skysight-inc/HackerNews huggingface dataset:
I read somewhere recently that Google used to be affected but have since patched their servers.
It's not mentionned in the article so I don't see how they handled security? Espcially network wise, how do they prevent spamming?
AWS Re:Invent 2014 – 7 Sessions on Databases and Scalability
How about putting a cap on the maximum number of people one delegate can represent. It probably wouldn't entirely prevent it but it might discourage it by at least making it a less productive venture.

"No one person can represent more than 20% of the total voters" or something like that. That way you have at least 5 big fish in the pond.
The people who know don't talk and the people who talk don't know...
Absolutely shocking!

What's funny is we have our own internal tax haven's in the U.S., say Delaware and Puerto Rico to name two...
The author mentions a mitigation of specifying a filename in the Content-Disposition header, which that particular url actually does:

Content-Disposition: attachment; filename="f.txt"

Perhaps Google has fixed the problem for that URL -- I would hope the author contacted them in advance.
Sorry Walmart – NFC and Apple Pay Have Already Won
You take a few minutes to get used to/remember how to use that terminal?

Not all of us are system administrators who need to be able to work on any Unix system at any times notice, and can only rely on things like ed being installed on them (That's at least the complaint I've read a lot of from people who are against some customization, or learning some kind of non-standardized/ubiquitous program. But what if you get stranded in the Sahara with no laptop, and you have to use a AT&T UNIX PC because the bedouins don't have anything else, and you desperately need to fix something on some boxes 1,000 miles away? Where's your fancy colour schemes new?).
I have some meetings in mind, so I'm looking forward to learn new things and meet other hackers :)
Ahh...that makes sense
Social Media and Cell Phone Use for Election News More Than Doubled
I believe because the download "actually" (via reflection) comes from google.com .
arguments? how about friendships?
Isn't this basically the way the electoral college works, at least on paper?

Wouldn't it be subject to the same limitations of the electoral college, that future laws could restrict how delegates vote based on popular election results, etc.?
The Fertile Philosopher on Indiegogo
How the hell is that the takeaway from the article? That's the most disingenous read possible. Ass.
The obvious is that you think you're running "su" but you're really running some other command because your PATH is ~/.trojans:/bin:/usr/bin. They may not have immediate control, but they'll get it eventually.
Real-life behavior shows that people prefer to punish by withholding help
Well...sure. The correct answer is "use WebGL, it's designed for this." Looks like the guy learned a lot about 3D engines though. His next goal (to make a CSS output for Three.js) is similarly silly, but the history of computing is full of ridiculous side projects.
True, from a first order perspective (short-term). But it's not the only perspective. It's also in the shareholders best interest when crime rates in the vicinity of their production and R&D facilities are low, education levels are high, transport systems are functional and well maintained, etc. etc. We can all agree on that.

However, cooperation would require negotiations of laws on a global scale. The existing systems in our old nation states are just not suitable for that.
the biggest problem with plain React (without Flux) is that the parent components have to pass event handlers to the child components, which gets really messy if you have multiple (>3, say) levels of nesting. It's much cleaner to have the child component trigger an event, and the data for the parent component to be updated accordingly.

This is something Ractive.js provides out of the box (child components fire events, that parent can be listening for), and what Flux (and its implementations) provide.
Flownote: https://flownote.io

Note taking and sketching software that aims to be as easy to use as a paper notebook, with the benefit that you can have a hierarchy of notebooks and you can share, search and export your notes. That's what makes it cool. It also has markdown support and a really clean user interface.

After getting some initial user feedback and then changing and fixing a few things, I'm mainly working on the UI at the moment.
Google must think they are the center of the universe with this
It's a strange feeling if I step back for a minute, but reading about exploits in car entertainment systems got me _excited_, not scared. I wanted this article to share 'this is how you root your car' style material.

Maybe _that_ reflects badly on the car manufacturers [1], creating expensive and often obsolete/bad environments, that make me long for a 'root hack'?

