skysight-inc/HackerNews huggingface dataset:
> Now that everyone has a Google account, the possibility of credential theft seems like something worth taking seriously.

Not sure I follow - is the idea to redirect from google.com to an attacker's site that spoofs the Google login page? I think we'll get more mileage out of solving that with origin-aware authentication mechanisms (password managers, U2F, WebAuthn, etc.) and perhaps address bars that show the eTLD+1 instead of / more prominently than the full URL. Phishing is already a problem even without open redirects.

> Widely distribute links "to a cute puppy on Instagram" that redirect to a URL that triggers a resource-intensive search operation on the victim's server?

Keep in mind that unrelated web pages can send GET requests to each other by just using an image tag, so if your website has a resource-intensive search delivered over GET and no automation to detect suspicious behavior and spikes in certain types of requests, you're already vulnerable to this via e.g. someone submitting an interesting blog page to HN that loads youe search page as a resource. Either make it POST or add some HTTP-level DDoS protection a la Cloudflare.

Same with advertising fraud - ad clicks should be POSTs. (Open POST redirects do seem more dangerous but are probably rare.)
Mine is: "I am sitting with a philosopher in the garden; he says again and again 'I know that that's a tree,' pointing to a tree that is near us. Someone else arrives and hears this, and I tell them: 'This fellow isn't insane. We are only doing philosophy.'"
The evidence for advantages from being raised by a parent rather than other caregivers is extremely thin, and more important, unquantified. We invoke all those platitudes about the importance of mothering because we lack the data to make meaningful assertions.

How much more will your child earn if you stay home and raise it, instead of going to work and leaving it in daycare? And does that offset the advantages we know accrue to children from higher parental income? We don’t really have any evidence that being cared for by a stay at home parent improves outcomes. We have quite a lot of evidence that, e.g., SAT scores correlate highly with parental income.
Some screenshots, a video, and/or an explanation of features would be nice.
Amen! I wish more companies would realize that SPAs are not the right solution in many cases.
How Data Collected in Warrantless Surveillance Ends Up Everywhere
Lane change assist alerting in modern cars has saved me from hitting cars in my blind spot, this tech makes a beeping alert when you hit the turn signal and a car is in the lane you are signaling towards.
Get a savings only account at a bank far from you. Throw the bank card out. Set automatic withdrawal to that account. This way you have to go to the physical bank to withdraw money. This may work for you. Good luck, it is really a challenge.
From Stanford professor's passing, rumors of ties to Chinese government emerge
Turning your head is not necessary. When you have side mirrors set up correctly you need to first look in the rear view mirror and only then in the side mirror.
It's cheaper, faster, and often higher quality for them to acquire, unless DDG is setting too high a price on themselves.
This is super neat!
i'd encourage anyone who liked this to check out dybvig's thesis[1] - super readable. It's neat to see how you can cleave the runtime system and compile time system. The first two chapters, at least, are pretty cool.

[1] http://agl.cs.unm.edu/~williams/cs491/three-imp.pdf
A commission has been set up to plan for the phase-out of coal in Germany. Seems like all agree coal will be phased out, the debate is more around the timescale, and compensation for those affected.

https://www.cleanenergywire.org/factsheets/germanys-coal-exi...

"Today, the Federal Cabinet decided to establish the Commission on Growth, Structural Change and Employment. By December 2018, the Commission will prepare a roadmap for the phase-out of coal, which will ensure that the short-, medium- and long-term climate targets are achieved. The Commission will also submit proposals for structural development in the affected regions that will serve to strengthen growth and employment."

https://www.bmu.de/en/report/kommission-wachstum-strukturwan...
FB would be the worst, because they have the most privacy issues, plus that sour deal with WhatsApp. There's no overlap of target market at all.
Right, and also internal CSRF is in fact an underrated vulnerability.
> I'm sorry, perhaps I'm bitter because I saw exactly what this was in 2007

And what exactly did you see back in 2007? Because it sounds to me like you are merely describing politics since the advent of television at the national level in the current U.S. two-party system.

