skysight-inc/HackerNews huggingface dataset:
To ensure that test kits, catches and patches prevail. But that's only a guess.
1) It helps admins verify that the patch was successfully applied.

2) It gives security researchers more surface area to evaluate when looking for similar bugs or bugs in the patch.

3) A PoC not existing provides a false sense of security. Just because one is not published does not prevent attackers from creating and using an exploit (in many cases before the vulnerability is disclosed).
We bring the ratio down as well... A load/store to a cores local scratchpad (Our software managed and power efficient version of a traditional L1 cache) is 1 cycle, compared to 4 cycles for an Intel processor. Add in the fact that we have 128KB of memory per scratchpad (compared to 16 to 32KB L1 D$ for Intel), you don't need to go to DRAM as much, greatly increasing performance/throughout on top of the 10x+ efficiency gain.

Even in the case of a core access accessing another cores local scratchpad when they are on opposite corners of the chip, it takes only one cycle per hop on the Network on Chip... meaning for our 256 core chip, you can go all away across the chip (and access a total of 32MB of memory) in 32 cycles... Less than the ~40 cycles it takes to access L3 cache on an Intel chip.
25-30 years is too long to predict anything when it comes to tech. The Chinese already have their versions of Google and Amazon...and just like the Japanese automakers in the 70's there is nothing to suggest they can't displace either Amazon or Google.

Also what happens tomorrow if you don't have to go anywhere to buy most products, but just fabricate it at home or at the local fab down the road as Neil Gershenfeld predicts.
No, analyzing a released patch and then write an exploit takes time. Compare that with taking a pre-written exploit and executing it, so it has nothing to do with "false sense of security". Fact is that it gives people more time to patch their systems.
Needless to say, but analyzing the patch and writing the exploit is a lot more involved than copying, compiling and running an exploit, like 90% of the attackers (script kiddies) do.

What they did here was simply irresponsible at best.
In 2015, Market cap means nothing. Also Amazon has many other things not related to product delivery/sales like AWS.

We should compare by total product sales.
I think the fundamental misunderstanding is that once a patch is released, you've given hackers a roadmap to understanding the exploit. At this point, there are essentially professional dev teams waiting to build out exploits. From what I've read, lack of a full poc delays hackers by hours.
https://www.wikiwand.com/en/Single-page_application
Awesome! That blog post should be an HN submission all its own, if it hasn't been already.

Edit: Looks like it was [1] I always miss the good ones.

[1] https://news.ycombinator.com/item?id=8587078
I don't mind the look either. I don't mind B & W sites. (I am partially color blind, so maybe that's a factor?). Even with photography, most of my pictures are in B & W.

I wouldn't pay $15/month. I would accept one targeted ad per week? While I won't use this service, I need to know how it works. I have a weekend project?
Delaying PoC raises the cost of exploiting the vulnerability; having it makes it easier to exploit and not having it means an attacker needs to invest resources recreating it. How much this helps depends on a lot of factors, but it doesn't seem unreasonable to me to allow some time for users to patch before releasing the PoC.
Accounting profits are too easy to manipulate. Valuation experts prefer to look at cash flows.

Here's a precocious '09 writeup on AMZN from an analyst at Andreeson-Horowitz.[1] He points out how Amazon's re-investing CF's to finance capacity, warehouses, real estate, etc. This is instead of realizing accounting profits.

[1]http://ben-evans.com/benedictevans/2014/9/4/why-amazon-has-n...

edit: it's worth pointing out that AMZN could be one of the most profitable companies (accounting profits) at the flick of a switch if it diverted its CF's away from capex and internal investment. Its CF's have been enormous for quite some time.
> open up the Android Market out of nowhere (why do they have this much priviledge? That shouldn't happen on the desktop without asking for permission).

This is based on how Android browsers handle URLs to the Play Store. Some browsers (like Firefox) don't do this automatically (at least for me); instead, they'll just present you with the web page version of the Play Store (as if you were on a desktop), but with an icon in the address bar indicating that you can open the URL in the Play Store instead.