1: Audi driver here, but I haven't seen something that didn't feel like a design from 5 years ago and sluggish like hell in any car so far.
I used diesel as historically cc for cc they have lagged behind petrol engines (though that has largely ended).

The turbo is irrelevant though, the IC has a turbo, they work and are reliable the rotating engine doesn't but that doesn't rule out a basis for comparison.

It comes down to fuel efficiency, emissions, maintenance and cost and I can't see this engine winning (for cars).
I'm not sure I buy that. Colorado also passed medical before full legalization and basically was in the same situation as CA in terms of medical dispensaries opening everywhere, run mostly by "out of towners".
Think Distributed, Live at RICON 2014, Academia and Industry Partnerships
Nice work. Very well explained.

However, the main difficulty of building a browser engine is (IMHO) the fact that it should update the display incrementally whenever a change in the DOM-tree or the CSS occurs. That is, an update should cause a minimal (or close-to-minimal) number of (paint) operations to be performed. I'm looking forward to the discussion of this topic :)
One of my proudest moments on the Internet was being mentioned as "MeFi's own egypturnash" in a FPP linking to a Kotaku article I happened to show up on.
I remember not just VRML, but noticing vwww.domain.com (or something similar) and thinking how it was going to be the future. Then I started using some random "3d" browser that allowed you to see webpages in a cube-like (compiz-like) environement. This was about 2001, which was the start to my interest in cgi and animation.
I don't get few things.

1. Queries are executed by passing your query and db-config to oj/exec. So, does it mean that with any new query there will be new connection to db? How do you manage transaction, when doing inserts/updates? I suppose there must be some magic I don't understand, because if that stuff actually is unsupported that would make all thing pretty much unusable, wouldn't it? Well, if you are not using MySQL/MyISAM anyway.

2. I suppose that library does some internal sanitizing, because it is what such libraries usually are for after all. There isn't much sense in using keywords instead of strings if it is the same plain SQL you would write manually (well, you wouldn't make a typo in the word WHERE, but that's all). But I don't see any mentions of types whatsoever. So if I pass some variable foo to that query, how does it know how to validate and sanitize it? If it is allowed to be NULL? If it should be passed to query as INT or string or maybe DATETIME? As it is minimalistic I would assume it doesn't use schema (and how would it if it's not an ORM, but just some query composer?), so how does it work then?

There are few other things I frowned on, but these are the major points.
Lots of interesting things can be done without root.

The author gives an example where he quits and re-launches Chrome with flag "--disable-web-security" which disables the same-origin policy. He launches Chrome to a webpage which then steals your Gmail session cookies.

Most of the useful things you do on your computer, accessing all of your data, etc. doesn't require root.
The Rosetta Mission: Landing on a Comet (10min documentary, October 23rd 2014)
Not unless you count politics, law, finance, and economics.
The biggest players in the anti-marijuana
legalization movement are pharmaceutical,
alcohol and beer companies, private prison
corporations and police unions, all of whom
help fund lobby groups that challenge
marijuana law reform.

http://www.ibtimes.com/marijuana-legalization-pharmaceutical...
Interesting. I emailed Amazon and received this reply:

Currently the unlimited photo storage benefit includes most major image file types: JPEG, GIF, (both animated and non-animated), most common TIFFs, RAW, PNG, and BMP.

This means at this time the .nef, .rw2 and .orf will be considered as unsupported format and will count against cloud drive storage limit.

For more information about Cloud Drive Photos & Videos file requirements, go to:

https://www.amazon.com/help/clouddrive/photos/filerequiremen...

I've forwarded your comments as feedback to our Amazon Cloud Drive team that you want .NEF file type images to be included in the unlimited photo storage benefit so that they aren't counted against your Cloud Storage quota. We're adding more file types to the unlimited photo storage feature, and file types not compatible now may become compatible in the future.
Fantastic to see!!

As much as I hope things like this will be a tipping point for python in the scientific community (from a major player to the dominant player), monoculture hurts everyone. Fortunately, one of the great things about ipython/jupyter is that it's designed to be language independent.

