skysight-inc/HackerNews huggingface dataset:
Ask HN: How to handle ignored vulnerability report?
I maintain an open-source client library for some third-party APIs. Two weeks ago, I discovered a content injection vulnerability in one of those APIs, and immediately reported the issue to that company. A few minutes later, their head of security emailed confirming they had received the report, and said they would investigate and get back to me.

And that's the last I've heard from them. My followup emails earlier this week requesting a status update have gone unanswered.

I could use some advice on what to do next. Specifically:

1. Should I release a security patch to my client library? And if so, how soon?

It would be easy to protect my library's users from the vulnerability. And it seems irresponsible not to if the company isn't planning to fix the problem.

But pushing a patch would publicly disclose the specific issue. And that would increase exposure for all their other API users (who aren't going through my client).

2. What else should I do before releasing a patch or otherwise publicly disclosing the vulnerability?

I'm confused why they've gone silent after confirming the initial report. Is it unreasonable for me to expect a reply or status update? Should I try to contact someone else at the company?

This is not my day job, and I've already put more effort into this than I really wanted. But I want to be responsible about something like this.

(Also, just to be clear: this has nothing to do with bounties. I haven't requested one, and don't have any reason to believe they'd offer one.)
Competition from China Reduced Domestic Innovation
Those numbers are adjusted to the cost of living in San Francisco, so the comparison is not quite as bad as you think.
I've been using Linux Mint, Debian Edition, for years now. It's rolling.
How to Spot Visualization Lies
Can't browsers provide a service like

txt://example.com

that shows web content in plain text, no images, no javascript, nothing, something like readability but directly without loading the whole page first?

It would also be good for mobile connections.

* Wikipedia should be the first site to offer that txt: protocol, Google second.

* Btw, hacker news is the perfect example of a text only site.
The downside of that is that if your product strategy is beholden to a few early adopter customers then it becomes much harder to make the changes you need to "cross the chasm" to the mainstream market.
For rocket fuel, you probably would not want to oxidize it. Low molecular weight in the propellent means higher exhaust velocities. Nuclear rocket engines used H2 propellent.
Clickbait article of the already posted blog post by the author:

http://jollyrogertelephone.com/i-am-going-to-eradicate-the-i...
vDSO maintainer here.

> Curiously the recommended syscall mechanism on x86 is by calling __kernel_vsyscall in the vDSO.

There are times when this doesn't work. Syscall resumption and cancellation come to mind. Also, __kernel_vsyscall is a hack to make fast syscalls work on the awful 32-bit x86 architecture, not a nice feature.

> it would have been fantastic if calling through the vDSO had simply been the only documented way of doing a syscall on x86_64

There is no __kernel_vsyscall or similar feature on x86_64.

> we can't even trap that on any x86_64 OS

You can on Linux using seccomp.
I can't speak to Matlab/Octave but as for Photoshop, FOSS folks always say use GIMP. But the interface is just so terrible compared to PS and I think they underestimate how important that is. Maybe it's configurable but for example, simple things like alt-tabbing between GIMP and other programs was painful because it opened parts of its interface as separate windows, so you'd alt-tab to your browser, then back to GIMP, but it wouldn't show the artboard, just the tool panels. That's a separate alt-tab. And more generally, it felt like everything in GIMP took two extra clicks than the equivalent PS operation.

Most people are goal-oriented when it comes to using software, not ideological, and they'll go with what gets the job done with the least amount of effort.
Matlab is still huge. As long as there's a need to run Matlab scripts, there's a need for Octave. The non-Matlab free alternatives aren't really competition for Octave. We're not short on users or developers. We're short on money.

The first possibility has been attempted. In effect, that's partly why the GUI happened: a company really wanted it and paid for its development. jwe has been able to coast on this kind of gig for a while, about 8 years now. It's just that it's never been a very financially stable thing.

The rest of your suggestion seems to be about running a business. That's the thing we've just never really known how to do. There are a lot of business details that we've never really figured out because we'd rather be writing code.
"Vim hasn't been on GitHub as long as Neovim." -- which says a lot, considering its age... it speaks to one of the core problems, Bram's godlike grip over VIM.

