skysight-inc/HackerNews huggingface dataset:
Only an installer on pear.php.net was compromised. I think a "proper" package would be built from the source code, bypassing that installer.

But a more ad hoc package, like from Arch's AUR, might just fetch that installer from pear.php.net instead. In fact, that's what the AUR package did - it just hardcodes the URL of the installer.

The AUR package was (probably) not compromised, but perhaps only because it happened to use the nozlib version of the installer instead of the version that was compromised.

This is how the AUR package looked at the time: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-p...

And this is how it looks now: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=php-p...

The old PKGBUILD does have a hash, but I don't know if it was obtained from a trusted source. So I would guess that if it had used the compromised installer, and the installer was compromised after the PKGBUILD was updated to use that release, it would have alerted people that the installer had been replaced.

The new PKGBUILD uses the Github release and includes a PGP key.
The key issue that relates to political division:

> As a general rule, the more political and emotional and social ties we have to an idea — the more an idea matters, in a deep way, to our sense of ourselves — the less likely we’ll be to let it go even in the face of strong evidence it is false.

The more you "are a progressive" or "are a conservative" (or whatever ideology, these are just examples) as part of your identity, the less open to reason you become. Ideologies give concrete answers that you can just point to whenever a hard question is raised - but more often than not these concrete answers are inflexible or only partially useful.
> to find something supporting what you said
read the username, I am not OP, and did not make the claim.

A simple search of "hypoxia from excess CO2" brought up https://en.wikipedia.org/wiki/Hypercapnia, which also support the claims.

Please, for the love of god, learn to google properly: http://www.catb.org/esr/faqs/smart-questions.html
Dunno, I don't mind being called a Rustacean, though I think Rustafarian is a lot cooler. The Gopher term doesn't bother me either, at least it wasn't "Yo Goats!" or something worse. I also like Pythoneer / Pythonista (don't ask me why I like that one). Not sure what D programmers are called, I guess just D programmers. That or Walter Bright's Heissenbuds? I don't know.
I agree with this principle. Can you tell us more about the trades people you know have been driven from?
I can't understand this fraud - surely getting something delivered to your door is the silliest way to defraud something? Also what are they doing with the £100s of takeaway food they are ordering?

I must be missing something here.
I've been passing "Fabrication of the Accelerator Structure" (the un-remastered version) around to people the last several years to show some people where I work.

Andy recently remastered these. I hadn't seen the first one before, but the second one is 100% work 42 minutes of your time. The narration is great, the topic is great, the pictures are great. Unlike current videos, it's happy to dwell on shots for more than 2 seconds, in silence, while people are actually working - instead of the pretend-working for a camera shot with dialog or futuristic music to fill the silence.

I really wish they'd have created more of these types of videos over the years, but $84k in today's dollars for a video would be a lot of EPO budget these days, in addition to 42 minutes being an eternity. It's a great documentary, and, I think, a treasure.
It's unacceptable - sexism.
That's how I feel and I felt I have to object.

Discriminating in the name of fighting discrimination is just a way to get more discrimination.

I am not going to attack you or anything, I guess your intentions are pure, I just have to express my objection and ask you to please reconsider your position.
Nobody cares about machines. Does your AI have a personality?
Just curious, what trades were these people working that they lost due to illegals? I find it hard to believe that there is a widespread job loss for skilled trade people.
Why do US colleges over-admit like this? In the UK you apply to do a computer science course, and they have 50 places or whatever for that course, and so they admit 50 people. You can't get into the college and then be told that actually it's full. If they do accidentally over-admit it's their problem to solve, not yours.
the main reason i use nvm is because its the only way i can use npm i -g.....
If an illegally underpaying employer only hires illegal immigrants, will the crime be seen by anyone who won't lose out from reporting it?

