skysight-inc/HackerNews huggingface dataset:
You can run this check yourself using the bundle-audit tool. It uses the list of vulnerabilities from ruby-advisory-db.

Checking the git history, I see that phillmv is a contributor to ruby-advisory-db.

https://github.com/rubysec/bundler-audit

https://github.com/rubysec/ruby-advisory-db
I look at my personal 2D printer usage as a guide. I rarely print a anything at home anymore.

If I need a photo, I send the digital images to a printing service and receive a inexpensive high quality prints on professional quality paper, or bound in a coffee table book, or on a mug or birthday cake, etc.

The only time I print anything on my personal 2D printer is when I need it right now. All the while, I hate the experience; it's time consuming and requires expensive consumables.

I expect 3D printing will go the same way. If and when I ever start doing my own personal 3D printing, it will be through an online printing service where I can upload designs and have high quality prints done in various quality materials and shipped to me quickly via Amazon Prime or some other delivery service.
Well, by granular I meant on a per-repository basis, ie. so you could grant an application access to only one repo (If anyone from GitHub is reading this...)
Dat hate
Add a search that isn't terrible and you'll solve most every complaint I have and hear from others about Gitlab.
I used to teach guitar and always had to tell students to practice it slowly, but perfectly first, and only try to speed things up once they had the basics mastered.

Speed is impressive, but you literally have to learn to walk before you can run!
Unless it is directly related to functionality, no.
Show HN: TextTailor.JS Responsive text to fill the height of the parent element
One good takeaway: be slow at things you don't want to do a lot. Be slow in answering the kind of email you don't want to receive again, etc.
I think they mean "only watch Illustrator" or "only Photoshop".
> "you can't point to a particular bitcoin and say that's my bitcoin"

Doesn't every Bitcoin have a serial number, similar to the car's license plate?
It's what ruby uses to "pin" the dependencies for a project.
I don't see how anything like that would become a trend. But I think it makes for an interesting double standard in how we talk about these issues. If a sociologist was to describe a scarcity of sex for men as gender inequality she would be informed that men aren't entitled to sex from anyone and that she is promoting rape culture. A woman isn't entitled to a relationship from men any more than men are entitled to sex from women.
What Steve Jobs Taught Me About Being a Son and a Father
I see that one is 30 EUR, since I'm in the US it would probably not be so cost efficient. The open sourcing is great, though.

The main bonus I get from this CHIP thing is the ridiculously cheap cost for what it gives you. At the very least, the built-in storage and wifi saves at least $15 and some physical space. That's awesome
Record the emails sent from your application
> If you don't want a browser that has some notion of "local file context" you should just sell your laptop and go live in a cave.

Thank you for your constructive advice.

And I note that so far my stuff written in 'memory unsafe languages' has been in production since '99 or so without a compromise to date over 100's of billions of requests.

Maybe it's not just the language.

And what business does a browser have with a .pdf file anyway, where does that end? excel sheets? word documents? proprietary format 'x'? Web browsers should stick to web browsing or at least have a mode where they will stick to just web browsing.
What about Chinese spying? Or the internet propaganda firms in Russia? The UK arguably has the worst domestic spying in the Western world. Rules need to be made on a global scale similar to the ICBM restrictions during the Cold War.

These are not NSA issues its a global issue. What are the ROE for cyber attacks? There are much deeper issues beside the NSA reading my gmail, which I dont mind.

What I do mind is undermining technologies that are supposed to protect us from 3rd parties (criminals and governments alike).
If you have a chair in your front yard, and I walk off with it, that's theft. You wouldn't say "chairs are decentralised and unregulated, you can't expect protection from the government". If I burn it, you wouldn't say "I should have bought regular, fireproof furniture." I can't give it back to you, but I should still compensate you.
Pretty sure physical packets get dropped at every hop!
Super.. good to hear! Ideally the community can get a little more involved in design/UX too. I'm not sure if GitLab plans to set the tone there first - perhaps that's also on the roadmap.

> Would Roboto work, for instance?

Maybe the typeface isn't so much the issue as the layout? On the issue view, comments and descriptions have different positioning and styling. Also, important information lives above the issue title, which is unexpected.

Being unable to trigger CI builds based on merge requests (which can dispatch a build for a commit ID, but you've probably already pushed that commit) is probably the most problematic for us at the moment.

Maybe it would be cool if GitLab came up with some basic design principles/goals and accepted contributions toward that end. I know we'd be interested in contributions here and there to improve workflow/UX.
I'm not seeing the issue. Sorry. I've worked in a number of air-gapped work spaces and each one was also a Faraday cage.

When there are "N" viable attack vectors, you'd better defend against all "N" of them.

Two very simple steps to prevent immense grief are ZERO consumer electronics and ZERO inbound media that has not been thoroughly vetted on an external system (i.e., outside the protected work area).

