skysight-inc/HackerNews huggingface dataset:
Not a reference per se, but I've noticed that several companies are now explicit that they're doing this. Chase's standard "This call may be monitored or recorded" has morphed into something like "This call may be monitored or recorded, and used for identification purposes", and Schwab has you repeat the phrase "At Schwab, my voice is my password" before they let you talk to a rep.
Quite true, in spite of favouring native over Web when given the option, it is demos like this that show how much we have evolved and make me reassess the current state.
emasculated?
Oddly, whether a project has at least one CVE reported could be interpreted in favor of the project.
https://www.cvedetails.com

Do they have a security disclosure policy? A dedicated security mailing list?

Do they pay bounties or participate in e.g Pwn2own?

Do they cryptographically sign releases?

Do they cryptographically sign VCS tags (~releases)? commits? `git tag -s` / `git commit/merge -S`
https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work

Downstream packagers do sometimes/often apply additional patches and then sign their release with the repo (and thus system global) GPG key.

Whether they require "Signed-off-by" may indicate that the project has mature controls and possibly a formal code review process requirement.
(Look for "Signed-off-by:" in the release branch (`git commit/merge -s/--signoff`)

How have they integrated security review into their [iterative] release workflow?

Is the software formally verified? Are parts of the software implementation or spec formally verified?

Does the system trust the channel? The host? Is it a 'trustless' system?

What are the single points of failure?

How is logging configured? To syslog?

Do they run the app as root in a Docker container? Does it require privileged containers?

If it has to run as root, does it drop privileges at startup?

Does the package have an SELinux or AppArmor policy? (Or does it say e.g. "just set SELinux to permissive mode)

Is there someone you can pay to support the software in an enterprise environment? Open or closed, such contacts basically never accept liability; but if there is an SLA, do you get a pro-rated bill?

As far as indicators of actual software quality:

How much test coverage is there? Line coverage or statement coverage?

Do they run static analysis tools for all pull requests and releases? Dynamic analysis? Fuzzing?

Of course, closed or open source projects may do none or all of these and still be totally secure, insecure, or unsecure.
Good question. There are no wallets, and users don't have to go to QUID to signup beforehand.

One integrated, the payment flow is smooth -- they click pay on your site, it pops up a credit-card entry form, with an e-mail textbox for signup. Once verified, the goods are paid for and you get a signed receipt to deliver your content. (User's cards are charged after they hit a payment threshold.)

More about it on our knowledge base: https://how.quid.works

(Also good point, we'll make that clearer on our site.)
try opera mobile browser. it has a nice zoom feature where the text will always word wrap to fit on the screen!
Printaroo – Your Online Shop Is a Hop Away
They built roads to invade those places in the first place, long before they "owned" them, dug out the gold and sent it to Rome.

I'm not sure the Chinese strategy will work or if they'll see enough growth to support it. It's quite scary. I think I'd much rather prefer US bases to Chinese loans.
It'll be interesting to see if the Disney streaming offerings upend that, given how much sports content they have full or majority ownership of.
San Francisco – where drug addicts outnumber high school academics
Next Level Networking – First Pro Dinner Party
You should be making your pages work without javascript. Progressive enhancement has been a best-practice for years.

I routinely use the fast JS switcher extension to turn off javascript on any site that does any number of irritating things (popups, autoplay videos, etc.) If those sites don’t work any more, then I just never visit them again. Their loss.
I found a bug on the PayPal site (I can't associate a new email address). I tried the contact forms in their app and on the website, both resulted in error messages. I tried emailing them, but got an automatic message back saying that they don't monitor emails, instead directing me to the support form on their website, which you have to log in to access. And as I mentioned, that form just ends in an error.

So it seems like a way more common problem than it should be.
If you're looking for privacy, you shouldn't use DDG as it's based in the US.
Consider searx or startpage instead
This still exists you just have to dig quite deeply for it. I created https://ratwires.space (NSFW) specifically to try and bring back some of the things that made the internet weird and wonderful when I was growing up but within a more modern framework rather than simply trying to make another GeoCities clone.
it's a great fail safe but not if you lose your engines in flight and can't relight them like in the article.
Ah so the fundamental misunderstanding is that you did not understand how the process works and so you proposed a platform that didn't work with existing processes, and so was rejected by essentially everyone you talked to.

