skysight-inc/HackerNews huggingface dataset:
That seems to be this one: https://www.thezdi.com/blog/2019/2/28/finding-unicorns-when-...

It's a straightforward miscompilation. I'm not sure why they even classify it as a vulnerability.

From Microsoft, per the article: "The said vulnerability is about downloading and running untrusted code, which has always existed in all releases prior VS2017 Update 9 that supported lambdas. The scenario is not common coding practice and considering we've always had this in all our prior releases and have not seen any evidences of exploit it would not make sense to port the change as hotfix from 15.9 to prior VS releases."

In other words, it's never made into a product in an exploitable way. I'd just call this a miscompilation.
Can you share any data on bounce/engagement/conversion rates for the different packages (eg. X% leave the page without scrolling/reading, Y% read the page but don't buy, Z% actually make a purchase, purchases break down A/B/C% between the different packages)?
Weather-responsive intersections could ease traffic congestion
This is true if you consistently have control at every relevant point in the future, but if a malicious entity gets control for a month and then loses it to the crowd again you can spend your old funds. That's one difference. Another is that the transaction log can theoretically be moved to a new chain if some part of the crowd desires (and has been), so if a proprietary ASIC manufacturer takes control the community, or some part of it, could move to a different hashing algorithm that isn't yet targeted by ASICs, and you could spend the funds on that chain. In either scenario you've probably lost value, but not all value as originally suggested.
I wish they'd accommodate news and opinion in the same way. Maybe that way, they could keep their employees out of the business of censoring the internet in line with their particular biases.
Welp, so much for that hope.

https://www.theguardian.com/us-news/2019/mar/06/whole-foods-...
I was never that engaged in Facebook, just checked it once a week. Then I started helping managing a private forum (for Michigan entrepreneurs) and got invited into another one. Now I'm on FB a couple of times a day.

Having the chance to engage with bright people who share my passion was the key. But the majority of my family has never been on Facebook.
UC researchers protect hardware from attacks
One stat I've never seen in these types of discussions are how many women are applying for tech positions vs men. If that number is low then it's probably a pipeline issue.
The obvious way is financial services.
Applied Ecology: Land-sparing and land-sharing patterns of urban development
Parsec doesn't support remoting into linux machines.
No. A fair amount of boots-on-the-ground experience, though...
> Google has stopped work on their Noto fonts initiative

:-( This may be my favorite Google project ever.
Is Canary build safe? My version is 74.0.3726.0 (Official Build) canary (64-bit)?
Is that wrong? I have virtually no interest in politics. It's unlikely that I'm going to remain friends with anyone who expresses particularly strong political views, left or right. I just don't care, and find it too exhausting to be bothered most of the time. If the only place I see/hear those views is on Facebook, it might be easier to drop Facebook than to drop those friends.
> No, the alternative is some old generic drug, which is just as effective as the new one.

This is a little simplistic. The FDA strongly prefers evidence that new drugs are more effective than existing treatments. They look at the target condition and available treatments, including existing generics, to weigh the benefits and risks of a new drug being approved.

And the only reason that "old generic" drug exists at all is because the patent process paid for its R&D more than 20 years ago.

> But the manufacturer bribes doctors to prescribe the new one, which has no generic equivalents.

This is illegal, for obvious reasons. I suspect it is less wide-spread than you think.

> Because for years there was no commercial alternative. It was only by chance that I found a compounding pharmacy that sold an old-school version.

So you're saying there wasn't an alternative treatment available and androgel brought an effective treatment to market and was rewarded for it? And they shouldn't be, because?

> That's how it works for generics. And there are lots of generics.

Generics manufacturers first, absolutely do not sell at-cost; they're for-profit companies trying to make money, not charities. And most importantly, they don't develop novel drugs.
Keyloggers don't wrap themselves up after the first log in. They could easily take the data from several log-ins (if they can't scan the HTML) and eventually get a complete password.

Besides which, the partial login isn't random either. It's always sequential. You'll never be asked to enter character 3, then 1, then 8. It will always be asked in the same order as the password string itself.
OK.

Can we suspend identity politics and admit that systemic homogeneity bias in software development is as much a technical as social and political problem?

I mean, why is it ok to release facial recognition software that has only been trained on white faces? Why is that considered a minimum viable product?

When we get to the point that facial-recognition systems don't recognize black people, autonomous cars won't even stop for them and law enforcement risk assessment AIs automatically tag them with a x2 modifier for criminality, this stuff stops looking like naive techie ignorance and starts looking like malice.

