skysight-inc/HackerNews huggingface dataset:
I think you can think of this as a generalized technique for turning reflected cross-site scripting into stored cross-site scripting.

The concept is straightforward. You look for refxss in "unkeyed" inputs: those are inputs that alter the output of a cacheable page but aren't themselves part of the cache key. That "unkeyed" property is why his examples are all in things like the X-Forwarded-For header. Caches key on URL parameters (because they key on URLs), but tend not to use that header as a key, so two requests varying only in X-Forwarded-For are, to a cache, the same request. If you can trigger refxss in the unkeyed input, that refxss will be cached and fed to everyone else regardless of whether they use the same unkeyed input. Presto: stored XSS.

While that's super cool, if you're not already familiar with modern web application testing, I think the more interesting part of this post is the tour you get of the methodology Kettle uses to find vulnerabilities in the first place. The XSS examples he's providing aren't "novel"; the novelty is in tricking caches into storing them. But he uses the post as an opportunity to show off some advanced Burp features, which is useful even if you're not going to go test for cache poisoning.
By people who would do anything to discredit such a book? Sure.
Recognize new, trending, and top contributors on your README hourly
In a few years the media (which has always been very pro-Apple) has internalized the idea, that all your software MUST come from a single corporation controlled walled garden and pay tax to them. The whole concept of being able to install software from a source you choose is now so foreign that they'll speak against it when possible.

And unfortunately, this seems to be the case with a lot of HN commenters as well.
Gravitation, by Misner, Thorne, Wheeler (http://a.co/dczH4eS)

Fully understanding the math in this book requires a solid background in linear algebra, calculus, differential equations. But I find it an incredibly interesting book even without understanding all the math: the engaging writing style and numerous illustrations capture the intuitions behind differential geometry and relativity, but without sacrificing the rigorous mathematical formulations underlying it.
I work in an usually well lit room and dark mode is really hard when I got direct sunlight, not in my screen, but in the room in general.

Dark mode is nice when it's dark, so maybe it's related to the use of smartphones in bed at night.
The best way I can think of describing this is like going into McDonald's and asking for a Whopper. You're not going to have a good time. You can't get whatever you want. McDonald's controls everything involved with their own operation, so they get to decide what's on the menu. And competitors products are not on it.

That's Apple.

Google is more like the only lumberyard in the reasonable vicinity. But they'll only sell you lumber if you also buy nails, a hammer, paint, and pipe from them as well even though there are closer, cheaper, or better alternatives elsewhere for those. They're using their position to force others into deals they don't want to be in.
CEO of Epic

>The 30% store tax is a high cost in a world where game developers' 70% must cover all the cost of developing, operating, and supporting their games. There's a rationale for this on console where there's enormous investment in hardware, often sold below cost, and marketing campaigns in broad partnership with publishers. But on open platforms, 30% is disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.

https://www.eurogamer.net/articles/digitalfoundry-2018-fortn...

And another interesting quote from him

>If you look at it, the stores on the smartphone platforms actually do very little. They’ll put ads up in front of your game. When you search for Fortnite on iOS you’ll often get PUBG or Minecraft ads. Whoever bought that ad in front of us is the top result when searching for Fortnite. It’s just a bad experience. Why not just make the game available direct to users, instead of having the store get between us and our customers and inject all kinds of cruft like that? It’s a general criticism I have of the smartphone platforms right now.

https://venturebeat.com/2018/08/03/tim-sweeney-epics-ceo-on-...
1/0 = 0
> but there are tools to secure an outdated app in other ways either.

Not really.
Most browsers on windows and mac (and linux if installed without a package manager or you're using a non-stable distro) autoupdate, so most people are within 3 version of the latest, and caniuse takes browser versions into account.
Who's saying that's a good thing for a healthy free market?
Seven hundred salespeople in the same room is already a crime against humanity waiting to happen.
One Small Step Toward Printing Replacement Organs in Space
Interesting. That matches my experience so far. It's not a symmetric connection so I have SQM running only on the uplink (40 megabits per second) at present.
Alpha Delta Lima. (Apparently spelling out the acronym gets your post blocked???)
Those are two different kinds of connectivity.

The first is about synapse density, the second about how strongly different parts of the brain are linked together (relative to one another).

So a brain with a low average synapse density may still have some areas more functionally connected than the average population.

The default mode network and the attention-related fronto-parietal networks are usually disconnected functionally, they inhibit one another.

See https://en.wikipedia.org/wiki/Dynamic_functional_connectivit... for details
Walking isn't exercise. Not surprised you don't mind walking to the grocery store.
Temer’s administration has cut or blocked 1.1 million families from the flagship social program Bolsa Familia, or Family Purse. The program provides a small income to poor families who send their children to school and keep them under a doctor’s supervision, according to government figures.

