skysight-inc/HackerNews huggingface dataset:
My experience is that the Avast installation process will install its Trusted Root certificate if the "web scanning" option is enabled (which is the default) during installation. Even if Avast browser extensions are disallowed, and even if the web scanning feature is later turned off, the Trusted Root Certificate will still be there and will still be utilized.

As noted in the comments of the accepted answer on SE, this is not necessarily a security problem as long as the certificate is unique on each PC. But to me, in order for this whole Antivirus-MITM scheme to be secure, the AV vendor has to get a lot of things right. If the certificate generation during AV installation is flawed (say, with a weak RNG), then it could easily be exploited to perform MITM on anyone with the flawed certificate in their trusted root store.
Texas Hold'em Hand Strength, Visualized
Don't get too excited, global Youtube audience!
This is US only.
Yes, and although I won't say to always trust that "feeling you get".. there is a feeling that you get when you organically come to that realization and it's very different from sitting in a brainstorming session and thinking of 20 ideas in a row. Can't replace first-hand experience in a space.
Greece's Debt Due: What Greece Owes When
No. Dynamic types are not tags. They're types, regardless of what static type zealots insist.
The article links the article where the authors suggest they don't need to know which tower you're connected to (in which case you could get a more accurate location from the towers themselves).They assume the only information you have from the phone is the power usage. However, they also assume the attackers have a general idea of your habits, and can therefore map out cell reception in the city where you live.

The "general habits" assumption seems implausible, but it isn't. Let's say you want to track all the citizens of the Bay Area. You know that, in general, ppl from the Bay area are in the Bay Area. Therefore, you map the cell reception in Bay area. You also take note of major transportation routes and patterns. Now, if you want to track a particular target, all you'll need is their power usage.
Burning Man and TicketFly disagree, hence why they're revoking tickets.
Sony Profits and Loss by Division
Don't feel bad. At least you're using their code which validates them open-sourcing it.

There is plenty that anyone can do to help. Probably the easiest is to update documentation and fix any spelling mistakes. Those are typically easy for maintainers to merge in. Other things I've contributed were bug fixes, smaller feature enhancements.

I'd focus on small to mid-size projects since they are always looking for contributors. With more mature projects like Rails, Zend, Linux there may be a higher bar to get your merges integrated and therefore it can take longer for your PR to get merged in (I believe my PR to enhance an exception message in Zend took about a month including adding a new test and signing their license) That's definitely on the longer side. The nice part about those projects is that the devs there will offer guidance on what you need to do and you'll pick up on some best practices
But surely at least the commenters of HN can see that the country you are born in is pure chance? And it's really important to remember that when thinking about whether workers from one country or another should be able to work for someone else in another country.
> We know what we're doing now

Yeh. We. Now.

Post-collapse? No, they won't. If everything was intact (including unwritten, institutional knowledge), then there won't have been a collapse in the first place.
"Youth is such a wonderful time of
life. Too bad it's wasted on young people."

Commonly attributed to Mark Twain
Isn't the assumption that "the noise of playing music,social media, etc" is not correlated with the phone's location, pretty weak? I know I have distinct patterns of when I scroll up twitter or listen to music, which depend on where I am..
The 10 cars most likely to kill you
What do you expect from a method that is based on visible results for short term iterations (a.k.a. sprints)?
Well, MS contributes to Samba

http://www.zdnet.com/article/microsoft-contributes-open-sour...

MS seems to have a financial incentive in having, at least, the file sharing part of samba working. Its probably too important to ignore, and at the time, samba was how OSX talked to Windows. I imagine making Samba work was also a move to keep OSX server from becoming an enterprise competitor.

Also, I think research and netsec departments in large companies have their own priorities. Why is google finding MS vulnerabilities? I imagine a lot of this is whatever scratches the researcher's itch.
Why you should take a look at Ember (again)
Молодец!

