skysight-inc/HackerNews huggingface dataset:
Yes, but the reason for that is because the subclasses didn't recognize that they were expected to conform to secure coding. Because subclasses inherit the value of the class flag supportsSecureCoding without any obvious indication of that.

The problem is that the core design of NSCodable (and NSSEcureCoding) is that the serialized data get to specify the type to instantiate, and the way supportsSecureCoding is exposed means that the claim to secure coding is inherited.

The former is a fairly common problem in serialization systems, and the security flaws in that approach resulted in the subsequent NSSecureCoding APIs.

The latter is a byproduct of how secure coding is implemented, and it results in any user of NSSecureCoding needing to be aware of all classes that may be transitively pulled into their address space. The subclassing semantics means that even the explicit list of allowed classes is not sufficiently robust - e.g '@interface ArbitraryInsecureClass : NSData' means ArbitraryInsecureClass can be instantiated if you allow NSData in the secure coding list, and ArbitraryInsecureClass could be declared in some transitively included framework, and is generally leaked implementation details.

These are all "fixable" for some value of fixable constrained by binary compatibility (though some of it could be mitigated by Darwin's linked-on-or-after mechanisms). There are a variety of steps that Apple could take that would make the entire NSCoding mechanism much more safe/secure without (afaict) necessarily breaking anything, though obviously I don't have access to the compatibility information they probably have.

Things I would do (if I were king?):

* Compiler warning when you subclass a class that declared supportsSecureCoding

* Make the allowed classes restrict to explicit classes rather than just conforming classes (e.g. if you say NSData you can't instantiate a subclass of NSData) - I would give good odds of this breaking things

* Rather than just checking the value of TargetClass.supportsSecureCoding I'd query the runtime to require supportsSecureCoding being a direct class member of TargetClass

* I would consider adding a "+property secureClass: Class" (or whatever the syntax is) that is instantiated, so even if you aren't using secure coding you end up instantiating a sane type - though it would be "optional" due to existing code and objects not having the property. But then at least Apple could go through the core types in Foundation (Array, Data, String, etc) and make it so you would only ever instantiate understood classes.

This would make the API slightly less footgun heavy.
Maintained by a single person, but I doubt that individual is irreplaceable as maintainer.

One reason we get so much bang-for-the-buck with software is that the maintenance costs for a given software package aren't necessarily proportional to the number of places/times it gets used.
The with(proxy) pattern is super clever. It looks like that was created by someone else. Kudos to whoever came up with it. It’s a really nice hack.
Hell, c11 has ghetto generics.
Right, that’s also the case for comma in JS.
Can anyone explain how / why the Firemen's retirement system is involved in this?

> As Frankel wrote in her article, the lawsuit, which was originally filed by the Firemen’s Retirement System of St. Louis, could be worth billions:
Interesting, I wonder if that is driven from a business aspect or as I suspect - some data regulatory aspect. Can easily see why they would not want to keep data on somebody who had in effect canceled there subscription.

May I ask, with netflix - do you cancel your account or just suspend subscription and just re-enable with your account later? Not used the service but trying to ascertain if it's a case of paused subscription or canceled account to achieve that. As if the later case, then I'd say it is due to your GDPR, data protection acts throughout the World and they are working with best interests, albeit against the grain in this instance. Solution would be the ability to export and import history - pushing the data retention aspect for the customer firmly into the customers hands. Again I see no business case for them doing this other than outlined and be more in there interest to retain said data in case you did resub.

EDIT ADD - had a look and you can export your viewing history, though no ability to import later that I can see, did raise it on feedback with them, maybe it will change.
https://help.netflix.com/en/node/101917
IIRC, clisp worked just fine without GNU readline. https://www.gnu.org/software/clisp/impnotes/readline-mod.htm...

If Lispworks writes a compatibility layer that allows SLIME to work with Lispworks, they are not causing Lispworks to infringe on the Emacs software license.

