skysight-inc/HackerNews huggingface dataset:
So web browsers are user agents, i.e. they act on your behalf. This is great because we can avoid heated arguments about what websites "should" or "shouldn't" be able to do as it's ultimately up to the user.

I assume you've already setup the relevant browser settings and extensions to enforce a user-defined CSP that blocks all further requests? If so, then great, your browser won't make any requests when you visit sites. And my browser will (apart from what I've blocked with other more selective extensions). We're both happy.
Not necessarily more depth, but here is one from mozilla.
https://developer.mozilla.org/en-US/docs/Web/HTML/CORS_enabl...
> I have heard rumors (and that's all I know them to be at best) of certain communities in California (typical culprits to the rumors seem to be wealthier areas of the State) paying for buses to transport their homeless to other cities outside California. It seems outlandish, and just another "blame California" excuse the conservatives here would use - but I honestly don't know what the truth is. It might be outlandish, but completely implausible?

In California, you will hear people complaining about every community in the South-West paying for buses to transport their homeless into California.

This has occasionally happened, but in a very sporadic way.

So, I think that, for the most part, both the Californians, and the non-Californians who believe this are wrong.
Also, it's been known almost 100 years that the ketogenic diet has neuroprotective attributes. There's strong evidence of its efficacy for epilepsy, and mounting evidence for all sorts of other conditions.
It struck me the same way. Presumably, you have a lot fewer people to work at pulling this off, also. That would be like saying, "of course it's hard for Costa Rica to achieve these lofty goals, with only a few million people to support it, whereas China has over a billion people". The particular resources, yeah, maybe, but that particular statement seemed silly.
Check out https://pinboard.in/tour/. Pinboard's feature set is more geared towards bookmark management which happens to have a read later integration. It's quite different than Pocket.
Some items show up as blocked for me,

But it was able to successfully ping my running Steam Client. The page works like an acid test; if it's clean, you're clean. If it finds something, it says what and the port.
So, goodbye CDNs, AJAX, DNS load balancing, most websocket applications, third party image and script hosts, and so on?
Why doesn't Google maps have routes for tsunami/volcano evacuation
We were just in a 4.6 Earthquake here in the Seattle area. I just tried to get google maps to give me the route for tsunami evacuation and it doesn't have that capability. Why not? Anyone from the maps team here?
The objective is typically to make it complex and advanced enough that it becomes difficult for the provider to reimplement it from scratch, or build features that the provider will probably never implement. See for example how Spotlight on macOS has not killed Alfred and probably never will, because Alfred can be very liberal with things like running scripts and plugins - whereas Apple cannot.
Yes, and no.

Yes: the net impact on the environment is likely to be equivalent if imports and exports balance.

No: a major criticism of renewable energy is that it is less reliable. Achieving 100% is much more impressive without a handicap.

I'm still impressed though.
Few years ago I joined some metaphysical dots between "construction", "constructivism", "creation" and "creationism" in my head, which is what led me on to explore 100 years of history/theory behind computational trinitarianism, intuitionistic logic, Curry-Howard isomorphism etc.

This conceptual understanding of Monist metaphysics was the end of my militant atheism.

The expression of knowledge is the creation of knowledge.

It pleases me to see that Per Martin-Löf joined the same dots in his paper "A path from logic to metaphysics".
I hope not. The whole point of the web is that you can link to anything and make requests to any service. Forcing websites to be walled off from each other just because some servers aren't secure would suck.
A confirmation might be helpful, yes. I think the challenge is to design a standard for that which won't completely flood people with warnings. I'm sure there are some "enterprise" applications that will load a ton of different resources from different services on an internal network. So would you have to click a confirmation box for every single one? Or would there be a way for administrators to disable it somehow?
It isn’t really a “major attack surface” and it would be better to configure routers to rewrite DNS responses within the subnet that they control by default than to add an arbitrary set of rules to browsers, breaking all sorts of developer tools and other useful functionality.

Also, legitimate services on the local network have tools like CORS and CSPs as well as standard anti-XSS and anti-CSRF techniques to use to defend themselves.
They are also miles behind on features customers want...

For example:

* My credit card statement should have links to the merchant, the address, a list of the things I bought, a link to the returns process, etc.

* Why can't my statement also have the total number of calories I've purchased in the last month, or grams of carbon in fuel I've put in the truck?

* Why can't I use my mastercard to pay another mastercard user directly?

* Why hasn't mastercard produced a '2 factor' for card payments rather than forcing every bank to implement their own?

* Why can't I buy a dual Mastercard/Visa/Other card, which works with merchants who are picky and will only accept one or the other?

* Why are we still issuing bits of plastic in the digital age anyway?

