skysight-inc/HackerNews huggingface dataset:
> in my threat model

It isn't your threat model that is important here. It is the users' threat models. Maybe you have full control of that too (the simplest case where that would be true is if you are your only user) but most sites aren't.
And (financial) securit_ies_.

Follow the money.
The test framework, or some live analytics, show your change makes Chrome 1 second faster and Firefox 2 seconds slower (in a 2 minute representative test). Do you push the change?
Depends whether you define yourself as your molecules, or the particular patterns those molecules have taken.
Our email address is all over the place but the best way to find it is via https://news.ycombinator.com/newsguidelines.html, so you get a refresher on the site rules before you email us. Sometimes a question will answer itself along the way.
I see..
So it could be a viable business to do research like this, short stock and then release the information. It just has to be a bit more damning than this as the stock price is actually up today!

Seems a bit shady in any case if one were to do this in the same way as when companies pay researchers to make claims publicly that benefit the company like the process leading up to the banning of led in petrol etc.
You might be delusional, but no this really has been tested and everyone failed.

PS: As recently as 1996 - 2015 there was a million dollar bounty for demonstrating this could work. It was not collected.
That's not GraphQL replacing Redux - that's Relay (ie, Apollo) replacing Redux.

So yes, you can replace Redux with something different. There are pros and cons to it, but it's not required or even fundamental to implementing GraphQL in a React app
lol, what? Look at the graph in the article, output is only slightly above 2000 levels. What portion of the world's consumption of manufactured goods is made by the US? What portion of the US's own consumption? Those would give a better estimate of relative strength.

If you make most of the product in China, then bring it to the us to put the final touches on it (https://imgur.com/PuyCZ), the final product counts as "US manufacturing output". Does that mean the US manufacturing sector is as strong as ever?

Oh, the production of electronics is up! You make the IC in Taiwan, the circuit board and the power supply in China, the display in Korea, the case in China again, but you put them all together in an assembly line in the US. And because there's more people and more demand for gizmos, you can say that you make twice as many widgets now! Does that really mean American manufacturing has gotten "stronger"?
My solution to a recruitment test was rejected without any reasons
My solution to a recruitment test was rejected without any reasons stated. Care to evaluate my submission to tell me why?
https://github.com/aitoehigie/intercom_test_solution
Try https://addons.mozilla.org/ca/firefox/addon/auto-tab-discard... I had been using Tab Suspender from the same author but recently noticed that it was deprecated for FF 57 or newer.

Pretty happy with it on long-running tabs I check once or twice a day.
Marines think outside of the box because we rarely have enough boxes and the ones we do get don't have lids. That's why we have the unofficial motto of "Improvise, Adapt, and Overcome".
If a given software can't handle TLS it's a fundamental problem of the software / development process and not the fault of the infosec community. Update/change the used libraries and everything will be fine.
I've switched a whole distributed system from plain communication to TLS secured connections just yesterday.

Yes sometimes it's pain to solve some TLS based errors and I also miss the opportunity to debug each transmitted packet with tcpdump but I also appreciate it that the continuous focus on TLS improves the tooling and libraries and each day it get's a little bit easier to setup a secure encrypted connection.
What is the point in trusting third parties, if you need to keep trusting them after they were obviously untrustworthy?
The entire world depends on the trust chain for SSL, keeping that chain trustworthy is very important.

Marking non-https sites as non-secure is a result of the network having proven itself to be unreliable. This is both the snowden revelations, as well as the cases of ISPs trying to snoop.

Besides, HTTPS isn't hard to get. Worst case means you install nginx appache or the like to reverse proxy and add in TLS. Things got even simpler when let's encrypt came along. Anyone can get a trusted cert these days.
Many years ago, I worked with a gentleman who was a reservist with the air national guard.

For one of their weekend sorties, they had an entire platoon parachute out, and one of the other transport aircraft dropped equipment for creating a runway. At the end of the weekend, they flew back to land and pick everyone and the equipment used to build said runway, and then flew back to the base.

Truly a work of logistical and infrastructure art.
Tell it to my wife...
Cooking channels, too.
Intercom buttons are one thing... I was less enthused to read about the impeller fan. It's all fun and games until it shatters under load and blows up a turbine.
If anyone trades options, the IV on options expiring in March on AMD went up significantly last week with no apparent news, probably because of these guys.
Something is "needed". If you don't create "political" change in a world where nothing otherwise would transform, then what? If we don't "force" schools to be diverse a class of people never excel and Obama would never be president.

All projects need it, because that project is made of humans. That project can succeed and die but those individuals will carry those experiences forward. I get what everyone here is doing linguistic math with diversity, but none of the replies are taking the impact on humanity in parallel with the success of a business that humans create.

