skysight-inc/HackerNews huggingface dataset:
I disagree they wanted to ban firmware, they simply want to prevent interference. I doubt they actually CARE about the firmware. Regardless, nothing you mentioned changes what I said.

Yes, under the revised rules [1] manufacturers are required to ensure certain changes can't be made, such as disabling DFS and using non-standard channels. And as I said, the FCC explicitly does not ban third party firmware. The biggest reason is that it's cheaper to make adjustments to the radio chips to prevent certain changes than it is to swear to the FCC no one can hack in new firmware.

And as I stated and you quoted, users are still required to follow FCC rules. You can't hook up an external signal amp to boost transmit power past legal levels, use unapproved channels, etc, even if they find bypasses for the protections required by the FCC. You can't use a signal booster for a TV antenna that causes interference. You can't boost power on your CB radio. Etc.

[1] https://apps.fcc.gov/kdb/GetAttachment.html?id=zXtrctoj6zH7o...
The site could benefit from a to-the-point explanation that doesn't assume prior experience with PGP based mail. I can't point less technical users to this.

Does this work if one uses multiple mail clients (fx. notebook, desktop, and smartphone)?

Since it requires client support, it doesn't seem an option currently on, say, an iPhone.
I'm not saying it's easy, I'm saying they should have solved it anyway. For a company that prides itself on (and charges for) high quality user friendly products, reliable software upgrades should be foundational. The double-edged sword argument only makes sense if you assume it's impossible, when in fact it's only the preventable (given Apple's control) accumulation of cruft that makes it expensive. Upgrades certainly would have made a better investment than removing headphone jacks, or adding the touch bar, or almost anything that went into High Sierra.

Yeah, I'm an idealist. Sue me.
AWS default VPC config whe does not block outbound by default. Neither in the security group nor the ACL. And of the half dozen AWS hosted startups I’ve worked for nobody restricts outbound yet. “Security nice to have, not prioritized yet”
See the tweet in the link above - Popehat published the person's phone number and physical address. The person is an asshole but Popehat shouldn't have done that.

https://imgur.com/0gIrajl
Yeah it’s a total nitpick, the point is still made.
I think the important part is that it’s a package manager commonly used for front end development, so the malicious code runs directly in the browser. It could have been bower or something else but npm is the probably the most popular choice these days.
Is there a precedent of someone buying a closed-source product, suing for being unable to update it, winning the case in court and being awarded damages?
I think everyone that use PostgreSQL FTS had similar stories and motivation to switch from external software/service.
They've lived here legally for years. Now US could send 250,000 immigrants away
What bothers me is the lack of confirmation on the microcode updates (other than 'soon') – apparently they're out there[1], but Intel's own package has yet to be updated[2]. The 20171215 update carried by some distros only seems to cover HSX/BDX/SKX, so does that mean regular HSW/BDW/SKL users are screwed, are they covered by the 20171117 update, or are the new microcodes simply not ready for all models yet?

Of course, the microcode updates are meaningless without the corresponding kernel patches, but apparently only RHEL and SLES were deemed worthy of receiving those ahead of time, having already rolled them out while Linus and co are left scrambling to integrate the IBRS and retpoline code dumps after the fact.

[1] https://tracker.debian.org/news/899110
[2] https://downloadcenter.intel.com/download/27337/Linux-Proces...
Just what is our problem with numbers?
I agree that I could have optimised the system more. Since this is the first time I'm installing Gentoo, I just followed the default instructions given in the Gentoo Handbook.

https://wiki.gentoo.org/wiki/Handbook:X86
Which is a common compromise and frankly more useful than the web-of-trust model, as long as users understand the limitation and verify once offline.

It's still unclear to me how this works if you use more than one email client.
True. I work with PyPI and it's been extremely solid for years, so we tend to just not consider this a problem at all. Pipenv stores hashes for each package version as well, so you get the security aspect built in.

Pipenv has pretty much fixed Python packaging/dependencies, in my opinion. It's the all-in-one tool I've always wanted. If you do any Python work, try it, it's great.
Where did those Java devs who pulled from Maven central directly publish their artifacts?
The secret lives of students who mine cryptocurrency in their dorm rooms
Sounds like a plan!
To all replied here with "politics" as a reason. How do you explain the fact there are harsh policies in the ex-USSR countries, where no racism existed, no hippies, no minorities to put in jail, etc?
What exactly happened here?
I use GoodReads a lot for discovery. See what friends are reading and browse lists that people make (https://www.goodreads.com/list)
Can you forge a meteorite?
You could say the same thing about the word "murderer". While technically correct, that doesn't make it any less a matter of life and death.
Exactly. I assume if one of the smaller providers like Linode found an internal vulnerability that they thought was a big security risk to have widely know and had 3 giant customers and a large number of smaller customers, they’d work directly with the giant customers in advance in the same way.
Iris claims to perform brightness adjustments in software (GPU?), allowing the monitor’s PWM brightness to stay at 100%, for Win/Mac/Linux: https://iristech.co/iris/

