skysight-inc/HackerNews huggingface dataset:
Ongoing work with big companies to replace existing technologies don't convince me. Though, neither does whining when the authoritative nameserver itself is returning bogus responses.
The problem is that the adversaries are themselves beekeepers or former beekeepers. Fake measures are unlikely to work since the thieves won't be fooled - you have to assume the thieves know almost as much about the countermeasures as the beekepers themselves do.

Your ideas are basically assuming that the thieves are amateurs, and amateurs that know nothing about beekeeping aren't going to be able to effectively monetize the bees they steal anyway.
While the fault lies with the users for not following security best practices, including enabling 2FA there are things gitlab/any site can do to help defend against these sorts of attacks. Some suggestions: Treat logins from datacenters as suspicious. (In this case the IP block identified belongs to World Hosting Farm Limited). Treat logins from a new/different ISP as suspicious. Limit access to the account and verify the login via email. It’s not foolproof but as part of a defense in depth strategy it can be quite effective.
> "Labor Shortage" is actually very good for the majority of the population.

It sort of depends. You could argue that in the US there is a (artificially created) shortage of doctors, which makes them great money, while inflating everybody else's medical bills. So, if the labor shortage is experienced in an industry serving mostly for the local (US) and not the global market, it's not good for the people.
I think $360k a year in wages (so not counting equity) is definitely on the high side of things.
This wasn't a new bug in an experimental feature. It was a timebomb (accidental) that's been in the codebase a long time.
CVE-2016-9179 was published about Lynx in November 2016. Lynx took more than 5 minutes to release an update, with the fix included [1] in 2.8.9dev.11 not reaching a production release until July 2018 — almost two years after the CVE was published.

With a response time like that, I don't see how Lynx will satisfy their "5 minute fix" need any more than Firefox did.

[1] https://lynx.invisible-island.net/current/CHANGES
I addressed above (will probably stay above, it's the top reply) about why I felt safe clicking this link myself and think others should too.

You're right that in general training them to listen to anonymous forum posts is less than ideal, but all in all I'd rather they have a working browser. As a side benefit they get to see posts like this that rightly point out you shouldn't trust strangers on the internet too much.
>Eclipse was slow and had the usual non native Java smell that all cross platform GUIs have

Actually Eclipse used a native GUI toolkit (Standard Widget Toolkit), backed by native widgets plus a few custom draw ones (like 100% native apps also resort to for custom stuff).

So, if it smelled "non Native", it wasn't because of Java.
> I find this hard to believe. Are you not surprised by traveling? Art? dmt experiences?

Those are the lightweights, largely because they are also manufactured experiences:

- Traveling: Whoa, in that other country, people are speaking a different language, have different customs, and have different values? Who could have known!

- Art: Sure, art can evoke some feelings, but rarely is it earthshattering

- Drugs: Okay, that I don't know - and don't care for

The bigger things are other life events, like change in relationships, change in worklife, moving places, friends and family getting ill or worse. Sure, those will never be easy, but the more you go through them the better you know that "this too shall pass" and how to deal with it.
>No, happiness is the result of making others happy.

By your own definition, you can't make others happy. Because, again by your own definition, for them to be happy, they need to make someone else happy, but for that someone to be happy, he needs to make an other person happy etc... A never ending chain. Your definition is illogical.
I know someone in Berkeley who buys the old goats/sheep. He takes the choice cuts of meat for himself and feeds the rest to his dog.
Hopefully they go with something this interesting. Moving forward while respecting the past seems like the right approach to me. Even rebuilding it exactly as it was isn't going to please everyone.
Oh, I did not know that. Are you sure that enabling studies also means that user's data is sent to Mozilla without consent? Are you sure about this?

I'm asking because there I can imagine that there is a benefit for Mozilla to develop a feature that enables studies without sending data. It could be used to fix a broken feature or a broken logic (as in the case of expired certificates here). So, I'm not convinced that enabling studies always means that your data gets uploaded without the consent. Can you point me to privacy whitepaper / source code to backup that statement?
What if higher education did its job and actually delivered skilled people instead of offering "the best campus experience"?

