skysight-inc/HackerNews huggingface dataset:
The main drive/purpose of life is to continue and spread itself, that’s just fundamental biology. You’re free to opt out of that and define your own goals (it sounds like enjoying yourself is your goal), but without another generation to pass it on to, everything that every human has ever done will have been pointless, because the purpose of most of what we do is to help humans. And what we collectively leave them with is the “score” that will be remembered for as long as there are people to remember it. But sure, your individual score is unlikely to be remembered for very long, except by your direct descendants.
If they can't get this right, what hope is there of browser security?
See https://en.wikipedia.org/wiki/Filesystem_in_Userspace
They would have to reissue the intermediate certificate, as well as all dependent certificates.
I'm not sure the GP is overstating things. For technical folks with technical reasons to be using Firefox: yeah, a mass exodus is unlikely purely because there aren't any good alternatives. What are you going to jump to? Chrome, and knuckle under to the Goog? Unbranded FF forks and be weeks behind on patches? Doubtful.

My concern is around non-technical users (the group, mind you, that Firefox has been spending marketing dosh on courting recently with Quantum and all) who don't have as compelling reasons for not just switching back to Chrome. In the last hour, I've gotten several phone calls from family members asking me why the browser I convinced them to use is broken. I don't have a good answer, because platitudes about surveillance and muh freedoms don't count for shit when your grandma just wants to get rid of the ads on the local newspaper site.

I'm personally going nowhere and deeply appreciate Mozilla for all the work on FF and friends, occasional fuckups aside, but I don't think this is going to be a non-event for a browser that's been desperately fighting to regain market/mind-share.
The kindness of strangers: The evolutionary origins of morality
I fail to parse your sentence 'to a shit behemoth' ?
You're not the target. You're "on the fence" with prime, and you're probably not spending that much with amazon. It's for the heavier shoppers with prime who double down on their spending.

It's ok, you're probably not the market for vegas casinos either.
I really don't think it is very many. There are clear patterns of failure for fizzbuzz - the biggest is the "copy-paste programmer" who sees a blank canvass and just has no idea where to start. Then you have your people who can write conditionals but can't reason about them - they will very often end up with a solution that compiles, but always prints the number no matter what, or never prints FizzBuzz, or some other obvious error that should be apparent on a quick review of ones code. Most of these people also take 10-15 minutes to write it out, where competent programmers consistently bang it out in five minutes or less. (And yeah, some of them probably know it by heart by now. Oh well.)

Screening someone who just absolutely can't program at all is, IMHO, by far the worst part of technical interviewing.
You can turn off that auto-saving feature in system preferences. It’s called something like “Ask before saving changes.”
I got all extensions to work temporarily by forcing the following settings in user.js (or could be set manually in about:config):

user_pref( "extensions.legacy.enabled", true );
user_pref( "xpinstall.signatures.required", false );

FWIW, I'm on Debian Stable with Firefox 60.6.1esr.
I got a small message at the top of the tab saying that my add-ons had been disabled. Still, not nearly enough considering what happened.
Come back when you are ready to use Clojure for real, not for a weekend reading through tutorial blogs. Clojure's concurrency story is extremely well implemented.
You're referring to things like HTTPS and contacting a remote server, and thus your reasoning there makes sense.

I'm referring to traditional code signing, which I assume Firefox extensions are more similar to --- the goal being to ensure that some data has not changed since it was signed, and only the validity of the certificate at the time the data was signed is meaningful; even after the certificate expires, a signature created when it was valid still asserts that the data it signed has not changed.
same +1
A warning yellow bar appeared for me below the URL bar.
Not sure that's a bug - there's a space in the actual post.

> give a direct s3 link to https:// s3 .amazonaws.com/mywebsite/index.html.
Still working for me in my main profile in Firefox 60.6.1esr. I could even install an update to HTTPS Everywhere!

When I opened my alt profile, extensions still worked, but I can't install updates—including for HTTPS Everywhere.