Seems to me, if a gangmaster is supplying seasonal workers to a farm, the farmer won't report them, the gangmaster won't report themselves, and the workers won't report their employer. Who's left?
Kamala Harris’s Logo Is a Disaster
Ask HN: Minimum networking knowledge for large scale devops?
What is the minimum knowledge of networking you need for large scale devops?
Maybe the restaurant is part of the scam, and the food is never prepared? Still it would remain extremely easy to trace the fraudsters.
> why the generalization? lot of package manager have been serviceable for decades, their security model based solely on verifying the maintainer identity with clients deciding which maintainer to trust.

What happens when the maintainer of a package changes?

The big problem I see happening is maintainers getting burned out and abandoning their packages, and someone else taking over. You might trust the original maintainer, but do you get notified of every change in maintainer?
> If an illegally underpaying employer only hires illegal immigrants, who is going to see the crime and report it to the enforcement agency?

As I already addressed with point two, fast-tracking of immigration status to legal citizen status, is vitally important to remove this method of extortion.
According to their subscriber forums, their current subscription model counts as a 'paywall' as far as Conde Nast is concerned, and there are no plans to change that currently.
The point is that the async style of programming will introduce unpredictable and potentially wildly varying service times. Contrast this to multithreaded programming, where the program is cut into thin time-slices which all have a similar, predictable duration.
A case in point to what you're saying, I think: Greggs - a UK chain - recently started selling vegan sausage rolls, and I think the reaction demonstrated that their sausage rolls are really pastry with something with meat-like texture in it. It got a massively positive reception. Though certainly in part due to a fantastic social media effort. But the social media effort got people to try it - the positive response afterwards was in large part due to the product, and the product only works because nobody is buying a Greggs sausage roll expecting a strong taste of meat; just a texture that says "filling" and flavorings associated with meat rather than something something sweet. And so the quorn based filling was close enough (I've tried quorn, I didn't really like it, because I bought it as a meat substitute, and properly prepared, it's close, but not close enough when you want meat taste).
Naming conflict with Fish Node Manager (https://github.com/jorgebucaran/fish-nvm), a wrapper of NVM for the fish shell.
JumpStory ApS
Show HN: CircleUps – A Politeness Tool for Busy People
I don't think it's wrong to get excited about new tech. But from what I have observed it's mostly that one dev that pushes for new stuff and after they get sick/leave someone else has to take care of it and many times it means a rewrite of that functionality. Also many times with new tech, you can't really tell its bad sides, because it takes some time to know if it's solid or not.
Possibly less sophisticatedly I think of them as a sandwich of affine maps and nonlinear isotropies (as those giving irregular rings in tree trunks). The affinities are represented nicely in GL(n+1) with a homogenous coordinates trick related to neuron biases. A question would be if there's something interesting to say about the interactions of the affinities and isotropies in group theoretic terms (which I dunno).
Scientists observe a new form of strange matter
FSFE publishes expert brochure about “Public Money? Public Code”
I didn't find it clunky at all, and it's not about LINQ specifically either. It's about how you'd derive the Rx event-stream paradigm from the building blocks that were well-known circa 2012 when the article was written, and how it abstracts over things so seemingly different as mouse clicks and relational databases. It's supposed to give you insight instead of just telling how to apply X to do Y. However I'm already very familiar with the pattern and also know how it was derived using duality, so YMMV.
And you would have had to have done related courses A levels for the last two years.

You cant just rock up at a university and say id like to study X with out any previous education - this is what the Raspberry Pi was made for originally.
It is likely that this is a variant of the issue with secure files. Secure files require a song and dance around changing the default branch or committing directly to a default branch to trigger a build after setup of the secure file. Coming from CI systems like Travis and Circle, this is an extremely confusing approach that I hope they consider changing.
http://lmgtfy.com/?q=sugar+alzheimers
From my experience with Deliveroo, you can pretty much order at any address, wait for the delivery person at the doorstep and retrieve your order without actually living there.
I understood you correctly. I'm just saying, even if you will build remarkable product you will loose with some corporation technology like TypeScript. They don't need to be remarkable.
Perhaps worth mentioning, since it's nowhere in the article, that the first thing to do is not to spend hours on the phone with Deliveroo (or whoever else) but to call your bank to report the transactions as fraudulent and to block your card.

