skysight-inc/HackerNews huggingface dataset:
Does anyone actually read privacy policies?

My default assumption is that they're all out to f me on this front & it's not like you actually have a choice in the modern world. If it's 4k long then I guess they just needed lots of noise to hide the crux of it.
There are a few ways to do this now:

m.2 add-on boards, such as https://amzn.com/B01NH2W8NL

boot directly from a good usb flash drive (I like the sandisk cz80, though they seem scarce now)
Green Sands Beach on the island of Hawai'i is a big tourist attraction. So, yeah, it seems fine for recreation. (Except it won't be cool anymore if every tropical beach is green...)
Yeah, no.

A programmer's blog is not an ultra-local business.
Let's assume the Pilot is a smashing success, let's also say math works out in some country to do it for 0.2% of their GDP.

How do the logistics of policy adoption work for the first "pilot" country?

1. You would need environmental clearance and the government's own stud(ies) on it. How do you get a government to do this assessment?

2. If you have to get Costa rica(or any listed potentials on the page) to show interest do you go to the Environment Ministry and do a power point and ask "So?".

2.1. Do you get them to do this as part of implementing some climate pledge. And in this case what are you mostly competing with for the fixed size pot of $$?
But it is pedantry because the person you were having a conversation with was using imprecise terminology and you were disagreeing with the words as written instead of the words as intended. Fine, they used the wrong words. Their meaning was clear. I think having the conversation is good as long as we can extend a little leeway to people that don't always have the correct terminology for a particular discussion.
So, it depends on the request type, GET vs POST and others.

Before the client does the request for data, it does a preflight request via OPTIONS to determine what is allowable (is this domain allowed, this type of call).

If it is allowed, it can send and request cookies on the requested domain in the current standard.

However, this is not supported in older browsers, so the request will just work.

In newer browsers, without the preflight check, the server still receives and replies to the request, but the reply is ‘ignored’ by the browser and throws an error.
Damn, he is doing some crazy stuff - take a look at the x-ray experiments: http://danyk.cz/rtg_en.html
Gross generalizations aside, do you have any examples of things he gets really wrong?
The History of CTRL + Alt + Delete
I'd agree with you if we could do what we need with just forests. But unfortunately we can't. Some other form of reducing carbon is a core part of any long term plan.

It's just bad enough now that forestry is no longer a valid option on its own.
Speaking as a Texan, the Netherlands has about the same area as the state of Maryland and three times the population.

I do love Amsterdam, but there's no way I could live there.
Accessibility: How to make digital services in the NHS work for everyone
Youtube (direct to creator) and Podcasts are pretty good as well.

Some small targeted channels can give good return as good videos are used for reference and you'll get a burst of business at the beginning and some followup later.
I hope the younger generation is much more progressive than the status quo, this sort of thing has no chance of making it in the USA for at least 50 years. The argument I always hear made by libertarian types is "I entered an agreement with the company, I didn't have to do this". It is mind-blowing to me how quickly the corporation is made to be the victim. It is in the corporations best interest to exploit the worker as much as possible and get as much work for as little pay, and no worker has as much power as even a small organization, so the organization will come out on top the majority of the time.

A government that is concerned about its citizens could balance this power dynamic.

This mindset seems so simple and basic to me, could someone enlighten me on the other side of this argument wouldn't almost everyone's life be better if we enacted policies like these?
While I use GUI JS-enabled browsers, when at a real keyboard, with a shell and terminal enabled (or even on Termux in Android), fast command-line lookups are useful. Unfortunately, much of the Web formats poorly (HN included).

I have locally defined bash functions for DuckDuckGo (ddg), the Online Etymological Dictionary (etym), weather, and stock quotes (well, plus extensive cruft-stripping for the latter). DDG + bang searches gets me numerous other services, particularly Worldcat, which wins the award for least-useful web design: it breaks on both mobile GUI and console devices, though at full screen rendered by w3m it's passable (I'm considering how to extract and present useful info bypassing the web design entirely).

Third-party utilities give further resources: surfraw for a whole slew of sites, rvt (no longer maintained :-( ) for Reddit, and a set of Wikipedia tools. There's dict/dictd for dictionary lookups (including forwarding OSX queries to my Debian Linux box which has both a server and far better dictionaries).

For RSS I wrote a far-too-complex "rsstail-pretty" which reads from a set of feeds and restructures output -- because there's all kinds of useless and annoying crap in RSS feed content. Similar tricks for stockquote (a bash function wrapper around an awk script) and weather (bash function, sed, and awk -- because features of each are required).

The browser or http agent (w3m, curl, wget, generally) fires once, grabs content, and gets out of the way in many cases. No 25GB VSS memory allocations (yes! Firefox) resident for hours or days.

