skysight-inc/HackerNews huggingface dataset:
Oh, this is awesome. I build a lot of random equipment, how do I help? This kind of thing could kickstart a lot of novel systems that'd take forever to design or cost a ton otherwise.
I disagree. Apple hardware has had some quirks, but over aggressive throttling is far more forgivable than basic functionality simply not working. My laptop is a tool—it needs to work.
The main issue I found with flow is importing type packages.
I dunno, Martha Stewart got a lot of street cred for doing hard time in the slammer.
This isn't any different from many download procedures. Consider that even a general-purpose package manager like Pacman uses HTTP, because there's little point in using transport-level security when the payload is cryptographically signed and there's a solid root of trust.

The only reasonable problem I see with this approach is that a MITM can make clients download an older version that is known to have critical bugs.
Definitely.

(I am working for Wix)

Website design is not a uniform business. A lot depends on what your client needs.

For simple needs, solutions such as our Wix ADI are a great self service tool.

When you want pixel perfect design, the Wix Editor is the tool for you. Most people are able to use the Wix editor, but creating a great design is a challenge, simply because not everyone have the training and talent of a designer. We do see a lot of designers working on wix and making money that way.

When you want more, Wix Code comes into play. With it, you get a serverless platform and a database as a service, and you are able to code whatever solutions you need for the customer.

While in theory your customer can do the coding and design, in practice they are more then likely to hire a professional to do so for them.
Here's the scenario that the original reporter added:

> if the update blob ​indicates a key other than the hardcoded one, it downloads the requested public key from the VLC update server ​over HTTP and does nothing further to verify the key itself. This means that all an attacker would have to do to serve a malicious update would be to sign it with their own key, then serve the matching public key when VLC requests it.

I think they should've included this in the original report, because if true then it really changes the severity.
Who says that isn't already happening?
Uhh, get with program, young lad, the shareholders matter more and not you, the employee.
Unless it is a company owned by its employees. So maybe this is one of the answers: coops competing in the market.
You obviously haven't used LMDB. It's zero-overhead reads can saturate NVMe and even Optane DIMMs, something that no other DB engine has accomplished.
OP here: Wow, did not expect so much response. I owe more details. Our client(his mom rather) used godaddy website builder template which had payment and appointment booking feature just for $15 a month(hosting extra). She did this in a day. As few people pointed out maybe thats all what he needs right now.

My skillset varies a lot. Although I'm confident taking on any technical challenge from wordpress customization, mobile app, CRM integrations to machine learning, I'm little behind on soft skills.

It seems business owners like talking to me about technical stuff(so do I), but none of them are showing interest hiring us. As the top comment pointed out maybe I should target businesses more than 10-15 people. But it's easier to just walk into a mom & pop store than cold calling a firm with more than 10-15 people. I tried online(fb/linkedin) advertising, email marketing but didn't get any customers through it.
“When I use a word,” the commenter replied, in rather a scornful tone, “it means just what I choose it to mean—neither more nor less.”

“The question is,” said the public, “whether you can make words mean so many different things.”

(with apologies to Dodgson)
Refuse to consider, or have considered and refuse to implement? Two very different things.
>Trac is written in Python, one of the slowest languages that there is.

Powering some of the largest sites on the internet. It's about how you write it and what you use (e.g. async python can be faster than Node).

This "slow language" accusation is straight out of "teenager just learned to program" style cliches...
> At least there seems to be no internet disaster as of now?

Are you saying there’s no disaster in general?

Haven’t EU Net Neutrality laws taken a huge hit recently? In Portugal, every major telecom now has zero-rating plans. It’s so prevalent, it’s the example image given on the Wikipedia page![1] Portugal is also one of the leaders in site blocking.[2] It requires no judicial order, which as expected leads to legitimate sites being blocked as well.

So I wouldn’t agree there haven’t been any disasters, just that they haven’t been felt hard enough. Nobody cares about small Portugal, and citizens will take any bad rules (no net neutrality) if they get their “fix” in return (use facebook without worrying about going over the data plan, which by the way is inferior to other EU countries).