We are reaping the benefits from many political changes 50+ years ago that inspired us to see the world differently and we cannot and should not stop now.
yes, i think its a good point you bring up. having some money affords you more time to work on art. but i think that it doesnt work beyond that- i.e. offering big monetary rewards does not improve the music. at some point, the incentives of money and music will always misalign, and so the person who cares more about music will create something better. i kind of think of money as a constraining force, not an inspiring one- the less you have to think about it the better.
> Those devs are gonna be really surprised when they find out that unencrypted connections are routinely tampered with.

Except most big orgs now employ MitM tools like BlueCoat to sniff SSL connections too.

> You have not been paying attention to the hundreds of tools available to make HTTPS painless.

I have, and they don't. They make it easier, but you know what's truly painless? Hosting an html file over HTTP. What happens when Let's Encrypt is down for an extended period? What happens when someone compromises them?

> And real-world attacks that are reported over and over again.

Care to link to a few?

> The problem is that it's not YOUR security, it's other people's.

Oh, so you know better than me what kind of content is on my site? So a static site with my resume needs SSL then to protect the other users?
Just look at what Citron Research did to Shopify last year. They tanked the stock from $120 to $93 just based on false accusations that they put out in a "report".

Now Shopify is now closer to $150...so their plan worked.
I can vet the guys who published this.

This is legit, and they haven't published anything that can be used maliciously.
I strongly disagree with the reasoning you're using here.

The premise of your argument is that without vendor cooperation, end-users are helpless to mitigate the impact of security flaws.

No, they aren't. Not only are they not helpless, but many of them are in fact ethically obligated to mitigate exposures with or without the assistance of their vendors. Almost every end user has at least one last-resort mitigation for any vulnerability: the power switch.

Most of the time, most users have better non-patching mitigations than that. These vulnerabilities are all post-compromise privilege escalation flaws. Their exploitation is situational and most users can do things to eliminate the situation that enables their exploit.

You might not like the fact that end-users have to make hard, expensive choices about how to mitigate flaws. But if you think about it for just a second, you'll see that the idea that patches were saving them from this choice was fallacious. There is no reason to believe these 4 dudes were the only ones in the world capable of finding these flaws (the reality is that if they're the only ones who know about them, it's because the kinds of flaws they found simply aren't important enough to demand focused attention from others). All restricted disclosure does is prevent end users from making the choice for themselves.

I believe that as a general rule, we're better off when we have the most information available to us about vulnerabilities. Personally, I'd probably stop short of publishing exploit code. But other researchers that most of us respect a great deal in the abstract do not have that particular scruple, and some --- like the original Metasploit project --- made it a point to publish exploit code immediately, patch or no patch, to arm operators with information about their exposure.

This isn't an idle opinion. If there was working Usenet search in 2018, you could find me making approximately the same argument back in the 1990s, when I worked as a researcher at SNI, the world's first commercial vulnerability research lab.
A+E Exec Nancy Dubuc Confirmed as Vice Media’s New CEO
The two projects are in completely different playgrounds. The midimutant is device that controls synths via midi, while nsynth is a synth (surprise!). And yes, it would be fun to use them with each other, though it would certainly take a bit of work on both sides (and is currently impossible because the midimutant source hasn't been released).
I've been running a modified copy of the dehydrated client (https://github.com/lukas2511/dehydrated) for, I dunno, a long time now. Since not long after letsencrypt became available.

I have my own domain name servers, so it wasn't hard to wire up DNS-01 support.

Anyway, the client has been running daily out of a cron job, updating certs on remote servers as they need to be, with very little intervention from me, for well over a year now. It's just about a set-it-and-forget-it setup.

Let's Encrypt is intended to be fully automated and you shouldn't have to faff about with it every quarter, it should do its thing all by itself.

...most of the time.
That was my first thought as well.

My second thought was the Cory Doctorow story which predicted that the first true AI will be the result of a machine learning spambot and a machine learning antispam bot getting stuck in an arms race.

This tech would make for an excellent means for spammers and malware authors to bypass spam filters easily.

1)Infect user.
2)Generate new content based on old emails.
3)Infect everyone.
4)Repeat.
I would love to use you service but it is not acceptable for me to share my email contents with someone else. Look at how mega cloud storage are protecting users files
The OP almost certainly did not put scare quotes around "customer" to describe trying on clothes at home in edge cases where it's impossible or burdensome to try them on in store.

(There's also the common case of regular customers who are busy and want to try lots of clothes at the same time, and the clerk makes a sales quote so they can bring up whatever didn't work for them later.)

OP is almost certainly talking about "customers" who buy a piece of clothing specifically to wear to a particular event out in the elements (party/dinner/camping/etc.), then try to return that piece for full credit after the elements have visibly changed the wear/fit/look/smell/elasticity of said clothing.

