skysight-inc/HackerNews huggingface dataset:
Stuxnet was able to be reverse engineered successfully so that we can know these things.

IIRC, its sequel actually used certain directory listings (registry keys or filesystem) of a target system as input to a KDF that is used to generate an AES key that is used to decrypt the next stage payload. That is, if you don’t have the exact specific system configuration that is being targeted (program names, versions, et c) then the primary function of the worm remains entirely opaque.
There's a proportionality requirement written into the GDPR. The commenter I was replying to is making a completely specious argument.

https://gdpr-info.eu/art-83-gdpr/
> If a completely foreign entity that offers a Spanish or French translation of its service could potentially be covered by GDPR, even if they're not marketing to EU markets specifically.

No, the GDPR is clear that it is applicable if you are offering goods or services to Europeans. The fact you are speaking French in Quebec isn't relevant.

> Or what if you fly to speak at a conference in Europe – is that "marketing" to residents of EU? Depends on your slides? Or not? Who knows.

So, if you fly to the European conference and talk to a Europeam audience, you're not going to be covered by the GDPR until you actually supply goods or services within the EU.
You may find that enduring years of frequent unpredictable debilitating skull pain that lasts for unpredictable amounts of time, causes hours of intense vomiting progressing to dry heaving, and is frequently dismissed by others because the pain isn't visible enough to be seen as a "legitimate excuse"... tends to help other parts of your life become disorganized.
I'm a EU citizen and proud of EU actually, something I don't feel very often btw, for being in the forefront in law-making that protects the privacy of individuals.

My vocabulary has been enriched with a new word: PII. I like it. It simplifies when thinking about GDPR. I expect one or two years from now I'll know the important parts of GDPR like the back of my hand.

But right now every person in the world running a multinational company needs to understand a new piece of legislature that threatens 4% of their annual revenue. You have better things to do and so I understand everyone's anger.

But is it wrong to force business-runners to learn about GDPR, stuff that's pretty close to human rights, like "don't track any of my PII without telling me exactly what you plan to do with it"? Is it wrong to now have to learn this, as a web/app developer?

I'm sooooo sick of being tracked. It has definitely made me exit the social media world all together, six months ago. Even though it is detrimental to my career I even asked Linkedin to erase my data. I truly hope my career isn't screwed just because I refused to give Microsoft a detailed description of 30% of my person, my whole work life that they can connect to an email address (some people even give them their phone number), IP, tracking cookie, thus a Facebook profile, real or shadow, thus to the most detailed graph of PII there is, probably in the whole universe. Hopefully in the whole universe otherwise civilizations on other planets took a wrong step somewhere.

I hope GDPR leads to PII being treated as gold by the market because it's so rare. Because isnt' it better to skip all this tracking-business that having to deal withstuff like GDPR?

No cookies for me please. Ans I'm also sick of having to run javascript.
This is new to me, and it took me a while to see the point, but having read the Mozilla docs (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...) I can see a few use cool examples of validation and input correction. That said- all of these things _seem_ to be fairly trivial to achieve without proxies, so I am wondering- what is the killer use-case that you absolutely positively need js proxies for?
Tools not rules!

Use hooks to check quality automatically on your repos and/or CI server. Change the environment so a developer can't push code unless linting and tests pass. If you configure the remote to use receive.denyNonFastForwards they won't even be able to use --force. Then add linting rules so you have to comment things (eg https://eslint.org/docs/rules/valid-jsdoc). It won't enforce quality, but that comes later once people habitually know to write comments.

Expect a lot of resistance to this sort of solution though.
Hawaii's Kilauea Volcano Erupts Sending Plume of Ash 30,000 Ft into Air
How is this relevant to GDPR?
How to become a forex trading expert using profitable Fibonacci indicator?
EBS probably has really terrible tail latencies.
Also, lightning network needs to be taken into consideration. But does anyone have exact stats for that?
Interesting. So perhaps a non-profit could start a grass-roots crowdaction campaign for all researchers in a field to switch to open-access overnight, and use US contract law to enforce compliance (in the US) if the threshold is reached?

There could be some penalty that researchers agree to pay if they renege on the agreement, and that penalty could be contractual. The non-profit could collect donations for marketing, and enforce the transition through legal action (if needed). Any proceeds could go to funding the next research field's crowdaction.
The document you link to has this interesting statement:

> The law protects personal data regardless of the technology used for processing that data – it’s technology neutral and applies to both automated and manual processing, provided the data is organised in accordance with pre-defined criteria (for example alphabetical order). It also doesn’t matter how the data is stored – in an IT system, through video surveillance, or on paper; in all cases, personal data is subject to the protection requirements set out in the GDPR.

