skysight-inc/HackerNews huggingface dataset:
> Also, couldn't fraudsters circumvent this entirely by paying in cash?

Are they doing it off credit cards, or scanning your ID when you present the return and running that?
A security researcher claims to have access to the full (non-public) technical report as well as PoC exploits for it. He says they're legit, and they are flaws, not just "you can do admin things with an admin password".

https://twitter.com/dguido/status/973628511515750400

Sounds like the capabilities include the ability to jump outside a VM sandbox, take over the PSP, and pivot to the firmware or BIOS exploits.

https://www.techpowerup.com/242328/13-major-vulnerabilities-...
> Given that the output of so many brilliant people is skewed to when they are young...

[citation needed]

Is this really the case? If so why do salaries increase with age? What do you mean by "young"? The bottom half of living people by age? How do you explain the years our children spend in school generating no value at all?
Imagine a "customer" hates Amazon, he can get Amazon to lose a lot of money by buying a lot of things, open them, then return everything.

Amazon won't be a sustainable business if it can't reject "customers".
Got it, makes sense. I'll make sure to update that soon! Thank you for the suggestion.

We delete data the second we don't have access to users' account. However, we don't store any new data after you uninstall us. The reason is that there's actually no way of tracking who uninstalls us - Chrome Extensions are not providing any real support for it. We're looking into it, and will retroactively remove all data from users who uninstalled us.

Brilliant idea! We'll make the checkbox more visible!
Got it, sorry about that. Please let me know what you think once you get some time to play with the extension! Thank you so much again for the feedback, it's incredibly valuable.
ever wonder why recurring subscriptions are the default Saas payment method? this is why
It seems to be based on referrer. You can save the article to Pocket, open Pocket, click "go to original", and bypass.
It's a very nice feature, but you can't actually get the cert to use on your own servers or devices. You can only use it with AWS services, like their load balancers and Cloudfront. It makes a lot of sense that they do it this way, it makes it very easy to keep secure, since you never get the key. However it doesn't solve the same problems that Let's Encrypt does, and that's ok.
Burst credits of t2 EC2 instances need monitoring
An eye for an eye works only until everyone is blind.

You seem to have several deeply misguided premises.

1. We don't know ARM knowingly shipped these chips although they were vulnerable. Bugs happen.

2. Even if this was the case, an individual can show, and ought to, show decency and empathy towards others.

3. This last comment of yours is a straw man and I doubt you are incapable of seeing this. You parent's argument was much more nuanced and elaborate than your rebuttal.
Fullstack apps support was just released to do so not many examples on our forum. If you go to https://repl.it/languages/express you'll see a simple scaffold for ExpressJS.

I started moving my blog to Repl.it, can be found here: https://repl.it/@amasad/blog
Really? My phone causes depression every time I look at it.
I thought that was the case, until CloudFlare issued a cert for a subdomain of mine without a single email round-trip or even notification.

Any DNS-based validation is contingent on full DNS control, and that does mean FULL. CNAME records are absolute, if I CNAME foo to xyz then I'm trusting xyz 100%. I won't get an email round-trip or CAA ping for the certificate unless I'm looking for it, because CNAME implies that all things that apply to xyz apply to anything pointed at it. So the CAA record for xyz applies, not the CAA record for foo - it's not even valid to have any other record types for the same name as a CNAME record, and CAA resolution stops if it gets a valid response versus walking up to the domain root.

To be clear: CloudFlare issued a perfectly valid certificate for a perfectly valid use case, it just bothers me that I couldn't tell it was issued until after-the-fact by seeing it in CT logs, and couldn't have prevented it from being issued by the mechanisms that seem to be built for that.
Thanks for thoughtful response!

- I was just looking at the cost for me to take Uber across town. My experience has a lot of 30 minute trips in different cities, which has equated to $50 rides on UberX, and that is always between urban centers and airports (i.e. ideal connecting points). My assumption would be that Uber gets as close to operating cost as feasible, if not cheating on the backs of the drivers, plus Uber hasn't actually made money (but thats a different discussion!). So thats my $100/hr for an Uber. Never mind the fact that personal car ownership is far cheaper.

