skysight-inc/HackerNews huggingface dataset:
>On what basis?...

Uh... on the basis of them beating, torturing and even killing slaves maybe? Or again, are we not counting any terrorism against slaves?

I mean, what would you call slavery but terrorism? Violence to achieve and maintain a political objective. What is war but terrorism really? When you're dealing with a terrorist, you use their tactics and prove to them you're willing to go further.

But coming to the central point, I think it's clear we just disagree fundamentally about when it's appropriate to use treasury to pay settlements. Paying terrorists or bullies is completely inappropriate. Paying someone you may have wronged inadvertently, or paying for land, is more appropriate. So paying, say, France for Louisiana, or Russia for Alaska, is entirely appropriate. It's just making an offer for a piece of land that's not ours. We don't own it. We don't farm it. We weren't the people making that land valuable. But we wanted to move there so we could do so. An offer of purchase is appropriate under those circumstances.

But paying southerners to free slaves, is tantamount to paying a kidnapper to release their hostages. If you're smart, you just don't do that. The only thing it does is embolden other kidnappers.

And paying someone for land you live on, you farm, and you make valuable, but they take the profit off of it with no input from you at all? Yeah, that's not even something you should consider doing. Just as you shouldn't pay mafia "protection" fees. It's just asking for more trouble down the line.

But you and I just think differently about these things. No worries. I just firmly believe if you tried to do things your way, you would find in very short order that the world is not unicorns and rainbows. There are significant dangers to doing business with bad actors.
Besides leaking data by on demand CLR checking, you also have a difficult fail open v fail closed decision.

Failing closed means failure of a third party immediately breaks your site. Failing open means a MitM can simply block the CRL check.

OCSP stapling and the 'must staple' header are a lot better for privacy, and OCSP responses have some validity so at least a 5 hour outage of your CA doesn't bring your site down immediately.

It is still vulnerable to a DOS and trust on first use though.
lol, both pivotal sources that I'll swiftly consult when something in my browser goes haywire.

Seriously though, when I checked the Mozilla and Firefox twitters (and I don't use twitter, so even going that far was a stretch for me) just before I wrote the parent post, they hadn't gotten around to tweeting a notice about this there, either. The Mozilla Add-ons twitter account is not the highest-level place that should be talking about this situation.
This is a good point. The collapse of local social hierarchies makes status competitions much more alienating and intense. It must be weird to have no shot at meeting - let alone dating or befriending - the most popular girl in school. The increase in status legibility - the ability to compare yourself against others and reduced ability to take solace in self-deception and local status - might also have negative effects.
كلمات اغنية عكست وياي نصرت البدر
Exactly. If me/firefox has verified the signature (or approved the download) when downloading or updating the addon, that should be all that's necessary. Why does firefox have to check signatures constantly?
This makes no sense, we know that they increase the MCAS action range from 0.6° to 2.5° and they didn't inform FAA of the change.
So, they must have told tests pilots about the feature, otherwise why did they change the parameters ?
Monitoring CT lets you verify that somebody renewed the certificate, but it doesn't verify they actually installed the replacement correctly.

My employer (Kynd.io) currently monitors public web sites for customers so we can flag e.g. "Hey this site cert expires in a week! If it's dead probably just switch it off, otherwise renew the certificate" and we're in the process of integrating CT but mostly so we can say "You already have a newer cert but need to go install it" in our How To Fix instructions.
Duplicate of this bug
i think it’s a combined “fixed cost” rather than just computational power... like you could do it with x, thus it should cost at most y

similar to saying that you could do it with a raspberry pi
Sounds like someone should design a server farm architecture tool that will take in various parameters and report designs and what constraints are tight, that is, the solution is right at the constraint.
It should fail 'locked'. continue to allow installed addons to work, notify the user of issue, disable any updates without explicit request by the user.
There are two seats in the cockpit. I would have informed one of the test pilot crew, the one not flying. In an emergency that person can take over.
"We can hit about 50k queries per second on one serveR"

WOW! For my 1.0 case, I was thinking maybe 10 a second!
remotely disabled

Were they really remotely disabled? That would mean somebody out there pushed a button and made your add-ons go poof.

