skysight-inc/HackerNews huggingface dataset:
You seem to imply this is a novel attack vector. But it's really just an instance of a very old mistake:

Don't use the root of your app as document root!

It's really as simple as that. Almost all modern apps have a subdirectory "public/" or similar. That one is meant to be used as document root. You only have to ensure there are no sensitive files in there.

If you fail to introduce such a directory, you'll have a game of cat-and-mouse, where you have to add extra webserver rules for each sensitive file: VCS, crypto secrets, private keys, and so on. In that setup it's easy and very likely to forget one. Of course, this then creates the feeling of "How can anybody keep track of this never ending list of security details?"

In the end, this is a blacklist vs. whitelist thing. Like with your firewall, you want one rule that blocks everything and allows only specific stuff. The alternative is to allow for everything, have rules to deny all sensitive stuff, and finally get in trouble for having forgotten one rule (e.g. probably because an additional service was introduced after the firewall rules have been written.)
Question, how is it generated by code?
My approach to security, when discussing things with our engineers:

1. Make a list of everything that absolutely positively cannot live without this data/access/permissions/etc.

2. Put the data somewhere where absolutely nothing whatsoever can ever read it (except root).

3. Figure out what one single change will resolve #2 so that the things in #1 can happen without any other things gaining access.

If you don't do #1, you don't understand your requirements/applications. If you don't do #2, then your data is probably vulnerable through some other mechanism. If you can't do #3 then you probably need to change something else (e.g. stop running all processes as the same user, stop running all services on the same box, stop trusting users, set up more granular sudoers rules, etc).

What I find is that when you come up with an idea for #3, and then come up with a list of side effects, you can actually find a lot of the kinds of issues I mentioned above, for example where the public website CMS (as 'daemon') and the accounting backend (as 'daemon') both have access to the same resources, and thus someone gaining access to the CMS can get the accounting DB user/pass and get access to your transaction records, user database, etc.
But in this case you'd want to use a constant-time string comparison function, which, afaik, strcmp() is not.
Considering the ammount of people visiting the store page each summer sale (well any sale), i dont think hacker news can generate that large amount of traffic.
Big Data Goes Really Big
I've been working on customized EC2 instances, DO droplets and Nitrous (https://pro.nitrous.io) since 2012 and haven't looked back. There is the issue of connectivity, but I'm unproductive without an internet connection so it has worked well for me.

I use tmux and then connect to the session from work, home, etc... and setup ssh config (http://nerderati.com/2011/03/17/simplify-your-life-with-an-s...) so I have shortcuts to all of my remote machines. App environments are built with docker, snapshotted, and pushed to dockerhub.
Making a website you with functioning log-in and log-off.

This was the 90's. It was surprisingly hard to implement this in a workable, reliable, secure way, and no one in our company of 50 programmers had ever done such a thing before!

I recall being puzzled for way too long at how to prevent someone from coming to a browser that had just logged off from our web app, and clicking the back button a couple of times to be logged in again.

Now, of course, it is a common and easy-ish task.
I solved many challenging problems, e.g. I wrote a parser generator, that can generate itself, I wrote an UN/EDIFACT parser that was parsing the human readable UN standard to create a parser for a semantic translation. My Y2K PTFs run on every MVS and OS/360 system. I did a lot of machine learning in the last 10 years, e.g. optimizing maintenance of Siemens power plant turbines or quality control for injection molding machines.

But ... I'm taking the biggest challenge right now. I'm coding my Onyx database client idea for 3rd time. The hardest problem was to start o3db. I failed badly with Onyx 20 years ago by burnout holding over half a million lines of C++ in flow together with nearly 10k lines of my own 4gl, during the 3rd customer installation of Onyx. I was very shy of coding UI/UX afterwards, escaped deep into server stuff, machine learning - escaped as far away from user as possible.

