skysight-inc/HackerNews huggingface dataset:
> If such tools actually existed and were good, people would use them and web app exploits would be a curiosity rather than an expectation.

I think you're missing another two obvious explanations:

1. Lack of education when picking a tool (copy paste from bad SO answers is a frequent source of bad code).

2. Developers don't care. If it works, why bother wrapping your head the rest of the way around to understand why it works or whether it's secure?

> By itself, it is not an XSS. But if the backend is/was running Ruby on Rails (presumably some old version by now) then it could turn into an XSS due to a combination of features that all look superficially harmless.

Sure, ERB before RoR essentially had security turned off by default (as I noted). And this issue could happen with any other non-web system, turning into any other kind of vulnerability. This isn't a web problem, it's a system security problem. Bad inputs in a "native" app could lead to security issues in the output of apps on other devices. Badly implemented binary data decoders in a desktop application could do far worse than a XSS in the browser.

This problem is misattributed as a "web problem" because there are far more complete systems on the web than there are on nearly any other platform. It's like the tired argument that Mac is more secure than Windows, but Windows has historically had an overwhelmingly outsized market share, making OS X issues far less valuable to attackers.

> When I argue that the web is unsafe by design, it's because cases like that aren't rare, they're common.

I don't disagree that these issues are common, but I disagree that the web is unsafe by design. The web is a platform. If everyone wrote their Python APIs without a framework, I can guarantee they would be littered with security holes. If everyone wrote their own text renderer in C++, just displaying strings on the screen would be a dangerous task.

There are good tools that make it really hard to fuck up on the web. Seriously, try to accidentally have a XSS vulnerability in an isorendered React app with Apollo. The problem is folks that want to jQuery-jockey their way across the finish line and don't understand that they are making terrible mistakes.
create an app that rates a users face on a scale of 1-10 and matches them up with another user of the same rating. sell the photo database backend to government contractors, law enforcement agencies, advertising firms.
Is org-mode a standard, beyond having only one implementation? You could just pick one markdown implementation.

Other than emacs, some things have very partial orgmode implementations, but they tend to be very partial, much more different to markdown implementations.
It wouldn’t be practical without some kind of underlying infrastructure orchestration system. Obviously some companies have gone the extra step to actually build these systems - e.g. Google made Kubernetes. For any not-huge companies, I think it pretty much just falls to choosing one of the many existing tools.

Obviously it is possible to just throw together a bunch of scripts and vaguely make it all happen, I’m not sure I’d be comfortable to do that in production.
And at the time, Los Alamos was essentially the only place in the country -- probably the world -- doing that kind of research. So it's not really surprising that both incidents occurred there.
When I started coding for Win16, my first option was Turbo Pascal with OWL, eventually I started to use Turbo C++ with OWL.

With the switch to Win32, the tools became VB, Delphi, Smalltalk and Visual C++ with MFC.

Like every Windows developer I also own the Petzold book, bought for Window 3.0 development, and other good one from Sybex, probalby the one book that ever explained how to properly use STRICT and Message Crackers introduced with WIndows 3.1 SDK.

However I might have written about five applications in pure Win32 API instead of using one of the former language/frameworks, as requirement for university projects.

In general, I think many developers only have the bare bones native experience without making use of proper RAD tooling, or the UNIX way, which has always been pretty bad in tooling for native GUIs versus Mac and Windows or even OS/2.
You could have added a bit more information, right?

Risk is usually defined as equal to chance times damage. So which damage could happen in your case? In other words, that security camera, what is it guarding?

