skysight-inc/HackerNews huggingface dataset:
> Bankers do not intend to increase risk without safety backups. In the financial crisis banks were incompetent just as much as unethical -- they had risk models that told them they had a safety net, but their models were wrong

I agree that what you describe covers most bankers. But you only need one person to come up with something like a CDO secured by credit default swaps. And you only need one person at the top of one of the biggest banks to promote this strategy. Then everybody else needs to follow suit, because profit is not just the source of their bonusses, it's also their protection against predatory competitors. So the number of people who need to start this is quite small, and I still claim that these few people knew exactly what they got us into, and they also knew that they could get away with it.

> in theory offered social benefit: decreasing cost of housing without increasing risk.

That is a foolish idea. The only way you can reduce your own risk is by putting the risk on other people's shoulders. You cannot make risk go away.

> The rise of ETFs has enabled average investors to invest with very low fees

Yes, but google what ETFs will mean at some point for the economy? Normal value creation becomes less and less fruitful. So in the end the whole market goes down and again the small time investors will lose while the big whales get bail outs and eat the smaller fish in the sea.

Also just because the fees in passive management are lower doesn't mean they can't be higher compared to the provided value. McDonalds is cheaper than a really good burger with really good fries, but you also get machine produced blurb in exchange, and in the end McD probably makes a bigger profit than your average, family owned burger shop.
Sadly what FB is doing is using contracts to defer the blame in-case of legal action. Shitty but standard practice.
> Fisher-Price PXL-2000

Now that's a name I haven't heard in a long time.
My anti-procrastination list
protobufs already support all these
Show HN: Totals Tracker – Track your season win totals wagers
Could they make a pink diamond?
Is the name a nod to Cryptocat[0]?

[0] https://crypto.cat
The NYT article says that Facebook told them that some partners stored that data on their servers. I note that this Facebook rebuttal does not refute that point in regard to the device partners. (Which could be a possible confusion or misleading quote in the NYT article, conflating all partners with the device integration partners, so I'd like it to be clarified somehow)
> Skype works the same as it always has for me and I pay them nothing.

I used to pay them for a monthly subscription so that I could use skype phone hardware to maintain a -sort of- VOIP variant and be easy to reach, even while on the road.
About two years ago, all of my phone hardware started to fail. Those phones are now collecting dust and I replaced them with proper VOIP hardware. Yes I should have done that before, but skype DID work great for this in the past.

If somebody calls me now on that line and my computer is off or suspended, I will never know as the call does not get registered. Besides that I might have turned down the volume on my computer for whatever reason and still miss the call.

Then there's the electron muckup which is really bad, removed a bunch of features and configuration options, is super laggy and uses a lot of resources.

Also the move from P2P to using microsoft servers is not exactly a security improvement.

Skype is a mess and I'm glad I moved away from it for any serious usage.
In this FB response, they seem not to disagree with any of what the NYTimes had to say. This is called justification, not disagreement.
Somewhat. But some are larger areas.
I might need to take a look at lower bandwidth applications based on spread-spectrum coding. That should enable reasonable sub-unity SNR transmissions, enabling higher frequency bands with much wider bands.
Agreed. Forced telemetry is unforgivably unethical. There absolutely must be a way to opt out.
The Dust programming language? Joke aside, I fear "D" came before Search Engine product names were considered. Sadly sometimes I google "dlang" and still get some odd results.
It's hard to believe you're asking this question in good faith. I'm sure you understand there's more to it than "APIs are good" or "APIs are bad", obviously the purpose of the API matters. If Twitter offered a public API for information that users hadn't realized they'd made public, that would be bad. When they pull support for an API for information everyone intended to be public and searchable, that is also bad.
I don't understand the allure of natural diamonds... I put synthetic oil in my vehicle.
CJ Affiliate | Senior Software Engineer | Westlake Village (Los Angeles), CA and Santa Barbara, CA | Onsite

We're the leader in affiliate marketing, and we're solving interesting problems at scale (over 930 million unique users a month).

