skysight-inc/HackerNews huggingface dataset:
Nice!

A bit unrelated but If you haven't seen it be sure to check out NASA's EPIC[0] aboard their DSCOVR[1] satellite

[0] https://epic.gsfc.nasa.gov/
[1] https://www.nesdis.noaa.gov/content/dscovr-deep-space-climat...
Browsers can only protect against malicious websites and malicious extensions. They can't protect against malware. Even without any cert problems, malware on your machine can modify the browser executable/process to insert whatever code it wants.

With this reduced threat model, it's easy to simply keep existing pre-installed extensions available, and disable updates. Your only problem is if a pre-installed extension is malicious or has a vulnerability, it will remain.
This is a very bizarre justification for an obvious bug. Code-signing does not work that way anywhere else — neither in Android, nor on iOS, Windows or any other common platform.

There is a possibility that Mozilla implemented their backwards code-signing model on purpose — for example, it allows them to oust unwanted extensions without explicitly recalling their certificates. But personally I think that they just didn't give the matter enough thought.
C - (stdio) - (net) = what an ideal programming library looks like. IO ring FTW.

Eventually, you realize that you're trying to use line buffers / getc / ungetc to parse lines on that packet of data on the iio_ring to serve that cat picture for teh Internetz. :)

We need to eliminate variable length protocols to make these interfaces go away.
The part where the disks contain ads from local businesses reminds me of diskmags: https://en.m.wikipedia.org/wiki/Disk_magazine

As for the second link, wow, we were that naive about plugging in unknown USB devices only six years ago?
>SSL cert renewal is one of the great unsolved problems in computer science

Certificate expiry really only exists to make money for CAs. It doesn’t solve any security problem that CRLs don’t already solve (and solve better). There’s lots of unsolved problems relating to ‘how do you make a reliable PKI’, but cert expiry is really just an unrelated business requirement for CAs.
Can you explain to me what evidence-based positions The Guardian gaslights or engages with in bad faith?
You should take a look at GPUs.

All of the complexity of 3D rendering is implemented in userspace, and that has been the case universally in production for more than 5 years now -- closer to 10, really. If you replace "all" by "almost all", you can go back much further than that, really all the way to the beginning of GPUs' existence. And yet normal application developers don't have to care, because the driver does it for them.

The point is, drivers don't have to live in kernel space, they can live in user space as well. Networking folks may start being more serious about this nowadays, but it has been the reality in GPUs for a long time.
The title is annoying on purpose... This is a different, more complex and more-efficient-in-some-cases approach.
What's always daunting to me in projects like these is the time it would take me to dig and understand the spec itself...
Even if there's no way to blast all Firefox users, there are blue links to standard Mozilla-hosted "help" web pages within the Firefox add-ons config, links that a non-insignificant number of confused users will probably click. Those web pages could easily be updated with info about the cert expiry snafu.
Decrappification, DeOldification, and Super Resolution
That's the joke. It's just not funny. But please, don't discount therapy. It can hardly hurt.
On Customer Obsession (Gibson Biddle, VP of Product at Netflix)
I’ve never lost motivation, but then I’ve never tried to just learn to code, but rather I’d challenge myself to build something and learn enough to get that thing done.

Of course sometimes you’ll be sick or tired or just want some fresh air. Or a week or month off. That’s fine. If you set things up in your head so it’s more of a hobby than a chore I think it will be a lot easier.
Hello- Jason here (one of the authors). I'll answer questions! I might not get to them right away as I'm about to go to bed.
Sourcegraph free user quota lowered to 50
Why century-old ship logs are key to today’s climate research
There’s lots of monitoring services out there that do it. A long time ago I worked at place that used a service called site24x7 for cert and API monitoring. That was before Pingdom kinda got better than most API monitoring services, but I don’t know if they monitor cert expiry.

