skysight-inc/HackerNews huggingface dataset:
Differential cryptanalysis, side channel attacks... The analogues are all there, only in a more tangible form.

A well-designed electronic lock based on modern cryptography might be immune to almost all of these attacks, so in a sense we're pretty close to getting perfect security back. In real life, of course, nothing stops attackers from simply ignoring the lock and bashing the door in.
A lot of people here are talking right past each other.

Is it good that WordPress has automatic security updates? Yes.

Is it bad that WordPress vulnerabilities are still so common? Yes.

Are Drupal, Joomla, or Magento better at this? It sounds like the answer is probably no.

Does that excuse WordPress because it is better than other frameworks with marginal track records? No.

For such a widely used framework, WordPress' security record is dismal. Automatic updates are a great feature, but they don't replace the need for the framework to be a lot more secure.

For someone hosting their personal blog on a $5/month VPS this is probably good enough. For a bank to run WordPress is borderline professional negligence at this point [1]. A lot of the comments seem to be assuming that because the update was rolled out withing a few hours, that their window of exposure was pretty small. The window of exposure to WordPress vulnerabilities isn't from the time the patch is released until you are updated, it is from when an attacker discovers the vulnerability and you are updated.

[1]: http://ma.tt/2015/04/a-bank-website-on-wordpress/.
Isn't .NET Native comparable to Go? I mean, an ahead-of-time compiled, garbage collected language. Whereas both Rust and C++ don't have mandatory GC.

That being said, I'm really excited to see a single binary .NET application on Linux, as I like C# very much, possibly more than Go and Java.
Back in Windows 98 days, it took a few seconds to load a screen of a native app sometimes. Now our computers are orders of magnitude faster, and webapps can still take a few seconds to load a screen. Progress?
Spotify and SoundCloud are testaments to how users will endure whatever awful UX you give them as long as they're getting enough value from your thing.
Someone should do a study on where these security bugs are coming from. Are they in new features? Introduced from refactors of old code? Are they due to the plugin infrastructure? Is it all in old code?
I'm with you on this. WordPress is acknowledging the actual behavior of the people who use it and aiming to be secure inside that reality instead of telling people they are doing it wrong and to learn how to internet. That is absolutely laudable and in practice prevents a lot of real problems and lifts people up instead of puts them down.
So, the 150TB is what feeds the CDN? How big is the data you're serving?

There is some gaming you could do here stitching together instances on other clouds possibly (digital ocean gives you 1TB transfer on a $5/month instance), but it's less than ideal and you're effectively going to be building a file hosting platform.

A quarter rack somewhere with a few servers might be the cheapest route, but now you have hardware to deal with.

I've been doing some consulting the last few months while I'm between jobs - if you're interested in having some help with this, it's an interesting problem to me.
Apple needs to deliver at WWDC next monyh
If the webserver can write to the web root, that means an vulnerability that allows arbitrary writing can be escalated to code injection.

In a same environment, the web user wouldn't be able to write to the file system at all, much less the web root.

Sanity being rate doesn't really justify only offering auto updates to the insane.
http://www.banggood.com/Original-XiaoYi-Ambarella-A7LS-BSI-C...

$71 free shipping

review: http://www.youtube.com/watch?v=Tybp5I9ow3I
Just thinking aloud here, but if bees get addicted to the pesticide, maybe we could mix something into it that Bee's don't like, to cancel it out.
I've heard that it's not very good at the "web app" paradigm vs. the "cgi script" paradigm that it was created in. Is that really true?
An Entrepreneur Says Travis Kalanick Stole the Idea for Uber
Plenty do. Pay to win pays a LOT better, so you see more of it.
Whoa, this is nice, but it's a shame the OCR/formulas are all screwed up and less than easily readable. Does anyone know if there's a cleaner version out there?
How up-to-date is commoncrawl data?
Fun fact: wild honeybees in the US have been virtually extinct for a long time; they were mostly wiped out by the Varroa mite starting in (IIRC) the late '80s.