- With very limited experience with general aviation, I have chartered a few private flights- for around $4000 for a day trip on a late model KingAir. Not worth much for this comparison. But thats why I looked to Uber as the absolute low end, because the best economics of air travel will probably only approach the best economics of surface travel.

- I just don't know why Cora's aerodynamics wouldn't look a heck of a lot like a quadcopter. My background is Civil engineering (im a static kind of guy!) so i dont know much here. All those extra surfaces add a lot of drag, no way around it. I wonder if they could turn the props and feather them up so they all align and provide lift with forward flight? I'm sure Eric Allison (engineering lead) is on top of it.

Dont get me wrong, I think its great stuff and I look forward to its development. However, there are a lot more problems to solve than just perfecting the actual aircraft. Its a whole ecosystem, not just an air shuttle. Recent history has given us a few great entrepreneurs who have overcome a multitude of problems in their space, but i definitely wouldn't bet too early on something like this without a little more to show for it. The New Zealand partnership will be a good prooving grounds.

EDIT: im happy to be wrong on all this!
They are already maintaining FF 52 LTS (actually, in Mozilla terminology it's called ESR) They should've calculated this in advance and made FF 56 LTS. They could still do it now if they wanted...
In the era in question westward movement was towards and over the Adirondacks. Formidable obstacle for ox-drawn sleds, but nothing like the Rockies...
I have prostate cancer. But I am happy
Does the DNS method require proving you control the IP space for the domain, or is a DNS TXT really the only thing you need to generate a certificate?
"I hope future people are appalled that in the 21st century, the richest and most comfortable people in history spent their money and resources trying to live forever"

I hope nobody tells this guy about chemotherapy, he's gonna flip.
While I'm fine with criticizing them for partial disclosure, I again have a problem mapping any of this back to ethics, because, again, independent researchers do not have an obligation to vendors or to any amorphous public. As long as they aren't literally exploiting (or arranging to have exploited) vulnerabilities to break into people's computers, or lying about what they found, I don't think ethics have much to say about what they should do.
Of the examples given in the story, all of them mentioned a "warn" before being unable to return. So it's not as if they weren't given advance notice.
>Maybe Apple isn't interested in allowing a competitor...

Wouldn't be the first time Apple has done this
> However, many people do believe that async/await and event loops make reasoning about non-blocking IO much easier.

they do, until their program is mysteriously having MySQL server drop their connections randomly because something CPU-bound snuck in and the server dumps non-authenticated connections after ten seconds. Three days of acquiring and poring over HAProxy debug logs from the production system finally reveals the issue that never really should have happened in the first place because the server is only handling about 30 requests per second, and of course the fix is to switch that part of the program to threads.

asyncio certainly makes it easier to reason about non-blocking IO but it also means you have to construct your own preemptive multitasking system by hand, given only points of IO where context can actually switch. We're coding in high level scripting languages. Low level details like memory allocation, garbage collection, and multitasking should be taken care of for us.
with those who do not go back on their own return policy.
This looks wonderful! I'd love to go through SICP or learn Haskell or something with this!

Are there plans to include Erlang or Elixir or $your_favorite_language by chance?
Interestingly enough, all transit staff are trained to be conductors in cases when the automated system doesn't work. It recently snowed which incorrectly triggered the "something is on the track" sensors causing the entire system to stop. They just took all the people normally doing other tasks and made them manually drive the trains for a day until the snow melted.
Well you imported those Starbucks songs yourself so you can't really blame Apple for that. Try the "Delete from Library" option -- it works great.
I feel as this story is only on HN because of the misleading title.

Here is a shortened version of the story:

"Natalicia Tracy's Story Of Human Trafficking

She came from a family of 10 children, and became a domestic worker, caring for another family's children, by age 8.

