skysight-inc/HackerNews huggingface dataset:
>be that person an artist or a major studio; it’s simply impossible to compete

Has this guy somehow missed out on the fact that Netflix doesn't own the vast majority of the content its users watch? A major studio competing with Netflix is not terribly difficult since all it has to do is yank its own content off the platform. CBS launched a successful streaming service on the backs of one Star Trek series and a bunch of stupid sitcom reruns. HBO Now is making a profit and it's about to be making a much bigger one since Time Warner is pulling their IP off Netflix to combine into HBO Max. The Disney behemoth is also creeping steadily forward. You know, the giant company that dominates the highest grossing films of the year and has done so for several years? The one with a stranglehold on children's programming? I'm not going to pay for Disney+ but almost every friend of mine with kids is looking forward to unlimited Mickey Mouse for only $15 a month.

Netflix is scrambling because it's only got a couple of years before IP holders start ripping its guts out en masse.
What? Are you aware that all commodities are basically deflation?

Do you think it is "evil" to buy commodities?

This is all about freedom of choice. If you don't like the properties of certain products, then buy the one that you like.

But lots of people would apparently prefer to spend their own money on deflationary assets. Who are you to say it is evil to do this with assets that one owns?
No.

- You visit evil.com

- Evil tries to make an HTTP request to bank.com/transfer.php

- The browser happily performs the request, authenticated with your cookies, and the bank, having a CSRF vulnerability, happily sends your money to the attacker.

- Since 'evil.com' and 'bank.com' are different origins, Browser refuses to provide the response to evil.com, but the attacker doesn't care, he got the money.

CORS allows you to relax these restrictions, not tighten them.

Now, bank doesn't like these attacks. So they make the legitimate application send an additional custom header, "X-Totally-Secure: true". Despite being a really bad idea, if (big if) the browser follows the standards, this prevents the attack:

- evil.com tries to make the HTTP request as before

- Browser lets it through, as before

- Bank rejects the request because it's missing the magic header

So the attacker adds the header to the request:

- evil.com tries to make a non-standard HTTP request to bank.com/transfer.php, with the header attached

- BECAUSE IT'S A NON-STANDARD REQUEST, browser asks bank.com (as you described, OPTIONS)

- Bank.com replies "wtf do you want I don't know what OPTIONS is"

- Browser refuses to make the request

Unfortunately, the bank forgot that they have a marketing department, that runs ournewbankapp.com, and shows your current balance in the fake screenshot of the app to show how awesome it is. And your bosses' bosses' boss has yelled at the IT department that rolled out the security measure to make it work again. They make ournewbankapp.com send the magic header (including access-control-allow-credentials), but now the OPTIONS request fails. So they teach the web server to respond with "everyone is allowed" (with "access-control-allow-origin: *" as you described) because they're lazy and dumb.

But because browser vendors know that developers are lazy and dumb, the browser completely ignores this: If access-control-allow-credentials is set, the allowed origin must be listed explicitly. The developers give in, and explicitly add ournewbankapp.com to the header, and now it works, but the attack doesn't work.

(part 2 follows)
I was also surprised to read: "the browser explicitly ignores any CORS policy for servers running on localhost." on the Zoom vulnerability writeup.

Among all the W3 specs, the CORS one is definitely not the largest spec. See https://www.w3.org/TR/cors/

Ultimately the Zoom vulnerability reminded us that there is always a trade off between usability and security. Most of the developers default to usability and simplicity.

The average developer looks for the fastest way to achieve "what I want to do". And they do not even question installing stuff with "curl https://any.domain.com/any-script | sudo bash".

And that is the root of all evils.
There are two different cases for this:

1) The faculty member from University A writes an article criticizing University B, without mentioning that University A also has the same problems.

2) The faculty member from University A writes an article criticizing a set of problems, including examples from both University A and B.

