skysight-inc/HackerNews huggingface dataset:
> "Most trips" doesn't work, the EV proponents want a ban on all ICE cars.

Politics is all about compromise. You actually have to start out at an extreme position so that when you meet in the middle at the end, it's still somewhat reasonable.

There will be bans on ICE cars at some point, but with a lot of footnotes.
I watched "The Bank That Almost Broke Britain" about the RBS debacle and it seems a bit rich for bankers to be calling anyone cowboys:

https://www.bbc.co.uk/programmes/b0bmbhzb
I stand corrected, thanks.

Supermicro's vendors they use in their Chinese manufacutring are the likely vectors for the implantation.
The Chinese government didn’t directly address questions about manipulation of Supermicro servers, issuing a statement that read, in part, “Supply chain safety in cyberspace is an issue of common concern, and China is also a victim.”

Essentially China ils saying "it was not me". Plausible
Own people? No way! Wrong! How could you ever entertain this notion!

Rent people at sub-subsistence wages? I guess it's okay.
https://basecamp.com/customers mentions "100,000+ companies rely on Basecamp to run their business." Since it does not mention "1,000,000+ companies", I think that "2.8 million accounts" refers to users, not companies.

Although current pricing for Basecamp 3 is $99/month (for unlimited amount of projects), previous Basecamp versions (Classic and 2) had other pricing models. Significantly cheaper when you were managing less projects, a bit more expensive for more than 100 projects, IIRC.

Basecamp / 37signals also has paying users for some other applications, e.g., Highrise (CRM, 10,000+ organizations, but closed for new signups), Campfire (instant messaging, closed for new signups), Backpack (intranet for businesses, closed for new signups). They continue to provide those services though, "until the end of the internet" :-)

So, in short... it's not as simple as 2.5 million times 99 USD.

Ignoring paid accounts for the other products, and severely underestimating the number of accounts at the 99 dollar level as 75,000, the monthly revenue could be 7.5 million dollar per month minimally, or 90 million per year. I would guess the actual number is twice that. Either way, it's impressive by any comparison.
HiQ. A CSS framework for the age of CSS variables, flex, and grid
In both cases the views are largely correct; end users aren't the main or motivating purchasers for lots of the industry, their employers are, so the users literally are not the customers, and often have interests poorly aligned with the actual customers.
AI Superpowers: China, Silicon Valley and the New World Order
Effectively nothing can be constrained by a whitelisting firewall if you have a sufficiently bored actor. You can smuggle data through a variety of benign looking protocols, things that wouldn't matter in the least generally. Your average server contacts hundreds of different public NTP servers, binary repositories, domain name servers every day. If the keys to the kingdom are a 32 byte ECDSA private key, you've lost if you think you can protect this from reaching the outside world.

A method that wouldn't show up on any firewall in the world is simply to delay or drop certain SYN packets. Even if you only intended to transmit a bit at a time through this, any unauthenticated host on the internet could use this without raising any suspicion or even printing log lines in most environments. As soon are you're making an assumption that you're trying to prevent what's inside from getting out things become substantially closer to impossible than anybody would like.
Right so all the stars need to align for it to go unnoticed - compromised server, firewall and other alerting/monitoring tools.

I would have thought one single unexpected packet in these high security environments would raise significant alarm bells and any anomaly would be found very quickly.
I'm not a parent but I would encourage parents to try and challenge their children to do things beyond their comfort zone, whether that's academically, socially, physically or otherwise. Some of the most valuable lessons a parent can impart on a child is confidence and resilience and challenging kids to do things they are scared of helps impart this wisdom.
Why am I not surprised that they somehow managed to turn it around to be sexist towards women? I'm honestly surprised that it was even considered to also be sexist towards men. Either way, this seems like an overreaction. I don't know anybody who I believe would be offended by that meme, so I don't see a need to make a big deal out of that.

EDIT: I wrote the above after reading just the first paragraph. After reading just two more, I have to correct myself: I am disgusted at what the article paints as the most common reaction, that the meme is mostly sexist towards women.