That will probably get you a refund quicker (the transactions will likely be held until clarified) and will stop any further fraud.

As for Deliveroo's support team... Not very good in my experience, but that's common. Their competitors are no better.
Great idea and well executed! Do I need a Google account to use it?
3.2. Configuring TLS and SSL encrypted connections

https://www.balasys.hu/content/documents/zorp-gpl-guide-refe...
I found Deliveroo sending highly detailed location information to a marketing company(Braze) yesterday[0]. I can't remember every giving explicit consent for this and AFAIK under GDPR just covering this in a Privacy Policy is not enough.

On the topic of this story it seems like a case of credential stuffing so it's not a breach in Deliveroo's systems. Do the requirements as a "Data Controller" still apply in such as case? Regardless Deliveroo seems to be handling this poorly.

0: https://twitter.com/K0nserv/status/1087753850088554496
Sorry for being so pessimistic. I wish it be other way. I keep my fingers crossed for your project.
No you don't! We support Gmail, iCloud, Exchange, Office, Outlook calendars!
I don't see how it makes my statement untrue. The most effective ML techniques are more effective the more x/y pairs you have. Sure, you can get a leg up if you partially define F yourself but then you're no longer being as hands off as before. In practice the WHOLE of F() will likely be a blend of machine learning as well as heuristics as a product of various layers that are one or the other.
TL;DR: uses code generation to allow output of messagepack-like serialized data of exported struct fields, allowing for very quick serialized data comparison.
Machinarium has a great soundtrack for coding too: https://open.spotify.com/album/52PLNrXUMtPUZwcueV75J1?si=2mv...
I once asked for delivery to a pub's car park. No problem and the delivery guy did not ask for any ID or anything.
I would be shocked if it's that simple and Deliveroo didn't bother looking better into it. If we laymen can figure this out on an online forum in a small amount of time why can't Deliveroo figure it out and report the Restaurants to the police. Worse yet, how is this happening to so many people! I swear we'll hear they got hacked in a few more headlines.
Thank you. It’s terrible to see how little it takes to expose the seedy underbelly of even this community.

It’s even more discouraging to think how far we have come from the times where, among the favorite lore, was the story of JFK asking someone sweeping the floor at NASA “and what do you do?”, with him replying “I send men to the moon”.

(Edit: you probably need to change your settings if you want to see what we’re reacting to.)
How to quickly set up a Gatsby.js JAMstack website with a headless CMS
Because it’s awful for your health?
I was drawing attention to a possible "branch prediction error" subsequent to the word "store". I don't have any problem with the sentence in its context, I'm just trying to respond to the viewpoints expressed other comments in this thread.

In particular, the comment I replied to made a claim that I thought I was meaningfully responding to.
Society decides that a certain degree of criminal activity is 'acceptable' in some sense all the time. That's why, even though it would reduce crime, we don't double our policing budget. At some point we decide that the expected reduction in crime isn't worth the extra expenditure.
Microsoft Bing Blocked in China as Tensions, Crackdown Intensify
So if you cross the border and join an illegally-underpaying work crew, you're guaranteed legal citizen status?
By the sounds of it this is a simple credential reuse attack (it's even states as such in the article) so I really don't see where these accusations of a "data breach", and "encryption, which appears not to have been in place” come from. If these fraudulent transactions are the result of credential reuse I really don't see the GDPR violation here.
This is completely pointless pedantry. Everybody knows that, and nobody bothers to type "Turing-complete (up to memory constraints)" all the time. Real mathematicians do this all the time, taking shortcuts with the understanding that they could phrase it completely rigorously if it were necessary.
> If you mean financial security, I think most Americans think you will work harder without financial security.

I have no idea what people are thinking, if they are at all. Work primarily matters when there are no opportunities. Zuckerberg isn't the hardest worker of his generation. He found one of the best opportunities.
I'm still envious of my friends with Amiga 500s. The Amiga just kind of does that to people.
Calcium in milk is also not bio-available once it’s been homogenized, because it’s stripped out of its protective fat layer and expose to lactose which binds to it in a way that humans can’t undo on our own.