Do you really mean to say you saw the same type of fake news campaign spread across social media in 2007 as is described in recent NYT pieces wrt the 2016 election (e.g., troll accounts so widespread that a Facebook lobbyist recognized one as one of his mom's Facebook friends)? If so can we see an archive.org link of what you wrote back then?
Don't have 20 hours to learn something new? That's fine - all you need is 20 minutes to watch this video on your phone.
Author here. Thanks for your comment. I think you have a valid point about users clicking anything. However I would only say that's the case if you send around 20 phishing mails. In a targeted attack you want to send one or two phishing mails and you wanna maximize your chances of success to avoid a reaction from the blue team.

I agree that the impact is low compared to other vulnerabilities. It is definitely the case that you get a t-shirt (at best) for it. Though, my point is that they could be critical for the users, not for the website itself. An attacker that don't really care about the vulnerable website can still exploit the trust in the vulnerable website to perform attacks on the user he is interested in (e.g. hash stealing or malicious redirects). In fact, I believe malicious redirects is a really common payload of XSS flaws.
Ideally you wouldn’t have to go looking. You’d see a gameplay GIF on Twitter, click a link and 100ms later you’d be playing the game.
The big privacy concern I see with MW is the exchange of blinding factor, and there are some arbitrarily good solutions to that if you make other tradeoffs.

With ZCash I'm willing to trust the trusted setup (even if it was imperfect); the issue is that people don't actually use shielded addresses/privacy protecting transactions much.
MTailor Is Hiring Materials Sourcing Coordinator (Apparel)
but the icons aren't as pretty
Studies probably show the opposite is true too.

Social science has proved itself not to be trustworthy enough that we can just bandy about the terms "studies show" like it means something. It doesn't mean anything anymore and we need to start holding people to higher standards of proof and competency.

As a rule I would suggest it's no longer viable to say studies show, you must provide the details of which studies have shown that.

I'm not saying anything for or against your position by the way. Just "studies show" doesn't cut it any more.
My understanding of how Credit cards work:

1. Alice has a secret called a credit card number.

2. To pay Bob she shares this secret with Bob.

3. Bob then contacts the credit card company and asks to transfer funds from Alice's account to Bob's account. This is authorized using the secret that Alice gave to Bob.

If Bob or some party acting on his behalf Alice can not receive this secret from Alice Bob can't get paid by Alice. As you point out if Alice gives the credit card secret to Bob, Bob can withdraw funds from Alice's account while she is offline. This is exactly the same in Mimblewibble. If you give a third party your Mimblewibble secret that third party would be granted the ability withdraw your funds while you are offline.
Well you did come here stating how frequently you're giving babies sugar and that you can't be bothered reading articles you're commenting on...so assumptions may be made.
I have a seven year-old Prius and the support columns on the left and right of the windshield are huge. I can't count the number of times I'll be pulling up to a stop sign only to stop and freak out when a pedestrian walks right in front of me. See, they're walking across the cross-walk at a pace that seems to match my slow speed but they're behind that giant support column so I don't see them until I've stopped. Usually, they're freaking out too and mouthing/gesturing bad things at me for not stopping sooner. This, of course, coupled with the fact that they were probably looking at their phone and couldn't hear me because at that speed, the engine has shut off.

The instructions in this post are great and I'm going to follow them the next time I get in my car. Still, I hope Toyota and other manufacturers start making pedestrian detection systems and blind spot information systems standard in all vehicles soon.
I'm sorry I don't understand what you are saying here?

Are you saying that the court system is forcing people into charade marriages? If so I'm not sure there is evidence of that. The number of divorces and single parenthood has skyrocketed in recent years. If anything I think there is something about modern society pushing people away from marriage.

But as I say I'm not sure I follow what you're saying.
An alternative would be to have a policy where all the app repos must use the same version (nobody can upgrade until they all upgrade). This makes things harder for the library maintainers, but no more than a monorepo.

