skysight-inc/HackerNews huggingface dataset:
> Yes, I meant Linux

The demo is on Windows. The goal is to do a sandbox that works on most OSes.

And, it will not solve the decoder issue, since it is on the decoding side, which still has access to the GPU/Aout and the kernel.

> Read access to an existing FD is not the same as full FS access, and there's no demux involved here.

You're totally missing the point here. The issue is demuxers/decoders/output, not really the access.

Reading from an FD or not would not solve the buffer overflow exploitation (if it was actually exploitable).
“Hack+ ”  an Intelligent network of bots that fetch the latest InfoSec content
Great article. Although I think it missed out on offering the obvious solution of just not watching 24H news. Large networks themselves are not going to stop making this kind of content until it's no longer profitable.
Tracking more please google. Im really happy that you violate my privacy with fancy new terms and ideas.
what counts as sanitizing? How do you know a file is malicious?
Mario+Rabbids: Kingdom Battle for Nintendo Switch, Slides Leak
If they ever changed the policy I could fly from Ireland to the US buy the I7/512GD SSD have a coffee and fly home all for the same price of buying it in Ireland.
Currently a €584 difference in the price between the US and Ireland. Any tax minded people know if this is caused by Irish VAT or pricing structure?

Its even €60 cheaper in the UK, €50 cheaper in Germany.
Why the Chinese Will Pay for Content That Americans Won't
But then you need to copy the memory from the decoder to the video output or you get back to the same problem to work-on.
There will always be more wild and more extreme weather events. Nature is random and not static. If one is near water, getting flooded will always be a risk. Not saying it wasn't a problem, not saying it didn't cause loss. Sea level is not static. Was never static. Oceans were 400ft (120m) lower when the climate warmed up at the end of the last glaciation (about 12000 years ago or something). Ice has been melting since then, there's absolutely nothing wrong with it whatsoever, nothing abnormal. There's absolutely nothing "wrong" with the planet's climate. The normal is the change!
Both Windows and OS X provide ways for a sandboxed process to draw directly to a GPU-resident texture owned by another process. Chrome's renderer sandbox is a good example of this technique.
> you have a very strong opinion it

Yes I do, this is internet after all!

> seems you know your stuff,

Now you lost me :)
The problem with OnShape and Fusion 360 is that if (when?) the services are discontinued your designs go away. You can keep the STL/IGES files but they aren't very useful if you need to quickly tweak a dimension. I've been bitten before by Fusion360 refusing to work (in offline mode) without an internet connection because it had decided it was phone-home time.

Whilst it doesn't have all the features of the usual commercial packages (Solidworks etc), SolveSpace is great, cross-platform, a single binary and my preferred open source solution for simple 2D/3D cad jobs [1].
FreeCAD [2] has also come along a lot if you prefer something more like the traditional packages, although I found some annoyances with it's dimension and constraint system when I last used it ~6 months ago due to the fact it has two different sketching modes.

1: http://solvespace.com

2: https://www.freecadweb.org/
regarding compiling

>Grenade layers are normal haskell data types which are an instance of Layer, so it's easy to build one's own downstream code. We do however provide a decent set of layers, including convolution, deconvolution, pooling, pad, crop, logit, relu, elu, tanh, and fully connected.

it's called a README for a reason.
Great idea, that's for sure!
Is the creator on here? The input field text for the Google form link is not visible on Firefox. .link-to-google-forms (main.css line 56) padding and .form-control (forms.less line 118) height collidate. Remove that hardcoded height and everything works fine in FF. Make sure to check in other browsers afterwards etc. of course.
A Gentle Introduction to Gradient Descent for Programmers
I thought they cleaned up after the last round of exploits?
A few years ago, Farbrausch released a lot of the code for their demos on GitHub : https://github.com/farbrausch/fr_public

I think it contains .kkrieger but I didn't try it.
This seems like a reframing of Charlie Brooker's criticism of news coverage regarding mass shootings[0]. Then, as now, many institutions seemed focussed on providing dramatic and emotional coverage rather than more objective and disconnected reporting.

