skysight-inc/HackerNews huggingface dataset:
If your security strategy relies on one or two security controls, you're doomed most of the time.

We've added SQL filtering as a defense-in-depth measure, having a convenient seat in the architecture, complementing every other mitigation measure proper application developers and DBAs should be doing (and frequently get wrong).

Even ORMs get bypassed once in a while:

- https://github.com/mysqljs/mysql/issues/342
- https://github.com/sequelize/sequelize/issues/5671
- (okay, we can avoid this one by saying nothing "nothing proper exists in NodeJS world)
https://bertwagner.com/2018/03/06/2-5-ways-your-orm-will-all...

Dumb concatenation can nullify the merit of quite advanced ORM: copybook example of misusing Ruby's ActiveRecord (is that proper enough) got as far as OWASP testing guide: https://www.owasp.org/index.php/Testing_for_ORM_Injection_(O...

Prepared statements are cooked wrong as well, but rarely, that's why they are viable line of defense, but not the sole one (as nothing should be):

https://www.reddit.com/r/netsec/comments/ww9qm/sqli_bypassin...
https://stackoverflow.com/questions/134099/are-pdo-prepared-...

(in fact, I've seen with my eyes exactly what first comment in reddit postmentions).
You can absolutely compare effective marginal rates; if you have effective rate data by income level, you can calculate from that effective marginal rates, which are simply the effective rate on the difference between the nth and (n+1)th dollar.

OTOH, because one of the big ways this is manipulated is by income that isn't “counted” as income, getting good data from which to estimate effective marginal rates is tricky and you end having to make assumptions that are hard to validate.
I'm not clear what the efficiency gains are here at all over a SSME style staged combustion cycle. In both designs all propellants go through the chamber. Comparing to a gas generator cycle there are gains, sure.

It seems like the major win here is running oxygen rich on the oxygen side and fuel rich on the fuel side to reduce the chance of a leak destroying the whole vehicle.

Am I missing something?
I really liked the added wrinkle in Blade Runner 2049 where replicants have to periodically prove that they're sufficiently robotic.
What's the limiting factor on just running with reduced staff support? (Honest question.)
Sounds like they're filling out an online form acting as the buyer, which might be in uncharted territory legally, and they want to dot every i.
I think thee is also definitely a problem where if you don't use the right/current fad/popular stack you'll have a lot of trouble hiring people to work on your stuff.

Especially true since front and back end web stuff is so huge and high paying. problem comes when those stacks are a very poor fit for the problem at hand. But sure you could get an old neck beard to write that in C++ instead of java/Ruby or Node.js. Great you only need a single core embedded processor and it doen't even get hot! And yeah then who's going to maintain it?
Maybe he isn't a robot, but his given birth name was
zxcvbn4038
Yep.

With the possibility of almost uniquely identifying us on the web through fingerprinting... Google, of all companies is in the perfect position to know that my web request was made by me... And therefore I'm not a robot.

You can only conclude that recaptcha is a ml training exercise.
Actually, Eclipse was a port of the "Visual Age" family of IDEs which started out implemented in Smalltalk. Smalltalk started out as something like Lisp, without the insanity of coding in your data representation. (Unfortunately, it means you don't have the insanely great benefits of coding in your data representation.)

Emacs was actually a great way to do work over a slow modem connection back in the late 90's.
Hiring Senior Mobile Engineer
TAPP is hiring! Los Angeles based or willing to relocate...
Senior Mobile Full Stack Engineer:JavaScript/ReactNative
jktappgroup@gmail.com
Hummus? Or humus? Because one I'd like to eat with pita bread and a nice shawarma.The other...not so much :)
Thanks for the reply. So if after accepting investment, if the company does not work out and has to shut down, is there a personal liability owned back to Earnest Capital by the founders?

