skysight-inc/HackerNews huggingface dataset:
Are compromised CAs worse than other software bugs though?

Yes, we have too many CAs, and some of them are pretty suspicious. It would be great to be able to give them TLD limits. But becoming a CA is still very slow and expensive, and certificate transparency will catch bad behavior. So there is a very strong incentive for each CA to be good.

Compare this to random server exploit, which is deployed anonymously and has no direct monetary harm to the maker company.

No wonder there has been very few cases of CA-based compromise compared to good old software exploits.
Politicians are looking for a soundbite and to humiliate him.
Internet shopping is a reaction to a lack of free time by an overworked population. Not this cause of all evil capitalism the retailers would like us to believe.
Even if Huawei stops using FedEx and switches to 'HenryBemisEx', there is nothing that a gag order can't fix. If this is a US 3-letter-word act/intervention, it will happen with the next company down the line. The only way to prevent this is the good old way. Send 3 trusted people with 3 sets of documents from A-to-B and make sure that nobody opens those darned folders. I am simplifying this, but hey, you send something using publicly available methods, you get publicly available privacy violations (unfortunately).

I enjoyed the "FedEx doesn't comment..." policy.
Couple tidbits.

> telling people not to use Android

I personally use Android as I dislike the Apple-itunes-lock-in. But, you'll be able to sleep better at night if you lose your iPhone with confidential info.

...

> Google's Advanced Protection Program is almost comically unusable for campaigns. The expensive dongles break easily, and when the dongle breaks you are locked out of your fundraising spreadsheets until you can reach Google support (if such a thing exists).

Ouch.
TBH, IMO--it seems like tech isn't for you. You seemingly have a good position that you earned--But you hate it. You have to be honest with yourself. It's impossible to know what a profession is until you actually do it.

I say this too because you're only spending 10 hours a week on your side project. If you really enjoyed it, you'd blow off spending time with you GF to do your thing... I know I did.

I'm not saying you should be a plumber or an electrician; You can be an entrepreneur, but it doesn't necessarily have to be in the tech field--at least not solely, rather use what you know to compliment your new venture.

I think you should talk to HR and see if you can get a 3 month leave of absence (even if you have to BS them for a reason), and take a step back to decide how you want to spend the next 35 years of your life.

Good luck.
What single thing in this article is solved by that?

(Note I’m extremely sympathetic to publicly financed campaigns)
Yes. I've seen it in all kinds of teams. Anything that allows a developer to retrieve some data after a local server restart essentially gets treated by devs as a system of record, regardless of the intricacies or guarantees involved.

My personal experience is that abuse of queuing/messaging systems along this axis is rampant. Engineering leaders must keep a close eye on how these types of mechanisms are utilized to ensure things don't go off the rails.

I've seen far too many serious data loss events that boil down to "we lost our AMQP queue". It's critical that developers understand the limitations of the systems that run their code rather than just jumping aboard that "SQL is for old people" hype train.
Vietnam swine fever cull surges, 1.7M pigs dead
Almost all types of cheese are not orange, but almost all cheese is orange. The orange varieties are very popular.

Here in the USA, "orange cheese" usually refers to Cheddar, which is almost always orange. It has nothing to do with any place named Cheddar; the cheese would be overripe if shipped that far. You could just about say that this is our standard cheese.

Other orange cheeses include Colby and American. https://en.wikipedia.org/wiki/Colby_cheese

The color comes from Annatto. It's a spice. https://en.wikipedia.org/wiki/Annatto
PiDP-11 Retro Computer Build [video]
The problem with scare media like that is that it does nothing to put the risk in context. What is the actual danger from eating fish with high levels of PCBs? The EPA guidance is based on a 1 in 100,000 increase in cancer risk over 70 years, based on extrapolating from animal testing to humans. There is no real scientific evidence that eating fish with elevated PCBs actually results in a measurable increase in cancer risk: https://seafood.oregonstate.edu/sites/agscid7/files/snic/pcb....