But yeah. The mobile web is a hellhole. My "favorite" is when a site will throw a browser dialog asking to install the app version of their site.

I feel like web developers nowadays are treating XKCDs #1174 [0] and #869 [1] as sincere, genuine advice instead of the scathing observations and condemnations they are of mobile web behavior.

[0]: https://xkcd.com/1174/

[1]: https://xkcd.com/869/
anything that limits you, like a shelf NAS solution do, will cost you more time as you adapt to it. instead of the other way around.
It's incorrect to label Isaac Newton's (1642 - 1726) alchemy as fairly weird for that era. Modern chemistry was invented during the same period. For example, Robert Boyle's The Sceptical Chymist, which argued that chemicals were composed of atoms, was published in 1661. It was not until the 1720's that the distinction between chemistry and alchemy was thoroughly established.

"The terms "chemia" and "alchemia" were used as synonyms in the early modern period, and the differences between alchemy, chemistry and small-scale assaying and metallurgy were not as neat as in the present day. There were important overlaps between practitioners, and trying to classify them into alchemists, chemists and craftsmen is anachronistic."

- https://en.wikipedia.org/wiki/Alchemy
Those links appear to suggest two things:

1) secrets

2) magic sauce

While the possibility of "magic sauce" is in theory possible, its existence would suggest that it is currently possible to mathematically describe the behaviour of stock markets in such a way as to generate 35% p.a. returns by trading entirely based on this description.

A priori, this seems very unlikely.

Alternatives, such as an unusual access to information, and/or efficient use of existing laws, e.g. those surrounding taxes, are much more plausible.
Damn, $15/month per line? At least Tarsnap is pay-as-you-go. Seems way too expensive. TossableDigits.com (1) starts at $3.49/month per number and pay per minute, with plans that drop in price as you ramp up. Pretty much the same service without the all-in pricing. And you get unlimited SMS, Voicemail and Call Recording. They've been in business since 2006 -- staying power. (2)

They also are offering Robocall Blocking -- a huge win. (3)

(1) https://www.tossabledigits.com/pricing.php

(2) https://www.tossabledigits.com/aboutus.php

(3) https://www.tossabledigits.com/blog/introducing-robocall-blo...
Nearly 40, staring at screens since I was 7 (a fleet of Apple II machines in 2nd grade). Vision is still better than average. 20/15

Why? Genetics probably.
i feel like you're being obtuse? don't confuse money raised in investment rounds (such as in the OP) with money that customers pay to palantir.

a company's value is the discounted value of its cash flows, future and present. palantir should expect to make money from its contracts, sale of software (i'd lump the value of their patents, etc here), and whatever else they have dreamed up.

since they have lots of customers paying them a lot, palantir has value. investors want to invest in a company that's growing. hence they give palantir money so palantir can keep growing. if palantir doesn't keep growing, they'll lose (part of) their investment.
> Because the internet differs from the real world in that... Actions are untraceable? Crime has no consequences?

Precisely. And you said one of the reasons it must remain that way:

> It crosses borders

The alternative is for any connection to the network to require a real-world identity, and to bear liability for information they transit if they can't identify who it came from. This is politicians' wet dream (more control/power), but it is utterly impractical as it simply can't scale, cross jurisdictional boundaries, or actually stop bad actors (who just steal someone else's credentials). Never mind the inevitable effects on free speech and cementing the idea that individuals cannot opt out being tracked and recorded.