Second, can you explain the valuation cap in terms of acquisition. Let's say I take $100k in investment, and 5 years later I sell the company for $10M. What is the max amount Earnest Capital will receive?
Maybe they should have GDPR-like fines (I am not saying that GDPR it self is good!): "In some cases, violators of the GDPR may be fined up to €20 million or up to 4% of the annual worldwide turnover of the preceding financial year in case of an enterprise, whichever is greater."

AT&T's revenue is 170.756 billion so the fine would be up to 6830 million dollars, or almost 7 billion dollars.

Maybe this kind of threat would stop them from selling this private data.
> Earnest would still recoup 30% of its investment (ignoring other expenses and time value of money) even if those companies never saw a penny of revenue.

How so? Who's paying that 30% if you have zero revenue?...did you mean "if those companies never saw a penny of profit"?
Blows my mind that a president has that sort of power. Congress has the ability to make war, not the executive.
Flip it around. If the stack you're using is memory or compute intensive for a given load, it will cost you more to provision that load. You may not need to service 1M connections, but you may need to service 10K connections with a single box instead of multiple boxes due to cost.
Clean code tips will dramatically improve your productivity
Why wouldn't a bot just use a proper browser (not headless), detect the "not a robot" box at the pixel level, and click on it using browser automation or some mouse movement script? At today's level of bot sophistication this seems almost trivial. Sure it might cost more in resources, but I doubt it's economically prohibitive when you're making at least a cent per fraudulent ad click?
Turn off JavaScript... And almost any site you visit will be broken.
Nobody's[1] goal is to stop you from calling your neighbor to tell them they left their garage open or whatever. That's the sort of thing telemarketing astroturfers love to go on about, squirting squid-ink to confuse things.

[1] I'm sure it is someone's.
Data Visualization Libraries for React Developers in 2019
It's very important to understand that once they show interest it means they need you as much as you need them. They're just very good at marketing and putting themselves in a position of "King Makers". Be confident when you talk to them ;)
It should be enough to force the called ID to be valid. Then the crappy people will know you can identify them or even call them back. Removing anonymity should go a long way.
Ok, so you've decided that being white supremacist is bad. I can agree with you on that, but still the question remains: who get's do decide what has a place in modern society? Who decides what "modern society" even is? Today Google might decide to censor white supremacists, tomorrow it can be human rights advocates. I think that allowing any type of censorship, even for such a noble cause as fighing racism is a slippery slope. Especially when done by a private company that is outside of our control (and governments are only marginally better).
I find they very rarely leave a voicemail message, and voicemail transcription has been a boon for the few that hang on the line.
I think less of whatever entity puts it in front of me.
Captchas inherently require some security by obscurity; they're not a good fit for OSS solutions.
Yes,

Don't underestimate how hard it is to get photos of people for scams.

And they are very important for building trust.

This should be big in the blackhat world, it's possibly the start of whole new scams against a whole new set of people.
I was shocked to read that, apparently, there is no key?

https://security.stackexchange.com/questions/18225/mars-curi...

I get the argument for why nuclear weapons aren't physically locked -- there's always people guarding them -- but not having security on a remotely operated billion-dollar device seems crazy to me, even if the technical barriers to establishing a link are high.
Optimizing Aggregations in Sql Query Execution
Memcached – Caching Beyond RAM: Riding the Cliff
I think they only do that if you get the first set wrong.
Part of me kind of misses the old dry 60's/70's style documentaries with some boring old dude describing facts in a boring monotone way.

Are you sure you weren't being misled by the stylistic choices of those documentaries into assuming they hadn't made decisions about the narrative they wanted to present?
PostgreSQL Deep Dive: How Your Data Model Affects Storage
IDK. I run Firefox on many OSes, everywhere with uMatrix that blocks known trackers, ad networks and such. I don't see most ads (if any).

I rarely see the "I am not a robot" box, and hasn't seen image recognition tasks for a long-long time.
How is this better than leaving a voicemail you're notified of receiving?
> Then, the images started getting grainier as they apparently wanted to improve their recognition in different conditions.

