skysight-inc/HackerNews huggingface dataset:
> Not just updates that you initiate yourself, though -- I think the idea is that any other app on the system could backdoor the JS in the ASAR at any time. That's pretty hard to defend against.

Good point, but if the attacker has filesystem access you're already hosed. I suppose there could be some other risk where the ASAR could be modified without full FS access? But I'd want to know what that attack is, if that's the case.
Man as a scientist with secure funding for life, who works with sociologists and psychologists, I frankly don't give a shit what gen pop thinks. The results will come when they come. Learning and progress takes time, due to which a large part of the population is always going to misunderstand the process.
The cows have a big environmental impact.
And it's far from negligble.
They generate a lot of methane.
So if you're using Steam streaming and the session switches to the secure desktop due to a UAC prompt, what happens... does the screen just go blank (a la VNC), leaving the remote user locked out?
If only WW2 lasted another 5yrs I'm curious what else would have been accomplished in that timeframe. They were all just starting to perfect some advanced technology.

The motivation from people dying and patrotic goals, combined with budget (but a constrained one) and every person in the country attempting to contribute to the effort seems like a good recipe for new technology development. Especially for finding the stuff that will actually do something useful today and not in 10yrs, since it was already needed yesterday.

Obviously the costs of the war outplay the value from this but it's interesting to think about.
Does anyone have any thoughts on heterodox ways to go the other direction? I'm a software engineer with an interest in the law and I always wondered what sorts of opportunities there were for someone like me.

What's a good way for an consultant engineer to pick up a law firm as a client? What kind of open source community is there for legal software?
Anything important will make the news.
Sickle cell anemia wasn't imposed via law.
I think it was a joke
> Microsoft is the only consumer OS vendor that still supports C++ for doing full stack GUI apps

On modern Windows you have C++, and also layout DSL, specifically XAML. And that C++ is not particularly idiomatic, it’s IUnknown-derived interfaces.

If you mean windows desktop, WinAPI uses quite a few DSLs. Dialog and menu resources are the most obvious, but there’s more: WMF/EMF vector graphics format, ribbon markup XML for ribbon control, theme files…
I did this with some considerable success. But I found out that it trains different abilities. Naturally, reading a new language and comprehending comes faster than being able to speak it. As far as reading and recognizing words go, it helped. Didn't help much with my speaking ability, which is the real thing I wanted.
By that reasoning, no one should criticize Electron because VS Code (and a few others) have managed to make it performant.

My comment was partly tongue-in-cheek, but the kernel of truth in it is this: a good UI tool makes it easy to build what you want without sacrificing speed, not hard.

Electron makes it incredibly hard (though still possible). I'd be interested to know how much better of a balance Qt strikes.
Four Ways Binge-Watching Hurts Your Brain
Honestly, when you're riding tsunami you only worry about staying on the board. How could he have turned that dumpster fire around?
And how are the typical daily parking rates?
The only thing worse than Amazon delivery is FedEx. The idiots can't find a road that's almost three years old and constantly attempt to deliver packages to the other side of the city. It has led to numerous problems. Calling doesn't help. The next day, they repeat the same mistake. And the next. And the next until the package is finally sent back. Managers there can't help and they never fix their system. Too bad other retailers think this is still a viable option, a delivery service that can't find an entire street. The pizza delivery guy doesn't have a problem and neither does ups, usps. Amazon's own delivery has similar issues but they seem to have corrected after a few tries although they have other intractable issues.
Also of interest is the follow-on discussion [1] taking place on the electron/asar repo.

[1] https://github.com/electron/asar/issues/123
Neither was Issac Newton. But the public listened to them most intently when they said something that they knew would get them in trouble. Every other ‘scientist’ of the day that spent their lives on elaborate self-serving proofs of their institution’s dogma, is long gone and completely forgotten. We are right to be suspicious of these people.
> If the attacker has filesystem access you're already hosed.

