skysight-inc/HackerNews huggingface dataset:
I dont see anything wrong with your first link. If someone can't fit in their seat they should buy two seats or not fly.
Archive.is copy for those of us inside the UK:

http://archive.is/EXWhb
It is NOT horrible. However, Latex is another way of doing things. Perhaps your requirements should dictate which of the two you should go for!
I did talk to someone on the phone, and she indicated that this position is onsite. :-(
This is taught so that small kids don't carry on doing things that might be dangerous (kids don't know the difference between dangerous and annoying, so a blanket rule is more sensible here). It's not evil, it's damn sensible. Please feel free to critisise the continuation of this teaching to older kids who can think critically about what they're doing, but don't ask for primary school kids to not do what the accountable adult is telling them.
> Travelling in the US or with US airlines is not looking very good right now.

As someone not living in the US, travelling to the US is not looking good either. I know of many, many people who have written off visiting the USA for the foreseeable future.

I'm one of those and I've spent many years in the US in the past (lived in NE and VA for 5 years in total and visited over 30 states). Sadly, as much as I enjoy visiting the States, it simply feels like too much of a liability to visit at the moment. I'll reconsider in 4 years if it hasn't got any worse.
> For the CVE points, I'd expect enforcement to be difficult.

Ever used kali linux? Have an gov org that is scanning for volnurabilities and fining companies. Not difficult at all.
Anybody know how to port code from using PhantomJS to headless Chrome? I have been using CasperJS that wraps to PhantomJS. PhantomJS had its own set of commands. headless chrome will have to be different one way or another.
So by switching to a security key that nobody else uses, you've saved $7.99. With that money, you could buy a cup of coffee at Starbucks and have some money left to donate to the change jar.
Java RAM Usage in Containers: Top 5 Tips Not to Lose Your Memory
I would stick to things like nitrokeys/yubikeys that have gone through rounds of side-channel attacks, research, and upgrades.

The only one I can generally suggest for most people right now, in spite of it being closed, is the yubikey 4. Mostly because it can be configured to require a physical touch for each operation. Something a remote attacker can't do.

I started putting some comparisons down here: https://github.com/lrvick/security-token-docs/blob/master/De...
Your solid arguments have swayed me /s
You're advocating for the flight crew to instruct a passenger to relinquish their seat after they have already sat in it so that a first class customer could have it? I think it's safe to say that that should be an action of last recourse...
I take it, “getting a home” is the hard part here. The good news is, the gadgets also work inside cardboard boxes.
I fly quite a bit for my business, sometimes traveling with a premium carrier in first or business class, but equally often with low cost carriers.

Out of all airlines, United has given me the most problems. Due to my "priority status" with most airlines, I am likely sheltered from the brunt of the harassment, but I often witness other passengers dealing with toxic attendants, overbooking situations, crew movement taking priority, and so on.

Emirates is my primary international carrier. However, for many of my international trips out of DFW, United is one of the only premium carriers available.

Truth be told, my best experiences have been with Virgin and Southwest.

Virgin is now my go-to carrier when flying longer-haul domestic between destinations within their market. The Wright Amendment previously crippled Southwest's usefulness but, since it's removal, I find myself flying with them more and more often. Love Field, due to its size and location, provides such a painless travel experience in and out of Dallas. The alternative is flying via DFW, which necessarily adds over an hour of traffic delay each direction and maybe half an hour of TSA delay, even with pre-approval, when compared to Love Field. Saving 2.5 hours each time I fly is quite the value proposition.

Given these United revelations, for international flights, I will try to book with other carriers more often - Luftahansa, Japan Airlines, Korean Air, Qatar Airways, AeroMexico, etc.

TL;DR: United truly is the worst. Virgin and Southwest are good. Use Emirates for international.
Wow! My big takeaway is that I guess Apple (or somebody in the middle?) is making a lot of money on batteries. I know Apple routinely charges $70-80 for a battery replacement, but this guy got one for $5!
Much better than SMS, but not as good as a security key, because if you can fool someone into logging in to an impostor site, you can get their email account.

It would be a reasonable backup in place of (or in addition to) Google Authenticator.
Off topic but What is that fried layered egg roll up thing around 9:46 in the video? It looks pretty great and I want to try to find/make one.
I agree way too many typos. You can tell it was the lack of proofreading (not acceptable) not someone whose first language is not English (acceptable).
This is a zombie lie that never ever stops. You can't trust whatever psycho-website you got that misinformation from.

DDT was NEVER banned for public health purposes in Africa or anywhere in the Developing World.

It was restricted for use in agriculture to ensure --in part-- that it continued to be useful for public health. As far back as the late 1950s it was known that mosquitos easily developed resistance to DDT and other insecticides.
I would add that Yubikeys and a number of other tokens work just fine with USB OTG with TOTP if nothing else.