Bt! There's so many ways in which that's just a grotesque misrepresentation, most importantly that the man is clearly the "bad guy" in the situation.

EDIT 2:

The article quotes the company in question:

"Everyone who follows the internet and meme culture knows how the meme is used and interpreted. [Whether someone is a] man, woman or neutral gender is often irrelevant in this context. We are an internet company and are conversant in this, as are those who would look for a job with us, so we turned to that target group [...] If we should be punished for anything, it's for using an old and tired meme."

It's interesting to see their perspective on things. The sentiment that in the internet it gender is "irrelevant" is ironically the less sexist view of the two, and the fact that they used the chance to state that they are interested in employing people who share that idea was probably a really good idea. It seems like they are showing a giant middle finger to both those who attack them for made up reasons and actual sexists. Brilliant. (Though arguable, the accusations that the meme is sexist towards women is also rather sexist, in that it completely ignores/accepts the image that men are dumb and only act based on their sex drive, have no respect at all for their partners and are the gender that is more likely to cheat)
Clojurescript is quite nice in avoiding the whole webpack/npm/grunt/gulp/... build and dependency tooling evolution nonsense. There are a few other compile-to-javascript environments that are as good by now I suspect if you don't like parens as much.

However, I agree that server-side rendering is much simpler in all of the cases where desktop app-like experience isn't required.
I wonder what a thought ad-blocker would look like. Maybe a tin foil hat :)
I'm not trying to push OCaml specifically, I'm just using it as an example of a "normal" language. I'd consider most languages (e.g. Python, TCL, Ruby, Java, Lisp, Haskell...) to be "smaller" than C; indeed the only languages I can think of that feel "bigger" are C++ and Perl.
MIT student: reinvents wheel

MIT press office: "MIT researchers develop matter transporter"
OpenBMC (Facebook, Google, Microsoft, Intel, IBM and others) is working on open-source baseboard management software, https://www.linuxfoundation.org/blog/2018/03/openbmc-project...

> The organizations behind the new project each have already made substantial contributions to creating open source baseboard management controller (BMC) firmware. Now, working together, they will define the vision for a standard stack that can be used across systems and computing environments.

LinuxBoot and Open Compute OSF are working on open-source server firmware that can be measured on every boot and validated against hardware root of trust keys controlled by the server owner instead of the server OEM, https://www.platformsecuritysummit.com/2018/speaker/hudson/
'Despacito' Is Now the Most Viewed Video in YouTube History
I can't stop thinking about E.Coli when I read the man's name.
The only interesting thing about this is left out. Who planted it is clear (someone told to do so) but not a single time is it questioned who they planted it for. Smells like false flag to me.

We think China does X Y and Z but we know the US does X Y Z and the rest of the alphabet. So unless something specific is leaked that shows who actually ordered this, logic would point at the US.
BTW, this has changed with many brands about 15 years ago. Cars made until that tend to disappear from traffic due to corrosion. In around 2000, it became common to galvanize the steel bodies of cars.

Renault actually advertised this at the time: "will rust like a fish", with a picture of a car immersed in water. Seems to be legitimate: corrosion problems have become much more rare.
Firewalls in high security environments aren't just port/protocol based. You lock everything down - source ip/port and destination ip/port. You should know where it is coming from and where it is going to.

Navy ships don't upload via Dropbox.
It sometimes feels like certain hardware protocols were designed to be insecure. I remember reading about IPMI issues back in 2013:

https://www.itworld.com/article/2708437/security/ipmi--the-m...
This is inspired by Vue/Angular. If you're familiar with those and dig into the docs you'll see that it's conceptually very similar. Nothing like Web Forms.
What is Chirped Pulse Amplification, and why is it worth a Nobel Prize?
>Europe isn't that great either but Denmark is one of or the most insane examples .... One of the things that makes me grateful to live in the USA - owning and operating a car doesn't bankrupt me

until you get into an accident severe enough to need extensive medical attention.
Presuming the previous lives in Allentown PA (ABE2 fulfillment center?), and presuming 2000 hours of work per year at $16/hour ($32,000/year), the tax calculator I found online says that taxes and social security add up to around $5222. $500 less under the tax changes Trump passed for next year.

