skysight-inc/HackerNews huggingface dataset:
>CORS requires an HTTP header white listing allowed domains. If the attacker can modify the HTTP headers they don't need to modify the HTTP body in order to perform an attack.

The attacker owns evil.com. They can make it have any headers they want, and then javascript on yoursite.com or any other site is allowed to make ajax requests to it. (Of course, they'd still need to do a man-in-the-middle attack on yoursite.com to modify yoursite.com's javascript. They technically don't need to involve evil.com if they're MITMing yoursite.com as I mentioned at the end of my post above, but it is a technically possible thing for them to do.)

> First, the image needs to be requested using the same protocol that requested the page or it will notify the user of insecure assets.

The attacker can make evil.com use HTTPS if they need to. There's no restrictions stopping attackers from getting certificates for their own domains. HTTPS doesn't signify that the owner of the domain is trustworthy; it just signifies that the contents you receive from a URL weren't MITMed.

> Fourth, actually test this. When I test it I get a CORS error in the browser. Strangely, Chrome reports this as a warning instead of as an error, but the request is blocked and it never leaves the browser.

Did you test this on HN? HN uses an unusually restrictive Content-Security-Policy header to restrict where assets can be loaded from. It is a protection against this sort of attack, but only a weak one against a determined attacker who can manipulate page javascript or html: An attacker could make every element on the page be a link to evil.com?userdata=..., which a lot of users will probably click. The user might realize something is up, but the attacker has already gotten their data so it's a bad consolation prize. Also, in the specific case of MITM attacks, CSP is no help since an attacker can just strip the header off.

>No, that is not allowed by the browser and will throw an error. It violates same origin policy. If you can figure out how to break same origin policy Google will pay you $5000 for reporting a significant issue to their bug bounty.

(I don't mean to brag, but just to point out a possibly relevant credential: I have gotten a 4-digit bug bounty payment from Google before.)

If an attacker MITMs yoursite.com and modifies the javascript served by yoursite.com, then when a user navigates to yoursite.com, that javascript is allowed to connect to yoursite.com (or any domain that is served with CORS headers). The same origin policy is about preventing a domain from accessing domains that don't want to be accessed; it is not about preventing a domain from talking to anyone at all including itself. (Content-Security-Policy does focus on that, but it can be difficult to make bulletproof and should be treated as a defense-in-depth, and it's not relevant to MITM attacks at all since a MITM can just strip it.)
Quote from blog post[1] dated 14th June:

I really did not get anything for this bug, and I know I'm probably forfeiting an acknowledgement
too right now. But I wasted alot of time on this bug, and nobody but me should be able to decide
what to do with it. People who criticize this type of behavior I find frankly annoying.
I used to be one of those self-righteous types, but I'm also pretty annoying, so perhaps there is a correlation.

Besides, this bug is way to silly in its complexity to be of any use to anyone.
I would not drop a full 0day exploit, which I can assure you,
I have totally sitting on my hard drive (not referring to this bug :).

For the people wondering why she released the exploit instead of claiming bounty on it, in the blog post[1] dated 14th June, she said she would not drop a full 0day exploit. I guess that changed when she did not get credit for her last bug (cve-2018-8314) according to her another blog post[2] from Aug 17th.

[1] https://sandboxescaper.blogspot.com/2018/06/using-filepicker...

[2] https://sandboxescaper.blogspot.com/2018/08/all-good-things-...
They still have ads for the free version, just not based on your emails.
The problem is people don't want stuff on their face.

They tolerate glasses because they are a necessity for most wearers. But if you hang outside the LensCrafters store and ask people, nearly all would tell you they generally dislike wearing them[0].

[0] Yeah, I know, there are people who wear them for "fashion".
> bond prices fall as interest rates rise. You can avoid this by buying individual bonds and holding them until they mature (pay out their full value).

Isn't this the same fallacy as "buy and hold" stock strategies? Basically, it ignores opportunity cost? If the cost to sell the discounted bond is less than the upside of the better payout of a new bond, you should sell.
How would one interface with payment gateways without sending the cc #?

I get that you are not storing it in the clear, but what if I actually have to use it?
Win32 is the original API for writing 32 (and 64) bit software to run on Windows. WINE functions by providing a compatibility layer for Win32 API calls. If WINE evolves to a state that it can run enough of the nominally Windows-only programs that people need, there's no more need for Windows.
There’s something to be said about which parties favor encouraging or discouraging car use in cities or restrictions of motorized vehicles on the cycle paths (which the interview also did not really cover).

But you’re right...no one is discouraging biking.
It's good to call for transparency. Google has an effective monopoly on search so it's not just about me as an individual switching to ddg or something. Google can make and break media properties based on what are currently hidden and seemingly editorialized levers.