Taking a look around, you’ll find lots of service providers, or tools you could use. But the main issue is all they do is tell a human being to do something, which they can still fail to do. Which is why automating cert rotation (with things like let’s encrypt or ACM) is arguably a better solution than monitoring it.
Yes, but what's the point of cert expiration? Is it safe to have certs that never expire? I believe there is a security benefit to expiration. Expiration is useless if it's never enforced.

Probably the correct behavior is to have some sort of semi-annoying popup when it expires, and then only a week later do the full blocking. You need to strike the right balance of making it annoying enough that it can't be ignored by everyone (otherwise you just have the exact same problem, just delayed a week) and that fear of it happening is a sufficient motivator to stop people lazily relying on the grace period, but also not too annoying that it makes a lot of people quit. You also want to avoid permission fatigue.
One thing wasn't clear to me from this article: did being non-white or non-male improve or hurt a prospective employees' score? I'm assuming in this case being 'non' raised the score, but the article doesn't state one way or another...
90 days is 4 times a year. 60 is 6 times, 50% more expensive when you’re paying someone to perform the task.
> buy a broad-based stock fund and forget about it

The stock fund is a product designed by a third-party to make money for them, which was the poster's point about you not being in control of your pension in that case.
They didn't have renew automatically but they could automate notifications, alerts or even banners in their internal apps when 60-70% of the time was exhausted. If I was given such a restriction, I'd still automate it 100% but require a human to authorize it every time by clicking a magic link in their email, slack or some dashboard, and nag them with notifications until someone authorized it.
You could say the same about Dragonfly.
Article reads like an overview of 2008 technologies, but offers no actual, new solution to the existing solution that fuels Twitter and other social media sites.
Now you’re comparing different sensor/negative sizes against each other. Usually ”full frame” (aka 135mm) diffraction starts to affect on smaller f-values (larger aperture) but on larger negative sizes the diffraction starts to be a problem on bigger F-numbers (smaller apertures). On 4x5 format something like f/22 and on 8x10 f/45.
When their life may depend on the information?
Surely tasks are performed by and assigned to roles, not individuals (who just happen to be in those roles at some moment in time). If a role disappears, e.g. in redundancy, then the role's tasks are evaluated for either transfer to a role that remains, or being discarded.
Good hearted advice but lacking in few aspects. Most medical products are terrible with open integrations and open standards.

I suspect this kind of advice is given by consumer companies for fear of liability than anything else.

In many cases, medical devices that have consumer equivalents don't have anything extra than a better written user agreement and little more liability.
That doesn't sound right. What about all the other websites with ads, like recipe sites, guitar chords, porn, diy, etc.? or apps on the Google play store with ads?
I doubt this. Even as a German I regularly get healthcare gofundme's in my twitter feed. HN frontpage regularly has horror stories about billing, including "out of network" hospitals in emergencies.

There is no way one can build up savings to shoulder such shit, much less are savings to be used for medical issues!
Which is why I explicitly did not refer to mindfulness meditation. I do step 2 in order to set the conditions to perform step 4. If I wouldn't do step 2, then I'd have the issue of being to agitated and then I couldn't make the switch.
Does this happen when you open firefox? Forgetting what i need to reenable and what i had disabled is going to make me mad. If i just don't open ff will i be fine?
Honestly, I just have to wonder what the Mozilla devs do. Don't they use extensions? Didn't they notice what was going on? Why does it increasingly feel like a more random Google Chrome-Lite paired with Apple's 'best intentions'?
I think recent years have proven that despite all the memeing about things like rest, "don't break the web" is not a value shared by all of the parties involved.

The takeaway is that for those of us that do still wish to uphold those values, we can let this serve as a lesson that we should not publish assets behind urls we don't control.
> the world owes you nothing and as long as you understand that you'll be fine

Conversely, without the World you are nothing. You can't survive without the help of others.
I don't get it, why not?
Snips.Ai runs as docker container in home assistant. I'm sure you can docker stuff on FreeRTOS
Wait a Minute, the Video Game Hall of Fame Inducted Solitaire?
Not a fan of git prime. It's built for micro managers, measures mostly meaningless metrics.

