skysight-inc/HackerNews huggingface dataset:
Also I'd be surprised if https://wiki.gnome.org/Apps/Evince wasn't easy to install if it's not included out of the box.
Found XSS in Help Scout, apparently they don’t pay for bug reports
Found a pretty serious XSS in Help Scout. It’s trivial to force the user to trigger it and after that you can pretty much do whatever you want: steal, modify and delete emails, steal user credentials, etc.

Turns out they don’t have any bug bounty program. Their Hackerone program is suspended (https://hackerone.com/helpscout). Judging by the links on that page, there was once info regarding bug reporting on their security policy page, it’s all cleaned up now.

Also, their Hackerone suspension notice is... ehm... “catch up on the backlog of reports and prioritize other improvements”. Prioritizing new features over a backlog of security reports, mkay.
Please don't post ethnic or national slurs to HN, including ones cloaked in insinuation. It's not legit to cast shade on someone or their work for that reason alone.

https://news.ycombinator.com/newsguidelines.html
I don't have a problem with people who use Linux Desktop, they have their reasons for their choices just as I do, many of which I would agree with[0]. My problem is with evangelists, people seeking to convert others to their chosen religion of Linux Desktop. Unfortunately because Linux Desktop users have a lot of overlap with Linux Desktop developers these attitudes still pervade the community. Case in point, how often do you hear a variation on the phrase "normal users don't need that"?

[0] and in fact I have a higher quantity of my devices running a Linux Desktop than I do Windows, but my main rig is Windows and that's unlikely to change for many reasons.
(Stripe CTO here)

That's a reasonable question. We wrote this RCA to help our users understand what had happened and to help inform their own response efforts. Because a large absolute number of requests with stateful consequences (including e.g. moving money IRL) succeeded during the event, we wanted to avoid customers believing that retrying all requests would be necessarily safe. For example, users (if they don’t use idempotency keys in our API) who simply decided to re-charge all orders in their database during the event might inadvertently double charge some of their customers. We hear you on the transparency point, though, and will likely describe events of similar magnitude as an "outage" in the future - thank you for the feedback.
I always read this threads wondering if there's something wrong with me. I just never get lonely. It's kinda a scary thought but I feel like I could go my entire my life not needing to socialize. I'm married so I do socialize obviously with her and her family and my family and my friends but I've never felt any desire to be around any of them (except my wife).
Never understood that either. People rutinely dump shopping carts everywhere unless they can recover a few of their dimes by bringing it back.

One cannot say that there were no previous experiences to learn from...
How would this type of sales pitch work with nuclear?

Person A: I'd like to buy power from you.
Person B: Certainly. That will be $50/MwH.

Accurate, but misleading.
There are two data points you are missing.

Land purchase and annual taxes add cost. To get to the scale of 1000 house, let's just pretend you need 100 acres. So where are you going to get that much land close to people so you cheaply transport it? Also, developers will make far more from that land near a suburban neighborhood than you can as a solar farm provider meaning you would have to overpay for the land. Most solar farms you see are in useless desert land. If solar farms were cheaper and more profitable than coal plants, the energy companies would have switched years ago.

The flip side is that people installing this on their house don't have this issue. They already own the land and pay the same taxes. They also gain some level of energy independence which is important to some people. Additionally, a lot of these were installed to take advantage of generous tax breaks or other discounts. That is why one of the big hopes of SolarCity was that new construction could come with panels built in and remove a lot of the installation costs. Eventually, we'll all probably have solar shingles and this all won't matter much.
Your English seems fine.
Facebook got a lot more news coverage over a longer period of time
Twitch dominates live streaming with its second-biggest quarter to date
If two or three tenants in a row move out and cite sky high power costs due to poor insulation as the reason, the landlord will notice and do something about it. One tenant is a fluke, several all saying the same thing over a few years is a problem that will get dealt with. Nothing costs a landlord money like high turnover. But departing tenants DO need to communicate that as the issue, otherwise the landlord would never really know since s/he isn’t the one paying the bill.
I mean, really? Mozilla's whole thing is integrity and principals. The Mozilla Manifesto is literally an ideology they probably don't want to be damned.