You can let the engineers do and use whatever they want whenever they want to, but plan for a disaster. Don't trust the engineers (nothing personal). In my experience, they seem to lack the right degree of paranoia about practical security.
You didn't read past the first page. The only userland thing is activating the rootkit.
Aye. I just wish it were different.

Incidentally, I've just come back from the Netherlands, where the rather excellent Rotterdam Museum of Customs had a series of quite nicely inquiring exhibits going into exactly why we pay tax and all the nice things it gives to the Netherlands. I wish my own society (the UK) felt more confident about putting forward a pro-taxation argument. Ultimately, it's a kind of social glue that's needed I think.
Is pyjd dead?
https://groups.google.com/forum/#!topic/pyjs-users/kXFZ2RdR2...
The site could be better but it's not terrible. They have $2 million so must be doing something right
I would love a list of all the excuses, they look great in error pages. I made a quick script[1] to scrape the site, but that's not as nice as a plaintext file that could just be downloaded?

Edit: Here[2] is a complete list

1. https://gist.github.com/orf/87825a18e6685144ae3b

2. https://gist.github.com/orf/db8eb0aaddeea92dfcab
> naming and shaming the advertising network that is allowing this exploit through

The person who found and reported the exploit said this particular exploit did not originate from an ad server[1].

Without disabling javascript, I have always argued that merely disabling 3rd-party iframe tags is a good first move[2]: significantly less breakage than disabling javascript, yet this will effectively step up security/privacy protection.

In the current case, the person who found it confirmed that just blocking 3rd-party frame tags would have foiled the exploit.[3]

[1] https://news.ycombinator.com/item?id=10021894

[2] https://github.com/gorhill/uBlock/wiki/Dynamic-filtering:-Be...

[3] https://news.ycombinator.com/item?id=10022096
Printing out stuff; playing a song; starting a script.
> According to the results, majority of OSS developers neither consider usability as their top priority nor do they consult usability experts.

A rigorous examination of thing's which most people consider to be obvious is still valuable.
NoScript is installed but disabled by default. https://www.torproject.org/docs/faq.html.en#TBBJavaScriptEna...
The presentation certainly makes it seem that way. The dramatic "POC" with the magic number only works with the rootkit already installed.

The proceedings paper has much more detail[1]. Installing the rootkit requires some very careful crafting and requires ring 0 to request memory remapping and set up far pointer descriptors.

1. (pdf) https://www.blackhat.com/docs/us-15/materials/us-15-Domas-Th...
Really nice and straightforward.

Although I'm worried about the part where I'm supposed to install a service monitor on our servers. I know, many people already do stuff like that with airbrake or newrelic but I know that admins get grey hair because of that. :)

You should think about offering an API where the client can upload its Gemfile.lock on their own.
First release of spinach, a Java Disque client
I'm continually amazed by people who think government bureaucrats make better decisions than consumers. Or people who think they know whats best for everyone else. You don't think renewable energy companies also hire lobbyists? Are you so sure of yourself that you know what everyone else in the country should use for power?

You're right electricity is heavily regulated and has been for quite some time. Despite the regulation however most companies generally operate as a lowest cost to consumers basis. Consumers ask for the lowest prices and electricity companies tend to oblige.

When politicians decide they very often have some vested interest as a priority and try to raise rates by handing special favors to certain industries.

What makes you think when politicians make decisions based on whats best for consumers vs. whats best for whoever donated to their campaign? If you think renewable energy companies don't hire lobbyists you suffer from a disconnect from reality.

Also, you didn't argue my main point which is solar isn't competitive to other sources. Should everyone pay more for electricity?
What Happens When You Pay Your $0.19 Amex Bill with 7 Origami Checks? (2008)
Good reporting. Shows how much the EU is owned by the publishing industry.
If you're into PHP, SensioLabs has a similar service you can use in your Composer.lock file: https://security.sensiolabs.org/check

It'll block any vulnerable version of a dependency in your project.
I didn't mean to say anything about collective guilt or merit, but apparently I didn't communicate well; sorry.

In iterated PD competitions, it's clear that none of the programs involved have free will, but punishing defections is still an important part of either a strategy for getting ahead, or a strategy for reducing defections. That is, the programs still have to keep track of the guilt or merit of their peers in order to make decisions about how to react to past cooperation or defection. Regardless of the moral responsibility of humans for their actions, they still have a responsibility in historical fact.
Show HN: mpm – npm install implemented in 80 lines
I see, we provide for now a PayPal button at http://imageplay.io/#feedback
The real story is that if you want the shipment to go where it needs to go you should reprint the waybill with the information on the correct lines.
Protectionism is not synonymous with communism. Most capitalistic countries - including the US - practices protectionism in a variety of ways.
Please find the PayPal button at http://imageplay.io/#feedback
DNS Server and Reverse Proxy for Docker
42x42 seems odd for JPEG, why not something divisible by 8 or 16?
About 16 hours.
Weird, at first it never seemed to run any code no matter what I put in (js/java/python/c++), but after a few refreshes it started to work for me.
X-Powered-By: PHP/4.4.9

