skysight-inc/HackerNews huggingface dataset:
By flagging this thread you are effectively suppressing a very important discussion about the tech community's roles and responsibilities in the social and political worlds. As I mentioned in another comment, this industry tends to eschew political awareness. Which is ironic, because that passivity enables some of the biggest issues that we in the tech industry oppose (surveillance, irresponsible data collection, etc). There is real, visible, connective tissue between politics and technology and while ignoring may be the most comfortable thing to do, it's also the most irresponsible.
Why would scientists intentionally inject subjects with virii that should make them very sick? What kind of paperwork did they have to file with the IRB to be permitted to do that?
A few cases off the top of my head:

- When you need to work with older browsers or non-browser clients (e.g. API clients!) that don't support service workers.

- When it would be a security problem if the user can bypass or interfere with the worker (e.g. you can implement authentication in a CF Worker).

- When you specifically want to optimize your use of the shared HTTP cache at the Cloudflare PoP.

- When startup time of a service worker would be problematic.

- When CORS would prevent you from making the requests you need from the browser side. (CORS doesn't apply to CF Workers, since the things CORS needs to protect against are inherent to the client-side environment.)
I'm not sure that I can agree with your statement. Most non-crappy developers can have a new job within a week or so.
something smells fishy... y 24hrs warning? whatever happened to the usual 90 days disclosure?
What do you think the scam they're pulling off is? My mother used to do this. She'd buy a bunch of clothes during the day while I was at school and then return the ones I didn't like. Was she not a real customer?
You can consult the search bar at the bottom of the page to learn that I am 100% OK with immediate, uncoordinated disclosure. It's not what I personally do, but that's easy for me to say because I don't find these kinds of vulnerabilities.

This isn't "shoot the hostages". The researchers didn't manufacture the vulnerabilities; AMD did. If 4 dudes in a basement can find exploitable driver vulnerabilities, so can 10 researchers none of us will never have heard of working in a nondescript office somewhere in Bulgaria. The only moral differences is that these 4 dudes told us about what they found --- something else they had no actual obligation to do.

Again: it seems really likely that these vulnerabilities have been hyped way out of proportion to their real impact. I think it's reasonable to be irritated by that (again, though: this isn't a first). But other than that, I don't understand how people arrive at the conclusion that independent security researchers owe strangers the results of their work.
With a 50ms minimum. Because I guess you can't do anything useful faster than that. :)
Dev here. Looking forward to suggestions or question you have. :)
Sounds like you could have made your feed items REST API return the top 3 comments as well...

Maybe the lesson here isn't that GraphQL is a magic bullet, but that designing your API for your business needs solves a lot of frontend complexity (even if it's not pure "REST").
I wasn't referring to EV certificates, just to verifying simple ownership of the domain for the purposes of MITM and other attacks of that kind. Let's Encrypt would inform you that the page that appears when you visit googIe.com was indeed served by the owner of that domain (barring server compromises or cert leaks, but that's a separate issue). LE and "basic" certificates do not attempt to answer the question of who owns the domain -- that's also an entirely separate problem.
Pretty sick! I'll be using a pro plan for a new project. BTW, gradients not working in mobile.
Is the experiment really over when politically-adjacent threads are still getting flagbombed and removed? Just because it's not in the site guidelines doesn't mean it's not being actively enforced.
AMD Chips Have Critical Security Flaws Like Spectre and Meltdown
Do you refer to a certain Star Trek episode? https://en.m.wikipedia.org/wiki/Half_a_Life_(Star_Trek:_The_...

(Ritual suicide at age 60 embedded in culture)
From their policy: https://www.bestbuy.com/site/help-topics/return-exchange-pol...

"Like many retailers, we use a third party to help prevent losses by detecting improper returns, and, except where prohibited, require a valid ID for all store returns that lack proof of purchase. Reimbursements on returns lacking proof of purchase may be denied or limited and state sales tax and fees will not be reimbursed."

And the Visa guidelines for chargebacks, page 28 lists the reason codes: https://usa.visa.com/dam/VCOM/download/merchants/chargeback-...

My read puts Best Buy on solid footing here. If you're just returning it because you're unsatisfied, Visa doesn't seem to consider that valid for a chargeback. If it's defective and you have proof of purchase, you had enough evidence that BB would accept the return.
> emergency landing sites

Well, there's beaches near some coastal cities that afford survivable landings, but may be risky for others.

Last year there was a tragic case near Lisbon where two people on the ground died. It was a flight lesson with an experienced instructor, who followed protocol and landed on sand at the water's edge. (My understanding of the discussion at the time was that hitting water with fixed landing gear is an almost certain death sentence for the plane passengers, because it flips over instantly.)