It's a long-held design principle to assume that the Internet is full of malicious intelligences, and that your software should act accordingly. Even if everybody in the world were completely benevolent, this would still be a prudent assumption for robustness against weird coincidences between context domains. Putting one's fingers in their ears and then crying to influential friends about "hackers" doesn't absolve one of responsibility for adhering to this principle.
Uber Fare Estimator Source Code
Sqrrl built the tech the NSA uses to sift through phone calls and such. They're now selling this tech for big data applications.
Is there anything like this for VLC or some other desktop video app?
Huh. I've been using a very hacky script I wrote myself for this purpose, but I hadn't seen syncplay - strongly considering switching to it.
Firefox mobile supports extensions like ublock just fine. Use a browser which doesn't suck :)

And if you're using an Iphone: you made the choice that apple should make all the choices for you. You've made your own bed. Sorry about that.
Responsible disclosure is a courtesy, not an obligation, to criticize reeks of entitlement.
MEGA, best encryption, 50 GB free
https://mega.nz/
> I have a limited time budget for reading (...) My comment is to give them a heads up and save them time. (...) I disagree with you on the "whole point" of the article (...)
more time spent reading her essay is less time to spend observing ants

The point of the article is not that everyone should become an entomologist.

It's that time should be wasted, not saved, that there is value in doing nothing, or, well, reading something several times, or, well, different variations on one theme.
Additional C/C++ Tooling
While I certainly think it's true that the "real deal" would jump on any patches put out and reverse-engineer the exploit with relative ease, I expect the actual hack scene to have the same distribution of skill (if not more skewed) than the regular programming world. For every Carmack there are 10 me's, and for every professional exploit builder there is an army of script kidies. Look at how widespread Shellshock and Heartbleed exploits became after their disclosure, I don't think there are that many attackers capable of making such an attack themselves without a PoC.
Is there a service provider for which that isn't true?
I wonder if you can ask them to reconsider. Let them know that you acknowledge your faults and that you want to work to improve yourself. In exchange, you will bring a positive attitude, work hard, and apply your skills and knowledge in a positive way.

> every project I build goes nowhere, ideas I suggest at work are routinely shot down & branches I do invest a lot of time and thought into are simply abandoned in the end.

The good news is that all of this can change. If you are executing many ideas, then start applying a more stringent filter on what ideas you actually take to the implementation phase.

If your best ideas are not panning out, then take some time to consider whether you are executing on the right versions of those ideas. Have you iterated on the idea and refined it or are you just going with what popped into your head?

At work, do you always feel like you have the right ideas and other people are getting it wrong? Take the time to listen to other people's ideas. Don't contribute any ideas for a while. Just pay attention. You won't be sticking your neck out and at the same time, you will be giving yourself a chance to see how others approach problems. Use this as a chance to train your inner voice.

Lastly, if you can move to a more positive environment, then that is great, but don't bring the negativity with you to the interview or to the new job.
Oh how I want that support. Our trunk providers at the moment say they've got it coming and then we just turn it on after testing it, but until then we're at their mercy. Don't forget MMS in there, too. That's a huge gotcha for some systems.

Someday we'll all be allowed to have nice things.
True -- but skilled engineers aren't necessary. The exploit builders sell their wares. I read recently -- unfortunately I don't have the link handy -- that these exploit toolkits rent out for eg $5k/mo.
That makes no sense. Surely there are some efficiencies in "repeat solving" problems that they have "already solved".

A cynical thought would be that perhaps they don't want to have to sell to a company in an industry where they already have a reputation. That may by no means be true, perhaps instead they just don't have the attention span to really product-ize a solution instead of making one-offs. Or something else, either way, it smells of their typical cultish marketing.
Used this one way back http://addons.videolan.org/content/show.php/Syncplay+interfa...
better than google. which actually owns your google voice number. and the chance of google just shutting down a service they can't show text ads on is much, much higher than some company shutdown (instead of being bought by the google or facebook).

google is already dropping the ball on google voice.

the app has no updates since android 2.3. just so you understand how behind it is... the app cannot support two messages in the notification. after you get the second message, instead of the usual two lines in the notification as with SMS or any other app, you get the literal text "2 messages".

if you cave in and use hangouts for SMS, you then have to use hangouts dialer... which is a still-born app. for example, if you route your calls to your regular phone AND gtalk (i think the gvoice UI still calls hangout as gtalk) then your phone rings for both things at the same time! and you never know which one you are answering when you swipe right.
Thanks for that great analogy! I'm trying to articulate the problem in easier to follow ways. I've been wanting to depict it in the dreaded infographic.