I think the BBC has somewhat changed its tone in respect to events like this; it's usually slow or last to report casualty numbers and attacker names, but being last doesn't effect social change if lots of competitors are doing it anyway.

[0]https://www.youtube.com/watch?v=G2o1V4lX_g4
Maybe (https://pep.foundation/)?
Please don't fall into the Dunning-Kruger[0] trap by assuming a straightforward task is also easy to perform. These things may very well be complex and include aspects that are not immediately obvious. And even if they don't, even simple code executing simple tasks can be vulnerable to bugs or flawed reasoning without the authors (or tooling) being stupid or naive.

[0]: https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
Read macro-man.blogspot.com if you really fancy some fancy terms.

In seriousness, after reading for a couple of months, and looking the odd thing up, and not worrying about the jargon, just acquire it, you'll have a seriously good understanding of markets, what they influence, and what influences them.
Read data according to spec, drop stuff that is incorrect and write it back.

For example if MP3 genre field is 999 bytes long cut it down to 32 bytes.
What would help is stop making such a giant fuzz about it every time something happens. The media just "likes" these kinds of events because they make emotions run high.

In reality terrorism accounts for less than 0.01% of premature deaths, yet nations spend magnitudes more surveilling their own citizens and fighting stupid wars (to no apparent avail) than they spend on fighting various other things that kill more than a thousand times (> 1000x) more people.

Here's a nice chart visualizing the disproportional response: https://i1.wp.com/thinkbynumbers.org/wp-content/uploads/2008...
SolveSpace is fantastic, and it's impressive that the entire parametric CAD package is ~2MB, it just never ocurred to me to use it for this. I'll give it a shot, thank you.

You're right about the proprietary/cloud nature of the previous alternatives, which is regrettable because Fusion is a desktop program, and could easily just be saving files locally.

I hope FreeCAD becomes a great alternative soon, because Fusion really needs competition in the space.
Or you could also try to add to the discussion and enumerate those facts and sentiments that you feel are being overlooked in the discussion.

It's amusing that you have chosen to break your own self-imposed moratorium on participating in order to wag your finger and criticize everyone else while not contributing anything meaningful yourself.

It sounds like you might live in your own self-righteous echo chamber honestly.
> Probably do a multi-process media player, like Chrome is doing, with parsers and demuxers in a different process, and different ones for decoders and renderers. Knowing that you probably need to IPC several Gb/s between them.

That's not actually how Chrome's renderer sandboxing works. Both Windows and OS X allow you to share a GPU-resident texture between processes (DXGI shared surfaces and IOSurface respectively), so there's no need to copy any video data.
Media isn't a person. It's a machine. A series of feedback loops within our economy that occupy a market niche in which optimizing for maximum fear and outrage is optimizing for profit.

As you say, there are so many steps between getting visitors and someone's paycheck that you can't really blame a particular person within the system. That doesn't change the overall system behaviour, though. Everyone there, in aggregate, optimize for maximum fear and outrage.
Interesting.

I am only interested in these features:

- you need access to the GPU stack, which is running in kernel-mode, btw, to output video and get hw acceleration;

- you need access to the audio stack, also in low-level mode;

- you need access to the DSP acceleration (not always the GPU);

- you need access to the system settings to disable screensavers, and adjust brightness;

- you need to unzip, untar, decrypt, decipher and so on;

- many OpenGL client libraries need access to the /etc too;

Is there a lighter version where these features are cut?

- you need to be able to open files without user interactions (no file picker), in order to open playlist, MXF or MKV files;

- you need the same if ever you have a database of files (media center oriented);

- you need raw access to /dev/* to play DVD, CD and other optical disk (and the equivalent on Windows);

- you need ioctl on such devices, to pass the MMC for DVD/Bluray;

- you need raw access to /dev/v4l* for your webcams and be able to control them;

- on linux, you have access to x11 for the 3 above features, which is almost root;

- you need access to /etc/ (registry) for proxy informations, fonts configuration and accessibility;

- you need access to the network, as input and output (think remote control);

- you need access to mounts to be able to see the insertion of DVD/Bluray/USB/SD cards and such;

- you need to expose an IPC (think MPRIS on Linux);