I'm wondering if the Iris approach affects color accuracy, otherwise why wouldn't MS/Apple use the same technique?
Aside: I played through PoE co-op with my fiancee after it was first released, and I really loved it. I'm really happy you guys were able to build such a big ambitious game and make it work financially.
The 2008 crisis was an emergent systemic risk. (Similar to Spectre) But Meltdown is Intel's fuckup, and the insider trading is on Krzanich. And naturally anyone is happy to point that out, even if they sort of fucked up by implementing speculative execution and thus allowed Spectre on their platform.

Or it can be simply someone that noticed this unusual sale, and saw the circumstances ripe for a bit of naked shorting.
> The Project Zero referenced some papers from the mid-2000s that talked about it.

http://www.daemonology.net/papers/htt.pdf
There's this vision for the web that we should be able to access public "data", not only web sites "guarding" it.
"Removing this code has the side effect of crippling the seeding process for the OpenSSL PRNG."

https://www.schneier.com/blog/archives/2008/05/random_number...
Ah, okay, so pretty agnostic. Sounds like this is geared towards single project deployments, though (ie it wouldn't be suited in a multitenant scenario), but that's good to know.

I've been looking for a Dokku replacement for running my side-projects on with easy scalability (by provisioning another server), but I haven't found anything that's suitable for running multiple apps together in a heroku-like way but still able to scale beyond a single server. Do you know of anything like that?
Usually options are typeset similar to

-p

Potrzebie mode ...

So search for it, e.g.,

/^ *-p

The caret regex anchor matches at the beginning of line, and the Kleene star matches zero or more of the previous pattern. In English, the above pattern reads “match -p only when it occurs as the first nonblank characters on the line.”

The surrounding context may be different, so adapt your search pattern accordingly.
Synology has its own backdoor as well [1]. Luckily the backdoor is only active when the OS crashed and the device is in recovery mode.

They also have some very odd practices, like hard-coding specific users and the shell to be used inside OpenSSH binary [2]. This was 2012; haven't checked if the code improved since then.

[1] https://wrgms.com/synologys-secret-telnet-password/

[2] https://serverfault.com/questions/458553/cant-log-in-via-ssh...
Use Hexo to Create Blog (2017)
> You can’t make such a promise that destroying a certain server in a data center may or may not cost the world something valuable.

Think on a different level of abstraction. Cyberwar is a thing; cyberweapons are a thing. You could totally have rules about what online services state-sponsored malware shouldn't try to attack. It would make just as much sense to protect Archive.org as it would to protect the Library of Congress.
Just tested my Macbook Pro (2016 model) with a 120 FPS camera and apparently there is no flickering in the display, however the keyboard backlight appears to use PWM.
Look up the name of the concept in the manual and search for that. Compare Google or Stack Overflow searches for <() versus “process substitution.”
> The brightness of an LED depends on the current through it. The current through an LED increases exponentially with increasing voltage. It's very difficult to directly control the voltage precisely enough to keep the LED lit at a given brightness, but it's a lot easier if you can just control the current.

I see. So set the current, let it draw the voltage it wants. Heh.

> Switchmode supplies can output any voltage, they're not limited to discrete steps.

Right - the issue I was getting at was the problem of getting an arbitrary representation of a desired voltage out of a microprocessor and into the real world. Digipots are the only way I'm aware of to do that (apart from PWM).

Thanks for the very interesting and highly informative wall of text :)

Open question, in case this piques your curiosity: I'm very interested what your comments might be on https://news.ycombinator.com/item?id=15005811, and any suggestions/ideas you might happen to have. I've long thought that what I describe in this post is noise-related, SMPS noise in particular, but I'm absolutely stumped on how to pinpoint/narrow things down any further.
Amazon invented a neighborhood to serve HQ, but restaurants it lured failing
Which flashlights use this firmware?
I think search relevancy is very important, and I wrote in my article start using PG FTS had permitted to work on search relevancy because I had more time which I used before in ES configuration and maintain another layer in my stack.
Thanks for the response! It's pretty tough to find anecdotes which offer support for the other options. I'm glad I asked. Good luck to you as well!
You might want to bite the bullet and upgrade from 4.9, because the patches for 4.9 are not so rock solid: https://news.ycombinator.com/item?id=16087736
Weird. It's not my field at all but intuitively, I would have approached a proof by trying to formalise the following:

1/ Complete part of the tiling in the upper right quadrant (this tiling exists by assumption)

2/ Shove all the tiles down and to the left

3/ Repeat.