[Her] goal was always to finish high school, then go onto some kind of professional training.

[She] went to the early session, from 7 a.m. to 11:30 a.m. Then from noon until bedtime, plus weekends, [she] worked for a neighbor who had asked [her] at age 8 to care for her 2-year-old daughter, and later, her second daughter.

To support [her]self, [she] began to work nearby as a nanny for a family of two doctors who had recently had a baby.

[They] agreed verbally that [she] would work for the family for two years.

The family told [her] [she] had nothing to worry about.

For one thing, [her] visa was tied to [her] work with the family.

[She] had worked for the family in Brazil, and there, [she] never felt mistreated.

[She] volunteered at the Brazilian Worker Center, a community-based organization in Boston that works for the empowerment of Brazilian immigrants.

Now, every day, [she] work so that women who are in situations like the one [she] was in can get out and build lives of their own.

This story was produced with assistance from the National Domestic Workers Alliance and its Beyond Survival campaign."
To try to walk very lightly and not be political, I'll put it this way.

A nomination sometimes (usually?) reflects an administrations views and policy.
The only reason I'm an Apple Music subscriber is because I'm on a family member's plan. There are so many usability problems with it on iOS that I would not consider paying for it myself — and iTunes is another level of terrible.

I often times have trouble getting Apple Music to playback reliably! https://imgur.com/a/VrO1Y

Spotify's UX is marginally better than Apple Music, but still not worth paying for in my opinion. Neither service allows me to block particular songs/artists from being recommended, which I find incredibly frustrating.
For those of us who aren't familiar with the price history what's the lie here?
> I don't know enough to understand how limited the ElbertV2 is...

The Spartan-3A (XC3S50A) is an older chip -- it's from 2007, and is itself a minor update to the 2003 Spartan-3 family -- and using it limits you to the Xilinx ISE toolchain, which hasn't been updated since 2014.

It's still a decent entry point to FPGA development, though.
The government ought not be sanctioning it by saying things like "the money that we get goes towards schools" (https://www.texastribune.org/2017/07/07/hey-texplainer-does-...).
> I’d be impressed if your manager agrees.

I am his manager and I agree with him
And now your frontenders need to know how to write code in whatever your backend is written in, lest every new change be bottlenecked waiting for someone to build them new endpoints. Also, your backend guys are tied up constantly doing stupid endpoint changes, and both teams are wasting time messing around with extra effort to allow one side to be deployed before the other, instead of working on actual functionality work. Doing this in REST is a genuinely unpleasant experience, well deserving of being called hacky
Did you read the article?

The guy who was flagged had spent thousands at the store, and bought 3 phone cases for 80$, then returned them as his only return ever, and got flagged.
That's a shame. Client side decoration seemed ready when it was enabled on Fedora.
From what I read, this is very different between the US and Europe.
3. All the libraries we all know and love are moving there, even Guido the Python BDFL killed 2.7 off himself[0] with a definitive EOL date of 01/01/2020. Learn 3.

[0] https://mail.python.org/pipermail/python-dev/2018-March/1523...
I log in with the Wall Street Journal account that I finally broke down and paid for and I get: Service temporarily unavailable.
Nobody appointed these security researchers to the authority to which you assign to their actions, though. Burning the immediate user on the off chance that it helps the hypothetical future user is some very weak tea.

I agree that some proponents of immediate disclosure would claim that their actions encourage vendors to ship less vulnerable hardware or software. I do not believe that that, in the general case, is why it is being done. And I am certain that that, in this specific case, is not why it was done.
What does it mean for a CC company to 'hit' someone 'with fraud'?
Tip for @lawrencewu

Real-estate investors are not looking for houses in the US and Canada. They're looking for investments in Los Angeles, or Kansas, or Salt Lake City, or Arlington Virginia, et al. If you're sending deals to someone in Arizona, for New Hampshire or South Carolina properties, they're overwhelmingly going to fall flat.