Seriously? :-)
Your wording is fine. Parent is being far too cynical.
The US may import crude oil but one of the main exports is refined fuels. We are exporting ~half of what we are importing in July.

http://www.eia.gov/dnav/pet/pet_move_wkly_dc_nus-z00_mbblpd_...
Google Maps’ New “Night Mode” Feature Makes It Easier to Navigate in the Dark
API Spotlight: Open-Source Part Lookup
I'm of the opinion that argument values should never be modified by their methods, because that would result in what I've been calling "backflow" or premature state propagation backwards up the call stack. I think this not only hurts concurrency but also reasoning about the code and its flow. I think any new state should be via a return value of the method and not via its arguments.
Indeed. Contenteditable is awful, especially when collaboration is involved, since different browsers produce different HTML. I wrote a similar rich text editor for the Storify editor when we introduced real time collaboration, about a year ago. We intercept all of the editing events, perform whatever actions are necessary on our internal document format, and then manually sync those changes into the DOM. Our document format is designed in a way that can be synchronized in real time using operational transformation, which is impossible to do with HTML. This is really the only way to build a good rich text editor IMO.

I'm glad Prosemirror was written, since it sounds like it does similar things. Wish it existed a year ago. ;-)
It's funny when I see this stuff here but then I see it in production code and want to flip tables.
When git was still one of many competing DVCSes - I tried darcs, and the CLI was pretty great. Spoiled for ever.
Reach out to people who work in those industries.......... not google.
While other people have correctly stated this point elsewhere in this topic. I think you have phrased it in a very simple and easy to understand way, which I feel anyone not able to understand would not be someone worth having a conversation on this topic with. Thank you for what I believe to be a correct and extremely dumbed down way of expressing the absurdity of anyone getting upset about this ruling. I will be stealing your analogy, as close to verbatim as I can remember, should I encounter a conversation on this topic in the future as it is much easier than trying to explain it in more abstract terms.
Yep! We started that project alongside postmodern_mod3 about two years ago :).

We figured we could do a better job all around if we managed to productize it.
The first page says: "There are two times when Firefox will communicate with Mozilla’s partners while using Phishing and Malware Protection. The first is during the regular updates to the lists of reporting phishing and malware sites. No information about you or the sites you visit is communicated during list updates. The second is in the event that you encounter a reported phishing or malware site. Before blocking the site, Firefox will request a double-check to ensure that the reported site has not been removed from the list since your last update." That seems pretty reasonable. But the second one looks like it checks every executable file you download. Why isn't that mentioned on the FAQ?
I was thinking this, too.

I can't imagine anyone--even those from out of town--thinking that walking 3-4 blocks to a subway station in NYC is too far to handle.

Re: another comment, the Paris Metro _is_ dense enough to work in the city proper - but only in the city proper. A side effect is that the service is super-slow except on 1-2 lines. The slow speed makes it nearly impossible to expand to the marginal/suburb areas, so you wind up with a similar situation to New York's outer boroughs.
American trade laws do not hold consumer freedom sacred. America has lots of protectionist policies - including a related one on trucks: http://www.npr.org/sections/money/2015/06/12/414029929/episo...
Twitter now has Premier League emoji
Yes, increased blood flow is integral to recovery. Ice slows that down. However, icing is not categorically bad. 10 minutes in an ice bath does wonders at helping to dispatch the lactic acid accumulated during a long event.
You did that in what code?
Bikes and Hikes LA
It isn't easy and it isn't fast. If your job supports you living on your own and you can start taking a class or two, that's how you start doing it.
39.0.1 and 39.0.2 fixed serious regressions in Firefox for Android in some configurations. They weren't security fixes.
I'm no expert on bitcoin, but as I understand it, the answer is not really: bitcoin works by numbers, but they are not equivalent to the serial numbers on dollar bills, more like rough equivalents of bank account numbers, login passwords and balances.
Preload Hints for Web Fonts
For task management you can use the build in issues and tools that integrate with that https://about.gitlab.com/applications/#scrum-boards

Your navigation remarks are spot on and inspired me to make this issue https://gitlab.com/gitlab-org/gitlab-ce/issues/2225

Doesn't the lockout expire at some point? I agree it would be nice to reset from the UI.

Mmm, I thought that if an admin added a user they didn't have to verify their email.