Continuances are discretionary. Judges are already quite good about handling extenuating circumstances on their own. AIs can barely understand simple human speech; they are nowhere close to notifying judges about whether continuances are appropriate.

And I'm not sure why you keep pushing this--the problem you've addressed is not a major problem in our court system (or even a minor problem) and the solution isn't worth more investment of time/effort than as an extremely minor feature in a court docketing/filing system.
This situation is so bad in India, that I can't even begin to summarise it... The biggest culprits are financial institutions themselves - they have such stupid requirements for passwords - need to change it regularly, can only contain @#!, need one caps, one small, one number, can't be the same as last 5 times, can't be shorter than 8 chars, but can't be longer than 15 chars either(!?!), etc - that you are either forced to write it down somewhere, or need to necessarily use a password manager. For the less computer savvy people, the second option is a non-starter, so they resort to the first option. And then, these stupid banks and mutual fund companies actively try to sabotage the working of password managers, and even disabling paste on password fields.

And then, there are incredible incidences like this: I received an SMS from a loyalty program a few weeks back:

Login at www.raymondrewards.com with your mobile no. & password <base-64 encoded string> for program benefits. Update your birthday & get 750 bonus pts in your birthday month.

And I just sank in utter despair.
I have always liked blogs hosted on their own. Different fonts, different background, font size/colours, different layouts et cetera. It feels very personal. Medium felt like an assembly line. It's very bland.
Facial recognition “creeps people out,” new bill would bar SF cops from using it
Then you strip out interactivity. Which is a pretty huge component of making the internet interesting and weird.

For its many sins, Flash was actually a pretty great sandbox for people to play with that way (as long as it didn't have one of its many security issues at the time)
This is a pretty clever way to introduce a new service.
> or an ssh client.

FWIW, I have a few ssh clients on my iPhone (Termius, Prompt, iTerminal) that came from the App Store. Termius even offers mosh. Why wouldn't they be approved?
Using the Google Cloud Vision API for OCR in Swift
A lot of online communities today are unbearable tho as everything's become so politicised. It started really wildly happening around 2013-2014 where no community was to remain a zone without some minority of users politicising it for attention. It was probably something that also happened before that but it somehow became really prevalent, at least. And often that took the fun out of it. I kind of think fondly of those times. Now of course this is just anecdotal, but that's what I've experienced in most communities I used to frequent and perhaps lots of other people here did too.

In fact, it's something I really appreciate here on HN, the tone of discussions is rather pleasant and on topic and it's very rare to see people intentionally driving it into the ground, although in contrast to something like a Facebook group it's a lot less personal.
Plus one for this idea.

In fact, I love everything about products that use semantic email addresses as the UI. followup.cc is great at this for their email reminder service. If I could forward an email to unsubscribe@leavemealone.xyz that would be amazing...
I have it on my Pixel 2. It seems to help a lot.
I think "fiscal responsibility" isn't the term Republicans really operate under anymore.

They seem to be more "anti-tax" and "anti-entitlement" at this point.
This particular solution seems wrong for all the obvious reasons listed in other comments...

But on the other hand, I love the idea of resource-limiting tabs by default, along all of:

- CPU usage (allow an initial burst, but after a few seconds dial down to max ~0.5% of CPU, with additional bursts allowed after any user interaction like click or keyboard)

- Number of HTTP requests (again, initial bursts allowed and in response to user interaction, but radically delay/queue requests for the sites that try to load a new ad every second even after the page has been loaded for 10 minutes)

- Memory usage (probably the hardest one to get right though)

I mean, every so often I've caught things like a Gmail tab in Chrome stuck at using 100% CPU indefinitely because it must be stuck in some infinite JavaScript loop due to a bug, as well as the occasional other random blog that uses constant 50% CPU for no discernable reason... and it would be nicer if this didn't suck up two hours of my laptop's remaining battery time before I discovered it.

If the browser had soft resource limits that just gradually slowed down code execution and HTTP requests to extreme levels, with a discreet pop-up warning in the corner "this site is attempting to use higher than normal resources, click here to allow temporarily/permanently" for the times you're opening a WebGL demo...

