skysight-inc/HackerNews huggingface dataset:
Amazon doesn’t have the entertainment brand that Netflix has nor the consumer dedication to the brand. People use amazon because it’s ubiquitous, inexpensive, and has good customer service. People love Netflix.
It’s not, but this argument comes up for absolutely everything Scandinavian countries do: universal healthcare? America’s too big. Prison reform? America’s too big. Not treating poor people like garbage? America’s too big. Oftentimes there isn’t even any reasoning behind why America’s size would be a problem, which is a good clue that the argument is bunkum.
Fast and easy way to track personal finances with extended reports and high security.
So, this was simply taking advantage of a crash-prone webapp running on a debug-enabled Django instance using Pickle session serialization, and more specifically this was only possible because _Django didn't redact the stored secret key used to sign serialized inputs out of the crashdump information!_

Did the author tell Django about this yet, or is this a (possibly unintentional) 0-day?

Besides the above interestingness, the morals of this story I get are

- Stay persistent and leave your scanners running; you never know what new things will turn up.

- Crashdumps _are_ interesting

- Yay, $5,000!

- Middleware and frameworks will always clash in useful and interesting ways?
For Apple you are the customer and they sell HW and services and have a vested interest in keeping your data safe. For companies like Google and FB you are the product.
The burned hand teaches best.
>If not, I don't see how this would be a problem. If your income is X times higher than mine, you will be fined X times more. Given your income, you can afford it, but it is still a deterrent (I, on the other hand, would go back to square "minus one" if I had to pay the same amount as you).

The way this is likely to work in reality if that you go to square minus one if you get fined and I go to square minus one if I get fined. So we've gained nothing except screwing more people and making the state more dependent on revenue from fines. Fines never go down, only up. An income based system would mean we all get screwed.

I have no problem with income based fines on paper. I have zero faith in their ability to be used properly in the US. Better to just lower fines across the board. It's not like the threat of a fine is what's keeping the vast majority of people from driving at triple digit speeds or littering.
I had a brief flash of a story fragment.

We enter the scene with Josh, one of the last drivers. He will sometimes pass self driving cars in regions of low data coverage for kicks... people hate the reports so much that special tech has been created to mask driver and car identity from the autocars after so many were mandated to surrender their licenses.

And that made me think of traffic enforcement. These cars could just start reporting all the non compliant ones, human driven ones, for liability management reasons.
MessagePack: It's like JSON. but fast and small
On the melatonin I would add that studies have shown negligible increase in effectiveness over 0.3mg. Yes, most pharma stores offer only 3mg and above, but that seems to be wrong.

Personally I've only taken melatonin when I most needed it, and then gave up on it. You should try giving it up, too, unless you really can't do without it.

You should check the vitamin D level, too, whenever you do your next blood test.

As for curcumin, the Longvida formula seems to be most effective. I can't say I've noticed any effects from it myself, but I haven't taken it daily, and I've also read that you need to take curcumin for 2+ weeks to see the effects.

https://www.turmericforhealth.com/curcumin-benefits-and-dosa...
has anyone used JSON API? How does it compare to graphql? Did you find JSON API was better until you hit a certain size?
This song was generated by over 100,000 micro-votes (from internet participants)
I don’t know what you had in mind for “large”, but I can tell you how it’s working out for us.

- Most customers write design docs/tickets. This helps because we can suggest alternative approaches early. It’s rare that we tell people that an idea is fundamentally flawed, but it’s common that we suggest a different implementation approach or additional safeguards.

- We review individual PRs. Here, we're looking for concrete individual appsec concerns (or infrasec if it’s a Terraform PR for example). Not the right place to have overarching product design conversations.

One concern is that there are just too many PRs for a fledgling security team to review every single one. For this we rely on 2 mechanisms:

1) IC opt-in (they tag us on GitHub via @CLIENT/security when they would like a set of eyes on something or if a PR is part of a product change we’ve been involved in)

2) Automated heuristics. These have a hair trigger: lots of false positives. It’s just stuff like “are you adding middleware?”, “are you adding an endpoint?”, et cetera. That’s OK, because we don’t make it a gating part of CI: its job is to turn 100 PRs for us to look at into 10 PRs for us to skim and make a decision if it’s the 1 PR that deserves extensive scrutiny.

So, overall: stop thinking of yourself as a gatekeeper and start thinking of yourself as an advisor. Our job is to make sure you understand what you’re doing and what your alternatives are. Security is never the only requirement: you have a business to run.
Getting Started with React – An Overview and Walkthrough
A training program is an excellent idea. Thank you very much - that helps me a lot.
Yeah only if you are leftist whiny cuck. Obviously the position is not limited by gender.
To be fair, poor generalisation is not a problem of NLP, but of NLP using deep
neural networks, which is a very recent phenomenon, following from the success
of deep learning for image and speech processing.

