skysight-inc/HackerNews huggingface dataset:
The developer edition allows that just fine.
The Developer edition allows that just fine.
India got rid of 0.1, 0.25 and 0.5. Cash transactions are rounded to the rupee.
Just discovered the same message in the Tor browser, and it seems that NoScript got disabled. So people running Tor are a lot more vulnerable right now.

Also, wow, the web has a ton of ads. I've been running uBlock origin so long I forgot how bad it had gotten :(
Not just that. Clojure actually has a lot of features. It's not just "yet another Lisp on JVM". here's an excerpt from Joker page (Clojure linter written in Go):

Protocols, records, structmaps, chunked seqs, transients, tagged literals, unchecked arithmetics, primitive arrays, custom data readers, transducers, validators and watch functions for vars and atoms, hierarchies, sorted maps and sets.

Clojurescript was much easier to make because it was written in Clojure, not Java. IMO if we ever see Clojure that is hosted on other runtimes it will be written in Clojure and probably still will have to depend on JVM.
On Linux, Dashlane only has a browser extension. Luckily, Bitwarden has both desktop and browser versions on Linux.
Location:Portsmouth, OH

Remote:Yes

Willing to relocate:No

Technologies:Python, JavaScript, SQL, MongoDB, Linux admin, AWS

Résumé/CV:https://drive.google.com/open?id=1ZioXZVt691y2imtiIfMMl1D-nkoGHSvo

Email:joshoconnor7113@gmail.com

Howdy, my name is Josh.

I'm a full stack web dev currently serving as a team lead for a healthcare software company. I have written, maintained, and deployed multiple applications.

I enjoy working with others and have plenty of experience working remote.

I have plenty of time behind me coordinating directly with clients but also enjoy working behind the scenes on the nitty gritty technical details.

I spend my spare time learning other technologies such as React and Django.

I'm very thorough and self critical. I like where I am but am just looking for the next opportunity.
We have an agent that pulls certs from an internal service and stores them on disk where apps can use them. We no longer manually install certificates. This solves discovery, and gives us alerts on services that have stopped refreshing their certs for any reason. The internal service is wired into lets encrypt and a commercial certificate provider. Setup is minimal, and after that completely automated.
As noted, in practice, without additional info, there's no way to tell when a signature was created and so all signatures die when the signing cert expires.

That said, existing signatures that have already been verified, for existing extensions, should still be trusted.
Still beats using chrome.
All these things work statistically, preventing a certain part of incidents.

They are not a guarantee that an incident cannot happen, though. They can only lower the rate at which incidents (privacy violations, tax evasion, nuclear proliferation) occur.

Same with exfiltration.
Yes, and I'm very upset, as well
A country shouldn’t be able to profit from the web while blocking other countries from exchanging ideas and wealth with its citizens. We should disconnect China.
if the point of MCAS was the make the new 737 behave like the old 737, why would it be necessary to make the test pilots aware of the details of it?
Developer edition is effectively aurora/alpha. It is buggy compared to release. And yes, I do mean that. If it were not it'd be 'release'.

Asking people to either give up control of their software (ie, walled garden release versions) or use buggy and insecure software Dev/Nightly/etc is not acceptable.

It's why I switched to a freedom respecting Firefox fork as soon as they announced walled garden extension signing in Firefox 37.
Yes, happened to me, too.
I just downloaded the dev version so that I could disable "xpinstall.signatures.required"(At first, I downloaded Chrome to use instead, but after using it for a little while, I decided that I really do prefer Firefox.) I believe you can also disable the signatures thing in Nightly and ESR. It's a slight annoyance, but I guess that's one of the things about FireFox being openly sourced.

I understand about the 'safety issue', but I think people are more mad about their extensions disappearing than they were about the 'safety' of the extensions themselves.

In my opinion, a better way to implement the signature extensions would have been to give users a pop-up or something that said:

"The following extensions do not have a signature from Mozilla. [List user's extensions that don't have a signature.] This means that they may be more unstable or they may not be safe (or as safe) as using an extension that has a verified signature. Would you like to continue using these extensions? {Yes} {No}
Mozilla is not responsible for any breached data as a result for using unverified extensions, blah, blah, blah, disclaimer stuffs."