The subtle distinction between both #1 and #2 is why people have different opinions on this. Many people consider #1 to be hypocritical and #2 to be fair.
Alphastar's APM wasn't even abused that much either back in January: https://deepmind.com/blog/alphastar-mastering-real-time-stra...
Not that I want to go down the rabbit hole, but I probably fall into the category of “JVM is heavy, but I use Python”

Sure, memory consumption and CPU perf are both pretty bad in Python, but latency and memory footprint of the runtime itself are pretty good, so it’s ideal for tooling, crons, lambdas etc. JVM is comparatively efficient once you have the JVM ready, but that sure takes tons of resources.

I’m hoping Graal changes this. I don’t like JVM-based languages, but I do like technological progress.
My company has a broad reaching IP ownership that covers absolutely anything I think up or build, even in my own time and using my own equipment. However, that's just boiler plate umbrella paperwork most company legal teams force comanies to have in place for protection. I frequently develop IP and work with start-ups, and earn extra income/equity on the side. You simply need to request a waiver, on a case-by-case basis.

A lot of people say it's better to ask for forgiveness than for permission, but to me that's an utterly weak stance and will only lead to stress now and hassle down the road. For me, for each side project I determine could likely be profitable in some way, I simply send my supervisor (division manager in my case) an email stating as much about the effort as I can without disclosing the actual magic sauce. If it's IP (rather than a extracurricular business relationship), then I give them the opportunity to buy it outright or fund development with profit share (they never take that option). I give them 2 week turn around. He runs it through legal, and they quickly assess it for major conflicts of interest.

This works because leadership are rarely people so insecure that they want to control every aspect of your life - if they are then you should probably go work somewhere else. If you are a valued contributer, the last thing someone wants to do is be responsible for losing a valuable employee simply because they neglected to respect your work-life balance and personal growth. If they do, then they are a poor manager, and that will be apparent to their peers and superiors. This is harder at a very small company, because some (not all) leaders are naively too inexperienced and insecure to be concerned about their professional reputation. However, I've worked with great startup leaders who respect my professional partitions.

Caveat: if you're working on something very directly related to the work they're paying you to do as part of your contract (job description), then that's a conflict of interest and they should own that IP you create outside of normal operating hours. After all, put yourself in their shoes: you pay someone $2000 a week to design and build an augmented reality application to help grocery shoppers look up product information, then that person asks you if they can sell an AR application they built in their own time to let people find directions inside of a store. If it were me, I'd scratch my head and say: "wait a minute, good idea but I'm paying you to design this grocery store app. If you had such a great improvement, why didn't you bring it up so that we could role it into the development plan. I'll take that, thank you."

I've never had my employer deny a waiver request. That includes patents issued, payment and equity agreements with other companies. However, if they ever did, depending on the potential value, I am always prepared to leave.
> Something about CORS and the resources out there makes newcomers think that it's something the client has to do differently

I think that "something" is the fact that the client does the blocking. Generally the servers are perfectly willing to provide the data. Heck, if you sniff the packets, you could even look at the data blocked by CORS (assuming you're working around TLS). It's especially confusing at first that tools like curl work no problem, while browser block everything.
Sorry about that, I didn't do a great job of clarifying. What I meant to say is that we haven't encountered that type of pushback nearly as much as we anticipated. Owners tend to understand the concept and most are interested in improving their competitive advantage. The primary concerns we face are around fulfillment and customer expectation, but we'll likely continue to run into more shops that are simply uninterested in this sales channel.
I would be significantly less skeptical about this if it were significantly less ambitious.

I'm sure there are low-hanging opportunities where this makes a good amount of sense. Places where there are olivine-rich mine tailings -- somehow uncontaminated by heavy metals -- adjacent to a tropical shoreline. In those instances, then yeah, I'm sure it makes good sense to just shove them over to the beach and let decomposition do its thing.