* Why don't the cards have a microusb plug on one edge, or NFC to plug into a phone or computer to log in, to act as an identity card, to authenticate or make payments, or anything else other companies issue smartcards for?

* Why don't mastercard work with mobile providers to issue cards that you can spend your pay-as-you-go balance with, turning a mobile provider into a bank.

It seems mastercards business is 'stuck', and there are opportunities to innovate all around them, but they won't.
Indeed, it’s too bad this is not more widely known.

The NYT has a nice overview [1], the relevant passages below. Wikipedia’s coverage [2] is excellent as well.

“In 1942, with so many eligible workers diverted to military service, the nation was facing a severe labor shortage. Economists feared that businesses would keep raising salaries to compete for workers, and that inflation would spiral out of control as the country came out of the Depression. To prevent this, President Roosevelt signed Executive Order 9250, establishing the Office of Economic Stabilization.

This froze wages. Businesses were not allowed to raise pay to attract workers.

Businesses were smart, though, and instead they began to use benefits to compete. Specifically, to offer more, and more generous, health care insurance.

Then, in 1943, the Internal Revenue Service decided that employer-based health insurance should be exempt from taxation. This made it cheaper to get health insurance through a job than by other means.”

[1]https://www.nytimes.com/2017/09/05/upshot/the-real-reason-th...

[2] https://en.m.wikipedia.org/wiki/Health_insurance_in_the_Unit...
On what browser? Works fine with Chrome and Firefox for me.

It also works in Brave Browser even when in "Tor mode" (which seems very wrong).
FWIW, concatinative languages are even simpler than Lisp.
That page worked in Firefox, Chrome, and Edge for me with only warnings in the console.

Chrome v75.0.3770.100:
"Mixed Content: The page at 'https://wybiral.github.io/localtoast/' was loaded over HTTPS, but requested an insecure image 'http://192.168.1.254/images/att_globe_logo.png'. This content should also be served over HTTPS."

Firefox v69.0b4:
"Loading mixed (insecure) display content “http://fritz.box/css/rd/images/fritzLogo.svg” on a secure page"

Edge v44.18362.1.0:
"SEC7137: [Mixed-Content] The origin 'https://wybiral.github.io' was loaded in a secure context and loaded an optionally blockable insecure image resource at 'http://fritz.box/css/rd/images/fritzLogo.svg'."
Please read my comment in the context that it was a reply to someone saying electricity companies in Australia are not moving into rooftop solar because it would undermine their current investments.

I am not arguing rooftop solar does not make sense to install. I have a system and it works for me. I think for a lot of people, especially Australian homeowners it is a sound economic and environmental investment.
If one is going to use this setup to distill seawater, you either have to place your solar farm near the ocean or pump the seawater to wherever your farm is. Near the ocean, corrosion and hence depreciation is high, and further away the cost of pumping becomes significant. There will be a sweet spot where such solar farms will be cheapest to install.

It might be possible to install these with residential solar plants to recycle water, but then you do have to pump dirty water up to the roof where solar panels are usually installed.
hobby security
Thanks for that link! For non-urgent routine care I have a local doctor. I was going to recommend to you a2zimaging, which was a service I used for discount MRIs using unused capacity nationwide, but I see just now they've gone defunct in the last year or so. They used to have MRI scans for $250-$500 depending on state. This was less than the over $10,000 I was quoted without. I seems there's other services claiming to do something similar now but I have no experience with them.

I've also paid cash at old specialists who don't accept Medicare, and traveled to Mexico for care. I've also gotten superb care while overseas. Single payer is probably the answer. If I need serious surgery some day I will likely do it in India. Your site there seems a reasonable alternative I would look into.

But this still leaves open the situations with a serious accident requiring immediate care which would surely bankrupt anyone. Insurance never covers whatever care is nearest to a random accident site, and this scheme is by design, along with the curious situation where each hospital and their staff are carefully partitioned out to different networks.
You're in the wrong city. I was at Longman and Eagle last week and the back bar was lousy with kids.

This probably sounds like a throwaway comment, but it's not; there are big cities that are more friendly and less friendly to kids. An advantage of places like Chicago is that the trendy areas are shared between people with families and single people, where in New York the family-friendly neighborhoods are specialized, like Park Slope.
You don't need to receive a response to do damage with a request...
Counterpoint: Is it reasonable in 2019 to treat networks with clients connected to the internet as "trusted" for security purposes?
Why should localhost be different from any other server on the web?
>> "applications can install local web servers" and "some local web servers are insecure"

Yup, that's exactly it!
So, when a company decides to run internal services for its non-technical employees on its internal network, now they have to make sure that all the user’s devices on the LAN (including BYOD devices) are configured properly?
The image requests only work because of mixed-content where browsers allow a TLS page to include non-TLS assets. Those are ones outside of localhost.