That way Mozilla wouldn't have to be concerned that they would get in trouble for whatever it is that they are worried about, and people could still have their extensions.
Looks nice. Would you consider adding an option to clear cookies when opening a webview? That way paywalls cannot count my views.
We have similar for jury pool service (I have one in my mail pile for about 10 weeks of notice), but is your case assigned and known to you and the parties to the case? I only know the date and court (we also call the evening before to see if we even need to show up and even if we do have to show up, there's no guarantee that you'll get a case as they have to have a slight surplus rather than slight deficit of potential jurors). I doubt any of the parties know my name before the jury is invited to the challenge phase.

Said differently, if I was a defendant, could I find out the exact jurors 2-4 months ahead of time so that I could arrange to bribe them?
A lot of this seems to be suggestive of the womb: shushing (like a heart beat or breathing), fixing the temperature and light, swaddling, rocking...
Yes, I also have the "One or more installed add-ons cannot be verified and have been disabled" Someone at Mozilla has lost there marbles.
Tried changing xpinstall.signatures.required to FALSE. Nope, didn't help
Security tends towards the lowest common denominator. I'd rather you just figured out how to run a cron job.

The problem comes if your keys ever get compromised or cracked all your historical traffic becomes vulnerable instead of just the most recent window.
Using the graph to connect “variables” is clever. Lisp is to lists as TCL is to strings as this is to a graph.
>Has anyone developed a tool designed specifically to avoid certificate expiry disasters?

Is anything more than a calendar reminder on the phone of someone important enough to shake the Earth and get it fixed For. Certain. needed? Like, say, the CEO, CTO, and CFO should at a minimum get a notification so they can ask if the refresh was done when necessary?
Just to clarify, because I assume there is a misunderstanding here: HVAC stands for heating, ventilation, and air conditioning. I assume pretty much everyone in Paris has heat, since it gets below 5C in the winter.
Works on android too.
There are plenty of places on the internet more lenient than the biggest websites. Check out voat and see what happens when people banned from other platforms go to the same place. It isn't pretty but at least they aren't a blight on other groups.
Looks like it. I had the same yellow "One or more installed add-ons cannot be verified and have been disabled" banner in the Tor browser as in Firefox, the NoScript extension icon is missing, and I went to two different "do I have Javascript enabled" sites and they both said JS is enabled.
That's cool and all, but what percentage of users do you think even know certs expire? I'd put the over/under at 1%.
Yep +1 here ... tried downgrading to prev version but no joy. :(
> What do you think the odds are that you're in the half that knows what it's doing?

Well then it doesn't matter what I do, so I am not sure why you'd be so angry about it.

> hen I say your behavior in this situation would be sociopathic

It is not sociopathic to retaliate against people who want to force you into temporary slavery. It is instead called justice.

> would turn into madmen

There isn't nothing "mad" about fighting crazies like you who want to force people into slavery.

Instead, the madmen are the ones trying to take away our rights.

Honestly, my actions are fairly tame. I didn't even say that I would engage in violence or anything. I expect that other people might, and I wouldn't blame them.

Violence is a perfectly logical response attempts to force people into slavery. I wouldn't do it, though (because of the other alternatives at my disposal).
Why do you have certificates in your code to begin with?
I don’t like the wording of 4. Don’t swing the baby. Rock the baby gently. The movement is often a distraction and soothing them. Swinging almost sounds like you’re shaking them. (I know we are referring to the same thing just don’t like the word swing)

When my Daughter was born I was the one who dealt with her at night time for 4 weeks after our confinement nanny left. To get her to sleep I would swaddle her, hold her on her side in my arms and rock her gently while saying “shushhhhhhhhh in her ear till she calmed down” she would fall asleep in about 2 minutes. Then I would place her in the cot slowly and pat her bum for 5 minutes. Then she would sleep for 3-4 hours till next feed.

