skysight-inc/HackerNews huggingface dataset:
No, the vulnerability is in the firmware doing nothing to ensure that the code it's executing is unmodified. This part of the attack isn't possible on systems that have UEFI Secure Boot enabled - once the option ROM is modified, the firmware will simply refuse to execute it.
> Words take on new, unintended, and incorrect meanings all the time. It's how language works.

No, that's how marketing works. We are developers not salesmen. and as computer scientists respecting other science branches is a duty. Using the expression "isomorphic" in that context is just confusing. And it makes developers sound like they haven't a fn clue what they are talking about.
Just putting a live link to that commit here:
https://github.com/facebook/relay/tree/2a86be3e71cdc6511fa99...
Man, all this shitting on young people is getting tiresome.
I can. It's long and tedious, because a lot of it is very simple things you learn very early on writing and maintaining software.

You seem to be arguing that your example demonstrates the fact that you can localize a bug in the code with binary search; specifically that the bug must exist in either a() or b(), and that running them independently is both possible and will determine the single location of the bug.

This is not true. It is only true in the case that one assumes bugs must have single locations, and that those locations can be found with binary search over what amount to incomplete programs. In other words, you're assuming the prior, begging the question, etc.

It's tempting to say "real code isn't like this contrived example" but in fact this contrived example is the best possible demonstration of why blind binary search is a poor strategy. Let us say the 'bug' exists in a(). You seem to be assuming this is the necessary consequence:

main () { a(); b(); } -- segfaults
main () { a(); /* b(); / } -- segfaults
main () { / a(); / b(); } -- doesn't segfault

But this isn't the only possibility. With the bug existing in a(), you could also see this result:

main () { a(); b(); } -- segfaults
main () { a(); / b(); / } -- segfaults
main () { / a(); / b(); } -- segfaults

You would expect this in situations where b() uses data structures created by a().

We may also see this result, still assuming the bug exists in a():

main () { a(); b(); } -- segfaults
main () { a(); / b(); / } -- doesn't segfault
main () { / a(); / b(); } -- segfaults

If above we learned nothing, here we've actually got a falsehood - our binary search has localized the bug to b(), but it actually exists in a()!

So, in practice, binary search fails to localize a bug in a(). All of these situations can be created by having a() write a global which is relied upon by b() - a() may write to a protected area, b() may have a default value, a() may write nonsense, or pass an integer where b() expects an address - none of this is particularly exotic, they're all the sort of things you get every day when debugging segfaults.

We might now delve into a competing series of contrived examples of a() and b() and argue about their relative prevalence in the world (which none of us are capable of knowing), because if some case is particularly rare, it may make binary search very slightly better than flipping a coin in this case.

Instead, I will point out that this is once again* assuming the prior, and that we have these simple (if shockingly annoying) facts:

1) side effects exist
2) in the presence of side-effects, binary search cannot predict the location of a bug.

And it follows that in the sense that a "scientific" hypothesis has predictive power, then binary search over the codebase is basically the homeopathy of debugging.
Isn't this the premise of Conservapedia. It doesn't claim to be biased, but to be free of the hegemonic liberal bias of Wikipedia (and academia, business, most forms of religion, etc).

There is no trusted source for everyone. Anyone with a bias they can't get into Wikipedia is free to spread FUD on the egregious nature of its biases and misinformation.
Better title, from the text of the article: Expressed Homicidal Ideation in Workplace Bars ADA Discrimination Claim.
"I work at Moat... an ad analytics company"

I get that you're just promoting your blog, so this is probably unwarranted but... why should anyone care what you think?

Or - also true - why should I trust you to be objective about your life's career? To not actively lie to me (or include me in your self-deception)?

Marco posted a well thought-out piece about the evolution of web advertising. Your solution seems to be "market incentives will sort it out."

Not compelling.
The first step is to just stop feeling guilty about doing what you want with your own property, and then you don't need to bother with these huge rationalizations either way.