Whenever you have the listing breadth to do it, you need to segment the emails down closer to the end user location, or at least make that an option when they sign-up. If I'm looking for a real-estate investments as a normal tier investor (ie I'm not super rich) that might own between one and a few properties, and I live in Boston, I am not investing in properties in Phoenix outside of unusual circumstances (eg the great recession, or going in with someone I just happen to know from there that will handle things locally in Phoenix).

I'd probably go further and suggest you knock down the pin for a specific market first, before sending out broad spectrum listings spanning the US in an email list. Starting out beyond that narrow focus, imo, dramatically increases the odds of failure, that you never properly connect to your email receivers (they don't get enough properties for their local interest, and dump your email list).
I even thought Meltdown/Spectre was overblown, and the average user will never see these attacks.
I'm guessing it's legal because they warn you before denying it (ie. they allow you to return it this time, but warn you that you won't be able to return next time)
What about the _user_? I'd like a easily-enabled option that gets rid of _all_ pop-up, pop-under, modal, whatever junk. Why isn't Mozilla providing that? It shouldn't be a matter of Chrome, or Mozilla, or whoever deciding. It should be a matter of the user deciding.

(And is there really a plugin for that? One that gets rid of all the junk, all the time? If so, it needs to be publicized.)
#SB
I'm trying to understand what the issue here was. Did they publicly expose the kubelet port on the internet?
I've been using repl.it for a couple of (or more, I suppose) years now, and it's been very helpful to have a simple, reliable REPL to jump into, test things out, and to share code. I've turned students and colleagues to it, too. I'm excited to see where you're taking it. I hope it continues to load and run quickly.

Just wanted to say thanks for building it, and keep up the great work!
Incidentally the first interpreter on repl.it was scheme. I was going through SICP and was tired of installing Dr Scheme everywhere.

Yes I love both these languages and will add support for them soon.
I could have used this advice a long time ago. For a while, I wanted to blog about the random programming issues that I run into, but it always seemed like writing quality blog posts would take too much effort.

I eventually created a dedicated page on my personal website. It's technically public, but I don't link to it from anywhere else on the website. It's just a way for me to practice writing and reflection without the pressure of thinking about an audience (besides myself).

This is the page, for anyone who might be interested: https://www.dannyguo.com/friction/
Tangent: I've long wondered when we'd see invention of drop-in roads - transportable segments of self-leveling roadways, robust enough for heavy use & a substantial lifespan yet easily disconnected & replaced (unlike current stubbornly permanent structures). In that context, I'm interested to the answer to your question.
Yes there are, but for some reason using a local file is a problem. Something about the ability of WebExtension to access a local file. Probably sensible, but in this case annoying.
Learning to Rank with Siamese Networks and Pairwise Data
The Net Neutrality law that was pushed recently did nothing for actual net neutrality, which was already preserved by existing legislation.

Also, if these laws were so obviously needed, why did they need to shovel $196M toward promoting them [0]?

0: https://www.washingtonexaminer.com/soros-ford-foundation-sho...
Show HN: Mindset – Self-Improvement Hypnosis
IIRC Microsoft does now recommend using a real domain with a real TLD nowadays.
Three articles on this same subject have been flagged off the front page this morning. Kind of smells funny.

https://news.ycombinator.com/item?id=16579219

https://news.ycombinator.com/item?id=16578715

https://news.ycombinator.com/item?id=16576569
I'm beginning to think that YCombinator will fund anything with MIT on it. Just last month I spoke with a YC founder that was trying to get me to pay $50 to have a 30 minute phone call with people working at Google. Not an interview, not a phone call with some executive--just a phone call with Google's rank and file. I've lost a lot of respect for YC as venture capital firm.
Probably Marston mat or one of its successors.

https://en.wikipedia.org/wiki/Marston_Mat
I'm too lazy to compile the example. Would be nice if they had some actual proof that didn't require my commission.
You can't just stop the gravy train by removing management. Bad culture is at all levels.
I'm not of a dissenting opinion on most of these experience reports, but

> TF binary versions need to be globally consistent,

honestly, shouldn't that kind of be your baseline goal for all tools that are on multiple hosts and taking part of your CI or development processes?
They could contribute to scientific progress by donating the money to a research university. Depending on your concept of immortality donating sperm or eggs seems to have a higher chance of success.
I think the better way to think about it is that you are investing in the network itself (at least in Sia's case). Siafunds could be valued with an NPV of the future revenue generated by users buying storage on the Sia network.

