skysight-inc/HackerNews huggingface dataset:
> So what do you say about the idea that it creates a disincentive to find security issues, because you'll be hit for them one way or the other?

With big enough repercussions it should incentivize processes that don't allow it to happen in the first place. This is how HIPPA and various other things work already and it does a decent job (not perfect though).

I'd also say that we need decide if mistakes are forgivable and whether or not if it's based on impact.

Perhaps for a small data leak it's forgivable, and we won't hit them with a huge fine or whatever. If it's a big leak then maybe we need to jail people.

It's a bit of a strawman to say everything has security holes because it's assuming the problem is unfixable from the start.

It's a bit like launching a person into space. "We know that probability we'll be sending people to their death is high, let's not bother then." We decided to do it anyway but we set extremely high bars for safety.
The MI band which uses their chip gets great battery life.
It's a bit like claiming that riding a bicycle is hard because steering, moving forward and keeping balance at the same time is too difficult. Yet, people learn it and do it just fine. They just don't think consciously about it. Riding a bicycle takes a bit of training but after that the body movements are virtually effortless.

Lisp is slightly more difficult than some other languages because lists/symbols are both used in code and data, because there are a bunch of different types of lists, and because code is a token tree.

(defun silly (a b c) (let ((my-sum (+ a b c))) (* my-sum (+ 1 my-sum))))

Now what's wrong with that? Nothing. But people don't write that.

Lisp is written like that:

(defun silly (a b c)
(let ((my-sum (+ a b c)))
(* my-sum (+ 1 my-sum))))

There are a limited amount of tokens on a line. Syntactic constructs are not one line.

Any definition has this pattern:

(DEFsomething name ...)

Oh, it begins with DEF, then it is a macro, followed by the name.

Function definitions have this pattern:

(DEFun name arglist body)

The code layout is:

(defun name arglist
body
...)

A method defintion:

(DEFmethod name arglist
body
...)

The difference between a function and a method is in the arglist.

LET is:

(LET binding-list
body
...)

Now you need to know what a binding list is:

((arg0 value0)
(arg1 value1)
...
(arg2 value3))

Such a binding list is used in other places, too.

If you give shortcuts to it:

df function definition
bl binding list
nm name
bd body
al arglist

DEFUN:

df nm al
bd

LET

LET bl
bd

PROG

prog bl
bd

lambda

LAMBDA al
bd

DESTRUCTURING-BIND

DESTRUCTURING-BIND al
form
bd

BLOCK

BLOCK nm
bd

CATCH

CATCH nm
bd

etc.

Basically much of Lisp consists of a small number of basic patterns which are being combined. lists, assoc lists, property lists, arglists, binding lists, body, ...

You've learned then a new alphabet of visual/structural patterns. Beyond that, code reading gets intuitive. Names give a clue what kind of pattern combination follows.

The IDE can then help with syntax highlighting, syntax documentation display, etc.

Lisp can even show you useful code layout:

CL-USER 68 > (let ((*PRINT-RIGHT-MARGIN* 30))
(pprint '(defun silly (a b c) (let ((my-sum (+ a b c))) (* my-sum (+ 1 my-sum))))))

(DEFUN SILLY (A B C)
(LET ((MY-SUM (+ A B C)))
(* MY-SUM (+ 1 MY-SUM))))
CA Corporate-Board Quota Law Unlikely to Survive a Constitutional Challenge
It would make more sense for process spawns to specify veiling behavior, such that unveil() only unveils things.
It came up after I had worked there for years; we were bought up by a multinational whose HR department wasted no time preparing a number of ‘additions’ and ‘clarifications’ to our existing contracts.

(Their) problem in court would have been that such contracts are not enforceable in my jurisdiction; however, my colleagues and I would rather not start off the new business relationship by dragging them to court, so we duly signed (of sorts).
As I mentioned as a reply to a sibling comment: Beware, I definitely saw reader views not only omitting illustrations, formulas and info boxes, but whole paragraphs of the actual text. I don’t trust it anymore.