In a general sense, if you plan to buy a camera, I think it would make sense to see how the vendor has reacted to security holes in the past.
It does, and mentions that they are not long enough to reach deep sleep. The next sentence says that we need 4-5 cycles to get enough deep sleep.
I keep hearing that Lisbon is a great place to move to! Where are you moving from and what made you decide to move your business to Portugal?
The contention isn't that a computer game can't have thousands of units, it's that the thousands of units in that particular game and the ways they are used and interact with each other, terrain etc would be difficult to represent in a game and give a single continuous view of the entire game situation would be hard to do in a computer.
Hey now, I'm as dizzy as anyone at all the free music-making tools from the Interwebs, but lets be honest .. "web audio" isn't much more than "browser audio" in the context of the DAW landscape, though, isn't it? i.e. giving the DOM access to OS-provided audio services is one thing, doing real audio processing locally .. still kinda relevant, no?

I mean, yeah .. some DAW's are better than other, but give me native for this, or gtfo, kthxbai ..
This. Do this. NEVER GROW UP TOO FAST.
The Society of the Spectacle by Guy Debord

Partially Examined Life podcast did an episode recently on the book. The ideas are related, not quite the same.

Contra another commenter, I don't think it's easy to separate Marxist critique of capitalism from spectacle / simulation replacing reality - I do believe that capitalism is responsible for the alienation, the alienation doesn't just apply to the labourer and his output, but also to consumers and what is consumed.
Even Windows Forms has a layout manager with data binding, but devs have to explicit take advantage of it, there is no need for "drawing it yourself".
I routinely handled beryllium for a couple of years as it is present in certain electronic RF power amplifiers. It’s perfectly safe in solid form. If you drill it or smash it, a different matter!

Plutonium, not so much.
I think Marxist alienation more broadly understood is what drives the simulation dynamic. I don't think the two should be separated.

Marxist critique of capitalism is very solid. It doesn't have any good prescriptions for alternatives, but the critique is well-founded.
Surely you need to ask what you shouldn't read?
In this article, the government directly accuses Google of deliberately storing data overseas, so that they don't have to comply with certain court orders.

How is it a crime to store data internationally?

Am I a criminal for storing my photos on a Russian VPS?

Does this enrage you?

Also absolutely insane that one ruling in one Fed District Court is non-binding to the other Courts.
It's a bit disappointing that Django doesn't emphasize REST more. I'm expecting that "classic" web application frameworks with templates rendered on the server (as long as they are not templates from a client-side framework rendered there for some optimization) are on their way out. And, to be honest, REST is not a strength of Django ...
recently i've installed duck duck go as default search engine in mozilla browser, I need to change my behaviour first before totally move on.
> It's a shame that all of the X replacements on the horizon also ditch the network transparency part, even though that's been a killer feature for me.

I've used ssh -X many times in my life, but at the same time, I understand why network transparency doesn't make as much sense anymore.

Classically, the X protocol kept a huge amount of state on the server, and clients would just send small requests to manipulate that data. Drawing would take place server-side, and it was relatively simple drawing at that, since UI needs were fairly modest. Text rendering occurred on the server with small strings sent from the client. And overall, it made sense to send a small amount of data to produce a large amount of graphics.

These days, however, rendering occurs almost exclusively on a combination of the client and the GPU. Everything takes place via large memory buffers, and compositing. And pushing those over the wire doesn't work nearly as well; if you're going to do that, you need protocols designed for it, with compression and delta-encoding, much like modern video codecs (but optimized for remote-desktop).

So I think it makes sense that network transparency is being rethought, in favor of protocols that look a lot more like remote-video (and remote-audio).
Poor fella. Couldn't handle all the hugs.
This is somehwat geared toward my specific preferences as a social scientist, but my cookiecutter template contains pretty much everything you need for academic writing using pandoc: https://bitbucket.org/jboy1/cookiecutter-pandoc-paper

You can also consult Kieran Healy's guide here: http://plain-text.co (again, this targets social scientists)
Here is the video if you want to watch the full talk: https://www.youtube.com/watch?v=lHtY7TUsLzk
It may be similar to ADHD medication where the stimulant affect causes you brain to “fall in line” which just makes it for the different parts of your brain to agree that sleep is the correct course of action.
this is easy and doable if your change is a front end change.

