend.
I still do. Not sure how you can take your derisive comment the right way, either.
Do You Think Like an Entrepreneur?