guidovranken

That is a gross medical crime.

All the criticism on Bitcoin would be a lot more reasonable if banks weren't increasingly unbanking dissidents (and central banks weren't printing civilization into poverty).

The window of acceptable speech is only going to narrow until everyone is toeing the party line in order to have access to food, shelter and banking. Until they introduce mandatory internet passports I will happily take the insane volatility of Bitcoin over kowtowing to stern ideologues advancing towards their goal of absolute conformity under the banner of tolerance. It's trans/feminism today and some arbitrary other thing tomorrow but the common denominator will always be exploiting our culture's unassailable values like tolerance, sexual freedom and racial guilt in order to justify any measure. Even if this appears to be a honest intervention for the betterment of society, it should be clear from the nature and trajectory of contemporary social justice activism that no amount of conformity will ever be satisfactory, and everyone will be crushed by this machine.

You can try Reddit r/AskDocs/. Usually actual (confirmed) physicians respond. It's worth a shot.

It's a great question, and I don't know the answer. A browser is a very complex application which requires many FTEs and millions of dollars to develop and maintain. Donation models don't work well for open source, there's no way individual users will be contributing (in aggregate) millions of USD for a browser. There are various forks of Firefox and Chrome but I am reluctant to use those because they may be out of date or its developers might have financial or other incentives to install telemetry or backdoors. Previously, an ideological, established and proud institution like Mozilla could be trusted to an extent to refrain from such things. A subscription based model might work but it's hard to say if there's a market fit, as the qualms that HN users have over Google's monopoly are not shared by the population at large, who just don't care or even know about these things. A strategy I have been pondering is to take a browser and drastically simplify it (just the rendering and networking, no JavaScript/WASM, audio/video and APIs) and iterate until it's finished and secure; this ought to be manageable by a modestly funded small team of developers. Then use that to browse the web where I can, and use Chrome for websites that require the full browser stack like Youtube. It's a step backwards but this is where we are.

> your worth is determined mostly by whether someone gives you a chance, which depends on your skin color, location, and last name, aka luck.

Nonsense. If you can code, you can start next week. You can set up a website and start selling things. If you make good music, people will come. If you solve a problem that saves people time or money, they will buy it.

Apart from people like you, most people don't care all that much about race.

The west is the ultimate emperor without clothes. 80 years of muh human rights and Nie Wieder and erecting countless institutions and artworks in its spirit, but when push really comes to shove, it's all revealed to be a Potemkin village of grifters and cowards scurrying away and howling along with the party line.

I can't think of a single mainstream institution which has spoken out against the atrocities going on in Australia. The media are deliberately silent on the matter. Don't expect anyone but a few lonesome, throttled Twitter accounts to stand up for you when you're rounded up. The future is very dark and you're on your own from here on out.

This also applies to C++ <locale> functions, like std::isspace.

Another fun one: With FD_CLR, FD_ISSET, FD_SET you can corrupt memory by merely passing a socket descriptor that is not 0..1024. Pass a negative integer for some undefined behavior as well (shift by negative value occurs here [1])

[1] https://github.com/lattera/glibc/blob/895ef79e04a953cac14938...

One of the reasons I don't always read the articles and go straight to the comments is because clicking on a link may result in an ungodly amount of cookie popups and autoplay video's exploding in my face whereas the HN comments are always the same predictable, comfortable web 1.0 experience. Dealing with this is a relatively costly intellectual operation, if you will, and frequent web use has conditioned the cost-benefit tradeoff I make when dealing with links.

There's a video of Peter Thiel from last year where he states that Satoshi attended the Financial Cryptography conference in Anguilla in Feb. 2000. This possibly points to Ian Grigg. I'm inclined to think Thiel has better intel than most people but who knows.

https://www.youtube.com/watch?v=Ufm85wHJk5A&t=2720s

Nice. The Hacker News archive contains a wealth of great information. I've previously performed similar extractions like OP but with grep and SQL. I've also looked for people who have accurately predicted the stock market (I did identify one pro investor. He's now into NFTs). I've found so much cool stuff, spending whole nights looking for interesting users and reading their entire post histories and being blown away by many insightful posts. I've been considering making a blog consisting entirely of insightful HN posts that I come across.

- Tor has done more harm than good for human rights

- Alcohol does not make people more aggressive to a large extent. In the vast majority of clubs/festivals almost everybody is inebriated but violence is fairly rare (in my experience). (I'm a non-drinker btw so I have no horse in this race).

- David Bowie's music is unremarkable.

- We should keep Linux unpopular because the more users it gets, the more malware/spyware/advertising/telemetry it will attract. It is fine where it is now in terms of its userbase.

I'd love to read a balanced biography on Thiel but unfortunately this sounds like it's just more slandering and activism.

Thiel isn't necessarily a good person in the sense that he'd readily share his sandwich with you if the two of you were lost in the desert together, but his unique perspectives on things and his willingness to share them are what makes him quite fascinating.

This isn't just selection bias. At this point you can buy random crypto/stocks/real estate almost blindly and just hold onto it and see its value appreciate more every day. There are occasional dips but on average there's a massive upwards trend.

At least the last times I checked, the WikiData SPARQL server was extremely slow, frequently timing out.

Google BigQuery has the full database, updated daily.

