skysight-inc/HackerNews huggingface dataset:
This is neither particularly new, nor particularly dangerous.

One possible attack vector would be abusing a filename/MIME mismatch to trick people into executing it locally.

If you have a website that allows image uploads and keeps the original filename, you could create an image that displays normally when displayed on the web, but executes arbitrary code when downloaded and executed locally.

This was inspired by the 2011 incident that lead to the use on CAPTCHA on 4chan. A spambot known as Cornelia would flood the boards with copies of itself that contained instructions how to execute it in the image data. Of course, that only worked because people would knowingly execute a virus just to spite the mods.
Hi minimaxir - I'm the author.

I originally posted it to Show HN, but then deleted it because you pointed out that posting it there might not be inline with the Show HN guidelines.

I'm sorry you think the analysis is bad. As I say in the post, I'm fully aware that it's an over-simplified theory - however, the point of the post is to give people an idea as to how to come up with a successful app idea, not to claim I know the absolute cause of any specific apps' success.

Hopefully, it will prove useful to some people deliberating over what their next (or first) app should be.
As an aside, that is not a valid Likert set. It is not balanced around a central non-comittal value.
I understand the author's exasperation, but the post is surely filled with loaded words and wild speculations. It may get the message across, but this is not the way to start a conversation.
A Ruby programer trying out Meteor.js
Although Google has earned a bad reputation by shutting down some of their services, I think this recommendation is simply FUD.

1. v8 is just a Google project. Their decisions doesn't represent the company as a whole.

2. They just changed the VCS.

3. When Google is going to shut down a service, they warn you several months in advance.

Honestly, whether Google will shut down Google Code or not should not be a concern until they announce it officially...
"people shriek"

Can you expand on that?
Honey, they shrank the food
Yes, but I can't help but imagine how an OS written in Rust would look. Probably a lot better than what we have today. A combination of Rust and D would probably be capable of doing everything C and C++ can, and much better.
The OpenCL code works on mac too, but it's not available in th e GUI due to a corner width/height case in which the downscale quality gets hideous. HandBrake has got no active developer working on the OpenCL code anymore, so it will stay as it is until someone comes and fixes it.
> Can you give an example of a program that produces too much output for Emacs to keep up with?

Example: https://news.ycombinator.com/item?id=7310770

The thing that's so annoying is that it seems to process data that it really should ignore. It has nothing to do with display at all, it's a pipe.

(I wanted to update that example with using star-prefixed grep and sort since the info manual says that should avoid emacs built-ins, but after five minutes of waiting I gave up.)
It's not just about native vs interpreted though. Most of those languages use garbage collection for memory allocation which is still going to be an unacceptable performance hit for most of the domains where C and C++ are still in use.
Not well enough to admin them blindfold, I couldn't!
SyncDriver:client for OneDrive working on WIN8.1 with local or different account
The problem described in this post is beyond just a buffer overrun. It's about pulling in huge numbers of libraries for a few conveniences.

Rust can't save you from that; pulling in libraries makes it way too easy to increase the surface area of your code by several orders of magnitude. Even assuming rust offers an order of magnitude better security than C/C++, it still can't keep up. Sure, it mitigates things a little, but only until the next whiz-bang library gets linked in (even if it's written in rust, it will have some flaws).

In other words, the security of a program is based on the absolute number of bugs in it; but a programming language can't do much more than reduce the ratio of bugs to program size.

The OS is in a much better position to address the problem.
there's a search function on hn; most combinations of osx, sandbox, app, apple will yield results

just one example: https://news.ycombinator.com/item?id=3191021
/bin/more is in the util-linux package.

Less can pretend to be more if run that way, but debian also does ship the real more command.
Quine Code
You may also want to try the 'most' command, which is like less but more advanced.
It's good to keep spreading awareness and AFL is cool. As for proving new things... fuzzing has been actively used for security research for 15+ years, and by now it's common knowledge that C/C++ programs are rarely safe against untrusted input.
Not true actually theres always a JIT overhead for the compiler.
check out this script by Don Melton:
https://github.com/donmelton/video-transcoding-scripts
People shriek because Apple isn't giving the device owner any option to get around the security if they want to.