Edit: to make myself clear, I absolutely think universities should focus more on thinking than doing. That is not a valid excuse for focusing on campus experience and the like.
Also any commits pushed between the last snapshot and the deletion would be lost too.
FYI this is a far-right conspiracy theory, typically found among white supremacists. there is no evidence that a secret cabal is planning some kind of new world order or plotting to burn all the history books.
Thanks for the details, this is very helpful.
More like "No true scotsman": e.g. "yeah, but those people are not truly happy", etc.

Well, I say they are truly happy, doing the thing they enjoy most inflicting pain.
> The bar is whatever I WANT it to be, it's my machine, and it's pretentious of a software developer to assume they know what I'm using the software for and what my best interests are. For all they know I'm using the software in a museum, 20 years from now, about this era of computing.

I think that's a reasonable point of view. However, for such users, it's best not to use software that's largely developed for masses who just expect the software to work. It might be best to just checkout the source code, and build your own binary. Sorry for being rude :(
Why not just send the subnet of the machine at cloudflare doing the querying?
I have personally rewitten a number of expensive inner loops into C to make Python be less slow. It is easy (if you find it hard Go wont be an option for you). I would say the argument against Python is not raw speed but concurrency model. I use gevent for io bouns studf but going multi CPU with data sharing is hard for the engineer and slow for the code compared to Go and goroutines. Subprocesses are ok and sending data over sockets is ok but serialization several times is sucky. Worse than extra memcpy. Also one big msg can block your interpreter.
I'm not really one for compilation videos, but I stumbled across this one when looking for info on the tic tac incident and it's pretty interesting - 4 Most Compelling Videos Of UFOs: https://www.youtube.com/watch?v=f7pgMfzTEZc
I think you're overstating it.

>It is astoundingly disingenuous to act like these things are comparable.

Why aren't they comparable? In both cases, it's Mozilla pushing code to the end user. There's a different process behind both but calling one a frontdoor and one a backdoor seems apt to me.

>and which can make such large scale errors as evicting all extensions

Normandy was not used to disable all extensions. It was caused by a certificate expiration error completely independently. Normandy is being used instead to work around the error until a more permanent fix can be issued.
This is great staff! Finally there is an Open Source initiative to create a robust transport for sync audio streaming. Existing Open Source solutions that come to my mind (like SlimProto, SnapCast, ffmpeg) focus on providing 'a product' rather than a reusable 'transport'. Few questions: how do you 'capture' PCM stream in case of ALSA? It is straight forward to create a PA sink and plug it into PA configuration, but I am wondering about pure ALSA.
Disclaimer: I am an author of https://www.github.com/gimesketvirtadieni/slimstreamer
Uhh....except that they have cut prices a bunch of times in the last decade and launched cheaper storage like one zone
Only if you define happiness in your own unique way to make your point a tautology.

If they are content and happy with their lives, and enjoy what they do (inflicting pain), then for all its worth, it is happiness.
Yes, the employers can and will try to pay out the overtime only after that time. And some are already trying to do just that.
There have been large protests which the state media doesn't even cover at all and honestly, calling this propaganda is quite dishonest.
Also workers are being "convinced" to sign agreements because otherwise they are out of a job.

Source: Austrian with Hungarian partner, and with friends in Hungary.
> With the proliferation of mobile devices, you'd expect there to be an increase in footage of such sightings with an equivalent increase in quality.

Phones have lenses with wide focal lengths and tiny sensors. You need a very different device to capture small objects far away from you with high resolution.
> That's probably because smartphones are way too expensive.

I used to buy new phones every generation when they were $3-400.

And back then that money would land you a noticeably better phone, usually with some new capabilities.

These days “good” phones are $1000+ and each generation only gets you better specs.