[1]: https://en.wikipedia.org/wiki/Zero-rating

[2]: https://torrentfreak.com/portugal-blocks-330-pirate-sites-in...
You can’t simply park $15B is s&p without affecting prices. The reason s&p was able to grow so much is because of companies like dell who try to improve and grow instead of just parking money in s&p
Have a look at https://www.hotosm.org/
You'd imagine an internet time (or civilisation time) used for timekeeping in interplanetary protocols, synced (relatively) well to Earth- or wherever the centre of human Civilisation ends up being. Because clock speed changes due to relativity, your Civilisation Time counter would have to take into account your position and velocity relative to earth to not slip- while syncing often enough to counteract
This way you can have relatively stable time measurement, even when time strictly speaking passes faster for some computers than others.

Time slows down as you go faster. The people leaving earth are the ones accelerating, so they're the ones who travel faster into the future- less time passes for them. If we colonise stars around us, the people going to the further stars (assume all ships leave from earth) will lose more time: Civilisation Time will be ahead of the time they measure on their regular clocks.

Maybe we could use pulsars as clocks? I think they pulse pretty regularly.
Yeah, that changes everything if true. But the subsequent comments on the bug report allege that the new key is in fact verified against the hard-coded public key.
> Can someone please do a crowdfunding for a fully open source 802.11ac chipset and mini PCI express device?

A few RF transceivers and an FPGA like an Artix-7 (which has PCIe capability) might do the trick. It wouldn't be as cheap as a mass produced chipset, but a completely open 802.11ac chipset is unlikely to be mass produced anyway.

We already have examples of LTE base stations being run with SDR hardware like the LimeSDR, which is just an RF transceiver and an Altera FPGA, with a USB3 connection to the FPGA fabric.

In fact there are some SDR/FPGA dev kits that are Mini PCIe size and intended for use inside a laptop, specifically designed with LTE in mind[1].

So WiFi seems doable, even if you end up with a soft core CPU in the FPGA to do the same jobs WiFi chipset firmware is doing right now, at least you'd have full control over it and the firmware running on it.

[1] https://www.crowdsupply.com/fairwaves/xtrx
Uhh, get with program, young lad, the shareholders matter more and not you, the employee. Unless it is a company owned by its employees. So maybe this is one of the answers: coops competing in the market.
> I’m listening, but it would help if you could make a list that isn’t exclusively American.

Not the parent commenter, but here you go: https://news.ycombinator.com/item?id=18948465
Then this issue should still be closed and the validation should be fixed.

End result for this issue is the same. Also, a comment is not the same as posting a bug.
> It suggests that Westerners have forgotten what most other societies remember.

But she wrote books for japanese audience in Japanese. Wouldn't it imply that easterners have also forgotten it? How would her books be best sellers in 'other societies' if they already remember it.
The MT-32 sound module(also a Roland creation) was the target device of a lot of PC games circa 1988-1992. The more sophisticated soundtracks would reprogram the built in patches, also using sysex for this operation. Not only that, they would put text messages on the MT-32's display!
Where have you been looking? LMDB's design is fully documented. Aside from the papers

https://symas.com/lmdb/technical/#pubs

every aspect of the source code is documented with Doxygen.

http://www.lmdb.tech/doc/
IPv6 killer product
Thats it- thanks.
https://www.amazon.com/Prophet-Silicon-Valley-Complete-Seque...

link to the book.
How about when Apple denied 2017's keyboards were shit then they denied it again and again until in 2018 whilst continuing to deny it they iterated on the design to fix the problem and launched a 4 year replacement program for devices otherwise likely to last 10+ years? How much is the EU going to spend in 2021 fighting Apple when the keyboard replacements are still required and cost $700...

How about bent iPads, badly soldered nVidia chips, fraying cables etc?

Code mistakes (sometimes) just get fixed instead of shielded with lies to avoid liability for avoidable mistakes.
The average daily volume of SPY is ~$15B. If Dell increased that by 1% so as to minimally affect the markets, he could cycle in and out of $27B over the course of a year. Diversified over several index funds, or even creating his own, he could do it much faster. That seems a lot more liquid than his current situation.

