skysight-inc/HackerNews huggingface dataset:
What I find frustrating is that there still has to be an exploit to have these crashes taken seriously/be blog worthy. We know that in c/C++ based programs input parsing errors carry high probability for arbitrary code execution. Instead of just supplying 50 PDFs that seem to crash the program or lib in unique ways and author/vendor fixing their code researchers have to ‘waste’ time writing exploits to really rub it in.
As I've read more about this topic, what if the lady was going through a divorce + busy?

I know that doesnt absolve from responsibilities, but I cannot imagine that experience.
Serverless: Nested Apps for AWS SAM and AWS Serverless Application Repository
Ayup. I don't really see many Clojure drama posts, here.
It reads them both and concatenates them together into t1_buf_array with a call to strcat() — but without a bounds check! Oops.

Things like this make me wonder what was going through the mind of the programmer who wrote the code. I learned C less than a decade after it was invented, but the lack of implicit bounds-checking wasn't something I ever forgot. Perhaps it helps that I was using Asm before that. Of course then it was not thought of as a security thing, but just basic correctness.

It's such a simple concept --- make sure there's enough room --- and there is a concrete analogy to it in the real world --- that I continue to be disappointed and amazed at how many times someone manages to get it wrong. Then again, maybe it's just a bias: no one makes the news for doing it right.
"Studies that are peer reviewed by unpaid experts in the field should be published freely"

Unasked question: How does Elsevier a for profit business get away with having salaried UCLA professors review articles for free?
Somewhat ironically you've accidentally included the `/publish-accepted` part of the URL in your submission, which means when I click through the link, the Chrome store is telling me that "I" have published the extension and will see it in the store in a few moments. You should try to get the URL fixed :)
Please don't turn off updates. You're going to miss out on exploit fixes, which puts you in a worse position.
Likely the same as similar services like RobinHood. A quick Google suggests they make most of their money on interest from cash sitting around in user's accounts that has not been invested yet.
Not just names, usernames too. People will find it much harder to dig up information on someone going by a generic sounding name like 'cat' or 'computer' compared to someone with a more unique handle.

Combine that with a generic name like John Smith, and you've got someone who's basically impossible to dox.
I couldn’t resist writing an exploit to go along with it

That doesn't sound like the case here. He wrote an exploit because he wanted to, not because he needed to convince anyone.
Note:

> Skiing and snowboarding does have a reputation of being a risky sport, but the overall injury rate for skiers is a little lower than you may expect with 3 injuries per 1000 skier days. Put another way, if you ski 20 days a year, on average you’ll sustain an injury every 16-17 years. Snowboarders have a higher injury risk with a reported 4-16 injuries per 1000 snowboarder days.

Source: https://www.premax.co/au/blog/recent-statistics-on-skiing-an...

See also: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC1303417/

And: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2492000/
The issue is that what you end up defending is the right of more malicious actors to acquire technology from the US below cost through low-cost, high-yield hacking.
Facebook sure does have a lot of "bugs" that grant them access to things they shouldn't have. Things that allow them to profit immensely.

It happens with such regularity that I'm amazed anyone here would be kind enough to accept their fake apologies for clearly malicious actions.
Macau's gambling revenue dwarfs Las Vegas's. None of the top 10 biggest money making casinos are in the United States.
Stars simply do not "work by converting gravitational potential energy into light/heat through fusion." The "light/heat," or energy, that stars produce comes from the mass defect of the fused atoms. Basically, the binding energy of He is less than the binding energy of the (net) 4 H atoms that go into the reaction. It works so well in the sun because of the long confinement times and the long transit time for energy to get from the center of the the star to the exterior.

"...while I’m not by any stretch of the imagination an expert in fusion physics...I can at least understand conservation laws..."

I don't think that you have a firm a grasp on their application as you seem to suspect, though I agree you don't understand the physics of fusion. Your reasoning is analogous to neglecting the contribution of smokeless powder to the performance of a rifle, because a rifle is just "converting" the energy stored in the hammer spring into energy in the bullet.

That's the best I can do for you. Good luck!
US announces intent to withdraw from international postal rate system:

https://thehill.com/homenews/administration/411828-us-announ...
And how do you prevent the moderators from being corrupted by any influence and stay perfectly objective? You say every forum needs a moderator, I say every moderator is, or quickly becomes, unacceptably corrupt.

Maybe we could come up with some really basic rules for these popular sites, and implement them algorithmically, but good luck dealing with that PR shitstorm.
Android One is 4 or 5 years old.

