skysight-inc/HackerNews huggingface dataset:
We're getting into Reddit levels of off-topicness here, but I actually kinda like where QC went: robot-sexuality is now a valid subject, as are light-hearted probes into the personhood of AIs, in a slice of life-esque drama.
No, then my head is hot and my feet are cold :)
> What's to stop a rootkit from just spoofing that it was installed months ago?

The fact that if a rootkit is in a position to performing that spoofing, it doesn't need to, because it already has the power to make arbitrary modifications to the system image.
You overestimated the extent that the Chinese economy is dependent on the US and EU. Exports in total, including to other nations, are less than 20% of their GDP. The US and EU combined account for less than 40% of their exports (ie. <10% of GDP).

They can manufacture almost anything they need. Oil is a major exception. They are addressing vulnerability to oil imports with big pushes for electric cars and nuclear energy, as well as alliances with major oil exporting nations.

They also have channels to import other raw materials, particularly from Africa with which they have strong economic ties and can in return provide the African nations with manufactured goods and expertise for infrastructure building.

On the other hand, a sudden, near complete sanction on Chinese imports would result in widespread shortage of many manufactured goods in the US and EU. Both sides will survive but it is unclear who would get hurt more.

https://atlas.media.mit.edu/en/profile/country/chn/#Destinat...

https://atlas.media.mit.edu/en/profile/country/chn/
An overview of checkstyle and how it is used in open-sourced projects
I think the flexible hoses are very common in newer houses. The labor costs are much lower. It also performs well in cold climates. Apparently the technology started in Germany in the 80s so it is well proven. Matt Risinger, a high end home contractor has some great videos on this technology.

https://www.youtube.com/watch?v=KZX0aTvbEzo
https://www.youtube.com/watch?v=OOeBJ8mDr8Q
Sounds like it may have similar coverage to tis-interpreter ( https://trust-in-soft.com/tis-interpreter/ ), but significantly faster.
Thank you, Lee! Good to see that you started receiving coffees. Enjoy one on me too!

We'll look into the link 'link in bio' suggestion. Thanks!
> It does seem worthwhile to validate the signature of the driver every time the driver is used if that check would reveal when a certificate has been revoked for having been compromised.

It would be much more efficient to scan the list of installed drivers every time a certificate revocation list is updated, because certificates are revoked much less often than operating systems are booted.

And there's nothing gained by just checking timestamps if you don't have a new certificate revocation list. If the driver is already installed and was trusted and running yesterday, you gain no security by deciding to not load and run that driver today, unless overnight you acquired new information that the driver is insecure or malicious. The ticking of a clock does not convey any such information.
[•] OP's point confirmed.
Welcome to BuyMeACoffee! Your platform fee is waived.

Regarding a darker stylesheet - it's a popular opinion, and we'll look into it. Thank you!
Imagine a scenario where a driver is installed during a network outage and with an incorrect clock. Because you need to be able to install a network driver the system will allow this security flaw. However when the system knows better its reasonable to limit the damage by stopping the driver.

You could say that any damage has already been done which is most likely true. But I can't fault them from mitigating it as much as possible.

I suppose you could modify the system to get external attestation of the time while the driver is installed and use that as a sticky bit - but its a big complication and its much better if the driver is securely timestamped in the first place.
This is partly solved with a right-sized furnace. A well insulated house with a huge furnace will run the furnace for two minutes an hour. Whereas a small furnace might run forty-five minutes an hour. The overall gas usage will be the same, or maybe even lower, and there is significantly more even heating & mixing.
How robots might alter hiking
It would be as effective to just bust a taillight, rendering the vehicle in technical violation of the vehicle code and forcing its recall back to base.
In 2011 Portland Cops Investigated a Sexual Assault Complaint Against Mark Cuban
I do embedded development for a living, and this reminds me of Arduino in some ways. I mean that in only the best ways. The main problem I see with Arduino is that there are several hard ceilings that prevent a beginner from growing into an intermediate embedded developer, let alone an expert, unless they abandon the Arduino ecosystem entirely.

