skysight-inc/HackerNews huggingface dataset:
Obviously I was just attempting to make a simple and easy to reason about example here, but yes of course there are a wide array of more practical approaches and tooling today depending on the type of binary and platform we are talking about.

I also fully agree you need to get people that specialize in the gotchas of a given framework to be able to spot the vuln. In fact that kind of bolsters my point, that you need the -right- eyeballs on something to spot the vuln, and this is much easier if something is open source vs only shown to a few select people without the right background knowledge to see a flaw.

The point I was trying to make is that you need both continual whitebox and checkpointed blackbox testing and if a tool is not open source then half of that story is gone unless you are Google sized and really can pay dedicated red teams to continually do both for every release... and even they miss major things sometimes in chromium/android that third parties have to point out!

Being open source client and server does -not- imply something has a sane implementation (and to your point things that rank well on paper like Tox have notable crypto design flaws).

This is more so you can quickly evaluate a few tool that contain the highest level criteria you care about for your threat profile, then you can drill down those options with less objective research into the team, funding, published research, personal code audting etc etc to make a more informed choice.

For me as an AOSP user, something without F-Droid reproducible build support is a non starter. Anything that is closed source I can't personally audit the critical codepaths of and have knowledge a lot of the security researchers I communicate with can do the same... is also a non starter. Lastly I want strong knowledge I can control the metadata end to end when it counts, and being able to self-host or being decentralized entirely is also an important consideration.

Many people have reviewd this list and described to me they have learned about a lot of options they didn't even know existed, or didn't know where closed or open source. That is the point. Discoverability.

It would be unreasonable and even irresponsible for someone to fully choose a tool based -only- on this list imo. If that was not clear elsewhere then hopefully it is clear now.
I showed the demo to a passing PM and asked him how long he would expect a team of five developers to spend on it and he said "a couple of weeks... no wait, maybe two months." :)
> That is some laid back attitude to murder.
No, I specifically pointed out it being immoral, and criminal. Though being engaged in war or warlike scenarios, one can expect that certain situations would require confrontation that ultimately can get people killed. This is what happens in war. This is why armies exist. And if it's legitimate for US Army, why isn't it legitimate for UAE Army? And if certain person can kill other people under the star-spangled banner, why the same person can't do it under other flags? Of course there are unjust wars, but I don't see how anything changes whether it's under US flag or UAE flag.

> Are you also cool with the "warriors" "monetizing" their skills in the US "civilian market" ?

Depends on how they monetize them. If it's a justified self-defense (e.g. somebody tries to assassinate a prominent political figure, her security detail reacts and kills the assassin) - sure, if it's aggression (somebody hires ex-military to assassinate a prominent political figure) - not so much.
He'd get prosecuted in the US if the US military had hired him for something? That seems unlikely.
Yeah, talk about arguing in bad faith, then move the goal posts (when lay people think the job is too hard / boring, they will not choose it when choosing education, seems pretty obvious?) and claim the other side is "arguing for the sake of arguing".

You are not engaging in debate in any meaningful way, maybe stop arguing on HN? You are not convincing anyone . . .
They’re not necessarily unlawful combatants, it really depends on the specific circumstances. The Geneva Conventions contain a few loopholes. For example, if the United States is a participating party in the conflict, US citizens are not unlawful combatants, even if they aren’t affiliated with the US armed forces.
Having spent several years deployed to the Middle East stories like this always seem to be somewhat difficult to navigate. I seriously considered going back overseas as a contractor (IT) after my deployments, but in the end it just wasn't a good fit for me.

