skysight-inc/HackerNews huggingface dataset:
They probably will issue alternative Firefox and Chromium build. That would be worse. Though if entire tech industry will fight this attempt, like Windows will stop updating, macOS, iOS, Android, etc, probably they will step back. But I don't think that anyone would do so. Especially because that scenario is legitimate and widely used by corporations to control their perimeter and Kazakhstan ultimately does not differ.
If you see things we haven't moderated that should be moderated, the likeliest explanation is that we didn't see it. We don't come close to seeing everything that gets posted to HN. There's far too much.
I bet most hardware wouldn't even last 100 years.
how can 33 people out of 70 for in 3fl building? why not jump out of window, even top floor must be survivable. hard to understand unless they were attacked directly with knife or he made some kind of flamethrower
This is actually the subject of some debate, believe it or not, there is a good argument against it.

Here is the crux of the issue, many TLS middleware providers install their own root certificate for network monitoring, data loss prevention, security scanning and so on. I personally would like them to stop doing that or at least make it obvious to end users it's happening. However, in order to modify the root store, they must have been authorized to do so by the Administrator, and it's their network or hardware.

If we try to make it obvious to users that this inspection is happening, these providers will switch to using alternative methods, such as using Microsoft Detours - which would be even worse, now you have random vendors patching security critical code in such a way that is not discoverable for end-users. This cannot be prevented, because they must already have Administrator access or they wouldn't have been able to modify the root certificate store in the first place.

In this Kazakhstan scenario, imagine if adding the government certificate put a red dot that said "You are being monitored". If the government didn't like that, they could instead require you to install monitor.exe that had the exact same effect, but didn't show the dot by patching and hooking all the crypto APIs. I find this argument against adding an obvious indicator quite compelling.
Five-year-olds designing smart technology
NPM 6.10.1 Released: Not a major release but fixes a handful of issues
I'd like to learn the reverse - investing from US in other countries
I think that since podcasts are often subscribed to, we might be able to mitigate the micropayment problem at least a bit. There are a lot of podcasts for which I'd be willing to pay, say, $10 per year -- though not enough to go through the trouble of finding and connecting to them on Patreon.
What was your top score?
UK land is technically "owned" by the Crown Estate [1], and revenue goes to the British government. The royal family get a percentage of this (called the Sovereign Grant [2]; née Civil List [3]).

[1] https://www.thecrownestate.co.uk/en-gb/resources/faqs/

[2] https://en.wikipedia.org/wiki/Sovereign_Grant_Act_2011

[3] https://en.wikipedia.org/wiki/Civil_list#United_Kingdom
Would have been nice to see % accuracy as well as or instead of just % words matched. It seems like the author decided to forego false positives.

You can train models that are good at finding words in images but can have terrible accuracy at perceiving the actual text of the word.
> - a scary amount of people of my generation are completely uneducated about food

A scary amount of my peers are afraid of cooking; I mean they're suddenly comfortable w/ their Blue Apron w/ instructions, but having a home standby is unheard of them for the most part.
Yes, that is why I wrote that women of that time were "not employed" not "not working". Household chores can be considered work, but that brings into question what is work and what is leisure? Raising kids is certainly a lot of work but it is also entirely optional so why isn't it leisure? arvinism however wrote "more time at work than ever" which can't mean anything other than hours in employment.
Why are you talking about sausage in a conversation about eating healthy foods?
What is interesting is that some local internet providers in Kazakhstan used to inject their own ads into http websites their users visit. I wonder if they will start doing the same with https now.

I noticed this behaviour last February with Kazakhtelecom (telecom.kz) internet provider. When I opened an http website in my browser and started clicking randomly on the parts of the page which are usually not clickable, sometimes such click would open a pop-up window with ads. Those pop-ups did also open sometimes, when I clicked on links of the page. It was unusual, because I used the same websites just a few days before that from Russia and nothing like that happened.

