skysight-inc/HackerNews huggingface dataset:
> A overlaying modal always interrupts the user's focus and often gets in the way of otherwise useful information or actions before confirming.

But an overlaying action-bar with a "confirm" button that otherwise allows you to scroll before you delete would be a great middleground.

But how can a browser tell the difference?
The announcement is indeed earlier than usual. The usual announcement date for WWDC is April with the event happening in June.

Last year was an unusual exception where the announcement was made in mid-february.
Good question. They call the "MASTERKEY attack" that requires a reflashed BIOS "remotely exploitable" because on some systems, the BIOS can be flashed from the OS. They then speculate "On motherboards where re-flashing is not possible because it has been blocked, or because BIOS updates
must be encapsulated and digitally signed by an OEM-specific digital signature, we suspect an attacker could
occasionally still succeed in re-flashing the BIOS." Page 9 in the PDF.

I'm not a professional security researcher but this is looking pretty darn flimsy. I also don't see any proof of concept code anywhere -- the "whitepaper" seems to just claim these things exist with very little mention of how to exploit them. Compare against Meltdown/Spectre, which was highly technical and had lots of PoC code. This just says "Upload malware to the processor" without further comment.

I'm not saying they didn't find anything, but whatever they found, they've hardly disclosed it.
I think the difference in facts you're talking about is a difference of degree, not category. In other words, it's not plainly false, there certainly is a vulnerability, it's just perhaps exaggerated. I could see a case being brought against the researchers on those grounds, but I'd be really surprised if anything came of it.
How DIY can make you to Creative Well-being
Sounds like a good job for Go :)
I'm trying to think of a logistics company that doesn't fight wars. Maybe USPS or Fedex?
It really depends from builder. Russian-built Tilda.cc and Realmag are two examples that beat Squarespace and Wix in choice of building blocks and UX for building. And these do not advertise heavily. Lonely Page has good UX for building longreads too, so I think it will find its users.
Legal question:

Insider trading claims might be difficult since you can claim the vulnerabilities were public knowledge waiting to be discovered, but...

Can you trade on knowing the security disclosure timeline prior to your publication of the vulnerability? That would seem to be insider knowledge until AMD authorizes publication. E.g. I've got knowledge that AMD likely wouldn't be able to fix the flaws prior to my disclosure. That knowledge would inherently be non-public.

Thoughts?

Disclosure: I've been long AMD for a while.
It's just more of the lower class preying upon itself. They understand the rules and stakes of the game within the scope of their own world.

Bubba Ray may be fooled by a slip-and-fall scam, but try that shit on Warren Buffet and you'll be dealing with his team of lawyers.

Bubba Ray opts for the lump sum instead of the annuity. Anybody with a gun knows he has easy access to it-- try that shit on Bill Gates and you'll be lucky if you can get more than $400 from his ATM card, what with his billions being tied up in various investment vehicles.

On rare occasion you end up with situations like the Getty fiasco but it's much easier (and draws less attention) if you stick to just ripping off the little people. The rules of the game change when you go big-league and you'll quickly find yourself in over your head.
I appreciate the feedback. I'll pass it along to our designer.
Copyright still covers silicon designs in any case. Patents limit fair competition, such as ISA compatibity.
A lot of ISPs, some huge like the "XfinityWifi" SSID, routinely inject their own javascript in HTTP pages. Some even take no care to namespace their javascript and wreck a party on your window globals, too.
AWS: “Requester Pays” Buckets
Good question, yes, you measure it when the rocket is on the ground.
As someone who used re-natal previously I'm looking forward to trying this out!
Exactly. But knowing some berezovsky folks back in early 00's (i'm russian), well, making it into 68 is an achievement, tbh. Folks were enjoying life.
Silicon Valley's Demise Has Been Postponed Again
Maybe it is off topic? But, on the other hand, this unflagged:

https://news.ycombinator.com/item?id=16576865

Seems pretty arbitrary to me. That's the internet, I guess.
> I think it's a cabal of morally righteous security-minded people who have never worked for small companies or realize that most dev teams don't have the time to deal with all this forced entropy.