As I understand it, the browser checks the certificate of add-ons at some point (on startup? on an interval?) and only uses signed ones. And since signatures are date restricted, previously valid signatures can become invalid.

I'm not 100% sure if this really is the mechanism. Would be interesting to hear from someone in the know.
> Ehhhh, I'd say that it's not that skewed towards age of the vechile beyond common correlations

But the warranty period is a huge amount of value, and there are others, e.g. newer cars are safer and have whatever other improvements so older cars aren't worth as much regardless of milage. Then many repairs are age related rather than mileage related, e.g. a car exposed to the elements will rust or experience day/night thermal stress even if you don't drive it.

> Mine does: in 5000km increments. (Australia)

Let me rephrase this. The insurance cost does not scale linearly with miles driven.
My movement teacher Ido Portal shares these two main principles:

- Every day is a spine day.

- The best way to get rid of pain is to flush it away with tons of new information" (In other words, you have to move the part that hurts a lot)

Preventing back problems is thus straightforward: move your spine a lot, every day. Here are some suggestions, that I started working with and have had very good results with:

* Do minimum 10 minutes of spine waves every day to increase vertebrae mobility - https://www.youtube.com/watch?v=_tlMntE1WzQ

* Change positions when working. Learn to squat in a relaxed position, so you can for example type emails while squatting - http://placeofpersistence.com/30-30-squat-challenge-by-ido-p....

* Learn to hang passively. Apart from stronger shoulders, inter-vertebrae pressure get released. - http://placeofpersistence.com/30-day-hanging-challenge-by-id....

* Learn a proper handstand. This had tremendous advantages to my wrists, elbows, shoulders, spine, core. - http://gmb.io/handstand

Such combination of movements introduces plethora of new positions to your spine: rotations, extensions, static holds.

I liked the book "Move Your DNA" which explains why constant movement is so important and how inactivity affects our bodies.

EDIT: Typos & editing
Crypto Market Update: Crypto Market Rallies as Bitcoin Surges Past $5,800
Add-On Signing in Firefox
Relevant recent discussion about potential extensive internet regulation in Austria:

"Austrian government seeks to eliminate internet anonymity, with severe penalties"
https://news.ycombinator.com/item?id=19698003
There have been major organizational problems at Mozilla for a long time that precipitated this. Many of us saw something like this coming, saw gaps and unclear responsibilities, reported these gaps and confusions up the chain, and were reprimanded and financially penalized for asking the tough questions. The questions were never answered, and we all quit, were fired, or lost motivation as a result.

This is a tech problem, yes. Cert renewal has bitten everyone in a high profile way (apple, google, and ms have all had renewal-related outages in recent years). But this was preventable at Mozilla. Ask a Mozillian about IT and Cloud Sevices, and what their respective responsibilities are. Ask Mozilla’s VP of IT- who is responsible for cert renewal? Ask Mozilla leadership- why are people afraid to ask questions?
Manifold hooks into the Java compiler via the javac plugin API. This is similar to the way annotation processors work, but without the overhead of additional passes (or rounds) in the compiler. The plugin route also provides access to earlier stages of the compiler, for example this is how Manifold's string interpolation feature works. The overall details are a bit deep and dark for a comment, however ;)
According to this link[1], you are off by a factor of 10. It lists France at 1692K barrels per day. I wanted to double check the figures because I know how much it costs to operate a car and it's not 1.2% of household.

[1] - https://www.theglobaleconomy.com/France/oil_consumption/
This worked like a charm. Thanks very much!
And you'll find that the same "thing" will succeed/fail depending on the parent.

The way our child behaves/reacts with me is very different to how he is with his mother. For example when our child won't sleep at nap-time, or in the evening, I put him in a pram and take him for a walk around the block. It's a horrid solution, but it works about 90% of the time.

When my wife has tried this it has never. once. worked.

