skysight-inc/HackerNews huggingface dataset:
Alright, I need to make more things clear here because clearly you have no experience on how HackerOne's platform works:

1) Companies have ability to change when the disclosure happens. This is because sometimes, if I find a RCE lets say, companies have to run incident response. This sometimes take more than 30 days. Also to add, if I just request disclosure for any BS report then it will just cluster the disclosure page with no valuable information for new hackers.

2) I haven't seen reports getting locked unless reporter goes "Can i haz update" every 2 days. Then in such cases, Locking a report is more than fair.

3) You might be confusing this with Limited Disclosure. That is allowed in both sense by companies and hackers. Most of my reports are limited disclosure because sometimes, I have to share personal details or personal information that I don't want other hackers to see.

I support transparency that is why, till this day, all of my resolved reports for public programs are publicly disclosed. Even in Uber's case, I have disclosed bug but they were limited disclosure because it had my personal information. But if you check, Uber has allowed me to write public blogs on my reports.

So please, learn about the platform and a program works before you make any form of assumption.
I haven't used it as much, but it seems just as good for single-person use. It's WebDAV IIRC. I haven't tried to use any "shared calendar" features.
Fastmail certainly is comparable.
> Speed is overrated [...] the average sports car can do it if you have enough space.

Returning to car examples, the race build of sport car tends to be worse in top speed that its street version and favor braking/acceleration, simply because modern racing and racetracks put emphasis on cornering where driver skill and tactic is decisive, and not on long straights, where take overs result from top speeds.
Wasn't he involved in Chrysler's C3 project, the major success of which was the agile programming industry?
Disclaimer: I only scanned the article, I'm coming back to it when I get more time. I'm largely just responding to this comment right now.

Yeah... I'm very torn too...

My dad and all his six brothers and sisters, save for one, are on disability, and have been for years. Their disability, without exception, is laziness and being self entitled brats. I'm not saying they don't have medical issues, they do, but don't we all at some point? I have zero sympathy for such people. I mean, I'm pretty sickly as I mentioned in another post, I could milk it and almost certainly get disability, but I am employed. I am employed because I want to be self sufficient. I've been on short term disability in the past, I worked to get myself back into the workforce. It's just like any other setback or road block in life, you work through it and move on. If I were lazy I'd say "I can't" while on short term disability and eventually apply for long term disability or social security like my shitty family.

My aunt's and uncles can do more than me half the time. My dad is ridiculous when he talks about how difficult it was to work, he basically says, "oh God, it's so difficult.. they want me to show up and do work, and I don't want to. I'm traumatized! Pity me!"

Same as TFA, when I worked at BK we would schedule extra people on the first of the month and it would usually be unusually busy. Why? That's when social security checks come in.

I am extremely sympathetic though to the people who truly have problems working... I feel like we, as a society, should take care of such people. But separating them from the lazy malingerers seems almost impossible sometimes.

I also believe anyone who got injured in the military absolutely deserves disability.

Or maybe my personal biases are coming through from having such a shitty and abusive family. Maybe I'm truly not fit to decide who "deserves" disability?

I guess this post turned out to be somewhat of a rant...
+1, the running Alto was the highlight of my trip there.
What the hack happened in 2017?
What average sports car?

Cars with more than 600hp or are tuned so well as to need less surely aren’t average. We’re taking at least $75k which really isn’t something an average person will ever be able to buy.

Sure you could probably build something with an engine capable of producing enough power— but I don’t think I’d want to do 200mph in a 96 Honda Civic.
Out of curiosity, why couldn't they just replace the bad inductor, instead of swapping out the board entirely?
* also, retain an atmosphere "over long enough timescales"

From the MAVEN research papers I've read, we're talking ~5,000 metric tons / yr of atmosphere being stripped.