I'd always assumed that was noise carefully tuned to throw off one machine learning model or another that was being used to beat the captcha, sort of like this: https://www.theverge.com/2017/11/2/16597276/google-ai-image-...

I think it might be the same when they switch to other types of objects (like crosswalks or bikes). Someone's model got too good, so they had to change to something else. I also get the impression that they add delays to the tile refresh before they do that.

I suspect Google now uses robots to generate captchas for humans, under the assumption their image recognizers are far better than anyone else's. They already have some very well ones for other products (self driving cars, street view) and lots of street-level city imagery. That would explain why their captchas are so difficult for humans to solve -- they're testing if you see things like their "AI," not like other humans.
Aurora down for the past 4 hours in ca-central-1, still no status update. https://status.aws.amazon.com/
> We also have a residual, uncapped, % option if the founder ever sells the business.

What exactly is a "residual stake"? In your spreadsheet this is set as 9.5%...where did that come from? Is this is a stock option, convertible note, or equity position?
You could have done both. I'd love to see an article on that.
Or the Japanese chocolate.
This isn’t an Apple “senior executive” exactly. Probably not one of the top 100 guys.
If you make the tax system substantially less progressive, as in Sweden or other often mentioned examples, I think it is quite possible to reach a sustainable level.

I partly agree though in that US spending really makes no sense. Other countries that raise more revenue are generally quite targeted in their spending, the US govt is not...at all. It makes no sense to say that the solution to bad spending is to generate more revenue...but it is also not particularly clear that there is any desire to think about how to spend more effectively, outside of slashing everything.

Btw, just generally this reflects how far the US is behind when it comes to intellectual discussions on policy. Most (but not all) discussions about these topics in the US take intellectual force from anti-scientific dogma. Elsewhere, politics has become an evidence-based study of the merit of policies. The former approach just isn't sustainable, the level of poverty in the US is quite shocking (to this outsider's perspective).
Are there any reasons to register windows 10, besides being able to change your desktop background? AFAIK the "this copy of windows is not genuine" message is benign.
I wonder if the Stanford Radio club could talk SRI into borrowing The Dish for a bit.

Pinging a mars rover would be one hell of a DX, even if Opportunity won't be sending you a QSL card.
I read his History of the Peloponnesian War in the tenth grade. Thank you Mr Chrome!

I remember really enjoying it but it may have been my teacher.
I got banned from Twitter within 5 Minutes of trying to figure out the user interface, and my best guess as to why it happened is that their anomaly detection is overfit to their existing users. So when a new user starts exploring randomly instead of directly going to look at ads, they're behaving much more like a scraper than what the system has learned to recognize as a normal user.
Ask HN: How far away are great AR glasses, and what are the constraints?
People with relevant knowledge: how far away are great AR glasses, and what are the bottlenecks or constraints?

Let's say that great equals "people will want to wear them for multiple hours every day"
it was designed to make it easier to integrate ads
They really are not your friends -- they are very good salespeople (as mentioned in the other comment).

One of the most famous SV VCs who is pretty much a household name and has the image of -> kind guy shredded our founder to pieces. It was baffling to watch but just shows how ruthless they can be in the face of adversity.
Please stop harassing me. Let's set the record straight.

The Koa organization did not write, maintain, or ever help with this package. I wrote it. I maintained it, with help from people who reached out to me directly (and actually contributed code).

@ZijianHe offered to maintain it, and I agreed to let him maintain it. Our relationship is not anyone's business. I don't have a relationship to the koa organization. I don't know them. Furthermore, @niftylettuce has repeatedly in emails to npm asserted that ZijianHe is Chinese, despite this having nothing to do with anything, or even knowing whether ZijianHe lives in China. Chinese developers have contributed more to this repository than anyone from the Koa organization. This kind of racial scaremongering or guilt by association is not acceptable. Its offensive. Let's be very clear: Developers from any ethnicity and nationality are welcome to contribute to open source.