I don't see why you'd need semver. The apps could sync to a particular commit in the library repo.
The nursing period is also not a differentiating factor. The long-term benefit from breastfeeding is very thin, likely not even a couple of IQ points if that: http://pediatrics.aappublications.org/content/139/4/e2016184... https://fivethirtyeight.com/features/everybody-calm-down-abo...
Funny you mention it, forecast.weather.gov is now the first link on my phone browser's start page. I made the switch after the wunderground app started refusing to update and otherwise glitched out constantly. The only downside is I have to actively think check the weather in the morning rather than just have it presented.
Herb Kelleher, Southwest Airlines founder, dies at 87
I didn't say actual kids, I said _hypothetical_ kids. Even parents whose actual diets consist of pizza, burgers and KFC every week would probably acknowledge that their life choices are made out of convenience, time or budget concerns, not because they believe those to be the pinnacle of health.

Besides, as I mentioned, armchair parenting is just one "trick" to help one brainstorm towards a variety/moderation mindset. Chinese cooking culture - particularly from older generations - is another way to build variety and moderation into a diet. Some people motivate themselves with martial arts (where health, pressure to maintain frequency and balance between aerobic/anaerobic exercise are somewhat secondary compared to the desire to improve technical skill)

> get people to correct answers.

I don't believe there are "correct" answers. Even mundane things like climbing stairs to the bedroom have been shown to improve health. As TFA expands on, it's a question of how one can incorporate more healthy habits into their life. This won't accomplished with repeatedly reaching for the "one weird trick"; there are millions of ways to become more active/healthy... if only people toned down on addictive sedentary activities like social media and the conveniences of pre-made food.
Surprised the author doesn't mention oauth - open redirects are the achilles' heel of oauth flows and allow for full account takeovers. It is very common.
Never said there's anything wrong with it, it just changes the capital expenditure and worth from physical to virtual (peering agreements). Companies like Century Link, AT&T, Verizon are in a slightly different category with abundant in ground infrastructure (that has extreme tax benefits in the US).
Cool. I wouldn't take the critics too harshly. As someone who has configured a lot of webpack configs across multiple version of webpack and various versions of the plugins necessary to enable these features, I know exactly what you had in mind when you put this together. This is a very saturated technology stack, so people can't help but react to it as noise.

To the critics, in front-end land there are some programmers who believe that building an SPA is always a mistake. I am of the opinion that there are some types of applications that live in the browser that benefit from the UX enhancements that scripting can provide. We all know some examples.

Everyone knows that front-end land is a crazy wild-west with a lot of moving and a lot of breaking along with a lot of hype, trends, wheel-reinventing and cavalier attitudes towards security. The criticisms are mostly fair.

However, if you're building an SPA, there is a combination of tools out there that can provide a very conceptually clean (from an architectural perspective), performant, reusable, and highly productive and fun development experience. Of course, this doesn't mean these tools make building an SPA the appropriate engineering decision, they are just tools, only the requirements can dictate whether or not an SPA should be built.

This project attempts to preconfigure via webpack, what is IMO, the best selection of tools available for working on an SPA today. For me, these tools include:

- react
- react SSR
- bundle code-splitting
- es6 (or ts/es6+flow)
- es6 modules
- hot code and css reloading
- module aliasing
- css modules
- postcss
- reusing business and validation logic modules on the front and back end

All of these tools solve very specific (former) problems that one encounters while working on an SPA. Anyway, nice work!
You can knot surfaces in 4D though.

Edit: not to say that 3D space isn't special though. There are plenty of special things about it.
I own a Surface device, an iPad Pro, and a Macbook Pro. While I write code on all of them, macOS is still the king of development environments.

On macOS, you can just work. That's what the end goal should be in other platforms. I doubt iOS will ever get there. I mean, how are you supposed to copy and paste code from Vim running in tmux inside of Blink? With your finger? Hell's bells!