I had never heard of the 5 S’s but the similar things I did they do work.
If only there were a way to revoke certificates. Like, some kind of list.
The biggest disadvantage of Elixir today - it doesn't have its own thing comparable with Clojurescript. Clojurescript is not just extremely nice compiler that gives you syntactic sugar, you can totally share code between JVM and JS and that's incredibly awesome.
Ah, checking `app.update.lastUpdateTime.xpi-signature-verification` shows that it hasn't checked since "yesterday"

:/

jtl@laptop-linux:~$ TZ=UTC date --date="@1556919381"
Fri May 3 21:36:21 UTC 2019
The issue here is that this wasn't done in a vacuum. Other software vendors were secretly and deceptively installing extensions that were tracking everything users were doing online.
It happened hours ago. Why in the blue blazes of hell isn't this fixed yet?
What is happennig!?? All my addons are disabled too!!
Yep +1 ... hope it's fixed soon or I'll have to revert to Chrome :(
I don't see how the absence of type erasure could possibly be a restriction. Cast everything to object if you must.

I've literally never run into a situation where I wished type erasure was there but didn't have it, but I've ran into situations where type erasure caused problems in Java and where the absence of type erasure let me do things the way I wanted in C#. typeof(T), new T[], new T(), default(T), etc.
>What can be done to prevent developers from adding a certificate dependency

Discipline? Experience? PIP?
> I’ll still keep using Firefox since I recognize the importance of browser diversity

Also, Chrome is not immune to "crashes for everyone at the same time" bugs. Like that time when the start of daylight saving time made it crash for a full day (a quick search tells me it probably was https://bugs.chromium.org/p/chromium/issues/detail?id=287821).
Presumably Amazon has PoPs for CloudFront; why couldn't S3 share the same infrastructure?
> I'm surprised to hear they're getting rid of JavaScript (and I couldn't find any references to that, but I wish it to be true)

I won't believe it until I see hard evidence. Acrobat and Reader have supported JavaScript for something like two decades. (I wrote a bunch of JavaScript multimedia APIs when I worked there around 2002.)

Consider the large number of interactive PDFs on the IRS website that use JavaScript for form calculations. I don't think Adobe is highly motivated to break all of those.
Donald Hall wrote beautifully about this: https://www.newyorker.com/culture/culture-desk/double-solitu...
Users will drop a product for the slightest reason. For instance, one of our users recently left a negative review. Paraphrasing, "Logging in is difficult".

We check our warning system (set up to detect suspicious logins, incidentally also catches any users who've been locked out because they forgot their password), and his last login attempt took a total of two tries.
One thing that bothered me while trying to learn the TLA+ is the two different but equivalent forms or syntax for writing it: a mathematical formula/expression form and code/program form. This topic is difficult as it, and having to deal with not one but two equivalent forms of saying one thing is perhaps a bit hard on a learner. I wish if there was a tutorial of TLA+ that ditched the whole mathematical formula notation, and taught only the code form.
There are plenty of examples of more local politics leading to worse outcomes. For example: balkanized cities zoning for too many offices and not enough housing, and jurisdictions racing to the bottom of tax policy to entice business.
Copying a potential workaround here from my lobste.rs comment, not really tested obviously

If it hasn’t broken yet for you, I think (but I’m not very much not sure) setting that preference to 1556940100 should keep it working until 24 hours from now. And if you keep updating that value every 23 hours to the output of date '+%s' until it is fixed via a firefox update it should keep working forever.

I think you need to restart the browser as well after updating the preference for the above idea to work.
In short, yes, they should have implemented timestamping for their code signatures like most other code signing systems do.

Without timestamping the expired cert always would have caused problems, even if it was replaced early and correctly: Every add-on would still need to be signed again with the new replacement certificate and shipped to all users. It's not as easy as just replacing the certificate on some server.

Well, this is still what has to happen: replace the certificate, ship that new certificate[1], re-sign every add-on, ship every add-on to every user.

Now, in order to ship new versions of the add-ons, you probably will have to bump the add-on version numbers as well. Which can have further unintended consequences.