This is just one anecdote, but I worked at a company small enough that I was the only developer/ops person. Time spent managing HTTPS infrastructure couldn't have been more than a handful of hours a year.

What is so painful to you about running your website(s) on HTTPS?
Firefox can now block notification requests from new sites
Could controlling the shape of the data returned by GraphQL on the client open up your application to really inefficient querying?

We control what is returned in data from our REST API by merely specifying the fields you want as a parameter. If there are use cases that would require multiple tables to be joined, those are created ahead of time as views with appropriate triggers for updates and then endpoints are created for accessing that view through RESTful methods. This has always worked just fine.
Agreed on the losing money part, in general, but in a stock as volatile as AMD, I feel like there is an opportunity for this type of action, may not be the case for others.

Also, as nothing has been verified about the report (from AMD), there is still the potential for this to move either way.

Great username BTW
Are you equally outraged by people who spend $10000 on other leisure activities?
I did 11 months of 24x7. My managers were so normed to it they actually documented it. No one seemed to notice my contract called for that time to be compensated.

After I ended my employment they seemed shocked when I asked for that compensation to be paid out. They then denied that I had been 'actually on call' (note: managers, don't lie to your HR department - especially the investigations people). Thankfully I had documented all the listings of me being on call and pointed out that their policy required an on call engineer to be available and noted that no one else in the group was certified to be on cal.

We settled before I had to take it to court.
No doubt, and thats why some places just put restocking fees around certain types of clothing (formalwear/around school events/ etc)
Most return policies these days has provisions that say they reserve the right to refuse returns. Also it's a huge hassle to go through a small claim court or call credit card companies (even credit card companies flags you if you make repeated calls for chargebacks.)
Anybody with unrestricted access to a SQL server can manipulate whatever they want.
Yup, I got flagged and only ever returned items THAT WERE NOT EVEN THE LISTED PRODUCT THAT I ORDERED. And rather than just punishing me by not letting me buy from randos not fulfilled by Amazon, they go all out in excommunicating me from the ~13% and growing of civilization that Amazon controls. And they give customers the same amount of "strikes" (trying to get scams or seller mistakes resolved) no matter the volume of purchases. But that's the future. These companies operate like the Chinese Communist Party and soon all of society will be run on this sort of repression.
> returns to online providers require paying for shipping, and the initial shipping costs aren't refunded either.

Amazon offers various kinds of free / flat-price shipping, and free return-shipping for flawed products

> Even with 'free shipping', the cost of shipping + everyone else's returns is just built in.

Delivering a package to a local retailer is customer-paid shipping, just in effort/gas/wear-and-tear, not simple cash.
Wow, what was the runway material?
>developers who just want their software to work.

Do they keep their servers up to date? Why is it so much easier to do that than getting an SSL cert four times a year?

I hope they update their servers more often than that.
There is a reasonably accepted definition for what a "black hat" is. I don't particularly agree with conceptually bucketing people into black hats or white hats, but the paradigm has an existing meaning.

In any case, if we go by what you're saying, then anyone can define "black hat" to mean whatever they want, which means it's a meaningless and unproductive concept to throw around in conversation.

Your assertion is in a catch-22 here. Words have meaning without requiring an independent body to rigorously define them. The established definition of a black hat is someone who compromises other people using security failures for their own gain. If instead we choose to say that the term has no established definition, then the entire point is moot, because calling someone a "black hat" no longer means anything.
Year in Review: Lessons Learned from Bootstrapping Our SaaS Startup
I understand what you mean, but political content is just not allowed.

Perhaps for the good ;)

Ps. I posted it
More information can be found here http://fsharp.org/mentorship/index.html
Good programmer with good libraries got something done (2013)
So the 11 billion dollar vendor who shipped vulnerabilities in the first place gets to treat these problems as an externality, but 4 dudes in a basement who did a basic research project have to be restrained from speaking?