Encourages frequent small commits with low "churn". Trivial to game if you write a script to split your commits and artifically remove "churn" by making sure you don't touch your changes more than once. Also penalizes you for high "impact" commits. Adding a bunch of docs, renaming packages, or even running auto format penalizes you in metrics.

It's completely blind to the language. Doesn't understand the code one bit. Doesn't tell you anything about code quality or if your "rockstar" only writes so much code because he copy pasted everything. Not kidding, almost all the code our "top coder", per git prime, wrote had to be redone after he got canned. He was copy pasting trash everywhere.

I'm not against metrics but what it measures largely isn't meaningful. Ex. It's well known that lines of code across different languages are not equivalent.
I had an install of SeaMonkey with NoScript installed and just have been using that - privacy settings all locked down - no problems, have been using it for more than half an hour - couldn't be bothered fiddling around and worrying about it.
Milo was banned from Coinbase within three minutes
Wow this is really bad, breaking millions of people's workflow in one go.

Fixed for now by switching to Firefox Nightly and disabling signing.
I'd argue it's a blunt hammer extra layer of defense, where if a certificate gets compromised and the owner never finds out at least it eventually stops working. This kind of compromise is pretty common.
Belajar HTML Dasar Text Formatting Tag SEO Heading
Why would a process need to run as root or have write privileges to /etc in order to automate LetsEncrypt renewals?

I run Caddy (which uses acme-go/lego as its ACME provider) as a non-root user with no access to /etc at all. It seems to be running fine.
A quick question to maybe further prove your point, how many people, that you only knew through social media, contacted you during your detox to find out if you were ok and what had happened?
https://www.newsweek.com/new-biography-cbs-newsman-walter-cr... specifically mentions him injecting his personal bias into stories (Vietnam, Goldwater, Nixon), etc.
Serious question, is there a blacklist of people deemed undesirable, being shared amongst Silicon Valley firms?
Much better, thanks! It's scripts like this that make me miss the old XUL addon interface; sure it was difficult to maintain, but it granted a level of control over the browser that wasn't (and now, sadly, isn't) possible anywhere else.

I was able to piece together most of my compact dark interface theme [1] with userChrome.css by sacrificing the all-tabs menu for its JS binding, but the all-tabs helper addon is a shadow of what it once was, and the Private Tabs addon is dead with no hope of revival due to the lack of a WebExtension API [2]. I can't even switch browsers to get the functionality back since the others are even less configurable.

[1]: https://github.com/techwolfy/rainfox-theme

[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1358058
That makes sense actually. But stored procedures could do that too?
Is there any chance you could share your friend’s list? I’m expecting a baby soon and this sounds like it would be very useful...
At UW (University of Waterloo), our Real-time OS class projects used physical trains. Walking the halls of the Math & CS building, you could see kids "playing with trains" all through the night quite routinely.

It had the reputation of being one of the hardest CS classes in the undergrad curriculum.
The Next Wave of Internet IPOs Has Arrived and It’s in Emerging Markets
True. But they also increasingly stand for things I completely disagree with. Namely, deciding which software is approved for me to run on my computer. The way I see it, extensions shouldn't need to be "approved" anyway.

Luckily, I can still type "make install" without debian informing me that "random_dangerous_untrusted_code_from_interwebs" is not approved.
> Doesn't Mozilla have a mechanism for blasting out a message to all Firefox browsers?

The cynical side of me says that it must not have this feature because if it did I'd have seen someone complaining about the browser "phoning home" or "forcing Mozilla's opinions into my eyeballs".
Same. I used to frequent the first Chapters store that opened in Winnipeg, and it was basically great. Tons of books, and a massive tech section that carried things like comp sci textbooks. In other words, they carried a breadth of subject matter that didn't just cater to the most popular, and this extended to other parts of the bookstore as well.