I'm sure a lot of folks here are already aware of this, but just in case you're not: There are Julia, R, Haskell, Ruby, and who-knows-what-else kernels for ipython/jupyter.

I know the basic idea has been around for a long time (e.g. Mathematica), but ipython really is an incredibly well-done and flexible execution of the idea.
Yes, you're right, it's corny.

Not to offend, but this is typical of HN contributors, to equate a completely mundane Experience with something much deeper and interesting and for no one to call you out on your pap.

Someday once space tourism starts it will be the equivalent of burning man. Until then... Burning man hasn't been cool since it left ocean beach.
I wonder if I used your add-on. There is some very interesting stuff available now, like ask Mr. Robot.
It's a shame that the HN meetings are taking a break right now! Good that people is still up for a get together :). Are you planning on organizing other meetings after the 12th of November?

Thanks for the welcoming
This is probably the first time I really get what is happening during a build (despite having written a few C programs and Makefiles). Thanks for writing!
Awesome, thank you so much for this.
The time is 9:41
Indeed, our system was originally a "Six Degrees of Kevin Bacon" sort, where if you didn't know him, you'd likely know someone who'd vouch for a House candidate or Elector (who was vouching for the President); the Senate back then was elected by state legislatures to protect their interests.

It had obvious scaling problems, and the total number of districts was fixed at 435 in 1910 ... yeah, in the period where the GooGoos (Good Government) types were smashing most everything in sight about our system, like Senate elections. They sure improved things :-(.
For those capable of understanding both English and German, there is a version where both are left undubbed here: http://vimeo.com/109821144
Let's read a Truetype font file from scratch
Delaware is not a tax haven; it's popular for its legal environment highly favorable to management of large corporations.

Puerto Rico is currently a tax haven, but only due to a temporary (but very generous) tax incentive that requires people to permanently and physically move themselves and their companies to Puerto Rico.
> The concept is only flawed under the most cursory of understanding and analysis.

I find that many counter-arguments to privilege will try to dial back the level of analysis to make privilege seem ridiculous.
Spark officially sets a new record in large-scale sorting
GoogleChro.me is not affilliated with Google. Solar effect is modified from a demo contained in Dart. - Privacy - Terms
I don't think it's the drugs.

I used to do cross-country backpacking. The kind where you go on multi-day trips out in the wilderness, well out of the range of any technology (except GPS). What is remarkable about such trips is exactly the type of detachment that the parent describes.

It also gives a profound sense of perspective. You kind of realize how inconsequential your day-to-day concerns are. You know, stuff like trying to not be late to morning stand-ups or vertically centering the text inside some div. You realize how small you are in the grand scheme of things. The forests and rivers and mountains existed long before you were born and they will continue to exist long after you die. In their eyes -- if they had eyes -- you don't matter. You're less than a speck. You're nothing. Then when you lie down in your tent that night and the only thing you can hear are the sounds of nature around you, what happens is that you stop giving a shit about your "default" life.

Several days later, on your way back to civilization, your phone beeps and you realize you're now within range of a cellular tower. Annoyed, you punch in your passcode to silence it. Oh, what's this? Your friend texted you two days ago, inviting you to a house party on Saturday. Better respond real quick so he doesn't think you're ignoring him. And maybe check email while at it, too.

And that's how you get sucked back into bullshit.
This is a healthy trend. Also a good lesson to US government that the current levels of taxation are not viable. US government might end up earning more tax revenue with lower tax rates.
Chances are that you are storing any data you care about in a way that's accessible to your user.

If that data is the target of the attack, user privileges alone won't help you.
What if Leo Strauss was right?
There are a lot of URLs that echo back the content from the path/parameters. google.com/s/whatever mentions /s/whatever is not found for example.
§2.3.2 mentions that the author reported the security problems to Google, and Google fixed their APIs.
Show HN: DuckieTV (Tv-Show tracker) now runs standalone on Windows/Linux/MacOS
I've just finished wrapping up my AngularJS web-app DuckieTV in node-webkit so that now it can run not only as a Chrome or Opera plugin, but also standalone on Windows, Mac and Linux. This makes DuckieTV the most cross-platform app i've ever built and i'm pretty proud.