To put that into perspective, moving from New York to Chicago will increase your risk of being murdered in a single year by 15 in 100,000, and your 70-year risk of being murdered by 1 in 100. Smoking and then quitting raises your lifetime risk of lung cancer by 3-5 in 100.
I trust that the first time those would try to do something bad, CT will catch them, and in a few weeks, they will no longer be trusted.

Entering this list costs hundreds thousands of dollars, an attack using a different channel is going to be more economical.
Alsup for SCOTUS
Asus' new dual-screen laptop is bonkers
With technically savvy users, I think it's safe to say that you can get a flagship Android phone asymptotically as secure as an iPhone. But most users aren't savvy, and need clear guidance, and if you say "Android phone" to them, you're effectively clearing them to use the worst smartphones on the market. Like, "I found this thing on the street and stuck my SIM card into it" bad.
Yep. Let's just cut out the middlemen already.
Vanguard just launched VEIGX https://investor.vanguard.com/mutual-funds/profile/overview/... as their environmental, social, and governance index fund.
I don't want to have to return things! What a waste of packaging and shipping and effort. Now fraud detection and product QA are added to the gig economy, and we're paying for the privilege.
GRC (regulatory compliance folks)
OMG I first used Spry via CompuServe too!
I think Walmart’s online store works the same way amazon does. It’s full of third party crap too.
Just like how China doesn’t pay the tariff, it’s US importers who do, in this case Facebook doesn’t pay the tariff, it’s Canadian advertisers that would, on top of whatever Facebook is asking for. It would only hurt Facebook if you applied a fine or tax directly to their Canadian profits or prevented them from doing business in Canada, and even then... with other countries, the sway is, “you’re a citizen of our country, you have to follow the law, it’s easier that way” but if you’re not actually a citizen, have legal defense and possible substitutions in place, and ultimately, the only penalty is likely a slap on the wrist and a request you somehow further can’t ignore, well... it comes back to other countries on their own don’t have sway if the US or host nation doesn’t make the same request and you don’t have immediate travel plans to that country (and, of course, the country follows rule of law and/or you’re protected by your host country’s legal system...) That said, anyone in the country making such a request that works for an affected company would have to follow the laws of that host country over company dictates, or face legal consequences...
4chan’s new troll campaign aims to make the hashtag a white supremacist symbol
Besides the point about already trying out Java Applets, Why would you dismiss the Oracle avoidance? Oracle recently moved with Java to show a strong preference to monetising it, whereas lots of people on the web cannot afford any licencing just to be able to make stuff to run on the client machine. It is actually a very strong feature of it.
I don't live in the USA. Very little cheese here is orange. I've never seen orange cheddar - I think that's a "USA Cheddar" thing.

Edit: I also know what Annatto is. I'm merely pointing out that claiming that "almost all cheese is orange" is very USA centric. (probably also limited to only some regions of the USA too, presumably ones you know about - while not living there I do consume a lot of American TV, and I don't notice all cheese being orange.)
What causes this difference?
I hope it sprays transparent paper.
They are orthogonal?
Is Canada allowed to do that? The United States wouldn't be: it's a bill of attainder.

The government donating to specific non-profits is sketchy as hell, too. Both of your solutions sounds like considerably more serious problems than Zuckerberg refusing to appear.
> Is this a bad news?

Certainly not at half. It is an open question how high it can go before there are destabilizing effects, but it's very likely way above the 90% level.
Sure, but you can say the same for most other countries outside the G7 as well. After Canada it would be India summoning him, then Brazil, then Israel, Turkey, Japan, Mexico and countless others. Where do you draw the line? Should flying around the world answering to politicians be his full-time job, or should he be able to actually run his company and let local executives handle such problems?
What’s your opinion on the password management that chrome offers these days?
Lol hacker news is cancer.
As a stubborn new Yorker who occasionally considers moving before thinking better of it I approve
I'm disappointed, I was looking forward to seeing a new fractal. The onion curve in 2d is just a spiral, as mentioned, but the word "spiral" doesn't appear at all. I think this paper is mostly without merit, unfortunately.