In this case, it looks like the problem here is that the UAE wants to pay someone to kill "terrorists" for them, and the US is either ignoring, or somewhat supporting, the conflict in Yemen. There isn't an easy solution to that problem, but a good start IMO would be to get the US out of the ME political games, because no one is innocent in those.
IBM Misses Sales Estimates, Casting Doubt on Growth Engines
Surely though the point of coordinating a disclosure is to responsibly ensure that nobody is needlessly put at risk whilst the vendor works on a fix?
Now you can buy ZRX on Coinbase
> Now I have scars and am probably too ugly for it,

Have you seen Danny Trejo? Like.. he is not the prettiest guy, but I still LOVE him, love his acting and the movies he has been in.
Building a REST API with KoaJS
I was asked in a Spotify interview to reverse a string as a warm up. When I wrote std::string(s.rbegin(), s.rend()) the interviewers seemed pleasantly surprised.
30 million!? Hot damn! That's like the entire state of Texas!!
It's actually quite difficult to lose your US citizenship these days. Per U.S. Code § 1481, it's not sufficient to merely serve in a foreign military, you need to do it "with the intention of relinquishing United States nationality".

What's more, per (b) there's an explicit presumption of what amounts to innocent until proven guilty: the onus is on whoever is claiming you've lost your citizenship to prove that you voluntarily intended to lose it, which is really quite hard to do unless you renounced in front of a US consular officer.

https://www.law.cornell.edu/uscode/text/8/1481
Eh. Sometimes over-engineering is a matter of perspective.

Take JSON API, a standardization of HATEOAS / REST principles around JSON and HTTP, for example. If you just naively walk up to it you think to yourself:

> Wait, what? Can't we just return the simple data we know we want? Why complicate this all with relationships, links, and meta data?

But after a while you realize that 90% of what you're doing could be abstracted if only you had a predictable output. So EmberData comes along and you write a Rails backend that has the nice advantage of not needing to worry about HTML (outside of OAuth / emails, anyway) and you harmonize your API. You use Ember Fastboot for slow clients and call it a day.

Someone else looking at what you've done may say:

> Wait, what? Why don't I just create static HTML pages instead of using your over complicated service?

And they're not completely off-base. In fact it's what I do for my own personal site. It's just that the context of their situation has different tradeoffs.

The same thing is true for a lot of software. Excel is "over-engineered" for most people. So is HTML. So is Unix. But in general what happens is that the person with the most complex requirements usually wins because they usually have the fattest wallet and everyone else papers over the complexity with abstractions or uses something less complex that meets their needs.
> it conflicted with my dedication to the principles of the constitution

I imagine being an assassin would conflict there a bit yeah
I think that's already happened.

https://www.bloomberg.com/graphics/2016-amazon-same-day/

https://www.reuters.com/article/us-amazon-com-jobs-automatio...
> The bourgeoisie cannot exist without constantly revolutionising the instruments of production, and thereby the relations of production, and with them the whole relations of society. Conservation of the old modes of production in unaltered form, was, on the contrary, the first condition of existence for all earlier industrial classes. Constant revolutionising of production, uninterrupted disturbance of all social conditions, everlasting uncertainty and agitation distinguish the bourgeois epoch from all earlier ones. All fixed, fast-frozen relations, with their train of ancient and venerable prejudices and opinions, are swept away, all new-formed ones become antiquated before they can ossify. All that is solid melts into air, all that is holy is profaned, and man is at last compelled to face with sober senses his real conditions of life, and his relations with his kind.
>
> The need of a constantly expanding market for its products chases the bourgeoisie over the entire surface of the globe. It must nestle everywhere, settle everywhere, establish connexions everywhere.
Great news. Also the right way to do CI/CD with each step being a separately configured container with a persistent workspace throughout. Makes it very fast and easy to chain together steps while using small, focused, and updated images.

There's only a few providers that seem to get this right so it's nice to see included in github. I was just talking to the Azure DevOps people about this kind of functionality so it seems like GH is and will continue to be run independently of MS/Azure.
122 comments and currently on the front page: https://news.ycombinator.com/item?id=18232961
If the military didn't exist there would be no need for the military to exist, except possibly as a specialised civil emergency service.

This would free up more than $1.5tn annually.