I started this project somewhere in february this year as a chrome extension to teach myself AngularJS and I've come a long way:

DuckieTV is a web-app built with pure AngularJS that takes care of TV-Show addicts by providing a personalized TV-Show calendar. DuckieTV makes sure the information is always up-to-date and gives you an integrated blocking-resistant torrent search to help you get to the right download as easy as possible.

With the integrated DuckieTorrent client you can connect DuckieTV to your local µTorrent/BitTorrent client and be updated on the download progress without switching applications. Experimental ChromeCast integration even provides the possibility to stream videos to your TV while still downloading.

More info, screenshots, changelog, and release on github: https://SchizoDuckie.github.io/DuckieTV
Instead, only run code from random sites that put time into having a legitimate looking UI and/or price tag.

Edit: I do wholeheartedly agree with the revised parent comment. Piping things into your shell is bad practice because it allows malicious and non-malicious risks to your system. In the malicious case, an attacker can very easily serve up an innocent script to your browser and a malicious script to curl/wget. In the non-malicious case, a break in networking midway through the download can truncate commands, turning "rm -rf /opt/coolsoftware/build" into "rm -rf /opt".
http://plstats.com

A site showing stats from the English Premier League that you do not see on the usual football sites. You can for example easily see how a team is doing compared to the same fixtures last season (http://plstats.com/#/ComparedToLastSeason/Liverpool).

It's cool because this is my first try at a passive income (ads) and its mostly built using tools/frameworks I have never used before: Go, MongoDB, AngularJS, Bootstrap, Amazon EC2.
But it would be good if the obvious way to do something didn't have certain magic conditions in which reasonable expectations aren't met (e.g. a variable is evaluated to its value, regardless of its name, or rather don't just change the language semantics in some places; yes I know it's fixed, still a good example), thereby minimizing those pitfalls.
How would this work with a case like foreign policy? Since everybody needs to able to participate, all the information related to a matter at hand needs to be made public. This is not always a good idea, especially when relating to diplomacy with other nations that don't follow this model, or to military intervention. It would essentially become impossible to hide anything from your enemies.
There is no virtue in paying tax. Why do people think that paying taxes is a good thing tax evasion through legal means is bad ?

It is government's responsibility to run the state by stealing as little as possible. At the current rate US government is stealing our money to provide welfare to mostly irresponsible and lazy people.
If you think you're downloading an installer you might very well enter your password in the pop-up dialog, since many installers ask for admin privileges and people are conditioned to think that is normal.
I second that whole-heartedly. Sometimes google/ddg/wikipedia gives the paragraph you are talking about:

> Stuxnet is a computer worm that was discovered in June 2010. It was designed to attack industrial Programmable Logic Controllers or PLCs. PLCs allow the automation of electromechanical processes such as those used to control machinery on factory assembly lines, amusement rides, or centrifuges for separating nuclear material. Exploiting four zero-day flaws, Stuxnet functions by targeting machines using the Microsoft Windows operating system and networks, then seeking out Siemens Step7 software. Stuxnet reportedly compromised Iranian PLCs, collecting information on industrial systems and causing the fast-spinning centrifuges to tear themselves apart. Stuxnet's design and architecture are not domain-specific and it could be tailored as a platform for attacking modern SCADA and PLC systems, the majority of which reside in Europe, Japan and the US.

Now I know what the hack Stuxnet is. Quite interesting but I'm not feeling like going into details - time saved.
I've just started using Morepath: http://morepath.readthedocs.org/

It's new, not fully baked yet, and yet it is amazingly powerful and simple to use.
> It's illegal to give a moose alcohol in Fairbanks

This sounds like a perfectly reasonable law. Imagine the damage a 1500 lb drunk bull moose would do.
I've also been using angular for about the same amount of time, and I think a lot of what he's saying is valid. On more than one occasion, a co-worker would come asking for help with a bug and to explain why it was happening was far more complicated than it really should be.