Companies have been naming things with "one" since forever.
Its current tradeoffs make more sense as a offline compiler than a traditional virtual machine compiler. Best case for using LLVM in a VM is a last tier compilation that's supposed to approach offline compilation. But even projects that have done that like JavaScriptCore have ended up replacing LLVM with their own backend.
It's a little bit awkward to watch a new generation rediscover things which used to be common knowledge. It's a good thing, though; this sort of thing shouldn't be as common a practice as it once was.
I'm thinking more of Africa, where you had the colonies side by side. On average, the British colonies did better. And, probably because they were already hardened to disease, the natives tended to stick around and keep their land more.
I don't understand the point of cussing in software comments. Comments describe the reasoning behind the code, and this shouldn't be emotional at all, but informative. We don't see language like this in bus route pamphlets and assembly instructions, so why is it in source code?

Yes, I understand that sometimes software can be frustrating, especially when doing integration work, but swearing does not contribute anything positive besides a bit of a chuckle from some people. I'm not offended when I see it, just disappointed that the documentation isn't as clear as it could be.

Leave that kind of language to mailing lists and forums, which are designed for venting. If this came up in a code review, I'd reject it on the grounds of not being relevant to the code.
No GPS? A DIY Radio Transmitter Can Help You Navigate
Implementing the Netflix Media Database
The Business of Selling Your Location
Something tells me Republicans won’t be rushing to complain about “activist judges” on this issue.
The author of this article is a cunning, dangerous person. She was not shamed as she would like her reader to believe - she was “outed” for her inflammatory political views and she only stayed in self-imposed exile until the current administration made those views vogue among a certain set of deplorables. Now she’s skmething if an influencer in Trump-world. Which is to say: shameless.
Agreed! My favorite Christmas carols are the ones that aren't just marking a jolly merry festival, but have that "foreboding" melancholy potency you describe. I think G. K. Chesteron did a good job of capturing the sense of it, in his "The Everlasting Man" [0]:

>Christmas for us in Christendom has become one thing, and in one sense even a simple thing. But like all the truths of that tradition, it is in another sense a very complex thing. Its unique note is the simultaneous striking of many notes; of humility, of gaiety, of gratitude, of mystical fear, but also of vigilance and of drama. [...] There is something defiant in it also; something that makes the abrupt bells at midnight sound like the great guns of a battle that has just been won. All this indescribable thing that we call the Christmas atmosphere only bangs in the air as something like a lingering fragrance or fading vapor from the exultant, explosion of that one hour in the Judean hills nearly two thousand years ago. But the savor is still unmistakable, and it is something too subtle or too solitary to be covered by our use of the word peace. By the very nature of the story the rejoicings in the cavern were rejoicings in a fortress or an outlaws den; properly understood it is not unduly flippant to say they were rejoicing in a dug-out. It is not only true that such a subterranean chamber was a hiding-place from enemies; and that the enemies were already scouring the stony plain that lay above it like a sky. It is not only that the very horse-hoofs of Herod might in that sense have passed like thunder over the sunken head of Christ. It is also that there is in that image a true idea of an outpost, of a piercing through the rock and an entrance into an enemy territory. There is in this buried divinity an idea of undermining the world; of shaking the towers and palaces from below; even as Herod the great king felt that earthquake under him and swayed with his swaying palace.

[0] http://www.worldinvisible.com/library/chesterton/everlasting...
Are you suggesting that the conclusion of a document isn't an important part of it?

I'd argue that the last sentence is more prominent than anything that isn't in the first paragraph.

And who is "we" if not "you" in your second sentence? That's an employee code if conduct.
Word on the street is they're dropping that part of the AMD/GloFlo WSA.

https://wccftech.com/amd-is-negotiating-a-7th-amendment-to-t...
If Facebook were free and its company had a completely hands-off approach with your data, much like a company that makes paper notepads never looks at what you write, I'd agree.

But Facebook is a company that actively snoops and uses the data of its resources, the end-user. It's like a security guard who's paid to prevent shoplifting actively ignoring violent crimes because it's not related to stealing, or a baby food company ignoring that some metal got into their food because the food is still OK if you pick out the metal bits.
Even if true, they can’t.
That's a great narrative for a lawsuit, but I'm skeptical it's true. It's possible they were negligent (it happens to straight people too wouldn't you know it!), but it's also equally possible they were making every effort and they're still getting sued because our system has enormous financial rewards available to those who win successful lawsuits, even if they are disproportionate in many cases.

At any rate, no, there is not some systemic bias against any class of people in our medical system. ERs take care of anyone, medical insurance or not. Our medical professionals are highly trained, EMTs, paramedics, firefighters, nurses and doctors are by and large good at what they do. The existence of exceptions does not discount the rule.
Same setup works well for companies too. Yes it's difficult to accept the short term PR hit, but at the end of the day, the social media mob will likely have zero influence on the success of the business or how many sales it makes.