...it seems like it would be a big win for users.
Cutting power to all engines in response to an event that is most likely to happen while the aircraft is operating close to, but not actually on, the ground is not failing safe.
I never claimed the problems were hard to solve. (It's probably harder than you think, but there's off-the-shelf solutions for them now, as long as you've got a developer smart enough to reach for them, or one skilled and experienced enough to know how to build them in a pinch.)

But by the time you've solved them all, you're pretty much back to where Reddit, HN, Facebook, etc. are. I assume the author does not consider those "fun and weird".

I mean, I remember when Slashdot was having trouble with user abuse of <pre> tags. A simple <pre> tag of all things! When you scale up, you have to close all the little holes, and what's left is not "fun and weird".

You can have fun and weird. It's out there, if you look, and worst case, you can always deploy your own site and do anything you want. But you can't have fun and weird at scale.
It's definitely not a knock on you or your position; it's more a knock on these sorts of politically-motivated, but empty, sweetheart deals. Walker's a particularly efficient trigger when the subject comes up.

Also, I'm just a bit bitter as someone who travels back to my hometown area (the Fox Valley) often from Chicago and it's never the same thing twice. ;)
Then it is not forced?
I think one of the main challenges here is subscription-overload.

Bingo! I had been using Patreon as a "poor man's micropayments." I was implementing the "spend what you would on a cable subscription" idea and spreading mostly $1 payments across nearly 40 YouTubers. I would love a system that just makes micropayments as I browse/watch.
Most of these things I think are pretty easy to mitigate.

>Allowing arbitrary HTML allows hackers to use your site to impersonate login pages, using your trusted SSL certificate to make the page appear authorized in the browser header.

Make each user have their own custom virtual host (yourname.example.com).

>Allowing arbitrary content allowed hackers to exploit browsers to run arbitrary code and go wild from there with user permissions.

Arbitrary does not mean you can't sanitize it. You can specifically restrict javascript for example.

>Allowing arbitrary HTML mixes poorly with having more than one user doing it on a page.

You don't necessarily need more than one person doing it on a page. Each person can have their own page.

>Allowing arbitrary content to be uploaded and served out means that if you're lucky, you'll go bankrupt serving people pirated movies, and if you're not lucky, you'll go bankrupt and to prison for serving child porn.

You could say the same thing about Facebook. We have the safe harbor act and we have the ability to monitor these systems for misuse.
it had its balls cut off. What made it edgy and fun was removed as it was promoted to normal people who just wanted to read movie listings, or whatever.
Overspeed protection takes place once everything else has failed. The engine controls have already attempted to throttle down and such. If that doesn't work then overspeed kicks in.
> [this] shows that the internet is still fun and weird for people that like fun and weird

Does it, though? Google used to give search results, now it gives Google Search Results™ and most navigation is dictated by what appears in social media feeds. The behemoths are able to enforce a sense of legitimacy in their own products while marginalizing any threats to their dominance. If they really can't stop a rising star that is pulling away users by squashing or copying them then it is no issue to throw some money at the problem and buy them out.
How can I post a question on Hacker News?
The other problem that bedeviled sites that allowed arbitrary HTML back in the day was crude phishing attempts: convert your user profile into a fake login page with CSS and HTML. Blocking this entirely is probably impossible. I suppose some machine learning could be used to detect pages styled as phishing attempts.

There were also all sorts of ways to sneak JavaScript back in. I remember embedding a javascript: protocol link inside a Flash applet would do it (flash eventually blocked that though).
OK, thank you for clarifying. It does read that way though, basically "Google was not abusing it like fb, thanks to Techchrunch they will lose their cert anyways".
"in short, many people lured by financial rewards may not fully take in what it means to have a company fully monitoring all your screen-based activity"

I would like to see this spelled out. What are the risks? Why is this any worse than being a Nielsen family back in the day?

It seems like the most likely thing to happen to the people who signed up for this is: nothing. They helped a tech company with their research and got paid. That's it.
Apple just took Google’s money to be the default integrated browser/Siri search engine in iOS. Apple’s morality on privacy has a price. The public outrage will need to be huge. Heh.
Gimme some more of that sweet walled garden.
I think we already do this. Its built into the fabric of the web. Not sure why we are proposing arbitrary limits and additional user opt in for this.

Wether a website wants to be inefficient or has a good reason for having a lot of resources it impacts the speed with which the site loads. The slower the site loads the more users are going to abandon the site. Stats say by 2 seconds most users have abandoned a slow loading site. Caveat that if the user feels the site is really worth the wait, they will wait longer.

