skysight-inc/HackerNews huggingface dataset:
Ask HN: How should I disclose this vulnerability?
Background: I am not a vulnerability researcher. I have worked directly in infosec, but not for many years now and my knowledge of best practices is out of date.

I recently discovered a remotely exploitable shell command execution vulnerability in an open-source third-party add-on for a popular application. I don't know the specific popularity of the add-on, but I do know that it is recommended by other users of this app, and I found it by simply being a user thereof. It could be only a tiny handful of people affected; it could be thousands or even more. I simply don't know, and no stats are available.

I have contacted the author of the add-on who seems unwilling to fix the vulnerability. He or she has expressed a preference for simply removing the github repo. I have suggested that at least there should be a PSA in its place. I have also found at least one fork in the wild.

I'd welcome suggestions or references for how to proceed in a safe, legal and ethical manner. I have searched for current responsible disclosure guidelines but they seem focused on the professional vulnerability hunter and/or for major applications.
A lot of progressives were pro-body-cam in the wake of Black Lives Matter protests but from my view, unless they are accompanied by very strict protocol rules (probably at the state or federal level) they simply increase officer optionality.

If the officer can decide what to record, what to to submit in a report, if the lens is dirty or covered, etc... it really is very tempting.

They certainly have helped cops put away very bad people and they certainly have put pressure on cops to follow official protocol but they're not a panacea if not regulated tightly. For example look at the protocol proposals of Campaign Zero here: https://www.joincampaignzero.org/film-the-police
Ah, I wasn't aware PayPal owned Venmo.
How Super Nintendo Renders the Background
Yes... It's no wonder that my first accountant never realized that this could be possible.
"Note: in the interests of full transparency, you can find our end-of-year reports for 2013, 2014, 2015 and 2016 here." https://docs.google.com/spreadsheets/d/1SXm7DQAGfw4Qr1VrXln6...

Lazy post. Also a Non-Profit Foundation and Amazon are two totally different beast. So your saying the Red Cross and Amazon should have the same practices?
https://github.com/claviska/shoelace-css/pull/10

This PR will reduce the size down to 18KB.
I believe the question was poised to people who's spouses/partners wanted to learn programming so I'm not sure why this reply even exists except to make people feel bad.
"my fish got a bad case of bronchitis [...] we decided to get him some meds and boom! Within 2 days he was all new again and just kept swimming!"

Presuming they stopped when the "fish just kept swimming", this is how you (and the rest of the world) get antibiotic-resistant bacteria.
I wish I could upvote this several times. That's my exact experience as well.

I would like more people to experience what was the way of creating software with Delphi, seamless and easy, really closing the loop between creating and the resulting application and then look back at what unnecessary complexity we are dealing with every day when working with software. (nb I think there was a blog somewhere by one of Delphi's creators where they explicitly mentioned that the language and IDE were designed to be simple to use).

If I will be teaching programming to my children I will dig up old installation of Delphi 7 and just let them play.
When I tried it, it didn't allow me to use third party components in design time. And only 32bit demo compiler is distributed. (Can't be used from command line)
You're right. Although i don't use it, i just spent a few euros :)
> The Foundation was created to be able to have Dmitry work full-time on Krita. Because we sell stuff, the tax inspector has determined that we’re a company, and should have paid VAT in the Netherlands over the work Dmitry has been doing in Russia. Even though there is no VAT in Russia on the kind of work Dmitry is doing.

As someone who has dealt with VAT in the EU a bit this sounds really odd to me. Even if the inspector determines that VAT needs to be charged on these services, shouldn't it be Dmitry who is paying them, not the foundation?

In other words, they should be coming after the person providing the services for the VAT that he neglected to charge, not after the foundation who just paid the invoices they were given.
Why is not using flexbox a bad thing? It recommends the new CSS Grid instead.
We have configured at work an intermediate postfix for this effect, but it takes a bit to learn how to configure it

So I can see the benefits of this approach
Apple.com is a marketing site. It's essentially a brochure that is expected to change completely for every new release of the product.