However, pitching this as THE solution to carbon sequestration is much more problematic. At gigaton scale, you're going to run out of mine tailings quite quickly. After that, you're talking about mining fresh olivine, from locations that are increasingly distant to tropical shorelines.

This would incur tremendous energy costs, and I'm skeptical that its balance would work in favour of olivine. How much does energy is required to mine a 1,000kg of olivine? How much energy is required to move it (say) 100km to the shore? If that net energy were applied to other forms of carbon capture, would it sequester more than 1,250kg of Co2? If so, then in that instance at least, olivine sequestration would be a bad idea.

Even if the energy balance works out favourably, I'm still not sure it's a good idea. Mining doesn't just have energy impacts, it has tremendous land impacts. 7 cubic miles per year of olivine is a very large amount of material. If you don't like the local impacts of mining gold and copper and coal and shale and sand and gravel, then this would have an environmental impact similar to all of those put together. Which is too much impact. It is probably preferable to pursue a less-efficient sequestration strategy than to engage in something with this kind of side-effects.

So I'm afraid that the way this is being presented will trigger a lot of skepticism / opposition. This is a shame, because in certain edge-cases I suspect it's quite a good idea. Even if this only addresses a small percentage of the total problem, every little bit helps. I'd hate to see the baby get tossed out with the bathwater.
>but downloading a Fedora or Debian install is in no way comparable to installing binaries from random filesharing websites.

What if you download binaries from non-random, trusted websites? Seem to me that is the same as trusting a repo maintainer.
> Is not published,

Correct, but we are talking about it, somehow, and has been uploaded to internet, accessible from most countries of the planet, without restrictions at any time of day or night

> It has no path to get into the attention of researchers

maybe they could google it
Presumably you mean that false should be represented with 0 and true with ~0? And the motivation is maybe to be able to toggle boolean values with one instruction?

Has there been any discussion on this matter on risc-v mailing lists or somewhere? If the RISC-V Base ISA is now ratified, I think it is too late to change such things.

Edit: seems to be too late. According to [0], SLTx instructions "set the destination register to one or zero depending on whether the relation is true or not."

[0] https://www.imperialviolet.org/2016/12/31/riscv.html
In Canada, the national carbon price will go to $50 by 2022. So it will very shortly be profitable in Canada.
Predictable, passphrase-derived PGP keys
This context was incredibly useful; thank you.

Am I missing something or is this transaction actually a browser being the deciding factor for whether or not the request gets sent?

If that’s true, couldn’t a nefarious browser decide when to push a request and completely ignore the OPTIONS header?
how long before AI powered "engagement" bot nets get good enough to pass the extremely low Turing test bar required of IG follower comments?

I suspect AI wouldn't even be needed, just harvest real comments from existing high engage feeds and dump them with minor word swaps on to low engage feeds. this alone would probably take a couple years for countermeasures to respond to, assuming there is even an incentive basis to respond at all.
This is inherently a security problem because web sites can open URLs without user awareness or deceive users about the content of said URLs.

On Ubuntu, xdg-open phrases the checkbox as something like "always allow X program to handle foo:// URLs?", which is probably not comprehensible to the average user; more accurate phrasing would be "always allow websites to open X program?" Which I think indicates why I'm so skeptical that this is a good option to give to users.
I don't know I was just answering your question about deposits.
Added advantage for me : no one making irritating sounds eating their $8 small popcorn or unwrapping their $5 candy.
And if the tax cripples business, it will slow emissions anyway
I believe it's true to say the NHS generally has worse waiting times than, say, American healthcare.
Third parties confirm AMD’s outstanding Ryzen 3000 numbers
The main one is my health insurance, which consistently gives me a free cinema ticket ever fortnight (was every week) for walking distances I'd've walked anyway.
Mubi gives me free cinema tickets each week to a designated film.
My phone network gave free ones occasionally for a while too, have switched networks since but I believe they still do.
You mistakenly assume that the actual owner can always be identified. Part of the point of adverse possession law is to moot cases of "the McCoys and the Hatfields both claim they owned this land 100 years ago and nobody can offer substantive proof as to which is right (and in the meantime the Johnsons have been living there for six generations)".
Representative sampling, does 'work' in the sense that it may or may not 'prove' whatever it is you had a question about. But the issue is that you effectively building in your assumptions about what is 'representative' into your sample. Its (imo) the central issue in the reproducibility crisis: our assumptions about the world and how that impacts the questions we ask about it.