So seems everything in this proposal is already addressed...
BEGIN KEYBASE SALTPACK ENCRYPTED MESSAGE. kiS2n6W4XB3QNEC peK0YLJK3LrUU4J ZUfCVBNUhWDXYby TkGZ91n3S9ep9c4 eKR2g2cXo4w1rxv MbLStzP8j7bPSKT 8FFt3dDpm3pMG1O UyCAed0l3GtoadX 51BWBdetJCgOzmw FhrciyUXrDnqwHz zaS1YQao8KgZT01 IdzgApjslh23dxR TwadRIu1swS1fVs diIvDSHnwqH4DwF QCbvcCeiSetv4fD xqTvVG7yj1nCLy4 9Pt3TlOUT72cHCH VmQLuI68X5ERp0K HIBvSrS1yThzILN yUqZ8sFQk8nDtUa 829LWJr54KpP66l JkW1Aj6o9kO0W6I qCv6uLEvk0u15bv ESIGVFOv9YxC3IL gqPxgTTAE6zhwSX f1LgR9msZqNzaqa GDXXxeUq33gJ4Mn S5aaYZQeiWmklPK 14Q7j9xVgo3hnaH dmt3kmy88IFXPKQ dZuebIdwXmMxjxg EJenNubVc0UCus8 LUOH9o9aTiLk7G5 0evoFIg7uiAac9G ib1DtE0UMrTI260 Ozf6r7x8wXtmDzH E3kOBRiUMtd2bPG roh7wIGZPdcaVmd ftY658blAA6HjPR vdZVR3wqKDwBES8 88oy8bMwgsLNxGS CLCq1pPxB9iP9wy yPkb82R5xdMMN8y XyHheuQrAC5tDBW wQ9JOqxNymDkKXE EVl62aqexReErEm t83saUws9pB1yST R1jfWNB9K98lvKp koms8iW4D4QX4yc y2aXd95rESqX03n gv3mCtWhQP1eLZb GI1n7um4d9C0yKb KTkbLXP04W7TWvS EzjGqg1OtruqyZ4 RzBvlpbVoK6yyrU lHkTNM7b5f3J48R UDFh1X6sqTeNntk bPRMk1rYW37Tbde 7AUTgZxxke64cRR TdG3gE3HBmvCs01 ZyDk9VUVHqAXJzV 0McKxFEXFRJ3Bdv LWzumu4qUGe4kOZ VHPCnUFQiDKuwuI Wmsn2dBYjVTY48j pSQgVrw8oi2cnyl 8gajc8FoWKd0mtA 43IctiiTCeQ6ZAh vhoudLc6QUwI6UR fgO9DBSKmYqFISh . END KEYBASE SALTPACK ENCRYPTED MESSAGE.
Nickel tends to be corrosion resistant. Oxidation is a probabilistic sort of thing. The higher the surface area, the higher chance of corrosive cascades. A metal sponge has significantly higher surface area than the equivalent mass of polished bar stock.

I bet if they did the same thing with iron, a drop of peracetic acid on it would make it go "FOOF!".

Actually that might still work on the nickel.
When a swarm of killer drones comes down your neighborhood, good luck complaining "it wasn't a fair fight".
What kind of strategies did they use to break through the noise and promote their content in the beginning?
To be honest that's the biggest reason I have never really rooted for Signal. Even though it's like really beta, I would rather invest my hope and efforts in Matrix/Riot kind of setup.
!s = Startpage, anonymizing by proxy the Google SERPs. I know, I'm having to retrain my DDG Bang muscle memory myself.
Did not know that thanks.

The box art also explains the blue hat (on the book cover).

https://www.retrogames.cz/play_004-Atari2600.php?language=EN
No, i read most articles through Pocket. Just save the link to pocket, and read it popup and adfree in the pocket app.
Dave is a long-time friend, a member of the Bitcoin elite and a new angel investor. In Michigan we sorely need more angel investors.