If you asked me (you shouldn't, I'm biased), I'd tell you that we're never going to get deep
neural nets to behave well enough to learn meaning. Those damn things are way
too smart for us. They're so smart that they can always find the easiest,
dumbest way to map inputs to outputs- by simply overfitting to their training
set (or their entire data set, if cross-validation is thorough enough). You
can see lots of examples of that in the article above.

The big promise of deep learning was (and is) that it would free us from the
drudgery of feature engineering- but, the amount of work you need to do to
convince a deep net to learn what you want it to, rather than what it wants to
learn, is starting to approach that of hand-crafting features.

And we still don't have language models that make any sense at all.
Life as a technical writer – 2018
previously: https://news.ycombinator.com/item?id=17822676
I live in Michigan, where PFAS are being found in water supplies all over the state. Companies did and still do dump poisonous chemicals into the environment, and day by day certain alphabet soup agencies give them more and more license to do so. We can talk about some garbage along a river bank after we prosecute large companies for knowingly poisoning entire swaths of land and bodies of water for decades, considering the scale on which they can harm people and the resources they have to avoid doing so.
Multimodal Sentiment Analysis with TensorFlow
Just saying, you all again say that iphone, ipad are easier, etc. but this is wrong. All my friends use Android.

They don't install almost any apps, and if they want they ask me.

My GrandMa can't use any new phone they stick to the old one because the new one are too complex, they want button and not touchscreen.

Apple is the worst.
Crocs create static charges on synthetic carpet - making them dangerous for machinery?

https://www.telegraph.co.uk/news/uknews/1562190/Hospital-ban...
No doubt you'll be able to buy cheap knock-offs in certain 3rd world street markets and bazaars within a month.
I agree the story is hardly about the action but about politics, religion, fanaticism, will power etc. The important parts are in the details and will be hard to be put in a movie. More time is needed to develop the characters than what's available in a movies length.
If I remember correctly, Django only shows these information if left in debug mode. Needless to say, this should never be used in production.
Isn't government the quintessential "single place" or "platform" problem?
Moving from Gulp to Webpack
Django is pretty serious about warning you of the risks of this [1]. I think in this case the key was in some third party options variable so the bug is there. The sentry thing sounds like an internal bug to Facebook rather than a django issue.

[1] https://docs.djangoproject.com/en/2.1/topics/http/sessions/#...
In contrast, I submitted a bad vulnerability in Facebook’s password reset feature yesterday that lets attacker’s send password reset PIN numbers to email addresses the user doesn’t necessarily control. The security team said to works as designed so they’re not going to fix it.

Basically if someone requests a password reset on your account then the PIN number gets sent to all email addresses associated with your account, not only the primary one. This is an issue because many people have one locked down email address for things like registering accounts, but others they use to talk with people, delegate to their staff, use with CRM apps, etc. (But you still need your everyday email addresses linked to your account so that people can find you by email, see your email on your profile, etc.)

The FB security team just says that delegating your email address isn’t secure so it’s not their problem. Like no shit, that’s why it’s a vulnerability. But for some reason the FB security team thinks it’s a good idea to let anyone immediately bypass 2FA and hijack your account.
In this article: “...CV-1 on a 1970s Soviet hatchback, the IZh 2125 "Kombi"...” I would say, it’s bigger challenge for them to create modern car, than an electric one.
Sessions vs. Token based authentication
Sue in small claims court.

I expect that Google will lose and you’ll get your money.
All art, like all things, is ephemeral. Burning Man just makes this explicit.
Nice job! I also really appreciate the lack of memes and very concise format of this blog post
The author of the article thought so.

> ... They owned Best Products, a catalogue retailer that sold discounted goods in hybrid showroom/warehouses (sort of like Ikea). Selling everything from hair dryers to toaster ovens to doll-houses, they were proto-big box stores ...
I think he meant well... Let me ask the OP to change it...
There's no trash removal for these people, and they're shut out of all public bathrooms. What do we really expect?

i-5 in Seattle is absolutely trashed from Northgate to Downtown because Jenny Durkan and previous mayors have raided homeless encampments out of view, away from other homes, spending millions of dollars to displace them instead of just giving them garbage cans and a few porta potties. They end up on i5 and in tent camps downtown and it looks like a dump.
I don't see why "rich UI/UX-based applications" is listed as "mobile-first". Sure, GraphQL is probably great for highly dynamic client applications, but why would that be limited to mobile?