That raises an amusing question. Suppose you have a one person business with a small number of customers (a few dozen or so) that you deal with in person. With proper mnemonic techniques it would be possible to do all the storage and processing of their personal data in your head.

Does GDPR apply?

The only thing I see in the quoted paragraph that might suggest it does not is "provided the data is organised in accordance with pre-defined criteria (for example alphabetical order)". Do brains use pre-defined criteria to organize data?

This too raises an interesting question:

> Personal data that has been rendered anonymous in such a way that the individual is not or no longer identifiable is no longer considered personal data. For data to be truly anonymised, the anonymisation must be irreversible.

If data is used to train a neural net and then discarded, but you keep the trained neural net, in some sense the data is still there in the weights of the connections in the neural net. Has it been sufficiently rendered anonymous to no longer be considered personal data?
Online-Fraud – How to identify and avoid dangers
It seems obvious to me. Want to illegally snoop on someone’s iMessages? Don’t compromise Tim Cook’s plausible deniability, just get an asset to climb the ladder until they can touch the systems that send the list of keys to the target device. Same goes for signing malware binaries for evil maid against iOS devices, chromebooks, et c. There are controls you can put in place as an organization to make this harder, but not impossible; eventually human beings are going to be handling keys and senior management isn’t always going to be in the room to make sure NSLs aren’t being handed out.

“Keep this quiet or go to the same jail in which Manning was tortured basically to death” is a pretty persuasive argument.

The fact that Google was asleep at the wheel so long wrt encryption of internal network WAN links (I mean, wikipedia has an article about the double-hull sub that the navy uses to tap intercontinental fibers) suggests to me that most Googlers (and despite organizational differences, also most Apple and FB and Amazon staff (outside of govcloud)) simply aren’t thinking about the illegal lengths to which the military will go to obtain huge amounts of information about possible threats to their safety, security, or persistence methods (e.g. whistleblowers).

It’s like the industrial rank and file never read the military-industrial complex speech, even while hearing their bosses take off from Moffet using taxpayer jet fuel. [1]

[1] https://www.wsj.com/articles/google-jet-fleet-loses-a-nasa-f...
I do agree with the sentiment that web page speed matters in most cases. However this article provides little insight into how important page load time is, why it is important, or what you can do about it.

Instead of this one example of a very basic solution to this very specific site's problem, I would prefer to see perhaps a list of common problems and how to deal with them. "Lastly, I changed a few configuration settings to improve transfer of data by the server." what configuration settings, and how do they improve the "transfer of data"?

Perhaps also an introduction to when optimising for fast load time makes sense, and some more statistics, instead of (paraphrasing) "it makes economical sense for two of the largest companies on earth, so I guess it's important".

Also why are they debugging asset requests using webpagetest.org instead of devtools?
Would it have been easier or harder to implement Stuxnet if the target networks were running some sort of linux? Or if it would've been a mac-only facility?

I'm curious.
TLDR; a team of state-sponsored developers & engineers with access to a huge list of vulnerabilities across windows, drivers and industrial equipment designed a worm to malfunction centrifuges used in uranium enriching with multiple hops of infection and stealth mode of operation.

Don't get me wrong, but "sophisticated" doesn't exactly mean obscure and stealth which is what stuxnet worm is all about. With access to all those vulnerabilities, i would call the worm implementation straighforward & stealth rather than sophisticated. Most likely the engineers didn't have much choice than to proceed in one possible way to be able to make it work. If one of the vulnerabilities didn't then stux.net wouldn't exist.
There is probably a large number of consultants who make money out of getting "GDPR ready" etc. and in whose interest it is to maximize the fear.
I got a mail from a sports club I'm pretty sure I've never visited asking me to please reply to remain subscribed. That was weird, wonder if I visited their stadium once for a concert or if someone just misstyped their mail.
Os principais riscos do procedimento estético lipocavitação
Privacy Shield starts at $500 per year for the smallest company, and that’s before you contract with a mediator (lowest cost there is $50/year if you use the EU options). Unless I’m missing the option for $250/year on their website?
Why have you isolated one element from a multiple element sentence:

If

* core activities
* require
* large scale
* regular
* systematic

If you tick all those other boxes, but are concerned that your processing may be teetering on the boundary of 'large scale', I would be cautious and assume your liable.
Yes and there's nothing saying I won't be arrested and thrown into a cell for the rest of my life if I say something incorrect by mistake when entering the US.

There's nothing that says IRS won't prosecute you if someone buys you a soda and you don't declare it as income.

Or that you won't be prosecuted by someone in the US if your blog has a copyrighted image and you don't receive a DMCA request that was sent to you.

See how ridiculous that sounds?

All fines can be administratively and judicially appealed.
I suspect you’re going to get the predictable response here that you should do the most conservative things possible, and if that tanks your optin rates and email list and ultimately your business, then obviously you’re a filthy scammer and your business deserved to die.