Which is a lot, but not an insurmountable lot.
Before my roommate got me into using Uber a few years ago, I was hesitant to travel to new cities or even go somewhere new or unusual in my own city because of being intimidated by having to figure out where and how to hail a taxi or having to figure out the bus routes.

I'm not familiar with he US, but taxis in most European countries have an app these days. Even >20 years ago you could just call their phone number and they would pick you up from (or drop you) anywhere, even in remote villages, even at 4am. Never had a problem. I find it hard to believe the same isn't true for the US.

Sure public transport isn't as flexible route/time wise but I don't see how Uber is different from regular taxi service - apart from the price.
Speaking as someone who writes ClojureScript themselves, ClojureScript is definitely in the category of technologies that show no sign of explosion whatsoever.

React and Vue are both great technologies, but with Teact the template syntax is optional, and no lisp user wants another syntax...
Is there any effort to collect those photos/accounts for later release, say after the person's death?

I understand the reluctance for them release publicly right now, but it would be a shame if it was all effectively lost because of that.
There's individual Nuclear plants of that size and the grid already needs to plan for those to be out unexpectedly (far less predictably than wind in fact) so it doesn't seems to be that big a problem in practice.
I agree with your general point, but currently don’t think the math adds up on unit testing for us.

Its not that it wouldn’t be better if we had unit tests. But their benefits are mostly in the future, meaning they need to be discounted for the value of time. And even without discounting, they won’t be as valuable to customers and our product as actually creating new and fixing existing features.

If our product fails in the next year, any efforts yielding most of their benefits after that are wasted. Any efforts that yield more customers and usage now, gives us more resources to do more things in the future, including unit tests.

That way if we get to that major, risky expansion in the future we will have more resources to write unit tests then, when they are most useful.

And lastly, i’ve reviewed the bugs that business prioritizes for us. Virtually none, including crashes and feature fails, would be caught by traditional unit tests. Lots of them were force unwrapping code written by original contractors that would pass unit test, but crash in multithreaded environment of garbage collection frees the right object.

To do unit tests we would also have to write a ton of mocks, making our production code less maintainable and understandable, and potentially introduce new bugs.
I believe you're correct; Mac XL sounds right to me, too.
Also, the loss of voting rights for people with felonies[1] means that the most likely to feel strongly on this issue are also ones that can’t express that opinion via voting.

[1] https://en.m.wikipedia.org/wiki/Felony_disenfranchisement#In...
OpenNIC – alternative DNS root
Print Color PDF Apple II Print Shop Christmas Cards
Because it's way harder to make a SSBN.
I was in the situation earlier this year where my new job contract wasn't yet signed and I was trying to figure out how long of a lead time to give my old employer. (Note: both old and new jobs are non-programming positions.)

Turns out that I didn't need to bother. When my boss found out that I was about to land a new position, he immediately called me, on my vacation, to lay me off. So much for a transition period. On the bright side, by getting laid off rather than resigning, I was owed a good chunk of severance.

My takeaway: only provide the minimum notice required by your employment contract, if any. Because your employer sure as hell won't return the favor if they decide to let you go. So if your employment contract doesn't require notice, don't give any.

*Minimal notice was actually an issue at my old firm before I left. I kept wondering why people would announce their resignations the day they were leaving, out of the blue, without providing any opportunity to transition clients and work. I found out the why the hard way.
Indeed. This mentality is poisonous. Relationships are based on mutuality. If one partner is always making concessions and always going the extra mile while the other typically only puts in the minimum effort and is only weakly attached to the relationship outside of personal benefit that's a dysfunctional relationship bordering on abusive. And yet that is the common case for many employee/employer relationships today. Employees are always being asked to work extra hours for no pay for the good of the company, they're always being asked to work for less money if finances are tight, they're always being asked to do whatever it takes to ease the transition for moving to a different job. While time and time again the reciprocation of those efforts never, ever materializes. Pay isn't spontaneously increased when finances get better. Executives don't take a pay cut or work extra hours so workers don't have to. And it's extraordinarily rare for an employer to facilitate an employee transitioning out of the company to a better job elsewhere.