Milk is a fantastic source of calcium, when you don’t mess with it too much. Why wouldn’t it be? It’s evolved specifically to grow mammals up to full size as quickly as possible, which includes growing a lot of bone. The issue is that we’ve monkeyed with it in a way that’s convenient for producers, but bad for consumers.
I'm a bit confused, probably since I don't have Apple pay.

Does it not use credit cards?
It should then be very easy to dispute the charge with the bank.
I think you're talking about Sorbet: https://sorbet.run/
I was interviewed for five mins on the phone back in 1990. They asked if you programmed your own computer at home. Not sure what they would say if you said "No."
Awesome, I'll look forward to it. Thanks Paul!
Not feeling attacked or anything. Thanks for sharing your feedback and feelings.

I also feel like focusing on the gender gap and inequality in tech and trying to fix it in some way is something not that simple to do.

P.S. Men can also apply to any job from TinyGigs.co - but hopefully companies and women alike will feel that on TinyGigs there's a place to connect more easily
It might be a far stretch to say that they've been "replaced". At least in my area the traditional vegetarian options are still there alongside these newer items.

It's not to your taste, which is fine. There are meat-eaters that don't like seafood. Let's just be happy that there is now an ever-growing choice in the plant-based section of the supermarket.
Makes more sense. But still seems pretty odd and a complex scam (vs say running up fake orders directly with stolen credit cards).

If that's not the case you can't resell takeaway food, so no easy way to turn it into cash.
Which is really quite a baffling perspective. A stereotype/joke I was told while young: if you see a scruffy, probably homeless, person near a good university you should first check to see if they are part of the Math faculty before making any further assumptions.

It is not possible to gauge intelligence or academic credential by visual inspection, unless someone is wearing an academic gown. Some very accomplished people positively seem to enjoy looking disheveled.
I use Apple Pay with both my debit cards. This is in the UK.
That was my first thought too. Yes, I'd contact Deliveroo, but also my bank. If I didn't get a refund (some people waited months?), I'd sue them in a small claims court if the amount is low enough for small claims and if its not, I'd at least talk to a legal adviser. Waiting on Deliveroo for months after being defrauded thousands of pounds is crazy.
Agreed about Java. However in OCaml or Haskell it allows elegant immutable tree structures with maximal sharing between versions.
> NASA, a government agency as well-known as Coca-Cola back in his little Brazilian hometown.

I've noticed this when I travel--all over the world, I see people wearing NASA t-shirts, everywhere I've been: Europe, Asia, South America. It seems like the NASA meatball is globally popular.

Whatever the Americans are paying for NASA, it must be an absolute bargain in terms of the good press and soft power it wins them worldwide. Can you imagine any other foreign government agency that people would be eager to have on their shirt? Was Roscosmos similarly popular during the Space Race?
I do think that code changes take more than 5 minutes, why?
As a person, who pushed the code:
1. I have to read the comments
2. Decide if they are right/it's worth a hassle
3. Sometimes you have to reach out to the author of the comment to clarify some things.
4. Change your branch
5. Change your (thinking) context
6. Apply stuff
7. Push stuff
8. Notify the person that it's done.
Many times it's more than 5mins, more like 10/15mins+

I don't hate CR. Someone below explained it better than me, that different people see the code differently. And you should respect that someone wrote it that way and not try to force your way upon them.