Unfortunately, without power, the pilot missed a more deserted stretch and ended up in a section of the beach with quite a few people enjoying the summer at the seaside.

One of the reports in the Portuguese press: http://observador.pt/2017/08/02/avioneta-despenha-se-na-prai...
Singapore and the US also have a very longstanding relationship.
Responsible disclosure is an Orwellian term literally coined by vendors as a way to coerce researchers into adhering to vendor schedules and vendor PR plans.

https://hn.algolia.com/?query=author:tptacek%20responsible%2...
Can someone summarize? I don't have a WSJ account.
That will likely be more expensive than just resurrecting you.

I’d structure with smart contracts with a certain price for digital. Another price for full physical. Keep other assets outside of consciousness in legal trusts.

There may be torturers, but likely non-torturers as well. Knowing this, tortured versions of me won’t crack as they don’t care.
They mention it in the article but forgot the caveat in the title:

How GraphQL[1] Replaces[2] Redux

[1] Or any well designed back end API

[2] For some narrow, often simple applications. And even in those cases it usually doesn't replace redux as much as it augments it.
But the whole point of this discussion is to evaluate the likely performance of a new aircraft, not the overall performance of the existing fleet. This particular new aircraft is electric, so leaded avgas won't be an issue.
The F# foundation also has a mentorship program for people that is free iirc.
Question for Apollo Client users.

I've been using Apollo Client. When I add or delete data, I need to update the local store on Apollo.

How have you found your experience using the local store on Apollo versus Redux?
Do you have numbers around how often autocomplete is used? For example, using your "how a" example, what percentage of time will a user select a suggested autocomplete?
Science covers it if and only if enough empirical proof exists.
By trains do you mean buses? or lots of buses. Or how about many buses mixed with cars. You should do a quick Fermi calculation and you will find that with a close packed stream of single passenger vehicles at 200kph, the people/hour is higher that BART at rush hour. Use vehicles where people stand and are packed like sardines, as it is on BART at rush hour, and then you are getting a crazy high people/hour.

If you really need to have all new transportation systems be public trains to feel good about building it, then, yes, there will be public trains in these tunnels.
You can also use our Terraform provider to manage DNS: https://github.com/terraform-providers/terraform-provider-cl....

We've got a number of open PRs as well to add other resources, e.g., load balancing, rate limiting, zone settings, etc. HashiCorp is currently reviewing/merging.
Funny, I'm going in the opposite direction. For a long time I omitted hats, gloves, and insulation for my legs on cold days, wearing mostly just a big jacket.

I eventually figured out it was silently making me miserable, as my core temperature would slowly drop as I lose heat from my legs & head, and my glycogen stores deplete.

I could slowly & silently endure subzero temperatures, for many hours or even days. Or I could take the time to remember to put on long johns, and be warm and happy.
You need to work somewhere for a while to know what it's actually like. What people tell you in interviews only has so much to do with that.
I think if I had to rank them I'd say Hyperion is top-tier, the sort of book I can quote from even years after reading it. The others are merely excellent sci-fi novels. I don't know how I'd rank the second book against the last two; they're fairly different and I enjoyed them all.
Definitely just speculating here, but there is a `driver.save_screenshot(path)` method that would probably be worth trying.

This worked for me:

from selenium.webdriver import Firefox
from selenium.webdriver.firefox.options import Options

geckodriver_path = '/usr/local/bin/geckodriver'
options = Options()
options.add_argument('-headless')
driver = Firefox(executable_path=geckodriver_path, firefox_options=options)

url='https://news.ycombinator.com/item?id=16576015'
driver.get(url)
driver.save_screenshot('./hn.png')
But did you create an entire website about the vulnerability, including graphics and headline-friendly names, as well as sending out briefings to major media outlets ahead of the disclosure? Because that's what this group did
​webjets.io is trending on ProductHunt
Most of your litany of questions can be answered by saying that nobody became a cultist by only reading words on a screen of what the cult believes.

Take Scientology for instance. I have access to the whole of their printed words online, yet I am not a Scientologist. You wouldn't be either. You can sub out "Scientology" for any other cult or any other odious group (including race nationalists, terrorists, etc.) and the statement remains true.

The reason being that nothing is being engaged here other than reading, writing, and thinking. No money is changing hands, no leader is demanding my obedience at literal or metaphorical gunpoint. In the case of a web forum the absolute worst thing that could happen to me is that I'll get rude comments or be unable to participate further.

The only difference between discourse and propaganda is the aim of the people doing the talking. This is a subjective value judgment on what you think of the speech, and when it comes to analyzing it, this amounts to noise. Are you trying to propagandize at me? :)
Ask HN: API documentation hub / directory
I'm looking to create an internal API directory for an organization with a few hundred services. They use OpenAPI quite a bit and document most of their APIs but as the number of services grows having a central API directory would this process much more manageable.