On top of that, he only started to introduce these features AFTER neovim came and put the pressure on by doing it better... if neovim's approach wasn't better, why would he be implementing features he's previous said he wouldn't implement?
>you were initially only talking about systemd

Systemd and Upstart are both advanced init systems and serve a very similar purpose. Complaining that one wasn't initially mentioned is just a way to prevent admitting that you're wrong. Arch took a very long time to make the step. That's a fact.

Flagging posts that are correct and provide sources should rather make you consider your own actions, but Arch users are often notoriously bad at facing reality.
You can have a simple fabric script to copy .vimrc (and .alias, .bash_profile, etc) copied to a new server. You don't need sudo for any of this.
As far as I know, the only BSD operating system to drop 32-bit support was DragonFly, back in 2014:
https://www.dragonflybsd.org/release40/
Why Apple's 10th Anniversary iPhone Will Likely Cost More Than $1,000
It's not a valid explanation when you see the usual equities and salaries people get at startup nowadays.
The words we don't have yet are the ones we will need as weapons in the imminent revolution/paradigm shift of mental health.

Some words we already have include (descriptions from wikipedia):

anomie: a "condition in which society provides little moral guidance to individuals"

acedia: "also accidie or accedie /ˈæksᵻdi/, from Latin acedĭa, and this from Greek ἀκηδία, "negligence") is a state of listlessness or torpor, of not caring or not being concerned with one's position or condition in the world. It can lead to a state of being unable to perform one's duties in life. Its spiritual overtones make it related to but arguably distinct from depression. Acedia was originally noted as a problem among monks and other ascetics who maintained a solitary life."

todestrieb: "the death drive (German: Todestrieb) is the drive towards death and self-destruction [...] This concept has been translated as, "opposition between the ego or death instincts and the sexual or life instincts" [...] The death drive opposes Eros, the tendency toward survival, propagation, sex, and other creative, life-producing drives."

weltschmerz: "(from the German, meaning world-pain or world-weariness, pronounced [ˈvɛltʃmɛɐ̯ts]) is a term coined by the German author Jean Paul and denotes the kind of feeling experienced by someone who believes that physical reality can never satisfy the demands of the mind."

joie de vivre: "a French phrase often used in English to express a cheerful enjoyment of life; an exultation of spirit."

ubuntu: "the belief in a universal bond of sharing that connects all humanity"

From the preface of Foucault's "Madness and Civilization": "...modern man no longer communicates with the madman [...] There is no common language: or rather, it no longer exists; the constitution of madness as mental illness, at the end of the eighteenth century, bears witness to a rupture in a dialogue, gives the separation as already enacted, and expels from the memory all those imperfect words, of no fixed syntax, spoken falteringly, in which the exchange between madness and reason was carried out. The language of psychiatry, which is a monologue by reason about madness, could only have come into existence in such a silence."

Emile Durkheim's "Suicide" is a work that touches upon the co-incidence of depression, existential apathy, and repurposed religion as affected by the industrial revolution. Here's a neat animated video by the School of Life: https://youtu.be/z9W0GQvONKc

The gifted (and, sadly, recently late) Mark Fisher's explanation of capitalist realism: "Capitalist realism as I understand it cannot be confined to art or to the quasi-propagandistic way in which advertising functions. It is more like a pervasive atmosphere, conditioning not only the production of culture but also the regulation of work and education, and acting as a kind of invisible barrier constraining thought and action."
What do you mean gaining popularity?

Athlon 64 came out in 2003, Pentium 4F in 2005. I'll concede that 32-bit Atoms were reasonably popular in certain market segments, but hasn't generally every consumer computer been 64-bit for over 10 years?
Not talking about this case specifically, but it could be that remote working makes defining reponsibilities harder and that could lead to not making sure that there are proper backup/restoring procedures in place.
>and they don't know or care about whether someone is post-op or pre-op or genderqueer or any of the other gradations of gender.

