skysight-inc/HackerNews huggingface dataset:
not intended to be a hostile ask here, but do you know any specific bugs to check out?

As a past (very minor) contributor to chromium+webkit I'm curious if there's anything one can do to help, but I haven't kept up with their status in a long time.
I'm a skateboarder, anarchist and software developer. I hate mainstream culture, conformists, "fitters". Hope skateboarding keeps this way forever and I'll carry that flag and do what I can to have it evolve in the other direction from the one that wants everything fitted nicely along with the rest of societys rotten mess. Fuck that. :)

ps.: I mean, instead of "keep it this way", I'd actually prefer much more "counter" and always a bigger "culture", you need to grow with quality, right?
I remember always being tempted to write these kinds of introductions in my high school English classes. Nobody bothered to tell me it was wrong until a college writing class. I think some teachers even thought it was good.
That’s a pretty weak argument and it’s on a site devoted to getting you to sign up with a “Lyme Literate MD”, which by strange coincidence includes the guy writing the page.

I’m more convinced that there’s a conflict of interest there than anything else.

AFAICT, the CDC position is the usual conservative scientific process: “chronic Lyme” isn’t a recognized diagnosis, the proposed treatments aren’t clinically proven, and there are significant risks: https://www.cdc.gov/mmwr/volumes/66/wr/mm6623a3.htm
Sounds cool, will check it out!
> Because bots scan emails and they are mostly in clear text.

If the password reset email goes through the same route then this doesn't matter.

It's essentially a 'password reset' with every login.
And because they are short lived you'd expect that if they had been used already that there would be no re-use possible, which would mean the attacker would have to be super fast and the victim would immediately know they were under attack.
Location:Tacoma, WA

Remote: Sure!

Willing to relocate: No

Technologies: lua, python, perl, kvm, hyper-v, linux, windows, ansible, and formerly c/c++. Poking at rust and godot in the free time.

Résumé/CV: Short time game developer into technical support into datacenter sysadmin in a mixed environment. Run a homelab for practice and providing servers for friends.

My history has put me at every angle of computer and software from development, deployment, and how best intentions actually end up with end users. I do a lot of investigating and untangling inherited networks that use all sorts of well aged technologies. Additionally I am the premier source of debugging the magical perl scripts written by folks who don't share a common language that do something but nobody knows what.

I love every part of what I have done but wouldn't mind moving to new frontiers such as hardware. Prosthetics have always been a keen interest of mine and would love to break into that world somehow.

Email:jordan [at] burrous.net
So with security in mind, when I run this:

docker run --runtime=runsc hello-world

Is there any way to remove default runc docker runtime, or to make sure that it is actually running gVisior?
And let's not forget that thunderbird ui itself is rendered using gecko.
"105 bits" isn't too shabby.

I'd only start to worry when it gets to say 70 bits or less. That's the kind of size a state actor could precompute ssh host keys for each of the initial random number states in a common distro for example.

If a state actor could compute ssh keys in 50 milliseconds on custom hardware, and they had 100,000 machines generating those keys, they could generate enough keys to have a 1 in 1 million chance for 70 bits of entropy after 20 years.
On a related note, any email that’s “pure HTML” or mostly HTML is something I don’t even open, mainly because such emails tend to be of the marketing and tracking kind, where viewing it would send various signals to the sender. If anyone has something important for me to read, they better put it in plain text.
Noodles and savings
Unfortunately I wasn't really able to test this out as there are no users in my area, but I was wondering how you are tackling / plan to tackle the following problem:

Suppose two people are almost but not quite 1km away from each other and are having a conversation on there. To a third person who has one of these people in range, but not the other, the messages might seem quite confusing and/or they might feel addressed even though they are not.