(He plays differently with the pair of us, and tries different behaviour. It is kinda fascinating to see the difference - part of that is our relative strictness, but part of it is him I think.)
If everyone's add-ons are disabled, I wonder why mine are not. My computer has been running over night (coincidentally, first time in years) and my add-ons are intact. Does it take a browser restart? Or might I have a setting that prevents this from happening? My system time is correct.

Edit: am on Firefox 66, Linux (Debian Buster/testing), using Firefox from Mozilla directly (not through repositories), and my internet/wifi should not have disconnected. System has been up since 2019-05-03T17:30:00Z, suspended before that.
Honestly then he is just an idiot and he will come back when he realizes he has to login to other services too.
Ok just checked this deeper. The [docs](http://manifold.systems/docs.html) actually show this is a javac plugin (I didn't know about the `-Xplugin` flag, but you ALSO need to pass that to javac for Manifold to work)... you also need the `tools.jar` file (which includes the JavaCompiler) on the runtime classpath... so suddenly, there's no magic... it's a bit misleading to say this does not require a build step, it clearly does, but as it integrates with javac itself, it "feels" seamless...
That depends on the transport costs.

In the UK you get into the centre of London from many places outside, on public transport, faster than you can cross London. And buy the much bigger property.
Reprimanded for raising the question? That's quite dysfunctional. Sounds like that's an ownership problem.
Realistically: reduce your own cert renewal window to weekly, if not daily. This forces you to have a good renewal system in place and alerts you to failures long before actual expiration.

Quixotically: make cert failure a randomised number, linearly related to how long ago the cert expired. This slowly introduces more and more failures, over a certain “grace period”, which makes the problem less of an extinction level event. It’s not a solution but it definitely would help.
This is technically true, but contextually lacking.

acme-go/lego doesn't use HTTP validation unless you disable just about every other form of validation first. TLS-ALPN validation is much more likely, so port 443.

That said, it is very easy to allow software to bind to privileged ports without providing it root access; this has been solved for a very, very long time.
Home HDDs Shipments of PC Hard Drives Predicted to Drop by Nearly 50% in 2019
You have time to work later, better start now
Chrysler/Cadillan has eye tracking - seems like exactly the thing you want. While it is in automatic driving mode, it tracks your eyes and if you are not looking at the road for an extended period of time, warnings are issued.
Because of this my Firefox crashed and I lost all my open tabs. Just fking great...
This does not work with Firefox 66.0.3 in Arch Linux ...
Questions from a Beginner Developer [Developer Story]
Caveats:

Certificates that aren't from the Web PKI almost invariably won't be logged. Most logs explicitly refuse everything except certs from the Web PKI so as not to be burdened storing garbage. So this won't find certs issued by the custom OpenSSL CA on that one guys Linux laptop.

Not all Web PKI certs are logged. There is no BR obligation and no root store programme rule that requires logging. The only things in place that strongly encourage logging are the Chrome and Safari policies. For systems that aren't designed to be accessed with a web browser or, much more rarely, enterprises that have persuaded themselves only IE is authorised anyway, the certs might deliberately not be logged. Yes there are (small) CAs doing this in the Web PKI, on purpose, in 2019.
in case it was revoked? Seems fairly reasonable approach
It was pilot error to try landing with a tailwind in torrential rain.
I’m sorry if my argument came across as a dichotomic; that was not my intention.

As other commenters wrote, the huge challenge that lays ahead of us is to take this progress to the African continent; the road ahead is just as hard as the one that has brought us here
A few years back, there was a user that used a script to find duplicate submissions and put them in a comment on every story. I can’t seem to find it now; I thought they had “giraffes” in their username? Anyway, it was mildly controversial, and they stopped.

I always kinda liked it, to be honest.
Are you on nightly build?
Here’s an archived version of the page: http://archive.is/GIhT3
How do you verify that nothing has been changed, if not by checking signatures?

Your call for everyone to be fired is very much in vogue but perhaps not at all useful. This isn’t a great thing to have happened, but the important outcome is, as always, knowledge and process that can prevent similar mistakes in the future.
I think it only checks at start up, or something? Mine has been running for days, and all my add-ons are working. As such, I've decided not to restart Firefox until news arrive that it's working again.
http://exploringorigins.org/

"This website is part of a multimedia exhibit at the Museum of Science that includes live presentations on the Current Science & Technology stage and a touch-screen kiosk."