And, all else aside, it's bad design.
> Whenever I see i18n I just weep over the fact they didn't use the term "lang"

That's a bad idea because "lang" or "language" is already dangerously overloaded. People casually use it to mean any of (actual) language, locale (language + region (+ script, maybe)), script, or any combination of the above.
According to the patch, the problem involves memory management of DOM objects (specifically ArrayBuffers), not objects from native libraries.
Gremlin Free Software
That’s true, if that’s where it ends and doesn’t represent a burgeoning trend, and if it doesn’t have a feedback effect leading to greater losses. After all if a fire starts in a mansion, well the fire is tiny and the mansion is huge, why get all excited over nothing? You have to leverage what you know about fire if you want to appreciate the threat it represents to the structure.
There's an inordinate amount of data at this point demonstrating that real average wages in America have been flat -- actually, falling slightly -- for decades.

http://www.pewresearch.org/fact-tank/2018/08/07/for-most-us-...
https://www.epi.org/publication/charting-wage-stagnation/
https://economix.blogs.nytimes.com/2012/10/22/the-uncomforta...
https://www.washingtonpost.com/news/wonk/wp/2018/06/15/for-t...

I'm honestly a little dumbfounded this is even a subject that people seem to be debating here. It's not a matter of "people in 2019 just have so much more darn stuff to buy than people in 1979 did."
I enjoy using IG but I don’t follow many real people. I follow organizations, brands, etc. I like seeing their new stuff as well as any news such as sales, new releases, etc. I follow photographers and artists. It’s essentially a feed of stuff I like.

I wouldn’t follow “real” people unless they’re close friends. Don’t want to see people’s lunches or vacations.
Yeah this "prosperity theology" crap would have me seeking new legal representation...
> It actually did my fucking head in to the point where it was causing significant problems with my mental wellbeing.

You could have turned off seeing updates from her. That would not solve all the things you mentioned but it should in almost all cases suffice.

Friends giving each other space is maybe a thing but not being able to handle seeing her name pop up at all is a very extreme state of affairs about which I would suggest consulting with someone.

I think it's unfair to expect a feature that caters to that.
You cannot just full ignore somebody in real life either, e.g. friends mentioning her name.

Facebook does in fact allow you to block a person or unfriend them.
If you and your friend are in agreement about giving each other space, those two options should be enough from a reasonable feature expectation standpoint.

If you are friends with someone and interact a lot it's obvious and generally a good thing that Facebook highlights them. Facebook cannot know on its own that you are currently "not actually" friends with someone.
Particularly when the reader view estimates it to be 78-99 minutes. I'm several paragraphs in and not seeing the connection to the comment thread.

Edit: Just as soon as I post about not seeing the connection, I find the bit they were referencing:

"6. The Two-Income Trap, as recently discussed on this blog. It theorized that sufficiently intense competition for suburban houses in good school districts meant that people had to throw away lots of other values – time at home with their children, financial security – to optimize for house-buying-ability or else be consigned to the ghetto.

From a god’s-eye-view, if everyone agrees not to take on a second job to help win their competition for nice houses, then everyone will get exactly as nice a house as they did before, but only have to work one job. From within the system, absent a government literally willing to ban second jobs, everyone who doesn’t get one will be left behind."
I think this author grossly misunderstands Dave Ramsey's target audience and what his goal is.
In that case he could just come out with it. My guess is he lost the money either by trading or through pure technical incompetence that resulted in hardware loss or did something to erase it all on accident. Coming out with this would not excuse him from legal consequences as much as it would he be claimed he was hacked.
Larry Ellison?
They created a GUI in VB and tracked the IP address.
I lost some 2010 BTC (trading at ~$30) in the MtGox failure, and then missed the window to make a claim. Harsh.
I know this is tongue in cheek, but the NSA's mission has to do with foreign interference. They are far less authorized to do anything involving US citizens.
I Love MySwimPro’s Fundraising Deck – and How I'd Make It Better
This is not the first chrome security issue in over a decade.
Amazon's joint health-care venture finally has a name: Haven
> I think the better example ... would be Apple, where almost all priority is in the Phone first, Tablet second, everything else after.

To be fair, the iPhone has been an earth shattering success that created multiple brand new markets (e.g. App store, Apple Pay) and propelled Apple to become the first trillion dollar company in history and the most valuable brand in the world. It's difficult to convincingly make the case not to prioritize a product line like that above others.
Solomon Islands struggle with nation's worst oil spill
I deleted my personal account years ago when it became evident that Facebook was little more than a reprehensible consumer surveillance utility, failing at the original value proposition of keeping in contact with friends.

I maintain a company page through an otherwise content-free account. As a corporate user I find Facebook slow and difficult to navigate.

All social networks die. They either fail to achieve critical mass, or they do and it turns out the mass was mostly composed of bovine scatology.
I also work at a petabyte scale web media company and what I've learned is we're not selling accuracy. We allowing ad campaign managers to use buzzwords with their employers.
Your TV & other appliances all used a lot more electricity to get the same job done, even if the screen or icebox was smaller. Your car got worse fuel economy and didn't last to 100k miles. Your house used a lot more wood/gas/oil/electricity to heat.