But to enforce the policy you have to care about precisely this, because there are plenty of transmen who look like men and transwomen who look like women. So in practice you have to go around asking every man/woman in the bathroom whether they have a penis/vagina. If you "don't care" whether someone is genderqueer or not, then simply let men use the men's bathroom and women use the women's bathroom, without bothering to check their genitals first.
> it requires some insight and preexisting knowledge from the reader in order to tell what's what.

The Deadline is a bit more generic (and dramatic): http://tomdemarco.com/Books/deadline.html
Postgres row level security and application users
It's fun, though!
European Securities and Markets Authority to Monitor Blockchain Tech
> Not every program is intended to be connected to the internet or have user provided input.

While true, I think the vast majority of programs do do one of these two things (and increasingly, both), whereas the majority of programmers seem to think that what they work on "isn't a security issue".

It's this disconnect that is giving us the Internet of Crap. Your phone apps, your fridge, your video games, your text editor -- every program I interact with every day -- it's all a security issue
It's unfortunate that they don't specify what those adjustments are.
Covers 4 Webcams
> So "computational graph" as I understand it, just stresses the point that what is represented is a unit of computation (a.k.a. an automaton a.k.a. a grammar a.k.a. a language etc. etc.) rather than some other kind of graph.

Exactly. I think that the fact that the nodes represent a unit of computation is enough for it to be different from normal graphs I think.
Land and Expand Strategies at GitHub and New Relic
I don't consider people who use throw away accounts to spout crap and hide in cowardice to be real commenters... their feelings an opinions are worth the value of the throw away account they created to spout them.
Wikipedia bans the Daily Mail as a source for being 'unreliable'
>The desire there was to provide women and boys with safe spaces more than to discriminate against anyone.

But that doesn't make the slightest bit of sense. How would preventing transpeople from using the bathrooms that align with their gender identity make anyone safer? Is there a single recorded incident of a cis woman being raped by a transwoman in a bathroom?

Also, the effect on boys is that they'll be sharing bathrooms with transwomen instead of with transmen. From the bigot's point of view, that ought to make boys less safe (as they think that transwomen are "really" men and transmen "really" women, so that transwomen are more likely to be rapists). It's telling that the supposed justification in terms of safety isn't even internally consistent.
Twitter grew by 2M users during Trump mania – Facebook grew by 72M
I wonder what India would be like - not as high wages, but the most expensive apartments in bangalore are like $700 a month.
Is there any sense of how corporate benefits effect the real cost of living?

Meaning, companies which offer free food, transportation, even limited housing, the net effect of cost of living increases could be somewhat offset?
LAMBORGHINI GOLD DIGGER PRANK – WorthShare.co
> I assure you it wasn't that way when Arch originally did the python3 -> python rename.

I disagree. I don't believe it was as painful as some make it out to be. The official packages were updated within a relatively short period of time, and while the AUR packages took longer they're also not officially supported. There was also a news announcement [1]. Honestly, I think of a few other transitions over my years of using Arch as being far, far more painful. The Python2 -> Python3 defaults change isn't one of them.

Although I would agree that Gentoo's approach was somewhat better via eselect, which I believe predated Arch's migration.

> Why should users of older distros have to add a symlink

You're right. That should be the responsibility of the package maintainer. Conversely, why should I, as a developer, have to continue assuming `/usr/bin/python` points to any particular version of Python when most distributions have migrated away from this anachronism? sed does magic, and you really should be using the appropriate symlink for your desired version anyway. Python 3 isn't new. I have a hard time seeing this as problematic because 1) things change and 2) the solution is easy. I'd be happy to entertain a use case where this actually has presented material difficulties, however.

> but this actually caused the most problems for little 20 line python scripts, because often the users of those didn't even realise they were using python.

Well, I do agree: It's a problem for the end user, but the solutions aren't difficult (if someone's using Linux, they probably know enough to fix it). So, either change the hashbang, add a symlink, and--failing that--complain to the package maintainer if it's been packaged up by the distro and the upstream software itself has changed (it should).

