skysight-inc/HackerNews huggingface dataset:
Honestly Uber's response to all of these seems pretty professional and reasonable. The submitter was hard to work with and seemed pretty eager to jump to conclusions about the Uber team's motivations. I haven't seen the details of the JavaScript XSS one but given the past behavior I'd understand some skepticism.

Their response to the Microsoft Store lack of cert-pinning seems fair (though disappointing for the submitter): https://hackerone.com/reports/293358

> This limitation is already known to us and as such we'll be closing this duplicate per our program guidelines.

to which he replies:

> Cute. Big surprise.

They should link to a submission if one exists, but it's possible and reasonable they already had an internal ticket.

The second issue, not revoking tokens on the server side after logout, the Uber rep replied:

> Thanks for the report, but after looking into it, this is a known limitation of our legacy authentication system and we're actively working on a new system that will replace these long-lived tokens with a more mature bearer token. Currently, the value associated with the x-uber-token HTTP header is a token that is only changed upon password reset.

The submitter added a long list of CWE items for OAuth, one of which was relevant (CWE-613: Insufficient Session Expiration). The Uber rep replied:

> Closing it Informative is not a judgement on the validity of the report -- it simply indicates we already knew about this and are actively addressing it already.

Seems reasonable that Uber's team knows their tokens don't expire and that it's not a good practice.

The rate limiting on the promo code endpoint report is the worst. It looks like Uber actually forwarded this one on to an internal expert, who replied with:

> we would consider the lack of multi-factor authentication a best practices concern, out of scope for our bug bounty program. Additionally, Uber tokens (UUIDs) are made up of 128-bit highly entropic values, making them very difficult to guess or brute force. We’ll be closing this report Informative, as this does not pose a security risk in itself. We wish you the best of luck on your next report!

Which is completely fair (you'd have to try ~10^29 values to get a valid token assuming a billion accounts, which would take millions of years at 1 trillion requests per second). The submitter argued their PRNG might be broken but provided no evidence that was the case. The submitter then posted some very hateful personal attacks against the people responding, including:

> Oh my God. Are you seriously the Program Manager for Uber's Security Division, with a 2013 psych degree and zero relevant industry experience other than technical recruiting? LULZ

I can understand feeling less than obligated to give a payout on these.
This is a very common misconception these days, IMHO. "Because people just use best of what's available, I presume that they are actually content with what they have." Today another thread talking about web apps and the heaviness thereof, people suggest that given people use these apps/websites, they must really prefer these slow, messy and creepy things to plain, information-dense sources. This might be indeed true, but you can't conclude so just observing the status quo from outside.
I have this suspicion that bars like that existed forever in cities. Usually tolerated by being studiously ignored. Except when there is a big migration to the cities by vastly more conservative rural people. First thing to the new comers try to do is shut down the dance halls, gay bars. Clamp down on brothels and street walkers. Unmarried people shacking up. And make everyone go to church.

That sort of thing is behind everything from conservative Hindu's harassing unmarried couples in India, to prohibition, the movie code in the 1930-1960's. Probably the move from urban to suburban in the US is behind the shift back to conservative mores.
Except the other one was posted two hours earlier...
"dotnet publish" should have you covered for restoring from nuget, compiling and producing a deployable package. Is there something it's missing for your use case?

Noda Time might have what you need in a datetime library.
Thanks for the clarifications.

> it's not limited only to string parsing, but can be applied to any other series-like value and code (i.e. blocks) itself

Sounds somewhat similar to OMeta (http://www.tinlizzie.org/ometa/) which can pattern match streams of objects.

With contexts it sounds like almost every word can be late bound? Also it seems blocks and contexts are decoupled which means you could evaluate multiple blocks from different parts of your program in the same context, or give each a unique context, etc?
Totally ageee.
I did the same thing the other day. That's an easy mistake to make.
In Oslo people complain that rich people in suburbs get Tesla just to avoid traffic jams and use public transport lines that electrical cars can also use. Yet for less fortunate folks who needs a family car non-electric cars are still the only option money wise.