- you need access to the fonts and the fonts configuration (see fontconfig).
How do you expect a company to keep to their code to the highest standard without continuously and rigorously validating that the code is actually up to standard?
Sounds like you are draining your precious life forces with the incredibly burdensome decision of what to eat the other two meals every day! How inefficient.
Which model exactly and where did you buy your Xiaomi? Sounds interesting
'Doomsday' worm uses seven NSA exploits (WannaCry used two)
It's funny because for a long time I would wear casual dress down clothing to my jobs and be cool with that. However now that my company has a no jeans policy I will wear a full suit, tie, shoes getup and I really enjoy it. I've amassed a good sized collection of high end suits and just really enjoy wearing them. Obviously though I really love fashion.
No they are symbiotes. The same as with Trump. The media needs terrorists and love the current administration. They were not exploited... they are willing partners.

Every left leaning journalist has perfect job security - something that this profession has nit seen in a decade. And highly improved social status among the crowds.
Sure, but then you need a multi-process sandbox, and it's not easy to do.

And the performance is not easy to obtain.
You can get a 10 year prison sentence or so for bribery. In any country in the world, you can be prosecuted there, or in the US or Europe. You will probably also be fired.
They exposed a spying operation against Russia government terrorists working on Ukrainian territory. Technically they did nothing wrong and also there no visible ties of them to any Russian structure, government or private. But as a regular Ukrainian citizen I have no need to have 100% unfalsifiable evidence for court, I just need sufficient amount of related information and high enough probability to consider this true. Russian bastards are killing thousands of our citizens, dozens every week and eliminating any suspicious software that may be related to them is an actual need.
Privacy is of course important. We should take it seriously. And i think its our duty to encourage other people to do so, and i know there are many people does not care.
hahah :)

I wish :)
Ask HN: PCI Violation by client storing 'cardholder data'
I was recently contacted to fix the admin portion of a website that was not loading properly. Upon fixing the issue, I found that the website is storing credit card information (number, expiration, ccv and customer info) in their database and even displaying it in plain text to the admin for processing offline.

I've informed the client that this needs to be fixed as soon as possible and that it is a violation. From what I saw they have at least 4000+ entries of cardholder data.

What, if anything, should I do?
The company I work at right now seems quite good at maintaining solid code quality. I'm pretty sure the reasons why are:

* A belief that code quality lets us deliver faster in the medium-term

* We start projects by asking "why does this need to be done?" and pushing for a fleshed-out explanation of that. This lets us write less code and do sometimes do projects without writing code. It also reenforces that we are building sonething that we will then need to mainain.

EDIT:
* We also follow that up with writing out a 1-2 page document explicitly outlinibg the scope of the project, the approaches we considered but are not taking, and the approach we are taking. This helps us keep a 1 week project from taking 3 weeks.

* Our hiring process includes a take-home coding test and a pair-programming exercise. We explicitly grade these on code quality and testing, so we filter for hires that value these things.

Feel free to email me at amfarrell@gocardless.com if have questions.
Not just sounds like... it is child abuse.

People would do well to read up on trauma informed care and Adverse Childhood Experiences.
Self-censuring the media to me is completely wacko, it's just gonna fuel conspiracies and increase reach of far-right ideology.

Keep calm and keep going.. also means keep reporting.
It's a good point. This post probably applies much more for libraries, where it's pretty easy to open a pull request with a code example causing the bug.

For batch-processing tools like Pandoc, uploading an example input file, output file, and description of what's wrong in the output would still be very useful.

I guess the nearest analogy for a graphical tool that you use as an end user, rather than a developer, would be recording a video of you triggering the bug :)
A media player is rarely that simple. Before writing to the GPU you have to access the content (file, network), demux, then decode and finally display.

The most dangerous areas are the demuxers and decoders so they have to be sandboxed.

So yes, you're right, but this doesn't solve the problem of moving the buffers between processes.
Especially with PDFs, my "sanitization" can be your "stripped away all the fonts and functionality - might as well have given me a plain .TXT", and vice versa.
You actually don't NEED a lot of these things
I'm perfectly fine with a default / embedded font.
I don't have an optical drive
A database can be in the local app storage.
I'm fine opening a subtitle file myself.
Why would I need IPC?
Why would I need to unzip anything? If it's subtitle files, it can be done in-memory.
Are you sure we need low-level audio?