My recommendation for developers would be to use the appropriate /usr/bin/python* symlink. Nearly all distros have them in place now (including Ubuntu from a couple years ago). Perhaps assuming /usr/bin/python will always point to a fixed version is a matter of misplaced assumptions.

[1] https://www.archlinux.org/news/python-is-now-python-3/
Show HN: Good News Reader (Android)
New release SlashDB v. 0.9
That does not matter. Each of us on HN has a responsibility to treat each other with respect and civility. If you find you can't do that in a particular circumstance, refrain from commenting at all. Expressed another way, don't feed the trolls. Flag if you feel appropriate, and move on.
Hah, I'm actually somewhat disappointed. I read "making" as "creating" - as in what people are making app-wise around the world right now.

Free idea if anyone fancies it (I wish I had the time!) - a live update map that sources geo-tagged tweets with a specific hashtag (#ShowHN?)
my vimrc (and all my dotfiles) are kept in my private github so, with a single git command, they travel right to me... :)
If there was only a news aggregation site based upon the startup culture where these sorts of things can be promoted.
I erred on the side of caution. :)

I've successfully run Arch on a set of 10 EeePC 901s for a club. Linux plus Arduino programming = awesome kids.
A location based value would never work.
If people could choose to live in a more developed area for no cost at all, they will most certainly move there, increasing the demand for goods there and thus increasing the cost of life there which would result in a snowball effect.

A "low-income slum" is not a problem so long as people can live decently. It's "universal" so everyone receives it, what differentiates people in low-income areas will be that they inherited no capital and have no means of acquiring capital which is a problem that already do exist, so I don't really see your point.
Here's the actual journal article:

http://ac.els-cdn.com/S1350417716304187/1-s2.0-S135041771630...

There's an ISO standard for conducting these kinds of tests, and they apparently followed it. It's easy to think of perceptual tests that mitigate your concerns: for instance, you can triangle test.
Why the Halo Movie Failed to Launch
Joining a billion rows 20x faster than Apache Spark
> (still limited to 4gb max memory though)

4GB max address space per process. It should support much more memory through PAE [1], which makes things more reasonable.

[1]: https://en.wikipedia.org/wiki/Physical_Address_Extension
AMD Ryzen Lineup and Prices Confirmed, 8 Cores for as Low as $320
Tesla's entire marketing message is about how they are saving the planet. It's really ironic then how many times I've heard about the terrible working conditions at their factories. One cannot really trust a message about saving the planet when you don't care about the people who need the saving.
I saw a similar effect with really fast disks. If you make the kernel faster at passing requests down to the disk, a simple benchmark with one request at a time will be faster. However, with many requests at the same time and less time spent processing then, you now have more time to poll the disk for completed requests. Each time the kernel polls the disk, it will typically see fewer completed request than before your optimizations, and overall this can actually result in decreased throughput.
Hi, I'm the real-time guy at Baqend and I'd like to object.

Baqend has streaming queries whose results stay up-to-date over time; purely push-based, no pulling involved. You just have to register your query as streaming query and receive relevant events or the updated result every time anything of interest is happening. In our opinion, this is not only comparable, but goes beyond the synchronization feature of Firebase, because our real-time queries can be pretty complex. A Baqend streaming query can look something like this:
SELECT * FROM table
WHERE forename LIKE 'Joh%'
AND age > 23
ORDER BY surname, job DESC

We are going to publish this feature during the next weeks. But you can already read the API docs here to get a feeling for the expressiveness of the feature: https://www.baqend.com/guide/#streaming-queries
You are getting downvoted because it is a Reddit-esque comment that adds nothing to the discussion, which actually does violate the guidelines.
Where it works, it's a drop-in replacement for VIM, notwithstanding differences in async implementations now.
I can assure you that you are incorrect. I am the primary source and very aware of Parse's scale.

I worked on building a feature that allowed Parse to list that many databases (it had response that does not fit in the document size limit of 16mb -- requiring multiple cursors, command cursors).