(Museum of Science, Boston, 1 Science Park, Boston, MA 02114)

"Funding for this project was provided by the National Science Foundation."
Pretty sure Signal and Psiphon use it successfully. Yes it's throttled, but it's usable most of the time.

They probably got an ultimatum from Chinese authorities to either stop allowing this or get blocked entirely.

They just blocked wikipedia last week.. no one is too big to get shutdown in China
No, same version as the bug report is about: 66.
Can Firefox be called open source any longer?

Users can't inspect the code or contribute to the code, which is what addons used to do.
Tungsten C had a 400-MHz ARMv5 core and 64MB of RAM

Good luck emulating that realtime on your phone with good battery life (or at all). :)
Mines been running for days and everything was disabled.
If you're going to quit anyway, and not saying this is a good idea, what prevents you literally going and yelling at these idiots demanding answers as to why they are not doing their jobs?
That’s an important feature, just like reflow. But does the former make PDF World’s most important file format?
Oh, darn. Thought I found a way to avoid this. Thanks for reporting!

Just a thought, might it be that you suspend (sleep mode in Windows) your system? So not restart the browser, technically, but iirc applications still receive some event when this happens. At the very least, open connections would break. Any TLS connection would re-validate the certificate. In that case, going offline would also trigger it. Have you done any of those (suspend, be offline / switch networks)?
I'll explain why I interpreted it that way. The conversation is about the deportation of immigrants. What I said was said in that context. The reply to my comment was therefore either about immigration or irrelevant to the topic at hand. Grice's Maxim of Relevance tells us to interpret contributions to conversations as attempts at relevance, so I did.

(In reality, I realized that bringing Native Americans into a discussion about immigration and deportation was an attempt to confuse the issues. That annoyed me so I decided to reply as if the commenter wasn't deliberately missing the point).
> I just don't see the advantage to an out of JVM cache when your service is so fast that you only need more than one instance for failover

I don't think anyone would advocate that you move to a remote cache. If you can fit your entire app on a single machine, that's great. It's a huge reduction of complexity, and you'll likely be able to get very fast performance like you indicate. You definitely do not need or want a remote cache.

These tools are for those that have more data or traffic than a single machine can handle. Things get much more complicated when you move from one computer to two.
Repeatable random simlations that cannot for some reason just check the date and use the date (and some salt) for the RND seed? What simulations are we talking about here? Must be some obscure things?
I'm using the Chromium-based Edge at work, and it's going to be a great browser. It's the one that most people should switch to if they want to leave Firefox. I've been using Firefox since 2002 and never left, but native browsers like Safari/Edge are appealing for many reasons, including deep integration for the best battery use. I tend to recommend people use native browsers or Firefox but never anything else.
Show HN: Cypto Invoicing Tool
Hey Guys,

I am building an Invoicing tool, to help the freelancer to send and receive crypto payments and keep a record of them. Would love some early user feedbacks (WIP)

Check out- https://cryptofi.co

Why pay high transaction fee, let's makes fee negligible from the freelancer land scape.
I feel you. I saw this kind of thing coming back in 2010, when Firefox started copying Chrome blow for blow. I saw Google's influence on Mozilla and knew it could only turn out poorly. By the way, what can you say about that?
Did Amazon invent the rule the cert wildcards only match one level?
You basically just described any sufficiently large organization. Complaining is not helping anyone in these situations, the only thing you can do to change things is to go ahead and try to change things. Reporting things up the chain hardly ever works because the chain is too busy with their own issues and politics. You have to make it worth their while.
Follow the money :/
Pricing is set by markets based on competitors' offerings. Reduced costs could simply result in monopoly rents.
You seem unconvinced by my arguments. Following other comments which were more sophisticatedly argued I updated the argument here.

https://cryptostar.money/blog/will-scotland-choose-bitcoin-p...
That's the way it should be, obviously.
The successor, Umajirushi DC Chalk, is available here from JetPens (San Jose, USA), $1.80 for 6 sticks, or 30¢ per stick (also available in a 72 pack like shown in the video)

https://www.jetpens.com/Umajirushi-DC-Chalk/ct/3774

“The two well-established chalk makers Umajirushi and Hagoromo worked together to develop this chalk.”

