skysight-inc/HackerNews huggingface dataset:
I was under the impression that git hashes are generated based on the contents in a commit. If that's true you cannot retire them. They're not random.
>It will remain slower than x264 though, it uses more cpu consuming algorithms in order to cram out more 'quality per bit'

At an abstract level, HEVC is AVC + refinement + new algorithms.

Conforming bitstreams aren't required to use all or even most features, so in the long-term, I don't see why an HEVC encoder can't be a simple, straightforward superset of x264 (i.e. same speed for same quality).
This exploit seems to require a <script> tag.

But if you let your users insert a <script> tag into any text field, this exploit is the least of your worries. Why encode your attack into a GIF file when you can just open a <script> tag and attack away in the comfort of a WYSIWIG editor?

A more interesting attack vector is the static HTML file that the attacker used as a vehicle for his <script> tag. If your users can upload an HTML file, or any other file that the browser might display as an HTML document (IE loves to guess the content type), you are vulnerable to XSS, no matter how thoroughly you filter all the other form fields.

One of the easiest ways to mitigate this vulnerability is to force browsers to download/save all user-uploaded files instead of displaying them. Configure your file server to add a Content-Disposition: attachment; header to all user-uploaded files.
Given that the only way to reuse it is to duplicate the tree and commit metadata exactly, or find an sha1 collision, I think it's pretty safe. :)

I wonder if there are any git sha1 collisions out there in aggregate, say across all of github. Would they even notice if there were?
When I tried to run Plan 9 in a VM I gave up because I couldn't figure out how to open a shell in the window manager and type ls. I also couldn't figure out how to use the text editor (why can't editors be simple enough so you can just type?) If Plan 9 booted in text/terminal mode I'd use it.

Does anyone know if you can boot Plan 9 in text mode?

However well-designed the OS is internally, it also needs to be approachable externally.
There are some very impressive things created in Minecraft. This one of them: Westeros (Game of Thrones) built in Minecraft. Simply amazing, I bought the game just to check it out:

http://www.westeroscraft.com/
Absolutely. The financial system is interlinked. If MS, AIG, Citi, etc. would have gone down then GS wouldn't have survived.
Doesn't anyone on HN play feed the beast modded minecraft?
I was saying that as a developer that has experience doing design.

For example, a lot of people in fashion and design are able to tell what colours go together without analysing tables or systems of complementary colours. I'm really not making this up - most great creative people understood a lot of this instinctively (and a lot of it is a lot harder to systematise than colour theories, for example.)
I never knew it wasn't called Where's Waldo originally. I agree, this would be an intense WW search. I wonder if he's already in there hiding?
Everyone I know uses the + operator, I rarely see others. Funny that I'm not seeing + here.
> iPhone supports IMAP just fine, so that is not much effort :).

What about password resets? Two factor auth? It's not just the email that's hard!
> Why are we just hearing about it now?

Once malware is identified properly antivirus firms will usually go through their detection archives and pull out earlier hits.

The reason why they don't see them sooner is because they get tends to hundreds of thousands of new threats each week and don't have time to go through each one.

Mikko from F-Secure also reported on Twitter that they found Regin[0]. The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats.

As for your general suspicions, this is endemic with infosec since there is a natural conflict of interest where those doing the research and reporting on it are also selling solutions.

If it makes you feel any less suspicious, the research departments within these antivirus firms are generally isolated from parts of the companies involved in sales and marketing. They are usually small teams that just go out and publish information on cool things they find - although there is often a race to be the first to dissect and publish the details of new malware (which is why you wouldn't sit on knowledge of a new threat).

[0] https://twitter.com/mikko/status/536624310035939328
Thanks for the mention of our Epic Privacy Browser (fast, secure & private). This looks like an interesting project as well, very ambitious. Java is an interesting choice (I've found it a pain to work in). You should post the names/bios of everyone involved in the project -- I guess it's coming soon.
1) can always use environments! :)

Okay, I'll stop at 1).

Having used R for over 15 years now, the one "feature" which still makes me shake my head is the partial evaluation of function arguments. If function foo has an argument 'blah' and you say foo(bl=5), it'll autocomplete that to 'blah' if there's nothing better to use.

The number of bugs I've found due to that ....
Regin: malware spying since 2008, likely built by government
I found Udacity's course on Software Testing (by John Regehr) to have a decent coverage of fuzz testing. For those interested, here's the course notes on that section ...

https://www.udacity.com/wiki/cs258/unit-3
Drone Flights Face FAA Hit - Would Require Pilot License
Only tangentially related but hey:

There is an interesting trick that was common for a time and still gets referenced by magicians where even the worst chess player can guarantee that they will win at least half of n chess games where n is any even number. They will also be able to appear to need very little time when they get to each table.