Egregiously, the table comparing the (reasonably defined, I think) clustering metric of the spiral with the Hilbert curve is only for rectangular queries which ask for almost the entire space, with the query side length differing from the overall space's side length by a constant.

An obvious advantage of the fractal nature of the Hilbert curve is that its clustering properties will be scale invariant, but the spiral will quickly degrade to a "space filling curve" that just goes row by row for small queries. Perhaps later the paper gives some reason to hope for the onion curve, but I'm disinclined to look.
Real powerful way of making money online with g2
If you value your freedom this strongly, then it's time to make bold choices regarding the rate at which you save money.

Since there is such a huge gap between people who hold a lot of material status and the rest, why even play the game at all?
Brazzers / MomPov/ Wicked / RealityKings+30 Sites Premium Accounts
It’s guidance for diagnosis. Doctors can already diagnose whatever they want. This is just a step toward agreement on what “burnout” means.
It doesn't have to be a pure science interest.

If you want to use the results from one test to inform what to test next, then A/B tests are better optimizing for truth.

Most website changes dont make a significant difference in conversion. If you use MAB, then you dont know if the winner is really better or the result of random variation.
Utilizing cross-window copy/paste, cross-window repeat, opening a new file (window) with a single command vs new tmux pane then initializing vim. Those are just a few of the many reasons. IMO, using a new tmux pane for each vim instance would be a HUGE anti-pattern. Most people with the tmux/vim setup will use a single tmux pane for vim, then N number of other tmux panes for other required needs (compiling, tests, etc...).
> certificate transparency logs appear to be completely ineffective in catching CA-related name hijack events in real time.

In what sense is this true? They're effective because browsers only accept certs which can first prove that they were submitted to a CT log, and it's easy to search the CT logs for e.g. gmail.com to find potential misissuance events.

This is the first time I've heard CT described as ineffective. What gives?
With the current internal political tensions in Europe, and things also looking uncertain in much of the rest of the world, it might not be the best time to deplete your savings.

Personally, I'd try to continue building savings while waiting either until the world gets through the current tensions relatively unscathed, of until the recovery starts if they lead to a serious economic downturn.
Many electronic items under $10 can only be returned at an staffed Amazon pickup location. In urban areas (e.g. Bay Area), that's a BART ride or a toll charge.

The round-trip BART ride will be $6 or more. The toll charge maybe $5.00 or whatever FastPass costs (not factoring in gas, maintenance, parking).

Such items are essentially un-returnable, unless you want to pay more to return it than simply dispose of it.

I make it a point to return such items. Having done so a handful of times, I now buy most of my electronics gear from brick-and-mortar shops.
'Color Added Freshness' was the most surreal term I ever saw posted on a piece salmon in the supermarket. Not sure I've bought any since.
I've been thinking about the apparent drop in burglary too; seems like there's not too much worth stealing nowadays, aside from jewelry, firearms, and perhaps carpets, art, and sculpture at the very high end. More homes have security systems, and there appears to be virtually no market for fine china, a 55" television is very bulky and fragile relative to its market value, any laptops or other computers are likely to be depreciated to nil. Folks don't keep coin collections, nor cash on hand.
More broadly I would think that the negative attitude towards Orientalism is a little xenocentric, because it suggests somehow only Orientalists were a problem of that type during that era. I'd argue it was probably a common 'ism' in the world given one cultures view of another, and frankly demure compared to most past activity. At least Napoleon brought 'scientists' who'd be keenly trying to study something. That's already miles beyond what most entities would do.