To what degree have you engineered the components to lock a developer in to your system? Say I read a tutorial on a new web technology, and its source is provided in javascript/html/css. Are there provisions in your system to interface with other tools and languages, or are you locked in to whatever Anvil has deigned to add to their vertically integrated walled garden?

Do you envision alot of your power users, or at least users that see success from your system, eventually migrating to traditional web development stacks?

It looks great, and I'm really interested to try it out.
What a horrible design decision. Instead of making a system that simply works or doesn't work Microsoft allowed everyone to produce apps which break at random times in the future. It's one of those "what could possibly go wrong?" cases.
It's slow. It kills your battery. It disregards standard platform idioms.
Here is an "under sink" re-circulation device,
instead of the "whole house" approach. Basically,
put a thermocouple, solenoid-driven valve, small pump, and a coupling between the hot and cold water supplies
in an under-sink cabinet at (usually) the most remote
lavatory sink in the house.

When hot water is wanted,
the pump pushes cooled water from the hot side into the cold side, and eventually out into the hot water heater's cold water intake. The same flow at the pump pulls hot water from the heater to the sink, and the pump shuts off and closes the
connecting valve when hot water arrives at the connection.

No water lost, no re-circ except when wanted. Use the sink
to set-up to bring hot water near to the shower. Locate
or repeat as needed if you have multiple "cold" bathroom or kitchen locations. The reverse flow thru the cold water
piping is, uhm, counter-intuitive, but appears to work.

https://www.amazon.com/Laing-LHB08100092-AutoCirc-Recirculat...
Pay $20 and you get the number permanently. I've set up my kids' soccer club and my son's Cub Scout Pack with voicemail-only numbers. Callers leave a message and a recording and a transcription is forwarded to the appropriate person via email.

I've also read using Google Voice is highly recommended for things that require a voice or text number since it's very difficult to get hold of someone at Google that can be socially engineered. Much easier to scream at somebody at Verizon, etc.
It doesn't secure the client inherently against super-heavy queries. GraphQL is a spec, that's an implementation concern.

One cool thing though is that if you define an schema that includes a field that is expensive to resolve, the server will only attempt to resolve it if asked to by the client (defined by the query it sends), whereas a REST implementation would still need to resolve the field, even if the client in question isn't making use of it.
Ha! My dad was just telling me how some of our old SANs had this happen. Just had to change the date to 2017 then do a firmware update.
The signed kernel keeps track of when it first has seen a certificate. That is signed by a kernel, so a rootkit can’t spoof unless the system is already compromised.
Excellent point. We never thought of it this way TBH. Thanks for the suggestion!

If you like to know more about us, check out our ProductHunt page; it is more personal and transparent - https://www.producthunt.com/posts/buy-me-a-coffee. We also have a LinkedIn page.
The problem in this case is much deeper than their fault / your fault. The problem is that in this industry we do (have to?) lean too much on the power of abstraction.

Whether you are writing SQL or graphics code you are constantly told "just express what you want to express directly, and the system is smart enough to do things as efficiently as possible".

But that might not be very efficient at all. The people who write "the system" have to write software that does specific things in specific situations and there will be endless cases which cannot be dealt with efficiently. And the more the interface hides the implementation, the less likely it is that those cases will be obvious.
When you have a divorce, separation, etc - the person is still there, still alive, around, may or may not communicate with you, etc. You can know that they're OK, even if they had to find happiness with someone else or whatever happened.

I was working late to make up some time and had headphones on. Wife told me "I'm gonna go soak in the tub and go to bed, see you in a bit." A couple hours later I finished what I was doing and headed towards the bedroom. I noticed the bathroom light was still on, and found her. Apparent heart attack and she drowned in the bathtub, and she'd been gone a while by the time I found her. Sudden wrenching loss. No opportunity to make up for fights. No goodbye. Just.. gone.