Would you support a law that made it illegal to run ad-blocking software? Why or why not?
Ask HN: Is my landing page too technical?
I would love some help with my landing page. My target audience is small to medium sized businesses that don't want to deal with their website problems...so non-technical people. I'm afraid it's too technical but I am not sure how to improve the copy.

Any help would be greatly appreciated!

http://ninenineteen.co
it's only what I already know, Javascript and HTML

But it's not. "className", much?
The spreadsheet links to Vulnerability Note VU#582497 (http://www.kb.cert.org/vuls/id/582497). This links to additional information in CERT Oracle Secure Coding Standard for Java (https://www.securecoding.cert.org/confluence/pages/viewpage....). That states that a compliant solution example may be found in "Android Application Secure Design/Secure Coding Guidebook" (http://www.jssec.org/dl/android_securecoding.pdf). Which is written in Japanese.
I think the sweet spot is going to be a Trader Joe's-like online brand. Good quality, organic options, low prices, curated selection. Instacart, GoodEggs and others are missing the mark.
I have a few comments on this one

1. It looks awesome in terms of UI
2. The webpage looks great and explains everything I wanted to know.

But when I looked at the source code and saw Java I was deeply disappointed.

I use Java a lot, MapReduce, Pig, Storm topologies, I love java but I would never use it on a server.

With every open source project adoption is super important, having Java on the server is a big ask when you want someone to try your project out.

One thing that will help a lot here is if you have a Dockerfile on your repo, this way people can build and deploy it easily. I'd even go as far as creation a chef recipe for it. Those can seem out of scope, but can help a lot.

Anyway, this seems like a solid piece of open source. Awesome
Distributed Voting on a Hackathon Results via Blockchain
One of the problems is this idea that opposition to GMOs and growth in demand for organic food is fueled by scientific illiteracy.

There an oft-repeated lament of "I can't believe people think GMOs are unsafe!", but why not instead start by asking why purchases of organic food increase alongside increased education level?
Yeah, we're going to have to start arguing on what to name the hybrid soon, since 'Vopus' is already taken.
Loops vs. Functional Programming Styles
Well the whole idea of Relay is to couple together the rendering logic of a UI component with the data fetching requirement of the component. So if you change the rendering logic of the component, the data that is fetched from the server will also change with it and you'll never be over/under fetching data.

But inside the UI component you're really just defining the schema of the data to be returned from the server, you're actually implementing how to fetch that schema from the database somewhere else in your codebase.

Clojure 1.7 introduces a new file-type with extension .cljc that can load in both Clojure and ClojureScript. Which means you should be able to define both your React component AND the Server side implementation of the data fetching schema all from one file. Pretty frickin' cool if you ask me. One file, one component, that knows how to render itself, fetch it's data and serialize it's data.
Of course it is different. GET is meant to retrieve a specific resource.
Search results are not a resource, they are computation result.

Also, how would you specify the query and search options? Mix those in query
string portion? Or encode them? (And how?)
Well said, and honestly, I think this goes deeper than just CS. It's probably a shitty thing for me to argue standing here with a BA, but I don't think the vast majority of people earning BA's today are actually using universities and colleges for what they were designed for. We need voc-ed and technical schools to not be shameful any more. There is nothing wrong with wanting to learn how to code without wanting to learn higher level mathematics along the way.

I promise you that not every electrician understands the subtly of homogeneous layers in high frequency integrated circuits. Nor do the vast majority of people actually building things with computers need to understand the draw backs to using a binary tree over a hash table. Sure, it'd be nice to be curious and want to learn more, but you don't need it to be competent.
Just in applying Occam's Razor, it's more likely Google got the idea from a world-famous author who used that exact naming convention as her book titles, than being tangentially inspired by your less-known group.