Fuck that. I’m keeping my working phone. Peak smartphone was probably 3-5 years ago. Since then there’s been nothing really new.
i love userspace implementations of filesystems.

note that the issues are entirely different from those with a kernel implementation since you aren't having to think about page cache et all.
In the 19th century goats devastated the native landscape of California and introduced the Mediterranean grasses that give California its moniker The Golden State. The headline picture of this article illustrates my main concern: that these goats will do further harm to native plant species. On balance, it may still be a good idea, but how it is done may require more thought.
It's mainly a list of Amazon affiliate links with no content whatsoever. It's spam.
Isn’t that demonstrably untrue given terrorist attacks and shootings that go undetected even though evidence was later found on their phones?
You might be underpaid! Should interview a bit to see what your market value is.
Academia has never seen itself that way.

It's pretty stupid that a 4 year degree is turning into a checkmark credential. It's a lot of time and effort to invest into something you aren't particularly interested in but need to get some job where the time and effort put towards the degree don't mean a lot.
Notably, Level3 and Hurricane Electric both appear to not use ECS, and archive.is resolves properly from those. Which seems to clarify that this isn’t a technical requirement for archive.is to work, it’s an intentional protest by the archive.is operators against Cloudflare.
if you contact AWS they can replicate existing
I suspect Apple will be happy to keep taking 80%-90% of the profit in the marketplace while only shipping 20% of units.
Likely you don't care which exception is thrown, only that one is. In that case, it's overkill to add the exceptions to the type signature. You'd be far likely to be better off using IO<A> from Kotlin or IO[_] from Scala to model computations with exceptions as side-effects.

Besides, any non-trivial method that calls any set of libraries/frameworks would need to declare tens or hundreds of checked exceptions in your scenario. And that's just the catchable exceptions. What are you going to do about any (subclass of) Error?
These are synonyms to some.
Links for documented instances of this practice?
See the CEO's comment: https://news.ycombinator.com/item?id=19828702

> We’re aware of real world examples where nationstate actors have monitored EDNS subnet information to track individuals, which was part of the motivation for the privacy and security policies of 1.1.1.1.

So it's not just "Cloudflare benefits from pushing anycast" (even if that's part of it).
The emphasis is not on the "new" but on the "hot new". You can hone your skills for decades, and even publish, but only become "hot" (based on some nicely selling or award winning work) later in life. You still deserve to be in a list.
The anti immigration thing is a political ploy by Orban, so he gets less informed people vote for him. He built a media propaganda machine which hammers the dangers of migrants day and night. Any kind of criticism against the government is deflected with the migration argument (those who criticize only want to bring in migrants), regardless of the current issue.
LINQ itself is a big deal because of what it enables.

A simple LINQ expression can be passed around an translated on the fly by various providers. The same expressions can be translated to Sql, Mongo, regular IL, etc.

And no LINQ isn’t just syntax.

Last time I checked neither SmallTalk or Haskell are taking the world by storm...

Haven’t Java proponents been claiming Java was going to be fast for over two decades?
We’re literally in this mess because Firefox requires digital signatures on this kind of thing, please don’t make FUD posts.

This is much better than disabling the very same safe guard, signature checking, that prevents you from running arbitrary code in the first place.
Instead of pretending you're perplexed about my desire for a "5 minute fix", you can go back to the comment that said everyone here who has a problem with the issue Firefox caused is crafting a "narrative that appeals to emotion."

Read that, I don't know maybe ten times, and then read my comment which said I just switched my browser, no emotion involved.

I'm a man of action, baby. You can deliberate over my thought process all day, wondering if I would pick this browser or that one, or maybe even if I felt bad that I violated my loyalty to Mozilla Firefox (blessed be thy name). But don't think too hard, I've already moved on to the next decision in my life.
You don't pay that much less for healthcare. Remember, it's not the government that's paying for it, it's _you_ paying, with your taxes. The cost structure is different, that's true (European doctors also make a lot less, and US pharma companies subsidize non-US customers for some reason), but that doesn't matter with a typical US SWE salary.