I'd have very much preferred them wait just 18 more hours and not have violated their privacy policies.

What exactly is Firefox's selling point if their principals can be traded for speed and convenience? That's just another tech company.
You can rent one:
https://aws.amazon.com/ec2/instance-types/p3/
>Localizing our entire energy dependence has got to have some serious national security benefits

It would also cause extreme instability by shooting up unemployment, destroying large corporations that offered valuable careers with good benefits, and exacerbate polarization between those who believe in man made climate change and those who don't.

Don't get me wrong - I think energy independence is the way to go - but paying $4.5 trillion to effectively ruin the lives of millions of people is not a popular position, especially given that we have terrible safety nets to allow these people to find other jobs.

I think the much more likely, less rough path is to continue renewable research until it becomes cheaper than fossil fuels in almost all cases. At which point the market will do the rest. The vast majority of fossil fuel users do not actually care that they use fossil fuel - they just care about energy generation. If you can give them a cheaper means to achieve that, they will go for it.
Hi Dave, you probably won't remember me (we only spent about 2 months together in Stripe), but I bet Mr Larson remembers.

The first question is who is this written for: It lacks the detail I would write for the incident review meeting audience, while lacking a simpler story for the non technical. As it is at the time I read it, I don't think it aims any audience very well.

I understand that the level of detail of the internal report might be excessive for the internal report, but if technical readers are the target, some more details would have helped. For example the monitoring details that Will described in another thread are a key missing detail that, if anything, would make Stripe look better, as problems like that happen all the time. I bet there are more details that are equally useful that would be in an internal report that would not reveal delicate information. In general, the only reason I could follow the document well is that I remember how the Stripe storage system worked last year, and I could handwave a year worth of changes. Since this part of the Stripe infrastructure is relatively unique, it's difficult to understand from the outside, and looks as if it doesn't have enough information.

In particular, the remediations say very little that is understandable from the outside: Most of the text could apply to pretty much any incident on a storage of queuing subsystem I was ever a part of: More alerts, an extra chart in an ever growing dashboard, some circuit breakers to deal with the specific failure shape... It's all real, but without details, it says very little.

I understand why you might not want to divulge that level of detail though. If we want fewer details, then the article could cut all kinds of low-information sections, and instead focus more on the response, and the things that will be changed in the future. The most interesting bit about this is the quick version rollback, which, in retrospect, might not have been the right call. A more detailed view of the alternatives, And why the actions that ultimately led to the second incident were made would be enlightening, and would humanize the piece.

Thank you for not just providing a public root cause analysis, but coming here to discuss it in HN.
Don't worry, the free market (tm) will sort itself. It's all for the best for consumers.
Any scooter that has an actual suspension instead of fixed wheels will handle bumps for the most part instead of trying to throw the rider off.
If the sustainable tight knit community is awash with horrible "values" like racism, homophobia, xenophobia, tribal bigotry and arrogance etc then I don't want to be a part of it. It's perpetuating the wrong things in my view and is like any bureaucracy just existing to serve itself. Kids should be taught the basics of human decency like honesty/empathy/kindness/sharing/helping etc, and then allowed to arrive at any specific spiritual or political views themselves through varied experience, not indoctrinated from a malleable age into mini-mes who never know anything else, as is usually the case in areas like I mentioned above.
Yeah, it’s a stretch to say using an alias makes it less real or using a ruckenfigur picture takes away from the story. If the law allows for witness protection via alias, I can’t see something less real or genuine.

As someone else had pointed out this man may not realize or care about the consequences of the publicity but the author does have a duty to care and I think he betrayed that duty here.
> ship hundreds of deploys a week safely

That seems like a lot of change in a week, or does deploys mean something else like customer websites being deployed?
True, and that would be a good thing for the README to emphasize. It's mentioned, but in passing.