What's up with that?
My extensions are also still running. Comments on the bugzilla bug restricted so adding details here and figuring that if this is useful someone can forward it to the right people

$ date
Fri May 3 22:45:22 EDT 2019

$ date --utc
Sat May 4 02:41:47 UTC 2019

$ firefox --version # Installed from arch repositories
Mozilla Firefox 66.0.3

about:config

xpi.signatures.required true
app.update.lastUpdateTime.xpi-signature-verification 1556920447
extension.update.enabled true

1556920447 is unix timestamp Fri May 3 21:54:07 UTC 2019.

Edit: I think I know why. It checks the signatures daily, and the timing works out so it hasn't checked since the cert expired for me. Just luck, it will break within the next 21 hours for everyone. From the source code:

const XPI_SIGNATURE_CHECK_PERIOD = 24 * 60 * 60;

[...]

timerManager.registerTimer("xpi-signature-verification", () => {
XPIDatabase.verifySignatures();
}, XPI_SIGNATURE_CHECK_PERIOD);
Yup. Wonder if there's any co-op / worker-owned medium-sized firearms manufacturers that are US-based?
If a signing certificate expires and is stolen, it can backdate signatures. On the theory that expiration is useful because either people keep poorer track of key material over time or algorithms get weaker over time (which is not an unassailable theory, but it's a coherent model), you want expiration to prevent future use just as if it were revocation. Because you can't trust the date of a possibly-forged signature, you have to check the current date.

The model you're suggesting is closer to the "timestamping" one commonly used in code signing (IIRC Windows and Mac both do this) where a third party that's particularly trusted to handle key material well long-term gives you a second signature over the message "I saw this signature at this time" (effectively they are analogous to a notary or witness for real-world signatures). Then you can trust that signatures from expired signing certs were actually made in the past, and not by an attacker who got hold of the key. That is, without timestamping you have no proof of #5 in your list.

(I suppose you could do this now for the SSL PKI with Certificate Transparency logs.... it isn't exactly what they were built for but it's probably sound.)
Yes!! Extremely angry right now.

All of my legacy extensions are disabled. My beloved uBlock Origin included. Only Disconnect works. Tried downloading alternatives and can't even do that; keep getting a "download failed. Check your connection." The hilarious part, they said the new add-on signing doesn't affect themes, so why are nine of my themes disabled? It's getting old, all this messing with stuff all the damn time. I don't need you to hold my hand, Firefox.

If I want to run add-ons that don't use Web API then let me do it to my own detriment...
> ...people will add subtitles due to a 100% understandable foreign accent.

The way he speaks is not "100% understandable" at all. Watch it with your eyes closed, or with the subtitles hidden, it's actually quite difficult to understand in many parts.
This is just abusive to the vast majority of users who do not care but still want to use SSL for their servers, frankly. I should be allowed to choose a near unlimited lifetime for my server's certificate if I don't care about the risks that may present.
They are living things. But also, greedy bastards can take living, thriving businesses into the embassy in Istanbul, chop them up and sell the pieces for profit.
Myers-Briggs personality test?! Isn't that like horoscope? The last time I took one in a company was administrated by a consultant paddling some psycho analysis things to HR. We all had a good laugh, like reading our palms to pigeonhole us into artificial compartments.
We don't know that human thought actually can run on a Turing Machine though.
Anyone know when they expect to fix this?

I basically can't (OK, won't) browse anything except HN until they do.
And there are often bootstrapping problems where e.g. the push that distributes the new intermediate cert to clients is rejected because of the same expiry issue.
So did they conclude it wasn’t a security concern or did they conclude the security risk was worth the uptime?
ffs i used tree style tab, and now my over 300 tabs i cannot access
This is democracy though.

The idea of a majority having more power than a minority is, as another user puts it "a feature, not a bug". If your goal is to best represent your population, then you want a system that counts people's opinions equally, regardless of what group/s they belong to.