The only major Google Maps redesign was from the original boxy low-fi design to the modern pan & zoom gestural design with overlays. The redesigns after that were mostly incremental and rarely affected the general look and feel of the site. There have been a number of design changes recently to unify it with the mobile app and some would argue those weren't always for the better (much like YouTube where it sometimes feels like the UX is getting worse every time).

Google.com always was fairly minimalist to begin with and that never changed much except for additions like the cards added to the mobile site to bring it in line with Chrome for Android. Again, whether these additions are good or not is heavily disputed.

GMail is yet another case of a site that never underwent a significant redesign but merely iterations on the same look and feel.

I can't say anything on CNN or Uber because I don't frequent them sufficiently to have observed any redesign other than Uber's confused rebranding earlier last year.

The way the new design for Reddit is being described reminds me of the Digg redesign. If you don't remember Digg: Digg was essentially pretty much like Reddit, the biggest differentiator was the community. Digg completely redesigned the site because it was failing hard. Digg today is irrelevant and what little community there was has left before the redesign largely been displaced by the redesign (and refocussing).

Changing aspects of a design that are so strongly part of its look and feel (or it's "DNA" if you insist on being poetical) is extremely risky and extremely easy to do badly. It's especially dangerous if you apparently only do it because you want something new/prettier.

HN and Craigslist don't look ancient because of a lack of effort, they look that way because the designs work and there's not much to be gained from changing it.
Protocol-Oriented Routing in Swift
> by the time that millennials walk the halls of power, their parents will have signed away all their rights.

I don't think this is a generational thing. Governments have always been trying to spy on their citizens since governments have existed. Back in the 1700s, John Wallis and the Rossignols were routinely reading diplomatic letters. Before the invention of the internet, the "Special Investigations Unit" of the Post Office was routinely opening people's letters and copying them to MI5. Even Snowden's revelations simply show that the government continues to pry into everyone's private lives - only the scale of the abuse has been magnified.

When so-called "millennials" walk the halls of power, they'll try to spy on their citizens too. Their bogeyman might not be terrorism - that was their parents' bogeyman, and their grandparents' were Communists, their great-grandparents' were Fifth Columnists, etc...

It's not clear how to make the situation any better when both major parties in the UK are committed authoritarians whose security policies are dictated by MI5 and GCHQ. The public, "millennials" or not, in the UK seemed quite unmoved by the Snowden revelations, and seem happy for the panopticon to continue.
Go's interface{} gets heavy criticism, a lot of it deservingly too, but this is one area where I think Go works really well. You can have a standard API structure and use that across multiple domains.

I really do need to give Rust a try though. I'd been holding back because my impressions of it was the core libraries were still in flux so code that compiled today might fail 2 months down the line. Is this still the case now?
You should, in most places of the world that have VAT. E.g. you pay VAT on inbound courier services like UPS, FedEx, atop of the duty on the goods they carry. (but not on outbound ones).
Hey all,
I am the owner of DataCircle and have made a blog post about the process of migrating the data from CSV into a DB.

DataCircle is a Data Marketplace that aims to improve transparency of data exchange through an e-commerce approach. For our showcase we took StackOverflow Survey results ported them into MySQL and are now query-able from everyone at our page.

https://blog.datacircle.io/2017/08/01/adding-stack-overflow-...

Feel free to ask me anything you want!
Training Convolutional Neural Network to detecte pavament cracks using Caffe
He meant server hosting costs.
Why don't you build an Orwellian society that punishes people instantly for "negativity"?

Oh wait, we already have it - this comment will be censored by the YC central committee.
but you can put people who use it on the billion dollar 'terrorist supect' database
Google Maps is far worse, CNN is horrible (autoplay by default? Really? Story stubs? Really?) Gmail has always been a design nightmare.