But even so, I know I'd like a good reference of what primitive operations are, the type system, and what's provided by the Prelude.
MM so you'd get star programmers moving to Holland to work for PSV Eindhoven (To take advantage of the Bosman ruling) and Philips would be come a challenger to Google.

PSV Eindhoven started out as Phillips employees team
> Wood Mackenzie estimated the cost to decarbonize the U.S. grid alone would be $4.5 trillion

The 2017 tax cut cost $1.5 trillion. I'm starting to suspect that priorities are being misplaced.
Looks pretty good! Even just skimming the page I get the message of how i works and how it would benefit me. Kudos for adding screenshots so the user is already familiarized with the product. My only recommendation is to be more clear at the end: "Get started now for free"
That's confusing because the first impression is that it is free, so the idea that I might get charged later makes me take a step back.
I'm curious about the Mark Jacobson quote.

Is getting rid of coal & natural gas possible without nuclear?

I don't see how solar & wind can do it by themselves, even if you take the battery part out of the equation.
For PDF viewing, Evince seems to be working already: https://www.youtube.com/watch?v=j8YMc06RMrc
Since neither of the others mentioned it. The nuance is the type system + multimethods. It's a gradually typed system that fully specializes code where it can (aided by the expressive power of multi-methods), and hence with some careful (or overkill) placement of types (and multimethods) it's easy to get large performance boosts with minor edits to one's code (rather than porting the whole thing to C which is the python strategy). But the first pass can still be like one is writing python code, with no typing at all (and sometimes you will get lucky, or be very smart, and that will be fast through specialization without extra work).

As a brief demonstration I can write:

foo(a, b, c) = (a + b) * c

And when I call it on integers, it emits only the necessary integer assembly, and when I call it on floats only the necessary float assembly, and when I broadcast it across vectors it emits SSE assembly. It's only when it can't prove the incoming types that it emits any sort of dynamic type code. It's also possible for the calling function to be ignorant of the types too, and so on, until a user decides to pass in an integer or a float, and all of the code is specialized to be as fast as possible.
Please don't cross-examine people like this on HN. Threads here should be thoughtful conversations, not boxing matches.

https://news.ycombinator.com/newsguidelines.html
Yawn. That would only be a problem if you choose to run Micro$oft software. And it is in your hands to fix the problem by going with Linux etc. (key word is choose...i realise it is imposed on many, specially in the enterprise world).
I wonder why we're not seeing such precipitous drops in the cost of personal solar installations? It still takes a couple of decades for a home panel installation to pay for itself, and that's if you're in a good area for sunlight.

Regardless, it's excellent news. Coal is godawful stuff and we'll be much better off leaving it in the ground where it belongs.
Deconstruct Files, Talk Transcript
Has anyone done an estimate to how much it would cost to roll out an actual ID system instead of continuing to use SSNs? Perhaps this unrelated $5BN can be used towards it. /s
Gross profit refers to revenue minus non-fixed costs. Net profit refers to gross profit minus fixed costs (e.g rent).

Revenue is how much you take in before costs. An analogy of revenue is how much money your employer pays you — before you deduct taxes, food, rent, etc.
1/12th of a year's revenue is a bit of pain, but it won't cause any fundamental changes at Facebook I think. This just sends the message that you don't have to care about things like ethics or user data being private as long as you have a big enough war chest to pay off the government. Either the fine should've been bigger, or coupled with new regulation.
Here you go!
https://www.theinformation.com/articles/the-incredible-rise-...
I bought my panels via a loan.

Based on my loan, my current cost of energy is much lower than if I bought it from the grid. (About 4-5 cents per kwh, instead of 20 cents per kwh.)

My monthly payment never goes up, but it's unlikely that my cost of grid electricity will fall below 4-5 cents per kwh during the lifetime of my loan.