The problem here isn't the voting system so much as the structure. The way to "better represent" minority groups is to have different weightings to those groups. But then that's difficult because you have to specify which groups are more equal than others. Clearly we like racial minorities and don't like minority groups like white nationalists (at least as a public), but most lines aren't this easy to differentiate.

The goal of voting systems like this is not so much to tackle this majority vs minority problem but rather to reduce tribalism. In a first past the post voting style your optimal strategy is not to pick the thing you like the most, but to rather pick the thing that you think is most likely to win and more closely aligns to your beliefs. These voting systems are more about finding common beliefs. For example, republicans and democrats agree on many issues. These systems are about anti-polarization, not about weighted representation.
That’s a bad sign on what they do with security
Related and currently #1: https://news.ycombinator.com/item?id=19823701
> The business model, sadly, is to be the Daily Mail of the left.

Bullshit. The Guardian is orders of magnitude a better newspaper than the Daily Mail.

What major stories have the Daily Mail broken in the last 10 years? The Daily Mail is not considered a reliable source on wikipedia, Comparing the Guardian to that is quite the insult
Yes, this is truly a gut-punch for everyone who has spent a bunch of time and effort getting their family and friends on a decent, cross-platform password manager (like LastPass, 1Password, or Dashlane).
Also, just saying, some extensions like color picker still work for me.
Whenever I ask to explain JVM criticism, people either really have nothing to say, or most of the time it turns out to be hatred of Java. JVM is a very solid piece of tech and it is hated for all the wrong reasons.

I'm baffled: give people a powerful tool that can simplify and bring enormous joy to work with two, most popular platforms of all time, even making it possible to share code between completely different worlds - they'd still be complaining about it.
You highlight a common fallacy that is repeated across the internet: "If you can't explain to me why I'm wrong, then I must be right," or something similar. But as you point out, this assumes that an explanation can be written in just a few paragraphs, which usually isn't the case. It takes years of study and experience to become an expert in a given field, and as a result, it becomes too difficult to accurately convey the necessary information to get a point across.
I never liked change that extensions had to be signed by mozilla.

Why do my personal extensions need to be hooked into some third party service that can go out at anytime?
There are good 401ks and bad 401ks. Many of them offer Vanguard funds, which have almost non-existent fees. And you’re doing it completely wrong if it’s as much work as you’re describing.

Pensions are often formed with unsustainably optimistic assumptions, and many of them will be insolvent at some point in the future. The temptation to mortgage the future for the benefit of the present is too tempting for people. Pensions do have a very nice set of attributes, but guaranteed benefits are hard to guarantee without being extremely conservative, which people have a hard time with.
It's a miracle the AWP got into Counter Strike. Either the design is so striking that it advertises itself or people-in-the-know recommended it. You'd think they'd use a Barrett as the "big ol' rifle" 3D model.
Select fire is rare and expensive for legislative, not practical, reasons. And it is VERY fun, if not particularly useful. It's a large part of what I was thinking of.

Why would the price matter?
Right. I am aiming at the group of companies that have 0 data scientist and would like to avoid hiring one. I assume that their use cases is simple/common and can be automated.

Note that automation is not only building the model, but automating the full life cycle - pre processing, hp optimization , pipeline deployment and monitoring/retraining.
But as far as using unapproved SaaS, they won't officially allow you to. But it does change the power dynamics at play considerably, since it's a matter of compliance rather than capability.

Well, yes, in the sense that someone might manage to access such a system despite any corporate security barriers if, as you mentioned, they initially managed to fly under the radar.

Of course, if caught doing that without the appropriate authority in the kind of environment I was talking about, that person would mostly likely be fired immediately at best. Potentially they could be sued for more money than they would ever earn if they wilfully caused compliance violations that resulted in big financial penalties. Potentially they could even face criminal charges that could see them imprisoned, depending on the nature of the violation and the jurisdiction in which it occurred.