Apple aren't using that model just for security, but also so they can tightly control the platform and restrict what the device owner can do on it.
This is a great lesson in writing focused & succinct specs, when one clearly sees what his/her program is going to do.
Bitcoin and Science: DNA Is the Original Decentralized System
Bitbucket is extremely good these days!
Very low indeed. Chance of SHA1 collision is of the order of 2^52. One person explained it this way: Chance of everyone currently on Earth winning a jackpot in their lifetime is actually higher than a single random SHA1 collision. It should be actually mind boggling how many of the software systems and algorithms rely on hashes and them being not collided.
Was this Addepar? I think I remember the match.
So 40 years later we rediscovered the ideology behind *nix. Now we must only get the interoperability right.
in this case, put everything in hardware and expose a standardized interface. This way, you can burn everything in hardware and be safe.
Expectedly, tptacek is all over the infosec thread, arrogantly dissuading the public from the notion of a possible involvement of the US intelligence community :)
The reason for this is that SELinux is a nightmare to configure, and lots of peoples expectations break when dealing with it and they usually don't know how to fix things without just disabling SELinux entirely. For Android peoples expectation has from the beginning been set to expect to run into security restrictions.
Sony's pulled PS Vita ad is embarrassing for everyone
Searchable Javadoc – A proposal for JEP-225
Why going global is the safest bet for a Vietnamese startup
Inspiration Giving FLASH MOB International  MILANO ITALY
Get real with ES6 (and webpack)
I immediately thought of it too, it might be fun to do the movify to transform a gif to a movie, command line.
It would be nice to have a bit more transparency on salaries. Yes, they are negotiable, but only within narrow bands. And if you ask for anything outside of those bands, the result is often not a counteroffer, but dropping the discussion entirely. That makes it time-consuming to determine what the market rate for your skill-set actually is, particularly since the "no"s don't typically come with reasons attached.
Interesting, I added it in my waitlist to read :) Thank you.
on my mac:

apple -> system preferences
security + privacy
General tab
Under "allow apps downloaded from:"
* Anywhere

As for ios, if you don't believe that users would click "yes" to whatever dialogue was required to make an app run, you simply don't interact with users. Allowing users to opt-out defeats the purpose. For example, my so's mother regularly gets her gmail hacked because she will respond to any google-skinned input box asking for her password. The only way to secure the majority of users is to not allow them through their actions to un-secure themselves.

Why is it ok on mac? Because many computer users are still dependent on non-appstore distributed software. Particularly developers. Nobody has evolved that dependency on ios, so it's not necessary.
Certainly horrible if we were to switch to it now, but if it had caught on, maybe we would have put more money on improving networks instead of improving CPUs.

OTOH, Plan 9 was designed as a company-global "machine": you have a room filled with CPU clusters and storage clusters, and your own simple, stupid terminal to manage your resources. But your terminal is only a view; ultimately the data lives in the storage cluster and is processed in the CPU cluster.

Take a look at this page, notably the figure 1:

http://doc.cat-v.org/plan_9/1st_edition/designing_plan_9

As you can see, CPU and storage were expected to live on a high-speed, low-latency link because most of the data would fly between those two. Your terminal was expected to be anywhere else, possibly on the other end of a slow ethernet cable, and would coordinate the transmission of data from there. But most of the transmission would be between CPUs and storage. It wasn't supposed to be a truly p2p decentralized model.
For example, the largest unsigned binary 64-bit ­integer—18,446,744,073,709,551,615—
could be held in 20 bits instead of 64.

This should read "could be held in 20 digits instead of 64 bits."
It casts doubt whether the suicide of the Greek Vodafone employee was a suicide. I choose not to buy Vodafone.
Just use what you know, it's not about the stack. It's about what will get the job done asap.
I would love to see someone offer off-planet backup facilities. Not sure who'd be recovering the data post-apocalypse, but at least it'd be there.
Please don't post procedural comments about downvoting on HN. They're off-topic, and usually end up being false.

