omgitstom

Scientific journals don't always contain articles, or papers.

My understanding is being published on arxiv.org does not mean it is currently in a scientific journal. Being in a scientific journal does not mean it is on arxiv.org.

But, being published on arxiv.org is usually a precursor to the journal publication, passing peer review and the journal 's standards.

Really confused about what they are attempting to test under the tabletop configuration.

It seems like their hypothesis needs to be tested in the middle of space away from the gravitational force of the sun and earth. If your calculations are off by a factor of 10^120, then making the test 1000 times more sensitive isn't going to help either.

Wouldn't scientists have had evidence of this being the case with the pioneer 11/10 anomaly? There was a slight deceleration that couldn't be accounted for, if dark energy was present in a vacuum wouldn't the pioneer probes (and the voyager probes now) show an acceleration that matches initial calculations?

They have removed the last piece of the hassle of shopping. Now you don't need to even get your computer out and search your past orders.

In all honesty, I don't think I would use the buttons though. The API is the important piece. I could see me configuring this with IFTTT do button or something. Do things like order a week of groceries when I know I'm going to be home for a week, etc.

I'm sure people are going to hate on these buttons, think of the API here.

bcrypt is only strong if their cost / work-factor is set correctly

This!

Even though I don't think this would have proactively helped this DDoS, but it can't be closer to the truth.

CDNs hosting libraries / fonts / resources for the web are going to be targeted more and more, it is just too attractive to malicious people.

I just worded this incorrectly. I'm sure Kevin is skilled. Being famous for hacking doesn't mean you are a skilled hacker. This is the way the article was phrased. Then they went on to say pen testing and have 100% finding vulnerabilities makes you good. Again, another false point. Thanks for your view of the article though, I'm always curious on other peoples views :)

This article is interesting. He isn't world famous because of his skill, he was world famous because he was caught. Being famous does not make you a good hacker, the best hackers will never be known.

I would be surprised if any pen testing group didn't have a 100% success rate. When you hire a pen tester or contract it out, the amount of information you get is absurd (but prioritized by severity).

Has a pen tester ever found a system that didn't have a vulnerability?

Why JSON in the url as query parameters?

What benefit do you give you API caller?

What benefits do you give browser / caller caching for GET?

It really feels like they needed to get some content out for some reason, and just found some post in some internal dropbox wiki and posted it. Maybe they posted a draft by accident? I dont know...

Maybe his flyers are biodegradable made from plant cellulose. You never know!

I'm pretty sure this has been discovered years ago. Or at least my brain is convinced it was.

Edit: Just saw the authors notes that this may have been found before... If anyone is curious, I found the one of the original reports on this:

https://sviehb.files.wordpress.com/2011/12/viehboeck_wps.pdf

"The drug, called aducanumab, appears to have met or exceeded Wall Street expectations in terms of how much the highest dose slowed cognitive decline. However, there was a high incidence of a particular side effect that might make it difficult to use the highest dose."

There is so much that scares me about this statement.

Wow - blast from the past, I loved descent 1 and 2. I thought this was going to be a new / digital version of the board game descent though.

Don't know which I would be more excited about.

I've always had these assumptions:

If you open an html email, you are being tracked.

If you click on a link in an email, you are being tracked (plain text / html)

Is there any email clients someone can recommend that force plain text in multipart emails? Or convert html emails to be viewed as plain text if the email isn't multipart?

Yea, that's why I put it in the comments. I'm surprised it didn't get down voted quicker.

Edit: Point being that people might still want context even if HN frowns upon gawker

Thanks for the laugh, definitely know that feeling!

This is an interesting downgrade attack for sure. The author didn't bring this up, but this will probably work around HSTS if you have your site set up and preloaded into the browsers HSTS list.

As a follow up question, has anyone thought / worked through support both HTTP/1.1 and HTTP/2 simultaneously?

I'm having a hard time understanding the argument.

Let's say I have a site that uses best practices for HTTP/1.1, and loads within 2 seconds without caching. It sounds like the article saying that switching to HTTP/2 will make my site slower.

What I've read so far in other places is that the site should by default (no modifications) be faster, it is just wont be optimized until I remove all my hacks for HTTP/1.1

This is one of my biggest problems with the software industry. It isn't just the posts, but the tooling / utilities / frameworks / languages as well. If you are smart enough to improve something, there is no fame in contributing to the open source project, some people would rather just re-write their own and attempt to force it down everyones throat.

It would have been nice if he proposed something innovative moving forward, but this is a step back to RPC-structured APIs. After reading this though, I had to check to make sure it wasn't April 1st.

Author here - let me know any questions. I'm happy to field them

#putsonconspiracyhat Or someone knew the statement was made, understood his position, and he was took out to make it look like it was Putin

Nope, thought the same thing. I had an awesome Duke Nukem 3d site on geocities. It had gameplay tips, easter eggs, and tips and tricks on how to build your own maps and scripts for Duke Nukem. This may have been my first attempt at programming, and was easily my first glimpse into network protocols

This article hits close to home.

I spent a day at Oculus when they were evaluating my product (pre Facebook acquisition) and we were able to play with some of their prototype headsets. They had games, space sims, etc to check out. But the most shocking simulation was just a bedroom, that was detailed out to the 9's. The developer was articulate around textures and shades and it felt like I was in a real bedroom. Taking off the headset, I felt shocked that that I wasn't removed from my virtual world, it felt like an extension of the real world. It really made me question what reality was and how sensory organs can be manipulated to the point to think something is real when it isn't.

Another example is I am starting to feel a connection to digital bits that probably shouldn't exist. I have built systems that have drawn a connection to my identity through media that I collect. This system has been up for 8 years (over a quarter of my life) and it has recently had a catastrophic failure. I genuinely feel sad, and feel that I am missing a piece of myself, my identity.

I agree with the article that virtual worlds, social media, and digital identity are skewing perceptions of reality. It will be interesting to see what is on the other side of tunnel of these advancements. Hopefully it will improve humanity and reality, not cloud or hurt it.

Man - this guy might have the best title I've seen in a while:

Daniel Nazer Staff Attorney and the Mark Cuban Chair to Eliminate Stupid Patents Electronic Frontier Foundation daniel@eff.org

This isn't just a problem with just universities. I have a card reader as well, and any site that issues swipe-able ID cards is more than likely susceptible. You would be surprised how many use an incrementing ID that you can easily impersonate another user.

The equipment needed to create fake cards (not just blanks) that look good is trivial to purchase.

I would be curious if OSU built or bought this system to issue cards. If they built it, shame of them. If they bought it, shame on them as well. Any security audit would have caught this clearly. Cards like any interface require good design for use and security.

It is amazing that the % of traffic using IPv6 is higher on the weekends... I wonder what is causing that cycle

Interesting article, I was hoping that dark matter would prove to be observable in our solar system.

I'm more curious about dark energy though. Hopefully in my lifetime, we can figure out what dark energy is. I'm curious what dark energy does to time since it accelerates the expansion of space. The next golden age of science resides in our understanding of the unknown matter and energy that we are currently observing.

Yea, I feel you. I used to live in DC and had a few friend that worked for the patent office. Hearing the stories about how things work internally made me lose all faith in the patent system.