A possible solution might be to define fixed cells of roughly 1km in diameter instead of using immediate neighbourhoods centered around every participant.
Or you could dynamically create rooms and you are added to the closest one to you (up to some maximum size)? The latter might also help with getting any users at all in less densely populated areas.
Does anybody know how this is related with chromeos project Crostini? It seems they are all related (GCP, Crostini,...) But they are not linked yet?
Or you use qt. Which is cross plateform, native, fast and open source.
AI is the new space race. Here’s what the biggest countries are doing
So like Jodel, Whisper, ...?
But for this it is probably good that the services do fingerprint us - so that we understand how well it can work. Otherwise we'd assume that cleaning cookies is enough and wouldn't know how well that tracking works, not only when services that we knowingly use are doing it, but also when some actual black hats do it.
How far is it from CloudABI ?
The Technical Debt Trap
Maybe it's not such a big deal if someone hacks your account on one 'inconsequential' site, but what if they do it across 10, 20 'inconsequential' sites?

You may not give much away on one site, but combine all that data across multiple sites, and maybe I can start building a profile on you, identify you, impersonate you, steal your identity, etc.
I'm not the author of the website, if that's what you're thinking.
Show HN: A Chrome extension to exclude Pinterest from Google search results
This looks interesting. One can see the two years of work that went into this. Is there a way to follow the development as a bystander? Something like a newsletter, blog, twitter or any other kind of feed?
I think parent's comment is telling people to store passwords in such a way that they won't be very useful if they are leaked.
Of course, I haven't put my focus on this yet, but it is on the todo list.
Already got the idea and published it.

Frankly the 1km radius is not a good idea, it will flood messages in crowded area, and display none in others.
The metering isn't based o he SNI header, so the second point doesn't apply. And since the frontier's domains are presumably using the CDN's DNS servers anyway, it's not an issue either.
Rust has more momentum and visibility -- and seems poised to have more uptake in startups and industry. Already several major companies use it -- https://www.rust-lang.org/en-US/friends.html

For Haskell, the best I've heard is Facebook for some custom dev tools and Standard Chartered. I'm sure there's more, but...
Windows 10 Manager 2.2.7 Crack Full Version
SEEKING WORK - Remote - Nottingham, UK

Hi I'm Robin, I am a true full-stack web developer with over 7 years experience, working at every level of modern web application stacks: frontend, backend, database, server, deployment. I am best used as a flexible, adaptable developer who can quickly get up to speed on new stacks and codebases. I love working remotely.

I take care over what I do, writing good quality code backed up with automated tests, and documentation where relevant. I am an excellent communicator, I build my own apps in my spare time and also maintain a regular blog: https://rsmith.io/blog.

Technologies: React, Angular 1.x, Ruby on Rails, Javascript, Python 2 & 3, Ruby, Typescript, HTML/CSS/SASS, MySQL, Postgres, AWS, Heroku

Résumé/CV: https://rsmith.io/cv

Email: robin@rsmith.io
I’m amazed that we still have people being bitten by exact floating point comparisons in 2018 really. Nobody working with floating point numbers should be surprised by the behaviour in the post. This article [0] is over 6 years old and is a follow up from I don’t know when, talking about this exact subject.

[0] https://randomascii.wordpress.com/2012/02/25/comparing-float...
At the daemon level set "--default-runtime"
Location: Nottingham, UK

Remote: Yes

Willing to relocate: No

Technologies: React, Angular 1.x, Ruby on Rails, Javascript, Python 2 & 3, Ruby, Typescript, HTML/CSS/SASS, MySQL, Postgres, AWS, Heroku

Résumé/CV: https://rsmith.io/cv

Email: robin@rsmith.io

Hi I'm Robin, I am a true full-stack web developer with over 7 years experience, working at every level of modern web application stacks: frontend, backend, database, server, deployment. I am best used as a flexible, adaptable developer who can quickly get up to speed on new stacks and codebases. I love working remotely.

I take care over what I do, writing good quality code backed up with automated tests, and documentation where relevant. I am an excellent communicator, I build my own apps in my spare time and also maintain a regular blog: https://rsmith.io/blog.
Thank you for your feedback! If you sign up for an invite, I'll let you know once something like this is up and running.
I'm on the lookout for a language that does a) not itself require a VM (can be properly compiled) or significant runtime, but b) can be hosted in a VM without too many leaky abstractions, and c) can interface well with other ABIs and VMs.