To figure out what's going on I opened the same webpage through proxy and compared it with localy opened one. Shell command for that was something like:

diff <(curl http://website) <(proxychains curl http://website)

And the only difference was that directly downloaded webpage contained a reference to some suspicious script in a place, where the proxied one had a reference to a google analytics script. I reproduced this behaviour with multiple websites from two different homes, on two different laptops (Linux and Windows). So this is unlikely to be a malware in my router, and I'm pretty sure it's not in my laptop.

I'll be back in Kazakhstan in 3-5 days, I'll try to reproduce this once again.
Rising CO2, climate change projected to reduce availability of nutrients
If it is a static web page you can try the free hosting of Firebase
Thanks for posting this! The screenshots of the platform look awesome.
A lot of internal enterprise networks use MITM, so your app won't work there as well. It might be a good thing or not, depending on your use-case.
Right. "Closed as Duplicate" could be renamed "Great Question! We have an answer for you over here!" without change in functionality and it would be an improvement. They could take it further and keep the duplicate as a "rephrasing" or "alternative statement" of a question - shouldn't it improve Google search-ability, having several different ways stating a question? And asking a duplicate question in your own words shouldn't be penalized; it is, prima facae, both a good and frequently asked question. It would be so easy to make the question-asking experience better for the vast majority of users... and yet they don't.
>The alternative here isn't keeping running, it's "does not compile in the first place". That's even sooner than your crash, and guaranteed, as opposed to "happens to hit the right code path."

Different people mean different things when they talk about correctness. I think it means accurately capturing the intent of the programmer, i.e. the logic/algorithm/code flow or whatever, and eliminating the ambiguity. How does rust help here?
There are means to enforce things in space. But they all constitute an act of war, under current agreements.
One should ask TeX related questions on the TeX SE[0] instead of SO.

[0]: https://tex.stackexchange.com/
Security Things in Linux v5.2
Buy them a book about SCRUM and explain what is a sprint!
because cafe can just ask people 'install this extension to navigate' and non-tech users being users will fall for it most of the time, because state actor can do even worse, and once we trained the users that non green check is dangerous they won't have the knowledge to distinguish between "insecure with no check" and "maybe secure with check but I've to control every time the details", people will shortcut that part, until some researcher finds our for them and even then it's not guaranteed that the message will reach everyone
"Visual Difficult"

I belly laughed. And I really needed to just then. Thanks.
Inmarsat offers relatively slow, very expensive satellite Internet uplink services if you really need some connectivity: https://www.inmarsat.com/service/isathub/
The X-XSS-Protection header recommendation is a Zombie recommendation which is at best outdated and at worst harmful. Its origins are based on old IE bugs but it introduces worse issues.

IMHO, the best value for X-XSS-Protection is either 0 (disabling it completely like Facebook does) or not providing the value at all and just letting the client browser use its default. Why?

First, XSS 'protection' is about to not be implemented by most browsers. Google has decide to deprecate Chrome's XSS Auditor[0], and stop supporting XSS 'protection'. Microsoft has already removed its XSS filter from Edge[1]. Mozilla has never bothered to support it in Firefox.

So most leading net companies already think it doesn't work. Safari of course supports the much stronger CSP. So it's only possibly useful on IE - if you don't support IE, might as well save the bytes.

Second, XSS 'protection' protects less than one might think. In all implementing browsers, it has always been implemented as part of the HTML parser, making it useless against DOM-based attacks (and strictly inferior to CSP)[2].

Worse, the XSS 'protection' can be used to create security flaws. IE's default is to detect XSS and try to filter it out, this has been known to be buggy to the point of creating XSS on safe pages[3], which is why the typical recommendation has been the block behaviour. But blocking has been itself exploited in the past[4], and has side-channel leaks that even Google considers too difficult to catch[0] to the point of preferring to remove XSS 'protection' altogether. Blocking has an obvious social exploitation which can create attacks or make attacks more serious.[5]

In short, the best idea is to get rid of browsers' XSS 'protection' ASAP in favour of CSP, preferably by having all browsers deprecate it. This is happening anyway, so might as well save the bytes. But if you do provide the header, I suggest disable XSS 'protection' altogether.