I think that's not supposed to be true in modern (e.g. latest macOS) threat models. App Y isn't permitted to just replace App X unannounced, and on both Mac and Win there's a large codesigning infrastructure in place to provide that protection.
Your opinion is backed up by polls: https://news.gallup.com/poll/231530/global-warming-concern-s...
The Contextis site was overloaded at submission time (and is currently as well)

Here is the Google Cache link
https://webcache.googleusercontent.com/search?q=cache:xeIOGz...
> After two rejections,[4] he was shown a demonstration set that Charles Babbage’s son had given to Harvard University 70 years earlier. This led him to study Babbage and to add references of the Analytical Engine to his proposal

It's amazing how old rediscovering old ideas can create scientific/technology revolutions.
Lots of places have multiple names, that come and go as the surrounding areas grow and merge, and sometimes de-merge as the new 'big area' merges with somewhere else and what was once a village name becomes an 'area' name. Sometimes you get artifacts like train stations or named parks left behind.
I don’t care about any one in particular.

I am concerned about the significant scale at which this is happening.
Electron co-maintainer here, so I'm a bit biased.

1) We should absolutely work towards allowing developers to sign their JavaScript.

2) Re-packaging apps and including some menacing component as a threat vector isn't really all that unique. We should ensure that you can sign "the whole" app, but once we've done that, an attacker could still take the whole thing, modify or add code, and repackage. We sadly know that getting Windows SmartScreen and macOS to accept a code signature doesn't necessarily require exposing your identity and I'd _suggest_ that most people don't _actually_ check who've signed their code.

3) If you ship your app as a setup bundle (say, an AppSetup.exe, an App.dmg, or rpm/deb files), you should code-sign the whole thing, which completely sidesteps this issue. The same is true if you use the Mac App Store, Windows Store, or Snapcraft Store.
This makes me think of an even more straightforward attack. How hard would it be to actually just ship them computer hardware and hope it makes it into the system?

I mean, if a package that looks like it came from NewEgg containing a router shows up, especially if it matches the type the company usually uses, which wouldn't be too hard to figure out, what are the chances it just gets tossed on a shelf to be used next time one is needed? Or do companies have sophisticated controls in place for something like that?
The primary purpose of the code we write is/should be to serve a function. Being legible to others is a secondary aspect.

In terms of cost/benefit, the cost of the programmer time in debugging far outweighs the cost of executing the code.

If the function the code is supposed to fulfill is immoral

Two wrongs don't make a right. Whistleblowing is to be preferred to sabotage.
Right, like I say I can show both of those things separately, but I can't demonstrate that they're correlated.

How would you go about finding that evidence? What would be sufficient evidence that they're correlated for you?
A national experiment reveals where a growth mindset improves achievement
Corrosion and scale.

Plastic takes a long time to visibly degrade and is pretty smooth using cheap processes.
>Really, did you measure it? Since we are, scientists and everything? Where are the numbers?

This remark should (also) have been directed at his parent comment, who made the contrary claim without any measurement either.

> Second, if you think the "parsing a XML UI declaration" is in any meaningful way more expensive that imperatively calling a bunch of UI functions directly, you have a distorted idea of what makes a UI slow, or of the time needed to parse an XML file and initialized controls based on it...

The numbers?
I had an idea to do exactly this but I never did it
Yes, I've been doing this since I saw it in the BSD source back in the '80s.
Rainbow tables don't work here because the password is salted.
There are plastics made without plasticizes. Polyethylene most commonly (what soda bottles are made of). Also polypropylene.
I'm unclear about how this attack works. The article says:

> attackers could backdoor applications and then redistribute them

Most distribution mechanisms however ship a single signed bundle, containing & thereby signing the entire application, including resources like ASARs. Any that don't sign the application are of course vulnerable to all sorts of trivial attacks (replace the whole binary with anything you like).

To make this a danger from a distribution POV, it seems you would need the application to be partly signed; i.e. the executable but not the included resources. Where does that happen?