good luck trying this when its a backend change involving distributed threads, locks, resources, etc where production load is 100x more than staging/test.
This form of cultural eugenics serves no ideal purpose to western society. What are the merits of basing everyone by the hue of their pigmentation? This is exactly the same position that individuals advocating bill C-16 in Canada so that people are forced to acknowledge others transient or sexual state. Again, these ideas only serve to segrate groups and will likely lead to create civil strife.
Hey,
Thanks for your feedback!
The lists are curated by comparing the traffic between all sites within main categories and also by our own rating system (https://statvoo.com/page/statvoo-rating-system).

p.s. You do seem to have waffles and syrup on the brain..
What happens if I ask my friend (in my origin country) to change my password and only reveal the password to me if I'm not under investigation?
The history of America, and of whiteness in America, is race. When whiteness has as an entire category changed to exclude undesirables and then include them when they were no longer as undesirable, it's hard to see whiteness as anything but the racist social construct that it has always been historically.

I personally estimate that in 100 years Hispanics are going to be considered white as they lose their undesirable status, just like happened to the Irish.
I think Apple (and especially Ive) would definitely prefer if the phone was notchless and 100% display.

The issue is where you put the various sensors on the front - even with just a camera you’re still going to have a notch (see the Essential phone) until we can use these sensors behind an OLED screen.

Phone manufacturers are going to be shooting for the bezelless design for the foreseeable future so this issue isn’t something that’s going to be isolated to Apple alone.

The alternative is an asymmetrical bezel, which is “less sexy and cool” than the (mostly) edgeless design. Defaulting to this avoids the problem, but you’re no longer hip.

This is another weird case of being in a transitionary period (wireless headphones is another) of functional design. Until the kinks are worked out, we’re just gonna have to deal with the weirdness because it’s not going away.
Exactly. And just imagine they find fixes for all the age related diseases (basically any organ failure) in the next decades, but not for Alzheimer‘s. You will hate yourself for not just having slept more. Perhaps everybody is then almost guaranteed to turn 125, and you come down with Alzheimer‘s at age 65.
Temporary disposable emails
> This form of cultural eugenics

Wow, that escalated quickly.

> What are the merits of basing everyone by the hue of their pigmentation?

This is a strawman; it's not what I'm advocating. What I am advocating is to recognize that black people have a different lived experience than white people. Colorblindness erases that.

> Again, these ideas only serve to segrate groups and will likely lead to create civil strife.

Like racism isn't causing civil strife right now?
Temporary email address
Use a disposable temporary email address. Free and fast temporary emails to protect your personal email address from spam. Receive and send email anonymously with temporary-email.org
Nier Automata Saved Platinum Games
Should put 1970 in title. It seems to be a republishing of a work created in 1970.
It is a bug, but it's a bug in the spec. Saying that a common mistake like dereferencing the null pointer is undefined and therefore your program can do anything is not useful behavior. The only sane design is for any attempt to dereference the null pointer to cause the program to signal an error somehow. Exactly how that happens can be left unspecified, but that it must happen cannot be unspecified in a sane design. I don't see how any reasonable person could possibly dispute this.
I can't believe this is the top comment.
From the article:

> The theme was to make hybrid physical/digital games using a prototype research system Bret Victor and Robert Ochshorn had made called Hypercard in the World. This system was like an operating system for an entire room — it connected cameras, projectors, computers, databases, and laser pointers throughout the lab to let people write programs that would magically add projected graphics and interactivity to physical objects.

In the same way Smalltalk was about virtual objects computing and communicating with each other through a common environment, Hypercard in the World was about physical objects computing and communicating with each other. The next iteration of the system is even called Realtalk as a play on "Smalltalk" but for the physical world.