If you have a phone with USB Type-C and a Yubikey 4c you can just plug it in direct.
The take on adjuncts is truth. Just about everything else is pure rubbish and I'm disappointed I wasted my time reading even half of it.
I hope so. Have you got any links to read about first-hand experience of going off medications from a person with bipolar disorder?
Errors happen, of course, but has a hotel customer even been removed from a room post-check-in because a member of staff needs the room?

Edit: From a major chain at least. I'm sure all manner of poor decisions have been made by smaller/single location operators, though they aren't really comparable to United.
Well you don't, the user does.
I once had a tiny bit of water on my plastic thermos. The TSA guy said "throw the bottle or exit the line, walk to the bathroom and empty it there".

I just looked at him puzzled, opened the bottle, and drank the water.

Now that I think of it, I was lucky he didn't taze me for my 'insolence'.
I didn't say it was the greatest thing ever and yes it sucks to have to pay for the privilege of what just used to be normal. At least at my airport the whole process winds up being a lot faster.

However it did change my calculus when debating train vs plane for trips. It used to be anything under about a 10 hour train ride was a no brainer, now that's more like a 3 hour train ride.
Thanks, I wrote that statement. I think it might be worth it if the statement text makes its way across to the CVE pages.
Prophet Camera uses deep learning to predict your photo's popularity
Since the church and the school are in quite nice areas, this strikes me as a bit of security overkill. The folks affiliated with this church are typically quite well off and are typically staunch Republicans with values that match. I can imagine that they perceive the need to defend themselves with more guns from potential attackers that statistically speaking only exist in their imaginations.

I get the sense that their security plan in general (either with their own police or just hired security) is just based on generating a perception of safety via a display of largely unnecessary force.
>At the end of the day, though, JavaScript is the language of the web.

And when webassembly arrives that will be over, and Typescript will be deprecated. I can't wait for a better modern language like Haskell, Python, Livescript, etc.. built on top of webassembly. Then we can finally stop trying to fix Javascript's flaws with new language features.
OpenSSL uses the flag in a couple of places: https://github.com/openssl/openssl/search?utf8=%E2%9C%93&q=M...

Does anyone know what crypto/bio/bss_dgram.c does?
Is it right that an airline can sell 310 tickets on a 300 seat plane, deliberately entering into 10 contracts it knows it cannot honour? As I understand it, that is legal. But should it be?

I assume there are weasel words in the contract(airline ToS) to allow this.
> the antisocial behavior of the person who harassed you is a result of poorly treated mental health issue

Exactly. It's not a significant transformation in consciousness and a necessary stage on the path of human development.
No, that's intentional.

A certain percentage of every flight is no-show - they bought a ticket, but never showed up for the flight. So by overselling, you actually get a fuller plane and more tickets sold.

This starts to break down when the no-show ratio drops for single flights, though.
You're painting a darker picture than what it really is :) Most of the time, things go smoothly and flights are very affordable. I find it amazing that as a middle class person I can fly pretty much anywhere in the world. I can live with the inconvenience of being scolded by the TSA and US customs officers.

Actually, I wonder how much this will last considering that fossil energy will likely cost more and more and that more and more people from developing countries start to travel too.
Yes. Also governments can see SMS in transit (a concern in many places), and SMS-es can show up on a lock screen. I'm updating the FAQ next; sorry for this dangling reference!
In the US, the alternative to this would be to consume organic produce. However, most people don't realize that organic produce still uses plenty of, if not more pesticides than traditional production methods; they just use organic pesticides.

I wonder which is worse: highly mechanized, high efficiency, and low volume synthetic pesticides in traditional production methods - or low efficiency, high volume natural pesticides in organic production methods.
Yesterday my Healbe GoBe 2 healthband arrived, it has an array of non-invasive sensors which values can be used to take a good guess at how much calories are burned from carbohydrates, proteins and fats. Each time you eat you have to push a button.
https://www.techwalla.com/12049437/healbe-gobe-2-is-a-fitnes...
Will somebody please post the kickstarter/indiegogo link?
Yeah, I really think that open-source software shot itself in the foot by incorporating unlimited free sharing for every recipient into its mantra. Now everyone thinks that open-source has to mean impoverished, because despite all the happy vibes, very few people will pay for software that they could otherwise get for free.

You can make your software "source available", i.e., not open-source under activist definitions but still have a GitHub repo and all that, and restrict [heavy?] commercial use. I think it'd be interesting to see more open-source devs take that route and stop giving away the farm.

This will still allow people to use your stuff, developers will get familiar with the tooling and expect to be able to use it at work, and companies that have the dough can be compelled to pony up for a license.

On Windows, there is still an underappreciated market for cheap early-90s-shareware-style applications that are < $100 a pop, but I think most of them think that sharing the source means they have to enter the poor house, which is sad. We should show people that there's a way to share your source without bankrupting yourself in the meantime.