The amount of useless cruft wrapped around desired information payloads makes the Saturn V launch / return capsule mass ratio look downright sleek.

Particular disappointments: Archive.org, entirely useless without JS.
Yes, it is overkill. And insecure. All that to avoid a confirmation box.
Wow! You're not kidding...

> As my electrical safety instructor said, "The reason we now have to teach the electrical safety course to all electricians at least twice per year is because some joe was bright enough to be the one person in the world who could figure out how to kill himself with a 9V battery."
We have one of these in my small, snowy Vermont town. I think it’s brilliant since it’s easily removed in winter when the bike rack would hinder plowing/sidewalk clearing.
One way would be to use a service like VeryGoodSecurity to capture payment details initially, then have it forward them to your processor later on.
Further in the article they mentioned telescopes have to be placed certain distances apart to calculate differences in radio wave arrival by billionths of a second. These differences gives them granular placement within the galaxy (I'm assuming the analogy is referring to arms, stars, planets, etc.)
This is fascinating. Nowadays people throng to the theaters for the latest Michael Bay special effects extravaganza. It seems like the same impulse, to see a big crash or explosion.
really, what the pi needs is rpi-config to support an option for a read-only root filesystem with an overlay filesystem.

For example, this is the standard configuration for openwrt (which you can run on the pi)
I tried DuckDuckGo for a while, but they have way too many spam results on the first pages, when searching for things in my native language, e.g. tried searching for details about a new tax law a while ago and got a lot of either NSFW spam pages, or pages redirecting to malware. When searching in English it is not too bad, I don't know what is causing this, perhaps just lack of testing/interest for non-english users, or Bing/DDG doesn't run a malware scanner on its search results.
Bing has the same problem.
Run the same query on Google and there is no spam.

I could try to give DDG another try, but where can I report problems with spam/malware in its search results?
The reason the developers didn't use CORS is because active mixed content isn't allowed. You simply cannot call 'http://localhost' from a https domain. For a medical SaaS application which needed to communicate via USB I created a self-signed certificate during installation and added it to the trust store to be able to call active content on localhost. Previously, we used NPAPI (which, when used correctly was more secure than the current plugin architecture), but that got deprecated.

Ask yourself why many developers need this path. The reason is that creating plugins for various web-browsers is a very expensive ordeal, with Firefox and Chrome having a completely different ecosystem. Moreover, in my opinion the plugin ecosystem is less secure than having good engineers take the localhost path (with challenge-response token authentication and origin hostname validation, obviously).
This is great and all, but small time bloggers aren't gonna matter. So how do we convince the big fish that Google cares about so much?
Analyzing My PR Data
It's not just a lack of understanding but a lack of support in server tooling. I was setting up CloudFront on AWS and kept running into CORS issues. I did all the steps to set the necessary headers, but it still didn't work. I ended up just doing some layer 7 routing to route requests to /api towards the other server that was on the other domain to avoid the CORS issues, because now there is no cross domain request. It seems more secure that way anyway.
That's a dishonest reading of what I wrote. To clear up any potential misunderstanding, I have no problem having anyone for a neighbor. I chose where I live in part because our school district has kids where literally dozens of languages are spoken at home.

My point is not that the people who are likely to be caught up in mass migration are bad in any way. My point is that the impact of migrations of dozens of millions will absolutely impact housing, healthcare, jobs, transportation, politics, everything. If the current turmoil we've seen with relatively minor migrations from central America and from Syria are anything to go from, we are in for turbulent times.

Mitigating the impacts of climate change has nothing to do with virtue. It's eminently prudent
Amazon Launches Transparency – Prevents Counterfeit at Scale
That sounds like cheating doesn't it? Can I write a bot to play for me too?
you should be concerned that someone else is listening what you re saying in a private space 1 or 3 does not exist or they are not concerned because they dont have a google home
That's so awesome.

Not just from a AI perspective but also gaming. Gaming AIs are on a consumer level still pretty rubbish.
Moderating a text-only message board is much easier than moderating real life interactions (in qualitative terms, not quantitative). There are so many ways to instigate bullying in real life without saying anything inflammatory at all. And that's not even accounting for the fact that kids can be very creative, when it comes to coming up with ways to make someone feel excluded and miserable.
Deet is benign to humans. Lots of studies on it since it was invented to protect those building the Panama Canal.

You can also build bat houses. Bats feed almost exclusively on mosquitos. They eat more than their own body weight in them.

There is a great story behind this and I dug deep into the research and history dozens of links long but this might inspire you

https://en.m.wikipedia.org/wiki/Hygieostatic_Bat_Roost
Context: I'm the creator of https://hackernoon.com/a-college-students-individual-analysi... , and I did the same with my Github PR Data for the past year.