The trick of course is just to play each player against another. The magician acts as a proxy and makes the moves of one player against another. Of course it takes a little practice at memorisation but magicians are often practised at mnemonics anyway.
The thing w/ reproducible research (I was an early BioC core member and have worked directly w/ its RR advocates) is that it requires having an exact set of R and packages. I know that BioC tries to do this (I wrote the original BioC package download script) but weird things can still happen. A few years ago I was tracing down a bug in some computational biologist's code that really traced down to some wacky version of a particular package which might be downloaded in the right circumstances.

In a previous life what we did was for every project you'd download a snapshot of an R environment, including all packages. That, and only that, was used for all computation for everything involving that project from start to finish. If Docker was around at the time, that's what we'd have used.
The Tech Industry's Other Bubble
> probably cryptographic incompetence

and it's been undetected for 7 years, so what does that tell you?
My very casually informed take was that it looked like a map of laundering money from oil producers to islamists.
http://paulbuchheit.blogspot.ca/2009/10/applied-philosophy-a...

This is good too by Paul Buchheit.
Extend and amplify your coffee
> One of the many strengths of computer chess programs is that they are virtually guaranteed never to make such mistakes

Sometimes, though, you WANT computers to make mistakes. For instance, when a mere mortal wants to play a game of chess with a computer.

It's no fun to get repeatedly crushed, so chess computer developers try to provide a way to set the playing strength of the computer.

So far, this has generally not been satisfactory. Here's how games often go when you are not a grandmaster and you set a computer to play at your level. It starts out totally kicking your ass. Then it makes a completely idiotic move that even a beginner can see is bad, turning the game around so you are theoretically winning. Then it plays perfectly for a while, brutally punishing every mistake you make, and it ends up winning again. Then it makes another idiotic move, and so on.

It's kind of funny. We've basically solved the problem of how to make a computer play like a person with a 3100 rating, but how to make a computer play like a 1500 is still largely unsolved.
"Superfluous" is not the same as "not necessary in practice" in this case. There are many websites that use JavaScript for polyfills, browser detection, screen detection, and scroll detection. In some cases there are alternatives, but that doesn't mean those alternatives are ubiquitous.
As a programmer, I can enthusiastically endorse this book. R "as a language" is hard to grok when you come to it with the mentality of "a programmer" due to it's history as an interactive environment for data analysis, and an interface to algorithms first, and a programming environment second.

Hadley's book is a solid introduction when you are trying to map concepts from other, more traditional, programming environments to the R way of thinking.
More likely just plain mozzarella. In most restaurants, you're likely getting a factory pre-made frozen and reheated product from a box - certainly that was the case at the chain pizza place I worked at in highschool. "Stuffed crust" pizza was made with string cheese (at least at the time), though. I've seen blocks of mozzarella chopped up at a fair to fry, but no idea whether that's what everyone does. The "stringiness" of melted mozzarella (as on a pizza or in a fried stick) actually mostly depends on the freshness, or so I've been told.
Is there a reason there aren't any braces around single-line if statements? Is that a C thing? It seems kind of inviting to bugs to me.
This is a very interesting piece to read. The amazing thing to me is how smart people can look at the same evidence and come to very different conclusions. To get the feel of this piece, you really need to read it along with the comments.

The author of the piece is a very talented statistician, with a PhD in Mathematical Statistics (I hesitate to think of what other kind of statistics someone might study?), a Masters in Atmospheric physics, and a BA in Meteorology. Without question, he is very extremely well qualified on paper to make write the post he did: http://wmbriggs.com/blog/?page_id=1085

The main critical commentator is David Appell. He's a freelance writer who's been concentrating and reporting on global warming issues for many years. He's got a PhD, Masters, and BA in Physics, has interviewed most of the main scientists in the field multiple times, and understands the issues as well as or better than anyone else writing about it in the mainstream press: http://davidappell.com/

And it appears that the two completely disagree about practically every line in the article!

Without doubting the credentials or understanding of either, I can't shake the feeling that one is following the data wherever it leads, and the other could rationalize any result under the sun and not be knocked off a single one of his talking points. And I'm sure that others can read the piece and the comments and have exactly the opposite reaction.

What is it about their prose that can produce generate in me this amount of certainty and trust? Somehow, one is able to signal to me that they share my worldview, and thus I'm willing the trust them on the details I'm unfamiliar with. The other loses my trust within the first paragraph. At some level I know that neither of these responses can be fully trusted, and yet I can't shake the feeling that one can be trusted and the other cannot. How can this be?
This was a dup of another story from the same day [0]

[0] https://news.ycombinator.com/item?id=8581865
Derren Brown pulled this off but with 9 boards, scoring 4W 3L 2D. The strongest players he played "against" each other and was able to beat the weakest (relatively speaking) player there. Quite impressive.

https://www.youtube.com/watch?v=evZmpsl3jI0
I'd say ssh keys generally don't have 2fa.