Are you aware of any open source project that could help with this?

Thanks!
We constructed a whole reality to steal your keys - the world's most advanced phishing attack.
The SSL zealotry drives me nuts. The infosec community screams constantly about "HTTPS everywhere", but they either don't know or don't care about all the effort and pain they're creating for developers who just want their software to work. How many perfectly good sites will be marked ominously as "insecure" by Chrome in the next few months? Sites that were working just fine until someone at Big G decided they weren't.

(Related, a big thanks to Google for un-trusting that whole big Symantec security chain. Yeah, I realize they weren't competent, but I also realize that it had no practical effect on my site's security, as I don't have nation states or motivated hackers in my threat model.)

Security measures should be weighed like everything else - as cost/benefit. In many cases the cost of the security is not worth it.

Edit: I'd just like to point out the irony in some of the replies to this comment. I'm complaining about zealotry, and the vast majority of nasty replies I've received to this comment are using language that only zealots and ideologues would use. My god, you'd think I'm killing puppies based on some of these responses. Nope, just advocating for using HTTPS where it makes sense, and not having it forced down your throat.
Show HN: TryContracts – A fun Ethereum intro, try a smart contract in 2 minutes
This is a bigger problem. But the smart contract should be verifiable if the blockchain still exists. If it doesn’t then your currency is probably worthless so resurrectors won’t bother.

Although I’m not sure how you would verify your messages with private key without revealing to whatever is managing your consciousness’ memory.
Yes, this is a very common problem actually, it's called return fraud [1].

[1] https://en.wikipedia.org/wiki/Return_fraud
Yea I think I would love if Terraform supported modern Kubernetes concepts. The plan-apply model is IMO the best. I don't really grok why people don't think Terraform should be used this way as I've seen in other comments here and outside of HN. At the end of the day I fail to see how managing Kubernetes resources with Terraform would be any different than AWS or GCP or whathaveyou resources.
I'm talking about the people who buy the clothes, wear them, and return them.
Kitty Hawk, NC - to be specific! It's why North Carolina license plates say "First in Flight."
This is a puff piece that's essentially an ad for the company with whom she accepted an offer.
I've been using Apollo Client and React to manage state on a medium size React app (i.e. no Redux). Interested to hear your thoughts here. Have you been using Redux + Apollo Client + React on a medium to large app?
What if you think of it like "I wish I could give my kids advice even when I'm long gone" or "would I wish to care for the well being of a son/daughter I never knew I had?" If so, what if that kid was 100% your genes instead of 50%?
But you didn't wear the ones you didn't like, presumably. The scam is where you buy clothes for a special occasion, wear them, and then return them.
>This is great for the winner, but how would you prevent collusion here?

Well the implication here is by publishing the person's name you have a public / crowdsourced validation process, right?
But how do you prevent collusion and abuse by the general public if they're really part of the validation process? Both have the same solution - you need trusted parties to validate the process, people who were themselves validated and vetted to do the work. Isn't that already in place? I believe so.
> Lack of access to a computer almost kept some of our best students from being able to attend. Those aren’t expensive.

This is a bias from the lower middle to upper class. A computer without some knowledge or support to maintain it (more costs) make that price rise.
1. It's easy to maintain/update the code because it is pushed once to Cloudflare and you don't have to worry about browser caching effects on JavaScript delivered to the browser.

2. The performance of the code will be much higher than in the browser because of the server resources available and also because and subrequests will happen across Cloudflare's fast/reliable links and not whatever the end user is connected to.

3. The end user has control over what JavaScript is executed and might use a tool like Disconnect to block external scripts preventing the code from running at all.

4. Security: you can include things like API keys.

5. Script starts executing earlier.

6. Conserves bandwidth/battery life of mobile users.
A friends startup, founder showed me around the source and everything two years ago. It's exiting to see a startup to grow and develop over the years. I guess their launch on ProductHunt is a good move way forward.
I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" - until the ACME endpoints are down or something).
They would need to both hack your DNS entries and have access to the private key of the pair for which the certificate was signed. Having access to the private key probably indicates a significant hole in the site's infrastructure so that is more of a concern than DNS.

Of course such access may be easier for a disgruntled internal actor so it is a risk worth considering (and mitigating via proper separation of concerns/access).
And hope they haven't learned to synthesize it or mine it from asteroids when it's time to wake up.
“Burdening future generations with our brain banks is just comically arrogant. Aren’t we leaving them with enough problems?” Hendricks told me this week after reviewing Nectome’s website. “I hope future people are appalled that in the 21st century, the richest and most comfortable people in history spent their money and resources trying to live forever on the backs of their descendants. I mean, it’s a joke, right? They are cartoon bad guys.”