Of course putting enough time on a framework can pay off once you've mastered the tool and know all the caveats. The problem is that if you weigh the pros vs the cons objectively, the cons are not something you can scoff at. Angular has a lot of complexity that is difficult to reason about, and there are a lot of traps along the way to mastery (speaking from experience seeing co-workers shoot their own feet).

For me, the biggest problem is that it throws some seriously useless errors (e.g. race-condition infdig on a route redirect). In a sane framework, errors are meant to direct you to the cause, not simply to announce that something somewhere is written in a way that the framework doesn't like because of complex reason foo. This can be a serious showstopper if you are more than a single developer working on the codebase and even more so if the rest of the team touching the codebase isn't made of Angular superstars (which is often the case).
So to summarize:

(1) You can use semicolons to get some web services to ignore the end of a request URL and respond normally, while tricking browsers into downloading the response as a file with an arbitrary name. This allows you to send a victim to a mainstream site (Google or Bing, e.g.) and have them end up with a file with the name of your choice in their Downloads folder.

(2) If the web service responds with user-submitted data, you can potentially get the contents of that file to be a valid executable. For example the author demonstrates a JSON response that is also a valid Windows shell script.

(3) By combining these two exploits, the author speculates that you can trick users into executing files that they wouldn't execute if they were hosted at g00gl3.com or similar.

The last part I'm not totally convinced of -- are there examples where attackers gain a big advantage by having a downloaded file come from a trusted URL?

Even setting that aside the first two parts are pretty neat, and I wouldn't be surprised if there are other interesting ways to exploit them.
I wonder if this can be mitigated by marking your JSON actions as HTTP POST only. Since this utilises HTTP GET the request would never be actioned and since JSON uses HTTP POST almost exclusively it wouldn't break existing code.
Hmm.. So this is a MUD in a browser?

I could totally get into that. Just logged into the MUD that I grew to love to confirm the time I spent in there:

>stats
Age : 75 days 3 hours 42 minutes 25
(Yep, that's actual "play time")

Looking forward to see how asciilands turns out.
Google Guarantees Inbox Invite by 5 PM PT If You Ask During Today’s ‘Happy Hour’
DNSSEC suffers from the zone exposure problem because its design was, for many intents and purposes, nailed down in the 1990s based on assumptions about cryptography from the 1990s. Specifically:

* DNSSEC was designed to assume that keys would be kept offline, because online signatures were thought not to be performant enough†.

* DNSSEC was designed to provide authenticated denial, because it was designed during a time when support protocol maintainers believed they needed built-in countermeasures for high-level DOS attacks.

The assumption behind these design goals are both dubious, but particularly noxious when combined.

There is more wrong with DNSSEC than NSEC3, for whatever it's worth; for instance, start with the fact that it's based on RSA PKCS1v15; until recently (last time I checked, within the last 18 months), the root of the hierarchy used 1024 bit keys.

These are, of course, technical issues. There's a fundamental Internet design problem with DNSSEC, too, which is that the roots of the DNS hierarchy are overwhelmingly controlled by world governments. DNSSEC is, at bottom, a centralized PKI dominated by the US Government.

But don't worry, this is only what DNS advocates want you to store your TLS keys in.

The entire security model for the Internet has been tuned for the last 15 years not to assume the DNS was secure. DNSSEC does not in any meaningful way exist today. If your most important adversary is the kind of online criminal that might employ DNS redirection to steal your credit cards, the risk/reward for DNSSEC might arguably make sense (I think you'd lose that argument, though). If your most important adversary is GCHQ and NSA, then the Internet is far more threatened by the deployment of DNSSEC than it is by DNSSEC's absence.

† (this believe has since been retconned into a belief that keeping keys online is "insecure", which is Rosencrantz and Guildernstern-style amusing given that DNSSEC controls only hostname mappings and that virtually every other system that protects content does keep keys online)