It's much harder to figure out how to value utility tokens. Here's an interesting starting point: https://medium.com/@cburniske/cryptoasset-valuations-ac83479...
>If you stop accepting returns

They are trying to stop people who abuse the policies, not returns altogether. The article never says the retailers are making a move to stop returns from everyone. That kinda defeats the point you are trying to make.

>If I can't return an item, I will be much more cautious about buying in the first place.

Sounds like its working then. The point is the customers that feel they don't need to research an item they are purchasing cause they can 'just return it' are the ones they want to be more cautious about buying in the first place cause you are costing them more money.

Really sounds like you are arguing against a scenario that isn't taking place. You are actually bringing up points that made them decide to do this. They can deter constant returners from using returns as a 'try any item you like and return it' and also deter return frauds.
Next time it might make sense to make it clear that the comment was edited and how... ;)
It's not their problem. There's no obligation for them to give any warning at all. They can just go public, short the stock, and watch it fall. The warning is just a polite thing to do
Apple’s Worldwide Developers Conference Kicks Off June 4 in San Jose – Apple
One of the original reasons that Bittorrent clients started sending encrypted data was to get around ISP packet inspection that tried to throttle torrents. That worked for a while, until ISPs started throttling based on torrent-like transfer patterns.

That wasn't a single regional ISP; it was a pretty common behavior. It's also something that would be fixed by either having a range of different ISPs available in a region, or enforcing net neutrality (in the sense of treating data as an opaque payload to be delivered).
It could be interesting. Some of the flaws presented require you flash your bios, if I understand correctly. They are included with what are likely real flaws, but maybe it's enough for a case of misleading the public in part. To me it seems sort of like saying Ford engines have a tendency to blow up, but only after you've overwritten some engine firmware. By itself, not much to talk about, but when attached to something that has indications of being used to make money through stock changes, maybe is more likely to be looked at unfavorably by the SEC?
Even then you should have some give aka Speed of X+3 MPH break, speed of x+1 MPH warning. You want fault tolerance not simply a hard limit without feedback.
This is one area where employment in California is advantageous...

California’s Labor Code, Section 2870 reads:

a) Any provision in an employment agreement which provides

that an employee shall assign, or offer to assign, any of his or her

rights in an invention to his or her employer shall not apply to an

invention that the employee developed entirely on his or her own time

without using the employer’s equipment, supplies, facilities, or

trade secret information except for those inventions that either:

Relate at the time of conception or reduction to practice of the invention to the employer’s business, or actual or demonstrably anticipated research or development of the employer; or
Result from any work performed by the employee for the employer.

b) To the extent a provision in an employment agreement purports

to require an employee to assign an invention otherwise excluded from

being required to be assigned under subdivision (a), the provision

is against the public policy of this state and is unenforceable.
Be careful regarding its transferability.

Under rule 144 you can have your original investors trade it after a lock-up period. But even with that, Reg D securities are not transferred very easily.

I had to learn all this when raising money for Qbix the last 7 years.

You MAY be able to have some sort of derivatives which are traded, like taxi medallion leases, and maybe they won't be considered securities since there is no expectation of profit (but then why do people buy them?)

IANAL
I suspect the percentage of podcasts sponsored by squarespace is probably even higher than that
Welcome! RedRock is a nice place to work out of, although it gets busy and hard to get a seat if you turn up after ~10am, but gets quiet again in the afternoon. I also like working (on https://ipinfo.io) from the library, which has tons of desks and great wifi.