A big part of why we have more is social & technical progress. We get more for our money.

I do think your parent's question is an interesting one- thorny, but it's not ridiculous to wonder if doubling the work force eventually gnaws away at compensation for the same work. (The natural next question is, well did the demand for labor grow to match, stay constant, or somewhere in between? Did the pie grow and we're all wealthier for it, or are twice as many people now fighting over the same pie?)
As a woman in technology, a coder no less, I totally understand the pipeline problem. Men dominated technology in the very early days, and men made up most of the workforce. As much as society, government, and education attempt to force women into STEM fields, it's going to take a while before there are enough women, with enough experience, to truly equalize compensation. As for girls opting out of coding, that's ok.. Not all girls want to code, and not all girls want to take a STEM path, and that should not be see as some failure.
https://maps.org/ is basically running a crowd-funded FDA process for MDMA as a component of PTSD treatment. (Well, major funding came from one random bitcoin millionaire, but still.)

The trouble for anyone (citizens, government, and biotech companies) is sifting the wheat from the chaff as far as what drugs are likely to be safe and effective treatments. You could give away all of your money and not end up with one approved drug.
Agreed, although I’d add to: When we get to the point that facial-recognition systems don't recognize black people, autonomous cars won't even stop for them and law enforcement risk assessment AIs automatically tag them with a x2 modifier for criminality, this stuff stops looking like naive techie ignorance and starts looking like malice.

I strongly suspect that it looked like malice long before this point if you were for example, black yourself. In the same way that people familiar with the history of TLA’s and tech were concerned about the behavior of the NSA long before Snowden confirmed our worst fears, I’m sure that black people saw this coming based on warning signs typically dismissed by people who can afford to do so.
lol at someone with a lawyer husband who still needs 2 consecutive car loans but writes an expose of Dave Ramsey.

Yeah that's an ad hominem but still come on...
I think this disassembly supports their assertion. The number of times a user copies and pastes isn't in itself input to the console, just a metric of some out of band events.
An example why NAT is NOT security
Coincidentally, most countries that have had a historically-disadvantaged population still see large socioeconomic disparities between they and the average, even when the populations concerned are racially homogeneous collectivists with a conservative political bent (looking at you, Japan).

Coincidentally, of course. (OR, The phrase "opportunity hoarding" comes to mind.)
D'oh! Thanks for catching that.
I was on Effexor for about three years. Once or twice during that time I forgot to take it and got a sample of a dreadful sensation that was unlike anything I had ever experienced. This caused me to look up and read about withdrawal problems people had reported. I was taking three of them a day and I began tapering by taking two-1/2 a day for a couple of weeks and then moving to two a day for two weeks and so on. Over the course of about three months I weaned myself off without once having any sort of withdrawal effect that I could recognize. I was happy to be free.
"Call me Ishmael"?
Those are definitely amazing opportunities. I have had colleagues who have had those and they were incredible experiences for them. However, I am not sure what the proportion of post-docs are that get that level of independence.
How do you want your spaghetti served? Baked-in the code, or the rpc variety?
I think the article is trying to say that the state of the pipeline is what it is because of the way that the end of it appears to those who might be in the beginning of it. Young women aren't going to stay in the pipeline for a career that looks like they will have a hard time excelling in once they reach adulthood.

Despite my distaste for the authors invoking basement coder stereotypes, I can see their point. We can keep blaming the "pipeline" if the industry is rife with sexism and harassment. Our current state of affairs influences the pipeline.
>While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit.

What happens when those zero days are leaked or stolen?[1]

The government couldn't even protect nuclear secrets.[2]

At least with nukes, it's difficult to obtain the fissile material. Even the poorest, smalled, most isolated countries can utilize stolen or leaked 0-days, and depending on how they're used they could kill more people than a nuclear bomb. (Eg: shut off the power to the Midwest during winter)

[1] https://en.wikipedia.org/wiki/The_Shadow_Brokers

[2]https://en.wikipedia.org/wiki/Atomic_spies#Notable_spies.
One of my supervisors used to point out various pieces of lab equipment and equated it's value to X PhD's. It was funny and a bit depressing at the same time.

EDIT: I do think the culture of referring to trainees as slaves needs to stop. Even in jest it can be quite disheartening to be reminded how beholden to your supervisor you are.
Deconstructing the Monolith – Shopify Engineering
NS10s are kicking around because they're unusually good at time domain performance. For instance, they have miserable bass not only because they're small boxes and smallish drivers, but because they're an infinite baffle design, which is significantly better for time domain performance than bass reflex. The enclosures also dissipate energy quite well, and it's well established that this contributes to being able to 'translate' mixes: you get a better sense of what's actually in the track using NS10s than you might with many 'better sounding' speakers.

