skysight-inc/HackerNews huggingface dataset:
Most likely only popular packages, forget about making `npm publish` a free security review (unless it runs custom eslint rules for stuff like Regex backtracking, etc.).

And probably only guarantee it for particular version.

And "guarantee" is probably too strong a word for it, unless there is a contract with some kind of liability attached.

Same for "security", from the wording of it, they promise notifying about vulnerabilities, not performing comprehensive audits.
CAA depends on CAs (all 650 of them) to respect it, and for all of them to implement everything perfectly (it was shown in 2017 that they don't). This also depends on DNS again, which again not everyone will do properly, so CAA requests from CAs can be hijacked. So CAA is stupid.

The client should be getting the list of authorized CAs for the domain from DNS on first connection, and/or from inside the first cert, with expiry dates. It should require that if there is a new CA, that its authorization be signed by a previous CA or cert. The client needs to verify the entire chain of authorized changes throughout history, rather than just believe any cert from any CA at any time. And there should probably be a certificate transparency pooled service which the client checks the first time they see a new chain or new root of a chain (or something, i'm making this up as I go). In the current case the domain owner may eventually figure out something's up, but the client may not, and changing BGP/revoking certs/etc are ineffective when the attack is already in play.

This is the only time you will ever see me say this, but we kind of need Blockchain here.
Mechanical keyboards. (Abandon all hope, ye who enter here.)
Good job! Is there a way to engage with other students after the class? Would be nice to ask follow up questions.
I’m not sure about that WeWork is considerably more expensive than running your own lease or even renting old school managed offices.

I did succeed because it had a lot of customers with a lot of money to burn (startups) and it offered very good networking opportunities, later on it offered top of the line real estate and services but they were never the economic option.

In a recession when there won’t be VC money to burn and an infinite amount of rounds to raise it I don’t think they’ll do very well.

Traditional businesses won’t get much value from most of their offerings and if they would be cutting back then cheap lease in industrial parks and sub prime locations would be what they’ll be after.
The new, fake cert just has to validate for your phish/drove-by/cred-jacking site that is mimicing a real site. You are not planning a long-term take-over but just to make sure the new site passes checks by your victims.
The yearning for fewer options for distraction is curious to me. I can understand the desire for fewer interruptions, but me choosing to kill a few minutes here and there playing Threes or Fire Emblem Heroes or perusing a Quora feed isn't the grand evil people seem to think it is.

After all, it's not like my brain just stops. Particularly when I play Threes, only a portion of my mental energy is devoted to playing the game, while the rest considers deeper musings. I consider it akin to music in that it 'patterns' my mental energy, reducing the total amount of chaos my mind has to deal with all by itself.

It's a shortcut to a meditative calm. Without the shortcuts I ultimately get less meditative focus and not more, like how you're more likely to exercise if you keep a pair of dumbbells handy.

If you're so mentally disorganized that phone apps destroy your peaceful calm rather than give you ways to create more of it, I'd suggest a daily 30 minute walk. It's my go-to solution for centering.
Microsoft and Discord Team Up to Connect Gamers
Here in Japan it’s a common setup to have a box you leave an unlocked lock on that the delivery person locks and you have the spare key for https://item.rakuten.co.jp/yasuize/zk-tb-0533-01/?iasid=07_1...
Perhaps consider having no visible gender queues. Maybe go so far as to also not show names. If the goal is truely for friends, does the gender and name matter?
That's not that useful. It's great for looking back in time to see the origins of the universe, but if you want to communicate with someone on a planet 100 light-years away, that's a 200-year round-trip latency. And telescopes will likely never be powerful enough to see, for instance, the actual inhabitants of another planet (we'd be lucky if we could see some gigantic Death Star-sized space station optically).
I implemented a power-loss circuit on a custom USB memory device (battery-backed LPDDR disks) and used something similar: the MAX40200[1].

[1]https://www.maximintegrated.com/en/products/analog/amplifier...
Step one: Hijack the DNS entries so they point at your site.