We are dedicated to personal and professional growth for all of our engineers. We send delegations to several conferences each year (Strata, Re:Invent, Defcon, React Rally, etc.), run lunch-and-learns and various working groups, offer personal study time, and foster a culture of teaching.

We value TDD, pair programming, automation, and dogma-free agile practices

We enjoy the financial backing of a Fortune 500 business while maintaining the independence, agility, and lack of bureaucracy of a smaller company.

Apply Online: https://engineering.cj.com/join or on LinkedIn (https://www.linkedin.com/jobs/search?f_C=5679&f_L=us:0&f_F=e...)

or email me at snazarian@cj.com

https://engineering.cj.com | https://github.com/cjdev
Sure it can. Almost every website on the internet right now has undiscovered security holes. Obviously you won't be leaving them open on purpose, but not using a framework is a legit choice and "it provides security that you can't implement without one" is a bad argument.

Yes there's convenience in "somebody already thought about everything you need before you did" but there are also security libraries, checklists, tutorials, and other tools besides a full framework with all its baggage to help developers write secure code.
I agree completely with marcus_holmes. If “ritual” is just jargon, it should be changed, because it’s also misleading. I can’t think of another example where a word means something precise, and also means less than nothing in the same context.
HN discussion of a Bell Labls paper describing the revese engineering of a Linotron 202 machine: https://news.ycombinator.com/item?id=10505349

There's a good "revisiting" of that paper, too: http://www.eprg.org/papers/202paper.pdf

Edit:

The contrast between the Linotron 303 described in this page, and the 202 described in the Bell Labs memo is interesting. The 303 was introduced in 1974 and uses film-based fonts, whereas the 202, introduced in 1978, uses fonts that are stored digitally as vectors. I naively assumed that a "303" would be a newer, more advanced machine than a "202", but that's not the case.
Right on the day that Microsoft acquires Gitlab :-)
I've been watching MS for the last 23 years. So I'm not oblivious to history. ;)

And granted that's how PR works, but the problem with carrying distrust to defend against it is that is eventually makes one paranoid.

Personally, I aspire to objective reevaluation at the current point in time.

In 2018?

Microsoft historically did terrible things to open source, Balmer was an asshole about casting it as us vs them, and they still have substantial legacy OS and Office revenue streams to protect.

At the same time, their cloud business is rapidly growing, they've realized the only way to compete there is to embrace open source, and that's beginning to permeate the rest of the company. Largely via promoting someone from the dev / server / cloud business as CEO.
Developer communities which pride themselves on their reason would rather not look at paltry things like details when a company they don't like is being criticized.
Microsoft promises to keep GitHub independent and open
Hey HN! I created Totals Tracker to solve my own issue: I have a lot of win totals (season-long "over/under") wagers I placed at the beginning of this MLB season, and it was tough to get an idea of how well they were performing. So I built Totals Tracker. There may not be a huge crossover area in the Venn diagram of "HN Users" and "Sports Bettors," but if you in fact fall in there as I do, I'd love feedback!

Oh, it's free, at least for now (and anyone who signs up now will be grandfathered in at no cost if/when I figure out a subscription model that makes sense)
Nope, never got around to debug in depth. Will do that when I have some time again.
Surely it is only giving blackberry the information if you type in your login credentials on a blackberry right?

I don't see how the situation is actually different now: if you run the official Facebook app on your Galaxh phone then Samsung could scrape and exfiltrate the data anytime it wants. It is Samsung's fault if they do it not Facebook's.
Microsoft Buying GitHub Would Be Bad
Forgive what may be a not-fully-informed question/opinion, but isn't the issue that 3rd parties were able to see private information? Not public information?