It was previously intractable to do a census rather than a sample, and maybe for your purposes a sample is good enough or a census remains intractable. In my field , this is how things were done for decades (and still largely is), and even though (imo) it did a piss-poor job, it was good enough for some purposes. As piss-poor job is still better than knowing nothing. Maybe this is good enough for your purposes.

There's a third way however, which is to move beyond sampling and to perform a census. This is the difference I'm speaking of. We're at the point where we don't have to sample because we can measure. Effectively, this is what modern data science is. We've always had the ability to sample and interpolate. It doesn't work very well (imo: https://en.wikipedia.org/wiki/Replication_crisis) and usually is reflecting back to us something about our assumptions in how we sampled. But thats just it. We don't have to rely on a sample if we can take a census.
Yes it is; I think you're thinking about healthy, pet cats. I have a couple, I've also worked with the local cat population control group on the pro-cat side.

Too many cat's is a huge problem. They carry unique diseases, most notably those transmissible to your pet cats. Also, toxoplasmosis gandhi which will kill large mammals in an area, including whales. It also infects humans through under-cooked meat. Cat scratch fever. Cats can also transmit whatever local diseases and parasites other mammals carry, but effectively as they tend to live in large colonies close to humans.

Cats murder your local bird populations, which in my area, includes a number of endangered species. I'm sure in other areas, there might be other endangered creatures cats remove.

And finally, there's the typical nuisances of getting into food stores and trash, dying on motorways, feces accumulation (even before considering diseases), and noise complaints.

Further a large feral cat population creates rabid, cat-hating humans which IMHO is also an issue.
It's relatively straightforward on a smartphone to monitor the battery and bandwidth consumption that active listening and device<>server communications are occurring.

Of course - then, the next apologist will always say: "the devices only transmit when hearing the 'Wake Word'"...

Yeah, I don't think it takes an elite programmer to store/buffer audio, until the device hears the 'Wake Word', and then sends a "slightly" larger payload... (or batches several payloads)

The next level of enthusiast evangelist will then tell us that it is impossible for these devices to buffer/store that much audio data, because they have limited memory...

Yet, the same devices when used to play audio streams from the internet obviously have some sort of storage capacity to handle network glitches.

Spoken audio (which is probably recorded at standard telephone/cellphone sampling rates - after all, why train on audio that is significantly different than the audio coming from mobile phone devices) does not take up a dramatic amount of storage space.
Nothing in C++20 contracts requires any checking to be done at compile time. The only options currently required are runtime checking and no checking.
I've even heard of cases where a carbon bike frame (itself worth thousands) was cut so the parts could be stolen. But you're right, the solution is a beater bike with a big lock, and if you have a nice bike, keep it indoors and never leave it unattended for more than an hour.
> Alphastar does already factor out reaction time

That may be true in some narrow technical sense, but it was heavily disputed by the StarCraft community. If you watch the exposition games, AlphaStar has superhuman ability to micro-control its units one-by-one during critical battles, which allowed it to beat its human opponents even when its army was far inferior on paper.
I think it's increased Cyberwarfare activity. It all started happening in groups right after the drone takedown over Iran.
A service I'm building has this option. Puts protection against SIM/email jacking or social engineering into the hands of the customer if they feel capable.
They "ruined" the taxi industry because it was anti-consumer and absolutely horrible. That's why it was so easy for them to "ruin" it (read: make it so much better).