I'm not going to say anything more on this issue. This is beyond ridiculous.
No, the point is that it doesn't matter if you "pay people not to work" via unemployment benefits that are stopped when they start working again, or just give them a baseline subsidy no matter what - either way, they'll have the same amount of success seeking work. So yes, it's a bit of a failure for basic income, but a win for unemployment benefits.
What apps are in the gray area? To me it’s pretty clear and not much room for “making an argument.”
They’re operating on a mixture of rules and mutual understanding. The mutual understanding could change through political outrage, I think.
Done. Looking forward to it :)
The existence of judges does not negate the need for the legislative branch to craft clear laws (and the executive to craft clear regulations).
> I've been thinking about this a lot lately. Where is our compensation?

You give Google training for ML models.

Google gives the site provider the service of excluding bots from submitting the form.

The site provider gives you whatever was provided by the form you were trying to submit.

No one is uncompensated.
Famous people endorsing snake oil has been a thing since famous people and snake oil, instagram is just the latest way to serve it up.
Link to the video of the press conference after the bill passed the EU-parlament in July 2018:
https://multimedia.europarl.europa.eu/en/press-conference-on...

Somehow, this is doublespeak, somehow it make sense too..
Very true. :-) It's all greed.
Apparently WhatsApp at some point handled 2M connections per server: http://highscalability.com/blog/2014/3/31/how-whatsapp-grew-...
My Porsche and my mom's Acura can both do OTA updates, though they both require user acknowledgement to install. Honestly, nothing coming OTA should be urgent enough that it can't wait until the yearly service.
Have you used Captcha on TOR? It really does feels like they're trying to punish you. They give you about 4 pages of "identify the traffic light", all of which are difficult for humans, then reject and give you another 4 pages. Or that thing where it fades out for about 7 seconds before you click the next image, and then wait another 7 seconds.
I'd go further than that and say that even raw livestream footage has a narrative, in the selection of what's being shown, the camera angle, even the title and everything else.
General problem solving skills will help.
One exercise is to pick a product everyone uses, say a washing machine and then you work backwards, imagining how they ever got to that stage. The type of iterations they had and then what the limitations of it were which caused them to make a new model.
A lot of people in the Netflix special (the marketing/pr consultants, the models, some of the influencers and other "outside" firms) came off pretty well. The view I think it was pushing was that they failed to do their due diligence but in a way that everybody fails to do, so no biggie. I am aware that this lack of due diligence isn't at all uncommon in the modern world but it is a problem. Subcontracting out the removal of toxic waste then throwing up your hands and saying "I had no idea that the firm was going to throw that directly in the river after we paid them peanuts" is illegal (though... not always prosecuted... separate issue) and contracting out services is similar.

This, I think, is where the fallacy of the gig economy comes from. As an example Uber should not be held not-at-fault if one of their drivers breaks the law, the standard needs to be the same as if a UPS driver did the same thing.
Male genital mutilation is still practiced in some countries in this manner.
I know there have been some reforms since 2015, though I haven't kept up with all the details.

Isn't there a simple fix for this? Set per-company max percentages for H-1B visa holders. So if it's 15%, and you have 100 employees, only 15 of them can be H-1Bs. I imagine there are probably ways to game this as well, but I'd think it'd be easier to figure out when that gaming is occurring, and shut it down.

Or is there just no political will to fix it?
What are some reasons for wanting to leave?
Ah, so that's why I've been seeing lots of videos and posts about Fyre... I thought it was weird, as the incident was so long ago.

I had no idea Netflix had a documentary coming. I guess I was successfully targeted with undercover marketing, making it seem like this was an issue having popular discussion.
I like the fact that the server returns an image directly without any HTML or other content. It makes the loading experience fun too.