Thinking a six-pack might make a nice no-reason gift, to friends’ kids or my local baker or church who uses a chalkboard, I just placed an order.
Yes. I mean bugs can happen but this wouldn't be so bad if they had
provided a simple way to allow unsigned add-ons in the first place. You
can't even create a simple personal add-on for yourself without
uploading it to mozilla first. That sucks. Please let me use my
computer how I want.
Disabling with no option of user override is not reasonable. It only creates unnecessary dependency on third parties.

When product recalls happen, the manufacturer isn't taking your product away by force.
Nit. Your driving costs shouldn't be affected if you pay off your loan early, the cost of the car should be averaged over the expected life of the car. If it were it should be downwards as you aren't paying interest.
The Stats of Affairs
Sure it does, not using C to start with.

Or in another form, C should have done the same as other systems languages, do proper bounds checking, arrays and strings without implicit decay into pointers.

Second, having a proper UI story like NeXTSTEP or NeWS, and not the X11 Frankenstein.
>the only thing you can do to change things is to go ahead and try to change things

how? Reporting up the chain is THE way to change things. When it doesn't work what are you supposed to do?
The complexity is exactly is issue. So while it’s possible to implement on the .net runtime without type erasure, it’s hard.

Plus the only reason type erasure is bad is if you want reflection. Which in FP languages with a solid type system isnt idiomatic and safe anyway.
Edit: value types are one other reason for not using erasure but Can be done other ways
I have disabled signature checks in Firefox because otherwise it is impossible to install a private extension without uploading the source code to Mozilla.

This is how you allow unsigned extensions in Firefox on Arch Linux, the same files can be edited on Windows and macOS, restart the browser after changes:

sudo tee /usr/lib/firefox/defaults/pref/config-prefs.js &>/dev/null <<EOF
pref("general.config.obscure_value", 0);
pref("general.config.filename", "config.js");
pref("general.config.sandbox_enabled", false);
EOF

sudo tee /usr/lib/firefox/config.js &>/dev/null <<EOF
// keep this comment
try {
Components.utils
.import('resource://gre/modules/addons/XPIDatabase.jsm', {})
.XPIDatabase['SIGNED_TYPES'].clear();
} catch (ex) {
Components.utils.reportError(ex.message);
}
EOF

This method also works for the stable version of Firefox.
See my earlier comment re javac plugin API, Manifold uses that as a means to hook into the compiler.

Probably the most interesting aspect of Manifold is its role as a type name resolver for the compiler. Manifold provides an API to dynamically resolve types corresponding with, well anything, but mostly with resources like JSON files, GraphQL schemas, SQL, DDL, CSV, scripting languages, you name it. So from the compiler's perspective it has no idea what is going on beyond normal type name resolution, but the source files it's loading up are coming from deep, dark places ;)

But yeah, no code generation step in your build, no agents, no custom class loaders, etc.
Same here. I've restarted Firefox several times and even manually checked for add-on updates and they are still working. Same on Android. However, I'm not able to install new Add-Ons (I get the "download failed" error). I'm in Germany, maybe that has something to do with it...?

EDIT: Android disabled Add-Ons when I switched from WiFi to mobile connection.
So many people have done this. Watch videos of past Mozilla All Hands meetings. You see the questions asked, you see the leaders dodge, and you see that soon after the askers are gone and leaders say- you have nothing to be afraid of, you don’t need to ask questions anonymously. “Executives” at 1000 person Mozilla are so distant from the workers, and middle managers listen to executives, not staff. It is so sad because Mozilla staff are smart, caring people who love the web, but they are powerless and afraid in the org today.
Don't exaggerate. It's a critical bug now and they are working on it.

Let them work on it