After some years, the store devolved. Again using the computer section as an example, the rows and rows of full shelves got hollowed out. The cool stuff went first, until there were many mostly-empty shelves with just the riffraff books like certification guides and software guides for specific apps and versions thereof. Really, what was left was the most disposable, and least interesting of books. Eventually, the once-awesome department collapsed like a red giant star turning into a white dwarf.

Once Indigo bought Chapters, the stores were doomed as far as being bookstores went. Most of the floor space immediately turned into places for greeting cards and scented candles, knickknacks replacing books far and wide. The NYT describes this as a big bookstore chain thriving, but it isn't really a bookstore chain at all. Maybe it's profitable, but there is no point now in my entering one.

Discovery of interesting books, and quick, convenient purchase of same, is more effectively done online now. Even before the acquisition, Chapters had gone in my experience from being able to order books that weren't in stock, to ordering and never receiving books without explanation. Perhaps they were no longer keeping up with paying suppliers.
Being upset is ok! I'm not particularly happy that I can't just override the certificate check on stable. But demanding someone get fired is just pointlessly punitive.
For some languages it's more about providing features for the IDE and less about providing features for the language itself. It's probably the main reason Microsoft started working on TypeScript for example.
I had the same thought, but I still find that absurd. Say they host 500,000 websites with HTTPS. 1,000,000 renewals they save spread across the year, roughly 2 renewals a minute. That is pennies. A t2.medium could handle that type of load increase
>...while blocking other countries from exchanging ideas and wealth with its citizens. We should disconnect China.

Have you never heard of the Wassenaar Agreement[0,1]?

[0] - https://www.wassenaar.org/about-us/

[1] - https://www.wassenaar.org/app/uploads/2018/12/WA-DOC-18-PUB-...
The dynamically typed case is not "only an AST," it's a living and breathing program. It made this HTTP request and performed some computation and read that file, and you can talk to it and learn all about its state!
An intro to Quantum key distribution
To some extent you are correct, but I think you are over-egging your point.

It is, of course, trivially possible to construct a program that halts. Or even to modify an arbitrary program to make it halt (a good debugging tactic when things seem to be running awry). But the programs we write on a daily basis are routinely much more complicated than the threshold where their halting-status is computable.

I agree that we often intend to write programs that are guaranteed to halt. And generally code with some informal heuristic logic as to why our code probably will. But you don't have to do a lot of futzing around with formal methods and algorithmverification to know how loose that reasoning can be.
This is an amazingly well done article! The writing is very clear and the interactive elements are fantastic in explaining the concepts. Really impressive and it was great to demystify how JPEGs work, I had a vague idea but the details are fascinating. Would love to see another one of these about MP3!
+1 for dark mode feature request. :)
I love "firehose of disease", and will steal it. And I agree that bugs are bugs; every time you add a new capability, you add all the possible bugs that can occur with that capability.
https://twitter.com/mozamo

https://discourse.mozilla.org/t/certificate-issue-causing-ad...
Came here for the same comment. I setup some s3 related stuff less than 2 months ago and the documentation, at least for the js sdk, still recommends the path-style url. I don't even recall a V1/V2 mentioned.

That seems very inconvenient, and is pretty inline with my experience with aws: I guess their services are cheap and good, but oh boy! The developer experience is SO bad.

- So many services, it is very hard to know what to use for what
- Complex and not user friendly APIs
- coming with terrible documentation

I'm pretty sure they'd get a lot more business if they invested a bit more in developer friendliness - right now I only use aws if a Client really insists on it, because despite having used it a fair amount, I'm still not happy and comfortable with it.
One counter example is GreatFire, who use GitHub for their wiki [1].

[1] https://github.com/greatfire/wiki
Eh, I don't really think we're about to see a stable government in Venezuela, let alone a stable Stalin-grade dictatorship.
Run this in your Browser Console[1] to delay signature checking for a day:

function set_xpi_sign_time_now() {
const {Services} = ChromeUtils.import("resource://gre/modules/Services.jsm");
const now = (new Date()).getTime() / 1000;
Services.prefs.setIntPref('app.update.lastUpdateTime.xpi-signature-verification', now);
}

set_xpi_sign_time_now();

EDIT: Changed `Components.utils.import` to `ChromeUtils.import` because apparently Beta and Nightly versions have removed the former, while the latter was introduced in 60.