Here's the app, in case anyone was interested:
https://itunes.apple.com/en/app/kurs-valut/id831528898?mt=8
Why men vs. women decide to go to college: intellectual curiosity,money,marriage
How airborne Wi-Fi works
They offhandedly mention pneumatic control (look for "beeks" on the indiegogo page). Think milking pipeline, but for honey.
It sounds like, from your description, that if your system clock was running fast that would have also exposed the purchase button early. Can you tell if that's the case by looking at the source? If so, sounds like you have plausible deniability.
All the ways America has chosen to execute people since 1776
Yes it's a pitty, Apache and mod SPDY is really a pain currently.
By whose definition? So if a site has elements on a page they do not want to be immediately seen their only choice is to not distribute the content? So if your circumventing a script that is not the same as circumventing a program?

I look at this way, if it does not occur to the common user to do so then it is "hacking". Not in any nefarious/sinister sense but the term still should apply.
My 3 year old son loves these videos as well (especially the toy car unboxing videos on Youtube). I'm glad someone linked to an article about it. It seems really odd to me that he loves them, but he finally seems to be over them after a 4 month stint of always seeking them out, trying to spell out the words to find them, etc

Cant believe some of these toy unboxing videos have +70 million views, insane
YouTube Kids
Capital Gains: Uber Raises $2.8B
> And that's why you never put that kind of logic on the front-end.

I wonder what kinds of goodies all these front end frameworks will lead to, when they eventually fall into the hands of people who don't understand that the final arbiter of some things must be on the back end.
Did you mean, "... the attraction between the Moon and a 1kg object ...?"
Ignoring cost, and assuming I already know what I want, I would much rather be able to do all my ordering by texting or calling a real person. Even the best, most streamlined ordering UIs are clunky and time consuming compared with "I want a cheese pizza from Johnnie's"

I think what you, and the parent article, are responding to is that it's really hard to actually have an always on-call, fast-acting butler at your service.
Etsy CEO says that net neutrality shaped his life
There is a proposal for such a standard for json document APIs: https://tools.ietf.org/html/rfc6902

I'm not sure where this stands in the standards track.
> e.g. Systemd will own port 80, and feed it back to Apache who listens over 8080.

No, Apache actually listens to port 80, just on a socket created by systemd. systemd opens the TCP listening socket, spawns Apache (potentially on demand when connected to), and passes along the file descriptor for the socket. Apache then treats that file descriptor as though it had opened it itself. Similar to inetd, except that it isn't limited to stdio.

That said, since netstat -p shows who opened the socket rather than who is using the socket, socket activation does make it less useful. Given that netstat -p already reads all the necessary information from /proc, it'd be nice to teach netstat to show multiple programs listening on a socket, not just the opener.
So, if I understand correctly you've the top biz category app and it's just generating ~100$ daily in ads? Seems a bit low actually :(

ps: would love some support for multiple data-sources per currency: for instance in Argentina we've official dollars but since they're impossible to get we also have sidemarket "blue" dollars...
These charts are so tiny I can't read most of them. I don't see a way to zoom in either.

Edit: If I resize my browser window and then reload the page, images are larger. This is annoying.
> Dropping into the queue early is when it got shady

My suggestion? Don't put your queue in my computer.
How To: Installing OpenCV and Python on Your Raspberry Pi 2 and B+
If it is true that people visiting with Noscript or javascript disabled would see the button immediately then it is a design flaw of the ticketing system, not hacking.
At least they should've used javascript to generate the link and show it as opposed to hiding it on page load.
Arq Backs Up to Your Dropbox Account
The concept looks a lot like my site: https://jobety.com. The difference being that Jobety is also for fulltime / onsite positions.
I dont see them building a search engine persay, but improving the capabilities of Siri. Which essentially is AI with machine learning and then a motherload of data mining behind the scenes.
I would "just say no".