In principle they have a point. As battery is still extremely expensive it is cheaper to make a plugin hybrid that can drive like 50 kilometers on a battery and uses small engine to get a bigger range. In practical usage such car will be 95% electric yet cheaper than pure electric with range of, say, 300 km. Yet in Norway only electrical cars have zero taxes. The tax insensitives for plugins are relatively minor and do not compensate for price increase due to more complex power train. So people looking for a bigger family car often get a gasoline or disel car.
But a third fact is true of Norway. You don't drive very far because of the geography. Instead, the market for domestic flights is booming.

If you live in a country where you don't drive your car outside your county (sligth exaggeration there), there's no need for fossil fuel.
Because it didn’t, it was hugely biased against CO2 emissions only which allowed the European favored Diesel engines to appear much less polluting.

On top of that the policy focused heavily on engine “size” which again favored Diesel engines and vehicle weight which effectively screwed over early plugin hybrids and currently screws over large families and luxury cars.

The weight and capacity policy has also been abused to make luxury and performance cars considerably more expensive despite being more economical and less polluting at road speeds.
Yep, I should add that portion. You're spot on. This was surprising to me because I've shown both models contain the same information but identical Frequentist hypothesis tests will show different p-values. This unshown part is what suprised me. The next post! :)
Uber is the last company in the world that gets to complain that somebody isn't being nice to them.
Norway also has abundant hydro electricity. EV use makes a lot of sense in that context.
I have a hard time believing this will hold up in court. Surely they take some measure of federal money to keep up those roads - blocking access to other taxpayers just because they reside outside your city is clearly unequal treatment.

The problem here seems more like the infrastructure that is being diverted around, rather than the alternate routes themselves...
> So please, learn about the platform and a program works before you make any form of assumption.

Welcome to Hacker News, I see it’s your first time visiting.
That said, if you walk around Oslo you really do see quite a lot of Teslas on the road; it's noticeable.
IIRC, it was around 10k.
I challenge you to explore addiction more fully - it is simplistic to assume that all addicts are opioid-linked and that maintenance dosages would remove harm (methadone programs are basically performing this function, so it is not as though this doesn’t happen).

Firstly, what is societal neutral? Is it where a person is able to indulge in their vices without affecting others, or causing cost to the community? Because if so, drug addiction (of prescription, or legal drugs - alcohol and tobacco - and illegal drugs) fails the test.

Speaking as someone working on the front lines (emergency departments) of societies care for vulnerable people, addiction is an enormous scourge that causes immense harm - particularly with ice which is highly destructive to the individual, their families and the social fabrics of communities.
Most companies run Windows by default, that's why IE took over the corporate world.

Netscape's plan was to so totally abstract the underlying OS that it didn't matter what it was.
You mean, the last 2 people in this echo chamber (outside of which there are orders of magnitude more people getting software stuff done) - there, fixed that for you.
If not, maybe we can engineer a breed of worms that can.
There are plenty of proposals, and very little delivered.
Yep they are lucky. The stock market is a gamble in the short run. Even a home is a gamble sometimes. But to me what was important is that they started putting away a much larger share of their income; even negative returns are better than blowing your money on boats or SUV's or a timeshare or gold coins or alaska cruises or whatever stuff TV tells older people to buy. I think the main effect of the stock market doing well wasn't so much to give them returns as to make them super excited about investment; so they scrimped and saved a lot more because it was fun to see their numbers go up so fast. They also worked harder at their jobs (both are self employed) to make more money to put in their retirement fund.

It's also easy to shield yourself from massive losses through diversification. Vanguard even had someone talk them through selecting funds, even when they didn't have much money to invest. I also got them to pay off loans (cars, credit cards), which is the safest investment you can make for the returns.