Data released to The Associated Press after a request was made under Brazil’s freedom of information law shows that most cities affected by cuts to the Family Purse program were based in the poorest regions of Brazil, the north and northeast. Those areas are strongholds of Temer’s adversaries, including former President Luiz Inacio Lula da Silva.

https://www.apnews.com/8be796a4692442b8befc65fa0c66d823
The same but Steve Jobs never ranted back in the day....

https://mobile.twitter.com/arubin/status/27808662429?lang=en

the definition of open: "mkdir android ; cd android ; repo init -u git://android.git.kernel.org/platform/manifest.git ; repo sync ; make"
"Google will lose"

what?

They won't gain from that particular source. They'll still make fucking BILLIONS.

Epic Games will save 50M$.
We will be pulling upstream WebKit changes from the Safari stable branch into WebCore, so it's not a "hard hard" fork.
I wouldn't call that hypocritical. He can hate the model because of his first hand experience with it. He'd also be a fool to turn down the iOS market.
I've heard of it but is that reliable? I meant I'm a bit afraid of loosing data by using unofficial programs.
1. Notes -> CSV -> MySQL

2. Hire someone in another country for below minimum wage

3. ...

4. Profit
Many employees find themselves forced to select between a narrow selection of mutual funds from their employee provided RSP.

Unless they forego their employee contribution to the RSP, they have very little flexibility.
Or just use this secure key fob holder: https://youtu.be/-MILCnDczC0?t=9m17s
I have never thought about it like this. Thanks and please keep pointing it out!
Thanks a lot, this list is really helpful!
> the default filesystem used by the most popular distro.

Ubuntu doesn't use ecryptfs (or even support it afaik) by default.
Ehh I just left Paris after visiting for a few days. Not that I bought fruits and veggies there, but I found the restaurant scene to be very average. The bistros are all indistinguishable from each other, pretty expensive (probably 25 euros for an entree and a drink), and very mediocre quality. I know you were talking about grocery store produce but a CA area farmers market is probably higher quality than an analogous one there too.
1.) Talk to your cofounder.

2.) Hope that he/she is willing to give up their share and leave amicably.

3.) If he/she is willing to give up their share and leave amicably, get a lawyer involved. You should pay for this. He/she may want to get a lawyer involved too.

4.) Be prepared to abandon the idea and all the work you did.

5.) Learn from the failure.

---

Here is the issue. You have created a situation where your cofounder has all the power. Without any other agreements, you have to assume you are equal partners. Even if he/she leaves amicably, they can always wait. If your startup succeeds, it won't be hard to find a lawyer who will go at you for a percentage of the settlement. If a lawyer goes after you, you should assume that you're fucked, as fighting it will create such a distraction that your company will likely die anyways.

If you can negotiate some kind of pay for work scheme, then incorporate, you might be okay. But, there is a huge power imbalance right now.

Do you have any other ideas??
But this is a requirement of the “you must be able to parse source code including macros without having to know how to expand macros” rule. Otherwise how would you know how to parse the following:

foo!((x))

As

foo! ( { ( x ) } )

Or

foo! ( { ( x } ) )

With {} representing the argument to the macro.
Give a Cow a Brush, and Watch It Scratch That Itch
This sounds like an outstanding model. Other states have complained that such process would be too expensive. How has Minnesota resisted being "too cheap" on election?

And in general I'm impressed by Minnesota's governance. Maybe the answer is a deeper look at Minnesota's government structure.
So does England. One has the ability to enforce them, the other doesn't. The point you are implying, that gun laws do nothing, is ridiculous.
Brazilians, and especially students, have reason to be angry. PEC 55 will effectively freeze social spending by fixing budgetary increases to social-assistance programs to inflation, rather than GDP, for the next 20 years, severely impacting public health and education. The United Nations’ special rapporteur for extreme poverty and human rights, Philip Alston, condemned the measure, saying that it “will place Brazil in a socially retrogressive category all of its own.”

https://www.worldpoliticsreview.com/articles/20753/brazil-s-...
I feel lots of this applies to Open Source too. The notion of wearing the company or community hat is pretty common, and often used to persuade others of your good intentions.

The number of times I've read a sentence that started with something similar to "Wearing my community hat, .." and felt the sentence was anything but community orientated is way higher than I would like. I'm sure a certain percentage of this is actually my own biases, but I'm also pretty sure that percentage isn't 100%.
I agree on this prosaic point, people/entities should not be absolved of their dangerous lies.

What I see as striking about the foundation of Qanon, is that their setup for the conspiracy theory, involves an almost leftist condemnation of the existing power structure in the US. And I agree with the general thrust of their diagnosis. This condemnation of some vary obvious problems in the US is actually kind of rare in the “mainstream media.”
It’s strking a chord with many ordinary people.