They spotlight midrange with a presence peak right where the ear's most sensitive, and this is in part because the woofer is actually designed more like a midrange: thin paper, conical rather than curved cross-section, both of which also contribute to 'sounding bad' tonally while delivering energy more unforgivingly.

They're not really about mastering, though, they're about mixing because if you have elements out of balance it will be screamingly, annoyingly obvious on NS10s. That's not down to their bad-soundingness, it's down to their ability to be incredibly unforgiving.
What’s Going to Happen This Year in the Data World
> The other was a character in a soap becoming HIV

I know it wasn't your intention and this is a serious topic, but I did chuckle at the thought of this.
I don't think "resetting your gut" is a good way to think about it. Taking oral antibiotics will "reset your gut", in the sense of killing most of the existing biome and leaving space for new flora to grow into, but that can lead to problems as the biome that develops from a clean field isn't the same as the standard biome. To the best of my knowledge, you normally inherit your gut flora from your mother during birth and nursing, and then your gut hopefully stays stable over time. "Resetting" is more likely to give you a worse biome than a better one.
There's every chance your MX MTA authenticates people against LDAP, uses LDAP again to figure out where to forward the mail to another system for final account storage, then the MDA stores the message on a clustered file system or an object store, then tells the logging system to log the delivery. The LDAP systems for authentication and for where the user's mail lives might be separate instances.

Then the MUA connects to an IMAP proxy which talks to LDAP to authenticate and to determine where the messages for this user are stored (again, possibly different LDAP instances), then connects to an IMAP backend that retrieves the data from a clustered file system or object store. The IMAP proxy, IMAP backend, and MDA are separate systems. The object store is, likewise, a separate system.

Meanwhile some of your users are using a webmail client as their MUA. That talks to an outbound-only MTA and the IMAP proxy, but it may talk directly to LDAP for authentication rather than authenticating to the mail servers first. It can pull user preferences from LDAP. It pulls their contact book from LDAP. These might be three different LDAP instances. I has a calendar app in the same page in another tab, but that talks instead to a separate CalDav server. The folder pane which updates with the number of unread messages in each folder updates through a different backend process on a different web server from the listing of mail in your current folder, which is a separate web server from the one that just fetched the content of the highlighted message into your preview pane.

Meanwhile. half of these systems actually forward through another MTA which makes no final delivery decision itself but scans for spam scoring. Those messages that make it through the filtering get forwarded to another service which only scans for malware. Then those messages which pass go to the system that forwards the mail for final delivery to the user or to the remote party's mx server.

All of these systems need their timestamps correct, so they all talk to an NTP service running alone on a VM or container that does nothing else.

All of these systems send their logs to a central logging cluster via a defined protocol. The logging servers do nothing else.

Just because your mail server might run qmail, Courier, Amavis, SpamAssassin, procmail, and mutt on one box with local storage and local logging doesn't mean that's how mail is done at scale. It's pretty clear to me how if you think of "email" as the application that it is composed of microservices.
I think you're missing the point the article is making, or at least obstinately not addressing it.
"Heliopolis" is almost not a stretch.
KHTML is the rendering engine for the Konqueror browser. Webkit is a fork of KHTML. And Chrome's engine is called Blink (it used to be Webkit, but they forked it).
The way that it works is that a certain number of coins are created when a block is mined. That number is recorded on the ledger associated with an address. Let's say it's 25 BTC, but it can be any number -- it doesn't matter. If you don't spend any of that BTC, then it exists only as that number -- a chunk if you wish. It is indivisible. It sits as 25 BTC in the account. If you decide to spend 5 BTC of the 25, then the ledger records that 5 BTC goes to wherever you are sending it and 20 BTC goes to your wallet. The previous 25 BTC chunk is removed. The 5 BTC exists as a "chunk" in the other wallet and the 20 BTC exists as a "chunk" in your wallet. The 25 BTC "chunk" no longer exists. Each wallet has a list of these "chunks" of BTC. Let's say that I have a 7 BTC "chunk" as well as the 20 BTC chunk. I want to send 22 BTC to someone else. It will take remove both my 20 BTC "chunk" and my 7 BTC "chunk" and give me a 5 BTC "chunk". I can't remember if the recipient gets a 22 BTC "chunk" or a 20 BTC "chunk" and a 5 BTC "chunk" (it's been a long time since I looked at the source code). I think the former, but it is traceable where the original came from and how they "chunks" where split up.

Hopefully that makes it a bit more clear. The word "chunk" is my own -- if you start using it in other discussions, nobody will know what you are talking about ;-) However, the main thing is that the wallets do not contain balances, but lists of transactions that ended up giving them coins. While there is no such thing as a "coin", it's discrete amounts rather than flowing in and out like water.
I'm not really interested in having a language shootout but I will say that I think you may be misunderstanding Java's history of serialization vulnerabilities.