[0] https://groups.google.com/a/chromium.org/forum/#!msg/blink-d...

[1] https://developer.microsoft.com/en-us/microsoft-edge/platfor...

[2] e.g. https://github.com/WebKit/webkit/blob/d70365e65de64b8f6eaf1f...

[3] CVE-2014-6328, CVE-2015-6164, CVE-2016-3212..

[4] https://portswigger.net/blog/abusing-chromes-xss-auditor-to-...

[5] Assume that an attacker has enough access to normally allow XSS. If he does not, the filter is useless. If he does, the attacker can by definition trigger the filter. So trigger the filter, make a webpage be blocked, and call the affected user as "support". From there the exploitation is obvious, and can be much worse than mere XSS. Now, remember that all those XSS filters in all likelihood have false positives, that may not be blocked by other defences because they're not attacks. So It's quite possible the filter introduces a social attack that wouldn't be possible otherwise!

Hattip: https://frederik-braun.com/xssauditor-bad.html which gave me even more reasons to think browsers' XSS 'protection' is awful. I didn't know about [2] before reading his entry.
I don't think it's clear from the parent's post that editor was a moderator.
Which ISP?
Same here. Haven't yet got any SMS or notifications from my mobile/home ISPs, but couple of my friends are reporting that they did / there are many posts at social media, proving the fact, like this one: https://www.instagram.com/p/B0Do5IOHjab/
Do you mean steganography? Stenography is writing in shorthand (or typing on a stenotype, like court reporters do).
I'll bet part of why they're conflated is because every company that tries to hire 10X engineers, does it wrong and ends up hiring arrogant engineers.

Not to mention, to the much more numerous ranks of "1X" engineers, a 10X engineer, even a real one, is kind of a pain in the ass and hard to distinguish from an arrogant engineer.
When he wrote Keen for those guys in Shreveport I doubt he was the straw that stirred the drink
>(and the ringing in my ears)

Yep. I also have tinnitus (ringing) due to overuse of headphones at the office. I have to be very careful about volume.
> It must have been many many years ago, more than 10 at least.

You would be unduly optimistic — for example, Apple did not support them at least as recently as 2015 (see e.g. https://bugs.chromium.org/p/chromium/issues/detail?id=407093...) and 10 years ago OpenSSL hadn't even shipped support upstream, plus however long it took your distribution to ship a major version upgrade to 1.0.

I was hoping someone might have a pointer to current information on that topic since I believe Apple did finally fix Secure Transport but not when.
For 1 million images, it's $1500 across all, but as you scale to 5m images, the prices must differ.
This strong sign of the confidence Twitter has in React Native for Web[1]. In 2017, Nicolas Gallagher gave a talk[2] about why it was used for mobile.twitter.com.

[1]: https://github.com/necolas/react-native-web

[2]: https://www.youtube.com/watch?v=tFFn39lLO-U
If your phone is also used for work, you might have gotten a root certificate installed through their MDM program. Check Settings>General>About>Certificate Trust Settings for a root certificate.
Would you trust an artificially intelligent doctor?
> how a supervisor determines you are working and not screwing around is a point

This should be determined by "do they deliver?" rather than constant monitoring.
One of the main things that keeps me using a third-party client (for as long as I can continue using one) is the Home vs.Latest Tweets feature. I NEVER want to see the home timeline. I always want a reverse-chronological list of tweets. It is user-hostile to have to continuously select Latest Tweets. I'm sure they see more engagement with the Home timeline, but I just want to be able to flip a switch and never see it.
Self-Licensing
> Fabrice Bellard

I googled him just now knowing nothing about him. Holy cow. How can this person even be real? Are we sure he's not a superintelligent alien?

>In 2005, he designed a system that could act as an Analog or DVB-T Digital TV transmitter by directly generating a VHF signal from a standard PC and VGA card.

WTF! How??

> On 31 December 2009 he claimed the world record for calculations of pi, having calculated it to nearly 2.7 trillion places in 90 days. Slashdot wrote: "While the improvement may seem small, it is an outstanding achievement because only a single desktop PC, costing less than US$3,000, was used—instead of a multi-million dollar supercomputer as in the previous records."