Do you have significant equity in the company? Is there a long list of examples of the company helping you out independent of your value to the company as a worker? If not then don't treat the company like some family member asking for a favor, treat them professionally and set appropriate work/life boundaries.
I agree; using JSX outside React feels kinda silly. But Vue is much simpler to grok than React.
Cool. I see there's a Lisa emulator that exists and works on the raspberry pi: http://lisa.sunder.net

Sounds like access to the source code might allow for some more progress.
You don't build an economy on Pokemon cards!
The people who pay my team mostly want bugs fixed. Bugs going in testing are far more expensive to fix than those found in code review.
> Russia is hostile? By what metric?

Would the metric of having invaded two sovereign nations in the last few years count?
Citation Needed, please.

The most basic approach for responding to a change in data is to compare the previous and current props in the `componentWillReceiveProps` or `componentDidUpdate` lifecycle methods.

Meanwhile, Redux is the most common state management library used with React apps.

You certainly _can_ use MobX, RxJS, or some other FRP-type library with React, but to claim that "the whole ecosystem is heavily tied to them" is simply wrong, and shows a gross misunderstanding of the React world.
What would you expect the habitats to have instead of nitrogen? You wouldn't want a high oxygen atmosphere. Not only is it an extreme fire risk (see Apollo 1), but humans aren't built for it - oxygen toxicity exists.
Lazarus, Xojo, Gambas to name a few.

A lot can also be done with an interface designer like Glade.

Delphi is still around.
Native form validation 3: Error messages and recommendations
Most places in the US exist in an At-Will or Right to Work state, people can walk out and be fired without notice. Companies fought hard for this and they got it. The 2 weeks is just a courtesy, I've seen people walk in Monday and hand in a piece of paper that was back dated 2 weeks and walkout the door.
A thing that will sell vue/react native for me is the ability to only use them for UI. I don't wanna use them for logic or heavy stuff. Just have them for render the UI.

This mean, easy way to embedb into iOS/Xamarin.NET.

I have look at react native and NativeScript and both are very hack-ish for my taste.
> The hard truth is that OpenGL 3.0 was far too tame when it came to breaking compatibility.

That is your opinion, mine is that breaking compatibility is the wrong answer in all but the most extreme cases (of which OpenGL was not).

Keep in mind however that i am talking about OpenGL. IMO they should have indeed created a more low level API similar to Vulkan back in 3.0, but instead of calling it OpenGL 3.0 they should have called it something else (like, i dunno, Vulkan :-P) and left OpenGL 3.0 alone to be an easy to use and fully backwards compatible API without creating an unnecessary schism (like the one we have with Apple/Mesa and everyone else today).

Of course that is what they eventually did with Vulkan, but i'd rather have that without the damage that they made to OpenGL.

> Instead of clinging to OpenGL 1.x or 2.x for no good reason

I have a good reason, i already explained it in my post.

> you should really switch to a high level drawing library or rendering engine

That library already exists and is called OpenGL with the compatibility profile. The only problem is that it isn't supported by every vendor that claims OpenGL support.
The Audience Strikes Back: 'Last Jedi's Plunge Is Worst Ever for a Star Wars Pic
> There is no explicit dependency on RXJS or its analogs, but the whole ecosystem is heavily tied to on them.

That's flat out untrue. This might be some people's approach but in all my years of writing React apps as a consultant I haven't had to use any of those libraries on a project.

FWIW that problem is usually solved by reorganizing code a bit and passing a callback down.
I can comment on using pub/sub - it's an immensely useful abstraction for these kinds of tasks and something that is quite difficult to implement yourself with the same level of guarantees that using the cloud service will provide. Any time you need to pass information or trigger events asynchronously messaging is the first choice IMO.
As much as it sucks for the employer, it shouldn’t come as any surprise to them. Culturally businesses have no problems giving employees zero day notices when they’re laid off or fired. Loyalty works both ways.