Password sharing is the road to hell because it is too easy to lose control.
same experince here also playdo mini burgers & fries and other weirdnes.

https://www.youtube.com/watch?v=LazzJtxNz4c
Still Viral After All These Years:
It might be possible to automate it! Google keeps posting these incredible recognition results. Perhaps they can apply it to the video/audio looking for items it has trained it to be inappropriate?
Sslucky
I'm sure it is true. See Bridgeman Art Library v. Corel Corp .

Yes, there is a real-world effect. As I mentioned and jeffmould wrote, I can use those part of ProjectB which came from ProjectA without being subject to the teamhappy license of ProjectB. It's not a question of dual licenses, it's one of license compatibility.

If I am IBM, and SCO sues me because my distribution of the Linux kernel contains code which is part of Unix, whose copyright is controlled by SCO, and without an SCO license, then a valid response is to point out to SCO (and the court) that that shared code was released into the public domain by AT&T. Even if some Linux kernel developer actually did copy the code from SCO Unix (very unlikely!), there is no new copyright claim by SCO for "slavish" copying.
First, did Lenovo commission the writing of Superfish,
or did Superfish approach Lenovo (or most likely their marketing dept)
with a request to be included?

Lenovo can go sue Superfish all they want to coverup their expenses. Let the court figure out who cheated whom in a three way lawsuit.
Ok, so what are the neuroscientifically, biologically plausible models of how learning and reasoning happen in the brain?
Had he not attempted to sign up at the same time he was going to order the burrito it would have been much less time.
Do I really need to be able to update the Cart? Sure, but what do I need to update? Because I need to be able to add new items to it. However, that should be under the Item resource surely? Great! Now we can get rid of that too.

My first thought was that POSTing to the cart (or the user) is the most obvious way to add items? But then I thought maybe you just PUT to /api/cart/item_number? That would be cool.
Would there be huge problems caused by requiring something like a $10 (actual cash) minimum to settle on behalf of the class? Or something other modest amount, I'm not stuck on $10.

The problem I see is that the class lawyers and lead plaintiff have an incentive to settle regardless of the benefit to the rest of the class. I think I've actually gotten checks for less than $1.

I guess an easy one is that sometimes the harm comes from a service and scales based on how much the service was used, so some members might get a substantial claim at the same time others get $0.50. But those people probably aren't going to pursue anything, so I'm not sure how troublesome they are.
Introduction to Facebook's Flux architecture
How would it not work if there are competitors? Why would businesses be buying ads from the same space if there is no profit? If it didn't work, then there would be no competitors, and then it would work, based on your reasoning, since there is no competition.
I enjoy cloud9

https://c9.io/
Personally I'm not too fond of Xamarin Studio. I really hope Scrawl will be a good alternative for writing C#.
I think the court case will answer all of these questions for you. Whether Lenovo is guilty or innocent here, it'd be great to establish a precedent to protect consumers from this type of thing.
For some contrast, a first-time user could fire up the Domino's app and have a pizza delivered at the regular cost (+ tip and regular delivery charge) in 30 minutes.
Do they just keep your CC # on file?
> In REST parlance, a user isn't a resource.

this is not necessarily true. if you're managing users, then they are resources like anything else. but users can also act as contexts for operations and access, including auth/prmissions, audit/logging.

when the user is acting as a context, it should be implicit and stored in a session, with an initialized token after login.
What does this offer that tcpdump doesn't?
Marijuana may be even safer than previously thought, researchers say
Reminds me of a few free file hosts (probably now long dead) that would do the countdown thing client-side, with the direct link to download the file right there in the source code.
Post-mortem: why did RiderState fail?
[[Just for the record, I didn't downvote you.] This is off topic, but I have read recently a few similar complains from another users.

Each community has it use and customs. Here most of the people don't comment unless they have something very interesting to say or to ask. So if the article doesn't have an obvious flaw and is not polemic, you may see that it has a lot of upvotes and no comments.