I agree though, nobody gets massively rich on passive investment. You get massively rich on active schemes (whether that is via entrepreneurship or investing), and then you passively collect when the scale of your wealth grows to the point where the liquidity of passive schemes is more important.
If you don't need perfect soundness, whole-program 1-CFA can be made practical by heuristic pruning. I've done it successfully in a commercial static analysis product.
>This is why we need mandatory jail sentences for white collar crimes...

Wait...

What?

Mandatory jail terms for discrimination?

I think these companies should be held to account, no question there. But putting people in prison if they discriminate against older people, or blacks, or women, or what have you, that's kind of a lot don't you think?

I mean, how many people would we be putting in prison if we started jailing people for discrimination? There is a LOT of discrimination out there.

We should be hitting these companies where they feel it most, in their pocketbooks. Take whatever you feel the damages might have been, and add a zero on the end. Or two zeroes, or three, until these companies get the message.
Yeah during a historic bull market. Plus indexing will stop working eventually.
The problem with the technique used by Eigen (and also Boost.Spirit among a few other famous libs), called expression templates, is that it leverages the fact that the references to temporaries in function calls will be maintained until the end of the expression. The last operation in the expression (assignment to a specific type) will do processing to preserve those temporaries, compute the result, etc...

e.g. it more or less looks like this in a trivial case :

#include <cstdio>

template<typename T1, typename T2>
struct add {
add(const T1& t1, const T2& t2): lhs{t1}, rhs{t2} { }
const T1& lhs;
const T2& rhs;

constexpr auto get() const { return lhs.get() + rhs.get(); }
};

struct integer
{
const int& i;
constexpr const int& get() const { return i; }
};

int f();
int main()
{
auto x = add{add{integer{f()}, integer{f()}}, add{integer{f()}, integer{f()}}};
}

Here, storing the value in `auto` is wrong because by the time the expression has ended, the references point to stuff that isn't in scope anymore

Hence the solution is to introduce a type that will actually do the computation or store the result during the expression ; but before C++11 you had to introduce a type here anyways, which is what was done and of course it worked.
Show HN: Pipelines – Language for scripting parrallel pipelines with Python
VOO is only about $90B. But if you add up all the variations of vanguard sp500 index funds, it seems to be well over $500B.
I remember when Microsoft released Win7 the ISOs were downloadable through HTTP direct links, and MS published the hashes on an HTTPS page. Similar idea, different implementation... and if cryptographic signing is good enough for a company like Microsoft, it should be good enough for VLC.
I know by shipping projects where the -O0 -fsanitize=address performance was enough for the client.
FWIW, I believe business owners can opt into eVerify now and it wouldn’t be illegal to deny workers on the basis of an eVerify failure.

https://www.greenindustrypros.com/business/article/12121235/...

Of course outside of the 19 states where eVerify is required, you’re hurting your bottom line by opting into the program. Not only are you shrinking your labor pool but you have to go through extra steps even to hire a legal worker.
It’s not fair to compare pre-tax salary with post-tax cash flow from your business.

Generally you pay less in taxes for an equivalent net profit as a small business than you would with that amount as a pre-tax salary. You pay slightly more in SE tax (~8%) but you get access to other write offs that more than make up for it, especially with the recent tax reform (huge deduction for pass-through businesses). And you can take as much time off as you want, which may cost you, but the flexibility is nice.

And operating expenses for most consultants are very low. For me it’s just been a new computer every couple years and a tiny bit of software and hosting. Basically nothing.