Like you send the same sequence of bytes that they do, but the difference is that it should be different depending on who is sending the bytes, no?
Monsanto has always been unfairly hurt by their name. You can't have an argument about GMOs on the internet without somebody mentioning Agent Orange or some other completely irrelevant nonsense.
Midwest
There isn't, though. It really is just the same origin policy at work (or, if you mean more abstractly, the website flagging them differently; you can still construct it into a curl call that will be indistinguishable, barring something like a varying CSRF token that requires the page to be loaded, but again, that can still be faked by loading the page, grabbing the token, and using it in the resulting cURL call).

But preventing PUT/POST/DELETE from other origins prevents other origins from making requests on the user's behalf. It also prevents the user from making those requests. It either has to be a GET (which is itself a security hole, but one necessary to the basic utility of the web and which -should- be okay provided people do indeed make GETs idempotent; it has been leveraged into JSON-P, a terrible unsafe hack, though), or it has to use CORS to preflight it.

Once you have CORS in place, it's still indeterminate as to whether the action was user initiated or not. It's just that a request originating from origin (X) has been allowed.
> Signed agreements do not prevent your information from being used in other ways.

Why is this, though? How is it different from any other legal agreements?
> mbasic.facebook.com

Thanks!
Except every year you are paying about 6% of the purchase price in principal and interest and property tax (plus maintenance and water), so the math isn't quite that simple.
I think this is super neat. The podcasts I am on do not make $10 an episode, so sadly, I can't justify it. But if I could, I would. I shared it with my podcasting friends.
It's interesting strategy. Even in their corporate merger photos, I can't help but sense how deliberate Satya's and Nat's clothing choices were. Regardless of the intent, we are being told a story.
I think it's pathetic when people complain about something and continue to use it. That's why companies are allowed to get away with so much bs.
My brother lives in Lakewood, so I've spent a fair amount of time in the area. It's west Denver and a pretty nice place to live. My take is that there are a lot of 'liberal' folks there; you see a lot of pride flags on the signs of mega-churches. Denver is a bit of a mixed bag in general. It's the meeting point between hyper-liberal Boulder and conservative Colorado Springs (though even CS is going liberal now). It's more of a 'libertarian' vibe than a 'republican' vibe. As such, the folks there will side with the baker in terms of his right to be bigoted. But his business is really hurting at the same time because people think he's an ass. In general, CO politics are pretty quiet, as the legislature can't raise taxes (TABOR). But when it comes to water and drought, Denver makes DC look like kiddos. Water is the BIG deal in CO.
From Arsenic to Electricity: A Look at Victorian Hair Removal
I had removed the Fb from my phone before and reinstalled it at a later date. What kept it off my phone 'for good, so far' was that for a while I'd unfollow anyone who posted any utter garbage to my feed, with occasional strategic exceptions.

Now if I want to check Fb I'm only on it for a few minutes due to 1) Using mbasic.facebook.com and 2) Only checking the 'notifications' tab. There's very little else getting through to the News Feed anyway.
In-Depth Paper Review: Referring Relationships (CVPR 2018)
Finance Ministry disciplines 20 over falsified Moritomo files
> Their PR problems aren't rooted in SV

Silicon Valley is the last place I'm consistently hearing full-throated defenses of Facebook. It makes sense to keep one's base in order.
Or that time when they bought Skype.
https://www.biofortified.org/2015/12/lawsuits-for-inadverten...

"To conclude this series, I have found no evidence that farmers are sued by Monsanto for inadvertent contamination. The lawsuits that I examined were for cases where farmers knowingly and admittedly used Monsanto seeds without licensing contracts."
CSRF tokens are usually only used for state-altering requests (POST, GET etc.), though one could use them for GET requests as well. The reason people don't do use CSRF for GET is that there's usually no risk involved when calling a GET endpoint from your browser, as it's not supposed to change the state of a resource in any way. And since an HTML form submission or included link will take the user directly to your API, there's no way for the attacker to extract the information afterwards (which is of course given if the attacker can make the request asynchronously via Javascript).