There were lots of other demos made in this system, but those will be published at some later point...maybe.
This reminds me of a delightful article that helped me fall back in love with sleep (and therefore find it easier to fall asleep): https://aeon.co/essays/the-cure-for-insomnia-is-to-fall-in-l...
Coding alone is a bit worthless unless you understand some spefic domain really well. So, either find some domain that you find intrinsically interesting and learn _everything_ about it or get a university degree.

If you lock down on some field make it an interesting one or else you might find yourself hating your job one day. University degree will give you way more options but does not guarantee any outcomes.

A good way to make money by programming is to first understand some other domain really well and then implement solutions that help there.

"Coding" means you are skilled in instructing a computer. Now, what should those instructions be? Why? Most domains worth anything are complex - intrinsically or accidentally. Hence understanding a domain is critical to become a valuable contributor.
It's a pretty great general book that I go back to every now and then when I'm reviewing something I'm learning (i.e. GANs) but isn't something I would recommend for newbies to just pick up and try to understanding without at least spending some time learning math/stats since it's a bit more technical than what non-technical might be prepared for.

There's better introductory material out there to Deep Learning, i.e. fast.ai, Ng's Coursera course, Thrun's Udacity's introductory course, tutorials on Medium, where they explain the math/stats behind something but you can get away with learning the process first and play around with code.

Furthermore for some newbies, I think it's a little easier to understand the material when they try to play with it in notebooks (as is the case of books like Hands-On Machine Learning with Sci-Kit Learn and Tensorflow) than trying to just memorize statements on a page.

But certainly for those here who are more technically orientated, it's an excellent book to pore over. I just like to caution friends interested in Deep Learning that it's not the be all, end all way of getting into it and that if someone out there is interested there are more gradual learning curves elsewhere to get their feet wet before committing to trying to go deeper.
Agreed, though exposing/using a bare TCP socket comes with security responsibilities that you are forced to address -- it's good to devolve those.
Software Security Is an Engineering Problem
https://www.xpra.org/ is an example of the video-codec style approach, it is per application/window like X11 and it is extremely usable even over very poor network conditions, and handles 60fps audio and video brilliantly.

Well worth checking out.
You’re a noob, and your chances increase greatly if you get some experience.
>You're assuming Face-ID is a detriment; however, Apple wouldn't have shipped it unless it was as at least as good as Touch-ID.

What an odd argument. Couldn't you have used the same argument for removing the headphone jack? And yet, the iPhone 7's lack of one was a detriment to me.
Ask HN: How to learn Computer Networking for everyday computing?
The question is focussed towards day to day networking concepts that developers encounter on a daily basis.
I find myself at a loss when we discuss concepts like encryption, DNS, LDAP, SSL, setting up digital certificates, etc.

I am not sure if some more devs feel that way. Maybe it's because I did not focus during my networking classes in college? I don't know.

Note that I am definitely aware of basic principles like LAN, IPs, etc. It's just that sometimes networking talk eludes me when it comes to advanced or even medium level concepts.

About my job profile -> I am a big data engineer working regularly with AWS, Spark, etc. but this is much recent, earlier I had been a .net engineer. So, you could say my interaction with the linux world is much recent. Note sure if the context helped :)

I would really appreciate to be pointed to helpful(but practical) resources or share if someone felt like this and did something about it.
Thanks again!
Benjamin is famous for arguing that in an age of mechanically reproducible art, what mattered was the idea in the art which he saw as a method of communication for political purposes.
Guitar browser game with a real guitar
I recently used Jaeger to visualize what my distributed system is doing. Got it done in about 2 hours; pretty pleased with that. Jaeger is visually pleasing, available via docker and just worked for me.
From the article:

> Players try to point a laser pointer at their opponent's socks while dodging their opponent's laser. Whenever they score a hit, the health meter closest to their opponent's play area fills up with blue light. Whoever gets their opponent's meter to fill up first wins.

The light on the ground is a piece of posterboard is that has graphics projection-mapped onto it to signify a person's "health" in the game. It would be cool if there were a physically-actuated health bar like you're describing, though!