I don't see how you get there from here.
He cares because we do, while Google is a faceless uncaring corporation.
Ummm, are there flight corridors defined for low flying aircraft? You can't just fly in a straight line everywhere. You can't just fly over a densely populated area and how do you avoid crashing into other flying taxis?
Most of the candidate of my past job who passed the initial non-technical interview with my former manager, over 2 years, that was probably a dozen people, leading to 3 hires.
I would think that a fan that has the purpose of cleaning the filter would have to blow in the reverse direction to blow the trapped dirt out. It would probably be on the clean side of the filter in that case, and any shrapnel it spewed off would go right into the turbine inlet.
I think google has just profiled you (and me, and everyone else on HN)...

We go on web-dev related and business start up websites, and google is watching us.
Nice platitude salad.
> "Thelonious Monk who just played everything in the hardest keys to prove how great he was on piano..."

Can't find where I read that. I believe it was a Miles Davis biography I read years ago. I know many Jazz greats thought the same of Monk. When you listen to "Monk meets John Coltrain" you can just see the two of them just making the hardest possible way to resolve what each other was doing. It is almost like they played musical dare for the last 9 months and finally gotten to a place where we got that album.

As a saxophonist I really enjoyed playing to his work, but my keyboard friends would get so worked up. Just look at 'round midnight. The key signature and the accidentals make it almost unreadable. Plus sure we can play in any key but certain one's are easier than others and it seem like it was always the key that couldn't make it harder if one tried. It was always known if you shown any weakness in playing keys that everyone else would keep modulating to try and mess you up.
Tesla is About to Ship its 10,000th Model 3
Shouldn't have promised it then.

Apri 2007:

"As President, I will close Guantanamo, reject the Military Commissions Act and adhere to the Geneva Conventions. Our Constitution and our Uniform Code of Military Justice provide a framework for dealing with the terrorists."

There was nothing there about "if Congress lets me and activist judges don't impede my progress".
> marked ominously as "insecure"

It's not that ominous. It's not even red!

I think it's pretty obvious to most users that "Insecure" doesn't matter as much on some random blog, but does matter a lot on something that looks like a bank or a store.
So sorry about that - we'll make sure to improve our privacy policy to reflect that better. Thank you for pointing it out!

We're working on client-side encryption right now actually, which will further help us be better about your privacy.

The only people who can read email sentences are our researchers - and even then the sentences are not identifiable. They are obviously bound by very restrictive NDAs.
Binance Will Open a Decentralized Exchange
black hats use them for bad, white hats use them for good.

ideological discussions about disclosure policy aside,
if they are doing this to manipulate stock prices and in doing so create a situation where more actual exploits occur, I'd say that is 'black hat' behavior.. the 'weaponization' is in the 'social engineering' of the market reaction, rather than a direct exploit in this case..
There's no chance of you getting to see a "super-interesting future". This comment is as weird to me as confusing a book on Relativity with Einstein. If you had a terminal disease, and a twin, would you expect to wake up in the body of your twin after death?
>I suppose you could hack something like that with REST but it would be difficult.

Not really. You can design specific REST endpoints to return the data in the format you want.
we're probably not at the same pay-grade / level of specialization.
Most likely the contract doesn't require them to accept returns at all.
Great, looking forward to it!
It's also a huge incentive to overstate the severity. Their goal is to profit off the panic they can produce, so every statement they make is likely heavily biased in that direction.

That said, I don't mind that these "research" organizations exist. Only bothers me when they put the general public at risk (or attempt to) for their own gain.
He measured it out to 18 extra hours per week. That's pretty achievable even with kids if your work week weighs in under 50 hours and you are judicious about your time management, but it does take a substantial amount of discipline.