Some businesses (yes a small software company I have friends at) will walk you out the door the moment you give notice because they’re in the banking industry and they’re concerned about people stealing confidential data. As a result their only mobile software developer decided to give zero days notice. This left them in a lurch, and I got a nice 4 month sidework contract out of it...
I believe it's OAuth (same with JWT) in that there is no endpoint one can POST to in order to "logout," but the end-of-authorization concept exists in both OAuth and JWT via token revocation on the server-side

SAML has an actual logout endpoint
Fair enough.

It does feel like people can say all sorts of disparaging things about the generations that came before millennials without any consequences on HN. I understand millennials are probably the largest contingent of HN users but I would just ask that the rules be applied equally across the board.
I love this kind of unifying formalism, but I wish they at least gave some intuition for what a weird machine is. I appreciate that it takes a lot of buildup to define them formally, but it would have been nice to have a plain-English explanation somewhere in the introduction.
Agreed. Unless your employment contract requires them to keep you on for the transition period, the most likely outcome is that they'll let you go immediately and you'll spend a few stressful weeks locking up the new job.

The only time a departing employee should give their old employer time to transition is if the employer is willing to pay for their salary and benefits during the full transition period.
Yeah, but we have no idea how long this has been unfixed. I reckon all security bugs not paid out to Uber at this point should just get automatically publicly documented.

Also: this is Uber. At this point, they’ve used up all their good faith. I definitely wouldn’t be taking anything they say in good faith - I still haven’t forgotten them threatening a journalist or publicly tracking the ride of a CEO for an entire room of people!
For 3) what are you not sure about? He demonstrated arbitrary DOM manipulation, and it reads like the XSS worked with some WAF avoidance. Brass tacks do you agree they should have paid out something for this?
It is often considered surprising and controversial. In particular, if the experiment performed included "controversial" stopping criteria then you could imagine the same data arising but not trusting each result identically.

Arguments exist for each side.
Thanks for the reply. What do you mean by "different versions of a crate?" Here's a scenario:

1. Compile a library libA that references type T in CrateX.

2. Add a field to T, and recompile CrateX.

3. Compile an executable a.out that passes a T to libA.

Nobody bumped CrateX's version or recompiled libA. Won't this crash? Or does this produce a "different version" of CrateX and so it will refuse to link?
They usually reach out to me or are referred to me via a friend. One time I had a friend doing some work for Vodafone Australia, and he just asked me to come out for a month long engagement to help them get ready for the iPhone 5 (which turned out to be the 4s iirc). Another time I co-founded a Meetup group in a relatively new technology and a startup wanted to leverage that so they wanted some help getting started and having some good patterns to follow.

So I guess I would counter what you said with experience/network rather than a brand.
I would suspect something akin to the Chesapeake Light Craft kits (http://www.clcboats.com/shop/kayak-kits/?jm=1). Panel edges are "stitched" together with wire, glued with epoxy, and then layered in fiberglass and epoxy.
For the confused, rocket is called arugula in American English [1].

[1] https://en.m.wikipedia.org/wiki/Eruca_sativa
I've actually seen this machine in person, I have a punch card with my name on it somewhere that it printed out.

As someone who missed this era of computing entirely, but was quite familiar with it, it was very awesome to see in person. One thing that I really wasn't expecting was the smell in that room. I spend a lot of time in data centers but the room at the CHM with the 1401 smelled more like a machine shop than any data center I've ever been in.

The CHM, in general, was awesome to visit, but definitely go on a day when you can get the 1401 demo.
ResEdit changed my life as a kid. I basically made a full game conversion at age 9 using ResEdit a basic draw application, and a Midi keyboard over serial on the family LCIII
A rich founder should take this companies on and bleed them dry.