Mixpanel version: https://engineering.mixpanel.com/2019/07/10/a-study-in-a-mix...

Extended version with time analysis: http://tiffanyqi.github.io/my-projects/engineering-progress....
Lambda MOO Programming
Safari 12 forces the confirmation, not all browsers.
Access to an API should be managed by a proper authentication or token validation scheme. However, protecting your users' authenticated API sessions, which are presumably initialized by the forementioned authentication scheme, is what CORS enables.

CORS, when implemented correctly, ensures that a session is not hijacked by a malicious website's JavaScript in order to call your API in the context of the session (effectively masquerading as the user who authenticated with your API). This scenario assumes that there is an authentication session cookie, tied to your API domain, that the browser would pass along with any request to your API domain (of course there are SameSite cookie and third party cookie blockers that can mitigate these situations as well, but perhaps "trusted" cross domain requests are desired in this use case)

With CORS allowing traffic from anywhere on the web, you can't reliably trust that the authenticated sessions to your API are not being used in phishing / side channel attacks: I discover your are authenticated on site on foo.example.com and I send you a link to my website, evil.com. Evil.com includes JavaScript to request data from an API on foo.example.com. Your browser executes the JavaScript and makes the request and gets a response payload, and since I'm a jerk I then post that same payload to my own endpoint on evil.com to capture the data.

Of course this all assumes that you WANT your API to be accessible cross origin. If you provide an API as a product this is common, since it allows other developers to build web apps against your API. If that is not a use case, then same origin policy (and no CORS headers from the API server) is sufficient to prevent malicious domains from doing bad stuff with your users' authenticated sessions.
It's very possible they genuinely think they're doing the right thing and helping the world. Meanwhile, many, many people outside of that bubble think they're doing the wrong thing. (If only they talked to their users... but I say the same thing about every tech co in general.)

It's the same thing as startups that automate jobs away. Sounds helpful to companies...but it might just piss off the people that are laid off.

I wonder, how do we solve this general problem as a human civilization? Tech people can get together and make tech, without anyone asking, that changes the world and negatively affects people even if the authors have totally moral intentions.

How crazy is it, that I can write some kind of automation software tomorrow that I think will be really cool and helpful, sell it to businesses, and get thousands of people laid off?
Or you can just use a more memory efficient language like Java. Python and JS use tons of memory compared to strongly typed VM languages like C#, Go, Java. People lament Java memory usage but Python/Node use several times more
Ask HN: Sharing side project w Boss
I wrote some apps that improve workflow at work. I wrote these in my own time. How should I share these with my company? Should I ask for compensation at some point?
Simplified, CORS allows servers to tell browsers which requests to allow or disallow between different domains. CORS is what blocks malicious-site.xyz from making a request to your-bank.com APIs with your credentials.
yes, but you forget to mention that before the second crash they actually disabled the stab trim motors and they couldn't manually correct the trim trying to turn the wheel with all their strength so they had to reengage them and that activated again MCAS and puff..
Or are you saying that is their fault because they should have been stronger than that killing machine?
If that's what the person I was replying to meant, they should just say that. They shouldn't say, "It's too long to read."

I don't agree at all with your point of view. I still think consenting adults can take some responsibility for making their own decisions about things. Obviously there should be exceptions when there are serious safety concerns, but such is plainly not the case with search engines.

Anyway, the TOU doesn't even address privacy very much. It would be a paragraph shorter if Google collected no user data at all. So I don't really think that is the point the top-level poster in this thread was making. Or if it was the point they were trying to make, they were doing so circuitously indeed.
Adding an additional line is a large capital expense for the manufacturer itself and probably most of its suppliers; and once you make it through the backlog, you would likely need to idle it.

It's better for Boeing to sell 400 737s a year every year for ten years, than 800 a year for two years, then 300 a year for the next eight years.
This is so simple and fun. The author did a great job.
Apollo 11 (1969)
Its mostly an informed guestimate from spending time in bike stores and seeing what other commuters ride. But here goes:
In 2014 the average retail price was $714 nation-wide (https://www.statista.com/statistics/276088/average-retail-pr...) around here in Portland, OR people tend to prefer fancier bikes, the shop I worked for in 2006 had an average retail about $1700 back in the day but that was a higher end speciality store. In recent years e-bikes have gotten extremely popular here, their retail prices range from $2500 and up, skewing the average price point up further.
Understood.

Point being that even narrower US legal standards are much broader than frequently asserted online discussion states.
Woz says the article you linked in Byte is a followup to the OP. Good find.
Pale Moon data breach post-mortem
OP should consider installing a Xenomai kernel on his Pi, to handle the signal output in hard real time while still providing a nice Linux-based interface to his program.
Yes, 50/50. Plain old Arm&Hammer. Dry.
The economics wouldn't shake out if it didn't work. Just because they don't work on you personally doesn't mean they don't work.
For the past two years I’ve been my own boss and one of my main terms I tell my clients is that I commit to 30 hours on-site per week.