On the particulars, as to who is behind the grand “conspiracy” and who is working for our salvation, they are completely off the rails. I was just surprised that their introductory propaganda didn’t sound as crazy as I expected.
Where, pray tell, is the proper place to engage with these people as fellow human beings then in your opinion? Is it loosely defined as a place that the rhetoric and world-view you prefer (and which I probably prefer as well) rules with an iron fist, with people who are actively censoring what someone says and forcing them into changing the way they address you? Over time, lines have been drawn, and many people have become disenfranchised based on the unwritten rules of certain Web communities. I'm not suggesting for a moment that you'll change your mind suddenly and agree with their views - or that I would. The people who feel strongly about certain issues have formed communities, and they supposedly defend the right and virtue of free speech. So, speak to them! Freely. Don't seek to control, but to understand. And then when you do understand, if you can find common ground, work from it. If not, sit back and consider where your morality differs so distinctly from another member of the human race that you can find no core values in common. I've found doing that makes for a much better result in my dealings with both left-wing and right-wing radicals - because I can usually find at least something we both see as positive.
> We do whiteboard problems, BUT we also emphasize beforehand that the interviewers in the room are there to work through the problem with them.

Except at the end of the day this is an interview, you are judging their answers and evaluating their performance. I have been part of white boarding sessions like this and it does not reduce anxiety and still feels completely removed from what I actually do on a daily basis.
> I can't imagine that 100% of the people interested in fortnite for android are willing to sideload the apk.

As long as more than 70% are, it's a net gain for Epic.
It’s not but it’s been that way since the first Atari game system came out.
They've created an artificial need for the platforms by closing their systems. Open systems don't require these kinds of platforms. I can install whatever I want on my PC and I like it that way.
this was discussed yesterday: https://news.ycombinator.com/item?id=17727140
Show HN: Ipywebrtc – Video/Camera streaming and snapshot fun for Jupyter
Maybe, but for projects like this, it's as simple as "FOSS is a prerequisite", for me at least.
Brazil’s Ministry of Education has officially announced the end of the Science Without Borders mobility programme
The programme had sent about 100,000 Brazilian students for studies abroad as of early 2015, and a previous Brazilian administration had announced plans for a further 100,000 scholarships through 2018
However, funding for Science Without Borders was effectively suspended in late-2015, and this month’s announcement confirms the programme will not continue

http://monitor.icef.com/2017/04/brazil-shutting-science-with...
unless Google is willing to censor worldwide on request of China, this does not seem plausible?
"Scaling" might have made sense if the average payroll were fairly constant. However, we're talking about a startup that could only adjust to demand by hiring and firing. If they served twice as many customers, they would have to hire twice as many ZAs. Thus the payroll would vary wildly from one pay cycle to the next, leave alone one month to the next. There is no purpose relevant to this firm's situation that could have been served by this particular simplification.

A startup with these particular hiring needs might have been better served to chop the year into 26 periods than to bother thinking about months... a part-time CFO is unlikely to suggest that.
No. Neither of the companies "deserve" anything.

If I bought a phone, it is my phone, and I am free to do what I want with it, including installing software that these companies don't approve of.
There are lots of small hadron colliders. Hadrons are just composite particles made up of quarks and held together by the strong force. This includes "exotic" particles like mesons and high energy baryons, but it also includes the "mundane" baryons such as protons and neutrons. So technically any proton accelerator is a hadron collider. Which includes the first cyclotron, a proton accelerator built in 1932 that was only 27 inches across, a very "small hadron collider" indeed.
From a purely Orwellian standpoint, I think the Russian model of government/media interaction is more effective.

There is "freedom of press" in Russia, and there are opposition media groups, but they are toothless. Journalists that publish scoops on high-level Russian government figure are in serious danger. Therefore, the opposition media produces watered down, safer takes. This allows state media to refute the opposition points step by step, so that the next time the argument is made, the viewer feels that it has already been addressed.

Contrast this with media blackouts like in North Korea. While NK's propaganda is extremely effective at training their population not to believe foreign accounts, they have a serious problem when it comes to South Korean movies/TV/music. NK citizens are fed the narrative about dire conditions in SK their entire lives. When they begin watching smuggled SK media, they realize that SK is in a much better economic place than them. This results in a serious erosion of trust towards the NK government, which is evident in the number of NK refugees who point at SK entertainment as being the impetus for their escape. This seems ridiculous on the face of it, but makes sense in light of how it results in a breakdown of belief towards the NK government.

If, instead, the NK government accurately portrayed what life looks like in SK, but provided reasons and justifications for the difference, they would not have this problem. There would not be the cold water shock when citizens saw a SK movie for the first time and realized that their world was a lie.