And with a fat $200K+ paycheck student debt goes away in a few years, if you had it in the first place (substantial fraction of students receive financial assistance).

Best of both worlds: get your "free" degree in Europe, move to the US, make a killing. This, in short, is Tusk's problem.
It’s only hated by angry online commenters in the US
5G signal could jam satellites that help with weather forecasting
Not to excuse poor hardware, but rowhammer can be pretty easily mitigated in software by using guard rows as mentioned in the paper.

To explain, rowhammer allows you to flip bits in adjacent memory rows. So, we if we just put an unused row of physical memory between two pieces of physical memory we want protected from each other, then rowhammer attacks as normally described are effectively impossible.

To provide a simple case, assume you a totally static system with two processes, A and B, that need 2MB each executing on hardware with an 8KB row size (order of magnitude correct). Then if we just put process A in physical addresses 2MB to 4MB and process B in physical addresses (4MB + 8KB) to (6MB + 8KB), then the physical memory is separated by more than the row size and rowhammer attacks in one process can not affect the other.

The main thing about this solution is that physical memory allocation needs to be allocated in at least row-sized blocks and you eat overhead anytime you need to insert a guard row. However, the overhead can be largely mitigated if you only insert guard rows between the security boundaries of your code instead of on every allocation.

As an example of how we could mitigate overhead by choosing a larger security boundary, say we have VMs on a shared host, but the VMs get 1GB of guaranteed memory. Then when we create a new VM we can just allocate 1GB of contiguous physical memory and insert a guard row after it. Since the memory of the VMs is not interleaved, all the memory of a VM is further than one guard row from the memory in any other VM, so all VMs are safe from rowhammer attacks by any of the other VMs. With this solution, we only eat a 8KB overhead on a 1GB allocation which is a trivial.
Eh, for me only that often if you include stuff caused by a dumb user (aka me). And even then I always got them back one way or another. Usually from %APPDATA%\Mozilla\Firefox\Profiles\[profile]\sessionstore-backups (thankfully there's usually a recent copy, since I'm on a test version) or last resort from backups.
Hmm, I'd like to follow up more on the education aspect than on the Sun bit...

Imagine a conversation with a five-year old. "What are you doing? Making this Arduino blink an LED light. What color is the light?"... Now imagine responding to that five-year old with a discourse on spectra and photons.

Yes, the misconceptions in such discourse can be fun and amazing. A recurring response from non-astronomy physical-sciences graduate students is something like "The Sun doesn't have a color; it's lots of different colors; it's rainbow colored". But maybe I've long missed the interesting question.

Why is stuff like this even a candidate to be said? Does the Sun seem so alien or aphysical that normal experience of objects doesn't apply? Are concepts of color fragilely situational? ("Bananas are yellow, but wow, mangoes? Do mangoes even have a color? Photons mumble spectra mumble."?) Are answers just associational mind dumps? (Before the "five-year old" was emphasized, a recurring response was a brain dump of random ideas about color and about the Sun, followed by "Did I get it right?".) Just what is going on here?

There's seems an opportunity to think less superficially about this than I have done. Yay. Thanks!
Mozilla is a spy-agency.

Why can we say this?

Simple:

https://blog.mozilla.org/addons/2019/05/04/update-regarding-...

"To provide this fix on short notice, we are using the Studies system. This system is enabled by default"

So they sniff on users, while breaking software.

For how much longer do people want to keep on trusting Mozilla?

I have said it before, I will say it again - even without Google funding Mozilla, the number one enemy to Firefox is called ... Mozilla.

It's like a movie story - The Enemy within.
Care to post benchmarks?
That's not true.

Many setups proxy everything but dns traffic.