C++ comes close (e.g. with Windows Runtime and Objective-C++) but its memory model fails (b) and there are no type generators or such so you get a lot of glue code generation.

A small Lisp dialect could easily be hosted in any VM and it can be made to interface well with just about anything transparently (look at Racket's C bindings) but the dialects I've seen fail (a) and lack lifecycle hooks that would make building a C++0-like com_ptr<> type possible.
It's not intended to impress anybody. I write the result first, an unreadable lambda-calc expression, then I explain the making of in few lines easier to understand, IMHO, than what I could see elsewhere. Did I missed something in the explanations?
Thanks! I looked at your profile and checked out the pages you list - when i click the privacy in the footer of the home page i got a 404.

https://travelalpacamybags.com/privacy

btw, love the site design!
Yes that can be a solution. The plan was to create a way to connect with people within a small neighbourhood or campus or building. 1KM is a max. distance to cover this area. So I was not planning for this scenario at all :)
Be careful what you wish for...

https://en.wikipedia.org/wiki/The_Lottery
I hate how GDPR forces me to log additional data. Like now I should ask for a age, have detailed access logs and so on.

I have semi anonymized data that I can now either make fully anonymous or link it directly to a user.

Worst of all is however that the complexity of my app doubles easily when I Actually follow all the rules.
Yes agreed. But is a good distance to cover a small neighbourhood or campus.
Please don’t take this negatively. The “bus factor” here is 1. That’d be a concern for many users (especially ones who have used corporate email systems and have higher expectations on the longevity of a client). More so when combined with the other feedback I gave on having export options for the mail to standard formats.
> "Since gVisor is itself a user-space application, it will make some host system calls to support its operation, but much like a VMM, it will not allow the application to directly control the system calls it makes." [https://github.com/google/gvisor]

TLDR; This is a user-space process that hooks syscalls/ioctls made by your "containerised" applications.

(1) This is hardly a strong security model. Proper security cannot be guaranteed by simply hooking API calls in user-space alone.

(2) With this framework in mind, developers now need to worry about yet another layer of indirection. Assume <application> was tested to work on Ubuntu, that fact alone is not sufficient to assume it will keep running under gVisor.

(3) I would personally like to see more documentation/benchmarks regarding the performance impacts that come with using this.

(4) This is strongly coupled with internal Kernel implementations. It will not be easy to port and maintain this across different Kernels.

> "but much like a VMM, it will not allow the application to directly control the system calls it makes."

From user-space? hold my beer.
Are grids still a thing? I hardly had to use any for the last 2-3 years. I just have a `display: flex` and control the direction with media queries. Seems much more easy than learning a grid css file
Stephen Hawking's final academic paper has been published today
The dots on the plots tell an even more compelling story than the fitted lines.
Specifically the image bug, as another commenter linked to: http://seenaburns.com/debugging-electron-memory-usage/
We just launched this today. Though it is a bad idea to roll out globally for this idea. I did want to spread the word and then target area wise. Not sure if it is gonna work.
I haven't been involved in the skate scene for a quarter century, but I'm at least vaguely shocked that Adidas has a team. Does any part of skate culture reject "big business" nosing into a rather anti-establishment culture?
> In a science fiction novel I wrote

care to link it?
Clear Containers are a full HW virtualization with a full linux kernel - just tuned to start very fast.

(The OP even have figures to explain the differences e.g. at "Existing VM-based container technology")
That's the point, it'd be a never ending game of cat and mouse, resulting in them blocking thousands of Amazon IPs. You don't have to plaintext the text files either, you could require some kind of shared secret from the app or user login to prevent the censors from just pulling the file in plaintext.
This is not responsive when resizing the browser window in Safari...
My guess would be that they were thinking h <= SIZE_MAX / w, and added the most obvious logic to avoid a division by zero.
Tst: Ruby validations with schemas
Psychological manipulation vs instruments for killing

No win either way.
What's unacceptable? There's nothing insecure about sharing a certificate among multiple hostnames.