Also, try to avoid oneliners. It's very difficult to write good onliners and they will probably be downvoted. Explain the same idea with more words. [There is an "exception" for congratulations in post in acquisitions, marrying announcement of well known users and similar and similar happy occasions.]]
Where's the source code? Creating a closed-source cryptosystem is generally a bad idea.

https://en.wikipedia.org/wiki/Kerckhoffs%27s_principle

> You may not distribute or redistribute this software without permission.

This is a turn-off. MIT/BSD/GPL/WTFPL licensing is more likely to gain rapport with hackers than non-free software.

> The keyfile is secured by a password using PKCS #5 (PBKDF2) with a SHA512/Whirlpool based HMAC using 100000 iterations and also AES and Twofish.

This sentence makes me greatly question the implementation of this system and now I really want to see the source code before I even think of trusting it for any reason. PBKDF2 is generally performed with ONE hash function and doesn't require block ciphers at all.
I generally try to meet at a bank where I'm a customer when I have sold big things on craigslist. i.e. here's what I'm giving you, you give me the money, you wait until I deposit money in my account.
Aldebaran Robotics Founder and CEO Steps Down, SoftBank Appoints New Leader
You're just not the target market. I'm not either, but despite that I can easily see that their target market does actually exist.
US HACKING CASE
How I Wrote an Ultra-Fast DNA Sequence Alignment Algorithm in JavaScript
Isn't passing the session token in the query string insecure?

The payload of the requests will be encrypted (assuming HTTPS), but the urls are not. So I think you're opening the door to session hijacking in this way.

edit: I was wrong about this. The URL will be confidential in transit. Thanks for setting me straight.

I still think it is not a great design, but for different reasons: the url will be visible in your browser history and on the server side in the logs.
That sounds like poor engineering in general - why would you trust the client on time sensitive issues? I'm predominantly a frontend engineer, but I make sure to understand the role of the technology I use and the responsibilities that need to be addressed by other sectors.
The question is that, should DNS nameserver at registrar still work for over a month after the domain passed its expiry date ? According to my experiences in past 15+ years, registrar changed DNS nameserver for expired domains, which causes the web/email service of expired domain unavailable.
Percentage is a lie
I've been looking for a good truecrypt replacement, but this unfortunately isn't it (yet at least).

1) Closed source. I can't take security software seriously without the source code.

2) Windows only. Ditto for the above

3) There's no point in encrypting a folder with N files to result in N encrypted files. It's always more cryptographically sane to create a large block of data (as truecrypt did) rather than reveal information about how many inputs there were and allow people to correlate them.

Those three issues mean I won't be using this (especially the open source bit).
Would you like to team up and build something? I have some ideas that can help build better algorithms. curran736 at gmail.com
Ouch indeed.

What's the difference between the VM module in Node.js and in io.js? JSDom says VM is "newly-overhauled" in io.js, but I looked at the documentation and (from a quick glance, not a diff) on both sites it looks identical.
Pulsar: Real-Time Analytics at Scale
ZeroCater (YC W11) is looking for a full-stack engineer to help feed the world
We're looking for full-stack engineers to join our team and help us feed the world. Our stack consists of Python, Django, PostgreSQL, AngularJS. We move quickly and deploy to EC2 multiple times a day. We're profitable and we’re growing like crazy.

About You:

- You're ridiculously in love with Python

- You’ve got experience with Django or another MVC framework

- You're constantly learning new technologies

- You’ve built and shipped a project that you’re really proud of

- You’re ready and willing to work on the full stack - backend, frontend, and everything in between

Responsibilities:

- Build customer- and restaurant-facing features to make their experience awesome

- Work on our internal tools to make our non-technical team as efficient as possible

- Dig into our data to find useful metrics or possible problems

- Automate all the things!

To apply, send a note about yourself to jobs@zerocater.com, along with your Github username, portfolio, resume, or some of your work.job-form
What a sensasionalist headline...
The results of the study can only be achieved under a very controlled environment and even then they're not accurate. From a practical point of view this is irrelevant when there are other ways of getting a user location that are far more accurate and easy.
But from an academic point of view I can see the interest.
For people who like embedded systems and RF and reverse engineering, you can't find a much better job opportunity than the secret spy agencies these days. Show me a company who has their engineers solve problems like these, there's very few, especially at the cutting edge like we're seeing come from NSA and GCHQ.