The lead magnet thing is such a good example. It’s a clear and voluntary trade-off: you can have this free resource if you join my list, from which you can unsubscribe at any point. It can obviously be done in a scammy way, but you’re clearly not doing that. But some people think you should have to provide that resource without any restriction.

Or that forcing people who already opted in to do so again is fair, because if they don’t reconfirm, then they must not have wanted to be on the list. This is like a SaaS company calling every customer periodically to ask them if they might want to cancel.

It makes no sense, but the pro-GDPR crowd on HN in particular is very hostile to marketing in general and email marketing in particular.

No one here who likes the GDPR gives a shit about your business. They’ll be happy to give you bad advice based on how they wish the world was, and if it costs you dearly, that’s not their problem and you probably deserved it anyway.

I’m doing some of the same activities as you, and I personally will be changing basically nothing for GDPR. I’ve always treated customers fairly and I’ll continue to do so. Governments that have no jurisdiction or enforcement mechanisms against my company can pound sand.
As a user of GNU screen, I feel pretty much the same way about this new feature. I feel When developing a new script (Bash, Python, etc.), I often just run something like `w | !python3 %` in command-line mode. I could be wrong (probably am) but I got the impression that the primary motivation for adding this feature was to play catch-up with NeoVim – similar to how asynchronous I/O support was one of the main new features included with Vim 8.

As a sysadmin, I’m not particularly attracted to the “shiny” stuff so I find it interesting to see the directions that the large developer user-base is influencing Vim towards. Also, as a donor to the ICCF, I can vote on new features, so I should probably take a look at the possible options and vote on something that’s more relevant to my own use of Vim.
The link does not work
I mean, in C++ "=" could be called "dangerouslySetAribtraryMemoryLocation" and it would be just as accurate. In native code, even trivial operations like concatenating two strings or setting a variable can cause arbitrary code to execute.
I was wondering if that was a joke, for added emphasis, or a mistake.
The respect comes with the single-mindedness of this code's approach. You would think the people doing this would have at least a little bit of The Joker in them - if they saw an opportunity to cause chaos for chaos' sake they tend to take it. Whoever did this - didn't. That is impressive focus.
Not outside the US, so I won't be so confident for non english data.
I remember Faggin (of microprocessor fame) dabbling with the idea of creating an all-FPGA ’hypercomputer’ back in the late 1990s, and even going as far as launching a start-up called Starbridge Systems. Nothing much came of it then, but here’s a WIRED period piece with all the de rigeur gushing optimism of the era.

https://www.wired.com/1999/02/the-super-duper-hypercomputer/
I am no developer but like to toy around, build small tools and automate stuff. So i often can't wrap my head around programming stuff promoted on HN (also i simply can't wrap my head around rust since i never really learned programming from the ground up...).

But stuff like this, some Binding Generator really amazes me and i am also able to understand the code. Had the same feeling when i was working on some REST API Binding in Elixir, and was looking at other Repos and found a generated Slack Package. Out-of-the-box solutions like this are great (myself would start to write every function by hand and probably stop half through and try something else...). Thank you for making something like this open source so beginners like myself can take a look :)
Art.7(3): "The data subject shall have the right to withdraw his or her consent at any time."

https://gdpr-info.eu/art-7-gdpr/
Do you ever use IV diphenhydramine in the ER when people present with migraine? Last couple times I hit the 48-hour mark and had to go in, I was surprised to get an IV full of Benadryl along with the pain killers.
I think that specific definition was more meant towards "relying on an authority figure or other third party to resolve the conflict without ruining the life of either".

I don't think the author wanted to cover vigilante behaviour under that.
Since when? I work at a games studio, you couldn't imagine more dorky people than those who work here, and yet there's several serious petrolheads here, we go to car meets, one dude rents a barn to keep all of his rare US-imports and to work on them in his spare time.....

I don't understand(and rather dislike) the notion that if you are a nerd/into computers, you have to automatically dislike cars.
The problem with that is that it would introduce a minimum fine, where currently there doesn't need to be a fine at all (if you coöperate).
They mentioned they were Tawainese comapanies. I’d bet it was stolen rather than passed to them by some insider.
You can use them to call some functions when an object property is called or set. P.S. Just like Database triggers ;).

You can use them conditionally to manipulate data before fetch or before storing.
For example: you want to store the username when a person registers using the email id like userzyx@gmail.com then you can use it to generate username from it by truncating the later part and generate unique username which will be "userzyx" here.

Just open up your brains and see where further it can be used and possibilities are just unlimited.
At least this time they them selves found the security vulnerabilities and not someone else.