I tend to fluctuate between spending zero hours a week to side stuff and 40 hours a week, in phases, and while I get pretty cool work done, it's hard to make money on an inconsistent pattern.
Blockchain-Based Machine Learning Marketplaces
In many places I worked, we had more trouble finding/retaining designers and people good with front design, CSS skills etc than server side. If she hasn't already decided to learn server side tech, maybe it is worth experimenting with design and see if she likes it?

I know of at least two women who got their start in tech career learning Tableau and basic DB skills and they went on to do other stuff from there. That might be an option too.
I think the fact that it looks like toy is a plus to YC.
https://blog.ycombinator.com/why-toys/

Great founders + (seemingly) toy/stupid/too hard ideas = how YC selects.
Test Finds Popular VPN Services Leaking Identifiable Information
Why is returning say the three top comments not RESTful?
This is actually perfect. Needed a super quick landing page creator and you nailed it. If you're going to make changes then recommend you develop an API for page creation, perhaps a Zapier integration. Otherwise good on you!
I had a look around for other people with this problem, and all the examples I found were caused by extentions. Ghostery just fixed theirs a few days ago, for example. https://bugzilla.mozilla.org/show_bug.cgi?id=1404468#c36
Small bug with the text field: https://imgur.com/N7SVdMp
But beyond a certain point slowing the trains gains little safety but (eg) pushes people back to the road where (in the UK for example) we spend 10x less to save a life than on the trains.

Thus, overcaution on the trains will kill more people.
Repl.it 1.0: IDE that Grows from Playgrounds to Fullstack Apps
Would it make sense to have retailers that cater to these heavy returners? Charge them a subscription and give them a monthly box they can return items in, allow partial refunds with a well described contract, and generally work with their use cases?
Not to be overly nit-picky, you obviously know ASEL referencing the Cirrus but maybe I can add a little more of my own experience. I own a Cirrus SR20, and I'm lucky at cruise to get more than 12-14mpg running 8.5gph lean of peak at altitude. I just recently flew a NA SR22 up to Philadelphia from Tampa and averaged about 12mpg. You might hit those numbers you mentioned in a turbo at flight levels, but not low, and certainly without a tailwind.

The operating costs for my SR20 with all things taken into account: Oil, Hangar Costs, annual inspection and averaged annual repairs, engine overhaul allowance are close to being conservative $160/hr fuel included vs. about $70 about it being fuel alone. From my calculations, if I went with a NA SR22, I'd be closer to $200/hr for a non-turbo, and about $260 for a SR22T.

Keep in mind, those hourly costs don't take into account the capital costs, depreciation and other training expenses required to operate the vehicle.

It's hard to compare costs of a vehicle to an aircraft. To drive to the airport, pre-flight the plane.. file a flight plan and deal with being re-routed the terminal area trying to get into a busy airport often undermine the time savings of just driving, unless i'm flying out of the state. I don't fly because it's convenient or faster. I do it because the feeling of watching the earth drift away from you when the plane is leaving the runway never gets old. I love flying. :)
Does this enable auditing of the psp, or replacing the sw with trusted code?
TL;DR click bait. The author is replacing Redux with Apollo - a client side graphql library that HAS BUILT IN STATE MANAGEMENT, which he fails to differentiate or mention... Apollo is similar to the firebase event / subscription model.

https://dev-blog.apollodata.com/tutorial-graphql-subscriptio...
Since Singapore came into existence in 1965, I'm not sure any countries relationships to Singapore are very longstanding (well, maybe Malaysia's).
#100DaysOfExam – A challenge to stay focused and pass
>much of its value exists on Facebook

This depends on how you define value. If you're talking about advertising revenue, then yes (and bizarrely other services let you authenticate through them, which I still don't understand). But if you're talking about the exchange of practical information, then Facebook's pretty meager and sites with technical documentation or Q&A are much better (for software developers, anyway).