This guy is more like 1000x than 10x.
I actually have family in Alcudia. :)

Another town you should check is Buynola. It has all the magic of the Tramuntana and not as expensive as Valldemossa or Deia.
Strange, the 2015 report says nothing about inserted code. Did they not know about it until 2019?
What knits together "thinking in math" and "writing in code" is...human effort. If the domain is mathy, then it won't take much. If it's not...

Math is the world without abstraction leaks; programming is the act of plugging those leaks.
it doesn't mention that... thats what confused me...
A 10x programmer would read the description of the bug, and from their knowledge of the codebase think "hmm, that should only happen when you have X loaded multiple times at once making Y happen..." then go on to immediately test and repro with two windows open.

UI dev/QA is a bit different but this is how things typically go in sysadmin-land. A good engineer can hear a description of an issue and immediately pinpoint one or a few seemingly unrelated potential underlying issues to test. This is just a combination of experience and a deep knowledge of the underlying systems and processes that make things happen. The tough part is that this isn't something that's "teachable" -- some guys just "get it", others, while having superficial knowledge of the infrastructure, just can't seem to be able to mentally walk though a system or process and identify where the trouble might be originating from.
1. nobody said the do or that they should "be inclusive"

2. miasma is a negative word (means repulsive)

I agree however, it is actually one of the reasons that more well-off people tend to socialize less: other people are not always "wonderful"
I say "assuming" because many times I'm communicating with people who don't necessarily believe in evolution, and I'd rather not derail my thought experiment with an argument over whether evolution is real. Instead I have the argument with pompous believers of evolution who scold me for being respectful.
Japan's exports drop for 7th straight month as China-U.S. trade war takes toll
SSH no, mobile apps and telegram probably if they use TLS.
I also have the Bose QC35 but I found them unsatisfying when in an open office. They do filter out the noise from the HVAC system which is nice.

I mostly use them when commuting by bus or walking in the street.
I Built a $300K/Year Online Flip Flop Shop
I wonder how much the ”everyone knows not to do that” attitude to safeguards has cost in total, in money and/or human lifes.
You can heat and cook food during a prolonged power outage, but that's kind of it as far as "essential" goes.
There's the big red X over the HTTPS icon in the address bar in Chrome and I'm pretty sure there's something similar done to the padlock icon in Firefox, no?
Show HN: Ascend.io – Smarter Data Pipelines
Hi HN,

I’m Sean, the founder of Ascend.io (https://www.ascend.io). I’m really excited to post here and announce the launch of Ascend.io, a radical new way of designing, scaling, and automating data pipelines. Ascend is the result of nearly 4 years of development effort for a team that is now 30-strong, and I would love for you to give it a test drive and let me what you think.

I’ve felt this pain since I wrote my first MapReduce in 2004 (using Sawzall @ Google), and in the 15 years since, things have not improved at the pace of other parts of the technology ecosystem. When I went about trying to fix this, I took a page from other technologies, particularly the migration to declarative models such as those found in React and Kubernetes.

With Ascend, you just declare what you want the end-state of your data to be and the Dataflow Control Plane automates the orchestration, infrastructure, and persistence to make it happen. Data can arrive late, schemas can shift, logic can be updated, and the control plane generates new pipelines to propagate, backfill, and repair existing datasets. With this approach, pipelines take a lot less code to build (current record is reducing LOC from 100k to 2k), they break less, and you get to actually sleep through the night without being paged.

I certainly think this is a huge step forward for the world of pipeline development and making pipelines suck less. But, I really want to know what you all think! Anyone who is interested, I can get you setup with a free trial (https://www.ascend.io/get-started). Can’t wait to hear the feedback!

~Sean
I think a lot of landlords are slumlords without even realizing it then. Landlords whine and scream and sound the alarm that shit will hit the fan when cities try to limit rent increases to a generous 5% to keep pace with actual wage growth. Yet to the landlord, did their costs even increase at all the year they jacked the rent? In CA, their taxes remained the same as when they bought the place. Hiring laborers to upkeep the property has always been about hiring from the very bottom of the handiman market, a market that also has not seen wage growth.