Also you can get a dedicated certificate on the free plan for $5/month.
Tst is a gem to validate objects against other objects or schemas(defined as a Hash). It abuses Ruby's hospitality and overuse the === operator.

I'm doing this as a learning project, but what do you think are the biggest problems of this approach?
Yeah the problem must be with Amazon, not that Mr Marlinspike refuses to allow federation of the signal protocol for no good reason whatsoever.
Please not. I don't want to use a 2FA for every crappy website with a login, nor do I have my phone with me all the time. (optional is fine of course)
It's not a client, when gmail changed it's TOS to use your messages, I wrote gpgmda. Found sup!? alot? notmuch.

https://github.com/jakeogh/gpgmda
Let's modify his analogy a bit then...

The thief that shoplifted $100 of goods from his store was identified, but flew back to Russia the next day.

Your alternative analogy would be considered kidnapping (as you say it is acceptable under the circumstances, but a jury might wind up deciding that).
Benefits of Augmented Reality for Business and 7 Fields for Its Use
Then it's even worse, because the picture you're trying to paint implies that it's either leave guerillas alone, or nuke the entire city.

A ban of a cloud service affects everything else that depends on it. The more popular a service, the more damage. That's the point of "collateral freedom".

(Note the name of the term. It's no accident. It comes from "collateral damage".)
I've played around a bit with CSS grid, and to me it seemed like it would just make this kind of grid frameworks unnecessary. Everything I see on that page are native CSS grid features.

After looking at the CSS, it seems entirely redundant. It's 36 lines, and only contains the basic grid setup you'd do by hand. Using CSS grid directly would not be hardly more difficult or verbose, and far more powerful than restricting yourself to the subset used in this.

What I also find strange is that this project still calculates the column width based on percentages, instead of the native support for fractions in CSS grid.
The threat and trust models are completely different.
It's not just about using a piece of software it's about using a piece of software that can lock or unlock your life because essentially every service you use today is tied to an email address.

>There is nothing wrong with running an email client made by an individual developer unless you have a particular reason to distrust that person.

It's not that i distrust that person but it's that I know how unlikely it is for a single person to be able to validate the security of their product especially when it comes to something as complex as a product with a DOM parser and a layout engine, nor do I think they would be able to maintain it up to date when new attacks and vulnerabilities are discovered even they do use something like electron since electron isn't simplicity safe and plenty of electron based software even fairly well maintained one lags well behind it's update cycle including when security patches are concerned.

>They have a proven track-record of security bugs for the past 20 years and longer.
They also have a proven track record of finding and fixing those bugs.

>I wouldn't use them as my main email provider security-wise and trust my current email provider way more than those companies. (Not because I think they are less secure, but because I think they are attacked more often.) But of course your mileage may differ, nothing to object to that.

There are potentially more secure providers but being attacked more often isn't a really good sole metric threat model unless you can effectively estimate resilience responsiveness and compare it to other options.

I used Hushmail as my primary email (still somewhat do) because it was fairly secure and had integrated PGP, I switched to Proton Mail now.
Companies could just pay a government organization to do the hacking for them, in a legitimate way.

In fact, it's a bit strange that law enforcement doesn't work that way. If my car is stolen, the police takes little to no action; but what if I could pay them to give the case more priority?
How Algolia Built Their Realtime Search as a Service
The Pain Hustlers
The adversary is going to shoot down all packets that don't have certain labels on them.

Refusing to put those labels on packets is not putting anyone in harm's way. It's a refusal to help them treat certain classes above others.
I completely agree. "Your password must be at least 10 character long, include 2 upper case, 2 lower case, 2 digits, 2 special characters, must be changed every 60 days and cannot be reused for the next 3 years"

G0Fuc4Y@urse!f

To me this is a sure way that people are gonna pick horrible and stupid passwords.
Also, if the victim's 'services' are being hacked (of which they do not host themselves), would it not be more akin to a thief breaking into a rented self-storage locker?