It would be nice if content and presentation were sufficiently separated as initially imagined, but I don’t believe that to be current reality.
Not true, you are wrong. Better organization leads to a focus that can solve problems at a greater scale and with easier access to solutions. Your metaphor sucks as well.
This is crazy. It shows how the social graph is so brittle.

My girlfriend's account was one of the affected and since then she keeps getting these random messages from profiles who look like ex military. No idea how they even find her profile, because she actually disabled search on FB for her name/profile.

For facebook, this is just yet another security incident, but for millions of ordinary people whose contact details are exposed and many of who are women, a continuous threat.
Investors should sue California over its corporate gender quotas right now
Meetingcost – see the dollars tick away
Yes, anyone could receive an "update".
> Contacts are found by taking the devices own IPv6 addresses and replacing the devices own MAC address by the contacts MAC address.

You require the devices to be on the same network for this to work right?
That's above and beyond what's needed IMO, good on you for going to that length.

In the end the only thing that will fix the broken sites is to cut it off entirely.

Thanks for your project and I'm glad you're able to bring it to a successful conclusion!
> Also, can I point out the irony of ironies that the attackers used the "View As" feature, which is ostensibly a PRIVACY check tool, to gain access to all this private information?

https://twitter.com/alplicable/status/1050819857351098370
They have sales and the components are upgradable.

I got a monster of a machine 2 years ago for < $1100, by buying during a 35% off sale and getting the SSD aftermarket.
There is no way to know that someone at PasteBin wasn't paid off.
Why? There's no precedent. Equifax got away with far worse, and literally nothing came of it. Fair's fair.

I mean morally, yea, I'm with you, but from a legal standpoint, I'm not.
And what's the purpose of cookies?

I'm saying if a store used ther CCTV systems to track the behaviour of individual customers, and was building a database of that information, and pestered their customers whose apparel foiled their facial recognition, then that would be pretty much exactly what WP are doing here. What the tools used might have originally been designed for doesn't make any difference IMO.
I think it's a hangover from ten years ago when it actually was a huge pain in the ass to do DOM stuff without jQuery.
Here's an anecdote:

The first time I did a longer fast (72 hours) I felt low-energy, as you describe. Then I ate a single large meal and did another long fast; that felt quite good for the duration of that fast... so I did that for a month, more or less, and lost a lot of body fay (I'm 6'4" and I went from 225 to 200).

And then I was being pretty healthy for 8 months before going back to occasional drinking, but I still don't do sweets other than fruit.

I mostly eat a single meal in the middle of the day (though I make a lot of compromises due to being around other humans) and I don't usually find myself hungry in a way that is intrusive on my thoughts. However, I did start rock climbing in a gym and I upped my caloric intake and would eat a small meal afterwards.

I did another series of fasts this spring to bring my weight down to 175, and it's stayed there. And then I did a short series of longer fasts this fall, and didn't feel low-energy during them.
Snap can be counted as days
Vaping Viagra? FDA says not ok
I've never used rawgit for my own projects, but it did make life a lot easier to check out demos and test run examples in JS libraries hosted on github.

Totally understand that the effort required to fight malware is tedious. But instead of shutting it down you may want to try a $5/mo plan. The money is not for making money but kind of like how Google chrome store required a $5 payment to publish your first chrome extension.

Spammers hate paying it and I think as soon as money changes hand there is verification and a trail which makes them nervous too (many forum owners do this as well).
+1

Everything should be in lock down mode while accessing vulnerability and working on a fix.
They weren't suggesting we need more secure OSes specifically, that was just an example.

A better example is maybe instead of Google spending $xxx,000 to develop the system that was found insecure they should have spent $x,000,000 so they had more resources devoted to the security aspects.

