skysight-inc/HackerNews huggingface dataset:
The attacker could inject code that replaces the Stripe integration with something that looks identical to the end-user but harvests the CCs.
What do you suggest we do? Have leaders that aren't good at politics?
TrueSkill – the video game rating system
Send the link to your boss and ask his opinion
VISA suspended Bitcoin payment cards in crackdown – Viral Docks
I wonder if turning on accessibility features would help.
Tesla drives down cost via scale, it is driving energy density for downstream segments: EVs, drones, e-planes, et al.
Discussion: https://news.ycombinator.com/item?id=16087154
Now that you make me think a little deeper about it, it seems simple indeed. The exponential V/I curve of the LED makes I unstable for a given value of V, so all you need to do is have a feedback loop that controls I.
Why Is 'Affordable' Housing So Expensive to Build?
The final count was 1263 comments, and no more will be added now that it's closed and locked.
The reason it can connect programs so "easily" is because it basically ignores errors and robustness - it really relies on there being a user looking at the output and going "hmm that looked like it failed".

Doing things properly in Python or Go may take a few more lines (not much more really) but it is 100 tones more robust, and you need that if you are writing anything more than a 10-line one-off hack.
No external dimmers were involved. As I wrote, I opened up a bulb myself (sawed off the tip of the base) and saw electronic parts consistent with a switch mode power supply (dozens of parts including rectifier, capacitor, tiny transformer, rectifier, capacitor, IC for controlling it). I know I saw something different than was in the video for the UK version! No reason China can't produce both.
i agree -- couldn't bare trying to read, closed tab immediately.
I use a MacBook Pro all day at work, then at home in the evenings. I can't say I've ever had an issue with eye strain.

Over the years I've used many different models too.
okay, but fwiw nobody is using the name https://google.com/search?q=inurl%3AProgressBoard https://www.godaddy.com/dpp/find?domainToCheck=ProgressBoard
Eqrning Bitcoin
> SQL database isn't going to be significantly easier to manage.

A SQL database doesn't run out of memory and crash when you add documents to it "too fast". ElasticSearch does.
Right, and that non-zero overhead is part of being a software developer.

It’s also laughable that npm is accused of being a hack and yarn is accused of being over-engineered.
PWM is used to control the brightness level of each pixel.
While I have never had a major problem, it certainly raises a LOT of eyebrows when I say I don't have a phone.

Most Officers simply don't believe me, and quite a few embassies had no idea how they would issue me a visa without a phone number on the application form.
You're taking flak for this, but you're right.

When I was doing pentesting, we had an interesting assignment. Our job was to pop a dev project. Then we'd tell them how to secure themselves.

One of our tactics was to set up fake Github profiles with very similar names, then try to get someone internal to the team to `git clone` and run our code. Boom, remote shell.

We didn't execute the plan. But it was thrown around as an idea.

When a package on npm can disappear, and a new package can appear in its place at a later version, by a different author, and there is no connection between those two people, then you're in a bad situation. Just because no one currently runs attacks like this doesn't mean you'll be safe forever. It's worth getting ahead of this.

I don't know whether package signing is the best solution. Maybe yes, maybe no. But the question is, if a package vanishes, what is the proper action to take?

The solution seems like a rollback. Let us have the latest previous version from the same author, by default. That will fix the builds and not require any heavyweight changes.

But package signing would definitely be nice, if it can be integrated in a lightweight and chaos-free fashion.
Here is a description how it works: https://posteo.de/en/blog/new-easy-email-encryption-with-aut...
I'm not so sure that's true. The mitigations they're doing seems to work very well for all sorts of form factors. I've been using a dell UP3017Q OLED monitor as my main display for most of last year and haven't had any issues so far whatsoever. It's simply the best display I've ever used. Even for my LG OLED tv, which I've had for a couple of years hasn't exhibited any image retention issues at all, despite watching a lot of news with scrolling headlines and logos. I wish OLED monitors would become more generally available since they're far, far superior to LCDs but for some reason apart from a limited run of the Dells and some short lived laptop models they're pretty much nonexistent.
Wait. Contemporary nystagmus == saccades?

I haven't tracked the cause down yet - I know it's a nerve issue of some kind - but sometimes my jaw, arms or eyes (yup) can occasionally jump. My jaw and arms jump when I'm nervous (or have a buildup of too much nervous energy/excitement), while my eyes jump when I'm trying to focus on something too hard, they drift, and I try to course-correct too hard. (I think half my brain is aware of the drifting, but the other half, the part that would make the fine motor movements to keep my eyes locked, is happily whistling away blithely in a corner somewhere.)

When my eyes jump and I overcorrect when I fail to re-point them where they need to be, I usually have a second or two where I'm not technically blind but I need to let my eyes refocus and remember their purpose in life (if you will) :P

I always thought this was nystagmus (read the term online one day and went "!!! that's what it's called!")... but now I wonder, is what I'm dealing with something else?