Side note: Napoleon is weirdly unreferenced entity in North America, I think due to the fact he was French and not part of the Anglosphere directly. So much fodder for pop culture there, It'd be great to see a decent film about his foray into Egypt, or rather, a film in which that was the setting. Or even a cheesy netflix 'game of thrones' type thing that went through the revolution, his rise and demise. So many actual crazy stories there, they don't even need to wait for the author to write it ...
Yeah like when Zuckerberg told senator Leahy, he'd get back to him about the issue he was being asked about. It'd be the perfect chance to finally answer that question.
The irony is, of course, that the chain is named "Seven-Eleven" because it was originally open from 7 am to 11 pm.

> One Monday night in late March, only 10 customers came to the man’s store in the three hours before dawn, and the sales during that time were a little more than ¥6,000. The store will be in the red if he hired someone for night shifts.

Smart management would close the store during those hours. Of course, the franchise doesn't care for smart management - when the operator eats the loss.
I didn't say they were exclusive, at all. I said that I don't like monitoring software for two reasons. I then explained my opinion on the question the parent poster asked - which is that education and fostering an open/trusting relationship is, in my opinion, the best method. Not the only, or exclusive method.

I appreciate the backhand compliment regarding any insight I provided, though.
I've heard of a couple, and used them successfully:

1) Learn something.

2) Get a small win after a big loss.

The ideal project to do when you're feeling burnt out is something that is well inside your comfort zone and can be completed in a couple days, but also teaches you something new. Something like learning a new framework, or building a quick new "toy" that isn't really critical to the business but users would find interesting, or doing a refactoring that you totally know how to do but have been putting off for months because other stuff is more important.

I've also had managers put me on projects like this after slaving away for months on a project that gets canceled. In hindsight they knew exactly what they were doing, and the fact that it was kinda fun and not critical to the business was actually a long-term investment.
The Seafood Watch app from Monterey Bay Aquarium is a good resource when trying to purchase fish that is sustainable and safe to eat.

https://www.seafoodwatch.org
Why would you bother to conduct and disseminate such flawed research? What sort of scientist would state publicly that their research shows married people are 'fucking miserable'? That there can't possibly be any more nuance beyond that?
It was a frame of mind thing for me, and changing my frame of mind helped.

I used to have the problem that too many conversations were boring to me, so I wouldn't engage. However, I found two key thoughts driving this feeling.

First, some of it came out of my own ego, like thinking I was above trivial things. The truth is I'm not, I'm just interested in different trivial things. And that's okay, but I did need to get over myself and learn to withhold judgement and appreciate the expertise that other people develop in their interests. There are still genuinely uninteresting people, but they are rare if you do a good job of prospecting for the things people focus their attention on.

Second, for me, the disinterest was sort of a social pecking order thing. However, it was mostly in my own head. In practice the leaders I respected were the ones who took care to treat me as an intellectual equal, even if they were formally higher on the hierarchy. A rare few people I know require token shows of power before they take you seriously, but most people just want you to relate to them.

I had a third realization that was more functional. I am an engineer because I've always thought like one (may not apply to anyone else). I've grown up looking at social conversations a bit like an anthropologist observing a human social ritual. It seemed like a wasteful artifact, and doing it just didn't feel natural for me. However, the reality of it is that it's central to how humans function. I can't opt out, but I can try to deconstruct it into a set of rules, guidelines, and practices that I can internalize just like any other skill, so that's what I did.

One key rule is that in any conversation (it's not my own phrase but I forget where it comes from) the other person first remembers how you made them feel, and second remembers if you said anything interesting. In cases where it's entirely a social transaction for me, rule #1 is to make them feel good. That might seem manipulative, but people who are naturally socially fluent do this intuitively, so I don't feel any guilt over intentionally doing it.

It's very much a "fake it until you make it" scenario, because our brains in many cases really do work that way. When you pick up a skill, your brain rewires itself in a way that over time the skill requires less conscious thought. Learning to carry conversations followed the same progression for me.
It would have been nice for this article to have been backed up with some data.