Perhaps this is too high for this system to exist; well maybe that system just shouldn't exist if it can't be secured properly with the budget for it.
6 Clutch Sales Prospecting Tools
1. You seem to confuse false and unsubstantiated
4. "lets slip that the Saudis are where the money might have come from" That's honest. Perhaps the problem is that the Saudi might take a share? If so, why is that a problem other than Western capitalists chose not to finance such operation instead? If the Saudi are OK to pay the best price to lead the transition to EV, why refuse? If the problem is with the communication of the info, then why do we prefer to be kept in the dark and not know how sausage is made?
5. Elon said that it is incorrect (cf direct reply to FT). I'm curious: who would you recommend? The guy is a clear supported of the transition to sustainable energy, while being part of a family known to lead the fight against it. He's probably well armed for the job, then.
6. Near constant questioning of company finances and viability: Most is just FUD from short-sellers, which the media repeat because its sensationalism makes people click.

We'll know soon enough with Q3's results. In the meantime, Model 3 are selling like hot cakes.
Click https://www.facebook.com/help/securitynotice and scroll down

I see

>Is my Facebook account impacted by this security issue?

>Based on what we've learned so far, your Facebook account has not been impacted by this security incident. If we find more Facebook accounts were impacted, we will reset their access tokens and notify those accounts.

I also get about ten spam calls a day.
This is why I hate not having custom security questions from Banks. What is my fathers middle name? Well, if you have facebook and he puts it up there you can find out. I have no control over that.

I could start using fake answers but trying to remember the fake answers vs real answers is tough. Whereas when I get a custom question I have a custom answer that I will always remember. Such as made up on the spot Name of the babysitter with curly finger nails. I remember that and no one can figure it out based on the internet.
Would you really be fine with that as long as no marketing was involved?
Government's move slowly.
Security best practices are evolving quickly.

My team is working through FedRAMP/NIST compliance right now. We have sadly adopted the saying, "Security or compliance, choose one." We have literally rolled back a more secure implementation in order to be compliant. Regulations can't keep up.

I'm not ideologically against regulating the software industry, but I have doubts it can be done successfully.
It was great while it lasted. I currently have a small extension that depends on it. Oh well, I knew the risks of using a free service so no complaints. Thanks for the free service!
That’s a bit like saying “my choice of watching widescreen videos as zoomed in and cropped square images is certainly my intended choice of medium”.

That’s cool, but don’t wonder then if important details are missing.
Useful Linux terminal one-liners
Just because something is burdensome to a business does not mean it will have the intended, positive effect.

At worst, you only make things worse for users and empower large incumbents without solving anything.

So hopefully someone out there cares.
Congrats! For the long run you might consider throwing in a day with multiple meals and significantly higher calories every now and then, sticking to whole foods for the most part. This might be good for your micronutrient intake (which I'm pretty sure does not cover the RDAs on 600-800kcals) and your metabolism, which might get wrecked in the long run otherwise.

I can recommend cronometer.com for tracking food, this might be a pain in the beginning, but gives you good insight on what your nutrient intake is. Helped me to create a diet with roughly balanced meals.
I really wish there was a video of this talk, I like this deck but I'm missing the color commentary.
I stumbled on webflow last week while looking for design tools and boilerplates. I was put off from going farther down the funnel by the mandatory account creation to try the demo. It's nice to see a there's now an ungated part of the product.

I like the idea of more visual design tools, but I'm not sure the browser is the place for it. Just having the demo open destroys my laptop, and it's not exactly a weak machine.
Possibly - https://en.wikipedia.org/wiki/HTTP_ETag#Tracking_using_ETags
The latest development release updates the ER-X to kernel 4.4, which is LTS until at least 2022. The base OS is updated to Debian Stretch also.

I think that's a pretty good level of support for a $49 device.
Advising (or hoping) against the accused defending themselves is counter to the justice system western democracies are based on. In a just society, a false accusation intended to harm the accused by piling on social media lynch mobs and the media, should be discouraged.