Care to help with the words or the graphic? I'm going to start website for this. If anyone knows of a great website already focused on articulating the problem with ads, let me know. Email me!
Again, delaying the PoC exploit code release gives people some time to patch their systems. How much time depends on the skill of the attacker and complexity of the exploit, but some time is better than no time.
The page aesthetics work for me - I particularly liked the absence of three USP divs under the lede (though the illuminoid-friendly logo was a close second..)

Hey, feature idea - riffing off the now overdue but unlikely to happen call flag for non-human callers, how about a voice-recognised audio-captcha before you're put through during open hours?
All of those make sense, but they seem to focus mostly on the most skilled of both groups.

I don't have any useful numbers, but that seems to leave many novice sysadmins vulnerable to script kiddies simply due to not being around right at the patch release time.

I could be wrong, though. And even if I'm not, perhaps it makes more sense to do things this way, but I'm not (yet) convinced.
No PoC was released with the Heartbleed disclosure, but many were published within hours by others (including myself). And this was a good thing, without them admins would be unable to verify that their servers were patched successfully.
> Ads or fees can just be different points in a price structure.

Tell that to the various for-pay services which have decided to force ads onto paying users because, frankly, it's so fucking convenient that there's already an apparatus which is simply disabled for some people!
Your link may be on-topic but it's awfully pink and salty.
-- J. Random Kuron

Links to Tens of Thousands of Legal Music Downloads

http://www.warplife.com/tips/law/copyright/music/legal-downl...

"Enjoy Free Music without getting in trouble
by downloading the legal MP3s that many musicians provide
as a way to promote themselves."

I wrote this in response to the RIAA's effort to convince the public that all music downloads are legal. You can download anything you want provided you have permission of the copyrigh holder, it is in the public domain or local laws permit it.

The RIAA responded by publishing their own legal music downloads list. They were all sites that carried tracks from the major labels. As that page was effectively giving my own free advertising they took it down after a few months.

I need to verify and update the links, I have that written down on my ToDo list. Maybe Tomorrow.

Musicians: List Your Band's Website
http://www.warplife.com/tips/law/copyright/music/legal-downl...

I estimate that my copy and Kuro5hin's together have had ten million pageviews.

Note: "Legal" doesn't imply "Free" though most are free.
> From the point of view of the user that content might as well have come from a third party since - just like the headless browser used in the testing - they have absolutely no way to verify that short of doing a bunch of whois lookups.

How many users, even among the extremely security conscious, do you expect to actually verify such things? And among these, how many do you expect will turn their noses up at a CDN url that is serving a number of obviously website-specific assets in addition to jQuery and friends? The real issue (and the one you focus on in your article) is the actual dangers you expose yourself to by using uncontrolled external asset sources. If I set up a CloudFront bucket that mirrors the static asset directory on my web server (and use it via HTTPS), what is the vulnerability? CloudFront could be hacked, but so could my web server (and the later is a more likely culprit since it is executing more dynamic code). The difference makes even less sense if my website is also hosted by Amazon.

If I want to keep my static assets on a CDN (and save myself a lot of server load) while keeping my assets URLs on the same domain, the only two things I can think of are:

1. Using a CNAME record, which precludes using HTTPS (introducing a real, not perceived, security vulnerability).
2. Use a local url that gives a 301 redirect to my CDN url. Which means extra requests to my website, for no real security benefit.
Hmm, I think it's smarter than that.

Every year around burning man time it "notices" that I'm buying supplies for burning man, and starts recommending me things like baby wipes, which are completely unrelated (naively) to things like lag screws, rebar pullers, etc.
How+to+keep+informed+iOS+9+cydia+|+iOS+Jailbreak+Tools+and+Jailbreak+Guide
**Hip-Hop Dancer SLAYS Choreography** Letrell Choreography – “D-Boy”- Big Sean
ADP the huge company suing Zenefits insists Zenefits CEO Parker Conrad 'lied'
I've messed with rabbit before. I wasn't a fan because in their implementation actually open netflix on a virtual machine GUI and use browser tricks to try to make it seem like you're just controlling the computer like its your desktop. The performance is horrible though because there is two hops, from netflix to their servers, and their servers to you.
Okay. I never "got" The Wire or The Sopranos, either.