Windows is just too weird. If you compare them strictly from the perspective of using Vim, Windows is better than iOS. You can use Vim from WSL or a VM in a nice Linux terminal like Tilix running on a Windows-native X server. Boom, Vim is running right alongside your Python interpreter, $GOPATH, etc., and copy and paste works. (Let's set aside the fact that WSL is crawling with problems.) But if you use Windows, you'd kind of expect to be able to use more than Vim, right?

That ends up being a pit of snakes... multiple Windows-native X servers I've tried have problems rendering Intellij, and I've tried to get native Windows editors like VS Code to work smoothly with interpreters hosted in WSL or VMs. Only Intellij can really do it properly, and even then it depends on the language. It ends up being just another distraction.

Then there's running Linux desktop on a VM in Windows 10. I don't know how other people do this. Even with a beefy machine with two GPUs, no modern Linux window manager is performant enough to use. If you can find one like xfce that is fast enough, you end up having to manage the scaling on individual programs when you switch between high DPI and lower DPI displays. It's bananas!

So purely from the perspective of access to any tool you want to use and limiting distractions, macOS is still the best. I'm rooting for Windows, but only because I have a 2017 MBP and the new keyboards are painful to type on.
Yes-- please give me some notion of what I'm going to get before you ask for my email.
I miss Weather Underground before they got acquired. :(
Heh, fair enough. Was thinking more things that might not need advanced math to solve. Or at least to understand the problem.
Compiling Julia Binaries (2018)
Oh, picked quite intentionally from things you actually wrote, yes :)
I wonder why it’s Danish only
For practical electronics engineering and implementation, things like Bunnie Huang's blog and documentation of things like the Novena "laptop" have far surpassed traditional publications like the IEEE Spectrum.
Right, when I just ask Google what the weather is like.
> he was a former Lincoln Fellow of the Claremont Institute [2]

Who are you referring to here? It sounded like you were referring to either Bannon or Pack, but neither of them are on the list in your "[2]" link.
Yes, floonet is the testnet.
If you're doing a startup, you probably have more flexible hours. What I actually do is start work around 4 or 5 AM and finish at about 3 PM. My family is not awake so I don't miss any time with them. Less time on commuting, finding parking, etc, and plenty of time to work. And I have huge gaps of time to play with my kids.

But if possible, I'd recommend finding a way to work less hours. I find that lots of scheduled time kills a lot of opportunities.
I can't really see how it's better than Monero. From their website:

Monero uses ring signatures, ring confidential transactions, and stealth addresses to obfuscate the origins, amounts, and destinations of all transactions.
Coconut is a superset of Python.

"Pythonic" doesn't just mean "idiomatic". Python has design principles[1] that influence new idioms.

[1] https://www.python.org/dev/peps/pep-0020/
I would like to release some OpenSource projects. But I don't want it to be used for evil.

I understand, and share, your sentiment. But really, once you put code out there, you can never know who's using it, what they're using it for, and whether or not they would respect your license terms. I mean, if the NSA find your software useful for something, do you really think they're going to skip using it because your license says they can't? Or what about the North Korean government, or the Russian mafia, etc. Criminals / terrorists / nation-state governments / etc. are probably a much larger source of evil-doing than a handful of corporations, and none of those entities are likely to care about a software license.

Personally, I'd go for just using whatever normal F/OSS license you'd otherwise pick, and in the README just add a note saying "I'm asking nicely that you please not use this software for evil purposes". It has no real legal effect, but, as noted above, having it in the license really doesn't help a whole lot anyway. And you still make your position clear this way.

What you probably need to ask yourself is "on balance, is me releasing this software going to make the world a better place, or a worse places". If the answer is the former, I'd encourage you to just do it.
Instacrap?
> The price of something being higher than you'd prefer does not mean there is a market failure.

The price of something being much higher than the cost of production is a market failure, in this case the market has failed to produce enough supply.