I’ve tried to splice this as 4x7,5 and 5x6 and I prefer the latter _by far_, even if this means one more day of commuting. After 6 hours in front of the computer my mental energy is spent and I’m basically running of the clock on the clients dime. It’s demotivating and I’d much rather spend that time at home with my family and/or exercising.
I always revert to this small, UK-based PR agency who did it (with a few caveats due to PR being a 24/7 industry anyway...): https://www.radioactivepr.com/agency-impact-1-year-4-day-pay...

It is possible for small businesses to adopt it, but perhaps only really in the knowledge worker/high customer contact space. If you're a small ecommerce shop selling lots of actual stuff, then you'll definitely need to have greater role coverage than you otherwise might.
Is it using special API giving it all the information all at once instead of scraping the screen?
I'm pretty sure you're incorrect - requests to sites different from the one you are currently on will not include auth data by default because of the same-origin policy. The auth data would only be included if the server that the request is being sent to responds with an Access-Control-Allow-Origin header whose value matches the origin the request was made from.
Apropos of nothing, in 1890 (i.e. pre-car), a pound of flour was roughly $4.00; a dozen eggs was roughly $6.00.
Perhaps the 4 day week works best with knowledge work, which is significantly different than manual labour.
What is the mechanism by which you resolve multiple challenges against an account? Do you always go with the challenge which was issued first?

The only failure mode I see is that you can effectively "bet" a small amount of bitcoin regularly that someone will lose access to their account (or stop checking in) to gain access to it.
It was in response to the comment mentioning Datasette, which takes data from a source and puts it into a database. Presto allows you to access data from various sources using SQL syntax.
Then in that case, does that mean that Boeing won't lose any money provided that they keep their backlog full for the duration of the aircraft's life cycle? (maybe 20 years). Seems like they have many years to fill the hole made by Saudi Arabia at no real loss.
Or MicroSnitch

https://www.obdev.at/products/microsnitch/index.html
> It's still a security risk. MITM happens regularly.

Then it's more or less as broken as alternative authentication methods
Seriously wondering! Why is Zoom worth $2B and companies are paying per minute plans to host meetings when you can now host your own videoconferencing software easily on your own website or app or intranet using WebRTC, branded, with your own experience, widgets, and it can all be open source? All you need to pay for are dumb TURN servers eg from twilio. Plus it would be far more secure.

For example we built https://yang2020.app/meeting

You can have stuff like that yourself, for free, no Zoom required. It’s open source

SPECIFICALLY what does Zoom provide? People can install wordpress easily, and 30% of the Web has. Why not for videoconferencing?
Privacy is not new and examples go back as far you you look. Curtains, doors, walls, envelopes, seals for envelopes. Some types and bits of clothing.
Privacy is built into a awful lot of what people have done when you look for it.
Once upon a time, Linaro produced flashbench, a tool for learning more information about how managed NAND devices (mmc, sdcard, etc) actually manage their flash. LWN did a story on some of their conclusions [1]. One of the standouts for me was that some erase blocks are managed completely differently from others, such that random i/o performance can vary based on the location on the device. Traditional filesystem benchmarks aren't set up to observe this behavior.

IIUC, F2FS incorporated some of that information, and not much else has. But in principle, you should manage your device with short extents and inode tables in the small-block-friendly area, and larger extents elsewhere whenever possible.

[0]: https://github.com/bradfa/flashbench
[1]: https://lwn.net/Articles/428584/
It now just says "Down".
Not Instagram, but I know someone who is a food scene/restaurant blogger on the side. She likes going it (and does a good job). She gets some trips and probably money/benefits here and there but it's definitely more of a hobby with some perks than what a lot of people here think of as a side-gig much less a significant employment stream.

I know someone else who does hiking equipment reviews who I expect is in a somewhat similar boat.
My hope is that they'll eventually open up the API to allow the public to write their own bots.
The wording of "less than half the volume of construction materials" mined each year seems hand wavy as a justification that this is possible. If I'm reading the chart right that would suggest we'd need a roughly 25% increase in the amount of global mineral extraction.
OK, I bid $50 to recover Satoshi's original account. Presumably he/she/they won't respond and I'll get a million bitcoin.

More generally, you'd want to make small bids against every account that's been idle for a while.

This has the flavor of https://en.wikipedia.org/wiki/Adverse_possession for land. It's socially good that land doesn't stay in limbo forever, but bitcoin being in limbo is a key feature of the economy.