Speaking of tangents, did you create this account merely to make this post? Your account is 16 minutes older than this thread is.
I am familiar with what Monsanto does and have pretty much agreed with GP. I am also familiar with the anti-science youtube documentary watching, "do-your-own-research" conspiracy junky crowd accusing strangers of being shills on public forums. Your profile is blank so that is all I have to go on as far as "what you do".
In my world view, there's nothing ethical about laying claim to all future work output of my own in exchange for incorporating any amount of copyleft code.

So you're saying that you don't believe someone can ethically sell their own work at a price they choose?
(lol)

By cutting interest rates to... what?

You want to see hoarding? Try negative interest rates. What happens again when you lower the price for something?

Whatever. We deserve what we get.
I think the fact this violates the standard would be the greatest difficulty.
If the dialog never appeared before people will notice it.

If the dialog has OWN POSITION in big red blinking letters they will understand.

Never firing on your position can cost lives too.
I agree. I've generally been part of groups that were very mixed as far as culture, sexual preference, or skin color goes, and most of our interactions went well beyond 'micro-aggression' right into overt racism, misogyny, anti-semitism, and whatnot. I've found that the more mixed the group was, the more of this kind of stuff happened and the less sensitive people seemed to be about it.

And to be clear, that's just an observation. As a white, male, highly-educated person I try to avoid judgements or too many opinions on this issue.
As a person who does not always want or need to install another VCS tool (Bazaar) I have created a cloned copy on Github (I'm sure others have done so as well but they haven't posted here yet from what I could find). Enjoy! https://github.com/stevegood/filesync-server
This probably happens quite a lot. Not every subject in Wikipedia will have a vigilant editor.

There was an article about ships owned by a major commodities trader dumping poison in the ocean, and they got their PR company to edit the article. I'm quite confident this is actually true because someone (inside) alerted me to the guy's name used to edit Wikipedia, and then showed me the PR company's people page.

Hard to see what can be done about this though. If someone is being paid, they have a lot more time to cleverly word their story. In some cases legitimately, in others not.
Or better yet - they got it from Picture Dictionaries.

A is for Ant, B is for Bear...
I saw the name "FirmWorm" used for this vuln.
The Amish don't go around reenacting the various Anabaptist slaughters of Catholics from the 16/17th centuries either. So, we tolerate their views because they're pacifists, thus are not a threat to society at large.
Possibly. I mean, what is this "wordpress" thing? And what kind of website do I get? Isn't wordpress a blog thing? We don't want a blog! How does it look like? Who designs it? Maybe people asking some of these questions are not your target group, but then it should be clearer somehow what you offer and what you DON'T offer.

Giving the technical details is probably fine, they should be somewhere easy to find, but some basics seem to be missing.
OT: At this point, I am so confused at what "drinking the Kool-Aid" even means. People on the Internet seem to use it for every meaning possible. I was surprised to see that it has its own Wikipedia: https://en.wikipedia.org/wiki/Drinking_the_Kool-Aid.

And it seems like you mean exactly the opposite of what you've said, based on that definition - you're not drinking the React Kool-Aid, or drinking the anti-React Kool-Aid.

I'm not trying to impose grammar OCD on anyone by any means. Like I implied, I'm probably one of the more ignorant people about these phrases. I just think it's confusing when people say things like "could care less" and "drinking Kool-Aid" when they actually mean the complete opposite. It's very bizarre to me but OTOH I guess it's fascinating that English is just that flexible.
Bonanza: Async friendly autocomplete module
> But they did say "g is for google", etc. which is our stuff again.

If by your stuff you mean "something enormously common in our culture that long predates CampaignRunner", then, yeah, "<letter> is for <thing starting with letter>" is "your stuff".

Heck, even companies using it specifically to promote things they do is much older than CampaignRunner; consider, e.g., the Shredded Wheat Company's 1920s alphabet cards. (And that's just an example, the promotional technique is older [0].)

Probably nearly as old as the technique of using a spurious claim that some entity that's getting more attention than you stole something from you as technique to get people to at least momentarily pay attention to you...