Step two: Obtain a certificate from Let's Encrypt using website validation.

Step three: Proxy traffic through a proxy you provide that SSL cert for and capture anything you like. In the event that a website legitimately has a higher-class Extended Validation cert or other such thing, hope users don't notice the downgrade from Extended Validation correct SSL cert to a merely correct SSL cert, which is a pretty solid hope.

Certs don't have any sort of overriding or superseding property. A given cert and its chain of signatures is either accepted because you trust the signers, or it isn't; at the time you are making that decision, you don't have access to know whether any other certs have been issued since then or anything.

One thing that comes to mind is that browsers really ought to scream if they see a domain that was previously Extendedly Verified drop down to a Let's Encrypt-level cert. Though how much good this would do in practice is hard to tell... "Hmmm, what's this about the SSL cert being less good? It still has one, right? Let's just click through this... hmm... looks like the web site I expected... must just be the computer being weird enters password"
Choosing a particular CA doesn't help, since attackers can pick whichever CA is optimal for their attack.
> contrary to my wishes I have the right to defend my person against that intrusion.

It's quite sickening how you phrase that. Intrusion? Defend? Unless you were raped, you did invite that person to "take residence inside you". People want to have their cake and eat it too. Absolutely no sense of responsibility.
Wow. Just wow. These BGP vulnerabilities are ridculous. Imagine, someone taking over DNS for even a small subset of people and being able to basically just rewrite the internet as they see fit, completely taking control of anything. Even without being able to get a valid SSL certificate you could do a lot of damage. For example, let's say I rewrote requests for SomeNationalBank.com to my proxy server. I make a request to the real SomeNationalBank.com with the weakest set of ciphers allowed, and then pass those bytes along to the client. Then I can try and decrypt it and log into your bank account as soon as I do.

OR better yet I wait for you to log into an unsecured site like neopets.com or something and then pair that unencrypted password wait the fact that I saw you request the domain for a certain bank and if your password is the same (which it is for most people) then that can also get me in.

We need a new more secure system to replace DNS.
I was excited as long as I assumed this would be E-Ink.
Not downplaying your choices but throwing this out there. Vim can and does all of that as well.

vim $DOCUMENTATION_URL (curls the page and opens in vim)

vim-rest-console

:terminal (new!..ish. Works great.)
> Coding Tests Can Trip Up Even Good Engineers

I recently took the first one ever in my career (in my late fifties). People tell me they think I'm an excellent programmer, but I did awfully bad. Why?

- it was my first time

- in daily life I switch between many languages, devops, meetings, and research. It always takes me some time to ramp up, especially on syntax: coming from Elixir, switching to Javascript: how does JS access object members again? I usually need an hour or two to get up to speed again.

- the tasks are very much outside the normal realm. If in real life I need to map some multi-dimension array, I first look for libraries and such, and if not, approach this as writing a library function: take my time to do it well.

Even though I could rationally understand the reasoning, it still felt demeaning, given my resume. Also, because I underperformed, it's easy for them to jump to the wrong conclusions.
Fujitsu showcases IOTA cryptocurrency as new automation standard
I have heard about these mythical people but never met one. Usually ten minutes of questions and you can see who is full of crap on their CV, but I have yet to meet someone who can't code at all.
A set of eight numbers
Route 53 DNS queries getting black-holed at a small ISP in Ohio: https://pbs.twimg.com/media/Dbka0oAVMAAFEXx.jpg
Nationalistic flamewars, which this crosses into, are definitely not ok on HN. Please don't post like this again, and avoid unsubstantive comments on divisive topics generally. This is in the site guidelines: https://news.ycombinator.com/newsguidelines.html
As an aside: the abandonment rate for 'normal' prosthetics is about 35% to 45% :

https://www.ncbi.nlm.nih.gov/pubmed/17979010
I bought a 500GB 960 EVO on sale for $200 last week. Now I know why it was on sale.
Check out https://github.com/schn4ck/schnack as well!
Sure - my point is that asking them to solve a problem on their own that you already know the answer to isn't a realistic environment of "playing nicely" either and is only going to show you how they deal under pressure, not how well they collaborate with somebody who genuinely wants to find the answer and can build off of.