> It's not hard at all to write an emulator if you're not picky about performance.

I'd argue writing an emulator is actually quite difficult. Due to the avalanche effect, slight errors in your emulation won't cause the emulated system to be slightly off, but it makes it completely unbootable, similar to how a bug in a (cryptographic) hash function can make the output entirely different from what it's intended to be. And unless there is an existing emulator you can compare against, debugging such bugs is very difficult and they can only be identified by painstakingly cross-referencing your entire implementation with the CPU specs. Years ago I wrote an Intel 8086 emulator and even the decoding of the instructions was non-trivial: the whole deal with MOD R/M encoding and prefix bytes can take considerable time to get perfectly right. Then there's the timer interrupt system, the IO layer, rendering the visuals by polling specific regions of memory depending on the mode, 80286+ protected mode etc.

I'm fine with that if it happens in a free market under informed consent and for curing real diseases. But big pharma, big media, big tech, government and law enforcement acting in complete lockstep to forcibly inject experimental vaccines into your veins for something that amounts to a bad variant of the flu is something else entirely.

You can take all the shots you want but you'll never be able to move forward with your life.

(Intentionally crafted) large metadata in a video file (which can be very large anyway, so 2GB extra doesn't stand out). A string field in a (machine-generated) JSON/XML dataset. And like tomohawk says, lack of a mechanism that prevents accruing large blobs (for example not limiting the size of an incoming HTTP header in a web server).

snprintf works most of the time but it can fail, and people almost never check the return value. For example it will always fail if you attempt to print a string >= 2GB. If that happens the output buffer may remain uninitialized (depends on the implementation) and you're at risk for a Heartbleed-like scenario.

I understand that they base their research on CVE data because it offers normalized quantifiers of severity and scope, but in my experience vendors by and large don't bother with CVE's for API bugs even when the affected primitive is clearly malfunctioning (memory or correctness issues).

I've been deeply fuzzing cryptographic libraries for a few years and found about 130 bugs [1]. The vast majority of these did not receive a CVE. Now some of these are merely theoretical, others will only manifest under particular circumstances like specific calling sequences, others were caught in the development phase before landing in stable releases, but a number of them are outright vulnerabilities. The usefulness of CVE incidence is questionable when it is so strongly influenced by the vendor's propensity for reporting these.

[1] https://github.com/guidovranken/cryptofuzz#bugs-found-by-cry...

I think there will be a great new way of search and content discovery. Google (as a search engine) is well beyond its prime, it's all spam from page 3 onward. It's still the same system as 20 years ago except with more spam. I think we can do much better through a fundamentally different approach and this is an avenue I'd explore if I were an entrepreneur. Even shaving off a few percent of Google/Bing's market share could be quite lucrative.

First hit on Google for '"indian reservation" pycon' points to a Reddit page which points to https://www.youtube.com/watch?v=bSfe5M_zG2s , which must be it

Site is down, archive link: https://web.archive.org/web/20210602080638/https://sigops.or...

What stands out to me:

- "Mercurial cores are extremely rare" but "we observe on the order of a few mercurial cores per several thousand machines". On average one core per 1000 machines is faulty? That's quite a high rate.

- Vendors surely must know about this? If not by testing then through experiencing the failures in their company servers.

- I've read the whole paper and I see no mention of them even reaching out to vendors about this issue. Their are strong incentives on both sides to solve or mitigate this issue so why aren't they working together?

There's a place for being patient and lenient, but HackerOne consistently seems to not shut down malfunctioning programs that never pay rewards and flat out stop talking to you, yet continue to collect bugs. Such a relationship is commonly called fraud so I suggest reporting HackerOne to the Federal Trade Commission as I have.

The premise of bug bounties is that the reward amount is at the discretion of the program host and that the time incurred by developing a fix will influence the moment of payout, but refusing to pay and even communicate (for years!) for clearly eligible submissions is well beyond a reasonable interpretation of the conditions, and to consistently keep facilitating this abuse is simply fraudulent.

OpenSSL had and has a few core developers from Britain who have made significant contributions to the project. Though there are forks and alternative TLS libraries, most websites in the world probably run on OpenSSL.

Ironic that these far-left "death to amerikkka" hackers are ensuring Twitter retains its de facto monopoly in the microblogging sphere and making its US billionaires even richer.

Woke culture is an abhorrent movement that combines the coercive dynamics of Marxism with the racism of national socialism. It's not about removing racism, it's about consolidating power by forcing everyone into compliance. Actual racial segregation is already happening in the US because of it and worse things are bound to happen. Everyone will be worse off if this is given free reign.

It doesn't work like that. You will be forced into compliance. Try creating a competing social network for example.

Coding and auditing/reviewing demand inverted perspectives on the code (aiming for functionality vs. disfunctionality), and you should seek to synchronize these two mindsets such that you always think a few steps ahead with each statement you write. Cultivating an awareness of the counter-intuitive repercussions of every block of code is a more durable objective than remembering cold facts like password hashing. I personally work a lot with fuzzers and the cycle of coding-fuzzing-bugfixing is a great way to attain this awareness. Letting your new developers fuzz or manually break a prepared piece of code is a good way to let them get a taste for it. It's interactive, engaging, surprising and optionally competitive so retention of whatever they take away from it should be better than listening to a presentation.