I am a collaborator on the parse-server project, love the Parse team, respect what they built, and have no incentive to deceive you.

I worked at MongoDB for 4 years in various roles, consulting, engineering, etc and saw all sorts of deployments of various shapes and sizes.
Since diogomonicapt didn't answer i'll try to give an ELI5 answer ;)

Docker-containers have many advantages, but one of the big drawbacks until now was that it was really hard to pass secrets into them. Imagine you are a simple, stupid Java-container. You handle HTTP-Request and need to access other services like Databases in order to function. In order to connect to the postgres-instance you need to know 3 things: the URL, the database-name and a password. Getting the URL and the database name is easy, just pass them via environment-variables. The tricky thing is how to pass the secret. Environment variables are not encrypted and super easy to read as soon as you have gained access to the container. There were some solutions, but they were complicated. So most just passed them via env-variables. Huge security risk. Very bad.

This solves the problem.
Permanent Makeup – How to Improve Sleep with a Memory Foam Pillow
Doesn't have to be fabric, just a shell script with scp. If you can ssh to a server you can copy dot-configs to your $home dir.
Which seems pretty odd considering that with the exception of urinals, toilets themselves are enclosed in cubicles anyway. It seems kind of weird that they even segregate bathrooms... if they did away with urinals, all we'd be really sharing are sinks anyway. Though, I've heard horror stories about the state of women's bathrooms. I've never seen the inside of one. So perhaps they should remain separate XD
"Write everything down" is very important for any org hitting 150 people. It's when an organization hits Dunbar's #. [0] It's even tougher when you pass it and everyone is remote.

[0] https://en.wikipedia.org/wiki/Dunbar's_number
Snapchat is clearly in the entertainment category, competing for eyeballs, where the value they add over the next best option is small compared to the rewards they get for being able to advertise to those eyeballs.

This is a problem with most of capitalism but is much more pronounced in ad supported models since there's no way for a slightly inferior product to get an edge by being slightly cheaper.
I use them every two weeks to move Canadian dollars to British pounds.

Nobody else comes close in terms of exchange rates and level of service.
They could, but I'm glad they don't by policy.

I can't imagine the amount of crying from the community if the hosts of the site would take special privilege to pin their posts at the top. (I'd be fine with it, as it's their house, but I think they actually are better served to only take a small privilege with the jobs and show posts and otherwise leave the site to the users to vote/curate.)
New in Cloudera 5.10: Hue SQL Editor and Security Improvements
I can believe that is the case, but that just moves the attack vector to within Keybase's network, it doesn't mitigate it completely.
Would be more clear with "earning" instead of "making," wouldn't it?
The current Tesla packs seem to hold up pretty good. Users who are tracking the degradation are thinking a million miles is possible. Tesla has a test pack that has simulated half a million miles with <20% capacity loss. Warranty is 8 years unlimited miles.

If you are driving a half million to million miles in 20 years, an electric will probably really make sense. You MIGHT need to replace the battery. With a ICE car, you will need $5K of oil changes, $3K of timing belts, and around $20K more in gasoline than electricity, probably a new engine and transmission or two... There's probably another $5K worth of service in there (plugs, fuel injectors, transmission, belts).

So with a gas car you KNOW you're going to be in to it for basically as much as the purchase price of a Model 3 just in maintenance (again, if you are talking half a million miles).

https://electrek.co/2016/06/06/tesla-model-s-battery-pack-da...
Value creation > 'innovation'
Do you use it for something?

Even if not, I love this idea for learning new toolsets.
https://en.wikipedia.org/wiki/List_of_assassinated_American_...

https://en.wikipedia.org/wiki/List_of_United_States_Congress...

http://www.foxnews.com/us/2010/08/10/prominent-politicians-k...

> No, there is a Russian opposition leader in a coma right now

Which one? I mean, they call Navalny an opposition 'leader' even though he's never led a political party or held office, so odds are it's some random protester or blogger.