For macOS for example, all resources (including ASAR files) are signed, and macOS makes it intentionally difficult to install anything that isn't signed.

Similarly for Windows you'll see large warnings if you open an unsigned application; Electron apps are almost always distributed as a single signed installer exe file, including the ASAR file.

On Linux it depends wildly, but most of the time either the entire package (e.g. a deb from the official repos) is signed, or nothing is signed and you're vulnerable regardless.

What am I missing?

(I'm not addressing the risk of altering an already-installed application - that's a separate attack also mentioned, but requires local access to rewrite files on the target machine, at which stage there's many other options)

EDIT: URL has now been updated, here I'm discussing points from https://arstechnica.com/information-technology/2019/08/skype.... The post now referenced doesn't mention redistribution, and I suspect that in fact Ars is wrong, and allowing signed redistribution of subverted versions isn't a real vulnerability here. I'd love to hear if I'm wrong though!
Pronounced 'uh-CHA-fuh-LIE-uh,' for anyone curious. CHA like CHApstick. At least, if you're speaking in the kind of accent used with great frequency in this story.
Moderated. Not regulated.

You could spread your message further by printing lots of posters and putting them up in your city, but it would obviously not be comparable in reach to the Internet. Newspapers that do have reach comparable to the Internet all choose to exercise their legal right to decide for themselves what is too hateful to spread. Cloudflare has now chosen to exercise that same right, to a tiny extent.
XQ Super School Voted Down by Somerville School Committee
What about the potential technical debt and additional manpower it requires to build out per-platform desktop applications.

Easy is a priority for many OSS projects and companies who want to ship something quick and reliable.
> It makes cross-platform desktop development much easier.

That is literally how Adobe Air was billed
i get all that, and i'm not against this change generally, but i'm wondering about whether the savings are actually passed-through or does the developer/owner capture that value? i'm skeptical that (most of) the savings accrues to the renter.
Having done a handful of red teams our last concern was security cameras since most times no one looks at security footage until they’re already compromised.
My default expectation is not zero deaths in surgery. Shit happens.

My expectation is that there should be exactly zero surgical instruments that get left inside the bodies of patients, when they are sown up, or zero cases of the wrong organ being removed.

And yet, there's >1,000 cases a year of the former, in the US alone.
But surely there are a much smaller number of Unix computers running sendmail these days? And sendmail is a lot more secure now than it was 30 years ago. Doesn't seem like a fair comparison IMHO...
It didn't used to be an elitist school of thought, because a school of thinking on the subject wasn't needed. There were high enough fences to keep the riff-raff out (high transaction fees, inaccessible markets for commoners, et. al.). Thanks to e-Trade, Schwab, and the like, those fences got torn down, not knowing those fences not only kept people out, but they also kept the bad things in. Bad things like super-duper sketchy penny tech stocks (HMNY).

Elitist? Meh, no more elitist than, say, a climbing permit for Mt. St. Helens (which is just $15 and fill out a form). Put up even a token barrier, even if it can easily hopped over.
The Pragmatic Designer: Ignore, Refactor, or Rewrite
FCC finally gets around to denying net neutrality complaint against Verizon
Yes, according to Wikipedia. Also, there's a reason why Jobs killed the Newton.
What's your address? I can send it on a usb key.
They deal with one photon at a time. The total number of events that are used to estimate probabilities usually number in the hundreds or thousands, usually collected over the course of hours or days.
Considering how all money streams for MoviePass depend on domestic card transactions which generate 100% auditable records... I'm completely failing to see how it could possibly result in money laundering or tax evasion.

Can you explain how? I don't see any obvious explanation in the articles you linked.
I think this is already happening.

I could be wrong but I vaguely remember something along those lines
I wish Amazon would add a $1-3 variable shipping charge to 2 day shipping (which is already very cheap) which gets pooled and awarded to the delivery people based on performance metrics (complaints, delivery times, damaged packages).
If you want to apply this advice practically, instead of using and trusting any of the various password managers out there, use a brain-stored hash algorithm for all password management. For example your hash could be <some secret phrase> + the last 4 letters of the website/service being visited, with the last 2 letters flipped. Combine the phrase in some non-intuitive way.