The castle doctrine would definitely not apply in that situation.
malloc(0) is implementation-defined: https://port70.net/~nsz/c/c11/n1570.html#7.22.3p1

One might, I suppose, decide that new_image will be exactly equivalent to the system malloc in this respect, in which case malloc(0) should be called when appropriate.
What if the person that takes over the account posts messages that arouse the interest of authorities? Your IP addresses and other info are associated with the account.
I don't understand how they're demonstrating a responsive grid framework with a non-responsive demo.
Unfortunately, OSs don't make it easy to use password managers, especially in mobile. A lot of my banking sites also defeat my password manager with bizarre UX like user name masking and multi step login screens.
Block the road, not nuke the city.

But if they were going to nuke the city? Fuck them, don't negotiate, it is absolutely not the fault of any group that is merely located somewhere inside the city.
There is a "--chown" flag on copy/add these days.
Indeed they are. CSS even has a `grid` layout style: https://css-tricks.com/snippets/css/complete-guide-grid/
Yes, and that can bring a sense of community to a place that doesn't already have one. But I'm unsure how many neighborhoods or campuses would both not already have some ways of communicating... yet still want to create one. Physical proximity removes communications barriers, so you are solving a problem that may not exist.
Anyone else having issues with playing in FireFox? Seems like a really cool project, looks like I might have to install it instead of using it in browser ... a bit disappointed :(
Bonobo and chimpanzee gestures overlap extensively in meaning
Does it cover the statistics that 86% of the password are from random websites, signup pages that don't need to be simple.
http://cis198-2016s.github.io/
In your strategy you only have three choices - put your own label, put someone else's label, or just give up. The labels are necessary for routing. If you put someone else's label on your packets, you're turning them into a potential target.
Please see OCP from the original movie Robocop.

So, if somebody "stole" your identity, and was able to drain your bank account and credit card, would you no longer be able to report that your car is stolen, since you lack the funds to do so?

Or, do you ask your family and friends to borrow money, so you can file a police report?
Cryptography ciphers: The complete list
you can find a map on this site https://ops.fhwa.dot.gov/freewaymgmt/ramp_metering/index.htm which shows where it has been implemented; Atlanta area where I am has an extensive amount of this and HOV systems, and express(toll) lanes.
It needs to be big enough so you can try and rationalise the morality of the DNS call cost (even being a few dollars, you're still being a bad actor in this scenario), a site known and well classified by traffic monitors that they won't get blocked on their own.

I guess also that hitting an Amazon domain means the logical recourse is to get AWS restrictions (such as we have here), rather than having an aggressive this party company outright trying to sue.
Absolutely. Generally, those rocking Nike, Adidas, even Supreme are not accepted by those who support skate specific shops and brands. But it's become a lifestyle thing. Somehow you see people like the Kardashians wearing Thrasher hoodies and someone like me, who grew up skating in the 90s, has to laugh a bit.
Bitcoin Cash Hardforks on May 15th. What Does It Mean for BCH Owners?
2 week report:
I haven't seen anything break.
>Widely displacing C is a pipe dream.

Displacing C for new projects though, it's not.

And it has increasingly done it for major projects from major companies (not just Mozilla).

This is already great for such a new language.
MakeBadge, free online badge maker
For the record -- OF COURSE he's a friend/loyal to Putin, because in the Russian state all of the oligarchs owe fealty to the leader.

Look to Mikhail Khodorkovsky to see what happens to those that aren't Putin's friends.
Top 7 Strange Things We Saw at RSAC 2018
I use keepass on all my computers and phones synced via Google drive. It's the only thing I'll use because self hosted. If Google drive stops being a thing then I'd just use my NAS. Haven't ever had an issue with it. I don't use it for security really, just convenience. I disable the clear clipboard option and I don't use a long encryption on the database file. It's very unorganized because I can't be bothered to clean it, so I have a good history essentially of old passwords. I also use it to store other stuff attached as notes or files.
Sue me, I have my keepass DB password in the clear in a txt that I just copy paste to unlock.