It's very surprising that step 2 needs the axiom of choice. (Usually when I'm this surprised it means I've misunderstood something!)

Edit: your link proves something stronger - that the ability to tile an nxn square for all n is equivalent to tiling a quadrant and tiling a plane. I guess that's where choice comes in, is it?
https://www.amazon.com/AquaTop-Line-UV-Sterilizer-10W/dp/B00...

About $45. Seems to do a good job for cleaning water, though this particular model may/not have a leaking issue.

Oh, and the way UV light accomplishes the sterilization is via DNA destruction: "UVB light causes thymine base pairs next to each other in genetic sequences to bond together into pyrimidine dimers, a disruption in the strand, which reproductive enzymes cannot copy."

So that's why it can kill viruses, because UVB light 'attacks' the DNA itself, stopping infection and mitosis.

https://en.wikipedia.org/wiki/Direct_DNA_damage
Seems a bit crazy that MS was not ready to go with the patch and really should have already rolled it out. There are already PoC out of the exploit.
Packages / projects being frozen. AFAIR that's how SourceForge works/worked. I remember a few years back being baffled that I couldn't delete my own project.

But it makes sense, other projects might depend on it, so it's archived.
But back then, Intel could not deny that the FDIV bug was an actual bug in the CPU. Intel's press release on Meltdown is carefully worded to avoid admitting it's a bug in the CPU.

But since the USA have the highest lawyer-per-citizen ratio in the world, it would be very interesting to see what happened if, say, Google sued Intel because from one day to the next, Google's electricity bills rise steeply, their servers crash, because the AC cannot handle the extra heat, ... , and Google demanded Intel pay for their damages.

We live in very interesting times, indeed.
Yes! Exactly! The key thing there is that Carlos is a musician as well.

I think Tomita is another great example of a musician who took material and adapted it for a new medium in really interesting, innovative ways.
I get that they may be unfamiliar, but learning your system’s tools will pay off over the long run. Search facilities in less and info are generally much more powerful than in your browser.
I think you have made the arrogant mistake that this is a fluffy pop-sci book. You are incorrect. Maudlin takes real physics very seriously. The book actually gives sufficient math. The point is that high level math normally associated with SR, GR (Riemannian geometry) is unnecessary for understanding the interesting philosophical consequences of relativity.
JAI Language Status Update
yes. it made me see myself and emotions and existence in a much more carefree, simpler light. sounds bad, or sad maybe, but its great.
Ruby gems can be signed but the percentage of gems authors taking advantage of that is low.

At least we’ve got most people using https to transfer gems now!
Yes I think you need both of them of course and I found it on my project with Django and PostgreSQL.
How the craft beer revolution started
It was just a bad joke, but in all seriousness, that was a big wake up call for a lot of people about the tangled web of npm dependencies.
Cheap products can be quite popular. It's probably fine until that cheap item you bought goes viral on facebook, or there is a single upstream vendor that is hugely successful. No idea either, only statistics would tell.
I read almost all of it cover to cover when I was an undergrad in math, when I still had intention of going to grad school, to get a sense of which area(s) of math I'd like to pursue further.

It is incredibly illuminating and I also recommend it highly.
Question: this is a problem because the LED array (as an LED backlight or an OLED display is) all flickers in synchrony, right? Would it still be a problem if each LED in the array was hooked up to its own delay line with a randomized-at-the-factory value?
It depends: I've got a Samsung S II with OLED and it doesn't show any flickering. But also a later Samsung also with OLED from all I can tell, and it does, and sat together with someone else trying to figure out what's going on. My interpretation is that early OLED displays were always running 100% duty cycle, but instead would lower the current through each pixel for lowering the brightness (when dimming the S II very low (and adapt your eyes), you can start seeing artifacts, i.e. pixels being lit up less precise because they are in fact using the lowest few values available of the current range). For later phones it appears Samsung added a PWM on top of it, so as to be able to dim the display independent of the pixel currents, perhaps to get rid of these artifacts in low brightness settings, or possibly because this might be a bit more power efficient.

What can be done, apparently (as my friend found out searching the internet), if you've got root, is to install a kernel driver to set the PWM duty cycle to 100% and instead use the old per-pixel dimming approach. I haven't bothered (not using my phones enough) but something potentially worthwhile to do if you use your device for a lot of (book) reading.
It tells us his workload is more network bound than computationally intensive.
i give you a lot of credit for writing this out. very thoughtful, thanks.
I've updated my Greasemonkey plugin that makes some minor changes to HN's text layout. It unfades faded comments, highlights inline quotes (prefaced with '>') and improves readability.