Only other considerations are to have a more basic hash for certain financial websites/insurance companies (cough Allstate) that for some reason think an 11-character max password is still okay in this millenium, and to have a method of "incrementing" the password in case you have a service that forces rotations. The only reason to write the hash down is for financial service access in the case of estate planning - store it securely/safely, of course.

Ever since switching to this, I've found it's even more convenient than a password manager. You get used to running your hash in a very short time, and don't need to have access to an electronic device to recall a password.
Theoretically, that would be part of the stress of the job.
under a paywall
> Can anyone comment on B? Is it safe to microwave plastics if they're not touching food?

Depends how things leach out of the plastics. Is it outgassing?
The wealth you describe is now summarized as the “boomers” by the generation Z. Basically, the ability to be branch manager while typing with only two fingers (It won’t be possible to have such a career anymore with 7M people on Earth), while the kid struggles getting a flatshare after passing a masters’ degree. The generation that lived through full employment, bought a house for way less relative money than today, while all they left their kids with was govt debt and a polluted earth. All the while believing the Carpe Diem philosophy will “get you through tough times.”

I don’t even agree that much with those clichés (they had their sets of challenges, plus I’m Gen X) but it’s extremely important to remain aware of the various trends of the new generations.

Example with a popular symbol: https://www.bitchute.com/video/_16B2euF128/
Thanks, and good suggestion!

I put together a gist with the currently supported services: https://gist.github.com/gsoltis/302b3e60d385854a9a5158d0c071...
What New Research Says About Race and Police Shootings
Something to be aware of, but we definitely aren't hurting for dogs or more humans.
It's the opposite -- companies lack sophisticated controls and without impetus they'd just never get the item into teh right place to use the item.

Maybe if you shipped it at the same time someone was expecting it, you could get it to someone who knew what to do with it. Or ship it to the newegg/amazon warehouse to get mixed in with regular deliveries.
Earth’s Magnetic Field Reversal Took Three Times Longer Than Thought
> My point is about recognizing the individual influence one has

How is that not essentially zero, in most political circumstances and for non-extraordinary individuals? That's my point.

[EDIT] and further:

> That is again a rather condescending spin you are giving to it.

I think I'm giving it a pretty fair shake by acknowledging there's any laudable purpose to actions of personal behavioral choice on large political problems. There is, but it has little to do with effecting change, if that's the part that's important.
I never did (I only played with Rust for a bit), so this doesn't answer the question. But realistically, the performance is almost certainly indistinguishable from C/C++, the bottleneck will be in the IO. The compiled code should look almost the same. (I don't remember if rust is using LLVM IR at some stage, but even so).

And given the advantages of Rust over C/C++ in terms of PL functionality, type system etc, I'd say it's worth it (unless you haven't already invested the effort to become proficient in it, and you're already happy with C/C++).
I've never heard overbooking announcements with discount airlines (easyJet, Ryanair). I wonder if they just don't overbook or somehow handle the situation better.
Wow that's pretty cool. This was the first thing that came out: http://r.weavesilk.com/?v=4&id=drz2p5fz9r9
We Share and Reuse Code Between Microservices with Bit
From an HN comment from today that I've added to my favorites:
"It feels as though much of tech has gone from helping people accomplish their goals efficiently to a business model of extracting rents while providing no or little value."