[0] http://www.hagley.org/librarynews/alphabet-advertising-alpha...
Also I don't think the templating language has anything to do with the nature of blocking vs non-blocking data fetching.

The previous commenter was specifically talking about the issue where the client side of an isomorphic application can "show the view with a 'loading' indicator", but generally the server is not able to stream out the full HTML until all data has been gathered and processed. The templating engine that I mentioned has a solution to that specific issue.

For example, in the first link, you can see that even though the template is rendered on the server, and has a data source with a 3 second delay, it does not prevent the rest of the template from being rendered and sent to the client, and includes a "loader"-like message (you could easily plop a loading gif in there instead of the textual message in the example).

So it does seem relevant to me.
It rocked my world. We don't live in the Atomic Age, or Computer Age, or the Age of Democracy.

We live in the oil age.

And the rapidity with which it arrived following Colonel Drake's well is staggering.
Apple refused to release QuickTime 6 until the MPEG-LA licensing for MPEG-4 was changed. This supports the claim that codec licensing has always been a contentious area.
In this case, the argument is easily made that a domain name is even less important because the company in question is Google itself.
It's funny you should mention Netflix. They demoed something called Falkor two years ago that is/was extremely similar to Relay/GraphQL. It's unfortunate that it's made so little progress in the past two years, but it wouldn't surprise me of the talks on Falkor had influenced or inspired Facebook's implementation.

For those that want links:

https://twitter.com/falcorjs

http://moduscreate.com/falcor-mvc-for-an-asynchronous-world

https://www.youtube.com/watch?v=z8UgDZ4rXBU
This is a form of corruption. It's power being used solely for the benefit of the one who held power, and it (minimally) damages the rest of us.
Edit: Will post on Friday =D
It is killing me to discover this at work - I only have time to read the abstract, can't wait to read this at home.

Not super shocked to see that read disturbs are a rare cause of field failures, just because I wouldn't imagine any of the data Facebook uses would sit still on one drive long enough. I would expect them to fall victim to failure modes like retention errors, since they're probably running these drives really hot, and using some of the most cutting edge technology possible - MLC, or maybe even TLC, where the margins of individual energy states isn't so high.
That blog is wrong. The program won't be undefined( unsigned wrap is defined ), but the offset will not be correct.
Oracle yanks blog post critical of security vendors, customers
Previous discussion: https://news.ycombinator.com/item?id=8508923
ECC signature verification is slower and big resolvers are complaining about it. Ed25519 is faster than the equivalent P curve but it's still slower than log-based crypto.
>And doing so means you're perpetuating the problem.

What problem?

Why the double standard? Why is your CoC fine and dandy and mine is not? What of the people who don't want to waste time litigating sociology and who want to code? Why can they just "go away" as you say and people who want to muddy coding with other non-coding interests not?

My entire point was that there are plenty of communities that don't need this, and so far, you've not shown that the problem it sets out to solve actually exists outside of a few well-publicized outliers.

>I did. Contributions welcome; hateful behavior not.

So is Linus' behavior hateful or not, by your definition?

>There are myriad sources and firsthand accounts available if you look, and the numbers from that particular presentation are (to the best of my knowledge) based on a direct study.

Which study? There are many, many studies that detail the behavior in online communities (and given my recent courseload, I'm familiar with more of them than I'd like ^^). Which one were those numbers pulled from? Nobody knows, because the author didn't bother to include that data.. This is why cites are important.
ASP.NET is not oldschool - it has MVC (with best templating language - Razor), real time with SignalR. Stop living in Visual Basic and Web Forms age...
I've created a vanilla fork on Github for this very reason. I really have no desire to use Bazaar or Launchpad to maintain code. https://github.com/stevegood/filesync-server
http://www.w3schools.com/jsref/prop_html_classname.asp
Are we saying you can no longer commercially develop a video codec?

If it's so good for the industry, the patent holders could just choose to make it free. Everyone else could choose to :gasp: pay.