If you need proof they can "actually code" and use DS/algos etc, use their GH if it exists. And if you want to see that they can work on a team to define and deliver a messy problem with other people, do that with them on a messy problem you've never solved before. (It could eventually be a DS/algo problem; my point is it's a group effort and neither of you knows the solution; you're looking explicitly for how the interaction goes, not if "the candidate" got the "right" answer.)
So what happens when you have "power-loss capacitors"? Since these things are limited the drive races to empty its buffers onto the SSD and then shuts down. It does not ask the host "are you done writing", so now instead you lose whatever the host had in its buffers. The host is gone anyway when the drive loses power.

No. Data loss protection needs to be built into the software itself, fixing that on the SSD level doesn't make a lot of sense. If anything, you install a UPS, and then of course you don't need to pay extra for SSD capacitors because the whole system keeps running through power loss and shuts down gracefully.
I personally prefer CC0-1.0 for software licenses.

> Do I need to do anything to ensure that I won't ever get "locked out" of my own work?

Yes, you must maintain positive control over your application and all its trademarks. Sometimes people can feel emotional or involved with an application, particularly if they believe they cannot live without it. As the owner you dictate the direction of the application. This will mean telling people no. When people get sad because they cannot have something they want from your application they have four choices:

* fork your application and maintain it on their own

* abandon the software

* shut up and take it

* do the requested work on the desired feature and write a pull request

Never, ever, let other people dictate the direction or terms of your software or your time.
I constantly hear people saying we're going to make ourselves extinct, but have you ever stopped to think about how hard that is?

We're the most adaptable species ever to live on this planet . There are 8 billion of us on every continent except Antarctica, and we've found ways to codify and share our collective knowledge.

Climate disasters, widespread thermonuclear wars, etc would be horrifying and would likely kill a great many or even a majority of humans. But even that wouldn't do much more than slow us down a few hundred years.

Even an a massive impact from space on the scale of the Chicxulub impact would kill off most people, and collapse civilization - but we'd rise again in less than a thousand years.

It's very hard to think of a scenario that would actually end us. One thing I've speculated about is maybe we unlock some awful power that we can't control. For example, if it were easy for anybody to distill antimatter in their garage in large quantities. Because there are always going to be those among us who want to burn it all down and who would destroy everything if they could. In a hypothetical world where terrorists and rampagers attacked with kilograms of antimatter, that might make it difficult to maintain a level of civilization for long periods of time.
> It's one think to say "we can self regulate"

Safe harbor isn't about self-regulation (in fact, it specifically is about relieving intermediaries of the need to do that), it's about content c
rules being directed at contract providers, not intermediaries; removal of safe harbor forces, rather than abandons the idea of, self-policing by intermediaries, which is rather the point: to get intermediaries to censor content on the threat of exposing them to public and private liabilities if they do not.
We used this a few years ago for MySQL Cluster automated installation, management and control. It is still the only really good product out there for NDB.
I haven't read the book in years, but from my recollection, there were three girls given the Primer; the narrator of the primer was a cloud-provided mocap/voice actor, running from an AI generated script.

For one of the girls, a single actress performed the majority of it, for the another it was whomever was available, the third would be a bit of a spoiler, so I won't say here. This was pointed to as one of the differences, with the single "tutor" being superior (their socio-economic statuses were far different as well).

It is true in the book that scaling it for the masses required pure-CG and was considered significantly inferior. Personalized instruction by an expert in the field has always been the realm of the privileged, so it's not necessarily a fault of a technology that it doesn't change this.
Patents have reached the level of stupidity.

For example, the recent patent granted to Samsung, to use an emoji-like representation of your face.

https://www.androidauthority.com/samsung-ar-emoji-video-call...