The GPL almost gets there, as it makes large-scale commercial use undesirable due to its infectious nature, which allows for dual-licensing, but with everything server-side nowadays, those stipulations are much less effective (have to go AGPL).
> It's a classic "public good" - an economic activity whose benefits are impractical or unworthwhile to deny to those who don't pay.

Open source software is not a public good, in the economic sense. There are two criteria for being a public good: non-rivalry and non-excludability. Open-source software satisfies the first criterion (my using it doesn't prevent you from using it), but it's fairly excludable (I can prevent you from using it legally).

As developers, our instinct might tell us that it's not excludable because "if the source is there, nothing prevents me from using it", but when we're talking about goods which fall under copyright law, the legal aspect matters as well as the practicality. And in fact, open-source licenses (such as the GPL and the Apache licenses) can contain provisions which prevent people from using the licensed software under certain circumstances, while still being considered both free and open-source by the FSF and OSI respectively[0]

The real classic example of a public good is national security. Practically, there is literally no way that national security can be applied to people within a country on an individual basis, as opposed to a geographic one. For most threat models (e.g. espionage, (counter-)terrorism), the mitigations are things like "prevent terrorist attacks from happening". You can't apply the benefits of that only to people who have paid for the service - a terrorist attack either happens or it doesn't, and you can't choose who's a victim of it.

> These are a classic example used by economists of a natural place for government in the economy.

Even for things which are actually public goods, like national security, that's overstating the case greatly. Public goods are used as an example of a good for which an individual market cannot exist, but that doesn't mean that the only alternative is a government one.

The so-called "tragedy of the commons" is an appropriate (and ironic) example - despite the way that most people use the term, the town commons was actually something for which there were plenty of well-established codified rights, and these were not always negotiated or enforced by a government entity.

[0] For example, the Apache license contains a patent retaliation clause, which terminates your right to use the software in the event of a patent lawsuit. (Technically it doesn't revoke your right to the copyrighted code, but it does revoke your right to the underlying patents, which amounts to the same thing, because presumably the copyrighted code utilizes the underlying patents, or else it wouldn't be covered by the license in the first place).
You should not use Firefox if you want the protection of a U2F key.
I barely put any time into my CS degree and I recommend everyone to do the same if given the opportunity. I studied for ~4-8hrs a week at home, and had ~16-24 hours worth of lectures, and I still graduated with a GPA of 3. The Dutch college system encourages cutting corners, so I did (along with most of the other students). Most of my college time was spent drinking and doing stuff with my fraternity, and I loved every second of it. I haven't worked a day in those 5 years either, just loaned a bit more money. I am of the opinion that if you get the chance to enjoy life like this, you should fully take it. You have more than enough time to live seriously after you graduate.

You have to relearn almost everything they teach you on your first job anyway. The contents of the courses were always horribly outdated, the only things I really needed were general programming skills, research methods and project management lingo.
> What more do you want?

Not doing it in the first place, of course! Because this has happened with VLC (a fact you seem to ignore), maybe they fixed it by now, or maybe it's temporary, or maybe you're just not in the "stupid people that would fall for this" filter bubble, but for quite a while Google Ads have been responsible for serving malware and damaging people's computers.

Also just because they try and fix it after the fact for VLC, doesn't mean it's not still happening for all sorts of other software. Google's approach for curation of ads is just not suitable to be able to provide a platform this large in a responsible manner (and I doubt it can ever be, but that doesn't give them a free ticket to behave irresponsibly).

Maybe you've forgotten what this thread was about in the first place, but if their policy is "we will remove ads that contain/link to malware as soon as they are (made) aware of them", then:

1) it's still a perfectly smart choice to use an adblocker because you can still get malware from ads (in addition to many of the other reasons such as opting out of clickbait timewasters, whose "innocence" evaporates as soon as you consider their scale), and a particularly important and smart choice to install it on people's computers that would actually fall for such a fake download link, which is not the HN crowd.

2) as a publisher, I would DEFINITELY want a much tighter guarantee on not serving/linking malware than "we'll remove it when we see it" because now it's not just my safety on the line (or my father trying to download VLC cause I told him over the phone, etc) but my entire audience!