I don't believe network effect is one-size-fits-all. Facebook is fine for keeping up with casual acquaintances. But if you want to find a local group with shared interests, then you may have better luck on Meetup. Or if you want to share Q&A with other developers, Stack Overflow is probably better. Each one has its own domain within which it's king.
One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA.

i.e. lets say your internal network DNS domain is 'my-company-lan.com' - all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's automatically trusted by all platforms and browsers[2]. For some companies that's going to be a BIG cost and resources saving.

--

[1] but not actually used for any public facing services.

[2] Mostly...
>On a side note, I once melted the face off of a GI Joe with a magnifying glass, burying him in a shallow grave in the backyard in an attempt to conceal the crime. That GI Joe, I presume, is now rolling over in his grave.

Oh yeah? I used to destroy those cheap green "armymen" with firecrackers and sometimes gasoline.

With respect to military culture, its rigidity is all over the map, and mostly depends on the nature of the unit's mission.
Could you elaborate on that a bit? There's no one looking at your data in real time.

I'll make sure we review the privacy policy once again - you've been bringing up some extremely useful points, so thank you so much!
Relevant Mozilla and Chromium bugs:

https://bugzilla.mozilla.org/show_bug.cgi?id=930638

https://bugzilla.mozilla.org/show_bug.cgi?id=1232961

https://code.google.com/p/chromium/issues/detail?id=104935
Nope, DV certs just verify that you control the domain (i.e you can place arbitrary content in a specific location). You don't need to own the domain otherwise SSL would be a lot harder for mysite.hostingcompany.com type providers.
What the gently caress does encrypting an HTTP connection have to do with morals or age? You are way outside the realm of making sense, man, and offer commentary that is openly harmful to securing the Internet. Please step back and revisit your woefully misinformed opinion on this.

Most people who advocate for security, including myself, have worked on small teams and understand the resources involved. Putting a TLS certificate on your shit with LE takes minutes. Doing it through another CA is minutes, in a lot of cases. You spent more time downloading, installing, and configuring Apache, then configuring whatever backend you want to run, and writing your product or blog post or whatever it is you’re complaining about securing.

Honestly, in the time you’ve been commenting here, you could have gotten TLS working on several sites. Managing TLS for an operations person is like knowing git for a software developer. It’s a basic skill and is not difficult. If it’s truly that difficult for your team, (a) God help you when someone hacks you, they probably already have and (b) there are services available that will front you with a TLS certificate in even less time than it takes to install one. Cloudflare and done.

> Security can be a roadblock to releasing valuable software on time and within budget.

Great, you've pinpointed it. Step two is washing it off. Ignoring security directly impacts value, and I'm mystified that you don't see this.

But I guess I'm a zealot ¯\_(ツ)_/¯
I thought about editing my response to add that neither of them were falsifiable. Is there anything in this universe that could falsify a multiverse theory?

They both seem so meta as to be faith based, but I don't know enough to state for sure, so I'm happy to be proven wrong :)

Edit: and can the theory explain where the multiverse comes from, or anything about it? To me, it seems like another way of trying to answer the question with more questions, but no way of discovering the answers. A sort of "God of the gaps" line of reasoning that just s/God/multiverse/ the entire thing.
Almost always these types of security incidents and breaches NEVER move stock prices negatively because frankly they don't impact business. $AMD is currently trading up 3.5% as of writing this. :-)
I wonder what she saw at Google that she didn’t like.
Allegedly
... And everything flagged and downvoted for asking a question.
Thanks for the support! Really appreciate that :)
The last bullet point of that section states: "The cardholder claims that the terms of the sale were misrepresented by the merchant".

It also states in their return policy disclosure section: "For card-present transactions, Visa will accept that proper disclosure has occurred before a transaction
is completed if the following (or similar) disclosure statements are legibly printed on the face of the
transaction receipt near the cardholder signature area or in an area easily seen by the cardholder"

I'd argue that unless the receipt also mentions Best Buy's use of a third party to potentially deny a return, they have failed to properly disclose their return policy, making a valid claim that Best Buy misrepresented their terms of sale.
The ICO paradox and how to fix it