This does the equivalent of setting in about:config the time of last signature verification to the current time. By default, Firefox re-checks signatures in 24 hours (or so I read somewhere here). I like the temporary effect of this, compared to the permanent disabling of signature verification suggested elsewhere.

----

1: https://developer.mozilla.org/en-US/docs/Tools/Browser_Conso...
Completely agree. Using firefox feels more and more like using an iThing.
Yes. I was upset. Sorry. I ought to know to stop when I'm upset.
the only extension that failed in a waterfox is tampermonkey which stopped working but did not get removed the way it did in a firefox.

as for a system to push messages to firefox users, is there anything like this in place? a standard? if so could it notify waterfox or icecat etc users at the same time as firefox users?

if there is no specification for this, is there a similar floss project that could be forked and molded into that of which we’re in need?
Google CTF 2019 is here
This is awesome!

I wonder if it's possible to load everything from the remote environment, including extensions, themes, settings, etc. I didn't see anything about that on the page.

This could be cool as a super easy way to make a very consistent portable development environment across platforms. This could be very empowering for classroom or casual learning environments where your users / students can just connect from any platform, any computer, and everything is ready and waiting. No environment setup, no OS issues, no platform-specific issues, no installing dependencies, no problem supporting old / weak computers, no multiple tutorials. It would also be extremely portable, users could log in from their personal laptop or desktop, shared computers, from their work computer, or from a classroom computer and they would all load in exactly where they left it on the last computer.

Something else that's interesting, and gets a little closer to that dream above, is code server [1], which goes all the way to just embedding vscode in it's entirety into a chrome web app hosted from a container running full Ubuntu. The two approaches are somewhat converging, or are at least on a very similar trajectory, it'll be interesting to watch as they mature.

[1]: https://github.com/cdr/code-server
Please make more. These are great :)
Importance of Choosing a Food Delivery App for Your Restaurant Business
i’ve a strong emotional reaction to this. it feels like a failure on all of us. will be fighting toward a more optimistic interpretation of such a snafu.
They are having a tough day - check out "When Firefox Extensions Goes Down" on YouTube. Have to feel for them :)
Put the checklist on the home page of the company website!
Can you set this to the future and get say a week of buffer time for the fix to get pushed?

edit: nope, you cannot:(
Systems designed around long TTLs make this problem worse. I love the default of 90 days for Let’s Encrypt. It forces some good discipline and hygiene. Wish there was a better solution for short lived CAs
This is not true. In Let's Encrypt/ACME for example, you can simply obtain authorizations for all the domains a certificate is valid for and request revocation [1]. The only thing you still need to revoke the certificate, is the certificate itself. The certificate can be obtained from CT logs.

[1] https://tools.ietf.org/html/rfc8555#section-7.6
I'm curious about how an update will be able to differentiate tracking cookies from legit ones?
The old videos are still up, but they mostly stopped uploading new videos to it a while back. It was discussed in the January Q&A. They're still uploading to bitchute and full30.
I think this is exactly what happened.
I Launched a Nuclear Startup
1. I don't think that'd be necessary; I believe Mozilla will fix it in a day, or two at most (PS: they're currently testing a fix); and

2. I don't know if there's sanity-checking code in Firefox to ignore times in the future.
...unlike the mothership breaking all addons, and the browser being designed intentionally in a way that prevents me from working around the breakage?

This isn't just a petty snipe borne out of annoyance. Ads being the malware vector that they are, and the degree of tracking and data mining out there, all of those countermeasures being turned off overnight is an exposure that should be treated with the same degree of seriousness as PII breach at a company you have an account with.

God forbid you use FoxyProxy or Tor Browser or something else that masks your connection source - this could have legitimate, real-life consequences if you don't notice the change.