If the accused is indeed innocent, I hope this case serves as a deterrent against false accusations. But if the accused is guilty, hopefully the system unfurls in favor of the accusers.
Circle Medical (S15) Is Hiring Care Coordinators in SF to Reinvent Primary Care
Many people don't get this, but calories aren't a very reliable measure of available energy. Measuring the caloric content of food is a pretty weird process, and is some kind of "one size fits all" measure of energy which we might be able to extract. The digestive system is not an engine, where you put in fuel, add oxygen, combust and use the energy. The digestive system is more like a mining operation which extracts coal from the bedrock that is your food, and which then throws it over the wall where billions of consumers burn the coal for energy.

That process isn't anywhere near 100% efficient. There is a huge amount of complexity in how food is digested and broken down into protein/sugars/fats. Some people can't even break down certain foods. Even more complexity in how those macronutrients are then dealt with.

Sure, in any system energy in == energy out. But without a way of reliably measuring how much available energy there really is in food for a specific body, there's really no way you can say "calories in, calories out".
You don't need the FPGA board. I work on CHERI and have only ever used qemu. The FPGA is mostly useful for benchmarks to compare with MIPS.
Previous Discussion: https://news.ycombinator.com/item?id=10222934
I've often wondered, instead of a filesystem, why not a database?

A filesystem is effectively a hierarchical model database with a very limited feature set (usually no transactions, minimal or no schema enforcement, very limited query language.)

Why not add some of those features?

Filesystem transactions: Windows supports them, but Microsoft has deprecated them; part of the reason, I think, is transactions required use of a different API to access files, which meant almost nobody used them; if they had been accessible through the same filesystem API as non-transactional operations, they might have seen more adoption.

Schema enforcement: I could create a directory called "images", and then specify that all files in images have to be of MIME type image/*, and the FS will refuse to let me put a text file or executable in there. I could have a directory called "logs", and require all file names in that directory to have names containing a valid date/timestamp. I could enforce the rule that a .json file has to contain well-formed JSON, or a .xml file must contain well-formed XML.

Querying: filesystem could support SQL queries over file extended attributes. (It doesn't have to be SQL, SQL syntax is pretty ugly.) "Find all files of MIME type image/png which are greater than 100KB in size?" "How many executable files are there? How much space do they consume?"
> In regards to using a DHT, that's something I have not researched. I am not sure how long an offer is valid, were you thinking of being able to update them as needed whenever you want to establish a connection?

Yes. I have toyed with js-libp2p to obtain "providers" based on a key, but I believe the part of js-libp2p that allows you to participate in the DHT isn't quite done [0]. I imagine you'd make a CID that would be a simple hash of some shared string. Then you'd tell the network you are a "provider" with that CID, and when requested, you give the offer (AES'd w/ shared string or other shared secret?). The client can just connect to the same DHT and give the hash and get the (encrypted?) offer. Not sure if IPFS has a way for me to prevent other people from serving/replicating the CID I am serving instead of forcing it to be a hash of the content. A similar approach can happen on BT mainline w/ an infohash maybe.

0 - https://github.com/ipfs/js-ipfs/pull/856
that's not how things work.
> The author of the linked essay is suing the creator of the Shitty Media Men list claiming defamation. This seems like a poor strategy on his part,

He absolutely should sue the creator of this list and whoever accused him of rape. It says so much that people think he shouldn't "because it will look bad".
Shame is not a trait the people doing this have. You can't appeal to them; you must treat them as irrational actors and act accordingly.
Here is the data that the study is compiled from. The majority of the added compounds are sildenafil (Viagra) or analogs of it. Interesting to me, Locacerin showed up in some of the weight loss preparations.

https://www.accessdata.fda.gov/scripts/sda/sdNavigation.cfm?...
> For instance, say you’re in a race at school. You do surprisingly well and beat most of your classmates. All things being equal, the next time around, you’re actually not likely to do as well, relative to the other runners.