As far as I can tell, GraphQL primarily allows you to trade client flexibility for back-end complexity. If you're willing to take the additional complexity on the back-end, GraphQL allows you API clients to iterate far quicker, and removes (or at least lessens) the dependency of the client on the team maintaining the back-end. If that's not worth it to you, don't use GraphQL.
Great comment. This is very true. People who drive cars are more likely to die from injuries than people who stay at home.
Just saw this but so awesome, thanks a bunch!
This is a great concrete example why you should never run debug mode on a public server. Django can only do so much for redacting private info. This is also a great example of how insecure pickle is!
True enough, but having a history doesn't make one "high-class". I do know part of my genealogy up to a landed gentry nobleman who wreaked havoc in Germany and Prague in the 30-year war on behalf of the Swedish king, but still my father was born to a tenant farmer family.

But you may have a point that apparently the social differences are smaller small countries and communities where genealogy is better known. To take an example, in Iceland, there is extremely good genealogical data about everyone for over a millennium. Social differences are not very big and were not that big even before the adoption of modern welfare state.
I'm a technical writer. I write the docs for Chrome DevTools and Lighthouse.

The tips in this article are mostly fine. Nothing controversial there. It has some good advice, but ironically, the article itself doesn't follow its own advice.

> The first two paragraphs must state the most important information.

The most crucial skill for creating quality documentation is to know your audience and then write for that particular audience. What knowledge are they bringing into the doc (and therefore you don't need to cover)? What knowledge are you assuming that they know? What if they don't have that knowledge? Hint: They'll probably find your doc confusing and frustrating. What is their likely emotional state going into a doc? E.g. if you're documenting an error code there's a higher chance that they're panicked, so don't waste their time! Given a particular audience, what exactly is "the most critical information"?

"Know thy audience" is one of those concepts where, the more you think about it, the less you realize you know. It's a lifelong journey. But the more you focus on this concept, the better all of your communication will get.

I could go on for years about all sorts of interesting tips for improving your writing, but it's all a waste of time if you don't have an overarching guiding principle. And that principle is to know and write for your audience.
Why would one choose GraphQL over gRPC for a native iOS / Android app?
Sorry, I'll try to do a better job to answer your question in there next time I see it.
People are afraid of rightwing ideologues on the Supreme Court because it means that certain cases might be reasoned from a point of view that is based less on sound legal philosophy and more on personal beliefs from the 1800s.
Former Asterisk guy here!

The industry needed this consolidation 10 years ago.

Glad to see it’s finally happening. So much talent has left the space now that it absolutely had to happen.

Sangoma is a great company and I’m sure they will do a great job.
Seems like a huge hack. What we really need is some kind of etcd for telecoms, where you just configure it and they replicate and share state automatically.
One huge benefit is that the client controls the response shape and the same server will power multiple different response schemes without requiring any changes. Very nice for supporting N types of clients.
We use AppScan from IBM.
https://www.ibm.com/security/application-security/appscan
I work in the USA and also answer "never" to all of the above. Regarding the last bullet point, I've helped to change general processes in almost every place that I've ever worked. I'm genuinely curious to hear from folks who have experienced these bullet points: where did you work at the time?
Or maybe we should stop being such snowflakes.
There's a big difference between having a beer after a hard day at work and actual alcohol dependency. One is harmless (and possible harm-reducing), the other destroys lives and relationships.

We need to be able to differentiate between the two without conflating them.
Map of Books Related to “Cracking the Coding Interview”
Their business is in the decline I would imagine.

As others have stated, their features are now found in many low cost proprietary solutions.

No reason to pay a tax to use open source unless you believe in it.
http://ww1.microchip.com/downloads/en/DeviceDoc/20005927A.pd...
To wash it all away [pdf; 2014]
Non-AMP version: https://www.bloomberg.com/news/articles/2018-08-24/kalashnik...
If you become part of an established camp that contributes significant art or experiences back to the community BMorg also offers directed group sales allowing your key contributing members to skip the lottery at the regular price.
Trump Takes Aim at China, Questioning International Postal Rates
Correct me if I'm wrong, but having read around the topic of GraphQL with a slowly-changing, largely static catalogue type appication in mind (ideal fit for CDN in front of REST); I remember a few horror stories around GraphQL not being CDN-friendly.

Perhaps if you have a dynamic or real-time data-lake or messaging-style app with quickly-stale data that would need to be talking to regional server clusters anyway, then GraphQL has benefits on top for schema independence etc. But I wonder if its CDN caching story has improved (not just client-side as mentioned.)
I'm not so sure. There can be very strong and specific, sometimes illegal favours done for people within one's network that one is obligated to repay and there seem to be specific rules.

We might have the term 'favours for favours' but I don't even like that.