You can also use the "Referer" and "Origin" headers to defend your API against form submission from third-party websites without using any CSRF tokens (as browsers will include the URL/domain of the site from which the form was submitted), though there were numerous cases where browsers or e-mail clients didn't set these headers correctly, so if you really want to be sure the only way is to use a CSRF token. You can put that token e.g. in a JS-readable cookie, which will not be accessible on third-party websites but which you can read out via JS on your domain and then include in the POST/PUT/... request. If you want to run your code from different domains as well you will have to provide an endpoint from which users can get the CSRF token though (as Cookies from your API domain will not be readable there). You will then need to restrict that endpoint using CORS, as otherwise an attacker will be able to get a valid token and e.g. inject that into an HTML form which he/she can then submit.

So CORS and CSRF do different things, but for API-based apps that should be able to run on multiple (non-sibling) domains you need both mechanisms to ensure security (and CSRF needs CORS in that case to function).
There's a nice documentary about Microsoft vs. FLOSS. https://www.youtube.com/watch?v=_wGLS2rSQPQ
> Nokia wouldn't have shared a successful OS with others like Google did if they had one

But that was exactly the plan. When they cooperated with Intel to build Meego, the resulting OS was available to all other handset manufacturers and there were test suites in the work for vendors to be able to claim Meego compat, just as with Android.

The Meego OS was actually quite solid and very nice to develop for. Its major problem was the unwillingness of most app developers to support additional platforms besides Android and the Iphones. Just as with Windows Phone.
It seems to me that the NYT allegations are not exactly fake news...
That would work through repeatedly exposing people to positive or favorable news. Aka astroturfing. Aka what I asked about.

Parent comment specified the same news, which makes less sense.

If I hear 100x that MS is buying GitHub, that doesn't make me more likely to respond favorably.
Your real data has already been mishandled by anyone from banks to healthcare providers to governments. This mass hysteria about FB is just silly nuisance constantly getting blown out of proportions by turf wars between FB and traditional media
Oh and this particular case FB is calling the nyt fake news
Initially, maybe, but i've read glyphosate resistant strains of pigweed quickly took over have been causing big problems. For many farmers, pigweed was the catalyst for them moving to roundup ready crops. Apparently Monsanto is trying to push Dicamba resistant crops now (see above).

Herbicides aren't the only solution for that problem. Some practices such a tilling, for example, churns up a bunch of weed seeds which exacerbates the problem (and others).
The problem with this is that seeds tended to blow between fields

And the problem with this is that it's nothing more than a spurious hypothetical that never actually happened. Monsanto sued and won in cases where farmers were deliberately storing and replanting seeds in knowing violation of their agreement with Monsanto.
Facebook’s response seems perfectly reasonable to me.

- Obviously in order to integrate FB functionality into a Mobile OS UI requires an API to render the data being displayed.

- If your phone has a home screen widget which shows friend data, obviously that friend data came from a Facebook API call.

- If you type your Facebook username and password into a settings dialog in order to enable that home screen widget to function, that’s pretty obviously consenting to enable the functionality.

- There once was a day when we demanded our social media platforms to provide these “open access” APIs to specifically allow for accessing our own social feeds on our own devices.

We trust our user agents to render our private information on our devices. Sometimes we even trust our user agents to leverage network services to improve the on-device performance (i.e. Amazon Silk)

If and when user agents exfiltrate our personal data off device for data mining purposes (i.e. Chrome Omnibar) it should be disclosed and opt-in.

It sounds like Facebook provided an API to device manufacturers to allow them to deeply integrate social features on device. This has historically been considered a Good Thing. It sounds like they put together a legal agreement that required these device manufacturers to take due care in implementing these features to protect user data. Also seems like historically this is what we would call a Good Thing.

When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data.

However, Chrome Omnibar aside, user agents are not expected to exfiltrate data in any way, and if that occurred, that would indeed be a story I’d like to read, and my ire in that case most certainly wouldn’t be directed against Facebook.
Any resellers that aren't garbage? I've found good ones for other gems over the years, but somehow not for diamonds. I've only found stupid prices for lab grown diamonds.
> If Microsoft shares SSL certs with NSA they could do MITM attacks.

