skysight-inc/HackerNews huggingface dataset:
Maybe I misunderstood the article, but I thought it said that Django does strip this information, and the Sentry app went out of its way to store the secret key in the SENTRY_OPTIONS payload. This custom, non-Django code effectively circumvents Django’s protections, making the bug the responsibility of Sentry, not Django.
As long as it's framed properly it can be acceptable. Ie. You get to a page with details and a "load environment" button with progress bars and all.

Of course when it's like 50-100MB you wouldn't use it in some cases. But once cached you're golden for your repeat visitor audience.
Finally a graph QL that can actually return graphs. Otoh, I don’t get why it is breaking news at all. Figuring out that in some cases you better interchange graphs and implementing a simple json-query-walker is a task for a day or two. You don’t need to go through The Era of REST or The Age of RPC to do that, neither is it a stellar innovation. Where are all the hackers gone?
Nothing screams quality like designing your car along the lines of some of the worst cars ever produced.
This is an issue of governance, not policing. The police are doing what the town has asked of them by valuing these tickets high, which is to punish parking infractions. If this is a problem, the townspeople need to get their government to relax these statutes. This is another way that income-based fines work well - the people with the means to influence this change now have an incentive to do so. This is also why it's unlikely to ever happen in most places, because as the article observes it is much more lucrative to find the sweet spot where you can toll people who are unlikely to be able to fight back (poor people, tourists).
I'm not arguing against the existence of Burning Man -- it does seem silly to me, but like many things I consider silly, it has the right to exist and other people can enjoy them.

I'm arguing against the idea that "any able-bodied person" can attend Burning Man, or events like it. Lots of healthy people cannot afford to attend events like that, for multiple reasons.
it wasn't out of court, this is the SEC's modus operandi

there's no precedent here, the government always does stuff like this

they got bullied in a civil case, the prosecutor caught them in a lie as they misjudged how the US government will nail them, and then they accepted a settlement deal

https://www.reuters.com/article/us-insidertrading-cyber-sec/...

The SEC's problem is that their interpretation of laws are very nuanced and they need to avoid jury trials and appeals courts at all costs. Financial crimes are hard to prove and it is hard to determine if they are actually crimes. Yes the executive branch (SEC) says "acting like this is criminal wrongdoing so we will try you in civil court and also tell the Department of Justice", and this is reflected in the social contract that people imagine to be so, but the judicial branch and the constitution doesn't necessarily have a way to agree with the SEC. The jury in the lower trial courts are also hard to convince, because proving intent and proving which law was broken is extremely hard, all while going up against the wealthiest defendants on the planet.

see: Chickenshit Club
https://www.nytimes.com/2017/07/05/books/review/the-chickens...

The SEC does no-admit no-deny settlements because of this. The negotiation amounts are very informal between lawyers. So just kickback and relax, emphasis on kickback.

That Ukrainian voluntarily came to clear their name and got tripped up during cross examination. Stay opened up to a perjury charge or advance towards "settling" with the US just like their "perpetual settlement" with Ukranian authorities.
Read Crazy Rich Asians Director’s Letter to Coldplay About Yellow
It's not the same.

My parents grew up very poor. We were comfortably middle class until my dad died while I was young. I helped my parent with bills from the time I was 18.

Even in me, you can see the difference that never going hungry makes vs my mother, who regularly went hungry growing up. And will still drive 45 minutes across town to save $2 on gas.
Wow, a fix in <24 hours, that's pretty impressive.
Some people avoid using Google.
I have noticed the encoding issue. Working on it. The job posting is though not remote, but welcomes/prefers the people with disabilities.
I know it FEELS like a 500£ phone, but if you look at ebay it's more like a 35-40£ phone today. Perhaps this helps reframe it? If Google is offering to give you back your original 500£, that seems like an awfully good deal.

I, personally, just went through a similar situation, except my 6p was out of warranty. I use Project Fi and have the device protection $5/mo add-on, and they sent me a top of the line Nexus XL to replace my top of the line 6p, for $100 (the device replacement cost). My 6p also got stuck in the boot loop.

Perhaps ask if a Nexus XL (not Nexus 2) is a replacement option?

Honestly, my 6p was damn near unusable before the replacement. I wouldn't say I have a lot of apps installed, I basically install a set of the ones I use daily and rarely install new ones, but it was incredibly laggy. The Nexus is way better in that regard. Yes, I had some apps I could remove, but pretty much everything on the phone was something I used regularly, most I used daily.