Healthcare is a big one though, if you’re not covered via a spouse or something.
VLC checks the downloaded file using the newly downloaded key??
No, yes, and yes
Dell went private at a low value, and public at a high one. This means they're doing the opposite of what you say: liquidating index shareholders at low prices, and then going public again at high ones, forcing index investors to sell low and buy high.
I really do not agree with any arguments that are just saying "they're doing it, so may I".
Daily Bitcoin transactions on darknet markets doubled throughout 2018
Phase modulation synthesis as Yamaha does it is computationally very cheap. That was one of the things that really boosted its fortunes in the 80s: you could produce very complex timbres (albeit often nasal or harsh sounding) with just a few sine waves pushing each other around. It's literally just a sine wave whose output pushes the phase of the next sine wave (operator in Yamaha's parlance) forward. You don't even need floating point math, and Yamaha got by with 12-bit DACs.

The SY99/77 really are great, though. I sold my TG77 and FS1R recently, but will probably get myself a used SY99 keyboard at some point. Or save up for a Montage.
This is why I like news aggregators like HN, Reddit, Slashdot, etc. Even if I happen to be the 9 in 10 regarding some article, the 1 in 10 will usually be quite vocal in the comments.
Proto3 has features (discussed elsewhere in these comments, like oneOf) that aren't present in Go's type system. I'm not clear on why constraining it so it's more narrowly compatible with a particular implementing language is more modern.

It would be useful to see an example of the workflow of using this tool compared with the equivalent workflow while using protoc. That would be a selling point, while "modern" is just a sticking point.
Memo – Real-time collaboration for Git
>That’s awfully cynical.

The world is awfully exploitative and cunning. The world of business doubly so.
Perhaps he's saying: Microsoft didn't find a threat model. The VLC developers had the same conclusion.

So the issue should still be closed according to the supplied information in the bug post submission.
Nice work. You (and others interested in open science hardware) should come join our community at http://openhardware.science.
> Aren't academic budgets sufficient to provide for a lab with proper basic instruments?

sobs
Good point about old-and-vulnerable versions. That seems like a strong argument in favor of using HTTPS. I’m curious why the Debian folks haven’t thought this a serious issue either. I’m going to try to dig up the discussions.

But the use of a weak signing scheme is just an argument in favor of switching to a better signing scheme. Though I guess it is also real world evidence in favor of defense-in-depth.
They don't cryptographically sign the updates as the op mentioned?
If the OP was already good at algorithms, then a day or two of refresher is probably all that'd be needed. It's made clear that he didn't have a fundamental grasp at doing harder algorithm questions, hence why he needed so much studying + practice.
> This essential micronutrient is produced mainly by plants, including phytoplankton, bacteria, and fungi; people and animals must acquire it through their food.

Key here is beneficial bacteria and fungi, which a lot of our foods are increasingly poor in.
Because rebranding is one of the sacred corporate cargo cults, and brand agencies need new customers.
Jesus, the look of that seagull is the stuff of nightmares. Zombie wildlife really is scary.
Yet they are screwing up with their sound engines and overall hardware :)
They do, with 1024bit DSA with SHA1. Cryptographically weak and forbidden by the NIST.
It also helps with integrity of the download.
I'm in as soon as Lenovo/HP/Dell introduces a 4GB+ RAM Chromebook with TrackPoint/PointStick/TrackStick.
I reported the issue months ago [1], and I'm sure many have reported it before me. The devs have been ignoring the issue regardless of this particular author's tone.

[1]: https://trac.videolan.org/vlc/ticket/21422
This is amazing, and it makes so much sense. I hope this project gets off the ground (ha!). I want to know if there's animo acids or RNA floating around that lake.
I like this idea a lot. I think the US, we like elections to come in certain cycles to give the incumbents enough time to actually accomplish something, but I have always admired the parliamentary system where you can call an election at various points.

I think the US Constitution either explicitly precludes this kind of system or could be construed to preclude it.
>The truth is its just cheaper than everyone having their own office.

Crappy plastic chairs, $5 non-brand keyboards and recycled CRT monitors are also cheaper.

If you want results from people working in a highly focus intensive and cognitive loaded job, and care about their mental health, adding divider walls is an irrelevant cost.

You already pay them 70K+ per year, it's not some 20K/year developing world call center.