Anyway. This isn't about me. This is about the community helping Matt, in whatever way we can.
Great app! Helps me coverting ETH to tokens using the decentralized exchange directly from my wallet via DApp browser, it’s easy, cheaper and fast!
So, how can you do that when the government is also demanding that you keep magic back doors with a master key so that they can unlock anything at any time of their choosing?
Do you live in LA, have you actually spent time here or is this a random post?
People think the traffic is terrible, but they also expect to get from the east side to Santa Monica at rush hour for some unknown reason.
There is a growing rail system, and the 2nd largest bus system in the US.

Given the population as it is now, I think "unwalkable, undrivable" is a bit of an overstatement or people simply wouldn't live here.
Are you a native speaker? Because 廣東話 and 閩南話 are totally unintelligible to me, and I want your language superpower.
I'd say the risk management is bigger than that. If you have 10 customers and cock something up, that's 10 people affected. But with a million customers, the same cock-up causes 100,000 times as much damage and might cost 100,000 times as much money. So you can spend something closer to factor more to reduce the likelihood of it happening by up to 100,000 times.
I hate Facebook, but I don't think the example you gave is accurate. Both your searches would only be recorded by Google. And why would Google share any of it with Facebook?

The only way the data could have gone over is through a malicious browser extension.
That sucks, I'm sorry Matt, don't know you so it means little but I'm sorry.

It really sucks that you had no warning, no time to spend in the last days. Knowing that it is coming sucks but being taken like that sucks (I've lost family to cancer, that is both better and more sucky).

It's clear that you loved her and that just makes it worse. Shit.

I keep thinking of stuff to say but it's all about me and my wife, don't want it to be about us. So I'm sorry for your loss, I hope you have family to support you, and I hope things get better for you.
I wrote a driver for MongoDB in 2010, but then moved onto Neo4j in late 2013.

I liked Neo4j quite a bit, it could handle all the sensor/IoT data we could throw at it. Back then it had (and I'm sure still does) a beautiful interactive data visualization dashboard, great Cypher tutorials, and more.

Neo4j is a good database. I went to write a database driver for it, and found it extraordinarily difficult. I knew it would take at least a month of work to build.

At the same time really cool tools like Firebase were becoming popular, and Multi-Master database architecture with Cassandra and Riak were showcasing what high availability could do.

So I decided, rather than implementing the Neo4j driver, which I knew was bound to Neo4j's Master-Slave architecture, I would rather switch to Firebase or build my own mashup of all the tools I wanted:

- Firebase (realtime)

- Neo4j (graphs)

- Cassandra (multi-master / P2P)

- CouchDB (offline-first)

I spent a few weeks building a prototype and submitted it to HackerNews in early 2014. It was a huge success.

Since then, we've gotten 7.5K+ stars (https://github.com/amark/gun), raised venture capital money, and introduced decentralized cryptographically secure user blockchains, and a ton more.

Graph databases, to me, are so compelling, I have not only "used them again" but spent the last 3.5+ years of my life dedicated to building, improving, and making them more awesome.

I certainly hope others try them, even if it isn't GUN. They're worth a shot, but aren't a silver bullet, so use them where it makes sense.
Why did CERN spend $185,000 plus labor on a TLD?
Ancient Secrets Hair Growth Spray – Natural Treatment
In that case, I agree with you that outsourcing is a good way to go. However, it should be stressed that the "core business" needs to be the core revenue generating portion of the business. I don't care if your company is dedicated towards making "the best photo sharing/social media/experience sharing platform for users". If at the end of the day your bills are being paid by advertisers, you're an advertising company and are in direct competition with Google.
This software is headed in an amazing direction.
> Since 1970 marijuana has been a DEA Schedule I substance, meaning that in the view of the federal government, it’s as dangerous as LSD, heroin, and Ecstasy, and has “no currently accepted medical use and a high potential for abuse.”

> Every year the percentage of Americans who favor legalization of marijuana climbs. Last year it topped 60 percent for the first time. A remarkable 94 percent support medical use.