So, my biggest challenge was to start Onyx again: A user facing UI/UX for common business database applications with its own fourth generation language. I've decided for Scheme as an intermediate language this time, and the prototype running well. I now have a non recursive Scheme interpreter and GUI running in browser, able to process the meta tables defining an application. Its still a long road to my vision. But to start a project again, I failed with a burnout 20 years ago, and to code it with actual technology, was the biggest personal challenge.

/join #o3db on freenode, if interested in a startup to create common business database clients for the web.
A bit over a year ago I researched what "Devops" means, and the answer seemed to be Developers being able to push code to production without having to involve Operations. This sounds like a good goal to have (presuming you've got good unittests etc.) as it removes an unnecessary friction for developers.

What it doesn't include is all the higher-value work the people on the Operational side tend to provide, like thinking about rollbacks, machine failure, network failure, provisioning, capacity planning, change/configuration management, security, monitoring etc - which is not to say that all developers don't think about these things, their focus tends to be on developing product rather than these non-functional requirements.

I'm presently in a world of Ubuntu LTS+a few manual backports for similar reasons as the authors. My home systems are ansible managed, giving me things like wireshark installed everywhere if I need it and new machines automatically hooked into Prometheus monitoring (which is much easier with my debs). I've seen what happens if you try to manually manage machines, and know that a small bit of upfront work will bring dividends later.

Writing the core code is just one critical step in running software long term, let's not forget the rest of the critical steps to keep it running in a sane way in the future.
I highly doubt the HN traffic caused Steam to go down, their statistics page[1] shows how much traffic they process each hour (and it's a lot).

1. http://store.steampowered.com/stats/content/
When Bio Meets Computer Science
Difficult to say this problem is solved yet - the jury is still out, but I've done a good deal of work on identifying what the mechanism of a defect in superconducting phase qubits may be.

TL;DR: Two level system defects are a 20 year old unidentified noise source that can be described by an oxygen spatially delocalising in an amorphous portion of the underlying circuit.

See http://dx.doi.org/10.1103/PhysRevLett.110.077002 and http://dx.doi.org/10.1088/1367-2630/17/2/023017.
To not bundle dependencies, use the Java packages in Debian stable and if you find one with a missing feature or unfixed bug, then backport that from Debian unstable or from upstream.
OnePlus 2 Invite Registration starts
I high school I went to extra lessons in physics. The teacher gave out a problem that he said it had a simple end result but he never seen an elegant way to solve it. An other guy the next class solved it with one really well designed figure and like three line of simple equations, it was awesome. I know he was a slow thinker, he wasn't really good at timed competitions However there was a competition where you had to solve problems from a journal monthly and send them back, he was really good at it.
Drone Firing Semi-Automatic Handgun, What's Next?
To the downvoters: the comments on that post mention a lot of deployment methods that people not doing Debops are using.
It's always nice to have a post explaining that you can comment in SQL. Most people are not aware of this, and it definitely helps when reading a DDL.

I have to agree that sometimes there are superfluous comments that harm more than help, since they add nothing to clarify the purpose of the column but consume your time. For example, in your post, the comment "required first name of the user" for an attribute called users.first_name adds no extra information. I'd also avoid using "required" as part of the comment, as that's implied in the NOT NULL constraint. However, other comments are very valuable, like the one for "created_at" or "data".

Regarding having a last, nullable "data" hstore or jsonb column, I think it's a very good practice. A nullable column is almost always free (takes no extra disk space) and allows for storing information without a prior, clearly defined, or variable schema, without having to be ALTERing tables frequently, which usually is a challenge on its own.
If you can use Microsoft and provided you have USB 3 ports on your workstations, Windows To Go could be a good fit.

https://en.wikipedia.org/wiki/Windows_To_Go
doh, you're right:

> In college, I owned a poorly maintained VW bug that would occasionally lose power on the freeway, such as from an electrical connection falling off from vibration. I caused more risk by not maintaining my car than these security researchers did.

that's what I get for reading and replying on mobile.
How do you not bundle dependencies programming in anything? If you want to be portable across Linuxes, you can't even count on tcsh or env being installed at the same path. Counting on the stuff installed with the system unleashes a world of pain on the user.
Ada is a good language for many things, but isn't very easy to use. It failed that test versus C.