I'm not a fan of regulation but as a consumer I'm absolutely within my rights to ask Google tough questions.
Tanya Talks Tech: What Is Cyber Ladies?
I was amazed at how mellow everyone in Amsterdam seemed while riding their bikes.

In US cities, most cyclist act like they're in a race. They must run every stop sign, charge down every hill, graze every pedestrian... in downtown Amsterdam most people were going at a leisurely pace and if you get in their way, they just ding a little bell at you.
I am curious. Which points of that list didn't you consider in any way and at anytime - except for specific features of the land that would force you to take into account the possibility of earthquakes or flood - while building the house ?
Has anyone in the US considered flying overseas to get treatment done? Many hospitals in third world countries are cheaper and more humane.

Sure, you lose out on the ability to sue them if things go awry but where is the tradeoff between six figure debt at an old age vs paying $10000 to get the whole thing done?
Yes, and is that line of reasoning working? Are we as a society saving money doing it that way?

It seems what people really need is just a savings account and some incentive to actually save money for future expenses (because knowing that someday you are going to get an illness that 100% of people get apparently isn't enough motivation).
What do you think are the ills of errors.Wrap?
And yet you still haven't answered his question.

This[0] is the democratic party platform. Can you point to the portion that says "White people; Check your privilege"?

If you were not talking about the democratic party, as I've assumed you are, I'm sure you can find the party platform of the group you are referencing.

[0]: http://s3.amazonaws.com/uploads.democrats.org/Downloads/2016...
We're so far away from being done it's not an applicable question just yet, but it may not be possible to know if there's something outside our ability to comprehend or perceive, even with sophisticated measuring tools.

We would have to settle for merely being able to explain every single phenomena in the observable universe at every scale.
> This is not correct, as I understand it. Under the ACA (Obamacare), health plan providers had to ensure that at least 80% of premiums were paid out for patient services. That leaves 20% for overheard, including profit and compensation.

Doesn't this imply that it's in the interest of health plan providers for patient services in general to be as expensive as possible? That means premiums will have to be correspondingly high, and the 20% available for profit and compensation will be larger.
Laptops with OLED monitors
Startup literature about MVPs is mostly relevant to software products, which are inexpensive to develop compared to almost anything else.
Buy them this: https://www.amazon.com/Charlie-Rendezvous-Memphis-Original-S...

It's from Rendezvous in Memphis. Not the best barbeque in Memphis, but it's world-famous, and a good example of the style. It's impossible to find properly cooked Memphis style ribs outside of Memphis (you'll find it on menus, but it's always garbage). If you want a bbq sauce that's special and consistent, this works.
Better Mastodon: Layout and design tweaks for the Mastodon web app
From what I'm seeing, moving from terrible insulation to decent insulation is an excellent idea.

Moving from decent insulation to excellent insulation... maybe not so much. There is a point of diminishing returns where more R values in your insulation does not gain you much.

According to this fact sheet from the North Carolina energy office:
https://files.nc.gov/ncdeq/Environmental%20Assistance%20and%...

"Insulation installation which brings a building up to standard can result in a savings of 1—5% of HVAC costs depending on the conditions before the improvements are implemented."

However, if you combine insulation with inspecting ductwork / windows / doors / attics and plugging as many air leaks as practically possible, the estimated savings rate rises considerably. Energystar's site (https://www.energystar.gov/index.cfm?c=home_sealing.hm_impro...) for instance estimates 11% of utility bill savings with a combination of methods.
And then the caller has to either check or ignore the error. The error never propagates to the caller's caller without an explicit action in the caller. That is unlike exceptions.
That's because your winter is more extreme. In any modestly hot country, electricity consumption peaks in summer.
I have no idea what you're writing about.
Wow I was in HVAC for 15 years and NEVER heard about 'greenfreeze' WOW.

Thanks for links!
> There was a major upgrade in 2013-2015 which doubled the energy (from 3.5 TeV per beam to 6.5 TeV per beam)

Yeah, that was the splice consolidation.

> but the luminosity was increased in 2016 and 2017 as well.

From what I know, that's through conditioning, repairs and improved techniques (BCMS, ATS, anti-levelling). The increase from 2015 to 2016 was because they didn't finish the intensity ramp in 2015 as the scrubbing campaign lasted so long. 2016 had the TIDVG dump problem as well as outgassing from the injection kickers. 2017 was marred by 16L2.
There's a lot to unpack here. First, neither party has the trust of the working class, whatever the rhetoric. Second, the candidate that talked about fixing the system, including healthcare, won -- that he was actually talking about breaking it further gets lost in the discourse around both candidates. There's a longer discussion to be had about how to build trust and what can be done about broken political systems, but it's not the parties that can act on that at this moment.