I had the exact same idea for this, but I thought it was just a cute little feature. I didn't think to patent this. And I'm sure thousands of other people had the same idea too.

But since Samsung was the first to patent it, now, if you make a little program that uses this same idea too, then you are liable for patent infringement. And you will be sued by Samsung.

Patents were originally devised as a means to protect the small players, from being dominated by the larger and richer players. In the 1700s to 1900s, the American patent system may have had the original idea to protect their small inventors, against the richer inventors in Europe. This was to help give them a fighting chance.

But today, with all the patents being filed by the large and dominant Fortune 500 companies, the purpose of the patent protections to help the smaller players, are now largely irrelevant.

Nowadays, the purpose of patents is for nationalism, to protect against other countries.

The other egregious patent that was granted, was the Swipe Left and Swipe Right, that was granted to Tinder.
Some cars have the opposite - a valet key that allows access to anything BUT the trunk
> if you feel like you will never get a fair cut of wealth in the current fiat economy, well, start a whole new economy where you hold all the tokens.

wait, so crypto is the foundation of the failboy economy? Clean your room and hodl? I... I understand everything now. ascends into the clouds in a blaze of enlightenment
The real problem is everyone looks like an imposter until you watch them code.
Forgive my ignorance but I have a few questions:

* Why would HSTS help in this case? While HSTS is active, does it prevent clicking through the warning (which was done here)?

* How would a CAA record help against cert issuance in this case? Is it only helping against compromise of the authoritative during the remaining TTL of the record in recursives AND if the CAA record points to something that doesn't have on-demand DV like Lets Encrypt?
Case study: Network bottlenecks on a Linux server: Part 2– The Kernel
> So it is misleading to say it is secure and that security is built in.

Well, it is a PR blogpost with literally that goal of wording most basic and boring things in a way that sounds maximally sensational and groundbreaking without becoming a lie.

Example: see how they comment on performance improvement. Instead of "compared to previous major relase, npm 5" it says "compared to 1 year ago".
Check out IPFS' DNS alternative -- IPNS. No blockchain needed, it's pretty solid.
Fintech Startup Reach Raises $3.5M
> Young thought leaders with no needs besides occasional hunger or thirst are welcome!

> We help children start businesses. Learning facilitators provide laptops, whiteboards, business plan templates, Post-Its, and early access to an entrepreneur’s despair.

They forgot to say they're taking 20% equity in the child!
I'm over 50 (55) like the author of the article. As it is often said over and over again, the best way to find a job/gig is networking. That's how I found my current job. Having people on the inside pulling for you cuts though the BS. It took about a week for me last time.
Maybe but I once had an interview in which I was asked how to find how similar two text strings were (for search). I answered that I would use one of the algorithms from Apache commons text or within Lucerne which implement one or several of the appropriate distance algorithms. He told me he had written his own. I asked why he would do that when these algorithms were written by people who did intense research and the implementations in these libraries have been tested by more eyes than his could ever be. He said “what if I want it to run in Ruby?”...I was interviewing but this is a guy I would not hire. He was wasting time for his own amusement. Never assume people know to do the research on existing solutions. Many developers would rather work on their own toy solutions while avoiding the actual unsolved problems in their domain
That isnt the issue. Its that I need my phone on, and Im getting slammed with notifications.
I think you need to be realistic about what "early retirement" means. To a lot of people this just means spending their time not at a desk job. Instead they spend their time making money (maybe less money but still some) in different ways. Ways they find more pleasurable. If that's the case you don't need to save all the money you'll ever need for the rest of your life by the time you're 50 because you're not spending your remaining 50 years doing literally nothing.
This is another one of the articles that says absolutely nothing.

The only reason why such attack was possible is because some of the providers did not filter announcements from hobos claiming to be able to advertise AWS space. That could have only happened if:

a) AWS did not register all their policy prefixes

b) providers did not apply filters on the transit announcements from those that announced AWS prefixes based on the policies registered by AWS.