I do favours because if it's easy for me to help someone, I do that. I don't expect anything in return. Maybe if one day I need something obviously it makes it easier to ask, but it's not what I'm thinking of.

I think most regular people are thinking in these terms, i.e. we're not constantly keeping track of sour social clout within a specific network. Frankly I don't even like the people that do.
Does anyone know how GraphQL manages (or if it even can) to sort and filter across microservices? It seems impossible to me to do from any client. If you have a list view that is made up of data from microservice a, b, and c and you try to sort on a column from microservice b, how does microservice b know how to sort then data when there are additional constraints applied to data on other microservices such as a filter applied to microservice a. Does that make sense?

Basically I feel very frustrated when it comes to sorting and filtering across microservices, some people at work think that GraphQL will solve this and I have found absolutely nothing to support the claim that it would help us with this. Thoughts?
This is the only plausible explanation to me as well.
Lochner Era 2.0!
Technical writers call this "information architecture".

Hierarchical organization is tough. E.g. if you're working on a docs site, and you have a multi-level nav, what's the best way to organize that nav? Same problem with organizing the directories in a company's intranet.

One idea that is influential within the technical writing community is to "treat every page as page one" [1]. Because of Search, you never know how people will first access your docs. So you always structure every page to handle one topic, and only one topic, thoroughly. And then link profusely to other docs that the user might be interested in.

[1] https://everypageispageone.com/the-book/
I agree with fsloth, but if you've made it to 29 without seeing some shit, I think you're the kind of person likely to make it to 40 without seeing shit either.
The thing is though that most of the materials in that list can still be used in ways that don't incur risk. Just because making your water system out of a toxic metal is a bad idea doesn't mean you should outlaw the use of fishing weights and lead-acid batteries, in the same way the banning the shoving of asbestos into every corner of a house doesn't mean you have to also stop using it in firefighting equipment.
My One-Person SaaS Side Project Celebrates Its Third Birthday
This subthread is UK specific, so the number in jail for non-payment of bail is zero.

Probable cause isn't a UK test -- we use [reasonable] suspicion -- but one needs far more evidence than that to retain someone in prison. CPS don't take cases to trial without an expectation of success; non serious crimes (and some serious ones) don't result in prison so aren't pertinent.

Suspicion is an even lower bar, but the charge officer won't even admit someone into custody without evidence (though that evidence has a far lower bar than is required for conviction).

So you get out 24 hrs later, the police caught the perp who just happened to match your description and locality. Surely the downside is just part of society functioning, do you really need compensating? Legal protection for your job, seems like it should be in place though.
Most of the “honesty” comes from iOS and it’s just a better thought out model than Android when they introduce new features.

Ad Blockers - the framework is built in a way that third party ad blockers can be installed but they don’t have access to your browsing history. They basically just submit a JSON file that is integrated into Safari and some types of web views

Third party keyboards - because of the opportunity of keyloggers, you have to explicitly go into settings to install one, then you have to give it permission to access the network as a separate step after a huge warning, and even then when you enter a password, iOS switches back to the default keyboard.

SafariViewController - with traditional embedded webviews, the hosting app has complete access to everything you are doing. The SafariViewController runs as a separate process.

The only way that an app on Android can (could?) know if it should stop playing sound was to ask for full permissions to access your phone state.

Why does any app need full access to my storage like Android allows? With iOS, an app has full access to its own file store in iCloud, you can grant it access to your photo library or music library (read only) but it’s very explicit. Any other document outside of those, the user explicitly tells it what file to open.

Why would I ever give a third party app access to my SMS messages? Why is that even an option on Android?

I download stuff without regard on my iPhone because I know that it can’t do anything crazy.

Even if SpyPhone didn’t go through any review process, it’s a track surface is limited on non jailbroken iOS devices.
And any mention of Perfume wouldn't be complemete without mentioning the Nirvana song Scentless Apprentice. https://www.youtube.com/watch?v=GYPDJg9mz1g
Code/PR reviews (by other devs and by people who specialize in application security), static analysis, secure coding practices training, constant vulnerability assessments and penetration testing, and a strong security team who understands the need to balance productivity and security.

Really, above all else it's just hiring or contracting (ideally hiring) good security people. Good appsec people to review code and look for vulns, people who just do education and training, people who just do penetration testing, people who just do security architecture and tooling. And of course a good security operations and incident response team to deal with the day-to-day "frontline" defense, investigation, and response. If they are full-time employees who are integrated with the company culture and are experienced enough with agile development, then odds are they're not going to set up more red tape than is necessary.

If security is mostly offloaded to devs or operations and no independent security org exists at your company, you're in trouble.