Adequate, sure! Best TV series ever? Strange.
Maybe they should just make the random functions return '4', documenting that it was chosen by a fair dice roll and is therefore guaranteed to be random.
Easy to say, hard to do. Really cars now need TWO CAN bus networks, the RED network and the BLUE network. All critical car functions on the RED isolated network, vanity functions on the BLUE network.

So often though a designer will say "We really want to help people who call in for roadside assistance, we just want to read the CAN bus, we don't need to write it." And some complex function will be created that only "reads" but then a overflow attack or some other exploit lets arbitrary code get run and since its possible to write code with a write function your security is toast.

So what actually will happen (I hope) is that a bunch of things will no longer be possible from the infotainment system because that system doesn't have access to the CAN bus at all. And any UI that does have access to the CAN bus won't have any wireless access to it at all. Which will make some car features, less featurefull.
I recently reported a security issue to a quite popular open source project (which has at least some company support). The fix is ready but because of coordinating other security fixes into one big release it is - after almost 2 month - still not released. I wonder if this is normal? What else can you do? Full disclosure?
Run SQL Queries on APIs, JSON / XML / RSS Feeds, Web Pages (tables), Everything
It's a bit of a stretch. :-)

The techie overshadowing was already underway nearly from the beginning. r/politics had displaced r/science and r/programming as the most popular subreddit by 2007 [1]. r/nsfw was the most popular subreddit in 2006. Indeed, one of the major impetuses for the creation of subreddits was to get all the damn political content and soft-core porn off the front page so that the science & techie types could have their own community.

r/IAMA was itself a spin-off of r/AskReddit, which was filled with frivolous questions at the time. It wasn't created until 2009. I'd argue that the creation of Hacker News in 2007 was really what transformed Reddit from a venue for engineering types to a mass-market beast. Before then, the programming types would hang out on r/programming, but afterwards, a good portion of Reddit's programmer userbase migrated to Hacker News.

[1] https://en.wikipedia.org/wiki/Timeline_of_Reddit
That is our current primary for the numbers I use, yes.
It's not so great for software devs, actually.

1) Zero paternal leave. This may lead to subconscious hiring bias for men b/c you know they can't take paid leave. I'm surprised the S-team permits this, but I think they're all male anyway.

2) No free lunch ever. Facebook and Google both have them. Microsoft has free snacks I think. Several Seattle companies have catering on Friday. The Amazon Silicon Valley office has them only because there would be a revolt if they didn't. (Oh sorry, there's rumor of free ramen noodles on some floor in Blackfoot maybe)

3) On-call for all devs.

I think reddit had a thread series last year showing off what interns got at Microsoft, Google, etc. At Amazon, interns get to keep their backpack when they leave.
If the only reason you're operating at a loss is that you're spending everything you make on gaining new customers, then you just stop reinvesting and are immediately hugely profitable.
Tree that grows 40 different fruits via grafting
The Most Radioactive Place in New York City Is Now a Superfund Site
Great demo. Out of curiosity, why not compiling the C algorithm with emcc into asm.js and probably get better performances (but a much larger js file) ?
>I value Amazon for the review

Same here, but I've always wondered if they manipulate reviews. Obviously, crappy reviews on high margin items and good reviews on a different brand of the same item but with low margins are bad for Amazon. I've never seen anything that would lead me to believe they remove reviews but having 100% honest reviews could be hurting their business. I hope to hell and back they never compromise the integrity of their reviews, but I wonder if it's something they've thought about or are currently doing without our knowledge.
I don't know if you missed it, but everyone(for the most part) are far better off than 10, 20, 30 etc years ago. I'd say in spite of the politics.