I don't have a remote, so I'd like it to be disabled by default. I don't need any access to the network.

etc. etc. etc
How to Hide Browsing History – Complete Guide
IncludeOS is now 64 bit
A technique often employed by my children. To which my regular response is "Looks like you need more practise."
As well they should, otherwise it'd be impossible to get ubers from certain places or at certain times.
A fingerprint is harder to steal and use than your birthyear of your kid, so for most people it's more secure than a memorable 4-digit pin.
There's also a Google Tech Talk on the subject of ESP, by Rupert Sheldrake.

https://www.youtube.com/watch?v=JnA8GUtXpXY
flukus, thank you. I was trying to say something like that but wasn't able to quite word it right.
I think it's reasonable for a person with good experience of multi-paradigm dynamically typed languages to work out the solutions to those questions.

As a person who has strong JS/Lua knowledge, I didn't recognise the language as Python, but managed to get them right. I don't think my past experiences of C++, Java, C# would have been at all useful. I've also had a look at languages like Clojure, Elixir, Swift and Rust in my own time, and again that's not useful for this quiz.

It's a fun quiz, but maybe some of the assertions they make ("Only 3% of programmers can get all the way through") are not very fair, given it's not a true assessment.
This is my first side project which lists most discussed books on stackoverflow.com on every popular technical topic.All your suggestions will be very helpful to improve my site better. :)
NASA Names Organism Discovered on the Space Station After APJ Abdul Kalam
Ride a bicycle or a motorcycle.
Video: https://www.youtube.com/watch?v=_qrsHqDF4BA
You can share file handles/sockets on Windows/OSX/Linux via IPC without giving the renderer process the ability to open the files/sockets themselves.
I've only ever heard this about Radcliffe doing this once, do you know of more examples?
Login is a legit surname, though[0].

0: http://www.onomastikon.ru/proishogdenie-familii-login.htm (source in Russian)
Tell them to put Jim Clapper on the stand and get some answers.
Its inspiring that widespread violence and terrorism didn't erupt in South Africa in response to the end of apartheid. It certainly did as Rhodesia became Zimbabwe. The key to the relative peace, I believe, was the widely endorsed notion of reconciliation, or acceptance promulgated throughout all aspects of South African society, particularly by religious and tribal leaders.

I don't think its realistic to expect the media to change how it covers terrorism. I do think much more could be done to celebrate, reward and publicize those preaching against violence and for peace.
They use a hash function to match subtitles.

http://trac.opensubtitles.org/projects/opensubtitles/wiki/Ha...
Fuel Economy Rules Would Decouple “Miles Traveled” Trend from “Gas Used” Trend
It still exists in Orkney and Shetland (which until the 15th century were part of Norway rather than Scotland) under the name of Udal tenure.

https://rosdev.atlassian.net/wiki/display/2ARM/Udal+Tenure
blogspam, copy of http://tech.firstpost.com/news-analysis/nasa-names-organism-...
Congratulations, you don't need those things. What about the other 19.999.999* users? Are you sure they don't need any of those things? :)

* Arbitrary number.
Hollywood is resorting to shitty tactics
yjftsjthsd-h, I'm curious so I looked it up but couldn't find anything. AFAIK POSIX only specifies operating system behavior and doesn't specify any actual apps but I could be wrong there. In any case, the rise of containerization has brought many nano Linux distributions that often have even fewer packages than even the most minimal distributions of years past.
HN isn't Reddit, dude.
blogspam, text stolen from arstechnica
Latest Oscillating Sprinklers Available Online
the next generation are doomed to live their lives alone.

oh wait, they have tinder
blogspam, text copied from arstechnica
UN in NY is ahead of rest: http://www.nairaland.com/attachments/5346108_fbimg1495211821...
What same folks? iOS, Android and Ubuntu are not developed by the same people. More than that, it's not like these apps are actually developed by Apple, Google or Canonical.