All: If a comment has been downvoted unfairly, simply contribute an upvote and trust your fellow users to do the same. In extreme cases, it's fine to email us about it. But please don't add noise to the threads.
Would material that named names be subject to more legal issues and scare off writers?
First breakout hit not so sure I heard nightvale name checked on the bus 3 months ago.
Study finds HIV drugs could help stop vision loss
What "most Linux distros" are you talking about?

Ubuntu has Mandatory Access Control in the form of AppArmor (https://wiki.ubuntu.com/AppArmor). It's switched on with a set of policies on the desktop (do sudo apparmor_status to see) and on the server.

On the mobile side a lot of work has been done to confine individual applications in a manner similar to Android. That's future work that could go into mainstream Linux eventually.

On the traditional server side both RedHat and SUSE have MAC on by default - for them SELinux I believe.
Certainly. But password+key really isn't 2fa, and a lot of people seem to mix those up (not saying you do). Given realistic constraints, and possibly no real auth-token - I find encrypted-key+otp strikes a good balance between what can be achieved, and convenience.

Assuming the ssh key is used with a pass-phrase, it's hard to imagine any real scenario where the key is compromised, but not the password.

I suppose an unencrypted key might be lifted from compromised backups (but not passwords, assuming secure passwords, and secure hashing -- defeating even off-line brute-force). However, an encrypted key should be at least as secure (again assuming a "secure" pass-phrase).

OTP (especially on a separate device, such as a phone) has the benefit of not being compromised (permanently) by a keyboard-logger/root access on the terminal. On the other hand it is probably vulnerable to an attack on the device.

I also find it comparatively easy to manage one OTP secret per account, vs passwords, where they tend to end up becoming opaque tokens (ie: managed by a password manager -- and by extension, no longer "something you know", but rather "something you have"...).

One of the worst part of passwords, is that even if it is stored securely (salted, hashed, stretched) -- it is essentially a shared secret: the server has the opportunity to log it on every login/use. While a secret key can remain secret while you use it (as long as your terminal is secure).

I wonder if there's been any work towards asymmetric-key (T)OTP? I suppose it shouldn't be to hard, but I'm not aware of any established systems for it. Should be enough to use ECDH to derive a symmetric key, and then use that (or a derivative) with traditional TOTP.

Just found this[1] -- not sure if it's really relevant, though. Strange to find something like this with such a recent filing date on it, though.

http://www.google.com/patents/WO2014141263A1?cl=en
R is very acquired taste - or rather you struggle through until you can memorize all the gotchas. For people who are not doing doing data analysis as a full time and perhaps only job, remembering intricacies of R is going to be deal breaker. Personally I would shift towards Python unless there are exclusive packages in R that you have to have it - and that's becoming rarer by the dat. Combined with iPython Notebook and recent wave of migrations of packages to Python, I see little need to deal with R on regular basis.
It would be really interesting to revisit this question again!
Interesting. I don't think that would be possible - the technique shown here relies on a mirror to get interferometry between the two light paths. I can't see how interferometry would be available to soaring birds (between its two eyes, perhaps?). Although nature has come up with some very surprising and impressive inventions before, so I might be wrong.

I would guess they're just very good at spotting the conditions which lead to thermals.

EDIT: of course, you can directly see thermals via the shimmering / "mirage" effect. It's normally obscured by the background noise, but maybe soaring birds are attuned to that. That's much more plausible, but a different effect to that shown here.
Steam Machines: Avoiding 3DO's Destiny
Really interesting to see this coming from a digital agency / consultancy.

What I would really like to know, is how far along development of this thing really is at the moment. The "preorder" button leads to an IndieGogo page which mentions expected delivery in June 2015 and aside from a really well executed landing page with impressive videos and interface shots, there is little detail about the state of the project.
DrRacket is on par with IPython qtconsole and only slightly more limited than notebook nowadays.

Embedding images or graphs is very well supported as well as normal text; you can also easily save such sessions to a file too. Such a file does need DrRacket to be viewed, but other than that I'd say it's rather close to IPython Notebook.