If you see an actual honeybee outside near your home, the odds are apparently overwhelming that the bee is owned by someone.
As strange as it sounds, that much bandwidth would probably suck up $100k faster than you'd imagine. There's a reason a lot of large companies that deal in video have their own data centres and crazy bandwidth deals that make it cheap. I don't think $100k at Amazon's prices would last more than a few months if the service became popular.
Honeybees are of course also not the only insect pollinators.
> But I have an enormous respect for this man, just making rockets affordable is a great service for humanity.

His business means rockets are going to go from $400 million to $150 million. That's nice and all, but it's not an extraordinary revolution. For equivalent, or cheaper rockets, see the Indian space program. They've launched rockets to Mars for cheap already.

I don't get the millennials adulation for him, either. Seems like a random guy for so many millennials to latch onto.

My guess is, because millennials never grew up with the amazing Apollo or Space Shuttle era, they feel Elon is somehow doing something novel and innovative, even with the Indian/Chines space programs going on as well.

If you want to see some sci-fi magic, just look at the Space Shuttle, That's some amazing witchcraft right there. The ideas NASA were throwing around in the 70's were insane. They were talking about constructing giant space stations with multiple shuttle vehicles at a time, with artificial gravity. Too bad Nixon killed their funding.
REST is a subset RPC. There is no instead.
Booming Computer Science Enrollments – What Is the Impact?
Not in 2015 it's not! Front-controller pattern (single index.php, in the same way you'd have a single Python process that Nginx talks to) that hands off to something like Silex or Symfony or Laravel, and you have a beautiful base for a proper web application API layer -- autoloaded classes, proper dependency injection, and more.
And not everyone uses GPS (GLONASS is a competing system used by some parts of the world, specifically developed by the USSR to not have to rely on a USA based system).
Hint: "<Folder index="1">"

I'd really rather just see

Folder.1.name ="Take off zones..."

Folder.1.open =1 #// ???

Folder.1.Folder.1.name ="drome"

Folder.1.Folder.1.visibility =0

... assuming "open" is an attribute and not a directive to add a level of nesting...

I know there's good map between this representation and XML because I've used it.

There are good conceptual cues from SNMP and ASN.1 without having to go the full BER monte. Indeed, you may well recognize what I typed in above as being a lot like what tools like snmpwalk produce once you get all the .mib files in place...

EDIT: fixed line breaks
Would love this. I know it's not "easy" but would love to have a "delete" keyword.
Eh, talk about average luck
http://www.south-africa-tours-and-travel.com/images/pretoria...

"Notable alumni includes two Nobel Prize laureates, 18 Rhodes scholars, eight Supreme Court judges, intellectuals and sportsmen"

His father owned several businesses, mines, etc.
The rarest of all, those that are labeled “ultrahigh-energy” and exceed 1 EeV, strike each square kilometer of the planet only once per century.

In other words, 14 thousand of these particles strike Earth every day.
It would be different if Musk did something new and innovative, but none of his work is actually novel.

I find all his stuff to be completely uninspiring.

China and India are also making cheap rockets. So what? Who cares?
Some of my tests came out as instrumentation which made no sense.

Need to test with a category of images and see what % of results come out matching the category.
That's a great story! I took my first Rare Book School class last year and Belanger is still teaching there, although he stepped down as director a few years ago. The Washington Post was actually filming a video about RBS when I was there. Talking to the journalist about Bezos and his plans while being surrounded by people operating an 18th-century style letterpress was kind of fascinating. This is the video if anyone is interested:

http://www.washingtonpost.com/blogs/style-blog/wp/2014/08/28...
WordPress's code is badly designed and written in a language that I no longer believe serves the best interests of the Internet in general.