A passphrase doesn't really turn a ssh-key into 2fa. It's still really only "something you have (access to)": the plaintext of the private half of the key. Granted, you can use ssh-keys with tokens -- my recommendation is to use encrypted ssh-keys paired with a recent[1] openssh server that allows stacking OTP on top, for 2fa with the RequiredAuthentication-directive (well, OTP is generally code for: can demonstrate access to OTP secret) -- but at least it is rather easy to store the two on separate devices (say a phone, and on the filesystem of your workstation/laptop). Not really maximum security, but quite a lot better than traditional passwords.

Until you store both the key and the authenticator on your phone, in order to use ssh from your phone. At which point you end up with "rather convoluted 1fa" -- which might still be marginally better than traditional passwords (along with a warm fuzzy feeling of false security :-).

Other than that I've been looking into using openssh certificates with openssh, but it still looks like it's rather complicated -- and for a single-/few-user setup it's questionable if the expiration etc really adds much actual security.

Maybe the best would be to apply some of the kerberos design lessons to openssh with certificates, issuing short-lived certs much like kerberos ticket-granting tickets (so have an easy way to get a user certificate that's valid for 8 hours or so...). Not sure the added complexity would be worth it, though...

[1] https://blog.flameeyes.eu/2013/03/openssh-6-2-adds-support-f...
For non-subscribers: https://www.google.com/search?q=Drone+Flights+Face+FAA+Hit
Within this instrument, resides the Universe
Not even this caused Americans to start using bidets. The thought of using toilet paper to wipe one's behind is savage.
It wasn't even going into today's game - Carlsen had been one point ahead since game 6. That's why Anand rolled the dice with that risky exchange sacrifice - with only 2 games left, he was running out of time to catch up.
71% of the Earth's surface is covered by oceans so it would only make sense to make launch and land platforms on the oceans. Not only for the space but for the safety; if a launch needs to be aborted, or has a catastrophic failure (see; explosion) the harmful debris won't come raining down on the population.

That's why the U.S. launch sites are located on the coasts: Wallops Island, Cape Canaveral, and Vandenberg AFB. They all launch vehicles away from CONUS.
It's a C-style language syntax option. If it's only a single line in after the if, the braces are optional. I've also seen it in C++ and PHP.

Whether or not it's sloppy is up for debate and just a matter of personal preference.
Love the idea. I wonder if it makes people dance on the edge of the of the sidewalk!

What would happen if two people went into the box?
i really don't see how you're getting that impression. We've seen cooperation on shared menus, mime types, dbus, and wayland (among others).
Here is a world I've been running for 2.5 years. Spawn has been moved several times, so the world spans tens of thousands of blocks. If you look carefully you can find large settlements from continent to continent, http://treestop.com:8123
So as to have more code on the page. It's official style of the Linux kernel [1].

[1]: https://www.kernel.org/doc/Documentation/CodingStyle
EDIT: I found it interesting that 9vx seems to have been last published in 2008 according to the website and the mercurial repository 404s

Lot's of Plan 9 discussion lately!

* Why Plan 9 is not dead yet and what we can learn from it (2005) [pdf] [0]

* Designing Plan 9 (1990) [1]

* Glendix: Bringing the Beauty of Plan9 to Linux [2]

[0] https://news.ycombinator.com/item?id=8649534

[1] https://news.ycombinator.com/item?id=8646860

[2] https://news.ycombinator.com/item?id=8581865
Can you give an example of the a somewhat complicated vectorized command in R that would require lots of list comps in Python?
Help Stop the World's Largest Animal Sacrifice
Really cool. I wish the team behind this would publish an article on the making of. I'd love to know how they built this. Especially for legality and such? I doubt government would go "yeah sure, replace the safety signs designed to keep people safe with your project". Does anyone have any ideas on how they did this?
I think this is a quote from Mark Cuban, but

"You can read all the literature on basketball, but you'll never get any good if you don't shoot any hoops"
The same thing happen with Stuxnet, and just about every other malware - it is why these firms will keep and check the archives of new detected threats.

My favorite is how Stuxnet was discovered just after Win2000 ended support.

So what made Symantec, McAfee, etc so horrible BTW?
Say there's a failure that forces you to bail into an emergency session where you can't mount /usr/local (which is where bash is typically installed on FreeBSD). All of a sudden, you don't have a shell.

This is a really bad place to be.
indexOf will only return -1, 0, or a positive integer
Game 6 was the turning point of the match. Carlsen made a horrific blunder, and if Anand had noticed it, he very likely would have won and taken a 1-game lead in the match. Instead he lost, giving Carlsen a 1-game lead.

http://en.chessbase.com/post/sochi-g6-carlsen-won-anand-miss...
This is a cool concept, but the real world is simply not as fun as a well designed game map.
In the C grammar, braces denote compound statements. Control flow statements can take any type of statement as their body rather than just the compound variety.
> It is a common mistake to misuse an OO type system this way.