You also see this type of thing with $POLITICAL_PARTY's big social media personalities. They take a watered-down, strawman version of the other side's argument and refute it. When their followers see the real version of the argument elsewhere, they are primed to disregard it, and they roll their eyes and laugh and move on. Whereas, if they saw the argument and it was novel to them, they would be much more inclined to read and consider it on merit.

I've worked with Chinese students who are studying abroad who slowly begin to lose belief in their government when living outside of China. It is not the hardcore, biting Western anti-Chinese propaganda that makes them lose their trust, but the day-to-day life of living in a place where there is substantially less corruption, genuine freedom of the press, and information is much more open.
Of course they have poor nutritional value. They’re junk food. But they provide 800 calories per dollar. And that’s the whole point — when you’re poor, you can survive on $3 of pop tarts per day, but not $3 of fruits and veggies.
I do not think this is what the piece is arguing. Rather, the concern is that by creating these 80/20 splits, the core values of the university are compromised. There's nothing a priori wrong with industrial research, it's this attempted hybrid that's problematic. Hence the title, "you cannot serve two masters".

Quoting the piece, "Part of the point of being a big company is to control your environment by crushing, containing, or co-opting inconvenient innovations." I think the author is arguing that attitude is fundamentally at odds with the values of the academy.
Do not forget the Real World OCaml book! I personally found it to be very well written.

Available both online and as a printed book published by O'Reilly: https://v1.realworldocaml.org/v1/en/html/index.html
It will probably introduce some people to die loading and, by disabling the prevention, maybe enable some malware APKs to be accidentally installed.

Not that much interesting software is available from outside the Play Store. Only OGYoutube comes to my mind here.
Err... I can’t imagine a scenario where one would want to use OneDrive/Dropbox to sync git repositories. It’s like having your local Dropbox folder inside your local OneDrive folder — only a lot worse.
Tesla Slides on Report It Is Only Now Approaching Potential LBO Investors
sure, as a private company I have a running budget based on the profits of my application. 30% of that revenue which I will never get will be going to another company which has a record of paying little to no taxes.

Now, how do you think the government makes up the difference in the tax loop holes? By raising taxes on companies like mine and restricting/regulating on how I structure my profits/income so that it can stay in business. So indirectly 30% off the revenue is affecting my tax situation with the federal government.

Again, 30% is on par with federal income tax.
"I have no idea why you're being voted down."

Because it is simply a completely bare dig at the company with nothing useful added?

What is it contributing to the discussion?
Sigh. My comment has nothing to do with what you can do elsewhere. I was responding specifically to the false claim "aren't doing anything to prevent competition" which is untrue, they are doing things.
Looks like this feature has to at least be enabled somewhere for it to work (it just so happens that for some systems it is enabled by default). If that really is the case it might be possible to disable the system, as long as only something in layer 0 can turn it back on. Although yeah still not an ideal situation.
A) It's documented, and is disabled by default.

B) It's not a coprocessor, it's the RISC like engine inside the processor that microcode targets.
I currently tolerate Google apps on my phone because Android is just open _enough_ for me to get by. If Google were to put walls around Android in this way, I'd never use anything Google ever again.
The solution to every security problem is more complexity.

And, in a well designed paper voting system, you do know your vote was not tampered with, because nobody's votes were tampered with.

There are only three mechanisms for tampering with the actual vote count - adding ballots, removing ballots, or altering the content of ballots. (Replacing ballots is a combined add/remove.) The blockchain mechanism only checks for alteration/removal, and only for a single vote. One individual can verify their own ballot, but repudiation requires breaking secrecy. It's simply not a very good solution.

And the reason it's not a good solution is philosophical - it's focused on the individual, when the election is about the collective. Any effective election validation system must validate the collective, not just the individual. The collective is validated by insuring that no tampering happened anywhere. And if we can demonstrate that, then verification/repudiation of individual ballots is irrelevant. If A is true for all B, and C is a B, then A is true for C.

But when you really love your hammer, every problem looks like a nail. Blockchain is basically useless for elections, but people obsess over it anyway.
I mostly agree with this approach. I think that you absolutely should be measuring the "boring stuff" because that's 90% of the work by number of hours spent.

On the other hand, I think there needs to be some proxy for "how well does the interviewee navigate complexity?" Because a programmer who does it well is far more valuable than a programmer who doesn't, and there's high variance on this between programmers and between fields of expertise.

The systems design interview sort of gets at it, and whiteboard interviewing often tries to get at it. I feel like I've yet to settle on an approach I'm happy with.
I think this is a great approach. It keeps the company flexible to hire a broad array of talent under differing circumstances while also letting the interviewee play to their strengths.
1/0 = 1(±∞)

https://twitter.com/westurner/status/960508624849244160

> How many times does zero go into any number? Infinity. [...]

> How many times does zero go into zero? infinity^2?
They could not have done that to the bootloader because of SecureBoot.