If the events are independent (as I believe the author is assuming at this point), then your performance in the first race has no effect on your performance in the next race, right? Maybe it's just a poor choice of wording, but it comes dangerously close to reinforcing a common misconception about probability (Gambler's fallacy).
ok retard
Opportunity cost is a thing. Eddie Lambert may be a genius hedge fund manager, but is a terrible CEO of a retail company. Sears/Sears Canada accounted for 53% of his hedge fund's portfolio holdings in 2016 [1], and now they have to pick . The S&P 500 was rallying like crazy at the time, so he definitely could have gotten a lot more if he were a regular hedge fund manager.

[1] https://www.investopedia.com/articles/investing/030716/top-5...
Why do people buy that stuff? They could choose not to.
I agree, I always leave those sites and never return.
From context I understand the meaning, but what does "NAK" mean here? I'm guessing it's an acronym?
If the Mozilla Corporation abuses my privacy, I don't care if they don't make money from it. That's irrelevant.
edible bento boxes?
More like "Oh look, another story about extra components inserted by a big state actor. Bloomberg just got burned for this, I'm not going to risk my/my organization's reputation on the slight chance that this one is real"

Or, "Extra chips on the motherboard? You're about a month behind the news cycle and didn't you hear it was all BS anyway"

But the false sense of security interpretation is plausible too.

I wonder who holds conferences on the cutting edge research of manipulating media
Become a Monk (Part 1): How to Set Up an Emergency Fund
>We know full well there's no evidence that the data WASN'T accessed by unauthorized parties.

Really? If Google has access logging on its content, and as in your example an AWS bucket can be configured for access logging then it would be fairly straightforward to identify if the data was accessed.
Do you by any chance have a link to back that up? I went to U of W's website and they did not mention anything about free tuition.
Honestly the last time I wrote an app for a website it was specifically because browser incompatibilities had me tearing my hair out. Calling HTML/CSS/JS standards is fucking laughable.
Stan on the web (thanks to RStudio)
The relation between Facebook, it's users and attackers is the same as between cattle ranchers, their sheep and sheep rustlers.
Probably a little off the beaten path: However, I know of government supported accelerators/incubators in China that will give free office space and a small stipend for foreign companies to register and work in some cities. Combine this with tinyseed and you are looking at a nice runway.
Which study are you referring to? He references different studies to make different points and I can’t tell which one you’re talking about.
"How mathematics works rests on no absolute timeless standard, despite what many assume today, given its precision and efficacy"

Exactly this is key to teach people to like math, stop trying to train me in it. It's like math has become so saddled with politics or ego that people want to train everybody in the same system of values and they are willing to lie to get you to use to the same symbols, the same way of thinking, etc.
Disclaimer, I'm really bad at math. But I hate how math and physics are taught, it should always be taught from a spirit of exploration as if you are discovering new islands or continents and you get to name the things you discover.
Try getting a math professor to admit that he doesn't actually have an intuitive understanding for any of the stuff he teaches. I believe the vast majority probably don't have any such understanding but they are understandably scared to admit it. It's a cycle of lies.
Who are you to say that I have to use that particular symbol or term to describe this math?
People have a large stake in interopability between mathematicians so they teach us these symbols as if they are facts of nature when in reality they are just arbitrary drawings that people invented to name stuff that they found in nature. Fields of math stack on top of each other because they happen to work together but in reality we dont know why. They just do and it's interesting that they do so we keep doing it that way because it works and hasnt broken yet and it's useful. There were cultures that did math with a completely different set of symbols, not just symbols but even way of thinking. Multiplication, addition, entire base ideas were thought of differently. Yet our current way of doing math is taught to us as dogmatic, accept it or you are a troublemaker. No wonder people dont like math, nobody wants to be a slave to somebody else's ideas and value system.
Every math class should start with something like "This is the symbol for addition: '+'. This was invented by some person, you could use something else, you could try to find some other way to add numbers but the way we teach you to think has proven to be fairly fast and convenient so we teach it."
That in my opinion is how you make people interested in math because you treat them as equals instead of subjects to be trained in your favorite cultural way of doing math.
Math should be seen like a weird natural phenomenon that we observe, from the getgo. From childhood on. Explain it like that and I believe kids (and adults) will love to discover more about it.