That's arguably one reason certain games companies have gotten away with horrible, rather anti consumer behaviour for years (like EA), because they realised early on that boycotts and internet complaints do not matter. For them, it's like 'who cares if the angry mob is calling for our heads over on Reddit, because Madden/FIFA/whatever will still sell millions of copies'

At the end of the day, most drama queens and controversy fanatics don't make companies money, and those that do will give up their boycott in time. So the answer is to do nothing and just watch everything fizzle out.
Do I? Or do I just not help to murder civilians on the other side of the planet? How can you be so sure that I’d only be helping the good side of the DoD?
To be fair, he directed people to a >500 page book on the subject as a good introduction to some of these ideas. Do you expect him to effectively summarize a massive text in a single HN comment?
Regular US railroads generally are 1:100 slopes (0.6°) or less. Grades steeper than 2.2:100 (1.2°) are rare. Clearly there is a way to efficiently connect population centers which is not steep.

I think the issue is vertical curvature rather than slope. Traversing a slope at speed is just going to get you a constant vertical component which you will not feel, and not terribly fast, <20kph, about half as fast as a fast elevator. Changing slope is going to get you a vertical acceleration which could fill your tiny capsule with more vomit than one would like. The question is then, can you blend the slopes to keep that under control? Going maximum up grade to maximum down grade at full speed will be something like a 40kph velocity change, at 1G that takes 1.1 seconds, during which time you will drive 360 meters. So, blending over 360 meters gives you full weightless vomit motion or a 2x weight. The blend from full up to full down will probably need to be over a kilometer to keep things clean¹.

␄

¹ The internet is not being forthcoming about real world elevator accelerations. It is too polluted by imaginary physics problems. So I unilaterally decided 1/3g would be ok.
It'll be even faster without indirecting through dispatch_table at runtime. Exporting your label addresses without introducing a conditional initialization block is tricky but doable. For C++ you can (IIRC) smuggle dispatch_table out of the routine using a constructor on a statically-scoped object. For C code I've successfully used GCC's nested function and __attribute__((constructor, used)) extensions, though that was with 4.7 (may not work with current GCC).

I mostly use computed gotos for implementing poor-man's coroutines in C, where the addresses only need to be visible within the routine. For VMs I use the obvious method (i.e. dispatch_table) to keep the code sane, but it does incur a non-negligible performance cost, which may matter in some contexts.
The word "culture" is often used as a euphemism when stereotyping - unsupported generalizations. What exactly does it mean here, and how can you back it up? Based on my experience in the world, it couldn't be said for anyone.
You seem to be conflating "whataboutism" with "responding in a way I don't like". Feel free to share your definition and show how the parent statement meets the definition
Sure, but any company paying an influencer does background research to verify follower counts and activity. Fake influencers may lure unsophisticated companies, but it's much harder to scam the big ones.
Isn't that pretty dependent on where you live? If you are in a newer house I doubt it would be an issue, since you have a personal water heater that gets cycled through pretty regularly.
I myself have no desire to live that lifestyle but when you think about, it probably beats most office jobs by far.
Klee is also a great example of the cost of LLVM's never-backwards-compatible approach: according to their home page, the stable release of Klee runs on 3.4 and 3.8 is "experimental". (The LLVM releases since then have included: 3.9, 4.0, 5.0, 6.0, and 7.0.)

Don't get me wrong, LLVM is great, but I really wish that as the project matured they had made more of an effort to provide some level of compatibility. As it is, it's a massive pain for open source projects to follow along.
Remember that this is not an accident or byproduct, but a goal of nationalists in the U.S. government (and probably in China too). They seek division and a breakdown of international relations and activities.
Facebook API Bug Leaks Photos of 6.8M Users
The point isn't that the number is a precise measure of unemployment, but that it's correlated to it and can be used for historical comparisons. That's all. As long as the way it's measured stays relatively consistent over time, we can reason that it measures "something", and track how that changes. Calling that something "unemployment rate" is just a label.
piracy is a workaround and not a legitimate solution

Why not?

Piracy is a problem for content generation because somebody needs to get paid to generate the content. Elsevier does not generate content, it's a (parasitic?) gatekeeper using network effects to extract rents.

If content generation would be healthier and more vibrant without Elsevier, then piracy seems an appropriate and just solution. I don't see content creators lining up to defend Elsevier; quite the opposite.

(It's possible that someone could argue that Elsevier adds significant value for their cut, but I haven't heard anyone make that claim)
> Every comment must be approved by its parent.