Reddit going through a redesign will almost certainly create a competitor that people will flock to.
I find the ones on youtube less annoying than the ones on an article for some reason.
In some case (see "abus de bien sociaux" in belgian law), tt's the other way around : if you make a mistake in your management of taxes, then the state considers that it was with the intention to deceive (because you are meant to 1/ know the law 2/ apply it). It's not the state who needs to prove your intention to deceive, but it's you who has to prove that there were no intention.
> Even if the inspector determines that VAT needs to be charged on these services, shouldn't it be Dmitry who is paying them, not the foundation?

From the look of it, Dmitry is outside the EU, making the foundation the importer and thus responsible for the VAT.
Training Convolutional Neural Network to detecte pavament cracks using Keras
Really? I always need to charge/pay VAT on services. The only exception is if both are VAT-registered businesses in the EU (but in different member states), in which case you can charge 0% VAT.
If this were the case, wouldn't that person be liable then?
Actually, there is no evidence that he ever said this.
Still better than supporting a new project from scratch that would take many years to reach the state of Krita. Despite this setback, they still deserve donations IMHO.
This is the argument raised by security experts in http://dspace.mit.edu/bitstream/handle/1721.1/97690/MIT-CSAI... , which I'm not qualified to disagree with. It seems strong! Even if it were technically possible, I expect there's also a strong argument along the lines of asserting our right to privacy.
I'm not sure if it's me or the article, but something about reading it just made me really tired. More so than, say, Javascript fatigue. Which is interesting, because usually that's my limit.
The author argued in 2011 that craigslist would be an afterthought within 10 years. Its revenue has grown from 122m when he wrote that to in excess of 380m now. I think he's pretty clearly wrong.
I feel it is the government that are brainwashing impressionable children with dangerous ideology and I'd prefer it if the stepped out.
Yes, to prove, get any crack exe and run pexplore on it. Very likely you will see some Delphi dfm or list of units compiled into the constant area.
If you're gonna use some random CDN, you should use the integrity attribute to confirm the resource doesn't unexpectedly change.

I'd encourage users to generate their own CSS bundle, so you only pull in whatever styles you need. Myth looks to be unmaintained. You can achieve the same thing with postcss and cssnext [0].

[0] http://cssnext.io
Is the "you don't need a grid" meme true when you take into account support for IE10, Kitkat, IOS9 and Safari 10? Is the polyfill as painless as advertised?
You mean "how to move mount Fuji?"
Pedantic, but income can and does go to employees through salary. Profit is not split among share holders and must be reinvested or saved.
I've lived in 17th Century buildings in the UK that have all for washing machines - I doubt the apartments there had washing machines in mind when they were built :)
Same can be said for any business venture... there is no free lunch, you have to work for it..
Or all of Switzerland. In Germany, it depends - Berlin is, well, Berlin. But Munich is immaculate.
I had assumed the situation was better as I've had great results with the TP-Link AC1750 and Openwrt. Everything is well supported and works fast. But that has moved on to the ath10k which is now blob-based like the other drivers so these kinds of fixes are now normal hardware bugs and not something someone can hack independently.
One problem is construction. When you need to interact with a library at one remove using interfaces everywhere, you can't simply new up instances; you have to go via factories. And that leads to ugly alien code.

That's mostly a Java problem, though, which lacks first-class types.
What do you mean? You pay VAT on imported goods. Not on imported services.
I never heard of this. Is that actually a rule in the Netherlands? I don't think/hope it is in the UK at least.
Sidenote: I recently finished reading The Story of the Human Body by Daniel Lieberman, in which he addresses this issue (among many others). The book is absolutely fantastic, an engaging, highly-readable page-turner packed with insights and epiphanies about how we can think about contemporary challenges from an evolutionary perspective.
What YouTube has is a preroll. Imagine if Youtube had a full page cover up on it like Forbes.com. That would be a prestitial. Websites can have both.
The PREVENT strategy could have been useful. But schools over-report (because that's the safest thing to do when you're compelled to report) and there doesn't seem to be sensible triage in place to filter out over-zealous referrals.