It will take something like the union/wildcat teachers' strikes, that forced Republican majorities with unified control of state governments to raise wages and increase funding, to do anything about healthcare or the many other structural challenges we face as a nation.
This is just an argument for diversification. Hold the world at market cap and you'll only lose money if the whole world's markets crash and stay down for decades. And if that happens, I'm not sure bonds are going to keep you from hurting.
I have one of these and a Hololens. Basically the ML1 is incremental improvement. There are still no mainstream consumer use cases that are plausible.
I don't think anyone here is asking for 10 dollar education, by affordable we want an education that won't take us wage slavery over a million years to pay back with potential interest also contributing towards that elongated time. Job security is always shaky especially out of high demand fields, so that is a factor in determining the 'unaffordability', if you can't pay it back and can't land the actual wage to live a life while being a wage slave then it's simply unacceptable.

public schools are also plagued with debt collectively, what a way to attempt red herring.
TLDR: Minneapolis uses 3.5x the energy of Miami for climate control.
NASA releases thousands of hours of Apollo 11 mission audio
Most people don't even know what parametric polymorphism is, let alone have ever used a language that supports it. I find it's basically impossible to explain just how powerful of a tool it is to someone who lacks experience using it.
If the user is trying to access https://example.com, and an attacker redirects the TCP connection (or fakes a response to the DNS query so the user gets the wrong IP address) to a server that doesn't have the private key for example.com's HTTPS certificate, then the HTTPS connection will fail. The attacker is unable to serve their own content to the user as "https://example.com". HTTPS doesn't just encrypt the connection, but also authenticates the integrity of connections as being from the domain they claim to be from.
If you use Emacs, AuCTeX provides this type of functionality
The more traditional email interface on Hotmail/outlook.com isn't bad either. Gmail doesn't even show me the subject line by default when I'm replying.
> As a dutch person I would absolutely NOT want to ride a bike in the US, it's simply too dangerous.

I understand this perspective, but as a counter to this, if no one bikes in the US then this won't change. I ride all over San Francisco. In the last 18 years of me living here things have gotten better and better for the cyclist, but there are still many areas that can be improved. I encourage you to support local organizations, like the San Francisco Bicycle Coalition, which can pressure local governments to make changes that improve safety for all cyclists.

For too long in the US we've designed our roads with the idea that cars have some right to the road that others do not. We're finally starting to rectify that in cities across the country, and it's only getting better.
It's not about lying. It's about using weapons of mass destruction. Only one country did this. Twice.

It was not China. You guys are just used to the devil you know, and scared of the devil you don't know. I am also in a way. But worrying about China having a virus? What do you think the US have?

Both China and US will blame any virus on someone else if it comes out to play.
The model isn't as complex as the universe in that sense, but filling out that model with the exact state of the entire universe would be. Just like how a chaotic function can be very simple, but give rise to incredibly complex outputs.
I took levofloxacin for a week about two years ago, for a very annoying infection that had lasted for months. The infection just disappeared within one or two days, and I didn't get any side effects. Writing this here just to add some "negative" report- I wonder how many of the hundreds who are reading this thread took a fluoroquinolone in the past and simply have nothing bad to report. Still, to be clear, I wouldn't take it again, but the probabilities of getting serious damage are probably rather low.
I believe you're think RFC 6018: https://tools.ietf.org/html/rfc6108

Related HN discussion: https://news.ycombinator.com/item?id=15890551
Ask HN: Examples of projects/analyses using publicly accessible health data?
I've been trying to find a project or do an analysis on publicly available health data. I'm looking for prior examples to use as inspiration.
Sounds perfect: if they have to pay out, they’ll go burn someone else’s building down instead.
No, it’s not culturally important. It’s foolish and needs to be abolished.
Instead of coding the bots with the rules of Dota 2, they’re thrown into the game and left to figure things out for themselves

I saw a strange behaviour. In the second game, I saw witch doctor use "Maledict" on neutral creeps, but this skill only affects enemy heroes. This only waste mana, put the skill in cool down and have no benefit. How can AI learn it?
Looks like they're solving a sales and distribution problem, not one of technical innovation.
It should be noted that the influenza virus has 8 segments, so those 8 released segments from a patient represent the entire flu genome.
That's a unfortunate state of affairs.
Within the NHS specifically, there was the recent case of Alfie Evans[0], where the medical practitioners said there was no hope for him and the family wanted to take him abroad for care. The NHS and the UK legal system decided that his best interests were to die in the UK. His family was not allowed to take him for additional care.

0. https://en.wikipedia.org/wiki/Alfie_Evans_case
False dichotomy. I guess some of those private schools don't teach rudiments of logic and debate. The idea is that we would have more resources and motivation to fix the hellholes, which should never have been allowed to become such in the fist place. Also, not every public school is a hellhole. The public high school in my town beats most elite private schools by any measure.