So after taxes around $13.40 to $13.70 per hour.
I've worked on systems deployed in the financial sector in high risk environments.

This sort of monitoring doesn't happen in the real world.
Can you expand on this? Never heard of this but I'm not super involved in fintech/banking. Something like Solarisbank?
If you feel that your speedometer is not accurate you can always err on the side of safety and drive a little slower than allowed. Perhaps your brakes or your reaction time aren't as good as you think either. Besides, typical radar traps have an error of around 3km/h or 3%, whatever is larger, so it's unlikely that your speedometer is wrong enough to matter.
Cannot it be physically disabled with a jumper or maybe by cutting some lines on the motherboard?
Not just NZ. Just ask the Central American countries and others...
> Even when guns are involved (e.g. suspect holding a gun or a knife), European police is usually able to defuse the situation better and not shoot to kill.

As a counterexample, Eric Torrell was recently shot to death by Swedish police [0] (link is Swedish). He was 20 years old with Downs syndrome and carrying a toy gun.

[0] https://www.expressen.se/tagg/person/eric-torell/
Show HN: PWA front end for any eCommerce (Open Source)
Node.js vs. Angular.js – Two Sides of the Same Coin
yep I have blurry vision coming back to HN for the comments...
I Read that as "The US is also attacking our hardware supply chains". That is, the statement concerned supply chain attacks in general, not this specific one.
Yes, hourly earning in the US is customarily gross earning (before taxes).

The median rule of hourly earnings to yearly earnings is 40 hours/week and 50 weeks/year, which results in every $1/hour == $2000/year in earnings.

For $15/hour, that's about $30,000. For a single person in California, without dependents and claiming themselves for one exemption, it would be 4,264.50 (14.22%) in Federal taxes and 579.35 (1.93%) in State taxes for a total of 4,843.85 (16.15%) in taxes.

Calculator: https://www.tax-brackets.org/californiataxtable
Presumably it contacts somewhere ubiquitous like AWS or Cloudflare.
It seems surreal to me that this could be real. And yet I'm not surprised.
In the parent I described a system which would be able to communicate through those restrictions to another compromised host (remember we're assuming everything is compromised for the sake of this article, which actually seems like a good assumption now).
Google Assistant Revamped
> I really don't understand why we don't enforce speed limits more rigorously.

Not sure how things are in the States but over here in Eastern Europe there are lots and lots of stupid speed limit signs, I call them "stupid" because if you were to follow them literally (instead of going with the traffic flow) then most probably you'd cause accidents for being an obstacle on the road.
Intrusion Detection Systems are basic network security 101 type stuff. I'd be surprised if anything that was really "high risk" didn't use an IDS.
I don't see what makes the two concepts are one and the same.

How can you know that the result is an advancement and not a regression?
The difference is that individuals can't build a database that covers almost all public space and allows for large scale data mining, while governments can.
I use this news as a ignition for another point: in the past for business reasons we have evolved concept of "platforms" witch means independent software layers build like a trailer to carry on other software on top.

Before we have another concept, those from LispM, the "system" as a single entity of well_integrated stuff.

We have many example of those two way of thinking today: on "platform" side we have snap, flatpack, appimage, lx[cd]/docker, ... on system side we have Emacs, NixOS, GuixSD, ...

Well, for years the "platform" model seems to be the most reasonable, today seems ancient MIT&c hackers ware right, "system" approach is better. Simple to manage, for good software, do not hide bad practice, force collaboration etc.

On datacenters today and not from today we do substantially the same, in the past datacenters was a big collection of independent computers, now their are substantially all "a single computer" (even before The datacenter as a Computer by Google), made of many well_integrated components.