Here's an example of what the PREVENT agenda should be about: http://www.bailii.org/ew/cases/EWFC/HCJ/2016/9.html

or this case: http://www.bailii.org/ew/cases/EWHC/Fam/2016/3171.html
> "my desire to discover and invest in the next new thing became eclipsed by my desire to get my hands dirty again and build the next new thing.”

Why do people write like this? "I'd rather build the next new thing than invest in it."
If the goal is to let developers make more design decisions, shouldn't we give websites root access to the machine by default?
Seems if you click enough, the tax site does mention it in some obscure tool. I always thought it only applied to goods.

For the dutch: https://www.belastingdienst.nl/rekenhulpen/diensten_in_en_ui...
Yes. Both fast and AOT compiled languages with great compilers and probably not the best IDE support unless you count a bunch of plugins. Both have small and tight knit communities and have evolved fast. Neither are the best from a library perspective, but Nim can use C or C++ libraries easily. Doc isn't terrible. Nim has jokingly been called "New Improved Modula-3", so it has some things in common with Pascal, although it's syntax looks like Python with types, while D looks like a mix of C++ and Java.
No, you must pay VAT at the point of import if your supplier is outside the EU.

Not doing so would allow unfair competition from suppliers outside the EU. Note that for goods, these are import tariffs.
The cut off seems to be a million messages, seems like enough to me
This is EU wide so it would apply to the UK, for now.

Note that the rules for intra-EU B2B transfers may be different (deferred VAT).
We're talking about things imported to the EU from outside the EU. Do you really pay VAT in europe on services you buy in the US? Or in Asia?
Delphi 7 was last of greatest IDE (on that time) exists. New one add .Net and became larger and unstable. Probably 2007 bring stability.

I also start with Pascal (Turbo 3, 4, 5, 5.5 (greatest!), 6 and little bit 7). Then jump to Delphi (all 1-7) and then abandon it.
Show HN: TidyFork for cleaning up outdated forks and stars
This is an understandable assumption, but it's actually not the way it works. I'm sure the Dutch tax authorities have equivalent documentation, but the UK description of the 'reverse charge' should explain the basic principle https://www.gov.uk/guidance/vat-imports-acquisitions-and-pur...
This is a quickly thrown together application that I built purely out of frustration over how horrible the experience is for deleting repositories you have forked on Github (confirming your password and repo name for each repo you delete). I have been a member of Github since 2010 and in that time, amassed a tonne of forks and starred repositories.

It's a basic app that automatically marks any fork that is outdated in comparison to the parent repo you forked from. For stars, it will mark any starred repository that hasn't been updated in two years or more. In my case, I had starred repos that hadn't been updated since 2010/2011 I cleared out.

I used this as an excuse to build something using Vue.js, as well as Firebase Hosting and Firebase Cloud Functions. I might clean the project up and open source it as well.
White House Officials Tricked by Spearphishing Email Prankster
You can switch to WPF at that point I think.
Cannot be loaded and seen. Can you put your text on some public blogging service instead of a weak small server that overloads when people on hackernews actually are interested on your thing?
S&P 500 to exclude Snap after voting rights debate
You might pay a customs duty on imported goods, but you don't pay VAT.
Oh, I see! That makes sense then.
How to Prepare Preschoolers for an Automated Economy
The government can legislate the pipes. It's possible to DOS strong encryption at the ISP level. Look at China...
>We generally take excellent care of public places. This is a combo of culture and government services actually cleaning stuff up every once in a while.

Ok, I've gotta take issue with this.

Dutch people litter. All the time. People rarely seem to clean up after their dogs. People place their trash bags out on the curb (where there aren't underground bins) far earlier than they should, resulting in trash-strewn streets and fat, obnoxious seagulls. It's a mess. Beer cans left on bridges and park benches. Energy drink cans tossed to the side. Cigarette butts strewn carelessly. Firework refuse absolutely fucking everywhere a few weeks either side of New Years. Bikes left as litter.

There's always someone who comes along with a street vacuum, or a team of people going along with bags and pickers. It seems to me that people have little respect for not littering because it's always someone else's problem, and there's always going to be someone cleaning up after you.