There is zero reason to believe they do.
Steve Ballmer is jumping up and down screaming "developers!" somewhere right now.
Stephen Elop, from Microsoft, became CEO of Nokia in 2010. Nokia was struggling to adapt before that, in 2008/2009, but Elop formed partnerships with Microsoft, put all bets on Windows Phone, and cancelled work on Android devices and the previous experimental Maemo platform. He decimated a huge company surprisingly quickly.

But is this really Microsoft's fault? Not directly, I guess ... but is it really plausible that Microsoft didn't have any underhanded influence on Nokia's board to put an obvious Microsoft stooge/idiot in charge of destroying the company?
I dont think there is anything wrong with using FB for things you want.

I dont scroll anymore. I check it for events and messages.

Thats it.

Do that 1-2 times a month, all my facebook needs are met.
Imagine in the near future [+] when telling someone they have cancer is the same as telling them they have strep throat: a minor inconvenience. We're still in the dark ages of treating cancer (ie radiation, chemo, and surgery).

[+] 20-30 years
> Most of the ruby code I want to rescue isn't littered with string-based define_method nonsense.

I see what you are saying - but this is where the issue is I think. You may not write code that does sophisticated metaprogramming, but the gems you use are probably fundamentally based on it. Even just requiring some of the standard library uses a surprising amount of of metaprogramming. For example you can't load something as basic as 'fileutils' without doing a lot of metaprogramming.

The entire Ruby ecosystem is built on metaprogramming.
Tesla Faces Accelerating Rate of Model 3 Refunds
> But I pity the american bubble wrap culture.

I don't see this in pools. 3m spring boards are still pretty common at pools in the US. My "nothing special" high school had 3m springs.

It's true that the 5m,7m,10m platforms are usually only found in sportsplex-type pools. They typically come as a package. But as you mentioned in an earlier comment, 5m+ starts the get actually dangerous. Flopping from 10m or even 7m without an agitator can do serious permanent damage. IMO a platform tower above 3m (or maybe 5m) is more "expensive sports equipment" than "general public recreational equipment".

I maybe could see a 5m platform as "general public recreational equipment", but 7 and 10 are definitely not. And there are just better ways to use time/money than building a 5m platform when you already have 3m spring boards.

American pools are moving away from exercise and toward recreation/amusement (i.e., switching out swimming lanes for "water playgrounds" and switching out diving boards for water slides). But that's a totally different phenomenon from "bubble wrap culture"; IMO those water playgrounds are way more dangerous than traditional pools (I've seen more than one kid injure themselves pretty seriously jumping off of the water playground into ~2ft water; that would never happen in a lane-swimming pool). And personally, I've had more injuries on water slides than on 1m or 3m spring boards.

So there's something annoying going on with American swimming pools, but it's not bubble wrap culture.
Even if a feature like this adds limited value, it's good to think about whether you can just live without it completely in order to leave Facebook.

For example, consider how the groups feature was abused to prey on people seeking addiction support -- and how even in the midst of such abuse, Facebook lauded some of the organizations in attempts to improve its reputation by highlighting what good it can do.

< https://www.theverge.com/2018/5/21/17370066/facebook-addicti... >

Basically every feature of Facebook that adds a tiny bit of value to a random person's life is actually just some deeply engineered data-harvesting dark pattern that opens up huge other groups to targeted harm.

I see a lot of comments of the spirit, "I would leave Facebook except ..." with some reason like it's the only way to see family photos, it's the only way to participate in online groups, etc.

Just delete it and leave. Share photos some other way. Find groups some other way. The population-scale downsides are just so serious and severe in the case of Facebook that people shouldn't be making the choice to stay on the platform anymore based on narrow-scope, small scale upsides that it offers for them in limited settings.

The huge, up-front, unlimited scale harms it facilitates are reaching a point where they need to be a daily civic concern for everybody.
That's astroturfing. Which is what my original comment was about.
imposing `messenger` on all of us because they know none of us would use it if we had a choice