So common, I would argue, that it suggests there is a fundamental problem or question of utility with using type systems for correctness. You're right that this has nothing to do with a _static_ type system specifically but they're almost always used together that when you say "static" you are almost always heard as "statically typed", so the point is moot in my experience.
I know this sounds harsh, but you seem to lack self control which I can emphatize with. After all, I've spent nights where "one more thing" has kept me up till early in the morning.

I don't have the end all be all advice on the topic, but you might just need some people looking out for you. If you choose to play, play on a small server where you know people, and people know that you are struggling to pace yourself. If you're feeling guilty about playing, don't. Building huge structures you aren't proud of doesn't do you any good. If you're playing compulsively, but you're not enjoying it, it might help to shut it out entirely. Deinstall your client, give your account to a friend, block imgur, reddit and facebook, and forget they ever existed.

Sometimes that doesn't solve your problem though, it only creates a void in your life. Empty time is horrid, and we try to fill it up no matter what. Unless you make a conscious effort to fill that void with things you do enjoy, you'll just end up filling it with whatever is convenient. If you don't know what those things are, you might need to do some testing and sampling. Maybe it's contemporary dance or building miniature railways or helping people learn to code that you'll stumble across and start to really enjoy.

Also, if you, in the process of doing that, stumble across something you absolutely love, but tell yourself that it isn't productive or important, you've got problems with who you think you should be. You might be telling yourself you'll be happy if you're the guy in the 10,000$ suit sitting in his blacked out tesla, whilst you just stumbled over the fact you might be happier if you're the guy that's sitting in his basement watching tiny trains go on laps.

If you think that that will make your parents or friends or whoever you care about think of you less, what business do they have of deciding what makes you happy? They shouldn't have a stake in whether you're gay or straight, who you fall in love with, whether you want children or not, and certainly not in whether you get to lead a fulfilled life or not.

Anyways, I'm just drawing this from similar struggles I've been having, and maybe some of these points will help you crack out of whatever problem you're having. Honestly, I can't either say that I have implemented everything I'm preaching here, but it seems like a step in the right direction for me.
Almost more importantly in this case, it's less characters adding to the bytecount.
Wikimedia Commons: Free Media Resources/Photography
It's pointless to argue over these kind of things. Every major project/company has their own codified code style guide, and if you want to contribute/earn your salary then you must follow that style guide to the T. Here's the relevant quote from the Linux kernel coding style[0]:

Do not unnecessarily use braces where a single statement will do.

if (condition)
action();

[0] https://www.kernel.org/doc/Documentation/CodingStyle
This is a pretty neat survey on the gulf between theory and practice, which is basically where practical cryptographic attacks live.

For example, RSA is based on the integer factoring problem, but they are not equivalent. Vanilla RSA does not offer what they call "chosen-ciphertext security"; in fact, a careful plaintext padding scheme† is needed to approximate this property.

PKCS#1v1.5 padding is not that scheme††: it formats the plaintext with a fixed leading byte (or two). This puts implementers in a tricky spot - what do you do if you decrypt a message and the prefix is wrong? If your answer was "throw an error", then congratulations! You've completely compromised the security of RSA.

They reference this attack briefly on page two of the linked article; grep for "Bleichenbacher". For more information, you can find Bleichenbacher's description of his padding oracle attack on PKCS#1 here: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.19..... I'll go further and say that implementing this attack is fun and enlightening - it's well worth your time.

† The scheme I'm alluding to is OAEP, but even it has implementation pitfalls that can sometimes be exploited.

†† But it is (bafflingly) the default padding scheme in every RSA library I can think of.
Yup, as anyone who has ever run a program that accesses files over NFS knows it all sounds very wonderful on paper and absolutely sucks in real life.
Supply, demand, and CS teachers
>I wonder if there are any git sha1 collisions out there in aggregate, say across all of github.

Despite the incredibly high number of all commits there must be, I think the chance of a collision is still very unlikely. 2^160 is a pretty big number.
Intel is hitting the wall on Moore's Law
>On the other hand, by including the tilde, you ensure two things: 1.) Future developer knows what it does and has no problems

The premises was that the future dev won't know.
It was hard to write, it should be hard to read moderately applies, I guess.
Just watched that and came away a bit confused. I'm not a minecraft player, but I understand what it is and have seen videos of people playing. I guess my question is, in the case of this, did someone go around a build that whole world just to mess with players or is it the work of a lot of different people who want to make a difficult world?

I suppose I just don't get what they are going for.
Exactly my point. This continuing misuse is VERY common even among experienced developers. The ongoing argument itself is a counterargument for type systems as being useful for correctness. At least it should give you some pause?