So if by "we" take care of public spaces you mean "lots of people get paid to clean up others' carelessness," sure, but in six years I've seen little to suggest that not leaving trash just anywhere is strong tenent of Dutch culture.

My hunch is that urban areas of the NL are essentially all developed and man-made, in that every street, sidewalk, tree, bush, patch of grass is planned and raw, untouched nature is relatively less accessible and visible. Therefore people perceive this urban "fabrication" with its attendant cleaning staff as less precious, less worth keeping clean than some primeval forest or national park.

I could be wrong, of course, and this is all just my own perception. But I really fail to recognize the cultural cleanliness that you say embodies the Dutch.
Text only Google cache: https://webcache.googleusercontent.com/search?q=cache:https:...
The problem is the stop the world pause. Imagine the following scenario: Thread 1 is a realtime thread and allocates memory up front and even uses @nogc for the rest of the code. Thread 2 continuously allocates memory. Thread 2 starts the garbage collector and must stop Thread 1 even though it doesn't allocate anything. Basically the only solution to the stop the world pause with D is to run two instances of your program and then use IPC even though the language provides a way to disable the gc. D's solution is to generate less garbage but it doesn't solve the real problem with current garbage collector implementations.
Game of Thrones data leaked in HBO hack
I find this thread interesting: https://news.ycombinator.com/item?id=14706548

In short, odds are greater that Tesla will exist in a post-combustion world than established automakers.

I mean look at the battery supply chain alone. For them to deliver at Tesla's scale, they'd need enough batteries, which, right now, would require major investment a la Tesla's Gigafactory: which is set to produce more batteries at one factory than the entire world's current output... all to support Tesla products.

At what phase are the established automakers in their infrastructure investments? They're all years behind. And I'm afraid they won't catch up.
GP = grandparent.
Link to the prankster's twitter: https://twitter.com/SINON_REBORN
A "public bath" isn't the same as a "public place", which has a wide range of meanings. Think of it as "open to the public", similar to how a pub="public house" even though it's privately owned and people can be kicked out.

A public bath has an entrance fee and staff, including cleaning staff.

While a train station doesn't have an entrance fee, even to access the elevator.

The streets are even more "public", in that speech like preaching has very few restraints. But a public bath has no obligation to allow yelling and preaching.

One of the ways people do public baths in the US is to join a gym. Another option is to go to a spa. Those two provide most of the market need for a public bath.

Other cultures also integrate a social experience in the public bath, but that is coupled to historical reasons not related to your objection.
Travis Kalanick before Uber: Scour- a peer-to-peer multimedia search engine
They would need to prove they suffered loss (and an actual error!). That's not clear in this situation. Not paying taxes you were due isn't extra costs due to your accountant, although fines and interests may be.
Good content can be found all over the place. HN and Reddit aren't a prerequisite. You will find it or it will find you. Don't worry.
Seed funding slows in Silicon Valley
Ahh. So if I cover just the article text (versus the whole page) with a countdown timer, it wouldn't be intrusive?
> It's a reactor designed to produce large amounts of plutonium.

It's a dual-use reactor: plutonium and electricity production (200 MWe).

> Any reactor produces some amount of energy

But not electricity. For that a power plant has also turbines, generators, etc., ...

The US for example had no electricity production in the early reactors for Plutonium production.

But the US Hanford N produced both Plutonium and electricity for the commercial grid for 21 years...

https://en.wikipedia.org/wiki/N-Reactor
5 Websites Where You Can Find Legitimate Online Data Entry Jobs
What treatments did you discover?
However, the Mailit service makes the client wait on the SMTP traffic too [1]. So with this particular service you now have to wait for both SMTP /and/ HTTP communication. Doesn't really speed thinks up :)

That depends, you could host the Mailit service in the same machine as the email server, which your application instances on other machines would call. This could be useful if you have multiple machines but only want to run a single email server.
It is important that the medium she is using to make these conversation build meta-data around these conversations. And then uses AI and machine learning to detect potentially harmful content and inform the authorities.