Additionally DrRacket has a nice feature for displaying contracts and limited help/docstring for highlighted symbol, a bit of auto-completion (no context sensitivity unfortunately) and a feature for displaying where the identifier comes from with arrows, which is neat sometimes (to be fair it breaks down completely when working with many macros). There are also three killer features: macro stepper, debugger and futures visualizer (which lets you see sync points of your parallel computations to (hopefully) optimize them away).

Personally I switched to Emacs, because I deal with more than one Lisp on a regular basis and because I find DrRacket harder to customize (this may be just me being used to Emacs however). I still use DrRacket when working with graphs in Racket and it's very pleasant.

Anyway, DrRacket is very high quality basic IDE and I wish every language would come with something similar. It has its problems (performance, sometimes), but by the time you hit those you're probably already using something more advanced.
Sort of (ignoring that web browsers don't retry failed requests), if all you are serving is static/cacheable content.

Which excludes the vast majority of functionality of Google/Facebook, and most other major web properties.
Not sure I follow you. Angel investing may or may not make sense (for the average punter). But for those who do it sucessfully, it seems rare to take <fractional> percentages. Maybe you can give some worked examples using math? I've updated my comment to be more clear below:

As a general thought, you should only value [as part of your employment] cases of equity when [either, (a)] the company is [potentialy worth] $100MM + up in exit mode; or [b] your have more than <fractional> percentages [ie, granted stakes >1%].

In other words, unless you expect the stake to be worth a substantial six-figure sum. In order for this to be true, the equity stake needs to be in the upper six figure under some reasonable probability. So, a 600k stake with a 1/3 chance of you "winning" it is only worth $200K. Once you spread this out over the time to get it, it boils down to a number closer to say 50k/year for 4 years.

Now, that is a nice bump in salary. But in order to get this in a realistic sense with a 0.6% stake, you need a 1 in 3 chance of exiting out of a $100 million dollar company.

Since a 1/3 chance of a 100 million exit is unrealistic for an average portfolio company, you need to correct the math a bit more. Since a 1/10 chance is a more likly number, lets divide our $50k/ye by 3, and we get something in the $15 to $20K range per year.

In other words, we get a number which is about a 10-12% boost on a $150K base salary. This is nice, but not worth taking larger paycut/mispricing for. So using this back of the envelope framework, small fraction percentages of ownership don't as a rule compensate for salary mispricing, when that mis-pricing is order of magnitude 10% or greater. Which just brings us back to the initial point but hopefully with more clarity.
Managed to find it here: https://mediacosmos.rice.edu/app/plugin/embed.aspx?ID=vVUTzF...
Lemon Law
Lots of lawyers might not charge any lawyer’s fees from you, fight the case on your behalf, and take their fee from the manufacturer.
Find us on calemonlawinfo.com
I have a colleague at work who plays blindfold chess with his nine year old son on road trips. Well, it's not actually blindfold chess, neither of them are wearing blind folds - they just are able to play games without a board, which, if you think about it, is pretty amazing.
Not only does JITting normally only occur once (something that microbenchmarks take into consideration by "warming up" the method), but if it does occur an Nth time it's because the runtime has acquired profiling information to do a more intelligent optimization pass on the method: far exceeding the quality of assumptions/heuristics made during the first JIT pass. As far as I know Hotspot implements PGO JITting.

Static compilers can do profile guided optimization, but this only takes into account the static scenario that you profiled - not the real world scenario that the program is encountering. Your PGO is only as good as your profile.

In theory, not only is your statement untrue - but reality can turn out to be the exact opposite.
My boys love 1986 computing
Yes, the responsibility here lies squarely with the distros that set LESSOPEN and LESSCLOSE.
You need to consider how much of your app needs to be realtime.

Do likes, comments, whatever absolutely need to be updated in realtime? If they do, you should consider going with a full realtime service. If not, i would go with a backend that you feel comfortable with and build realtime where you need it.