Points to you and your friends for consistency of messaging, though. Guess you all read the same websites.
I agree, but what if you don't care about inexpensive? Seems pretty much everything available newish construction has been cost-optimized to absurd levels.

What if I want to build a European-style concrete or stone building, that will still be standing in 300 years? Not a throwaway structure that has a 50 year designed lifespan?

I was looking at new construction (or a full gut rehab of an older 1800's building) and it's just real hard to find any contractors even interested in the "quality" angle.
I completely disagree. The reason insurance pays for the small things is to encourage people to seek treatment early because it’s cheaper in the long run. Almost nobody would pay hundreds for a cancer screening like mammogram or colonoscopy that they don’t believe they need, but catching these things early is orders of magnitude better both for health and financial outcomes.

Insurance covering a minor infection prevents needing to handle a major infection. Your system assumes humans are rational and a good judge of risk, something that has proven to be untrue countless times.
Ask HN: Resource to outsource the business side of starting a side project?
I've had a couple side project ideas (either turning one of my existing open source projects into a SAAS business, or starting a couple new ones). But I work full time. I'm looking for a company that I can outsource the customer handling (payments, refunds, possibly support triage), for a share of the income (even if that is a significant share).

Or would I be better off finding a business partner, where I'd handle the technical side? Basically I'm concerned about making sure I'm following applicable laws, liability, insurance (if needed), and this is even before I get to the point of validating that there is a market for the ideas.
The Red Queen of Palenque
Yes, the various fmt.Print functions only return an error if Write on the underlying Writer returns an error.
> Of course I know effort is probably not a valid criteria but still, it's sometimes hard not to see what appears to be low-effort generative art as barely more than the random dot/line/rectangle exercise most programmers do early in their learning.

You aren't making art because art does require effort. You have to put some thought into the product you want and then work towards it and make the thing that feels right to you.

If you never have an emotional connection to your work, it's no wonder you don't feel like you haven't made art, because you haven't.

This isn't to be mean. You could easily begin to make art, by creating your works with an eye towards purpose or feeling and demanding that what you make satisfies you. Then you'll be making art. But pointless generative stuff is just doodling, as you think. It'd be the same with a pen and paper as it is with code.
Get off the red paths and we're good. Jokes (?) aside, I don't think that's because of the cyclist profile but more about the people in the Netherlands in general. People are just not in a rush.
The Netherlands are (is?) also very flat. If you go up a tower with a viewing area in one of the bigger cities, you'll see what I mean. You can see really far in the horizon! Maybe it's just easier to bike there so more people do it?
I would say that is because in the US only the people most into biking use their bikes to commute. They have to want to bike enough to put up with no bike lanes and such. This attracts people who want to ride fast, there is also very little community to hold each other accountable for riding like that.
Helmet does not help in high speed crash with car and is not designed for it. It helps in small falls.
Agreed. I don't blame anybody for not wanting to ride in the city. But I've been in SF since 2000 and I'm amazed at the progress that has been made in this direction. (Thanks in no small part to the SFBC.)

And these improvements are happening all over the US. I've been pleasantly surprised to re-visit places and see how much progress has been made.
Tesla launches wireless charger not for your car but for your iPhone
Seems like the problem is broadly in the medical sector (including pharmacological). There is 0 reasons why it would cost over $1. Maybe $2. $40 is still way ridiculous. I mean in a competitive market.
Competition isn't likely everywhere, though. Rural areas, for instance, probably could not support more than one hospital.
Which Companies Have the Highest Gross Profit per Employee?
Of course third 3rd party don't need VGS, you will send tokenized data through forward proxy, and at the other end they will receive real data. That is the usability.
Ok, here's one list, I'm sure it isn't comprehensive: http://ourmed.org/wiki/List_of_medical_emergencies

So for each item on this list you'll need to find out every possible treatment and drug and what they cost at every hospital within ~50 miles. Make sure you look up allergies and any side effects when combined with medication you regularly take, you don't want to be in a situation where you listed Hospital X for meningitis, but their cheap drug can't be combined with your asthma medication, or whatever.

And again, how often do you update this will? And what about travel?

Is there anything else in your life that you shop around for in case of emergency?
If you want to build with concrete, look into ICF (insulated concrete forms). These are foam panels that easily fasten together make the forms. After the concrete is poured, the forms stay in place to form the insulation. If you are handy, you could probably do the pour yourself with friends and family, saving you a lot of money.
This story will never make it on HN
I seem to recall from a geography A-level course about 35 years ago in the UK that historically Los Angeles' spread was something to do with the city fathers offering incentives to adjoining communities to become part of Los Angeles - something like 'call yourself Los Angeles and we'll give you access to our water or electrical grid'.

Is that right? A bit hazy after all this time.