That's why this topic is a thing.

https://trac.torproject.org/projects/tor/wiki/doc/Preventing...
> (artificially created) shortage of doctors, which makes them great money, while inflating everybody else's medical bills

Good point. I was just referring to the common usage of the phrase. When media talks about "labor shortage" they usually don't mean doctors.
I could say that for reliable software like SQLite or curl.

But for Firefox? My expectations for browsers in general aren't anywhere high enough to warrant raised eyebrows even in the face of monumental fuckups like the one were seeing today. Specially because users tried to warn that this could happen and Mozilla stubbornly said NO: https://news.ycombinator.com/item?id=10038999
> Personally, I got a brand new Xiaomi phone

Make sure to go over apps preinstalled (system apps) and disable them or take away their network permission, if nothing else.

NetGuard, NoRoot Firewall, Glasswire are some of the apps that let you do that.
Also see here for a less breathless article on the event: https://skepticalinquirer.org/2018/05/navy_pilots_2004_ufo_a...
> In the 19th century goats devastated the native landscape of California and introduced the Mediterranean grasses that give California its moniker The Golden State

I always thought it was because the gold rush happened literally weeks after the state's incorporation, and fundamentally shaped it in many ways?
There was a long period in software during which it was ordinary to hire people without degrees, including through at least the start of the dotcom boom. For most software as practiced today, I still don't understand requiring a degree, if one looks at what the practice is actually doing -- you don't need a degree for most of what is currently being done.

Separately, it also seemed not-unusual to hire software people for general ability and experience, on the assumption that they could quickly pick up whatever language/tools were needed. This seems to be less common now, outside of new-grad recruiting.
That hole can be filled as long as they keep doing it.
Why not hire someone you think is smart but inexperienced into a low level programming job?

There's lots of chores that don't exactly take a lot of deep knowledge.

(Of course the answer is that companies have discarded the idea of having a training pipeline)
This is a problem of the 1^4 resolver not implementing DNAME support (either not a priority, or just in the backlog): https://community.cloudflare.com/t/www-lancaster-ac-uk-not-r...
The full IP of the Cloudflare resolver doing the recursive resolution is already provided to the authoritative server, as the source IP for the DNS query traffic.
As for your other weirdness. Signatures are only checked once every 24 hours, and it's only been 20 since the cert expired, your other computer probably just hasn't re-verified the signatures yet. You can find some comments here about how to delay it if you want.
What you really want is a Starbucks near the door, so the parishioners can get a little pick-me-up before services start.
Yes, I am 100% sure. See https://wiki.mozilla.org/Firefox/Shield/Shield_Studies#What_...
To add to the specific example of twitch, their ads are broken and annoying as hell.

The broken:

- they still don't have the volume of ads under control

- the android app regularly freezes during ad display

- sometimes it disrupts and buffers the stream without then displaying the actual ad

And possibly more, I wouldn't know since all these are enough to make me either not watch twitch or block ads. I disable it once every few months to see if it got better though.

The annoying:

- the same ad every time often (when The Grand Tour started again this year, it was the only ad that ever played for me)

- most ads seem to be trailers for TV shows or movies. Most of those spoil half the story

- if you just want to see what some streamer is doing you have to watch an ad first

Twitch Prime was the only reason I still had Amazon Prime when it removed ads officially. Not anymore.

Twitch turbo was great before Twitch Prime and I had it. But now it's 9,99€ per month which I find outrageous, especially because the streamers will see very little of this money anyways, afaik.
> Without a teacher of some sort that can provide feedback, I have no idea how I could have learned elementary Mandarin

One of the points made in The Language Instinct is that children pick up their languages without using any explicit feedback. That is, people in the child's life who can already speak are liable to ignore errors in the child's speech, and when they do point out errors, the child will essentially always ignore the feedback.

But I wouldn't say children don't get feedback at all. They get a lot of important feedback, such as whether the thing they wanted to happen when they spoke did happen, or whether the person they were talking to appeared to understand them. However, this kind of feedback is generally not the kind provided by a "teacher"; everyone automatically provides it.