You also don't need to give everyone their own office -- you could have people in smaller units of 2 to 4 persons.
iTunes does the same thing (signed downloads over HTTP): https://news.ycombinator.com/item?id=18582060
Being illegal and going to prison aren't the same.
You say your are a decent programmer. Take another look at Wix Code.

We see people looking to hire programmers to help them build websites using the platform.

There is a demand for programmers among the Wix Experts community.
Wouldn't that make it a derivative work, legally speaking?
what you claim is in contradiction with what eps claims at https://news.ycombinator.com/item?id=18948449

I don't know who is right, but you claim the update needs to be signed, but eps says that it also allows the update to be signed by a key retrieved over insecure HTTP which of course can be MitM'ed. I guess the threat model includes malicious ISP's / governments, so as a user you want a clear delineation of responsibility, and have VLC either 1) use a backup master key to sign the signing key, so if the signing keys is compromised a new key can be issued from an airgapped system or 2) insist VLC retrieve the second key over HTTPS. I would prefer 1) though...
Are you sure that you aren't confusing MIDI with SMF? With MIDI my experience was that it was very simple to implement and understand the standard. It took me <100 lines of C. SMF on the other hand looks quite a bit messier.
Yes, like Reddit, which had to be rewritten from scratch because they simply couldn't afford to keep throwing more servers into the fire.
Her books are marketed differently in the US vs Japan. In Japan they're practical and familiar. In the US they're spiritual and "Japanese."
Golang Runtime for Deep Learning Deployment in TVM
I've seen sites use websockets
10 years, 10 mistakes [video]
> This isn't any different from many download procedures. Consider that even a general-purpose package manager like Pacman uses HTTP, because there's little point in using transport-level security when the payload is cryptographically signed and there's a solid root of trust.

This IS different.

If the VLC update is signed with a key not known to VLC, VLC will then go fetch the new key from the update server over HTTP, and not verify the key in any other way.

This renders the cryptographic signing of the updated binary a complete no-op. Anybody in a position to tamper with the HTTP download of the signed binary can equally change the HTTP downloaded, unverified key VLC retrieves to verify the signing. It is effectively unsigned, and the root of trust is as solid as mist.
Heart rate data gathered from a store demo device without any personally identifiable information isn't subject to HIPAA rules. If it was reading inaccurately then most likely the band was loose or the sensor was dirty.
There's no reason you can't combine the two and create some for-profit service which serves an honourable purpose in the grand scheme of things. The guys who created e.g. JustGiving did exactly that.
This looks like it went bad because of poor communication. There is a lesson in that. For both sides.

For example, what would have happened if the reporter had either reported the security issue via the security process, to people who should understand this, or took a moment to explain the that model.

Or, what if the person who responded had politely asked for more detail or asked the security issue to be handled through that process?

How we treat people can make a world of a difference
>> This is a security risk and should be solved ASAP. Thanks

> This has a unfriendly tone of the OP.

Having lived on both sides of the pond, I'm aware of differences, but in which culture is that considered rude?
You're addressing computer geeks, not the King of Thailand.
>Yes, like Reddit, which had to be rewritten from scratch because they simply couldn't afford to keep throwing more servers into the fire

Actually Reddit is written in Python still. It was originally written in Lisp, but they rewrote it simply for more familiarity.
I am not an expert on VLC security, but here are a few things I can say.

1) The reaction is due to the fact that VLC developers know very well it updates over HTTP on Mac. It has been reported at least 10 times in the past.

2) The comment mentioned by eps about the ability to MITM the key exchange is probably wrong. The update code the poster was looking at is not the one used by VLC on Mac, as JB Kempf (president of VideoLAN) commented. VLC uses Sparkle which is a popular updater for Mac applications, not custom update code.

3) There may still be a vulnerability. Typically apps that update over HTTP and verify using GPG are vulnerable to an attack where the attacker serves an older version vulnerable to another attack, signed with the same key. There are mitigations for that but I don't know if VLC uses them. The Sparkle project itself advises the use of HTTPS for both the updates and the appcast (https://sparkle-project.org/documentation/).