WordPress as a globally managed app is FANTASTIC. Automattic does a superb job of keeping on top of just about everything that comes its way. They do great work over there, and I'm really proud of that whole team.
I linked the study elsewhere, but unfortunately not: https://www.usenix.org/system/files/conference/osdi14/osdi14....
United Airlines Bug Bounty Program: Report Security Flaw, Get Rewards
Breaking Bad-themed 'Los Pollos Hermanos' crypto ransomware found in the wild
So what happened to Wordpress? Their slogan used to be "Code is poetry" and today they are the punchline of every bad code anecdote told.
Well, one reason is that to_string() is ancient, but into() is fairly new. Another is that 'to' and 'into' are two different things: to_string() takes its caller by reference, and produces a copy. into() takes its caller by value, and so consumes it.
Walkthrough of Star Wars: Republic Commando by Its Lead Programmer
For others who might have been curious, the last word on the subject appears from Capn. Aux (another semi-famous pilot/writer) who talked to him in late 2012. He said he was alive and well and may be back in the future. Sadly that doesn't appear to have happened yet.

http://americandigest.org/mt-archives/site_notes/flight_leve...
I appears someone still flied United. Who knew.
Yep, and most apartments have worse versions of those, which the residents are contractually forbidden from doing anything about. I'd love to have a steel door with a solid frame and half-way-decent locks, but since my landlord is good with whatever was on sale at Home Depot, I don't get a say in the matter.
I am ridiculously tired, after burning the candle from both ends for the last few weeks to get this release shipped. In the last four days, I've written almost 1700 lines of docs. I make mistakes sometimes :)
I know the are well, and let's just call it Walkable. For comparison, I moved from the suburbs of Houston (14 walking score) to the Montrose area (94) for the same reasons why I live visiting Manhattan - not having to drive most of the time.

Chao's comment is right on. Living in your own pocket is great, but driving to the article's house still takes 20-25 minutes since it's all interior roads.
POST is not idempotent. If you fill out a form, submit it, hit back, and submit again, if the form uses POST, each submission may be processed separately.
It is actually an after CSS selector with fixed position and a linear gradient background. Pretty clever! Here is a JS Fiddle which shows just that bit: http://jsfiddle.net/wyx7zogo/
I think many people mis-understand locks. Locks are very rarely there to prevent entry. It's there to prevent undetected, unauthorized entry, or to make entry a little harder, but not impossible. With bump-keys, most locks actually fail at both (never mind lockpicks) -- and end up being a strange kind of security theatre -- where most people are in fact actors (ie: don't realize that so many, many locks are completely insecure in any meaningful way).

Another thing that people often mix up, are security and safety. A secure door/building is a death trap. If people can't get in/out in an emergency, that's usually terrible, for almost any kind of building. A building that you can't break into or out of in less than a minute, is unsafe.

Or to put it another way: what's the difference between being in prison and living in a castle? ;-)
LILY – World's First Throw and Shoot Camera
Don't United miles also expire.
> Both RPC and REST use HTTP protocol which is a request/response protocol.

Neither REST nor RPC is tied to HTTP at all. I think the title alone of section 6.3 of Fielding's dissertation, "REST Applied to HTTP", [1] should be enough to convince anybody that they're completely orthogonal concepts, much less the rest of the actual dissertation. The Wikipedia article for RPC [2] also provides numerous examples of RPC implementations that never even touch TCP, much less HTTP.

REST is literally just transferring some state via a representation. RPC is literally just calling a procedure remotely.

Also, yes, hatred of expecting different behaviors from different verbs is irrational. Because verbs indicate actions, and different verbs indicate different actions. It works well in written/spoken language, and it works well in REST and HTTP.

[1]https://www.ics.uci.edu/~fielding/pubs/dissertation/evaluati...

[2]https://en.wikipedia.org/wiki/Remote_procedure_call
I think the biggest hurdle is lack of precision. 200 feet isn't much error in the horizontal realm but is a big deal vertically.

There are ways to supplement the precision of GPS altitude with ground-based stations (WAAS), and this is indeed used to construct GPS-based instrument approach procedures which are comparable in accuracy to traditional means (ILS). But these require ground-based transmitters; impractical to implement worldwide.
How long to get through the wall with a fire-axe, even if you secured the door and door frame?
They did a refresh recently (just a few weeks ago) that installed a new renderer both for the playlist content view and for the playlist list view.