This is a modern day "let residential IPs to send data directly to tcp/25 and not check".
Gender Pay Gap? Maybe Not in the Corner Office, a Study S
The only thing I've found to help with this sales funnel is... to know a lot of people, and to invest time in networking. It sucks because in a meritocratic system it shouldn't work this way, but it does.

I'm neck deep in my job search, and I'm getting to the HR interview at rates around 30-40%, but that's because I'm getting to the HR interview at rates near 90% where I was able to get someone to refer me or send my resume straight to the hiring manager. For non-referrals, I'm seeing closer to 100->10-15.

I think that's just insane.
I think you'll be lucky to have the kind of problems you're worried about. A lot of open source projects have one developer and no users. (Which is fine, we all have itches to scratch.) Definitely pick a license. Permissive if adoption (particularly commercial) is more important to you than reciprocity, copyleft otherwise.

The other thing to remember, if your work is any good, is that you have a big head start on doing whatever it is you're doing that makes your engine better than others, and you probably have even better ideas in the pipe. Open-sourcing this project is an expression of confidence in your own ability to come up with something better in the unlikely event that worse comes to worst and the project somehow gets hijacked.

One word of warning -- there are probably more open source game engines out there than anything else, including actual open-source games. Your project has a lot of competition and may not gather a lot of attention unless you work hard to sell it.
Summary:

1. Spouses of certain H1-B holders were allowed to work, without restrictions

2. The restriction part is worth talking about. H1-B ties you to an employer, the H4-EAD doesn't. Along with that comes portability, and freedom - things that should not affect wage depreciation.

So - the proposal is to take away work privileges from honest, legal, tax paying individuals that (in theory) do not contribute to wage depreciation. At a time when social services are stretched, and with record low-unemployment, this seems like a bad idea for America, and lost tax wages for the government
Only if the tenant leaved. If leaving loses the rent-control, the tenant will stay. The price is well below market rate, then they wouldnt even get roomates, harming the entire rental market on both ends: by removing profits from the owner and decreasing supply.

If rent-control didn't have the restriction, then it wouldnt make a dent into rent prices, but it would clearly show that it is a mere transfer from the owner to the rent-controllee.
Story time!

I've failed a FizzBuzz.

While failing interviews is basically my superpower, I think my git repositories, college graders, previous and subsequent employers, coworkers and clients might be somewhat shocked to learn that all that code was written by a guy who "couldn't code" at all.

(The autograders and CI accepting all that non-code must have been exceptionally buggy.)

But still, I failed the test. I told a friend who'd had the slot a couple hours after mine; she thought I was joking. It's FizzBuzz!

I'd seen it before. I knew what it was. The guy had changed the strings and added a factor, but who cares. I could write it in my sleep.

Just not in the form of a puddle of goo, which is pretty much the form I took in this interview. My functional IQ was roughly on par with that of my socks.

I could tell you why it happened, but it doesn't really matter. Now that interviewer had a story of the time a guy with FAANG on his resume (whose name alone had gotten me the interview) was totally incompetent.

These comments are full of those stories, mostly being used to show the test is fine and everybody sucks.
I can't talk to you about my team's current problems, and neither should anyone else. If I do and you offer up a solution I'm in real trouble ... because that's a lawsuit waiting to happen.

Try to remember, this is the country where a range check function resulted in a lawsuit:

private static void rangeCheck(int arrayLen, int fromIndex, int toIndex {
if (fromIndex > toIndex)
throw new IllegalArgumentException("fromIndex(" + fromIndex +
") > toIndex(" + toIndex+")");
if (fromIndex < 0)
throw new ArrayIndexOutOfBoundsException(fromIndex);
if (toIndex > arrayLen)
throw new ArrayIndexOutOfBoundsException(toIndex);
}
It's good to see them using containers.
Amazon Key In-Car delivers packages right to your car's trunk
Back End Software Engineer (Senior, Golang)