My poor English may not help, but I hope I have been clear up there, if so, what you think?
However, a proposition, like, "A says she knows it is raining, but A says at the same time that she does not believe that it is raining", is about a state of mind and a question regarding its logic is about what may be generalized. I can't see where analytical philosophy may be of help here, as the proposition would be just meaningless. (Let's say, Wittgenstein I wouldn't be of help, Wittgenstein II maybe. But I wouldn't consider the latter as analytical in the strict sense.)
It's great for document markup. But the web has moved beyond that and writing interactive applications has always been a serious of kludges to work around the fact that the web is ostensibly just a network of documents (apologies for the massive over simplification here - please bare with me on this....)

I will grant you that things have gotten better in recent years and I do agree that there isn't such thing as a perfect solution, but given we're in an era where desktop software is being fazed out in favour of web applications (and even some desktop software is now being written using web technologies - such as Electron) it really feels like we're going wholesale into using a stack of technologies that could be significantly improved if we redesigned it from the ground up taking into account:

* what we have learned form the last ~25 years of the web,

* the change in how the internet (in a broader sense) is consumed over the last 10 years

* all the lessons we've learned from the decades of desktop software development.

Plus removing all the legacy cruft which your sibling commenter highlighted has to be seen as a bonus too.

I'm not suggesting we get rid of HTML entirely, but maybe have a new programming language for the modern web - like how we have different programming languages for other areas of computing for when we have different problems we are trying to solve. eg Bash, Perl, Go and C can all be used to write CLI tools but you'd use them to target different problems.

I guess to an extent developers are trying to do this already with some of the massive tooling you get that compiles down to CSS, Javascript and so forth. Plus the experiments we see in web assembly are another example of developers trying to break free from the constraints of scripting stuff inside a document. But I'd rather see a secondary development platform that is native to the web and is more application aware and security conscious than our current situation of having to run vast and complex frameworks that still, ultimately, compile down to the same inconsistent and insecure platform that we're currently stuck with.

But as I said, this is just soapbox ranting. I couldn't see it changing without one of the powerhouses developing it largely in isolation and then we run the risk of walled gardens which - in my opinion at least - is worse than the current status quo.
For a better reason, watch this great presentation on the subject, by an experienced defense lawyer and a police officer who had a lot of experience on interrogations.

https://www.youtube.com/watch?v=d-7o9xYp7eE

That really should be required viewing in every civics class.
Is this as big as it sounds?
I guess the philosophy and incentives must be different. I'm not that up on US cops as I'm a brit.

In the UK we had "Sir Robert Peel’s Nine Principles of Policing" with things like "Police, at all times, should maintain a relationship with the public that gives reality to the historic tradition that the police are the public and the public are the police" https://www.nytimes.com/2014/04/16/nyregion/sir-robert-peels...

which seemed to work well and they were thought some of the best in the world. These days they have a lot of politically correct form filling and bureaucracy which means you don't get hassled much but they also aren't around much in terms of catching criminals.
If you can find the time to get up to speed on Kubernetes, I would say do it.

I actually have a weirdly similar setup to you (I run on Hetzner and used and still use ansible), and I've written about it, most recently when I switched my single node cluster to Ubuntu 18.04 [0]. In the past I've also run a single node kubernetes clusters on CoreOS Container Linux, Arch, and back to CoreOS Container Linux in that order, from versions 1.7~1.11.

[0]: https://vadosware.io/post/hetzner-fresh-ubuntu-install-to-si...
Sex robots, artificial intelligence, and ethics
We recently shifted from Gerrit to Bitbucket. I don't miss Gerrit. Perhaps I am missing something.
I don't even want to use it for commercial projects.

It needs a certain scale before the overheads are worth it.
5. When a server was installed and
switched on, the microchip altered
the operating system’s core so it
could accept modifications. The chip
could also contact computers controlled
by the attackers in search of further
instructions and code.