I should also emphasize that, having started so late, stocks could never be their primary source of income. At a reasonable withdrawal rate I think they'll get about about $15-25k per year. Most of their income will still be from social security. But on a long enough time scale one of them will get senile or cancer or something, and we'll thank god for that big pile of money when it's time to hire help.
Well that works too.

Love your website, by the way.
Let's pretend MySQL had such a license. The cloud providers would then likely either use a fork, or simply skip that technology entirely.

You'd need projects without viable competition (think: the Linux kernel) to use such a license for it to take hold.
A shout out to my favourite audiobook website, https://librivox.org . All free and open.
The atmosphere of Mars contains nitrogen. It could be extracted and concentrated to provide the same percentage as earth's.
Show HN: Solo – An app for sharing loneliness and aloneness
What makes ASHoNE so fantastic is it doesn't shy away from "science is messy; while there is a common quest for objective truth for the most part, it's incredibly convoluted, random, non-linear, and in any case polluted by our apish propensities".

That's what makes the book so relatable.

A fry cry for that worrying pop trend of "Science is so awesome, bro!" that's been picking up lately (which I find superficial and cringy to the point of being a cult).
Archisuits allow a wearer to fit into, or onto, structures designed to deny them
Dont you find it bizzare that adding extremely complex engine + drivetrain integration is cheaper than adding additional solid state battery storage?

It’s a bit like CRT vs LCD or HDD vs SSD. Eventually the reduced complexity or even weight of raw components are cheaper than counterparts.
Given the nature of the game I'd say that's a mild response. On a scale of 0 to 10 that would rate a 3 or so. If there is one group I'd really avoid pissing off it would be pentesters.
Yep. In some ways LisaOS was ahead of where MacOS is now. It had stationery pads, for example, and it just felt snappier. On a processor 1/1000 as fast as a current Mac.
Plants are pretty tolerant of solar radiation. Far more so than humans.

In any event, what you'd probably do is use reflected light to filter out high energy particles.
With all the horror stories I've been reading since the 90's I'd never help any company like this (again). Discover a vulnerability and get sued or punished. Fix their bugs for them, get nothing for doing their job for them.

I remember contributing to BigCommerce's crappy software just because I needed it to actually do it's job (despite the fact that my boss was paying their enterprise rate). I got shitty responses from their devs and nothing got fixed when I forked and submitted patches. I kept and then hid my working fork and never looked back.

Yeah, a company can fix it's own problems. Open source, perhaps... Helping a profitable business for nothing? Never again.
The decision makers are not particularly concerned about superior alternative vendors or value for those that need it most.
I am using python to wrap Windows-C this week. I tried Idle again for the first time in years. Its text navigation is nasty, and caused me to go to shift editor. For example, ctrl+shift+arrows highlighting is something I do all the time and Idle's behaviour is inconsistent with Windows convention.

It is hard to know how to make it mainstream from where it is. If they changed keyboard behaviour to align with Windows-convention, it may annoy parts of its existing userbase who have become accustomed to it.
They arent subsidized. Internal combustion vehicles are disincentivized with taxes. Externalities internalized.
I don't know about the last sentence. As an independent consultant I've been in places for years, but that's because the place was relatively transparent with me and so I chose to be transparent with them.

You should go honest and transparent first, but if people play games then you have to protect yourself. However, my theory is that consultants are less prone to the crazy political storms that engulf full-time employees and give them insomnia.
I am not a Trump supporter, I am not even American, I am just a neutral observer so I can see things without the tribe mentality.

> It surprises me that Trump supporters can't see beyond words.

What was the alternative, Clinton was not sure what her platform was and I agree with you, some of her words were
very clear, calling the Trump voter a deplorable. That is not how you win elections.

If you are a 50 year old guy who worked hard all his life and then lost his job because the factory went to China are you going to vote for a guy who says he will bring back jobs or are you going to vote for a lady who could not figure out what exactly was her message (yet was in the news for her controversies) and calling you a deplorable. The choice is simple you will vote for the guy who says he will bring back jobs.