Do you mean something like project services? http://doc.gitlab.com/ce/integration/README.html

I agree that your shouldn't change .rb files. Please contribute any improvements you make so we can include them.
John McAfee Arrested While Armed and High as Hell on Xanax
The article claims this exploit leaves no trace, but what about Linux atimes (assuming you don't have noatime set)? Eg. if you found multiple shell scripts with similar access times when you know you haven't worked on them at the same time. If this is a workable method of detection then it would be a good idea to avoid accessing any potentially affected files until you have recorded full access times.
They got responses to 5 questions from 72 OSS developers with projects on SourceForge. There is absolutely no way you can draw any sort of reasonable conclusion from that sample.
Exact dupe:

https://news.ycombinator.com/item?id=9751312
These browser vulnerabilities have got me thinking that I should start browsing in a VM. Has anyone moved to this level of isolation? Steve Gibson on the last Security Now podcast said he's been experimenting with Sandboxie...

Sandboxie looks like a paid closed source solution, I'm not sure they give me a compelling value proposition over something like a light linux distro under VirtualBox.
Zynga Revenue Rises Despite Fewer Gamers
I cannot read articles like this (or the US's weekly "China hacked us again") without just dismissing it as outright propaganda.

First off, let's be absolutely 100% crystal clear about something: the Russian and Chinese governments hack things sometimes (both economic and security related).

That being said it seems like blaming the Chinese/Russian government for random hacks is more a political move (in the USG's continued "China/Russia bad" campaign, since "Communism bad" no longer works as well).

I justify this belief due to three factors:

- The USG is extremely quick to blame them, so quick in fact that it seems implausible that they conducted any type of technical investigation before finger pointing. Under a day in some cases.

- Not every attack coming physically from China/Russia is from the governments in those countries. A lot of lone blackhats exist all over the world, it is insane to assume it is different there. Just as when you see an attack from the US, it MIGHT be the USG, or it MIGHT just be a lone wolf or wolves. People could also be using endpoints located in China/Russia to hide their true origin.

- Due to the way the internet works anyone with some skill can hide their true origin pretty well. We're meant to believe that Chinese/Russian hackers are this uber threat, but at the same time that they lack the 101s of hiding their identity and location. Seems contradictory.

As to why the US blames China and Russia for "hacking" I believe they have two motives (as an over-simplification):

- They can paint these hacks as being highly sophisticated, and therefore avoid the implication that the break-ins are primarily due to incompetence or neglect within the USG (which is almost always the case).

- Keeping Russia/China/NK/Iran/etc on a constant "war footing" with the US public seems like standard operating procedure. I guess "just in case" war broke out, half of the PR is already done. Watching the NBC Nightly news in the US is very similar to watching Russia Today in, well, Russia.
Tell that to everyone who's been in a relationship for 6 months before breaking up because "he/she seemed so perfect when I met them"
No, we can't use a patented method even if we don't sell stuff we make with it.

From the USPTO site: "Patent infringement is the act of making, using, selling, or offering to sell a patented invention...

http://www.uspto.gov/patents-maintaining-patent/patent-litig...
http://pyjs.org/Translator.html

>Overall, the general rule is that whoever wants or needs something, they either work around the limitations of JavaScript and the pyjs implementation, or they contribute code to improve the compiler/translator.

The lament of the transpiler
The bill with a known serial number quits being tangible when you deposit it into an account because you are only owed a bill not that bill. If you had put the bill with a known serial number in your safety deposit box, for instance if it was your first dollar ever earned you could sue for that bill the same way the coin is sued for by stating its serial number, since the bank was storing it as a tangible good, and not simply as a product of its value.
Google Is Going to Limit the Number of Ways Brands Can Buy YouTube Ads
Also, people forget the automobile industry of Japan was beneficiary of protectionism for decades.
Having logical URLs for your search results isn't SQL injection:

https://jet.com/search?term=Sony%20OR%20Samsung

Look, it even guessed the product category based on my search term.

Back in the day search engines used to have these things called logical operators, then basically Google deprecated them.
This is seriously awesome. Great for helping to understand programming conceptually as well as being great fun.

Less nice visuals would be good, then I could make it look like I'm just working.
What did I tell you about using parts of the system you don't understand?

This got a smile out of me.
One way to look at this is that it's part of the CEO's overall compensation-and-benefits package. Instead of paying the money to the CEO and having her (or him) purchase a security service, the company can purchase it directly. And a large company like Apple probably just has part of their security staff protect him.

Losing a CEO is extremely disruptive to any company, and so this can also be seen as a business expense, similar to insurance protecting the company's headquarters building.
Patrick Wardle dropped two Little Snitch bypasses at BlackHat [1] this year.

[1] https://www.blackhat.com/docs/us-15/materials/us-15-Wardle-W... [PDF Warning]
As long as I like that editor, it's not even close to this one.
Nature ambient sounds
Actually list support in numba is WIP
OK, read the paper.

Don't get too excited. From the sound of it, it could be an artefact, those could be harbour walls, but they could also be looking at some nice old karst that happens to have weathered into rectilinear shapes.