If the cost of wheat production remained constant but the cheapest you could get a loaf for was $50 would you not consider that a market failure?
The default weather app on Apple iPhones is IBM's Weather Channel, https://support.apple.com/en-us/HT207492

> The weather data used in the Weather app comes from The Weather Channel. If you have issues getting accurate weather information, tap the icon in the lower-left corner to go directly to the weather source.

If you have an iPhone and are in the US, a home screen shortcut to mobile.weather.gov is much safer. Avoid putting the site in web browser new tab Favorites, which will be pinged by Safari even if you don't visit the site. This can be seen with Charles Proxy.
Hurts anonymity if you have to do peer to peer transfers of the file, plus you have issues around resending/etc. (payments are somewhat different from other messages). Even with IM-based exchange, I'd probably use something else and then pass a message instead.
Good point, the word "low" itself is relevant.
Ah, ha! I KNEW I had read about this, but couldn't find my notes on it, so I didn't include it. Thank you!
Arguably computer graphics are the best candidate since many engines already have a velocity buffer for effects like temporal anti-aliasing and motion blur... would need API integration though.

My hunch is motion interpolation is preferred at high fps. E.g. a high action scene at 30 fps will need a lot more information to be filled in and has likely already been mastered with the target frame rate in mind (camera shutter speed etc).

But 120hz or more content will have very little motion between frames, and this motion will be far more linear (e.g. a finger might move 1cm between frames, but doesn't bend so less motion artefacts).

So 120hz content upscaled to 960hz+ would be much closer to native 960hz content and preferable to displaying at the original 120hz. A logical implementation would be VR headsets with a built-in DSP.
> (O'Reilly's books were famously typeset with Troff/Groff for many years, though I don't know how painful that was or how advanced their typesetting needs were.)

I beleive that O'Reilly Media has used ASCIIDoc[0] as their preferred internal format for quite a few years. Formulas are supported through ASCIIMthML[1].

More recently, they seem to have transitioned to HTMLBook[2] as a preferred source format for systems like Atlas[3].

[0] ASCIIDoc is basically a Markdown-like (or ReStructuredText-like) format that is feature-equivalent to DocBook XML: http://asciidoc.org/

[1] http://asciidoc.org/asciimathml.html

[2] http://oreillymedia.github.io/HTMLBook/

[3] https://atlas.oreilly.com/
Go one step further and sell a box that does quantum error correction for the entire room, like those "ambient room conditioners": https://www.lessloss.com/blackbody-p-200.html
Most people on this site don't in the same way they don't buy servers and prop up huge margins for AWS. The funny thing is it's not hard, I have my own personal autonomous system, IPs, and routing.

You buy transit at any "on net" site they are at, and that can include static IP routing with IPs they lease you or you use BGP to announce your own IPs (from the correct regional RIR). This is "The Internet".
Ummm... if you have infinite power to pull carbon from the atmosphere, don't you also have infinite power to launch radioactive nuclear waste at the sun using mass-drivers? Sounds like that would be a lot more efficient than what you're proposing, too, since it's all fairly concentrated.

The whole infinite power from space argument seems problematic. Even assuming you just meant "a large, globally significant amount of power", I'm guessing that the inverse-square law and heat buildup would sink the idea. I can only imagine the dead zone surrounding the location where we beam petawatts of radiation down from orbit. It would make our worst ecological disasters look like a joke in comparison.
It's informative that objectively unethical lifestyle choices which burden the environment, animal rights, and other people directly, actually are unmentionable and politically incorrect as some vague social injustice to the people who make these choices.
Zksnarks is an incredible pile of research. It’s actually stunning.

Out of band blinding factor transfer is interesting, also relay/mix nets are interesting. I think it’s all a super cool area that’s worth studying closely.
Yelp accused of manipulating reviews to coerce small business into buying ads
Came here to say this. Requiring a sign up to see the product is a red flag for me.
As someone who is interested in amateur radio, there is certainly something magical and romantic about signals propagating from all over the world.
> Also, if you have infinite energy, there are many things you can do to cool off. Everyone will be able to set their own preferred temperature.

Jesus. Someone failed thermodynamics.