I'm building a Ionic (AngularJS) based mobile-app aswell and went with Firebase for full realtime, but in hindsight i would probably have had a better go with using a RDBMS on the backend (which i'm way more comfortable with) and used Socket.io or similar for the parts that really needed realtime.
Or it could be Google, Microsoft, Apple, Amazon...

Any big tech company investing in industrial espionage. It's not as if they don't have the development staff.
MeteorJS sounds like a all-in-one package that'll give everything you need, rather than having to mix and match components by yourself. I have not used MeteorJS. I have been building AngularJS apps for almost a year - when I started MeteorJS was nowhere ready.
I've tried a few and as far as I can tell they're all pretty good but not quite there.
You're right about the 10 hard drives : if you've bought them identically at the same time, it's likely they all gonna fail in a short time span. I've recently heard about the "3,2,1" rule concerning backup :

- 3 images of your data (1 original + 2 copies).
- 2 types of media (e.g. extHD and DVD)
- 1 offshore location (e.g. bank vault, your parents' house,etc.)

Of course it's not a golden rule, but it can prevent catastrophic failures.
Single phone vendor tech is a bit 2012-style. Time to catch up.
Prisoners / Tutsak
I applied all your advice. This is awesome! I can't thank you enough!

Really, thank you for the time you took for me!
My god... the comments. Looks like the reddit culture (i.e. fun for in jokes but not particularly professional)
They're an anonymising frontend to bing with a number of extra search utilities.
You could do:

var exists = ~someStringOrArray.indexOf(searchTerm);
if(exists){...}

or

// If exists do...
if(~someStringOrArray.indexOf(searchTerm))
Visual Studio Community – More or Less Visual Studio Professional for Free
Given that many soaring birds have fantastic eyes to find prey or carrion, they might be able to see it.
Lack of PCL support makes it's applicability quite limited in today's multi-platform world. Hope they will fix this flaw before releasing.

Awesome project nevertheless.
تحميل برنامج جوم بلاير
I ran a test using x264 and x265 just about a month ago. The x265 encoding took about twice as long, and was half the bitrate for the same constant quality setting.

However, since all my playback devices (Fire TV w/ XBMC) rely on H264 hardware decoding, I have to stick with x264.
The State of Android Hardware Companion Apps
Well, you have certainly proven that one must take anything on Wikipedia with a grain of salt. Kudos.

However the point that medieval gives the false impression that Al-Kāshī was a European astronomer still stands but unlike what you suggested before; changing the title, I hope this changed the impression.
> As for ios, if you don't believe that users would click "yes" to whatever dialogue was required to make an app run, you simply don't interact with users. Allowing users to opt-out defeats the purpose.

It does not require "Click here to get owned" level of work around. I'm perfectly fine with needing to boot into the equivalent of single user mode and entering some security key. But if I want to break the security model on a device I own I should be able to.

> Why is it ok on mac? Because many computer users are still dependent on non-appstore distributed software. Particularly developers. Nobody has evolved that dependency on ios, so it's not necessary.

That is circular reasoning. The "dependency" doesn't exist on iOS because Apple tries very hard to prevent non-appstore distribution being a viable avenue for app developers.
Let the language wars commence!

In reality, there is nothing wrong with C++, particularly not modern C++ (since c++11) as the approaches laid out in Stroustrup's book discourage writing C++ in the old-fashioned "let's throw pointers around!" approach.

As with ANY language, if you write it badly, bad things will happen. The language choice doesn't mean bug-free code.
I think most of the SSE slowness is because the weird static vec::add that uses pass by value, try changing that to pass by reference.
> People shriek because Apple isn't giving the device owner any option to get around the security if they want to.

You are misinformed. Right click -> Open instead of double click overrides my current signing requirements and executes the app anyway.
It's not 'disrupt' as in actually disrupt, you have to translate from the Silicon Valley speak:

https://github.com/richardharrington/disrupt-to-bullshit
Haha, but what kind of cars do Lyft use? I really like the Uber cars here in Sweden, mostly BMW and Mercedes.
Docker Code Walkthrough – What Happens During a Docker Run?