I'd love to work on problems like this, especially in a team of highly skilled coworkers. It'd be a lot of fun (and a lot of frustration, reverse engineering generally is). The part I wouldn't like is having to keep it secret from family and such.
There is a huge difference between a code review and the specific search for the cause of a known, defined bug. Should we rephrase Linus' law as "given enough eyeballs, all bugs' causes are shallow"? But maybe that's what the sentence actually meant for the first person that wrote it.
Track JavaScript, AngularJS and JQuery Errors with Google Analytics
Yes. I don't see any reason why not.
How I Hacked Telegram’s “Encryption”
MIT Engineers Beat the Complexity of Deep Parallel Processing
My First Week Using a Treadmill Desk
Phones had cameras before they became "smart". Granted they were crappy but so were the cheap cameras of that day.

And I am not sure your point and shoot camera market is dead. Lots of people still don't have smart phones.
> If systems effected by this were sold in Sweden or Germany or other places with relatively strong privacy laws

How is this a privacy issue? Was lenovo collecting information about you? This is more a case of knowingly releasing software that was a security liability on an unacceptable level.

I think the real outcome will be the judicial environment available for the plaintiff. In a lot of eurozone countries, courts don't give out big punishing settlements like we do in the US and are, from my understanding, very, very big business friendly. If anything, the eurozone will be worse than the US if you want a punitive settlement. I know there's a lot of "herp-derp the US is a lawless nightmare of NSA spies" but the reality is that you have a better chance winning here than elsewhere. Look at the Sony rootkit scandal.

http://www.infoworld.com/article/2659436/security/sony-rootk...

California and Texas took Sony to task, not Brussels.
How do you hope to win with now free ( for single user) Visual Studio?
Small farmers hold the key to seed diversity: researchers
CoinBase does far more than just look at the blockchain. They go beyond know your customer (KYC) requirements and actively

1. Ask users about income sources and Bitcoin usage, even for low volumes far below legal requirements.

2. Monitor and analyze blockchain transactions for activity they disagree with and close accounts with BTC in these chains, with no prior notice and no evidence of wrongdoing.

When a company is more aggressive at removing users than Chase bank you know there is a problem.
This announcement isn't as significant as it seems. As mentioned in the mail, Debian has already transitioned to using systemd by default for the upcoming jessie release, for both new installs and upgrades, with a carefully orchestrated transition coordinated between the sysvinit, upstart, and systemd maintainers. (That transition includes the ability for sysvinit and systemd to co-exist on the same system, choosing which one to boot at boot time with init= or a GRUB menu option, rather than having the packages conflict at installation time.)

This announcement only occurred because, after that transition, someone formerly on the technical committee (now resigned, but a member at the time) attempted to use the technical committee to force a revert of that transition. This announcement is effectively the current technical committee saying "nope, the other teams in Debian have done a fine job arranging this transition, and we're not going to overrule anyone".

(I helped draft this proposal, and spent a fair bit of time trying to make sure it would not be taken as changing the current state of affairs in any way, only affirming the work others had already done.)
Full disclosure, I don't mean to present the Noscript/Disabled Javascript comment as fact – I read that here:

https://www.reddit.com/r/BurningMan/comments/2wieta/did_you_...

EDIT: Typo
Confirmation or double checking that the user isn't spoofing GPS?

Though it seems the results would be useless if a Stringray were in the vicinity, and I thought the assumption was that Stingrays were everywhere.
Microsoft Makes Apache Storm Generally Available
Casseres, have noted down all of your points.

Thanks for the awesome feedback!
Sorry I am not answering your question but I wanted to point out that the gccgo work is also being done at Google so isn't a second class citizen.