How many faces are generated? This can't be real time.
I don't quite understand this sentiment. Maybe it's because I or the company I worked for haven't experienced this kind of situation. Can you shed some light on what big corps like AWS, Google, MSFT did to other people?
the mars rover missions cost $2.5 billion. sending humans has an estimated cost 500 billion
Ask HN: What technology do you think will take off in 2019?
The reason we're seeing so many robocalls now is because we currently have a consumer unfriendly FCC. Repealing those laws only made the people doing the robo calling more brazen.
Nintendo Direct: Feb 2019
I've noticed that my prepay burner phones, some of which I've kept in service for years, never receive robocalls.

It's definitely not a blind system of calling all numbers, you can have a robocall-free existence. I've simply never supplied the numbers for those phones to any personal information selling (or leaking) services/businesses, and that seems to effectively keep them off the call lists.
Also, I wondered, maybe it could lead to an friendly facebook alternative from Europe.. That would be grand.
It's mind blowing that the agency, FuckJerry, that did the marketing for Fyre was contracted to make their own documentary about the festival. Seems like a huge conflict of interest and it shows when you watch it. I get that this isn't Frontline, just seems nuts when you think about it. Sure, let's have the same semi shady agency make their own take exonerating themselves.
> You cannot avoid that, as subjective point of view cannot avoid impacting perception of the relevance and importance of objective facts (which directly effects selection and the perception of “hiding”), and also what the important relations between those facts are, which affects organization and thereby the perception of “twisting”.

Even though it's hard to 100% avoid bias, you shouldn't lump all attempts at telling a point of view as being equal. There's clearly a spectrum with the far end being propaganda and intellectual dishonesty.

I value the opinions of people who can objectively present both sides as well as they are capable of and who separate out which parts are subjective and their opinion. If someone shows the facts that go against their point of view, that makes them more credible to me.

Yes, avoiding all bias is close to impossible but that doesn't mean all people are worth listening to or can be trusted equally.
Interest is part of the issue, but $22 trillion is still $22 trillion. And yeah, there's lower interest. But it's still very, very hard to replay.

In other words, interest comprises a few percent of the debt. The debt itself is a huge issue, too.

I'm not being fed anything by anyone. I'm not particularly loyal to either political party. I think both suck. But I also think that's a ridiculous amount of money to have borrowed, and will be very difficult to pay off. And the politicians won't even stop spending.
The only guaranteed way to avoid regulatory attention is to shut down everything and stop operations. There is fundamentally no decision you can make other than "comply with the law while continuing to operate as effectively as possible".

Even more unfortunately, bureaucracies, including every modern corporation and government, are UnFriendly AIs. You must comply with the letter of the law because not a single agent involved, not the regulators writing the law nor the courts that will interpret the law nor your competitors that will bring complaints against you nor even the users of the products involved, knows or cares what the spirit is. They don't have the correct value systems, experiences, philosophical frameworks, or cognitive architectures to execute the "comprehend human values" step that would be required to interpret the "spirit" of the law. That incapability is why an even minimally functional justice system needs things like checks and balances and case law and jurisprudence and rules of evidence and all of those things. But we do need those things, because history has proven universally that the letter of the law is the only thing that matters.

On the one hand, this means we literally can't trust any organization composed of more than approximately two people. You often can't even trust organizations with one person, simply because bureaucracy is a force-multiplier even for single humans; think about things like bug trackers and source-control systems and apply them to other workflows. On the other hand, this means that it's pretty much worthless to try to do anything about any individual corporation. Up to the point where you entirely obliterate their industry you're stuck. Which is, coincidentally, what an antitrust action really is - antitrust actions happen exactly when a single agent has taken over an entire industry, and making sure that that an identical bad actor doesn't reappear requires not just breaking it up but also obliterating its industry and introducing a new one with similar features but substantially different (non-agglutinative) dynamics.

Standard disclaimers: Views don't represent employer, etc.
As someone who actually does have a bit of knowledge of genetics and molecular biology, I couldn't get through all the fluff. What are the actual news presented here?
lol yes. if cheap, spray and pray option works too ;)