I feel like it's much more complicated than the title suggests.
This is not some small business making minim salaries for the owners. Not your typical corner store who's owners cannot afford the tickets. How fun it would be if all 10 countries block Facebook for a couple of years, now THAT would be fun!! That would teach these thugs a lesson or two about 'corporate responsibility'.
XXX Free Password
Every Vehicle Should Have an Electric Motor, Even If It Doesn’t Have a Plug
> That's not an "existential threat". No European state bothered to care about that piracy until Sweden and the US in https://en.m.wikipedia.org/wiki/Barbary_Wars . The bigger states were evidently happy to pay the tribute—this is cost cutting not defense.

That strikes me as a West European-centric view, "the big West European nations weren't threatened and nobody else matters".
From https://en.m.wikipedia.org/wiki/Slavery_in_the_Ottoman_Empir...

> Sixteenth- and 17th-century customs statistics suggest that Istanbul's additional slave import from the Black Sea may have totaled around 2.5 million from 1453 to 1700.[4]

Also

> In the devşirme, which connotes "draft", "blood tax" or "child collection", young Christian boys from the Balkans and Anatolia were taken from their homes and families, converted to Islam, and enlisted ...
I find it hard to square the paranoia about CAs with the imposed death penalty on Symantec's certificate business. If no one is watching the CA's, how did Symantec get caught and punished? And for what seemed like relatively minor infractions?

I think its possible that the average web developer underestimates the degree to which the web PKI is monitored by private and government organizations. And public cert logging only makes that easier.
Entire countries like France do not use qwerty, and in Japan the taxi light is not an exception, rather it is fairly common. The traffic light IS the exception here, and it is definitedly not accepted that red=bad and green=good here! If anything, I'd say that red here represents the primary action.
One that we encountered in several services were gRPC ruby clients that semi-regularly blocked on responses for an indeterminate amount of time. We added lots of tracing data on the client and server to instrument where “slowness” was occurring. We would see every trace span look just like you would hope until the message went into the runtime and failed to get passed up to the caller for some random long period of time. Debugging what was happening between the network response (fast) and the actual parsed response being handed to the caller (slow) was quite frustrating, as it requires trying to dig into C bindings/runtime from the ruby client.
IMO, it depends whether the law is just and reasonable. I do not think any just or reasonable purpose is served better by having Zuckerberg or Sandberg attend this meeting, as opposed to their lieutenants. No questions will be asked that the lieutenants would not be equally or better equipped to answer. If such questions need to be asked, a letter and response would be fine.

If the purpose of the meeting were more than a show trial, I might feel different. But, that is universally not the case. FWIW I would not be offended if Zuckerberg declined invitations from the US congress either, although it's difficult for him to do so considering they could actually arrest him.
Just came back from Japan and man are there too many convenience stores. Within any given area there is probably 6 to 7 stores within eyeshot and an easy walk. It's weird thinking that they are too convenient, but honestly they start to become pointless. More than once we simply walked by a few knowing that there would be another one just a minute or two more down the street.

It's great that we could find something to eat at 2am when jet lag messed with our eating schedule and nothing else was open except the four 24-hour chain restaurants, 6 full-service Izakayas and a late night curry shop within a 5 minute walk. What would we have ever done without a choice of 6! different convenience stores within the same area?!

Oh and on the way there's vending machines literally jammed into every available urban crack that can fit one where I can service most of my beverage and a few food needs.

I couldn't figure out how these places earn enough money to keep the lights on given the competition, now I guess I know.
I spend all my time server to server so I don't feel qualified to give real advice.

My impression is that if you're going to talk to a browser, that edge stands to gain much more from conforming to HTTP standards. If your edge is more "applicationy" and less "webpagy" then maybe a browser facing gRPC (or GraphQL?) might be more appealing again.

As to the other JSON schema systems, I kinda wish one of them won? It feels like a lot of competing standards still. Not really my area of expertise.
Yes Microsoft enabled it by default in their browser (can't remember if this was the days of IE or Edge) and advertisers used that as an excuse that "DNT doesn't represent user choice" and that they could ignore it.