Plus you're dissing some very complex projects. I think you're underestimating the complexity of the work these "same folks" are doing.
>Every left leaning journalist has perfect job security

You've crossed over to hyperbole now. While the current administration has been colorul, there's a click fatigue induced when outrage becomes normative.

Or have you come across some data about the decline of syndicated coverage and the resurgence of investigative reporting?
My favorite Lincoln quote "I never said that about the internet".
Inclined to disagree - depends on your keymap and software you use. If I were to add keyboard shortcuts to my program I'm sure as hell not gonna use a key that I can't get to on my keyboard.

On German keyboards it's even 'worse' though. Because ;, [ and ] are used for ä, ö and ü, [ and ] are Strg + ⇧ + 8 and Strg + ⇧ + 9. Same for { and }.

(Strg = Ctrl)

So any keyboard shortcut involving those and ⇧ or Ctrl is pretty much impossible.
The first rule of the FREE Dyson blow dry bar is?
Ask HN: How do you make Windows 10 tolerable?
I have recently bought a new laptop which is not compatible with Windows 7, so I have installed Windows 10 Professional. Although 10 has some improvements over 7, my impression of Windows 10 has so far been overwhelmingly negative.

For example, I am shocked by the number of useless pre-installed apps that come with Windows and demand attention, e.g. with top-level Start Menu icons. Most of these are at best irrelevant (e.g. OneDrive) and at worst completely inappropriate for a work machine (e.g. Xbox). Even worse, it seems that this is just the beginning: Windows will automatically download more inappropriate apps in the future. [A]

What changes have you made to your Windows 10 install to make it suitable for professional work? For example, I am looking for ways to:

1. Remove all of the irrelevant apps cluttering my machine, and prevent any more from being downloaded. Control of what is installed on my computer should rest with me, not with Microsoft.

2. Remove advertising from the operating system. I can't believe anyone considers this acceptable.

3. Ensure Windows is respecting my privacy. I already changed the relevant settings [1] to off/basic when installing Windows - is there anything else I should do?

4. Prevent the OS from restarting to install Windows updates, except when specifically told to do so.

With Windows 10, I'm so pleased that I can do most of my work in Linux and macOS. However, as long as some of my customers use Windows, I have to keep it installed.

What can I do to make Windows 10 "Professional" worthy of the name?

----

[A] I don't understand this at all. On the one hand, Microsoft sell "Signature Edition PCs" [2] which avoid the problems caused by PC manufacturers' "pre-installed junk". At the same time, they have started propagating the same junk themselves?

[1] http://hexus.net/media/uploaded/2017/4/4d9dfa9f-69ec-4378-9688-8e7cd7e8d009.jpg

[2] https://www.microsoft.com/en-us/store/b/pcsignatureedition
The first part are the dangerous parts.
I really love these visual explanations, and wish I had more at degree level. Do you think these will ever permeate traditional higher education?
Discussion of a similar article is over here:

https://news.ycombinator.com/item?id=14408811

That article is not the same - but it has a similar message.
He, I just happened to have MATLAB on my other screen performing a PCA of a CFD simulation. I got bored of watching the progress bar and decided to browse HN a bit. I guess I cannot escape...
those are real gamedevs
Also, correct me if I'm wrong, but the state of the art seems to be happening in Tensorflow/Keras; so committing to a different platform could mean you are systematically lagging behind in this new field.
68%, actually.
Yeah, but SOD isn't data sharing exactly (or wasn't?). To quote the Reuters's article:

You'd be told only, ‘Be at a certain truck stop at a certain time and look for a certain vehicle

This isn't a defense of the program or of parallel construction of course. But it is indicative that raw data wasn't shared, and other agencies didn't know the source or get any idea of how it was obtained.
I completely agree and was in the same boat - I used to use Fusion because until recently the only open source option I knew about was FreeCAD, and I had various issues with stability, features and the interface. OpenSCAD & friends are neat but if like most you've learnt CAD with a more traditional package it's tricky to adapt to.

Of course the cloud systems have their advantages and uses too!

Nice project and write up by the way!
A travel mode like this for Dropbox would be even more useful. Being able to mark certain directories as confidential so they can easily be removed and re-synced would be much better than deleting and re-installing the entire app.