Aside: I was looking at a recent sale on the Nexus 2 XL, which brought it down to more like $800, and they offered $180 trade in on my Nexus XL. I felt like that was kind of low, but when I looked at ebay it turned out that was about right. I decided I'm super happy with my $180 phone! :-)
San Francisco has a ‘Poop Patrol’ and workers make more than $184,000 a year
The Fed probably wishes Trump took monetary policy lessons from Putin
DC Airport First in Nation to Catch Suspected Imposter Using Facial Biometrics
Being in that position for many years. Its not about they pay so much as its about the pressure to constantly be working in extremely unhealthy physical and mental way. Which takes its toll long term. Something that took me years to recover from and I'm the lucky one. Don't expect people working in factories their entire life to pick up programming/software development because their minds will be warped by the repetitive nature of all these activities, which only reinforce all their problems day to day making life even worse. All they can think about is their problems while they are mindlessly doing repetitive work.

If your going to force people to live like that, and it definitely is not a choice anyone makes you might as well give them a little dignity and not treat them like a machine. Don't put insane pressures on them leading them to pee in bottles. The rate thing is evil lets be honest. If you had to program every day certain lines of code and your performance was judged based on that and how long you went to the bathroom you would go nuts too.
Introducing windows-acl: Working with ACLs in Rust
The overlap in JS tools is a bit confusing to me. There's Webpack which bundles and transforms some aspects of your code. There's Babel which transforms (and sometimes bundles) some aspects of your code. There's TypeScript which transforms and can also bundle your code. Recently I have needed to use all three, but it's very difficult to know just how to mix and match them. It feels like the JS community has a lot of great isolated ideas, but hasn't quite mastered inter-project coordination.
>> Encoded into this somewhat unstructured data is the very thing NLP is after: the meaning.

The problem is that we don't know how meaning is encoded into language utterances and we don't know how meaning is represented, once it's decoded from those utterances (i.e. in our minds). It's very unlikely that these elements, the encoding process that turns meaning to language and back again and the reprsentation of meaning, are carried around in language utterances themselves [1]. And yet- we keep trying to figure out both, the encoding process and the representation, just by looking at the encoded utterances.

Imagine having a compressed string and trying to figure out a) the compression algorithm and b) the uncompressed string, withouth having ever seen examples of either. That's what natural language understanding from raw, unstructured text is like.

______________

[1] Edit: Is that even possible? Is it possible to send an encoded message including its own encoding procedure, so that the message can be decoded even when the procedure is not known beforehand? Wouldn't that require that the procedure is somehow possible to decode independently of the message? Is there another way?
Some people would become alcholics. It is that easy for some people.
... and even if they do work, would they affect rainfall?
Some GraphQL clients will create POST requests by default with the query as the data (Apollo does this), which should normally break caching, however there is no reason you couldn't append the query as a querystring param in a GET, which would help with that.
Why the U.S. Needs More Worker-Owned Companies
Video Friday: China's Legged Robots Parade, and More
I was raised in a cult. I know what it’s like to be incapable of considering others’ views because of dogma because of my experience.

I am assuming that his Christian perspective is similar to the one I had. My experiences with Christians since have reinforced this expectation.

Does that help?
It does emphasize how your (Facebook account's) security is only as strong as the weakest link - there was a story not too long ago about someone's accounts getting hacked because they had an old college e-mail address still set as recovery e-mail address, allowing an attacker to circumvent gmail's 2FA and everything.
This is a misrepresentation of the legal system in the US. There's an immense amount of information on this topic available from the Bureaeu of Justice Statistics. This [1] paper in particular is highly relevant.

Bail tends to be set in relation to the criminal record of an individual, the seriousness of an offense, how much of a flight risk they are, and whether or not they're likely to be a danger to themselves or others if released. It's not the 'norm'. So for instance of all individuals (arrested for any offense) 77% of those with no priors end up being released without financial condition. For those with misdemeanor priors it's 63% and 46% for those with felony priors.

And there are excellent test cases that can experimentally show whether these release conditions are reasonable. For instance there are occasional emergency releases caused by things such as prison overcrowding. And this is where people that would not normally be released without condition, are. Of these individuals 52% end up being charged with pretrial misconduct! For the general population of people intentionally released that figure ranges from 27%-36% depending on the release type.

And when somebody is forced to pay bail, they have numerous options. Generally they only have to pay 10% of the cost of the bail. In some cases that can be paid directly to the court who will then refund that 10% once they return for and complete their trial. If that's not an option the way bail bondsmen work is that an individual pays the bail bondsmen 10%. The bail bondsmen then go to the court and pay 100% of the bail on behalf of the individual. They get that 100% back once the individual returns and completes their trial, so the 10% is their profit margin. This is also where modern day 'bounting hunting' tends to come into play -- the bail bondsmen have a very strong incentive to ensure that their clients do not flee.