If we got rid of nation states at the same time, we might actually start to get something interesting done as a species.
EU antitrust legislation isn't about the end user (as discussed elsewhere in the thread) so much as about keeping fair market conditions. The EU formed as a common market of multiple old nations with country-specific state monopolies and rules for telecommunication, public transport, alcohol, tobacco, an other things. Regulating this common market has been simply a prerequisite for getting countries to evolve state monopolies into publicly traded companies.
Hostile conservatives would say spitting upon existing practice is tantamount to destroying society.

Personally, I think that universities should be a place of debate, and intellectual broadening without hostility. As a conservative, I am well aware that conservative universities exist, and are often extremely hostile to liberal viewpoints (e.g. try suggesting cohabitation is okay at Liberty University, and see how fast you are reprimanded).

I think that is wrong, even though society seems to feel that by going to a conservative university, that treatment is okay because you knew what you were getting.

We can do better, on both sides. Don’t you agree?
I think a large amount of bitcoin prices are attributed to western banks explaining to wealthy chinese how to transfer money out of the country on a large scale.
The article mentions it was because their Firebase database was unsecured - meaning anyone who knew the url could get access to all the data. That was the default for a long time, and Firebase will send you email reminders if you keep it unsecured. The developer ignored the best practices mentioned in the Firebase documentation and the email reminders that come out once a week (I think).
Have you used any of these tools? Have you done a binary reversing engagement? Have you found a vulnerability in closed-source software? Can you tell us more about the tools you used to do this work? What kinds of vulnerabilities did you find? You have very strong opinions about what's possible with open- vs. closed- source applications. I think it's reasonable to ask where the frontiers of your experience are.

It's clear to me from all your comments that you are somebody who wants to sysadmin their phone. That's fine; phone sysadmin is a legitimate lifestyle choice. But it has never been clear to me what any of the phone sysadmins are talking about when they demand that the rest of us, including billions of users who will never interact with a shell prompt, should care about their proclivities. The argument always seems to devolve to "well, if we can't sysadmin this application onto our phones, you can't be sure they're secure". But that's, respectfully, total horseshit, and only a few of the many reasons that it's horseshit appear among the many informed criticisms of your spreadsheet on this thread.

You might want to put your warning about how unreasonable and irresponsible this tool is on the actual spreadsheet, instead of just advocating that it be enshrined in Wikipedia.
I think what I'm seeing over and over in this thread is people talking past each other because the grandparent shouldn't have assumed we were all working in the same context.

I agree, in the legal context of business decisions, OSI has a very specific claim to the term 'open source' and declaring that mongoDB "IS NOT OPEN SOURCE" is a warning directed towards people making business judgements around legal risk.

To everyone else, we use the term 'open source' because we heard someone else say it, and when we write software we say 'oh it will be open source' without getting into the nitty gritty of what license it will use and whether that's OSI approved.
It might be worthwhile putting some bracketing or aspirational pricing up there with it too then as you’re potentially scaring away potential commercial clients who look at that price and can’t see how they could justify its inclusion at a prices they would have to guess at using that as a base.
To me, everything seems to point China's current situation mirroring almost perfectly Japan in the 90s. I must be looking at things wrong. It seems like no one is betting on it.
I use 1password right now. It's really nice.

If I were starting over I'd give pass and its various open source UIs/apps a chance: https://www.passwordstore.org
as an occasional uber driver and sometimes passenger I have to say while it has its moments when Uber is most convenient and cheap option there is nothing super amazing about this company or their product. Drivers are unhappy about worsening pay (uber keeps bigger cuts), riders are unhappy about worsening qualify of cars/drivers while uber still has not reached profitability. I would not bet the house on ubers ipo. may as well go the Groupon route
That's like saying there's no point in using pronouns, since you have to say the antecedent anyway.

It would be wrong in both cases because the context can make clear what a variable or pronoun refers to. If the problem context makes clear what the binding constraint is and you just need to talk about scaling behavior, then it is indeed shorter to say "O(1) rather than O(n)" vs "doesn't depend on the operations rather than being directly proportional".