This is one place I would love to see Amazon undercut the competition and give real value to the people who need it most.
Clearly a problematic exchange, but, nowhere is it said that this is a bug bounty program interaction nor is it an account of Apple denying promised payment for such a program.

I'm certainly not justifying a poor communication and response to the report, but, it seems like a very different kind of problem, and not one reflective of the kind of corporate sleaze often seen from Uber.
I will not say anything about whether he needs to get paid or not until Uber discloses the report. If he showed that it is a valid xss and not a content injection then I guess it would be valid. But again, right now we do not have the report made public.
Yeah wtf, this is wrong. They should require explicitly permission before transferring ownership.
Apple /// was their first stab at a business computer. Too late as the 16 bit revolution was already underway.
FAQ: What is the meaning of tuwat?
I have zero expectations on formatting preferences. But i have high expectations on writing correct, maintainable code. If i see code that can fail in ways you haven’t anticipated, or is a duplication of other code in the project i’m going to point that out. If you implement something in a way i wouldn’t, or can’t understand, it may be an opportunity for you to teach me something.

And if I tell you to re-implement working code my way simply because of some personal preference, i would expect you to tell me to fuck off. Cause that’s what i’d say if you did it to me.

To give you an idea of how our code reviews are perceived, we have one junior dev, at last retrospective she spoke up about how much she valued and appreciated them.

Obviously some places don’t get it, but i think we do.
They did, but adoption has been very limited.

If you look at fees from the activation date (a few months ago now) it has not moved the needle at all.
Have a look at this list, hope it helps! http://stephaniehurlburt.com/blog/2017/7/14/beginner-friendl...
The current state of kernel page-table isolation
The problem is not with advanced tools, but with incentives.

Most sites exist to bring a profit. If they are paid / subscription-based, they can be nice as heck. If sell a product, they make examining and buying it as effortless as they can.

But the rest of for-profit sites are vehicles to sell eyeballs to advertisers. They afford to the advertisers as much comfort as they can without turning too much readers away. They exist not for the readers' convenience.
I don’t know why this was voted down. It sound cynical and potentially judgmental, but I did t read it that way.

There are fewer and fewer jobs available for people without much education, and in the US at least also very little practical assistance. In such a situation going onto disability is a rational decision.

There are jerks who milk the system, sure. But I think the situation described by the article is one where there is no social safety net for the unlucky.

The US seems to have a punitive view of social assistance. This is an important reason why we should use robots to replace middle class jobs ASAP. If the only jobs replaced are physical labor, ced people will be left to rot. If the jobs replaced are lawyers and oncologists, governments will act.
Several people asked him repeatedly to post his numbers and links to his sources, but he continues to stonewall and deflect. He can't answer those questions so he won't, which proves my point that he's not arguing in good faith. That's just how people who subscribe to conspiracy theories predictably behave.
In related news, Adam Back (CEO of Blockstream, current stewards of BTC) inadvertently admitted to hiring people to shape the narrative in social media.
Well you're dismissing things like on the fly color correction, when pre-grading is an important feature for a lot of productions. High FPS is also not a rare requirement. Sports/Action/explosions/water splashing/hair commercials/etc/etc all benefit from high FPS capture. These are all features that the competition advertises. Things like high dynamic range, a file format that allows for easier post production, etc are real tantgible benefits that they give you. I'm not quite understanding where you're coming from.
Looking at their rank history at AppAnnie, they were doing really well in 2015 but it's been downhill from there (from top 10 to >500 in all the major App store charts). How they were able to go from 140M to 350M downloads in the last year (compare this article with the techcrunch one) is a complete mystery. Also, stating your number of users without any qualifier (e.g. MAU) in a tech article is a bit of a red flag, in my experience that usually means that it's a vanity number (yearly active? Who knows).
Are you familiar with the freelancers' concept of "fuck you, pay me"?

I guess, that's how the first part works. There are things you can try, and there are other things. Messing with freelance pen testers is clearly one of latter.