(An aside: I'm really, really bad at tracking moving objects in space. If someone else is holding onto something and I'm expected to look at it, I have to hold it instead. No other alternative.)
Pretty off topic, but: I've been working on signed web applications: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap.... If anyone working on a web-based email client wants to take a shot at making it completely secure (against the web app's server), shoot me an email :) in profile.
Attack the argument not the person making the argument. I believe that climate change is a major problem and we need to take steps to mitigate it, I also agree with the gp that the media is using a lot of crap logic and crap science to try and fight the good fight but in the end it's only going to give cover to climate sceptics.
"without noticeable effort" is a strange way to describe Honda's experience that goes back at least to the early 1970s (the Civic came out in 1972). Mass manufacturing of automobiles might look like a solved problem from the outside, but that does not necessarily means that the ability transfers easily to a new manufacturer.

I don't know anything about auto manufacturing. I'm just reasoning from first principles.
OLED has worse PWM.
> Also, restricting yourself to the 16 characters in hex encoding makes your passwords that much easier to guess.

No. Entropy does not change by adding redundant bits.
It's not the LEDs themselves that are a problem there, but the driver circuitry in the "bulb"[0]. There are a fair number of these being made in the US and Europe, not just China. Significant numbers of LEDs are also made outside China - Cree manufactures LEDs in both the US and China; Nichia manufactures LEDs in Japan.

[0] Bulb is not really an accurate term here. Maybe bulb-replacement?
To manually check if the PWM has a low frequency: put your finger in front of the screen (or the led lamp you want to test), and move it quickly to describe a paper fan (V). If you see a stroboscopic effect, the frequency is too low. => The screen is not flicker free or the screen brightness too low. This is only a quick test not a bullet proof solution.
I don't want to debate the meaning of the word "common", but given the number of Stingers in use, and their NDA prohibiting disclosure, I think it's naive to assume that parallel reconstruction is rare. And yes, that's just my opinion.

When the police find a guy carrying $500,000 in his car, do you really think that was random chance?

> That statement by itself is clearly false.

No the statement is true. Detectives act on hearsay evidence all the time (which is inadmissible). They use everything they know about a suspect to drive an investigation.

Inadmissible means only that it can't be presented in court. While a jury must ignore inadmissible evidence, police have no such requirement. Most of their work is outside the courtroom, the trial is just the presentation at the end.
Have leaders that lead people to achieve strategic objectives not trying to cutthroat into a higher position.
As someone unfamiliar with NPM, why does it not lock package names for a certain period of time? Rubygems has a 90 day period, so if a package is completely removed, the name can't be used for that long. That seems like it would help with the security side of these problems.
Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).
It will be pretty unfortunate if it turns out that the projects that maintain a kernel (FreeBSD, various others) only received notification at Christmas, while various Linux distros (who have to deal with packaging, release, QA but not developing their own kernel patch since that comes from upstream) got a long warning period. It seems that way... Looking forward to reading about how this played out when the dust settles.
And anyway, what dependencies does a webpage for processing credit cards need?
Not OP, but ...

You can use Go/Rust for static linked bootstrap instead of Bash. (See rustup.)

I'm thinking about combining GitLab (private token access + repository files: https://docs.gitlab.com/ce/api/repository_files.html#reposit... ) and a bootstrap script in Bash, that then launches something better. Plus self registration back into a GitLab repo (hey, it has the access token already, so it can push).

Yes, Ansible/SaltStack/Chef/Puppet reinvented, but you're now not bound to the horrible database, language, bootstrap, speed (slowness) and workflow of any of them.

If you want more access control, then creating a HTTP microservice that has the real private token (or proper OAuth2 access) to GitLab plus handles the self-registration and token handout/revocation is easy compared to the other parts. (And it can also store everything in GitLab.)
In Climate Science, Predictions Are Hard, Especially About the Future
To be precise, new tools are continuously created to address the weaknesses of other tools. This happens in other languages, just more slowly due to smaller community sizes.
What is the best alternatives to bash for writing fairly large automation scripts? I have already looked at Python, Lua and Guile. The last two especially since I like using them and they have some sort of posix interfaces. I haven't looked at Perl 6.
I originally wrote "about half" but there was one too many words in the sentence. Also I figure for an eCommerce site max-traffic might be 7-9pm or something so even though there's more sleeping happening outside 7am-7pm, there might be equal traffic. Anyway ... close enough.
Yes, this is more like it. Most likely it was someone's 20% project (if it still exists) and someone higher up the command saw some potential in it and gave them more resources. Google can afford it. At worst, it can fail, at best it can give Google a technologically superior OS. Plus, they can always use parts of it or lessons learned from it elsewhere.