Remember, the cost we pay for electricity includes the cost to run and maintain the grid between the generator (or battery) and our homes. The system in the article is a little more than 3 seconds per kwh BEFORE the costs of the grid are involved.
It's a shared responsibility. The server has to publish the whitelist(in headers). The browser has to enforce it.
Doesn't it work in the opposite direction, with Garmin pushing data to Strava? Also I value having Strava segments on my Garmin bike head unit, so I'm sure the value is going in both directions here.
“If InsuranceCo says they'll payback 20% of list price, but it costs the hospital $100 to run the test (including some nominal profit; hospitals aren't non-profits, for better or worse), the hospital must charge $500 for the test, just to break even on InsuranceCo's patients.”

I have never seen a real accounting of these costs so we can see whether they overcompensate. It’s the same with the high drug prices. They always say that other countries underpay and therefore the US has to pay more but you never see any real numbers.
The Object-Oriented Schism
Why would we put aside the science fiction of astroid mining? In 3000 years, it probably won’t be a problem.

And I’m not sure how you think it’s the most non-renewable. How much oil do you think we have left?
How much bandwidth does the spinal cord have?
Their toolchain might not have been mature enough at that point for the compiler to optimize reliably. Just means they had to optimize it manually.
What amount would you say is enough?
Not nearly analogous. First, the policy was not about accountability, it was about privacy and specifically restoring a trust already broken.

Second, it would only have taken a worst case of 24 hours vs the 6 hours of using Studies to follow that policy. I think the integrity of a company that trades on that very thing is worth 18 hours.
I have blackout curtains in my office covering two south facing windows (in FL). They block a good bit of heat, but it still gets warm. I mostly just wear shorts and deal with it as I really don't want to run the AC down too low (keep it at 80 while I'm home alone; 76 when the family gets home).
I think you're misreading those graphs.

As an individual then yes you can reduce your peak load on the grid by reducing power in the evening. But that is only the case because other people have already massively reduced the peak during the day by installing solar, see this graph they provide:

https://www.iso-ne.com/about/what-we-do/in-depth/solar-power...
> and office networks now

Yeah, forget about home, this is a nightmare. Who knows how many devices are in a corporate network. Internal networks are usually not as well protected as the perimeter.
Typical PG&E power rates are $0.12/kWh.

Typical PG&E delivered power rates are $0.28-$0.42/kwh.

PG&E charges about the same for transmission and delivery that providers outside California charge for transmission delivery and the power itself.
Strava is the only social network from which I derive any real value. I don't need them to constantly mutate the product.
> your data doesn't belong to you, it belongs to them

Not according to the GDPR
Doh.li: another public DNS over HTTPS server
Do they have plans for energy storage?
This is better than nothing?
Performance Analysis Methodology
Is it possible for you to share the state that does this?
Not always ;). As someone with experience managing mongo at scale, this really speaks volumes to the amount of effort needed to make it not do the wrong thing. And even then, there are unknown unknowns like this that can pop up at any time.
Right but the reason large insurers can offer good insurance is they are a much larger risk pool.

I work for a Fortune 500 and my daughter has probably cost the insurance $1m. No big deal rates didn’t even raise.

Before I worked for a contractor and we cost THEM a million bucks, and they had to get rid of the low deductible plan, and boost insurance rates by $50 per WEEK per employee. We single-handedly destroyed their risk pool from three months of NICU stay, making it so they could no longer offer affordable insurance. Rather than accept the new rates we got cheaper plans on the Marketplace. Unfortunately though those aren’t tax deductible but we still came out ahead.