I know I am careful personally, what to click and install, but I honestly wonder how long I myself could keep a fresh Windows install malware-free without running an adblocker. Some of those things are nasty clever and misleading (not thinking about Google Ads in particular, here). Ever consider the amount of good those people are doing? The ones writing the adblockers and keeping the blocklists up-to-date? They are not even getting paid to do it. It gives me such a bitter taste, every time I see a website whining about my adblocker usage. If you care so much, why are you using a third party ad network. If hosting and linking and curating your own advertisements is too much to ask, well then so is me whitelisting your site, sheesh.
What's so special about CCNA? I've acquired it as a backup plan few years earlier, but never used it nor worked in networking. Pretty much anyone with basic knowledge in networking, few weeks of spare time and and few hundreds of $ could obtain it.
An outrageous hospital charge: I paid $710 for an hour of babysitting
Something wrong with .VIN?
I had a high school student working with me last summer who did some development on it (no previous experience with unity/c#). His goal was to visualize crystal structures. My main comment is that the FOV is small and the question of what makes for a good user experience is still open. I wish I had more time to play with it.
I've never had an issue at Logan (Boston), SFO, Seattle or Austin. Usually past security in 20 min and I do not use precheck.
> Does that work

It does because it allows to apply very vague criteria when selecting candidates. 'Culture fit' bullshit at it's finest.
Does anyone know when Ember will use TypeScript?
The other side of the problem is the skill level needed to be a good developer.
It's a .pl address, so I don't think English is his first language.
I have answers/arguments along those lines here: https://github.com/lrvick/security-token-docs/blob/master/FA...

Would be interested in seeing contrasting views though!
There is a more benign reason Google requires a phone number—they're worried you'll lock yourself out of your account.

I'll take the Pepsi challenge with anyone on Google bashing, but I think this one is not fair.

It does hold for Facebook, though :-)
It's not as good as having a hardware key, but they still need your username and password and pwn your phone. That's a lot of trouble. So for most people, TOTP software is good enough security.
Hi everyone!

We are proud of this first beta before 2.1.0.

It contains very useful stuff:

* Push notifs:

* XEP-0357, and a very new standalone open source push notification server, MongoosePush

* Amazon SNS (Simple Notification Service)

* Full text search for MAM (Message Archive Management, XEP-0313)

* Continuous Load Testing

* Pipelining for faster reconnections

* Erlang distribution over TLS

Plus contributions by @astro, @aszlig!

The "MongooseIM Platform" welcomes a new server-side component: MongoosePush. It is in Elixir, it is open source.

Still a very strong focus on code quality and performance, mobile features, and this time a new component (Push) in Elixir!
I agree with most of the article accept the idea that you shouldn't have a front facade controller and that each team should be responsible for their own UI.

That isn't feasible in a lot of real world contexts.

- what if the same service is used by web and mobile applications?

- the backend services usually have access to data that shouldn't be exposed in the DMZ. By keeping all of the services that communicate with backend systems behind the firewall and having the front end services exposed in the DMZ, you have another layer of protection with the only port being opened between the DMZ and the internal network is port 80/443
Yes that's my understanding as well, user space code using a given syscall with given parameters triggers the kernel exploit.
> Indecision is a decision (and often the worst one).

This is a great guiding philosophy!
Attitude isn't criminal.
This is a terrible idea, in my opinion. The answer should be to hire private security and foster strong relationships with the local police. You don't get to create your own police force.
How do you legislate security standards - especially in the general population of products and in a way that would be applicable to all suppliers? And how do you quantify liabilty due to a security vulnerability in some sub-component or somewhere in the software stack? How do you assign liability if thousands of different IoT devices are compromised and DDoSing the White House page? How do you deal with bankrupt or foreign suppliers? Or people using products that have been end-of-life-ed? Or how do you keep regulation up to date with current security standards? This is an incredibly hard problem.
I would really like to know what is unethical (or even illegal) about this (just so I can understand this correctly).

Uber

* created multiple fake accounts on lyft to know about it's drivers

* figured out that it's drivers were assigned numerical ids

* used said ids, to track lyft drivers.

imho, this is just figuring out your competition (say by signing up to the service) and then using this knowledge to improve your service (by incising drivers on both platforms to ditch one).

This is one of those "do things that don't scale" mean (or my interpretation of it). I say this because, one multi-billion $ "startup" is doing this to another multi-billion $ "startup".

Also, I'm sure this would never be an issue if Uber was not in the press for other crappy stuff they did.
Can attest to sturdyness. I have washed and decased 2 of mine with acetone and they still work as expected.

As an alternative to a second key as a backup, you can always keep a set of printable backup OTP tokens offline in a safe etc, ideally encrypted.
I use Authy: https://www.authy.com/
Now I'm wondering are there similar security concerns here as with Google Authenticator?
I think the fundamental dilemma here is between the "packrat" and the "thrifty liver"

I have a box with all my old handwritten letters from just before the Internet and email exploded. I rarely take it out, but when I do, it's kind of neat to show my niece and nephew.
It is called progress, one ludditte at the time.

C wasn't that relevant before business started to adopt UNIX workstations.

We were happily using other languages and will continue to do so.

Neither Go nor Rust are written in C.
> Stuff like this must happen hundreds of times every day

I think that's the problem.