There is also no reason they can't replace Linux underneath Chrome OS with new Foundations. After all Linux internals were never exposed to the consumers in Chrome OS. As long as they port Chrome, they should be able to do it at least theoretically. Same theory could apply to Android but that would be much harder to do I think.
Interesting, thanks very much for the insight.

> Switch-mode power supplies are the high-end version. These can step the input voltage up or down to produce the required output voltage and can regulate current to one or many desired levels.

The way you wrote this makes it sound like SMPS don't have the smooth progression linear regulators do, which is in line with what I understand about SMPS designs. I presume the controller is connected to (or incorporates?) a digipot or similar, or is it actually possible to define an arbitrary reference voltage (derived from a digipot for example)?

> More information on how both of these work is easy to find with a google search, but I should note that some things written about linear regulators assume a target voltage. When used to drive LEDs, regulators with a target current are required.

Sure thing. And yeah, I find the constant-{voltage,current} thing a very fascinating/interesting quirk of LED regulation. At some point I'll find out why LEDs need constant current.
https://news.ycombinator.com/item?id=16084575

370+ points
Except there's no argument to attack. They never offer any argument or solution and instead seek to spread basic fear, uncertainty, and doubt (FUD). It's most certainly valid to attack the person when that person has shown a pattern of action that is not based on anything substantive.
> e.g. I'm pretty sure no white-hat security researcher has checked for security problems in the cheap wifi light switches I bought on Amazon.

But isn't this also applicable to the other side? As in, black hats have less incentives to research vulnerabilities in less popular products (security through minority).
I'm not certain how this balances out.
Any voltage-mode linear regulator can be connected to form a constant-current driver. It's best to use adjustable regulators if doing this, to improve stability. And of course a dedicated current-source is better still, as they will tend to have a wider possible operating range.
Leading spaces induce
this style of formatting.

It is difficult to read on mobile.
I believe in your userdata script you can write a line to download a Python script from S3, then proceed to execute. Don't quote me on this since I don't use userdata.

However, note that userdata will only run once at launch time. If you ever need to re-run userdata, you have to stop the instance, remove the userdata from settings, and then add again. YMMV.

I do the Python way when launching a beanstalk instance (basically cloud init).
YEOW. OUCH.

I...... I am very glad I'm using a CCFL laptop. This is like going back to evil 60Hz CRT flicker!!

I've just accepted I might need to rip out the LED driver board in a future laptop and replace it with my own design. Hopefully not, but if that has to happen then okay.

Thanks for the reference to the comparison, that was also very interesting to go through (and bookmark).
Actually in Vancouver, before you clear customs to get on your flight to the US, you enter a secure area where there is a sign that says welcome to the US of A, and you are in fact on US soil, just like an embassy, I'm pretty sure they could even fly you directly to a Bellingham jail and the Canadian government/RCMP couldn't do a thing about it once your cRoss that imimaginary line in the airport.
Why?

Communities die, people die, and more importantly, they change. While it used to be that if you wrote something stupid on a wall or carved it into a tree, with a natural expectation that it will get erased or destroyed over time, now even when behemoth social networks shut down, there are apparently enthusiasts which want to conserve every creepy pasta and highdea everywhere. Just because it can be done.

At best, the users should have been given the chance to download whatever they want for private use, and the rest should rightly get obliterated.

Many people would object less to Facebook if it probably deleted all content not marked "important" after a year, rather than creepily storing everything ever.
Time-lapse video shot from Seattle's Space Needle over 3 years
explainshell.com is your friend here.
Why didn’t you consider Perl 5?
Thanks for this. I've added a note to the post. "...consider having dedicated, lightweight pages for login and credit card collection that don’t ship any third party code (npm packages, advertising, analytics, GTM, etc.)"
But it's so legible!
I’ve seen this.
Mottley Fool article by Ashraf Eassa on December 19 [0] supports your position that it wasn't just routine behavior:

>However, there were two transactions that Krzanich reported in that Form 4 filing that I thought were more notable than typical stock option exercises and subsequent share sales. Let's take a closer look. ...

(Assuming that Ashraf called this without inside knowledge of what Intel had already disclosed by that date to selected 3rd parties.)

[0] https://www.fool.com/investing/2017/12/19/intels-ceo-just-so...
So if you're running a ARM64 chromebook, the answer appears to be: get fukt.

"For the 4.4 and 4.9 LTS kernels, odds are these patches will never get merged into them, due to the large number of prerequisite patches required. All of those prerequisite patches have been long merged and tested in the android-common kernels, so I think it is a better idea to just rely on those kernel branches instead of the LTS release for ARM systems at this point in time."