I actually agree with your point. I just want to make it clear what that means. When it comes to patents, to me a compression algorithm is the closest thing in software to a mechanic device. At that level could patent equivalent ideas as hardware. Are we saying no more patents on mechanical inventions or hardware?

For a long time I've thought that the patent office letting crummy patents through as being a separate issue than having patents at all. It also never made sense to separate out software patents from anything else.
does it have recording capability ?
I appreciate the idea of going after a very strong mandate. If he runs that way, and wins, he has a very convincing case that the people want him to make the reforms he promised.

But, it also makes it very hard for him to win. He has to find a running mate willing to play second fiddle, but also strong enough to win on his (her) own, because everybody would know that voting Lessig-Foo really means voting Foo-for-President.

Sounds like a recipe for failure.
Looks nice.

I'm currently working my way through a Whitelines spiral bound graph paper notebook that I'm pretty pleased with.
A trading account is much like a bank account. You can't just open a whole bunch of them, it takes a fair bit of documentation. And there's only so many banks you can do it with. You'd have to draft a bunch of people and send margin to all the accounts.

Perhaps a smarter thing to do would be to try to drown out the profits with noise from a market neutral basket. A gentle updraft in the PnL would be much harder to detect, and compounding would mean you'd get pretty rich anyway.
In general, you're right.

But I think you're underselling the value of pure computer science compared to the software engineering discipline. Physicists don't have to go into academia, they can ply their trade applying physics, collaborating with engineers on the cutting edge of semiconductor manufacturing, aeronautics, space exploration, and so on. Before a field is ready to be turned into engineering, the early work is usually done by physicists.

Sure, there's hopefully no need to account for novel physics when you're building a bridge - all the theoretical models engineers need have been worked out long ago (by physicists). But if those same engineers were working on a space-elevator? They'd bring along some physicists to help figure out the new stuff they were going to encounter.

The same applies to the software domain, too: before something like deep learning can be engineered into regular products, it's going to be computer scientists who work out all the details - and not just in an academic environment, they're doing it in industry, working with engineers to turn theory into practice.
I don't see how you can say that you make of point of listening to people who have more of a stake than you, then in the next breath dismiss a group that you know exists (underprivileged white males).

Geekfeminism wiki is a political organization, they're not a source I would trust.
I've been running a forum since 2007 and Adsense was the boon that paid for my university and made me money.

I don't think I'll ever ask for donations again. Plopping a donation button on a website seems to do nothing but make users assume that other users must be donating.

I've never seen donations go anywhere without active hustling/fundraising which makes the website feel like a desperate church. Look at how much effort Wikipedia goes through to ask for donations. And after all that work you'll always make less than you would with ads.

Meanwhile, sticking Adsense code on a website makes you passive money that's less annoying to your users than a donation campaign.
This templating language even adds HTML-like attributes! What a mess.

<ul>
<for each="item in items">
<li>${item}</li>
</for>
</ul>

I have no problems with a mess that looks like that. Anyone on my team could pick that up with no problems whatsoever.
You are correct, the HD page lists 124 shower heads as "in store". And even then I'm sure it varies store to store.

My comment was more to say, $250 isn't a crazy expensive shower head. I wouldn't consider it to be in the elite category only accessible to the world's 1%. Even at $400 (the eventual retail price) it's not bad. HD has nearly 200 shower heads between $300-$500. Restoration Hardware has a similar shower head to the Nedia (minus the small droplet water) for $1000 and Restoration Hardware exists in many malls around NA (https://www.restorationhardware.com/catalog/product/product....).
Maybe. I used them through college some 20 years ago prefered the same for years afterwards but have switched to yellow legal pads for temp scratch surface and https://workflowy.com/ for note taking. Not sure why, but I like the yellow.
You are trying harder than Occam would have liked. Who in the history of copycats has admitted to the act? The history is full of just the opposite cases though:

http://www.imdb.com/title/tt1054588/?ref_=nm_flmg_act_19

Yes. And your account has no posts but plenty of comments.