[1] Incorrect, see blow; it is my understanding that the certificate in question is baked into the browser itself, with no way to push updates just for the certificate remotely other than shipping an entire new Firefox build. Well 6 new builds: esr, stable, dev, beta, nightly, unbranded. Gonna be a fun night for a lot of mozilla folks... Well, a night is not gonna be enough...

I might be wrong tho, and misunderstood something.

EDIT I was wrong (https://news.ycombinator.com/item?id=19824520), the expired cert is not baked into the browser, just into the add-on package files. No need for new Firefox binaries, after all. Still, they have to resign all add-ons and ship new versions.
s3 isn't just used for static hosting. And if you have terabytes of data in a bucket that happens to have a dot in it (that may have been created a long time ago). Your options appear to be not using https, or spending a _lot_ of time and money moving to a new bucket or a different storage system. It seems to me that if Amazon is going to do this, they should at least provide a way to rename buckets without having to copy all of the objects.
I think the idea is a well insulated building needs less heating / cooling.
Haha. My Daughter when born. She didn’t cry to tell us she’s hungry. She cried to tell the entire neighbour she’s hungry. The people who live above us thought our daughter was sick because her crying when hungry was so bad. But the moment the bottle touched her lips instant happy.

I always new what she needed cos she had cues.

- screaming at top of lungs = hungry

- kicking feet violently = nappy change

- waving arms about = tired
When pressed, they admitted it was just "gut feeling". The team audited a couple ACME clients and couldn't find anything to justify not automating.
> Why should the majority bend to the will of a minority

I'd prefer to read GP's post as a "live and let live", rather than pursuit of domination.

That said, there's always the risk of "dominating minority is bad" if my in-group is the minority, and "upholding majority preferences is good" if my in-group the majority. :-)
The statement can be simplified down to "don't run programs downloaded from random websites which ask for your admin password."

Adjust the qualifier at the end depending on your platform. On Windows, it might be apps that present a UAC dialogue—or maybe just remove the qualifier, since Windows doesn't do much sandboxing by default.
I'd be happy with just squeezing out the fare. It's an option, you know.
Facebook’s Unintended Consequence
There are tricks to pull chunks of memory into cache as is, no? Not that they are ideal.
Some shared hosting like Bluehost now provide LetsEncrypt by default for all their sites with auto-renewal (But I don't recommend Bluehost shared plans for anything even closer to serious hobby due to absurd downtimes like most other shared hosting).

I used manual renewal for LetsEncrypt for about 4 websites on other shared hosts & renewing them every 3 months was a pain; had to keep reminders and schedules just not to miss renewals until I synchronised their renewal schedules to batch (manual) renewing them.

I had automated renewal for 1 website on a cloud server, it was a one time effort, I never had to bother about SSL cert for that site and the most favourable of them all.
Charlie Munger, Unplugged
Mystery Git ransomware appears to blank commits, demands Bitcoin to rescue code
Doesn't work for me. Using Arch Linux. I was already on Nightly when this happened.
The two most provocative paragraphs for me were the last two:

> And yet, I don’t see that much praise for Nordic infrastructure. There are people in the English-speaking world making grandiose claims about how democratic countries need to be more like China and about how authoritarianism is just more efficient. I don’t know of any making that claim about how Nordic social democracy is more efficient, with its depoliticized state apparatus, multiparty elections, high levels of transparency, bureaucratic legalism, and near-universal collective bargaining.

> Across all levels of public transportation investment, from high-speed rail down to routine track upgrades, we see inexpensive, efficient projects in the Nordic countries. They achieve high levels of rail usage without megacities in which only masochists drive, and keep expanding their networks in order to complete the green transition. Public transit managers in not just the laggard that is the US but also Germany and other relatively solid countries should make sure to study how things work in Scandinavia and how they can import Nordic success.
Yeah "just" a cron job except the implementation changes several times a year. Somehow this automated process was more time-consuming than the previous, manual one.
If only such a list were actually effective rather than the majority of clients not bothering to check it.
I love little profitable businesses like this. Seems like you’re living the dream
Once I remember a coloring app developer, calling for artists to be featured in their app.