---

So the point of this all is that in the vast majority of cases we do simply let people go on the assumption they'll return to trial. For those that we don't let go, there tends to be a pretty good reason. That article from the BJS I linked has a great table at the bottom that offers some regression figures for release/return rates of various groups helping to determine how justified various decisions are. In most cases they are, in some cases they are not. It's pretty reasonable to conclude that it's a system that does well, but could be made to do better. But it's quite different from what you would portray it as.

[1] - https://www.bjs.gov/content/pub/pdf/prfdsc.pdf
It's useful.

Disclosing a disability during a job search is risky. An employer taking the time to say "I don't care about your disability, apply." might be the difference between someone qualified deciding to apply or not.

That fact that discrimination based on a number of factors is illegal for employers in the US doesn't change anything. People break the law, act inappropriately, and damage careers/job prospects all the time. And, unless they do something supernaturally stupid, there won't be any consequences for misconduct.

There's no harm in employers throwing "We're an Equal Opportunity Employer, and mean it" into a job post, or putting up an ad on a site like this. It shows that they're at least minimally serious about it.
I would agree with Facebook's assessment that this isn't a vulnerability. If a user intentionally adds an untrusted email address as an official email address for their account, Facebook can't really detect or prevent that.
NumPy can work without libraries like BLAS or LAPACK, but it will be sloooooooooow. There are C versions of those libraries however, maybe they are using those?
Show HN: Monthly Online Meetup for Software Testing Professionals
> Don't list email addresses owned by an adversary in your account.

I mean if you're delegating your email address, your staff aren't adversaries. But they shouldn't be able to, say, drain all your retirement accounts either.

Just because I want people who search for alex.krupp@gmail.com to be able to find my Facebook account doesn't mean I want password reset requests sent there. It wouldn't be at all unreasonable to send them there if that was explained in the UI, but just immediately sending a password reset pin to a non-primary email address without any warning is crazy. At least wait a few days if the user doesn't take any action after it's sent to their primary address.
> I guess we need an in-browser package management like npm?

It exists and it's called bower.
> I could go on for years about all sorts of interesting tips for improving your writing

Please do! Do you have a blog or something to follow?
Welcome to the Age of Privacy Nihilism
+1 for Glowstone, highly recommended to anyone interested in running a server, one of my favorite projects of all time. A while back it was forked to add improved Spigot plugin support (in addition to Bukkit), later re-merged into mainline Glowstone, extensively under new development so it is worth checking out again for those who have tried it out years ago. Glowstone has a long history!

It even works well as the server backend for my NetCraft client, which is based on fogleman's Craft. The support plugin WebSandboxMC provides a WebSocket client for the web client to connect to, and it runs well on the Glowstone server, compatibility with Glowstone being a top goal.

So with these projects you can have both an open source client and server talking to each other, the full stack open source. The downside, of course, is neither are complete, but it is a start. Open source can only get better (contributions certainly welcomed).

Another project I'd recommend for those in the market for an open source server is Cuberite. It is written in C++ and supports plugins written in Lua. Also has a very active developer community, maybe slightly bigger than Glowstone. Last year I added Forge handshake support, so modded clients with Forge can connect send their mod list, while server plugins can register certain mods as required. Not full Forge mod support, but a necessary prerequisite. The downside of Cuberite is, without Java support, it doesn't have compatibility with Bukkit or Spigot plugins, so there is a vastly smaller ecosystem of plugins available, unlike Glowstone which can use many of them no problem.

Either way, both Glowstone and Cuberite servers, and Craft-based clients (shameless plug for NetCraft/WebSandboxMC), are very exciting and promising projects in my opinion. Personally I have not contributed to either recently, seeing this post I'm tempted to pick them up again, yet for better or worse I've moved onto other things. I'm certainly rooting for them to keep up their open source momentum, could turn into something very cool!
Thanks for this. Do product owners and developers get a sense of the product level threat model, e.g. "competitors reversing our code," "spammers will harvest our user identities," "a grad student is going to break this as their thesis project," or "a state level actor will try to establish persistence for Intel collection" ?
Followers of the religions which prohibit alcohol drinking would be pissed and may cause social unrest? and USA would not be a secular country anymore?

Edit: typos
Drinking and (often, necessary) driving are not comparable, so the commenter could have chosen a better comparison.

Edit: Based on comments in this thread, there are a lot of different perspectives on how comparable these two activities are. I still think there are many significantly "better" examples that could have been given.
The rule I learnt was aimer with people, adorer with everything else, and add bien to aimer for liking a person instead of love.
Running GPU-Accelerated Kubernetes Workloads on P3 and P2 EC2 Instances with EKS
It appeals to big structures, because they often have many clients but much less backend endpoints.

If you have one server side code base but targets the web, the mobile, an customer api, a desktop client and embeded devices, it's a net win.