Lua on the other hand, won that test plenty of times.
One scenario I can imagine is a regex which doesn't properly handle multi-line inputs (quite common issue in ruby[1]). Together with a mail header injection vulnerability, this input could be dangerous:

user@real.com\nCc:attacker@evil.com

[1]: http://guides.rubyonrails.org/security.html#regular-expressi...
https://packages.debian.org/prometheus
A way to search Hacker News
+1. I ended up using Git for everything. Use a private server, ssh repos, and you have a pretty good end-to-end encryption, and privacy.

I've always wished there was something to help me sync my environments, especially between mac an Linux platforms (just sync my terms, keep the history, stuff like this), but at the end of the day, it forces me to stay clean and close my windows from time to time ...

Oh and I use Chrome with sync feature, and it works awesomely great! - with extensions like LastPass to sync all my accounts. I used to value privacy a lot .. I gave up when I moved to China.
The outlines of every character are calculated by source code (the .patel files, compiles to JavaScript).
OWASP is a pretty good resource: https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet
Number 3 is pretty good honestly. It might be the best option in fact.
The 'hello world problem' a.k.a. birth. Nothing compares with that.
http://deb.robustperception.io/ is my nightly build. It's one of the few things I want to run on the very bleeding edge of.
Yeah, but in other (more high-level) languages you simply wouldn't compare strings byte by byte.
Syriza didn't get a majority, they got just over a third of the votes. Even with the 50 bonus seats for the biggest party, they don't have a parliamentary majority and depend on the support of the radical nationalist party ANEL.
It's not just you. I found it to be a painful, and ultimately worthless, read.
USB keys are known to be too unreliable in the long run, so my advice is a big STAY AWAY from them; but I can testify an external box, connected via a USB2 / USB3 cord, plus an (Intel 530 series) SSD can do wonders as a portable, full GNU/Linux system (Kubuntu in my case). Boots to desktop in under 1 minute even over USB2 (USB3 is a lot faster), and is very usable despite the USB bottleneck (way better than any USB stick). 120Gb, even after installing a full distro, leaves you with plenty of space to carry along your favorite music, virtual hard drive images, so you can carry along your Windows virtual machine(s) intact, and already configured [1]. You can then use TimeShift (or manual rsync cronjobs) to backup your full system to local drives/USB keys, and sudo apt-get upgrade the system whenever you get a reliable internet connection.

Minor issues I have experienced with this setup:

1. The biggest issue of all is, due to the peculiarity of USB power design, most SSD's might experience failures when the machine is powered off. This is a known issue with USB keys too! Believe me, booting a system every time not knowing if it's going to end in the dreaded fsck mess with thousands of errors really is a nightmare. Going with the Intel 530 series SSD's (which is a known solution) fixed the issue as they have larger capacitors, though Samsung SSD's might be reliable too.

2. USB power: on most laptops, your single USB power cord is unable to power the external drive; you might have to use the popular Y (double connector) USB cable.

3. Stay with open source video drivers. Especially swapping nVidia <-> AMD drivers is a recipe for disaster.

4. Audio HW devices will stack up, possibly resetting their settings when you return to a previous machine.

5. You might sometimes have issues with UEFI when you first boot your system on a new machine.

[6] VirtualBox VM's have sometimes issues when the system unexpectedly swaps eth0<->eth1 interface names, but this is easily fixed in the network configuration before booting them; also swapping AMD and Intel processors is risky, and can unexpectedly hang your Windows system on boot; BTW don't forget to carry along on your external drive every hard disk image they might use, or the VM's won't boot. Of course this applies to Vagrant boxes too, but is less relevant as you can destroy/recreate the box any time.
Recent discussion of HN Search on algolia.com: https://news.ycombinator.com/item?id=9934069
There is an current academic debate about this:

https://medium.com/bull-market/violent-warfare-is-on-the-wan...
That was the one, thanks.
I'm sorry, but your reasoning completely escapes me. The only things that are left are very big, and very small? In addition to this being an incredibly vague catchall (which misses all the possible discoveries of 'black swans', that is phenomena and occurrences we have never seen), your statement more importantly misses the fact that humans don't even understand what something as common and important as light (or electromagnetic radiation in general) is. Is light really big or really small? We've certainly characterized light's behavior (to some degree), though we still have basically no understanding of what it actually is (though I may be the only one who finds the circular definitions of electromagnetic fields unsatisfying). The same is true of things like matter and gravity. Once we have better understandings of what these are, I may grant that further fundamental insights will be difficult to come by; but we're not there yet.

You might be correct in saying that humans have characterized particles, objects, and phenomena that are closest to their scale and location, but we have done a poor job of understanding their fundamental nature. We also don't understand and have not even characterized things we've never observed (the 'black swan' problem).
Is such a timing attack really possible over the internet? I'd expect the code to expire after a few failed attempt anyway.

But I guess you're right, better safe than sorry.
Conservation of momentum is a much bigger deal than conservation of energy. We already know of situations in which energy isn't conserved (like the energy of a photon decreasing when there is metric expansion where it is.)

Conservation of momentum is a consequence of the translational symmetry of physics via Noether's theorem, so that's what we'd need to give up to hope to see it broken.
Can you elaborate on what Kotlin doesn't get right? Surely there's something. Just trying to get a more balanced perspective here.
Windows 8.1 Permanent Activator 2015 by KMS, Daz
Instagram. Oculus. WhatsApp. SuperCell. GungHo. Mojang. Twitch.tv.

It'd be easy to go on. And I'd bet there's no way Valve is just a $1 billion company.
>> No reason to bake it into the language

Go-style channels and goroutines are built on green threads which Go/Erlang has, but the JVM does not have. One way to work around this is to use fibers and continuations which is what Quasar is doing.
True, but I don't think Steam allows you enough tries to make it viable.
If this summer's negotiations were a deliberate chess move, they are akin to manoeuvring yourself into a Fool's Mate.

Closing all banks for the largest part of a month sinks your economy at a faster pace than any austerity ever could. The country was on the path to recovery since last year but this summer has caused another implosion in economic activity similar to a devaluation - all without getting the eventual side benefits of an actual Grexit.
New computer program is first to recognise sketches more accurately than a human
> Every physicist I know loves new physics.

If physicists don't want new physics, they should stop doing research!
When media covers a new model it's Jeep. When they cover a recall it's Fiat Chrysler. Funny, isn't it?
This is funny because I am basically about to try and diagnose a _very_ similar issue with a VPN tunnel between a Cisco ASA and AWS. I'm also seeing SYN/ACK being occasionally dropped and TCP connection states ending up in WAIT state.
You shouldn't. There are fast thinkers and slow thinkers. I consider myself a fast thinker and let my intuition flow through a problem. Then I try to solve it rigorously. My SO is a slow thinker though with an extremely different mindset, we learn physics together. This incompatibility really shows when we are talking about physics, I rely on my intuition a lot, then she asks the hardest questions ever about the most "intuitively simple" things.
What exactly do you want to sync? Is there any data, or is it only your environment?

Almost all the ideas so far mention moving the whole thing with you (usb sticks with system or vm), or working remotely (X / mosh / similar).

There's another possibility if you don't require any (or only static-like) data to be migrated - use some system which can be updated / rebuilt in sync. Setup a server salt / chef / puppet and make sure your local machines sync to it periodically. Whenever you need some modification, you have to implement it in your server and push.

Advanced version - implement it over something like NixOS for consistent builds.