>>what we ended up with was several classes for each operation.

>The second is shorter, and says no more than what is relevant.

It says less: the O notation is used to indicate that as you add more operations, you will need to add more classes, rather than only needing to add classes when there is logic the operations don't yet implement.
> Why have I never heard of any software team ever saying "There's nothing for you to do right now, so just wait"?

In addition to Parkinson's Law, there's this one: "A poem is never finished; it is only abandoned."

There's never nothing to do, because we can always improve things. And to a business or to a manager, "just wait" costs about as much as "work on something of little importance" but provides less benefit. It might be different if programmers were all on zero-hour contracts.

(OTOH... Firing engineers could work. I wonder why sites that seem "done" don't decrease their payrolls. Pride?)
I don't know anything about FFTW, but the question/answer seem misleading:

GitHub language details of the non-generated sources say 75% C: https://github.com/FFTW/fftw3

FFTW author comment linked from Quora answer contradicts said answer (~2/3 C): https://groups.google.com/d/msg/fa.caml/B5kFMTl67MU/9c8swiOE...

Am I missing something here? Double generation?
But also no private property, right? Isn't everything a 99 year lease?
Japan plans to flush Fukushima water into the ocean
The content of this article is based on the 2018 The Global Competitiveness Report which you can find here: http://www3.weforum.org/docs/GCR2018/05FullReport/TheGlobalC...
3 Choices for OEMS:

- ASOP Vanilla or their forked version [Free]

- Include Play Store and Google Services [Pay up]

- Add-on Chrome with Google Search on top of Play Store [Free]

Prices of flagship phones are already higher than they are in US, now they will be increased again.
That's a false dichotomy. Coordinated disclosure can sometimes optimize outcomes for some subset of users. Sometimes it doesn't. Ethical judgements in vulnerability disclosure are complicated. Sometimes a vendor and the majority of its user community would prefer disclosure be suppressed, because it saves them work (see: "Patch Tuesday"). Sometimes that impulse lines up with what's best for the world, and sometimes it doesn't. See what's so Orwellian about "responsible disclosure" now? The whole point of rejecting the term is that there isn't a one-sized-fits-all answer, to which you must comply in order to be "responsible".

Anyways: hard no to the suggestion that, in order to be a "real researcher", you have to coordinate your disclosures. To be a serious researcher, you just have to be serious about finding vulnerabilities.

(Semantic reminder: our field uses the term "researcher" in a way closer to the journalism definition of the word than the academia definition.)
> what are my black-ops tax dollars funding these days?

Domestic propaganda
> payed 160k tax free

Tax free or after tax? Aren't Americans taxed worldwide?
http://archive.is/b1dLN
I always enjoy this site for anyone in the market. https://diskprices.com/?locale=us

FYI I have nothing to do with the site, just a user.
That's exactly the point I was trying to make.
The spreadsheet seems to be missing e-mail.
Scientists make plea to save Pacific Northwest killer whales
Harvard Cites Weaker Teacher Recommendations for Asian-American Applicants
I keep reading stories about Sears in how it compares to Amazon, but what I wonder and have never seen discussed is whether Sears was a local American phenomenon, or if there were other companies like it globally around the same time?
If anybody added her as a contact in their phone, such an app with contact information permissions would get that information as well.
So there's a handy table in that document that shows all the rankings and notes that the US position hasn't moved in the past year, how is this article even a thing?
That Mayo Clinic page has another way to calculate target HR.

Target HR = RestingHR + (MaxHR - RestingHR) x 0.85

So, if your RestingHR = 70 :

Target HR = 70 + (178 - 70) x 0.85 = 162
I have previously seen Microsoft Embedded Learning Library[1] which requires LLVM support for the target arch IIRC, and uTensor[2] which runs TensorFlow models on larger ARM cortex micros.