I hope these internal audits are now a normal part of their business.
So like submitting a pull request and having my peers evaluate it?
Also any Americans reading “we can trust X” will likely get a good laugh out of this.

It is irresponsible not to assume that if the law is written a certain way then at some point, the law can (and likely will) be enforced that way when it suits the government.
https://en.wikipedia.org/wiki/Operation_Olympic_Games

It’s not really a secret anymore.
Well if you look at the graph almost half of the load time is taken by Magento's server response.

Magento is slow. Ofcourse you can optimize all assets but in the end Magento is still slow.

I've seen companies throwing lots and lots of money at Magento hosting to speed it up. But at the end of the day I think Magento is great for marketeers but not so great for the rest of the world.
Video encoding would be another good application for the FPGA.
Maximum stake for fixed-odds betting terminals cut to £2
Two pivots and three countries later… we have an app
10 Best Node.js Frameworks in 2018
What is the legal situation with this? I mean, forget for a second that illegal things are done all the time, I presume it would be unconstitutional were the CIA or NSA found to be paying google engineers? How big of a scandal would this be, or is it kind of tacitly understood in the way that black-budgets for large projects are?
How we built the UK’s first Viagra subscription service
I was referring to https://www.privacyshield.gov/Program-Overview where single framework (EU-U.S.) for companies with between $0-$5 million the yearly fee is $250. If you want to add Swiss-U.S. privacy shield as well, then $375 per year for both.
The map is not the territory. Just because our models of computation mimic some of what our brains can do, it doesn't necessarily mean that they describe the _essence_ of what our brains are doing.
It is just because since all the JSFiddles are on one page. All the console.log would be together in the console and it would be difficult to know which console is for which code.

Hence document.write is used.

Though HTML could be used but that would just increase one more tab to show useless HTML. ;)
Haha, the response to your comment here is a perfect example of how ambiguous this law is: you yourself are disagreeing with official interpretations of this law. And the blog post that we’re commenting on here says that personal projects have to comply, while you have posted multiple times saying they don’t?

It’d be really nice for the “fucking idiots” that you referred to earlier if those of you who clearly know what the law says and what it means could get your stories straight.
Why do they remove comments? Do they delete commented code or textual comments?
The DPO cannot be himself.
They extracted it, so it means it was in a context. Address + context is very much personal.

That doesn't mean it was available to the MT workers. Why would it be?

Also I note that the comment author prefers not to answer.

They haven't made any new post since that one, how do you know if they even saw yours?
WordPress 4.9.6 Privacy and Maintenance Release (GDPR)
Open Source Calculator Teaches Us about Quality Documentation
Material UI v1 for React is out
> This article actually points out my philosophical problem with GDPR. In one point he says you have to be compliant if you want to do business in the EU. In another he observed that it is difficult (maybe impossible) to block EU folks from coming to a web presence. It’s the expansive reach that bugs me.

Other countries have already had to deal with the US on this front. If you are a US national you may find it extremely hard to get a bank account in a non-US country, for example; non-US gambling services also have to be very careful about US users (PokerStars et al) https://en.wikipedia.org/wiki/United_States_v._Scheinberg

There are also things like the Magnitsky Act and various other bits of human rights law that allow extremely serious crime and crimes against humanity to be pursued internationally.

The one we'll have to watch out for are Chinese censorship laws going global. There's already some weird side effects of "One China".
I think you and everyone making similar points in this thread are getting tripped up by the difference between rules-based regulation and principles-based regulation. This is unsurprising, given that the US is so heavily rules-based, but the EU (certainly the UK) has a long history of principles-based regulation.

In rules-based regulation, all the rules are spelled out in advance, and the regulator is basically an automaton once the rules are set. In principles-based regulation, the rules are extensive rather than complete and you expect the regulator to have some lattitude (and, if the system is well designed, a mechanism of recourse if they do something stupid).

An advocate of rules-based regulation would say this can make regulators unpredictable and capricious. An advocate of principles-based regulation would say it is an important safeguard against "rules-lawyering" and regulatory capture (especially the kind that ties new entrants up in check-box compliance that doesn't actually affect your business because all the rules have been worked around).

A classic example would be the time PayPal tried to tell the UK regulators they shouldn't be regulated like a financial institution (which is a claim they successfully made in the US). They pointed to chapter and verse of the relevant law, and said that according to subparagraph 2.b.c(iii)... and the relevant regulator essentially told them "shut up, you keep consumers' money for them and will be treated accordingly". As a result, the worst "PayPal took all my money and I can't get it back" stories generally do not come from the UK. (And when they do, they are accompanied by referrals to the Financial Conduct Authority, who have teeth.)

You can approve of this way of working or not, but the GDPR is a principles-based regulation, and you'll have to engage with it on those terms.