wopwopwop

I tried bringing attention to this in https://news.ycombinator.com/item?id=13344039

At least two people replied in the vein of "nothing to see here".

Now they have finally updated their canary statement (this was back in 16 Feb 2017).

They have added the following text:

> Q: Why didn't you update your canary on time in the winter of 2016?

> A: The canary was so broad that any attempt to issue a new one would be a violation of a gag order related to an investigation into a DDoS extortion ring and ransomware operation[0]. This is not desirable, because if any one of a number of minor things happen, it signals to users that a major thing has happened.

So, in my mind here's the lessons:

A) ignore missing canary statements at your own peril

B) orgs that have sloppy canary releases devalue their canary statements.

I haven't read the linked articled (yet), but I wanted to urge everyone to check out r/the_donald. It is the strangest online community that I've seen.

Truth doesn't really matter unless it supports us, everyone who says good things about us is right and everyone who doesn't is a corrupt MSM cuck libtard. To get banned you don't even have to be critical of Trump. If you're even ambiguous you'll get banned. In a sense this is self-selection in that the only people that haven't been banned are lunatic-level supporters.

Basically, it's Donald Trump times 380,000. You have to experience it.

Could someone more knowledgeable here explain this to me? How do you "crack the password using ssh" from a guest VM to the host? That seems to imply that the guest VM and the host were somehow on the same network and the host had a SSH service. Is this the case? And if so is that normal (or the default?) config, that you can network from the guest VM to the host?

Thanks

> In addition to those crimes, it was revealed by an independent court-appointed computer forensics expert, that upon receiving notice of the Oculus lawsuit, the files on Mr. Carmack’s Oculus computer were intentionally wiped–destroying the evidence, and that a sworn affidavit Carmack filed with the Court denying the wiping was false. The wiping occurred right after Mr. Carmack researched on Google how to wipe a hard drive.

Isn't Carmack supposed to be super techie? How does he fall for this?

Is this my imagination, or are we seeing a lot of anti-Snapchat stories lately? It's like Facebook decided to run anti-PR on them lately.

It's a qualifier, bro.

> Nip arguments in the bud, not at the leaf.

I like that attitude.

> Travis is right on a technicality they did not lower Uber Black prices much if any. What they did instead was coerced Uber Black drivers to take Uber X request.

That seems like semantics to me. The pay was lowered.

> This will probably be an unpopular opinion, but I actually thought the driver was exceedingly rude. He clearly took advantage of Kalanick being in the public eye, and thus a "target". Filming him without acknowledging it was totally immoral, it should reduce any fair person's bayesian priors as to the credibility of the driver.

Why? If I were a driver, you can be sure I would be filming everyone. Does that mean I would have no credibility?

Here in London I've assumed that cabs are always filming.

I'm not an expert, but doesn't celery use multiple processes? I hope I'm not saying anything stupid, but I thought that's what "workers" were.

Because crawlers spend most of their time waiting, you might as well use python's gevents.

Question to the experts here:

- What is the relevance of Docker here? I'm pretty sure that celery+rabbitmq are enough to do a distributed scraper...

From your reference

> Then why did recursion work so well with divide-and-conquer? The key point is that in divide-and-conquer, a problem is expressed in terms of subproblems that are substantially smaller, say half the size. For instance, mergesort sorts an array of size n by recursively sorting two subarrays of size n/2. Because of this sharp drop in problem size, the full recursion tree has only logarithmic depth and a polynomial number of nodes.

> In contrast, in a typical dynamic programming formulation, a problem is reduced to subproblems that are only slightly smaller—for instance, L(j) relies on L(j − 1).

I think I got it. The distinction isn't that clear cut anyway. For example, I could implement a mergesort with caching and say that I'm technically doing dynamic programming, even though the cache would get hit exactly zero times. It would sort of be "trivially" dynamic programming. On the other hand, the first time I calculated fibonacci numbers recursively, I've added a cache. This would be "memoization". Or in other words, wikipedia article is correct, but some problems don't benefit from the caching.

Thanks for the references.

uh-oh. Bloat alert.

I think the guy should sue them. He probably lost a lot of money over this nonsense.

It's literally the two things which are mentioned on the opening phrase on wikipedia: recursion and caching.

Maybe you could explain better...?

Thank you for the reference.

I'd never heard of the expression "dynamic programming".

https://en.wikipedia.org/wiki/Dynamic_programming

Am I to understand that it is "just" recursion with caching?

Thanks for the link. However, it seems just a subset of Cormen et al.

Hahaha. Yahoo employees don't read hacker news :-)

He is signalling that he has connections. One day we could be as cool as this guy.

That's a corollary of "no one will prove your statement wrong if you use language ambiguous enough."

Some people talk, some people do.

OP don't listen to the jelly haters. If you were making $100k/mo each of these hypocrites would get knocked off their high horses and copy you. Well done, congratulations!

Like Germany condemning Snowden, but having no problem using his leaks in their investigation of the NSA Bundestag hacking.

It's not a post-truth world, it's a post-hypocrisy world.

> What hash? Nobody even mentioned a hash.

I mentioned a hash. The secret is hashed together with the time. _That_ hash.

> The crypto keys used for U2F are indeed domain-specific, if that's what you're trying to ask.

I know the secret is domain-specific. What I was describing is taking the secret, and the time AND THE DOMAIN and use them to produce the hash. This would break MITM. One of the comments above me mentioned this and I run with it. But you're talking to me like you didn't read anything above....

> Who's "those two"?

Those two are the yubikey and the browser.

sigh read my response to the other guy

I know how it is now, but that's not what I'm talking about. Currently the URL is not included in the hash, that's my point. It could be by having those two talk to each other. Who's the server and who's the client is beside my point.

Very clever, thanks for sharing.

However I wouldn't want my second-factor to be attached to my browser. Seems way too volatile for me. Personally I'd rather keep TOTP and be vulnerable to time-of-use phishing.

Maybe if the browser had an OS API that a YubiKey could query...