Nice to see another group in Microsoft is targeting smaller 8/16 bit processors, they can still be useful for very limited power budget applications, low cost devices, and some odd applications where they are built in to a specific purpose IC (e.g. a flash drive controller). There aren't many other alternatives in this space I think, other than manually porting your model to C and running unit tests against it, does anyone know of any competitors?

[1]https://github.com/Microsoft/ELL
[2]https://github.com/uTensor/uTensor
I'm sure 'tptacek is tired of grinding this particular axe so I'll trot out the usual arguments:

- Discovery didn't create the bug. You have no idea who has been exploiting the shit out of it already.

- Vendors will have all sorts of unreasonable responses, from ignoring you to threatening legal action to dragging their feet.

- Vulns are work product. You are entitled to zero of the researcher's time and effort unless you're paying them for it.

I'm not saying coordinated disclosure is bad either! I prefer to do it when I find stuff. We found a bug in NextJS last week and we did coordinated disclosure (I'm talking about it now because they released a fix). I'm saying the researcher owns the bug.

EDIT: Oh no! Of course he beat me to it.
Neither invented the term, they just marketed it, because it directly benefitted them.

Christine Peterson of the Foresight Institute is the "OG" for the term "open source" as applied to software.
Looks cool, how performant would this be?
A term of art is a description not a prescription.
I brain-dumped the major features of my life with ADHD and how I manage it
I've had to take a bit of time off work due to being ill, which gave me a great opportunity to sleep a lot and write the longest thing I've ever written about having ADHD.

The TL;DR: knowing I have ADHD empowered me to deliberately build a framework of supportive exercise, sleep, hydration and eating habits. Adding medication protects my framework of helpful practices from myself.

I am always grateful for questions, feedback and links for further reading.

https://medium.com/@sashacollecutt/life-with-adhd-a61cae5a5bf
But that's an entirely different argument, and it's one that always muddies up the conversation whenever I bring this up.

This isn't a blog that loads 50 trackers and tons of superfluous animations and video, this is an application which is designed to do things for the user. It's stuff like a music making app, or a medication reminder and tracker application that takes a lot of your personal information to help you find accurate dosages. It's stuff like games or offline-caching documentation browsers with IDE integration and powerful client-side search, or self-hosted home automation controller systems, or chat applications, or a barcode scanner app that checks for coupons for things that you scan in a web browser, etc...

And again, i'm fine if you don't want to run one aspect of it, you are the client and I can't technically control what you do, but complaining that the car won't work when you ripped the spark plugs out is dumb, and a mechanic that goes around taking out spark plugs every chance he/she gets so that people won't speed isn't helping.
> You are conflating real world policy execution with values.

No, I'm not.

> Substance can't be mapped onto reality without prioritizing values and deciding accordingly.

That is a syntactically-valid sentence but I have no clear idea what it is trying to communicate relevant to the discussion.

> The belief of individual liberty is shared throughout America

The idea that there is a thing called “individual liberty” that is to be valued is broadly shared. What that label actually means is not a product of such a broad consensus. This isn't a matter of “how to achieve individual liberty” being a matter of disagreement (that is true, too, but a different issue) but the fact of what it means to say “individual liberty” being a matter of disagreement, with mutually incompatible views as to what that means.

> Your last point is in alignment with everything I've said before

No, it's directly opposed to it.

> We have the same over arching goal (happiness), we just disagree about how to get there.

No, that's what you said. What I said is that Alice has the goal “Alice should be happy” and Bob has the goal “Bob should be happy”, and these are not the same goal, and may (depending on what actually concretely produces happiness for Alice and Bob, respectively) may be mutually incompatible goals. And when you scale up to hundreds of millions of people with goals of that style, absolutely are, in very many cases, mutually incompatible goals.

This is not at all a matter of dispute about ideal path to a shared goal, because the goal is not shared. The language Alice and Bob use to describe the goal might be shared (each might say “I want happiness”), but the actual goal is different, it's just the differences are elided in the casual description.
English Wikipedia isn't blocked in China.