It's very small and uses calls to HN's own javascript. Too small to be worth its own post but .. this seemed like a good thread to post it as a comment.

https://openuserjs.org/scripts/kennethrapp/Hacker_News_Text_...
We all sell out every day; might as well be on the winning team!
I would do the same thing no matter the stock. It is stupid to keep all your eggs in one basket (as others are saying about userland all through this thread).
True. You can do just fine in general eschewing info wankery in favor of man pages. Stallman may disapprove, but I don’t lose sleep over it.
Unfollow Trump: All of Trump's and POTUS' tweets (even deleted ones)
Thanks for your reply , my opinion is th same
Better to recommend something from here: http://kernel.ubuntu.com/~kernel-ppa/mainline/ (especially the daily is relevant now)
I don't know if you must answer the question or provide a password, but I do know that lying to a federal agent is a crime that can land you in jail for up to 5 years.
http://kernel.ubuntu.com/~kernel-ppa/mainline/daily/
edit: To clear the air, I completely agree regarding the statement. "convicting based solely on the accuser’s testimony is not fair no matter the crime."

it's not always so clear cut though, for example if they decide to quit as a result of the advances, then it could count as sexual harassment due to the adverse employment decision. Admittedly you're completely right about winning. You're not going to win a lawsuit because Sally politely asked you out once, but maybe if she "politely" badgered you every single time she spoke to the point where you were not willing to work with that person any more, and that caused you to get demoted.

Usually someone has to be a dirtbag, but some people think they're not dirtbags when they totally are dirtbags. That's when HR disasters happen and the accused weave some tale about how they were totally innocent when in reality they were shitty people creating a hostile workplace otherwise the jury would never have voted the way they did.

bob: "Oh but you said asking out was okay"
HR: "yeah but uh your version of asking out was putting your balls on their desk and saying 'hey babe you know you want this'"
bob:"Yeah but there was nothing rude about that, babe is a compliment"

bob@thePub: "I can't believe they fired me you ask a girl out and all the sudden it's sexual harassment"

you know who I'm talking about.
That's what I meant by attempting to find a constructive proof. 2 doesn't work because no matter how much you shift down and to the left you'll always have a boundary.

> our link proves something stronger

No, it proves that the 3 statements are equivalent, so it is not stronger.
No. Packages would not need to be installed as root. Additionally, many possible ways to use the exploit in GP could run as unprivileged users.
But one day, the 486 will be deprecated. Just like the 386 was...
Lazy loading via javascript at work... If your adblocker has an option to use the <noscript> element, the images display fine on wired though.
Shit. That's a good point, I downloaded the Heroku CALI during the attack and it uses duplexer3. I got a weird message that seemed "off" during postinstall.
Even offering ECC for mere mortals would be a good start. Of course with the option to disable as much of the ME as possible.
With Gentoo, it is possible to reduce the startup services I guess. I just ran with the default configuration suggested by the Handbook.
While you’re waiting for the rest of the world to agree with you and then implement the true hypertext manuals, consider sharpening your regex saw.
Most companies of any size are allergic to "pick your own toolchain" development strategies. The infrastructure team has to support them. Someone has to be responsible for hiring. Security needs to be able to review the environment. Employees should be able to be moved between teams. And so forth.

Sure, I suppose devops can mitigate the infrastructure support problem, but overall most companies strongly prefer standardization.
I'm not sure if it would help much. That means you either have to have users be able to recognize and eyeball-validate hashes ("sure, this is left-pad-5ffc991e; that's what I want! Wait, shit, it's actually left-pad-5ffd991e, never mind; wrong package), or you need pre-existing databases of trusted hashes (which either puts you right back at a registry a la NPM, or leaves you reliant on a package.lock file or similar, which doesn't cover many common use cases for secure package signing).
One of the most exciting archeological pieces we have from the Roman empire, is graffiti spouting the same mundane things people scrawl on bathroom walls today.

> At best, the users should have been given the chance to download whatever they want for private use, and the rest should rightly get obliterated.

This is a hard one. The right to be forgotten is probably something the average person should have.

But equally, human history can be understood and shaped by some of the most mundane things, and our descendants have a right to review that. To understand it.

I don't have a solution to it.

> Many people would object less to Facebook if it probably deleted all content not marked "important" after a year, rather than creepily storing everything ever.

It is not their storage of data I find creepy. It is the fact that this permanent storage is actively used, sold and traded. A deleted profile shouldn't be able to follow you around the web, and continue to build upon itself.
Show HN: Python exercises, all from someone self-taught
The difference is that those extra lanes take up physical space, which goes unused outside of rush hour, while increasing frequency of eg trains or trams does not. For example, I was recently in the US and during the day the 6-lane-each-way highways were completely empty, almost like a ghost town, but during rush hour, they were at a complete standstill.

> If people didn't typically commute at the same time...

Absolutely! That would be ideal.