You have nothing to explain if a shop lets you purchase clothing to try at home in controlled clean conditions and then return it if you feel it doesn't work for you.

If you also bring back non-defective clothing that is no longer in a condition to be sold for full price, you are a meanie.
Keel looks nice, thanks for making it!

Does Keel include any ability to rollback to a previously deployed version? How to you recommend handling that use case?

Keel looks similar to Weave Flux (https://github.com/weaveworks/flux). Have you looked at Flux, are you able to compare them? At first glance it looks like Keel is probably easier to setup, but Flux is more feature rich (edits k8s .yaml files in git with updated image tags, has CLI that supports listing deployments and images, can release an old image).
Ask HN: What do you as an alternative to Facebook?
I used to have a Facebook account but now I don't want to go back to it as I find it super creepy. But I do sometimes miss sharing stuffs/thoughts. Many of my friends aren't on Facebook either. I am looking for an alternative to Facebook.

What are the other alternatives HN users use? Also tell me what is good about that alternative.
That's true however at that point our API is not longer "RESTfull" and become very ad hoc. The cool thing we found with GraphQL is that the client can control the shape of the data it needs without any server side changes (assuming your schema exposes everything properly).
I don't recall too many cases of government admitting that some problem was its fault and deciding to repeal the regulations or legislation that caused the problem. Rather, taking action to "move forward" shows initiative, even if it's just piling new rules on top of the old ones. Bonus points if you can blame capitalism, "the market," or your political opponents for the mess.
Well, there's a huge difference in the mindset of deployed grunts vs stateside red-tape laden behemoths.

When you're deployed and something important breaks, you have a BIG problem. The impact is usually somewhere between you being absolutely miserable for weeks to costing you your life. When you're stateside and something important breaks, you have a reason to expand your empire at next year's budget meeting.
That's not how inflation works - in the future, the value of the dollar will be less, not more.
>Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security

Can you explain why you think Symantec demonstrating incompetence is completely isolated from your Symantec SSL protected website?

I sense a lot of hostility coming from you. It seems like you think we do these things for fun. Do you imagine a bunch of grumpy men get together, drink beer, and pick a new SSL provider to harass and bully?
Yeah, I expect it to be an exciting adventure down the rabbit hole starting from my visual Pure Data prototypes. And I have no clue what lurks beneath:)
Apple announces WWDC 2018
There are a couple of scenarios that might be helpful to consider, as they are examples of mental discontinuity in use today. I cannot convince you of the semantics of "not you" vs "still you", because I think this question is too ambiguous to address satisfactorily.

- general anesthesia is definitely, to some extent a discontinuity of consciousness. You lose time.

- more extremely, Deep hypothermic circulatory arrest actually (temporarily) causes brain death by cooling the body to between 10˚C and 20˚C. All brain activity ceases for the duration of this deep hypothermia.

Are there risks to these practices? Definitely. Some may argue that someone who undergoes general anesthesia isn't the same person. But I would argue that it is, despite the discontinuity, and despite some risk of personality changes.
Why does returning an item right before a store closes hurt your score? (per the infographic in the article)
So you believer in the absolute freedom of security vulnerabilities disclosures and security researchers should just do so at will?

Do you know that the general public are usually the ultimate victims and impacted by those vulnerabilities the most?

Especially Intel/AMD are corporations worth tens of billions monopolies in their fields, and if their CPUs with zero days unpatched and sample code and exploitation techniques out in the wild, what else are you gonna use on your desktop computers?

We've seen similar happened for Microsoft after Shadow Brokers's disclosure.[1] It's gonna be worse for hardware products as it's virtually impossible to retroactively fix silicons chips.

[1]: https://www.wired.com/story/eternalblue-leaked-nsa-spy-tool-...
And just about every photography channel.
- Adding value to the world
- Building a sustainable business
- Learning personally
- Growing others
- Working with great people

This is where I looked at the URL and realized it was on their own website.

First spot being "make the world a better place" brings it close to satire level!

edit: fomatting
Apple WWDC 2018
> invisible monsters are breeding all around us [...] before they wipe out the human race

See also, the germ theory of disease.[0] I think we have this covered already...

1. https://en.wikipedia.org/wiki/Germ_theory_of_disease
Not sure if it would help in your situation but I've moved all of my github pages to netlify.com and they have a one button https feature for custom domains.
I'm cursing for about a year about this. I spent days searching for workarounds and stopped short of hacking into firefox. Maybe I should just install firefox 50 and disable updates.
We're working on a business version of the product, which will be a monthly fee on a per user basis. We're unsure of the exact pricing yet.