Requirement: Portfolio and Instagram profile with a considerable amount of followers.
I mean, it's perfectly understandable. Who will want to feature unknown artist in their app — but you know what, screw it.
If the malicious software can adjust protected user settings, can't it also just inject into the Firefox process directly?

If there's a privilege level that allows for one but not the other, that sounds like something Mozilla should fix.
Makes me think of this ticket no work around for the error other than closing the browser and editing a file or modifying the browser and recompiling. No options at all in the advance settings.

https://bugzilla.mozilla.org/show_bug.cgi?id=1528738

It's stuff like this that makes me unhappy with mozzilla. User's who know what they are doing should be permitted to do so. Warn them here be dragons or whatever, but it's ultimately their choice.
Would going to a previous version of Firefox solve the problem? I'm at 66.0.3, so maybe going back to 66.0.2?
This works.
On a desktop, you can reload installed addons from the firefox profile folder >> extensions.
Nice work! Please consider adding a dark mode.
Yes, all of mine are gone too. And they won't let you install anything to the add-ons. I saw something about buying a subscription for a login id. They want to start charging for add ons.
This makes more sense than it seems to.

MongoDB's insight was that the overwhelming majority of data stores don't matter enough to justify worry about correctness. It doesn't go faster than other DBs if you turn on the "do it right" flags, but their customers mostly don't.

Would you be willing to wait an extra five seconds for page load to be sure the banner at the bottom of "people who looked at this also looked at these" list is fully up to date and correct? Or is filling the boxes with any old crap good enough?
Same thing happened to me
What's wrong with VB.NET? As far as I can tell, it's as good as anything else to get to the .NET Framework. I like it because it has more traditional syntax I believe is easier to teach, learn, read, write, and debug than C#.

With VB.Net, what am I giving up?

I'm asking about "sufficiency": It all seems dirt simple to me, where some simple code really is sufficient. So, where is the simple approach not powerful enough? Where is Redis needed and something simple not good enough? Where does my simple solution fall short? It appears that Redis is now really important: What does it have that is so important?

Is object instance serialization really slower than, all things considered, it has to be? Or if we accept (1) we are going to have instances of VB.Net style classes and (2) send the data via TCP/IP, that is, basically via byte arrays, then where can we do better than just serializing the class instances to byte arrays? If we work with just XML text, then we don't really have the advantages of performance of VB.Net instances of classes, and we're back to interpretive data structures instead of compiled data structures. I can think of some just blindingly fast approaches in PL/I because the PL/I data structures (1) are nearly as useful as class instances and (2) occupy essentially sequential storage -- so, could just copy storage from a starting address to an ending address and send the result as the byte array -- reverse that process at the receiver. Could do much the same with C structures, much less general than PL/I structures, if avoided most uses of pointers.

This is my first Web site, first use of collection classes, first use of a session state store -- I'm trying to learn what I'm missing out on.
So why not just disable extension updates instead of disabling the extensions themselves?
I believe https://github.com/danluu/post-mortems is close to what you want.
Same here. Opened Firefox after finally getting back online after some rogue Spectrum tech showed up and no-notice, no-knock, no-call shut us off because he claimed there was some unspecified issue with our modem. ALL of my extensions, notably security add-ons I choose to use for obvious reasons, are gone. You think you can go to the web and not be hassled, especially by something like your choice of browsers. What a joke. Once I can recover how I had my firefox set up I'm seeking an alternative.
I've seen a (then) current version of Glassfish (java EE server) refuse to start because of an expired internal certificate a couple of years ago.

So here is one example: https://stackoverflow.com/questions/18248020/certificate-has...
> In some cases cross-region replication may help too.

How so? cross-region replication doesn't replicate existing objects, only new ones.
Maybe I am misunderstanding the term objectivity or bias, or the intent of your comment. If it is a bias, then isn't it a good bias?
That's really bad because it means it also effects Firefox ESR which is what lots of large enterprise users have installed.