> If you getting bit architectural change problems in your code review, you obviously didn't collaborate with the team very well... People should roughly know what your approach is before the CR even arrives at their door

I agree with it a lot. I think that would solve a lot of problems, but not necessarily the small ones.
But what you going to do with 3 £100+ takeaway orders back to back? You can hardly resell it!
Question: are you looking for facts to support your opinion, or are you looking for enough facts to determine what’s happening with respect to illegal immigration & jobs in the U.S.? Because the story is complicated.
When our kid was 2, we used to drive over SLAC on 280 several times a week. We taught him to be able to answer what “the building that looks like a train” is really called. What’s cuter than a little guy squeaking “Stanford Linear Accelerator” :) Still makes us smile.
There you go with that wrongthink. You’re on the wrong site buddy. In general these folks don’t care that illegal immigration disproportionately impacts native born poor and miniorities. They treat it as some kind of myth. They also act as if every gov employee is some vitally important researcher or scientist. Anybody who has ever worked in a legitimately large organization knows that you can easily lose 10-15% of the workforce and barely even notice it.
The 80386 is unusual in that it supports multiple calling conventions

It's unusual to speak of a processor as "supporting" any calling convention, given that they are simply a convention compilers may follow. The CPU doesn't care (and in the case of the 386 which has no return address prediction or special stack handling, it really doesn't matter) about such things as functions or procedures either, as you'll quickly realise if you read good optimised handwritten Asm.

Instruction encoding is highly irregular.

It looks very regular in octal:

http://www.dabo.de/ccc99/www.camp.ccc.de/radio/help.txt
Node and React and SEO example
I think in CS that isn't such a concern.

I mean they will want good grades in maths (and decision maths covers some parts of the CS curriculum) but little else, perhaps Physics - but other than that just good grades.

The thing is that the Computing A Level wasn't widely available and the quality differed between qualifications and exam boards as well - whereas Maths is pretty consistent and is run at every school.

I was fortunate enough to be able to study Further Maths as well, which honestly I would consider a better preparation.
Microsoft Bing blocked in China
In the UK they oversubscribe most 101 courses, including Psych and Comp Sci. The real watershed is Junior Honours classes which are fixed places. Even 201 is very large.
Or maybe the agent didn't want to take the next call in his queue and wanted to relax a bit.
one would think in free market US economy you will have tons if brands to choose for each budget but the article imply opposite, is it really truth there it's unregulated monopoly? can't you buy cheap glasses in supermarket for few dollars or some event brands for let's say 50-200$ online? looks odd from Europe

of course luxurious brands cost more, bit who is forcing people to buy luxurious fashion brands? that doesn't sound like monopoly to me
I love the saxophone arrangement of Philip Glass's String Quartet No.3: https://open.spotify.com/album/1DqC3PqfnxwzAEryseW4iY?si=kr1... In particular, when I really want to get into the zone I have the last movement on single repeat.

The other single-repeat song I like is Cimex Lectularis by Ed Dowie: https://open.spotify.com/track/2WXibRi5REhP3a7WDsvQ1t?si=Zgd...
Period-Tracking Apps Are Monetizing Women’s Extremely Personal Data
Problem is most vendors will then block you from ever using their service again. Might not be such a big bummer, after all they're helping people steal your money. But here it was through Apple Pay, so it may have bigger ramifications to block the card.
Hackintosh is not an option for the serious developer.
Wow, things really went pear-shaped with the package manager.
/rimshot
Awesome idea and love the feature already. Always a struggle for me to follow up after meetings. thx!
You should report it to the relevant UK agency tasked with GDPR enforcement.
Have not. For me, there are events where the internal media team (responsible for announcements and for ads) handles taking these.
I haven't yet.

I'm considering it because of the popularity of LinkedIn but in the Anglo-American culture and thus most multinational companies - it is frowned upon to attach a photo to your CV.
This is poor form from Deliveroo - their fraud detection seems particularly lacking, and fobbing customers off for months at a time is not good enough.

However the article is unnecessarily sensationalist in banding around GDPR data breaches. Much of the article intimates there has been a Deliveroo data breach, whereas in fact the most likely explanation is attackers reusing passwords leaked from other breaches. This is acknowledged towards the end of the article but quickly glossed over.

If consumers are reusing exposed passwords this makes life tricky for Deliveroo. Maybe they should be using Troy Hunt's "Pwned passwords" to protect new user signups:

https://www.troyhunt.com/ive-just-launched-pwned-passwords-v...