Personally, I wouldn't consider it ethical to try to attract additional business in that way. As a practical matter, it's also highly unlikely to succeed with customers in sensitive sectors like finance, healthcare or defence/security work, though of course those are organisations towards one end of a spectrum and the IT departments in less security-sensitive organisations wouldn't necessarily be deploying the same level of countermeasures.
As the service provider, you shouldn't get to decide. I think it's the users who can decide how long lived certs they're willing to trust.
The guidelines aren't that way because those people necessarily deserve better, but because the community deserves better. When you break the guidelines like that, you're damaging the community you're participating in. Worse, you're damaging it where it's most vulnerable. HN is only valuable because smart, thoughtful people choose to come here.
A mistake of this magnitude cannot be the fault of an individual, because if it was, then the organization lacked adequate safeguards.

What I'd like to see is a post-mortem, followed by an explanation of how they'll prevent the mistake from being made again in future.
As I recall there is such evidence, but there's also evidence that commonly encountered concentrations of particulate air pollution drastically reduce that increase in BDNF. So it's not entirely clear what mechanisms all have to be working well to see that particular benefit.
Consider the recent news stories about the Boeing 737 Max. Boeing added an automatic system to an airplane, and then didn't give users (the pilots) a way to disable that system. This worked out great while the automatic system is working properly. When the system broke, well, we all know what happened.

If we're going to assume that software is right and the user is wrong 100% of the time, then the software needs to actually be right 100% of the time. Unfortunately, our software isn't that robust, and it never will be.
Show HN: Viewer and Finder for LSP Symbols and Tags in Vim
> When Adobe designed PDF, they kept the same imaging model as PostScript, but stripped out the programming language.

And then they added JavaScript to it:

http://www.adobe.com/devnet/acrobat/javascript.html

The small subset that displays text and images is fine, but PDF is a nightmare.
Not the end of the world. An annoyance sure, but not the end of the world. You people need to relax and stop throwing temper tantrums over nonsense.
Definitely. Everything works on my Debian Buster while Windows machine wasn't so lucky.
Same here! A while back I found some of my old Allegro games from a high school CS class (choked back chunks), and with little effort got them to compile on modern macOS. It was quite nostalgic.
I’m not necessarily against a for-profit pharmaceutical industry... but I certainly am when the entire cost burden falls on us because the pharmaceutical companies band together to prevent our government from negotiating drug prices at the national level like pretty much every other wealthy nation...
Sure this is annoying, but not the end of the world. There have been far worse bugs. You people need to relax and stop throwing temper tantrums over nonsense.
Running Firefox 66 from Ubuntu repositories on Ubuntu 18.04 and all my extensions are enabled.

Does it only occur after a restart or?
When CRISPR?
Within hours of setting up DLP, I had someone complaining I had broken their workflow. That workflow apparently involved emailing credit card numbers to an external personal mailbox "for security".

It was allowed to go on simply because noone knew about it. Could a skilled attacker spread a card card number across three lines and get past the system? Absolutely. Is exfiltration protection pointless? Absolutely not. Once you scale a certain number of users, you'll find someone somewhere that completely ignores training (which they did have) and decides they don't see the problem with something like this. And you won't know about it until you put a suitable system in.
It’s funny to me that people talk about this limitation as if it were some kind of virtue.
I live downtown Minneapolis. I own a condo and there are literally at least 4+ different bus stops right outside on the corners of my building going just about anywhere in and outside the cities (Costco, Aldi, Grocery Stores, Movie Theaters, Home Depot, etc...). Target, Whole Foods, Trader Joe's are within a couple blocks walk.

The light rail is 1 block away and goes directly to University of Minnesota or Mall of America with stops between.

During the winters, rain, or bad weather, the entrance to the Skyway is across the street.

I don't see how it can get any better.

I sold my car and lease out my parking spot for $150/month. I have a Metro Transit GoToCard [0] I fill up with $20 or weekly/monthly day passes.