For localhost-only you don't get those warnings because browsers treat localhost as TLS even if it's not, such as this: https://github.com/wybiral/wtf
I would suggest that all requests must require a DNS lookup. No requests directly to IP addresses, full stop.

This prevents LAN enumeration from random websites. This is not a big deal for most home networks, but I shudder to think of the damage one could do in a standard corporate network.

It doesn't help with routers with well-known config URLs.

Yes, I realize that this will break a bunch of stuff.

(Edit: OK, DNS rebinding mostly breaks this proposal. Let me think about this harder.)
There's also the consequences of putting violent or unstable homeless people in with the general prison population. Which is what pushed them into mental facilities in the first place, who had people better trained to deal with mental illness.

Both of those solutions have downsides and as the NPR story mentioned a lot of those mental health institutions were shut down in the 1980s.

Having beat cops and other locals or street people deal with the problem is also non ideal.

So its going to be lessers of evils and attempting to minimize the evil as much as possible.
I do love Pinboard as well, but I would really like to see it continue iterating.

There are some very useful features that would be great additions to the product though. Things like better Firefox integration, more powerful querying (e.g., it's not possible to search "unread starred bookmarks tagged with hn" today), and the open API being feature equivalent to the website to name a few.
I assumed it was some 10xer/brogrammer hosting for projects that were 'lit'.

Slightly disappointed.
Even a fraction of a penny drop in that price will mean a lot of value given how many KW/H our society consumes.
One reason some homeless people seem to be more brazen is that they are not being policed as heavily, since people have realized how much of a waste of money it is to throw homeless people in jail for minor crimes. So the people who would be bouncing around in/out of jail are spending more time on the streets. And the same nonenforcement policies also enable homeless people to live in encampments that are not immediately shut down

Note, I don't think the solution is necessarily to reverse these policies. But this is one explanation for why homelessness seems much more visible now than it used to be.

There are other factors increasing homelessness in general, namely substance abuse and increasing housing costs. If you have a poor support network and are living paycheck to paycheck (like most Americans actually do), you are one incident at work + eviction away from homelessness. Substance abuse and untreated mental illness make these worse.

Also there are some pernicious cycles that are hard to avoid with homelessness. Namely that homeless people, as you mention, tend to congregate in large wealthy cities that have lots of services for the homeless. These cities tend to have very high rents so it makes getting out of homelessness more difficult as long as they stay in the city.
It is well known that people with schizophrenia are three times more likely to develop diabetes.

Well. That's significant.

Diabetes is linked to inflammation. So are a lot of brain issues.

I actually came here to note that the brain is 60% fat, so it seems reasonable to assume that the amount and kind of dietary fat would matter a while lot for a wide variety of brain related issues.
The Oldest Book Printed with Movable Type Is Not the Gutenberg Bible
That actually sounds more like a Slashdot starterpack.

HN starterpack is more like verticals, pg, acquihire, execution, and Bay Area.
Wouldn’t one approach be for property managers to lease rooftop space too, making a place for businesses focused on leasing rooftop space, installing solar, and selling power?
Yes it is reasonable, but it should be subject to CORS rules as any address.
> How is the browser supposed to reason about "local"?

That isn't even the issue. It's that there is nothing inherently wrong or unusual with mixing local and internet requests.

Look at IFPS -- it runs a webserver on localhost which you can request content from by using content hashes. There is nothing wrong with a website on the internet which anticipates that you to have IFPS installed and uses it to request page elements. It can even use javascript to detect that you have it and use a different (e.g. slower or more expensive) source for the content if you don't, or show a message explaining how to install it.

Or you have a company with some internal servers where some of them have public addresses (or public IPv6 addresses) while some don't, but they arbitrarily access resources on the others because they're all managed by the same people.

This isn't a browser problem. Browsers are supposed to work this way.
Thats not what I am saying(or maybe it is): sites shouldnt be able to access OTHER machines on my network at all.
The article mentions those mental health facilities were shut down in the 1980s.

I guess you mean some better modern version of them deserves more funding?
> My concern here is, a deployment have been made months ago, and many other changes that could make things worse were introduced.

Make every bit of software in your stack export as a monitoring metric it's build date. Have an alert if any bit of software goes over 1 month old. Manually or automatically re-build and redeploy that software.

That prevents 'bit rot' meaning you daren't reduild or rollback something.
HN is for anything that gratifies intellectual curiosity, whether technology-related or not. Historical material is particularly welcome here.

https://news.ycombinator.com/newsguidelines.html
Except if we go that route, people who use very little power will get screwed, since the cost of the grid hookup might be a large percentage of their total power cost. This will disproportionally hurt poor people (who don't have a ton of gadgets using power, don't have the money to build solar, but still need some electricity)
I'm trying to figure this out: What, specifically, is the duty you think he betrayed?