Best part of the article for sure
> You cannot get out of the network unless the traffic is proxied

Place I work does this - and it's a constant PITA that gets in the way of me doing my job. But I think if you have a system to put exceptions in place, and it doesn't take 47 weeks of email ping ping with 18 different managers, then it's fine.

Unfortunately, where I work is a beurocratic nightmare.

But it's easily gotten around - I have a cloud-hosted VM (paid for by company MSDN!) that runs SSH on port 443 - so the HTTP proxy will let me through to setup a tunnel through which I can access anything using SOCKS.
Amazon does this as well. I don't know why they would this and treat customers this way, especially customers who purchase a lot of things from them, but I do know it's not fraud. It's not even clear how this is legal since the return clause is part of a contract. But they will close your account, prematurely end your Prime membership, and there's nothing you can do about it. Nor can you know when this will happen. That's how much companies like Amazon and Best Buy value their customers. To say they treat them like shit is an understatement.
Then why even say it requires euthanasia. If they are still researching it, would you want a non-destructive scan as the end functionality.
http://archive.is/Swq7X
Python 3: An Intro to f-strings
Desk.com is shutting down by March 13, 2020
Have you read Avogadro Corp (http://avogadrocorp.com/ )? That novel is based on the premise of a tool that is intended to help you write well-crafted emails yet quickly gets out of hand.

I'm not suggesting at all this will be the case here but this seems related and might be an interesting read.
How are they going to compete with Amazon's competing service?

https://www.theonion.com/popular-new-amazon-service-just-com...
We get used in 15% of emails on average. That number tends to vary a lot from user to user though - we've got a few users who use us in 80% of their emails, and some that use us very sporadically.

We don't have a number for the percentage of usage for what the user specifically types, but it sounds like definitely something we should have, so thanks for the suggestion!
It doesn't necessarily wholesale invalidate it, and it depends on the context. The danger is that if the claim is, for example, "they are making a hostile environment for $MINORITY", if statements exist that say "We are just doing this to avoid liability", those could easily be interpreted as indicators of insincerity and that the bias exists. Whereas, if they at least appear to be True Believers, it is harder to call that into question.

It also hurts from the PR angle, for basically the same reasons. News outlets don't want to be seen as tools of the machine spreading corporate FUD and saving BigCo from liability. They want to see themselves as noble soldiers on "the right side of history", and they want the public to see them that way too.

It's therefore much easier to get coverage, which will be useful for establishing your non-bias, if you don't tell everyone "we wouldn't be running this program and enforcing these 'everyone play nice now' codes if we didn't feel there was a meaningful legal risk involved in not doing so".
How the new Versa and Ace will help Fitbit fight Apple Watch and win the family
That's a funny one. The kernel changes they needed to make in order to support transactional stuff were pervasive, and it's used extensively under the covers. The MSDN commentary makes it sound like they're going to completely pull the functionality one day, which is misleading.
What's a good example of a page-blocking modal box? I never found one that wouldn't be better as a pop-up, like the new email dialog on Gmail, or as extra content to the main page, like most confirmation dialogs.
Thank you for your support.

I also believe this is a terribly important topic to discuss, with special relevance for the HN community (not that I need to prove that, the number of comments speaks for itself).

I have emailed the mods, and will update with the reply I get (if I don't end up banned).
<money does not help creating good music, and i kind of think that might be more true of software than we think too.>

Wow, yeah, I agree. I think this is such a misunderstood aspect of software. A lot of institutions seem to think it's like biotech, where a huge investment in gleaming buildings and dedicated lab space will make all the difference.

I'm old enough (and grew up in SF) to remember when software development was not the monied, gentrifying cultural enemy it's often made out to be nowadays, but a creative pursuit that naturally took place in funky, artistic neighborhoods, for the same reasons everyone else was there. It was the right environment for this sort of activity.

Money does of course help for software development in that you do need to live, and it takes a lot of time. I read this interesting quote about the Galapagos project (an arts collective moving from NY to Detroit)[1]: "You can’t paint at night in your kitchen and hope to be a good artist. It doesn’t work that way."

Now, counter examples abound, I am sure of that. And most creative folks do need to do something to make ends meet. But in the end, if paying the rent means you have to be drained from a corporate job by the end of the day, it does make it harder to create good music, art, and yeah, software. This is one reason I have to wonder if SF can continue to be the locale where this sort of creativity, including even software, will come from in the future.

[1] https://www.galapagosdetroit.com