Pros: anything fails - just rebuild it (even remotely if you can set up the satellite servers to boot over network); you won't forget your physical media; you can update all machines at once; you can store all configs in a repo with full history; if you need per-site specialisations, templates are great for it

Cons: if you need to sync any large chunks of data, this is not a good idea anymore
Annoyed by Mobile Sites That “Ask” You to Download Their App? You’re Not Alone
Try it out here: https://jsfiddle.net/valgaze/wpL2La7d/

If this is in fact how how things worked, what a great showstopper bug
Social-Engineer Toolkit (SET) V.6.5 -Mr Robot- Released
git and tmux are my main tools for multi-site working too.
Might have been validated in step1, but the email goes out to the email in a hidden field in step2, etc.
Show HN: A documentation solution that links to your codebase
The advantage of performing superoptimization on IR level is that you have explicit data dependencies (due to SSA form). Thus you don't have unrelated instructions in between. Figure 1 of the cited Optgen paper http://pp.info.uni-karlsruhe.de/uploads/publikationen/buchwa... shows an example that can be optimized with IR-based superoptimization but not with a machine-specific one.

In summary, no approache subsumes the other one. Thus, it is worthwhile to have them both.
That has been removed from the Scala standard lib and is now distributed separately. I am unsure how well it will be maintained by the community. As the other commenter said, parboiled2 is a good choice using macros and it is lightning fast. A lighter weight, runtime choice that was released recently is fastparse[0].

0 - https://github.com/lihaoyi/fastparse
at least in germany you have to go no where. You just register online at DKMS and they will send you a Q-tip to collect a bit Saliva of yours which you send back (free shipping). So it's no work or costs at all
Ask HN: Replacing a tech co-founder
About us:
Setup a business 18 months ago, and incorporated 8 months ago. I'm the back end tech lead (and business, marketing, etc), and my co-founder is front-end. I'm appalling at front-end/design. Co-founder is going to exit soon - he can’t commit much beyond september, so we’ve agreed he’s going to hand back probably 50% of his stake, keep the rest for recognition of the work done to date, and we’ll go our separate ways - this is all fine and amicable. (Not sure if relevant - front end has just been rebuilt in react.js) There are two other people knocking round with small equity stakes (currently 10% each, about to be reduced for a variety of mutually agreed reasons), and me and the other main co-founder each have 40%.

About our position: We have early non-revenue traction, and a reasonable understanding of who uses our system and how - we're building pay functionality now, and will land it in a few weeks time - the idea was to run that out till Christmas, and then evaluate whether or not to continue. (With hindsight, I would have done this last year, but you live and learn.)

Question: what should I do to replace him? I have two needs right now - one is for customer relationship marketing while I build back end, and the other is design/front end stuff - but that should diminish once this build is landed in September.

If I need to find another ‘front-end guy’ for this - would you go and look for another ‘co-founder’ type to replace him (bearing in mind I’ll have 70% ish of the company to play with in terms of equity), or would you go for ‘employee number 1’ type approach? This will be a sort of 5-9 gig, and unsalaried until we hit funding post Christmas (which now that my partner's leaving is definitely the plan - he wanted to bootstrap the whole way).

I think what I need is the marketing guy (significant options/ equity) to replace me, I'll do front-end maintance, and post-funding hire a salaried front-end dev -thoughts?
If you get hacked from a machine your previously authenticated I guess Steam guard will not work.
Secondary skills for software engineers
It depends who your end users are. If the people responsible for running the code do it as their full time job, then yes, bundling the dependencies is more practical because you have a team of full-time engineers to handle security updates, rollbacks, etc. But if you're pushing it out to people who expect to just be able to fire and forget, not relying on your distro to manage dependencies for you is going to result in a world of hurt.
Debs and Rpms are fine for configuring the machine, as soon as you have it where machines and application services aren't a 1:1 relationship that will lead you in the direction of dependency hell. As each application will want slightly different versions you'd have to be very careful which version you installed.

You can cheat a little. For example I am using some system debs for python packages, but if there were more than a handful of python utility packages that can get unmanageable fast. That leads naturally to the fat jar/virtualenv/static binary approach with manually managed dependencies which gives you isolation between applications, and all the associated costs.