It’d make far more sense to just have a marketplace for everyone and make the risk pool the entire US population, rather than let giant corps get good rates while small companies get devastated when an employee or their children get sick.
The quality of said language is highly variable which also has an impact. It simply isn't a priority to a lot of schools.
The only question I have is: How are these doctors and bill coders not sharing a jail cell with Bernie Madoff, and that guy who keeps stealing six-packs from my grocery?
Pumped hydro actually emits significant levels of greenhouse gases (methane rather than CO2, though).

https://www.theguardian.com/sustainable-business/2016/nov/06...
The is better than nothing?
Garmin sells hardware and Strava is at best a brand. 3rd parties could replace strava.
SpaceX targets Tuesday for Starhopper demo rocket hover test
Nuclear fuel is a non-trivial resource. There is no basis for thinking we will ever find anything better.

Scientific progress is not a law of nature. It needs very specific environment to thrive. Before scientific revolution kicked in the pharaohs would have easily adjusted to europe and elsewhere.

No one can predict whether there is an infinite amount of scientific progress ahead of us or will we hit a wall.
Jay, this is awesome! I really appreciate this and it's super great to open this for the HN community. I love that approach to balancing paywall vs. critical mass / sharing. Thank you!

PS. I'm an Information sub and love how deep you go in the reporting - keep it up, it's very refreshing.
I personally find Diceware passwords unfriendly, so I made my own passphrase generator: https://rmmh.github.io/abbrase/ (has an offline mode too)

Here's two sentences picked from a batch of 32 for a 120 bit security factor that I think the average person could memorize with a few minutes of effort:

know why rod signifies eight nodes

middle crude tissue clearly said Sultan
Nothing can change Facebook that Zuckerberg doesn’t want to change. He has a controlling interest.
50 billion is the right order of magnitude.
Strava presents a derivation of data provided by Garmin. They don't just use it raw. It is snapped to roads and the elevation data is cleaned up and so forth.
> Put aside the science fiction of asteroid mining nuclear fuel for now

> If we have dreams of ever being able to do mass interstellar travel

We probably should put aside the science fiction of mass interstellar travel for now too then?

Especially given that asteroid mining (or lunar mining) is relatively achievable in the near term compared to interstellar travel...
I come from a country where climate is very similar to what Chicago has,so to read that people use AC for heating is quite fascinating! I agree that houses shouldn't be built like in "The Three Little Pigs"...
> What exactly is Firefox's selling point if their principals can be traded for speed and convenience? That's just another tech company.

If everyone cared as much as you do about this issue, then they'd have likely waited. The fact that they were jumping through hoops tells me that the users don't care, they want their crap fixed _right now_.
Get your neighbors to all talk though and things will change.
That is literally xterms on phones. That is not amazing to me.
Accepting anti-features in exchange for security hotfixes isn't going to win everyone over.
... funny. My first thought was actually Egypt and actual garbage because of how absurd a leap it would be, then figured it must be Cairo the OS or some other more likely Cairo.
When so many people rent, landlord just passes the utility bill onto tenant and there's zero incentive to use energy-efficient windows/insulation/etc.

I have lived in building <10 years old where a breeze blows through closed windows.

The energy bills aren't so bad that middle-class renters are going to differentiate which apartment they choose based on the potential energy bills. (Whereas a homeowner who has already settled down into that house/condo has an incentive to reduce bills). So the heating/cooling energy is just going to keep getting wasted.
Eh not quite. I said they must provide a benefit, otherwise people wouldn't click on the stuff. You said, "No they're being manipulated into clicking on the stuff." I responded with "Outbrain is not nearly as good at manipulating people as social networks."

To me that means there are other reasons people are clicking on the stuff and yeah I like to believe it's because they get some benefit from it (even if it's the same benefit they get from watching trashy tv or reading pulp fiction). I don't like to believe that because I think ads are awesome, I like to believe that because it feeds my belief that people do much of what they do out of free will. If we're puppets of corporations we're willing puppets of corporations and blaming ad networks won't change us.
It's not a matter of money cost. Americans are (in some ways rationally, in most irrationally) terrified of a national ID.
A house has some advantages:

* less transition losses

* the "land" to put it on is free and not being used for anything else

That said, here in Austin they have been shifting some of the tax dollars from home-solar incentives to large scale solar farm incentives instead.