At this point, why does the United States Government even pretend it represents the will of the people?
He's been a frontend dev for 7 years -- he can learn three new CSS properties that he claims would solve a major problem of his.

Beyond that, all of the CSS that he writes on a daily basis would become more robust once he learns a few more values (space-between, space-around, space-evenly, flex: 1;, etc.).
Censorship is evil, no matter the content.

Those links are garbage, unscientific opeds. They add nothing to the conversation. Lucky nearly all of the world has moved past this ignorance.
Thanks, Vivan! Our backend is LAMP. WhatRuns is picking up pretty much everything we run.

BTW good luck with what you're working on :)
Ask HN: Harvesting Call recordings
Hello HN, this is a genuine doubt I had this morning. Everytime we call customer care we have a small announcement that the call is being recorded for quality and training purposes. But are they strictly used for that or is there some machine continously tagging the voice of each individual? because during the feedback the Customer rep knows the emotion even the emotion can be tagged. If this is happening is it legal/ethical? Can the data be useful?
Can this data be aggregated from various providers to target each individual's emotion and identify their mind state or other metrics?
At the core of the issue, yeah, they just need to publish the same driver with a different signature.

It looks like their auto-updater used the same cert though, so they can't distribute it as a normal update. They're probably figuring out the least sketchy/most automated way to distribute it right now.

When this is all said and done, there will be a handful of people who will never, ever forget to use the /t flag in signtool.
I’m so sorry Matt. My heart goes out to you and yours in this time of grief and reflection. What a wonderful blog post about her, her love of life was so evident in your thoughtful words.
> Because you need to be able to install a network driver the system will allow this security flaw. However when the system knows better its reasonable to limit the damage by stopping the driver.

The only way that the system "knows better" is by acquiring something like a certificate revocation list. The system does not know whether it was powered down for five minutes while the network outage was fixed, or for five years. When the system is powered back on with a working internet connection, it does not have any reliable way to tell whether the offline installation of the network driver occurred prior to the expiration, or after the expiration with a properly backdated driver and backdated system clock. There is no way to justify suddenly de-trusting a driver that's already been running simply by observing that you're in the future.
Not having to buy diapers anymore is fucking glorious, but it's also a double-edged sword. No more spending money on Amazon for diapers, but now you have to make sure they pee often, especially before car rides because you could find yourself in an emergency really quickly.
As someone who doesn't use slack, why did we ever move away from chat programs and protocols that worked fine? I don't know why I need to use slack, hangouts, discord, etc, that are just reinventing irc and/or the garden variety instant messaging platforms that already exist.
Comparing AWS Lambda performance of Node.js, Python, Java, C# and Go
McAfee comes packaged in the installation of some other software, e.g., Java, where it can easily be installed by mistake if you aren't paying attention.
I just had the horrific thought of what if some nearby interstellar event zaps all of earth with a deadly blast of fatal radiation killing all life in a matter of days. Is this possible and is there anything in the archaeological record hinting this may have happened?
Two reasons why startups amass huge numbers of people:

1. CEO is a shithead who doesn’t know what to do, so hiring is a futile attempt to do everything at once

2. Huge number of employees looks better when coming up with valuation for a round.

The two tend to be self reinforcing. And #1 survives and blossoms after IPO.
Your friend could have searched for the college before or after your discussion, or maybe even your friend had just been looking up old college friends on Facebook lately and that was enough to match up that ad and you. Not that I wouldn't put it past Facebook to do something like this, but it will be hard to prove from anecdotes because, ironically, Facebook captures so much other data that plausibly could reveal the same connections.
Sorry to hear this news. Learned lot of things from your valuable comments and feedback on HN. Hope you find strength again.
If anyone is interested in this topic this article goes into more detail:

https://msdn.microsoft.com/en-us/library/windows/desktop/bb9...
Context: https://github.com/tc39/proposal-flatMap/pull/56