Saying Trump is all words is not the argument you can make when the general public have been hearing empty words from establishment politics for many years and yet making deals to ship their jobs overseas.
That's not how it works. The US also relies on the ability to promptly respond to a first strike, which say the UK does not.

What I'm pointing out is that you've conflated two things. Just because one aspect of your deterrence is the ability to launch your land-based ICBMs within 30 minutes, that doesn't mean that the inability to do so (e.g. because you don't know who struck you) means that you're out of options.

Besides, there's no way someone could amass enough SLBMs in the Pacific to take out two aspects of the US's nuclear triad without the US knowing who owns those submarines.
The only real solution is a region-wide implementation of congestion pricing, which will cause the main arteries to flow freely, and mean that no one will try to get around them.

The best plan for the greater NYC area is: http://iheartmoveny.org/
A decent consultant would never leave from one day to the other. If the employer/customer is doing their part, a consultant is reliable. The money's better, the reputation is what earns them more gigs. Also, there's not anything inherently bad with letting them go with zero notice, since that's what you pay for.
I was going to suggest hackerone should be responsible for both storing and arbitrating known bugs but this is even better.

It's really hard to not think Uber is simply playing hackerone to get free penetration testing here by responding to everything as "already discovered" or "out of scope"... A dangerous game though if people catch on and get pissed off enough and just publish it like this, I can't really blame the author, the whole process sounds like bullshit.
With music amplifiers basically a couple TO-3's with nominal passive heatsink can output the equivalent 50 watts of a pair of 6L6 vacuum tubes.

The tubes run hotter because of the always-on heated cathode which is not needed for solid state amplification.

BTW still have a couple Diablos and a DEC drive, for parts, that could use a home.

Also an HP1000 in a full rolling rack the size of a refigerator, plus a VAX 4000, it's a mini-fridge. These are in good shape.
In the earliest days of the Mac (1984) you had to have a Lisa to develop for the Mac, because that was the machine the Pascal compiler ran on. I bought a Lisa and a Mac for this reason. It'll be fun to see the source code.
This is nothing. A Pizza shop in Oslo was busted back in May for using Facial recognition software on it's customers:

> A crashed advertisement reveals the code of the facial recognition system used by a pizza shop in Oslo...

Source: https://twitter.com/gamblelee/status/862307447276544000
Hacker News: Happy Holidays
Ladies, gentleman, hackers, entrepreneurs, daily readers, occasional readers, and seldom readers alike:

Whatever you celebrate... enjoy yourself, enjoy your time with family, enjoy time off from work, enjoy the holidays. Relax, be merry, eat good food, and it is certainly okay to indulge with a little dessert and some wine.. or whatever you drink.

Whatever happened to you this year, I hope it was good. If not, I hope going into the New Year, you have learned from your mistakes and are now a better improved version of yourself.

Keep on contributing to the greatness that is Hacker News!

I hope you have a wonderful New Year filled with lots of success. Take care!
Technically they are not subsidized, they are just not as heavily taxed as combustion engine cars.
My mother works in Barnes & Noble. The corporation supplies each store with a selection of music that changes periodically (once a week or month, maybe). I don't know how the decision is actually made in the corporate offices, though.

I don't really want "good music" playing around all the time, though. It's a distraction from whatever I'm trying to do. Something quiet that kind of blends into the background is fine, though.
Same here. For us personally, the license made no difference. We know we will never come across any patent issues with Facebook. But the fact that it existed led us to believe that in the long run an alternative would emerge since larger corps would avoid it because of the license.