It's pretty obviously not the case that authors have a duty to anonymize everybody they write about — I've never even heard a serious argument to that effect.

Hessler said he considered whether there was likely to be negative consequences for Sayyid if he was identified in the story, and he didn't see any likelihood of that. There don't appear to have actually been negative consequences (at least, nobody has mentioned any), so it's hard make a strong case for negligence on that front.
> I think MIT people had their reasons for "rethinking" and trying out Java, and then Python. One of the factors I recall was a perceived changing nature of CS practice (moving to assembling from components, rather than understanding&building from the ground up), but I can't properly represent all of the rationales here.

i really don't fully understand their rationale. as i understand it, just at the time that abelson and sussman grew tired of teaching the course, mit felt the need to restructure their curriculum to meet modern demands and changes in software engineering. of course, things have transitioned from building things up to "poking", but i feel many of the principles of sicp remain unchanged. but even ignoring that, i feel mit made a crucial mistake, in my opinion.

mit is a research and education institute. as a programming language, python is not uniquely suitable for computer science research other than its machine learning and data science library support. i feel it is also not suitable for education either, especially not in the same way a lisp or scheme is. python is what is given to you and thus makes it difficult to explore and implement other paradigms of programming and other ideas in the same language like lisp and scheme can do, and certainly not in the way racket can. now, right next door to mit is northeastern, one of the major racket hubs. racket is a re-envisioned scheme and programming language. it is very much suited to computer science research, building languages for teaching and education (for example, pyret was originally implemented as a racket language), and comes with plenty of library support for general purpose programming. so other than having a lack of libraries for machine learning, data science, and scientific computing, it beats python in every category of comparison. and mit's own language, julia, takes care of those missing components. there's no reason why mit couldn't have developed libraries and teaching packages in racket for their courses.

so imagine if mit had chosen racket as their language. that would bolster racket development and popularity. it could have created a bridge between northeastern and mit and would have taught racket to the thousands of mit students and online students. it could have been a huge leap for racket in terms of popularity and use. and mit could have grown to be an additional hub for racket research and development right next door. and also, racket is an evolution of the scheme language, which would have been a perfect segue from the old curriculum.

but no, mit chose a language that was invented over a period of a couple weeks by a stubborn guy who wanted to replace perl. i strongly suspect that there were political and monetary reasons to choose python. and mit probably has a chip on its shoulder, like it does with everything. mit has also become a university driven by the need to raise money, and i think it has gone all in on taking all the machine learning and "ai" money it can. that later point is probably the real reason.
They are themselves dependent on third-parties to ship data to them. Almost nobody uses Strava to log activities, they just sync up from Garmin and friends.
Monroe College Hit with Ransomware, $2M Demanded
Zero based indexing objectively has various convenient properties which one-based indexing doesn't.

The value of convenience over inconvenience isn't objectively better, that's all.

Objectively speaking, if I find the least positive residue of some integer modulo M, I get a value from 0 to M-1. If my M-sized array is from 0 to M-1, that is objectively convenient:

hash_table[hash(string) % table_size]

Objectively speaking, if I have some files in a directory and I give them zero based names like file000, file001, ... then I can objectively refer to the first volume of ten using the single pattern file00?, and the next volume as file01?. If they are numbered from 001, I need file00? file010 to match the first ten. For the next ten, the file01? pattern unfortunately matches file010 so I objectively need some way to exclude it.

Objectively speaking, if I have zero based indices to a 3D array, I can find the address of an element <i, j, k> using the homogeneous Ai + Bj + Ck rather than Ai + Bj + Ck + D, which objectively adds an extra term.

Objectively speaking, the zero-based byte index B can be converted to a four byte word index using B / 4 (truncating division), and within that word, the zero-based byte local offset is B % 4. Objectively speaking, the same conversion from 1-based bytes to 1-based words requires (B-1)/4+1 and (B-1)%4+1, which is objectively more syntax and more nodes in the abstract syntax tree.

There is no reason I should like shorter, simpler, faster; that's a purely subjective aesthetic. After all, a short poem isn't better than a long one; a bacterium isn't better than a rhinoceros; and so on.

Hey, how about those one-based music intervals? C to E is a major third and all that? We have a diatonic scale with seven notes, right? As we ascend, whenever we cycle through seven notes, we have passed ... one more octave. And to invert an interval, we subtract from ... why, nine of course! And a fifth stacked on top of a fifth is a major ninth. There is objectively more cruft in 1 based music theory than 0 based. But there is no accounting for people liking it that way, right?
Please don't post unsubstantive comments, or flamebait, or take HN threads into ideological battle.

Please do review and follow the site guidelines: https://news.ycombinator.com/newsguidelines.html.