Seriously, you think it's "ruining" an industry to have a convenient smartphone app instead of having to call someone on a phone and hope a driver shows up within 2 hours? And then have a driver that doesn't use a taximeter, drives around in circles, and just makes up a price on the spot? Maybe you never tried using cabs in the suburbs before the invention of Uber/Lyft.
A deep dive into Linux namespaces, part 2
Citations Needed, Chapo Trap House, Stuff They Don't Want You To Know, Crimetown S1 and S2
Boston. 365 days. 7 miles. With 2 kids (starting at 12 months) on the back in seats (not a trailer).

Snow tires make winter way more feasible. Also fwiw, the kids never complained about the weather bothering them, only that we didn't stop at the playground (crying, sometimes tantrums).
> The actual minting of money has not been a major factor in managing the money supply in a long time.

Very much not true.

Quantitative easing, the process of minting money to inject liquidity into the economy, was a core tenet of the Obama administration’s* response to the Great Recession. Literally trillions of dollars created to purchase bonds and mortgage backed securities to prop up the economy.

Edit: It was during the Obama administration but implemented by the Fed, which is independent of the White House administration (thank god.)
That's sort of my point. cars are way too big and go way too fast for a lot of roads, and there is often no room to widen them. So we let the cars squeeze in anyway, to the severe detriment of pedestrians and cyclists.
Again not true! If you do nothing, the compiler generates both copy constructors and move constructors. If you pass an xvalue reference, the move is used. If you pass an lvalue reference or a value, the copy is called. The compiler doesn't do anything silently.
Afaik, it is parsed, but limited to the current camera view
It looks like NYC, SF, and Chicago are the big places on their maps. Those seem to be walking cities, though.

Not sure how their business would translate to the midwest, where many of the cities are driving cities.
Are we sure that moving the camera is considered an "action" by the APM limiter? If so then that does indeed change things.
You're correct, the browser is the safety net when it comes to CORS.
His arguments are agriculture's health and societal effects. We wanted X from agriculture but we got X+1 (what human achievement doesn't result in this?) where +1 is some unwanted consequence (having to have more children to maintain a farmstead, rotting teeth, increase in belly size, the loss of the tribe (maybe alluding to dunber's number) His points make sense, in my opinion. He understands the pros are great but his argument is we did not foresee (or adjust very well to) the cons that come with the agricultural revolution.
By default, under the same origin policy, a browser won't allow requests cross origin.

But there are valid situations where you want a request from 1 domain to be made to other domains. This is where CORS comes in.

CORS is a mechanism to loosen security, not increase it. It allows a server to say, these are the domains (outside my own domain) who can make requests. CORS headers should be set carefully so that you are only allowing the domains that should be allowed through.
Infrastructure like dedicated bike parking in itself shows a cultural acceptance of biking: it's like a "you are welcome here" sign. It helps.
I'm looking at one right now on Main St. between Huron and Washington. It even has a library Summer Game code on it.
> You would be surprised how much coastline around the world is undeveloped and not even accessible by roads etc

True, but does that apply to tropical coastlines too?

I live in Mexico, even lived in Cancún for a couple of years, the majority of the tropical coastline in the Riviera Maya there is used for touristic purposes.

I don't know the pacific coastline as much but I've been there a couple of times and AFAIK most big beaches are accessible from roads and are accessed by tourists.
It's a chicken-and-egg problem. People want more buses so they can commute and travel by bus but they don't have the bus routes they need to reach their place of work or the locations they wish to travel to. Which means they can't give up their car until a robust enough transportation option is available. Which can't be implemented until streets and parking are redesigned to accommodate the new transportation option. I'm watching it play out in a smaller scale where I live (Madison, WI) right now. As density increases and there aren't robust transportation options for people to use on their daily commute; parking becomes a hot-button issue.
yeah, that's kind of why I half jokingly call it the Eventually Efficient Market Hypothesis