Design twist: every comment must be approved by the commenter's parent -- father or mother.
Doors are slamming shut for Huawei around the world
I've only had one proper lesson, but even so I have definitely experienced a sense of progression. I don't fall getting off lifts, I can do traversals without getting stuck, I can turn smoothly between my edges, I don't have trouble with blues, even moguls are fun. The problem is that I'm not great at paying attention to my surroundings (a problem not exclusive to snowboarding) and end up choosing to fall semi-safely rather than risk knocking a kid or someone. I also have a knack for scheduling my trips when the local slope is too icey to be very enjoyable.

The getting up thing is purely a strength problem. I can't do it from the floor either, can't do pushups, and I don't do enough strength training otherwise to fix that.
"you can make a $1 of real savings circulate as though it were $1.50 or (probably a lot more) of circulating currency"

Quite a bit more, I think.

Like, banks only need about (I think) 9% actual money. So you can lend $9 off that one dollar.

But then that $9 gets deposited somewhere, and that bank can then lend $100-something... etc.

Though I could be mistaken about how fractional reserve banking works.
I’m loving your comment, and speaking of stimulants, you write like you’re on adderall lol :)

We do need drive and charisma to emotionally mime. But the implication of what you’re writing is that the Kings among us manufacture that drive and charisma ourselves.

I have a different hunch about the best way to produce this charisma than you: we don’t need stimulants. We just need placebos and placebo thoughts.

The solution isn’t in “superior stimulant medications” because it seems like the main value people really stimulants is their value as placebos. The solution, IMO, is either in superior PLACEBO medications, or superior methods for people to simply trick themselves into becoming manic.

Like dude just try it as an experiment. Wake up tomorrow and don’t drink coffee. You really think you’re going to crave a king to mimic? What if — just what if — you turn out to be the king ? And what if the only difference between the two outcomes was your willingness to ingest and embrace a “placebo thought” like “IM THE KING!” (Or Zuck’s “Im CEO, Bitch.”) rather than a “superior stimulant medication”?

You don’t need coffee or adderall or “superior stimulants” bro, all stimulants are mostly placebos. All you need is superior “placebo thoughts” that allow you to go from a state of normality/anhedonia/“slight depression” to mania without chemical assistance, IMO.

My 2¢ btw: maybe coffee actually increased the need for kings , because suddenly everyone’s adrenals were fried in the afternoon and they all craved naps and sedatives more. Equally plausible IMO but I like ur theory too.
> I find it intellectually lazy to believe that assisting the military is morally wrong

Even if you view the military as an amoral tool, then it's still immoral to contribute to its strength while it is under immoral control.

> You are responsible for everything that happens and is happening, and if you really believe that the system is so badly broken that we are involved in illegitimate wars then you need to take responsibility for that and stop it. Stop paying your taxes, organize your community against it. Be willing to sacrifice to make it happen

So I'm on board with this ethos, but then the question becomes to do what ?

If you act in a direct violent manner (which includes not rendering unto Caesar), the system attacks and contains you.

If you act in an economic manner (earning less to pay less taxes), you're heading away from the attractor of competition. The end result is living like the Amish, which while individually sustainable, has clearly not caught on.

If you make small actions under the idea they accumulate, then you get stuck in simulations (eg ethical consumption, voting).

If you narrow your focus to one topic, then you end up just fighting your fellow plebs with different priorities (eg SJWs).

I have long thought about this and still have come up with little. Cryptocurrency seemed promising, but then Bitcoin came along and vaccinated the state. With no straightforward answer it sort of feels like you're throwing out a straw man. While I'm all for kicking people to not compromise so readily, everybody compromises constantly. It is nonsensical to pick on someone who has partially compromised as being inconsistent for not having fully compromised. I would rather have them hold on to their ideology and still be looking for new doors.
Ask HN: Will doors start slamming shut for Australia around the world?
Australia's new encryption laws make it probably more of a security risk than Huawei.

Will the world start closing its doors to Australia?
Pell is involved in two separate trials. Until the second trial is completed, the gag suppresses news on the verdict in the first trial.

Without the gag, it's very unlikely that it would possible to obtain a conviction against Pell in the second trial.

Once the second trial is over, both verdicts are able to be discussed and circulated as news.
This is so cool! If the bug originates in dvips code then it's probably decades old.

Confession: About a couple of years ago I tried running AFL (as the author here did) on tex, but got nowhere; couldn't even get it to get to the interesting parts. (Took ages even figuring out how to compile TeX.) Good call starting with dvips which works with binary formats... and really cool exploitation here.

There is a lot of code in a TeX distribution: there's the “core” code written by Knuth in WEB, and then there's (probably orders of magnitude larger) all the code of LaTeX (and other) macro packages (written “in TeX”), which are both quite likely harmless. But there's also a lot of other code that gets much less attention... from everything that's been written for TeX (and its extensions) to interface with the system, to common utilities, etc.
IIRC it only takes a click to add a PPA (a 3rd-party repo) in Ubuntu.
And selling order flow