However, if you just have web + mobile, the complexity may not be worth it.
I don't think this story is particularly limited to immigrants. I remember that when my grandfather died, I didn't know about it for two months because I was studying abroad and my mother "didn't want to upset me". Our family has been living in the Americas since the 1600s.

Coming from a smaller Southern town that existed to produce textiles--none of which are produced in the US anymore--I grew up relatively poor and without guanxi or even any role models and mentors to advise me. Only in the past decade since leaving college and living in a large US city do I see the huge deficits in my understanding and network that such a background creates.
Most of Scandinavia has no financial privacy. What people earn and how much tax they pay are published online. This would make penalties based on income much easier. The US values financial privacy much more. It's also a very different society. It's easy to imagine precisely what would happen if peoples incomes in the US were published.
Canonically, the Prisoners Dilema is a game with one round and each player has no idea what strategy the other player will employ; the one round is taken simultaneously. In this version, it doesn’t make sense to say “one prisoner defecting would cause every prisoner to defect.” That sounds more like the tit-for-tat strategy in multi round prisoners dilema.
I live near the busiest chic fil a in the country. If they didn't have the iPads it would be impossible to serve all the people.
Is Nautilus doing ok, since the problem a few months ago about paying writers? I've noticed lately that a lot of front-page articles are pulled from older issues, and they publish fewer articles every week. Also, I still haven't received any print issues in the mail this year. Maybe they are transitioning to a digital-only publication?
Because the very act of storing information in your brain gives it credence, even if you don't go through the extra effort to verify whether it is correct. With repeated exposure it can become a belief, even a belief so strong that you will hold onto it in the face of evidence it is false. This can happen to anyone; it's a fundamental feature of how our memory works.

It works especially well for information that does not affect you personally, because you're less likely to go through the extra effort to verify whether something is true.

If your boss tells you that your salary is $100k/year, you're going to check that on your paycheck!

If your boss tells you that garbage collectors make $100k a year, you might not believe it, but you might also not bother to put in the effort to check. But if you remember it later on, the very act of bringing it out of your memory will reinforce it to you.

And if you don't go specifically check on the accuracy, you're also more likely to rely on social signals like, who is telling me this? Is this a person who I identify with? Does it seem like a person or an institution I should trust?

In this case, you are reading a news article from TechCrunch, a well-known, successful, and long-running news site. Any information you read there comes wrapped in however much trust you associate with TechCrunch. So if a claim is passed on in an article, it comes with some level of default trust.

And even if you don't like TechCrunch, the default level of trust is affected just by the act of reading the article. By default we tend to trust ourselves, so when we do something (like read an article), the default trust is pushed above zero, just because we're the one who read it! This effect is why most people think they are above average drivers, for example.

So: reading an article about an ad campaign, that contains the ad and its claims, can affect how you feel about the advertised product... even though you know it's an article about an ad campaign!

In marketing this is called "earned media" and it is valuable because it hijacks your trust for the media source to support the ad claim. A spectacular example was the "Swift Boat Truth" ad against John Kerry, which barely ran on late night TV, but was widely covered by the news media. It had a huge impact on Kerry's campaign for president.
We maintain an Ember app that uses JSON API, as well as a graphQL schema that both touch the same data. JSON API is well suited to Ember, since it manages data relationships client-side with its heavy data layer. GraphQL makes the backend a bit more complex (but not overly so IMO), but the tradeoff is that it abstracts the backend better than JSON API and allows new clients to be spun up more quickly since the data aspect is already taken care of, and the clients only need to be a view layer.
I think the problem with it is it solves the transport but you still have to deal with the shape of the data.
Announcing ISO 27001, 27017, 27018 Certification and SOC2 Type I Attestation
Not everything, but North American cities need a lot more skyscrapers. Instead most North American cities sprawl.

Density increases innovation. Density decreases travel carbon emissions.
Can you elaborate on what you did and how it turned out for you?
That scenario obviously wouldn't be Facebook's fault, because any email address you sign up with is always going to be your primary email address unless you change it later. What I'm talking about is signing up with a non-delegated email address, and then adding a secondary email address for the purpose of either displaying publicly on my profile or so that my friends can find me via email in search.

In other words, cases where I had no intention of ever allowing a password reset request to be sent there, knew fully well that it wouldn't be safe, but did so anyway because Facebook provided zero indication that they would do this and it's not at all intuitive that they would.
Other than fixing the Django source code , is there any OS level mitigation techniques that can detect and prevent such security vulnerabilities?

I am thinking something like selinux, docker or chroot - a bit like internal firewall for Django (or any other webapp).

Any suggestions on the links to latest best practices?
Using Barman to Backup PostgreSQL – An Overview