Great. Into the trash it goes.
Thanks for your and other report I found the issue and fixed it.
I think now the layout is working correctly on low-width window
https://i.imgur.com/BCaPTEt.png
I think it's a result of constantly dealing with people who ask for help, receive good advice, and then ignore it
Geniun Hacking
For over a year i have been trying to take down a website that put up contents about me , after spending alot of money on impotent hackers, i was finally able to do the job,thanks to ecodatasolution@dr.com
We used to use this technique for ground textures a long time ago.

We even wrote an article about authoring textures using the technique here: https://www.pathofexile.com/forum/view-thread/55091

In the end though, we found that the time spent authoring textures like this didn't really pay off so we stopped using the feature.

Instead of that, we blend randomly between a few different material versions that make up the ground which leads to a similar but easier to achieve effect. An obvious example is here http://web.poecdn.com/image/xboxbeta/ss/Panel1/screenshot3.j... where we have a snowy and non-snowy version of the same ground texture and we scatter blends to the snowy version randomly.
I have an old Motorola "dumb" phone, but what I want to know is if I am asked "Do you have a Gmail/Facebook etc..account" I am required to tell the truth, am I also obligated to provide the password to access it regardless of whether or not I am carrying a device to access it?
Seems like you should have froze publishing instead of saying, "Please do not attempt to republish packages, as this will hinder our progress in restoring them." Especially, to prevent, even temporary, hijacking.
You might be familiar with the W3's CSS Technical Architecture Group's (TAG) Houdini task force, which started around 2015 (2014 http://lists.w3.org/Archives/Public/public-wtf/2014Dec/0003.... ) to solve the problem you've mentioned. And it's looking quite good nowadays: http://snugug.github.io/magic-tricks-with-houdini/#/2/1/1
>>The manual exchange and management of keys – which users often perceive as complicated – is becoming superfluous: Prior to the first encrypted communication, a regular empty email (without content) is sent. With this, the key is transferred in the background. Henceforth, messages can be encrypted automatically.

doesn't sound like they solved the key exchange problem. they merely changed it to trust on first use.
With cases like the current one, or the leftpad incident in 2016, I'm surprised package registries still allow recycling old package names after a package was deleted. Really seems like deleted packages should be frozen forever - if the original author never recreates it or transfers ownership, then people would have to explicitly choose to move to some new fork with a new id.

But your point about pressuring or bribing package authors still stands as a scary issue. Similar things have already happened: for example, Kite quietly buying code-editor plugins from their original authors and then adding code some consider spyware (see https://news.ycombinator.com/item?id=14902630). I believe there were cases where a similar thing happened with some Chrome extensions too...
The brightness of an LED depends on the current through it. The current through an LED increases exponentially with increasing voltage. It's very difficult to directly control the voltage precisely enough to keep the LED lit at a given brightness, but it's a lot easier if you can just control the current.

Switchmode supplies can output any voltage, they're not limited to discrete steps. Their only disadvantages are increased complexity and potentially increased output noise, depending on the design. Most good switchmode control chips use a bandgap voltage reference internally, that provides a temperature-independent fixed voltage. Then an internal error amplifier and some feedback from the output is used to control the output voltage. Think of it like a thermostat: if the output voltage is too low/high, the supply senses that and starts boosting/dropping the output. Once the output goes over/under the threshold the boosting/dropping stops, and the output starts to fall/rise. The supply keeps switching it around the output threshold. (Linear regulators do exactly the same thing, they just only drop the voltage instead of being able to boost, drop, or both. They also drop the voltage in a less efficient but less noisy manner.)
Tips for writing quality software
I'm a parent of 14 and 11 year-olds and we're always struggling with this. I'd like to chat with you about this further. Find me on #parents-with-tech on freenode IRC (I've invited one other parent I've found).
Great point about ubiquity.

Perl regexes are the best of breed that everyone else replicates — far better than “reasonably good.”

The Perl erasure in this HN thread is startling.
I used haystack in different project to connect to Elastisearch as I wrote in my article, but in this article I wrote about Django Full-Text Search with PostgreSQL and you don't need haystack to use it, because there's a 'contrib' module in Django code
https://docs.djangoproject.com/en/2.0/ref/contrib/postgres/s...
Seems particularly prescient given
https://news.ycombinator.com/item?id=16087024
I've been looking for something like <() for a long time. Thanks for sharing it!

Regarding :h, is it any different than just using dirname?
Because we can. Historians love glimpses into the mundane of past societies. For the first time in history it is actually possible to archive these mundane aspects of everyday life like we archive the "important" stuff.

Imagine how ecstatic historians we would if we suddenly discovered an archive of even 1% of the smalltalk that went on in bars during the 1800s.
Doesn't pan/zoom on Android (Chrome) either. I assume it's not supported. Bummer!
Nobody is singling out NPM. The issue is the current JavaScript ecosystem and that happens to be provided through NPM, so you can use "NPM" as a shorthand for "the way JavaScript developers these days use NPM to depend on a gazillion trivial packages with totally unknown provenance".