Now that they got rid of it, I have no such concern investing time in react for the short/mid term term.
I've seen people leave without even a notice. Gone one day and no indication afterwards. The employer is just worried that nothing bad happened to that person.
This article sounds pretty extreme. "They've read your biography" to personalize your dining experience? I think very, very few places would bother with something like that. Maybe if you are such a regular that you know all the people there by name, or if you go to a very expensive restaurant where cost is not an issue.
Ahh, the Lisa. The last great Apple device.
To a certain extent it has. Living in London, I can't remember the last time I paid with cash! Now cryptocurrency is a whole other kettle of fish...
It's definitely the key to the networking link to Mars. Whether it will involve lasers or RF, I don't know, but an IP system won't work.
>Bugs going in testing are far more expensive to fix than those found in code review.

How so? Particularly if you don't do your code review right after development. That holds true for production vs. QA, but I'm not sure it does for QA vs. code review, unless your QA deployment and ticket bounce back process is overly cumbersome and you don't have time planned for it.
EVGA GeForce GTX 1050 GAMING 2G Graphics Card
>state-full

You meant stateful, right? I mean if we're being pedantic it's good to actually be correct.

Something that has success is successful, and when you're having trouble sleeping you might say you're feeling wakeful. Why then would it be state-full?
> "dotnet publish" should have you covered for restoring from nuget, compiling and producing a deployable package. Is there something it's missing for your use case?

Thanks a lot – this is the first time someone actually provided a useful solution, this might actually work well enough for simple projects.

> Noda Time

Also thank you a lot, that actually is significantly better than Joda Time in the Java world, and as result, actually useful (in fact, it feels like a 1:1 clone of JSR-310, at least from what I've seen in their API docs)

This is actually very helpful, thank you :)
Interesting comment. Lazarus and Free Pascal are good, alright. (With some issues, as any software has).

IIRC, VB's initial code name was Thunder. I worked on VB in a few commercial projects. Alan Cooper demoed VB 1 to Microsoft and they bought it.
I like the looks of this. Time to spin up a VM and test it.
Right click -> Sort Room/Desk/Bookshelf/Bathroom is the feature I want for life.
Yeah right, did I get warped back in time? This is the opposite of modern.

2 weeks notice is an anachronism in the age of "human capital" and at-will employment. This is the world HBS biz school dbags made and its the world they'll have to live in.
wrong, anybody can fork it (assuming blockchain-based ledgers)
See this document with the calculation: https://www2.isye.gatech.edu/~brani/isyebayes/bank/handout2....
Facebook has corrected the licensing issue. Most consider it a non-issue now. And I think Facebook proved with that move that they are willing to play ball.
I feel like sending earth worms to Mars is like sending pigs to South America. Perhaps there is nothing living there... I don't know. But do we need to have such an imperialist attitude with planets too?
Chernobyl Nuclear Power Plant
Having used both React (with Typescript and Redux) and the latest Vue (with es6 and Vuex) I prefer React, and I don't even use React Native.

Vue is better for onboarding people more in tune with "classic" html + js development; and that's where the advantages end as far as I'm concerned. This might be a big win for some people.

The way I reason about it is that React is simple, Vue is easy.
When you take into account Vue's templating language, React's api is small in comparison.
A beginner won't know how to do some common use cases reading React's docs, when Vue might have a something built-in in its templating language (e.g. slots, or the component tag for dynamic components).

Slightly annoyed with Vuex too because of its slightly leaky abstraction.
You have to remember to setup the properties you mutate so the reactivity will detect a change; and also remember not use array indexes arrays cause it can't detect changes otherwise. The array index thing will be fixed in the next version when they drop support for some older IE.
Using Typescript would probably help a bit here, although Typescript being useless for checking Vue templates really feels like a huge chunk of its value is wasted.

Typescript is not currently available in the official blessed boilerplate which greatly affects its uptake in the Vue community.

Anyway, if you already know React, there is zero advantage in investing time in Vue.
Secure Communications in Google Services with Application Layer Transport Security
You might be interested in Hernando de Soto’s project to create a global blockchain registry for land ownership.

Podcast interview: https://www.ft.com/content/5887858e-f499-4bff-8f3f-5434b5780...