So, in typical vulnerability/payload/exploit fashion, the board's bus is vulnerable by default, because the chip pierces all the usual lines of defense protecting against network and operator I/O. It carries a payload intended to target very common features used everywhere commodity servers are used, one that likely listens for DMA traffic on the bus, and alters the signal stream, by escaping upon the occurrence of a magic sequence, and inserting its own signal, before resuming the authentic stream in flight.

The payload could be pretty small, since the server boards are likely using OS packages that match the chipset. This limits the software to a small set of well known targets, Linux, Windows, Apple. Target their kernels, and you only have to snip out a small chunk of bytes, and splice your own pre-defined package in. Splice in a miniature runtime, that operates a turing complete set of operations, and open up a listener that waits for network access, and now, your payload can enable arbitrary code execution, irrespective of permissions.

Now, to exploit, the payload needs to time the opportunity to splice itself onto the disk correctly. If certain well-known chunks of code will always exist in each given operating system, then with every disk access event one just needs to wait for the inevitable moment those magic system-specific bytes travel over the bus, in order to replace the known bytes with the poisoned modification. Events might target when the bytes are originally installed with the OS, or every time the OS reads those known bytes back into live memory, from any source.

The total payload package could probably fit inside a couple of megabytes, pack on a few more for the "listen & splice" part of the attack to round out the entire mass, and all we know how much data an SD card can fit into say... five grains of rice?
How desire shapes and is shaped by algorithms.

With Houston banning a robot brothel, it is time to have that conversation no one wants to have. Algorithms invading our most private thoughts and deeds, how does that make one feel? Where do AI developers draw the line?
No. SuperMicro make some models which appear to be for government application which lack the ASIC completely, they were available on NewEgg with no further description of purpose at one point.

https://my.mixtape.moe/sorqql.jpeg
I like Marwa Hassanein physiology. The worlds past generations have always fought over physical borders and resources. Our generation is learning to live, work and share with out these physical borders. I true believe time is our friend.
You can walk on a highway in Denmark? If that's not the case, the cops may have arrested/forcefully moved the wrong person.
Yes, it happens. But much less frequently, and is not the "default mode" in such situations.
>It did not do as much damage as this drone did.

probably wasn't shot out of air cannon at 230mph
Show HN: For anyone that searches for electronic components and hardware
a simple concept built for my own needs. may be onto something as the few hobbyists I have shared it with use it daily. Feedback good or bad appreciated.
The Italian police often carry guns but you don't get the same issues.
Most likely it is using SPI https://en.wikipedia.org/wiki/Serial_Peripheral_Interface, that requires four pins and the two remaining ones are power and ground. SPI what is used to access EEPROMs and flash memory, so an attack that you can do is daisy chain such a device in the path to the EEPROM the board management controller uses as its firmware storage. Then you can very easily insert your own instructions and get the board management controller to execute whatever you want.
Even if the ground connection of the rods is sufficiently low impedance to prevent electrocution of people nearby, the noise is going to be loud enough to cause hearing damage.
And if the officers guilty of misconduct lose their job, it's a sign that there is a system to deal with them and that it works (at least for those cases).
Can you explain why you describe dependency injection as "hell"? I prefer working with DI/IoC rather than without it.
Isn't the author a Dropbox employee? Not sure if he's still at Dropbox but I believe he's one of the first employees.
I felt a little bad after my initial post because it's not as though everything I watch is particularly highbrow. If nothing else, though, YT could do wonders for quality by hellbanning the videos where the titles are all caps.

ChuChu actually seems fine, for what it's worth. Even so, in the article the author describes how they couldn't get the phone out of a 2 year old's hands, which is 1) horrifying (regular screens that close to the face at that age may be problematic for depth perception development among numerous other issues) and 2) true of literally anything you put on the phone before giving it to a two year old.
New law sees Shetland break free of map box
Yeah, I get what you are saying. This might illuminate what's happening.

https://www.ribbonfarm.com/2009/10/07/the-gervais-principle-...
AN Interview with Augmented Reality Artist Marco Matic Ryan