That resulted in a big performance boost, at least on my Core i7 MacBook Pro. With older machines I can guess that the performance might still not be that good.

However, this refresh also removed the ability to filter the playlist content view (cmd+F). The worst part of losing that feature is trying to find stuff in "Local Files". Very awkward.
What always gets me is how (in this situation) he would ever operate a laptop that was usable without being plugged in... If he had simply removed the battery and kept the thing plugged then the laptop would have powered off immediately after it was grabbed.
correct me if im wrong, but those are governments creating those rockets, while elon is just a private citizen.

the space program that he created would be unshackled from the states desires, be they good or bad.
"Educate women and girls to create the next wave of skilled female technologists."

A gender imbalance cannot be solved by another gender imbalance.

In my home town there is a startup incubator that took pride in the fact that they were trying to solve the "gender imbalance". This was done by putting pressure on all of the males that were there and making them feel uncomfortable through policies..and many of them quit. On top of this, female founders were charged less money, which is clear discrimination.

Fast forward 2 years and there are no more males using the space.

They still continue to talk about how much they support "diversity". Diversity isn't supporting one gender over another (in fact, it's the exact opposite). It's supporting both genders equally, but it seems like the trend now when talking about "diversity" or "equality" is to give special treatment to one race, gender, or sexual orientation, which is just, plain, wrong.
Open Source Version of Symantec's VIP Access
Consider this. If bees were dying in such record numbers, wouldn't you see significant rise in honey prices?

There's enough market control and price fixing going on in the world, that I can simply never put much faith in short term market price dynamics as an indicator.
They created something that makes the most common sort of deployment more secure.

This is a net improvement and therefore entirely justified.
I think this idea of bounty programs even among non-tech companies will continue to grow. I recently wrote about this in-depth as a solution to many of the online security problems: http://mytwoandahalfcents.com/prevent-enterprise-security-br...
I am fully sighted, and occasionally use VoiceOver for accessibility testing. I found it a little difficult to use while learning because it wasn't how I was used to navigating, but after a few hours I was fine. When you first enable VoiceOver, you're given the option to take a VoiceOver tutorial which goes through basic keyboard commands and web navigation. After the tutorial,
I found most of the keybindings I needed by searching the text on this page:
http://lab.dotjay.co.uk/notes/voiceover-commands/

I was curious, so I had "Alex" read me some news from http://www.20minutos.es (first Spanish-language newspaper I found), and he did not have a Spanish accent. Perhaps there's a better voice in a Spanish localization of OS X.

I recommend using VoiceOver with QuickNav on because that makes navigation much easier. VoiceOver also allows you to set keybindings for launching AppleScripts, which you might be able to leverage to remove some of the complexity from learning/using VoiceOver:
http://www.applevis.com/guides/mac-os-x/understanding-and-us...

Apple has a handy keybinding reference, which is VoiceOver accessible:
http://help.apple.com/voiceover/vo/en/VOKeysColor_1.html

Applevis is a great community, and so far I've found an answer to all of my other questions by searching their forums: http://www.applevis.com
Let's ask one question: what CMS, CRM, programming language, operating system, etc doesn't come out with major security flaws every once in a while?

All of them, even OpenBSD. Software has bugs, and security flaws. It is not how buggy they are, but how well we patch them from a larger scale and that, WordPress does extremely well.
And United just limited how you can use reward miles. It used to be that your status would pass on too the passenger. So I'd fly my mom or sister, and they'd get checked bags, lounge, priority access, etc.

Now they no longer do that. So it makes the miles far less useful. And, since it doesn't apply to GS, all the other premiers still get screwed by this change. So it's not like it's gonna improve premier status for the rest of us anyways.

Ranty anecdote:
Oh and they don't even respect what their ticketing and policies on this state. It was that any such ticket booked before 15 Apr would use the old rules, and indeed the baggage calculator would show that. Sent my sister somewhere, counting on some big bags to bring equipment. GA starts making a fuss, saying no, made her unpack and so on. Even after calling United and being assured she'd be treated properly on the return flight, nope, still not handled correctly and made to pay extra. United's IT is terrible. That's why we call their site ".bomb".
Oh! Thanks for the clarification!!
GPS satellites somewhat regularly go in and out of service for various reasons. There are more satellites in the constellation than strictly necessary in order to compensate for this.