[0] https://www.metrotransit.org/go-to-card
Commercial platform breaks things people have built on it for "the sake of continuously improving customer experience. "

Also: see photos of your favorite celebrity walking their dog and other news at 11.
What comes to mind to me is highly organized is, for example, a NIMBY crowd; a pro crowd is not as tightly coordinated, they get trounced, even if in polling the pros are in majority.
Maybe I misused the term. I meant it more as a way to describe how learning software engineering is just as much about modeling sound principles and learning by example as it is learning theory and terminology. You don’t need a 4 year degree in order to do that, not because it isn’t a highly skilled occupation but because, on the contrary, it is highly specialized.
downloading yet another pdf he promises himself he will read in the future...
I'm curious as well. My intuition would be that it's not a concern, since servers already keep their private keys stored locally in order to be able to communicate with clients anyway? Being able to update them doesn't really seem to make things any different. But I feel like I could be missing something/not have thought through it properly. (I imagine security implications can get more complicated if a different server decrypts traffic vs. processes it, etc.)
How is she planning on living afterwards with debt and no earnings potential? If it’s to rely on you, you might want to disabuse her of that notion so that she starts taking life a bit more seriously.
Oh relax. A cert expired. An intermediate cert at that...

This has probably happened to every major cloud provider and countless companies at least once. Certs are hard.

Should Mozilla have had monitoring on their cert expiration? Yes. Will they after this? Probably. Is any one person ever at fault for something like this? No.

Firefox is an open source project. You're welcome to contribute and make things better.
Discovery of all the certs is what I think is the harder problem.
Another benefit in-memory cache vs remote key-value store is the reliability.

Redis/memcached servers are super reliable, but at scale, you'll run into non-trivial amount of failures when communicating to those servers, even a sub-second blip in network connections could result in hundreds of failures.

Now you have to deal with retry, ensure your application logic is failure tolerant, worry about timeout, consider impact of temporary delays in redis to your application server due to skyrocketing threads waiting for results and all that fun stuff.
Seems like an over-reaction. "Destroy user trust in Mozilla?" Really? Because your extensions got disabled for a day?
SEEKING WORK | Washington, DC | remote: yes | Travel: no | Willing to relocate: No

Expertise: Advanced Deep Learning (Transformer-based sequence modeling, GANs/Autoencoders, various recurrent architectures, etc), Deep Reinforcement Learning

Technologies: Python, C++, D3.js, Matlab

Email me for a detailed CV. randy_marsh_rools@protonmail.com
This worked for me on Firefox 60.6.1esr on Debian 9 Linux—changing the setting instantly restored my addons.
The parent poster brought up an example of news outlets not publishing Creationist opinions. You claimed that The Guardian is not engaging in good faith by being a participant in a debate rather than an observer.

My counterpoint was a simple ask: Is The Guardian therefore not behaving in good faith if for example they choose to not publish opinions by Creationists, or if they don't give equal weighting to Creationists whenever a discussion about say, evolution appears.
I'm Interested in a proper root cause analysis and mitigation report.
Collateral freedom doesn't work in China. China has already blocked or throttled (hard to tell which, since GFW doesn't announce it) connections to AWS S3 for years.
Did you notice any downsides from the experiment?
Do you read the Guardian? I do, practically everyday, and I can say - As someone is centre-right, i.e. not the guardian's idea of their readers - that just isn't true.

This comment ignores the existence of Owen Jones, of course, but still.
HTML (sans javscript) would have been so much nicer though. All of the machine readable structure and separation of style from content would have been just absolutely wonderful.

But we'll never have that (not in the sense we have PDF.) Either it's an image or an application, no one really understands how to handle anything in between.
you mean like an orchestrator service ? ex: building for a uber eats system which depends on responses of systems (B, C, D..) where each of these systems have xx min SLA`s ?
Hmm I tried that too, year since I was on any social media, still just as lonely lol.
Insurance is a thing... you do have to build up enough savings to survive while not working, but that’s doable if you don’t blow everything on traveling and other luxuries.
I believe it happens the next time Firefox goes to check for addon updates. You may want to proactively set xpinstall.signatures.required=false which... I think might work for 66 on Linux? It worked for 60.