I quote it because your comment made me think, "where have I recently heard that before?" :-)
As a free speech absolutist you should support Youtube or Twitter's right to ban who they wish from their platform. What about their right to free speech?
Well, ironically Lambda School uses Webflow (https://twitter.com/austen/status/1159145385891205120), so it's not just "mom and pop" small businesses that are customers. If anything, those businesses would be better served using something like SquareSpace or Wix, not Webflow.
How does eating healthy food, exercise and not sitting on your ass all day compare to this? I suspect healthy food and exercise would provide significantly more benefit than stressing over your contact with plastics especially when most people don't eat very healthy and don't exercise much.
Good luck avoiding it. Even IF you don't prepare your own food with plastics there's a very good chance that the food you're eating came into contact with plasticizers during its cultivation, preparation, or packaging process.

There was a woman a while back to went to extreme measures to avoid plastics. After 1 year of doing everything she could to avoid plastics, they STILL found plasticizers in her blood. Wish I could find the article...
> I don't know what you're talking about. You said it is wrong to assume humans are different from animals, which makes this case a case of animals (humans) causing suffering in other animals (cows).

I'm making a claim about what humans should and shouldn't do to cows, namely that we shouldn't torture them. The behavior of some kind of predator does towards its prey is not relevant.

> If I crapped gold, I would be rich. That doesn't mean you can assume I am rich. You can't make a convincing argument by basing your assumptions in fantasy.

You found a loophole in thousands of years of logical reasoning! Hypotheticals aren't real or useful in thinking and communicating, who knew!!

> What? No. This has nothing to do with parent-child relationships, it has to do with the fact that humans teach and write and communicate ideas across long periods of time. If you take away the ability of humans to communicate and teach each other, then their suffering will be comparable to animal suffering. If you teach cows to read and write, they will stop being treated like animals.

By your reasoning, then, it's actually the torture victims writing about it who are causing the reverberating suffering. If they didn't opt to communicate and teach, their suffering would be fine. Maybe after you've finished convincing everyone to torture animals you can start to shame the writing of memoirs by torture victims?
It's in vogue to describe a business you don't understand as "money laundering" even when you don't understand money laundering.
Is low quality sperm permanent, or does the quality increase after the behaviors are stopped?
Or bite the bullet and leave facebook. Your friends won’t vaporize.
Hacking obsolete protocols is shooting fish in a barrel.

Classy hackers hack modern protocols like WPA 3.

https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access#Dragonb...
You remind me of the old joke (based on a true story, I'm told):

As the New Guinea man said to the missionary, "If God didn't want us to eat people He wouldn't have made us out of meat."
Autodesk Maya 2019 is one pretty good example off the top of my head
I suppose it depends on the theater location?
Verizon didn't violate the old net neutrality rules, Verizon's FCC says.
Doesn’t the fact that MoviePass failed show that the economy is naturally filtering out those bad ideas?
Oil built Saudi Arabia – will a lack of water destroy it?
Where are all the free-speech zealots from the "CloudFlare shuts down 8chan" thread?
I wish they'd call for directions. Instead they go to the wrong place, can't find the house, and return back. The next day, they do it again. And again. The managers said they have no control over it. That's not a delivery service. That's just idiots with a truck wasting gas.
Lyrics are written or spoken components of songs and songs (with vocalizations) are poetry.

Poetry is an artistic expression of ideas and feelings.

I suppose all songwriters could preface their music with : "I plead the 5th amendment"
> ... because for the foreseeable future, the absolute worst case is my grandparents can outwallk climate change coastal changes ...

For someone who starts their argument with "climate science is imperfect and we don't know which model will predict the future correctly," you seem to have a lot of confidence on your "absolute worst case" which looks like, honestly, pulled out of thin air.
The transistor of course was 1947, so that five year addition wouldn't have pulled it forward much. I think there was a lot that could have been done with WW2 budgets + desperation to force the arrival of the microprocessor forward from 1971 by many years, 10-15 years faster perhaps.
> I'd be less concerned about SSID's not being unique as I am about the fact that the SSID of a specific target is trivial to obtain and almost never changed.

Salts don't need to be secret, only unique. In fact, in this case the unauthenticated client needs to be able to compute the PMK from the password alone, so you can't keep it on the AP.
Hundreds of Short Videos of Everyday Life in Japan in the 90s