So if all the landlords costs do not rise all that much, why do they feel justified to raise rents sometimes well over 10% a year? The only reason is to fatten the wallet by milking the tenants, and we've hit a point where in some cases the working class has to commute 4 hours a day in desperate effort to find a job that pays the exorbitant rent.
> I think this CA should be blacklisted by Mozilla and Firefox should not accept it at all even user installed it manually.

> This will save privacy of all Internet users in Kazakhstan.

No. This will mean that users would simply switch to chrome, edge, brave, ... , n + 1.

In case all of them block this CA, the government will force people to install an older version or will patch any open source browser so that it works with their certificates.

IMO, this is also wrong from a philosophical point of view. Your browser should just be your browser and not take part in political disputes. It doesn't sit well with me that Firefox has anything to say in the politics of its users.

And finally, encryption doesn't solve violence.
The app exists and is going to be banned from google play in the next few days.

It wasn't yet submitted to F-Droid when this piece was published.
Oh I agree 100%. It just makes me sad that governments keep trying to spy and we have to keep coming up with new technology to make that harder.
Exactly - this is why we don't want to train people that non-TLS traffic is insecure, but rather keep them from encountering it, ever, ideally. TLS must be the default- a baseline- and deviating from that baseline must be at least as hard as getting a user to install a malicious extension.

Ever SSHed into a server and been told by your SSH client that, oh, by the way, the server is using the NULL cipher with no authentication, and network attackers can mess with your session arbitrarily? Probably not. That's what using plaintext HTTP should feel like.
I hope they pin on the key, not the certificate. For a mobile app I worked on, I had it pin the public key on the leaf certificate and indeed it would fail to connect in this scenario.
I was hoping the smart people of HN would be able to read between the lines, but I guess not.
It is a valid point, it becomes much more obvious that you're snooping if you're trying to MITM. If you weren't snooping, you wouldn't bother trying.
Of course, and there's no reason to write such code.

I just dislike that the simple syntax rule "any expression can be used as a statement" now has an exception.

I haven't been able to think of scenarios where that might have consequences (code generation or refactoring tools?) but that doesn't say much as I'm not that smart.

Edit: having looked at the cases that are disallowed, they remind me of generator expressions. Those are usually written with parens, that can optionally be omitted in some cases. := is the same except they can be omitted in so many cases that it's easier to list the cases where they can't.

I think a generator expression used as a statement already requires the parens, even though they can be omitted e.g. as a single parameter of a function call. So that's probably ok then.
This sounds very familiar. Oh yeah, 4 years ago:

https://bugzilla.mozilla.org/show_bug.cgi?id=1232689
Sorry if too OT, but I wished we used stuff like this more in the US. Stick construction is really bad at noise and vibration isolation.
agreed, you still see clever c hacks today in the embedded world, because resources are still constrained for many devices
One thing I really hope they fix is the timeline is very jumpy when new tweets come in from the top.

The previous design was very good about keeping whatever tweet you were scrolled to in focus when new tweets come in.

I'm not sure how widespread this issue it, but I have seen other people in my personal feed express frustration with this issue.
Why? It’s been deprecated for years and years. You don’t have to set any of the other 20 CSP options to set CSP:frame-ancestors. There’s no reason to avoid it except taking a completionist approach to CSP headers (“we have to set all possible CSP attributes for maximum security in a single go on our first try”) which I strongly discourage.
BBC reporter documents his own cutting-edge 'proton beam' eye cancer treatment
A subset is all I was thinking really. Perhaps starting with the kernel.
I envy you. There are complains of Firefox on macs on most Firefox-related threads. Ignore the titles and search comments in recent threads with significant number of comments: https://www.google.com/search?q=site:news.ycombinator.com+fi...

On my machine at current gig it crashes every other day making me lose my containers. It doesn't overheat the machine like some others reported though.