It definitely isn't slow for all users! However, there are some that send so many emails that any incremental speed-up is very helpful.
Plus, we're looking to start working on mobile, where it should be most useful!
Well it's being used to clean the air filter so presumably any failure will be caught by said filter.
This is awesome guys. To reply to all the people that are like this is not a big enough problem, tell them that this is the start and then tell them what is the next stage of your company.

To me, it sounds like a personal assistant that can automatically reply for you to fairly complex emails. We get SO MUCH email, maybe this will actually help us manage all that.

It is a very powerful idea, all the best to you.
Cntr: A user-friendly replacement for docker exec
No they aren't. Aside from the inherent and obvious lack of nuance in that terminology, black hats do not report their vulnerabilities. They weaponize them and use them, or they sell them to criminal organizations.
https://news.ycombinator.com/item?id=16577824
10% chance of recovery when? You can't talk about probability of a continuous unbounded time process without specifying a timeframe. Otherwise you end up with 100% or 0% as only possible answers.
Yes, "100% Satisfaction Guaranteed" is a common marketing theme, and explicitly encourages the behavior parent commenter calls "not a defacto right"
I wrote a Firefox extension called "Open Page in Private Window" that adds a toolbar button and context menu item to open the current page in a new Private Window. This is useful for reading articles on websites that limit the number of articles you can read per month.

https://addons.mozilla.org/en-US/firefox/addon/open-page-in-...
Current trends show a stabilizing population around 11 billion just after 2100.

Income inequality and “expensive” are not exclusive. If the median income is $1B in current dollars with lots of zettanaires (10^21 vs 10^9 for bikkionaires) you will have high income inequality but still have plenty with few things expensive.

Income inequality, with no other info, is not necessarily bad.

https://esa.un.org/unpd/wpp/Publications/
These are fairly different offerings. Improbable is about enabling the creation of massive worlds with various actors and players interacting in the same world server - effectively large-scale MMO's with a lack of sharding. But it is also proprietary technology, so your game is entirely dependent on them sticking around and maintaining the software.

Agones is focused more on massive scaling for individual servers. i.e. making it significantly easier to scale up and down servers based on demand (similar to AWS GameLift), but from what I see there is no world-sharing across them as that isn't the point of this specific project.

It's an interesting solution to a common problem. We work in a similar space and use Kubernetes extensively for managing our services behind the scenes, it's particularly useful for mobile games as they have a lot of peak/trough traffic throughout the course of a day, let alone during a featuring on an App Store or a live event which drives traffic through the roof for a very brief period of time.
I wouldn't say so. I'm distraught by it, actually.
Yes, common email replies are fast. It is composing a new email to a new person that was not written before and cannot be seen in my sent folder that is difficult. AI can be done by using the receiver email and subject of the email to produce content.
Really long expiration certs are a security issue. The main reason being that if the cert is compromised, there is a much longer window that it can be exploited. With a 90 day window, even if it is compromised, it will stop working soon.

Even in the case that it is compromised and you know it, your only option is certificate revocation. And you are in big trouble if you are relying on revocation because most clients do not keep very up to date with the CRL.

Not only for security, but the 90 days is to encourage automation. And most clients like certbot will check everyday, and if the cert is within 30 days of renewal, it attempts to renew. If letsencrypt is down, it will try again the next day. So you have an entire month before an outage would affect you.
I've asked interviewers "what do you like about working here."

followed by what are the things they don't like about working here.

I've gotten pretty candid responses.
IIRC checking it out, even just out of curiosity and not filling anything in, automatically created a sparse one based on your Q&A activity. That could explain the wording.
“Women at Microsoft are sexualized by their male managers,” lawsuit alleges
>their one dollar notes that are worth $1,000 in 2018 dollars.

The fed would never allow this to happen. That would be deflation.

What we should pray for is $0.25 loaves of bread, $10 rent, and a $1000 minimum wage.

We want a future where human time is valued and basic resources are plentiful enough to be cheap for everyone.
Sorry to hear that! I'd love to find out more about how we could resolve that issue.

Privacy and security are extremely high on our priority list since email is such an intimate communication channel.
Yes. A rather uninspiring appraisal of cyberspace — web browsing & emailing — though.
The renegotiation of the social contract to remove any element of personal space (cubicles to bullpens, cars to crush-loaded buses, and now studios to barracks) is many things, but it isn’t progress. As someone with deep-seated needs for alone time and private space, “our culture’s obsessive individualism” is awesome and it’s deeply disturbing to see it evaporate.
OK, but you talked about "the day HN announced". That's different from user behavior. (And I'm not sure user behavior changed all that much. People flagged political threads before the short-lived official ban, too.)
The security flaws aren't really the issue. The way they did it seems like they have an interest to manipulate the stock.
Black hat isn't distinguished by failing to report vunlerabilities. It's distinguished by bad faith.