The module that detected laser dots was like a page of code. It really wasn't complicated at all.
Broadband didn't exist in the year 2000. It is fair to call that the pre-internet era.
I've been using Jaeger for a few months now and it performs really well. I even wrote a custom tracer for an unsupported language and it was relatively straight forward.

There are a few things I wish it did, but they are all on the roadmap: http://jaeger.readthedocs.io/en/latest/roadmap/
The Optionsbleed Apache Vulnerability and WordPress – WPScans
Its not well-founded because modern financial instruments such as retirement savings blur the line between those who labor and those who command capital.
As I hoped I had made clear, I'm also more of a descriptivist than a prescriptivist. And I'm not against being creative with words now and then. I just wouldn't insist on every one of them becoming the new norm. My criticism is that even when mainstream usage is divided (so descriptivism will not take you very far), people who argue for changing the meaning tend to argue unfairly that seemingly only the people on their side of the divide count. All the others are just boring old prescriptivists. I, on the opposite, would rather go with established use as long as it's not clear that the accepted meaning has really changed.

About sic btw, it indicates that the spelling of a word is exactly the intended one. Even if that spelling is /not/ wrong (afaik). It was meant to gently draw attention to that spelling without giving offence.
"Brand" seems to be the name of the game lately. We encourage these "beginner experts" to post tutorials and articles because "everyone should blog!"/"our publication wants more views" yet we do no hold them accountable to their poor research and writing.

We may laugh and ignore this guy, but these kind of posts can seriously hurt and confuse beginners.

What sucks is that this guy seems genuinely nice and wants to help... but IDK. I personally would never post anything unless I am 100% sure it's correct (when applicable).
Xeno Kovah: macOS 10.13 EFI firmware integrity check
We're based in London, UK; where we started https://analytics.statvoo.com . Lisbon has a fantastic startup scene and there is a lot of money being pumped into the economy to create something really great. It has a very nice climate, friendly people and is the only other place in the world that has a Golden Gate Bridge.
London, like Silicon Valley is extremely expensive and I'm not convinced you get any value or benefit from being in it. Lisbon is definitely where it will shortly be at.
I've been thinking lately about the "sloppy reasoning" problem of critical theory. I used to really love critical theory when I was younger, but now that I'm older I'm almost ready to dismiss it as entertaining crank writing at a time when western civilization was exploring new boundries and slightly adrift. It has more in common with artistic expression than critical methodology. Still valuable, but should not be taken as seriously as it currently is in academia - at least in my opinion.

I came to this opinion when I stayed at a friends' place recently who had a massive collection of critical theory, and I had not read any crit in years. I read a few of the books, and to my own surprise, my reaction was "what the hell is this nonsense?" The ideas were certainly interesting, but had no real provable basis, and just seemed to be the reasoned expression of one author's individual sense of alienation - more like artistic expression than any real solution to the dilemma of civilization or consciousness.
I want to be good in what I do, not just think I am good.

Many people can take enough from simply feeling better than everyone around them.

On the other hand I often feel bad about myself, which isn't good either.
Also referenced in The Matrix: https://www.youtube.com/results?search_query=matrix+simulacr...
I am a dedicated org-mode user and unfortunately, I feel that this is a fair critique. Never underestimate the power of branding and unconscious bias. It's a VHS vs Betamax situation. The tech with the mindshare wins the masses.
Don't you ever go into a file, start playing around with an idea, decide you don't like it after all, and want to revert to the on-disk version? That's probably my most common use of leaving changes unsaved.
Just go sailing.

Ability to code is least needed commodity. Ability to fit is a better commodity. Be able to compromise if software development is your goal. Be a bussinesman if entrepreneurship is your goal. Be a politician if corporate ladder is your goal. Nobody needs coders. Besides your skills are outdated by the time you learned them.
So, go sailing.