This entire thing is just dumb. I would actually double down and _let_ them name it smoosh because they will surely make some non-FP friendly design choice in semantics anyways.
Minifying XSS – Bypassing XSS protection by minifying the payload
TLS certificate expiration tells your browser to stop downloading new pages from that site. It doesn't tell your browser to close the page that's already been rendered and is still on-screen.
I agree it's important. Divorcees don't get smothered with caring like widow(er)s do despite how devastating it can be. Perhaps worse because not only have you lost them but they're also telling you you're not wanted.
This is awesome! Instead of getting all mixed up in the discussion about which of the existing build-systems is best, and instead of trying to figure out how to work around all of the (mostly arbitrary from user perspective) restrictions, it is a very rational and pragmatic choice to just get it done and make it do what you want.
He lost a person that he greatly loved at a relatively young age and you presume to tell him to be happy about it because now he can lord his widowed status over people. I'm generally not into making direct personal character attacks on the internet but I think that outlook is disgusting.
Now that there are some people who are surely becoming considerably rich from the sale of cannabis in the US, it's strange that they aren't pushing for this kind of research to be allowed - i.e. out-lobbying the anti-cannabis lobby. Is there really still that much money going against legalisation?

Are the people who have been getting rich just not politically savvy enough yet? This seems unlikely because it's not like they are the original black market dealers turned legit. The cannabis market has been mostly captured by "respectable" white people with access to big money and business accumen who were smart enough to get ahead in what will be a very lucrative market.
Feudal security at its best.
Samsung's new QLED TVs appear almost invisible
Tesla Semi does its first production cargo run with batteries on board
"As noted in another comment, PEX is sort of flexible and hoselike, and is seeing a substantial amount of use for water piping nowadays."

Yes, PEX is the flexible tubing material you are thinking should exist.

PEX and sharkbite fittings are like magic - you can plug together arbitrarily complex water circuits and layouts as simply as building with legos.

I personally use copper piping for very long-lived installations and for simple, long runs. However, anything complex at the end of the line (irrigation, pump and well work, filter assemblies, etc.) transitions to PEX and shark bites.
Ask HN: How often do you refresh your JWT tokens?
I've a few questions regarding tokens:

1. How often do you refresh them?

2. What's the soft (during which it can be refreshed) and hard expiry (after which it can't be refreshed) on them?

3. Do you refresh them on receiving 401 response or you refresh at a fixed interval? Why?
Discord is amazing, there really isn't a good replacement right now. Before that it was a mess/mix of IRC/Skype/Teamspeak/Whatsapp, now you can combine all that in one great client from a company that actually seems to care about its users. It's my favorite monthly Paypal charge!
It's not tolerance, it's just that they know who to blame. You're average user is just as likely to blame MS, a virus or their ISP instead of the company making their computer run like a dog.
Thank you. Love the updates, @DpdC. Welcome to Buy Me A Coffee!

Glad to buy your first coffee. Also, your platform fee is waived.
I run a curated community of tech people in transition here in NYC: recesslabs.com

Check us out, and if you're interested, feel free to shoot me an email with some info about your background! If it's a fit, I can invite you to some of our events. We typically look for people with some startup experience who are looking to play around with side projects.
>At this point, why does the United States Government even pretend it represents the will of the people?

people say that when it's something they disagree with...

If the majority of the pop had populist ideas which went contrary to their position, then this "will of the people" is cast as "coarse populism".
Are driver CRLs any more challenging than the virus definitions already distributed through Windows Update?
I've heard GraphQL is a better match for graph databases. I wonder if the issues you encountered might be a result of that mismatch?
I think it's a great idea and signed up for the beta. Just curious though - given the Binance hack today that seemed to only affect people who had given out their trade API keys, how will you ensure that people trust your bot?
I haven't played with graphql much yet but one thing that really struck me most was that it's possible for a single graphql query to make multiple queries to database. I read that dataloader helps in this case, is this similar to what you mentioned in #5?