Information on this is distributed to pilots (in the US) via NOTAMs, and you can use this information to decide whether it's safe to use GPS navigation for your flight.

Practically speaking though, aviation GPSs have a function called RAIM that continuously monitors the integrity of the position information and will inform you on a loss of precision. I believe most GPSs also allow predicting RAIM along your time and route of flight to make sure you'll have integrity from takeoff to landing.
The "security by obscurity" that we have in the physical world, is closer to AT&T publishing personal data on their web site, and weev getting sentenced to years in prison for pointing it out, than many people realize.

The big difference, is that in the digital world, seeing is possession -- if someone walks up on your porch an reads the documents you've placed there, you'd never know.

(Writing this, I kind of realize how some seemingly sensible people think that the crazy laws on computer intrusion makes sense... but the don't. That's a discussion for another time, though. Along with how analogies may not be the best vehicle to determine sentencing guidelines new areas opened up by new technology...)
The real problem is that the agribusinesses (please don't refer to them as farmers) are unwilling to make the changes to not require honeybees.

If they let about 10% of their acreage go wild, native bees come in and can take over most of the load. However, that's more expensive, right now, than continuing to use honeybees.

Until using honeybees gets expensive, agribusiness will not change.
> By this point, you're already on the other side of the airtight hatchway

Not really. Having the ability for a web process to write its to files which it then executes actually opens up whole new vulnerabilities. For example: one popular PHP exploit is writing a PHP file, then executing it on the remote system. Can't write a file? Can't execute the exploit.

Reading and executing PHP out of the DB, and also writing user input to that same database? Same problem. Triggering system-altering actions based on an unsigned token? That's a vulnerability.

Letting an application be able to do more on a system than is absolutely necessary to operate is a great way to give control and information over to others.
I never liked the pattern of routing every single request through index.php. I prefer to let Apache do the routing for me, having a separate script for each task.

I also had a PITA debugging someone else's code with autoload magic. He didn't follow any pattern for what code was in which directory, and he reused class names so grep didn't work. Now where is that source file again? (In one particular abomination, he took a string from the database and included that source file.)

That's one nice thing about PHP. You can use PHP for a simple straightforward style, or for an abomination like zend.

Vanilla wordpress is good. I'm working on a project that has a custom framework that lives on top of WordPress, and I'm cursing the people who wrote it and my employer for outsourcing the WordPress project to them.
Intial thoughts: 2/3rds of the screen are seemingly things I don't care about. It is also not centered which annoys me a bit. Light gray on white is hard to read.

Image for reference of how it looks to me: http://i.imgur.com/7xzmqxJ.png
How to Prevent the Next Enterprise Security Breach: Invert the Model
they should, for sure. from what I've seen over the past few years it is really all of the above although plugins are notoriously horrible.
Yeah how hard is it to just let us select meals before boarding? Instead of running out of the better meal and pissing off high revenue customers. Even AA gets this right.
I was never a big a fan of WP, but… I agree the ease of updates is an extremely important feature, especially for non-technical users. I'm working on a small conversion project migrating content from a Joomla site to Wordpress. The original site was running on Joomla 1.5 (Support for this version ended in Sept. 2012!). The upgrade path was too cumbersome so the clients just "took the risk". It was compromised several times but "cleaned up as best we could". Needless to say, we're ditching that server.

Still not a fan of WP self-installs, but hosted on WPEgine with smart tech support, automatic daily snapshots with the option for non-technical people to back up or revert the whole thing with a single-click is super simple. For added security and performance we'll be using cloudflare DNS, applied a plugin to hide any evidence of wordpress use and use just a few well-known and maintained plugins. Nothing is perfect, but ease of use, ease of upgrades and ease of maintenance go a loooooong way. It's mighty budget-friendly too.