I thought his approach to finding (and sparking) investments was novel and innovative. Lots of angels tell me they just can't find worthy investments and that's why they're inactive. Dave isn't just waiting for people to pitch him.
"toronto weather" gives me the weather now and the 7 day forecast in a widget on the top of the search page. If I search "packers" it gives me the latest packers scores on the top (and if a game is ongoing an indicator of the time, who has the ball, and the score), if I search "patriots", there is an nfl tab on the top that I can click and it gives me the scores. I'm not saying you're wrong, but DDG has been working on some of those issues. You can always add !imdb or !rt in front of your shows/movies for rottentomatoes or imdb.
First result from Google: https://github.com/facebook/graphql/issues/91
That's a rather interesting question... maybe.

https://urbanmilwaukee.com/2018/11/27/murphys-law-is-foxconn...

> First, the fact that state passed a law with special benefits for only one party. “It’s a principle of law that you can’t pass a law for the benefit of only one business or person,” Flynn says.

> Specifically, the Wisconsin Constitution has a provision prohibiting special laws to benefit a particular party that are not general in scope. And the law providing a subsidy for Foxconn gives the company different legal treatment than any business in Wisconsin:

> -Foxconn is exempt from state law requiring an Environmental Impact Statement to be filed by any new company building a plant;

> -And Foxconn has been awarded special legal treatment under the courts, whereby any legal claims made against it can bypass the state court of appeals and go straight from circuit court to the Wisconsin Supreme Court. In fact, any decision by a circuit court is automatically “stayed” or delayed, until the Republican-leaning Wisconsin Supreme Court takes up the case.

> No other business in Wisconsin has been accorded these benefits. The Republican-dominated legislature sought to disguise this, Flynn notes, by targeting the benefits to any company in a designed investment area, “but then they said there can be only one company allowed in this area. That’s tantamount to saying only Foxconn can benefit from this, which is unconstitutional.”

> ...

> A second challenge to the legality of the Foxconn deal, Flynn notes, is for breach of contract. The company promised to build a Generation 10.5 plant, with a factory of workers building panels for 75-inch TVs, but it now says it will build a much smaller Gen 6 plant, with most of the manufacturing done by robots.

> The deal, moreover, was supposed to provide a state subsidy in return for 13,000 jobs going to Wisconsin workers, but Foxconn is now considering bringing workers from China, as the Wall Street Journal has reported. The company denies this, but had earlier denied the change away from 75-inch TVs, only to later concede these news reports were correct.

> Moreover the company said that while Wisconsin workers will be the first priority, “We will supplement that recruitment from other US locations as required.”
How does what fit into what?

It's possible to serve ads without being creepy if that's what you're asking.
There was a period when you could use Flash to invoke a javascript: protocol link and it would be executed in the containing page! They fixed it eventually but it was a great way to escape the Flash sandbox.
Someone knowing your birthdate isn't really a big deal anyway
Aside from the fact you can return JSON types as a catch all.

It is possible to imbed types within types in GraphQL I.e.

Post {

Comments {

Comments

}

}
Surf (a suckless webkit2 frontend) can be configured to disable JS by default, if you really need it, hit ctrl-alt-s and volla the junk gets executed. Browsing without js is wonderful.
https://surf.suckless.org/
We have fully automated homing cruise missiles since the 1980s. That's what modern combat is about these days. That's why guerilla fighters exist: to hide from US Troops because they can't win in a fair fight. They need to use civilians as shields (and there's no AI that can determine friend from foe yet).

---------

The Starcraft demo was supposed to be a demonstration of intelligence. Not a demonstration of superior-accuracy and superior-dexterity that machines have. We've known for years that machines can see things at the millisecond level and react faster than us for some time.

The AI problems trying to be solved today are "friend vs foe" recognition, strategic decision making, etc. etc. The AlphaGo game managed to demonstrate that. But the AlphaStar games only demonstrated what we already know about computers: Computers can click faster, and more accurately, than humans can.
Yeah, I think the issue is there's not a lot of low-hanging fruit anymore. No one hacks together some PHP scripts to create a community website anymore, they just make a Facebook group, or use Discord or whatever.
There are an infinite number of apps that can be made that aren’t ‘cool springboard replacements’.

Why is that even remotely important?
I disagree with this view completely.

Companies like MailChimp and Atlassian are great examples of bootstrapped companies that became very successful. There are more.

Money is great to have at any stage of a company, and bootstrapped companies prefer to trade stability and time for the freedom of not having money (and those who only focus on it) control decisions.

You can build a great company with and without investment, but you can fail with either just as well.