(Side note: for your hypothetical website critiquing another copyrighted work, there is a somewhat unclear [in the sense that it's facts and circumstances dependent] fair use doctrine in the US that almost surely allows genuine critique of that work to include relevant snippets [while disallowing copying the work in its entirety under guise of critiquing it]. https://en.wikipedia.org/wiki/Fair_use#U.S._fair_use_factors )
There were quite a few sites with that level of polish on free hosting services at the time. Usually by people who either didn't have the means to pay for hosting/a domain name or simply didn't see the need to at that time. Came across quite a few of them when I used AOL's free hosting back in the early 90s, or Tripod/Angelfire/whatever.
It took two years before the baby slept through the night? That's almost more terrifying.
How can they determine a proper bail for a person they are trying to vet in the first place? If El Chapo showed up I don't think he would care much.
Handling User-Submitted Content with Django
Eh... it's turning out that Netflix just introduced a new medium for cable.

Now that every content owner is starting their own services, we're losing the thing that made Netflix revolutionary: loads of quality and diverse content under one subscription.

Personally, the shows I'm interested in are spread across a half dozen services... and only one or two really warrant full engagement (versus "background entertainment")... so obviously it's back to bittorrent for me.
Yes, they clamped down on Chinese quotas, but not foreigner quotas. Your comment:

> --a lot of non-Chinese companies immediately backed off on Chinese investments (i.e., factories, etc.)

That meant foreign companies on Chinese investments, not Chinese companies on foreign investments, right?
Yep -- Starbucks and similar typically hold these in big banks, who pay interest on the deposits.

They're called "brokered deposits" in finance, and they have all kinds of restrictions. Banks like them because they have predictable stability to lend against.
I need the simple English version on what exactly this lawsuit is about.
Probably just the first ones to pull the trigger. I don’t understand what the lawsuit is about though, seems like they are just complaining about performance of the acquisition? People just drunk on Oracle koolaid?
Does that test replace targeted ads with contextually relevant ones?
Using Steamspy to just declare how much money he has made and that it is enough to support his family, continue development and hire someone for more art direction when the entire article is about he doesn't have enough money to hire someone is exactly why he wrote this article.

People keep posting in the thread that games with "bad art" still look good with "good art direction" but art direction also costs money, which he still doesn't have.
Iframes are good, they are the best way for encapsulation of content.
Sorry, I don't really understand from the article: how exactly did the accused supposedly break fiduciary obligations? Does it solely have to do with Larry's previous involvement in NetSuite?
I feel like oocities.org has way more archived (except my Final Fantasy page from 1998).
This particular title matches a lot of stories for obvious reasons. I'm not sure exact-querying would be better in general.
What? In what way? Genetically? I mean, I suppose, but do you really care about that? Passing on your beliefs / values? This rarely even makes it a single generation, and why can't you do this by simply making an impression on people around you?

I don't think anyone should have children because it helps them come to terms with their own mortality.
> what makes you think HN is not full of bots?

Exactly. Turn on show dead and look at the new page sometimes. There's a bit of spam there. Although much less recently! I suspect some new automation was added to remove the blatant entries.
Interesting. This came up in the local paper a while back: https://www.bendbulletin.com/localstate/6536506-151/building...
The biggest game changer for me with streaming is I watch less TV. Before streaming I either had to maintain a complex balance with my never large enough DVR or watch shows when the network decided (I'm looking at you Channel 9 in Australia putting Star Trek on at 11pm on Tuesday and Thursday nights). Before that I had VHS, so many VHS.

With streaming I watch maybe an hour or two at most, then I stop, confident I can pickup whenever (and increasingly wherever I want). I don't worry about my wife deleting my Star Trek for her Firefly.

Unlike DVDs we can catch up on an episode of a shared show while traveling.

Though I did get hooked on a Netflix show in the UK that isn't available in Australia, four weeks later I can't even remember the title.
Calling it lowest ever means that you can get more yuans than ever in 11 years for 1 dollar. If you look at the chart, it clearly shows that this is the maximum yuan amount you can get for 1 USD in at least 5 years.
Can you elaborate? I work on a Spring Boot application and so far we're all pretty happy with it. Obviously I'm one data point, so I'd like to hear more about what you're seeing.
TL;DR: This guide written by Brian Mee (member of British Orienteering Federation) originally for design printed orienteering maps, but would be useful for creators of any type of maps.

FTR, I would recommend to try OpenOrienteering Mapper[0] app (desktop publishing software for cartography) if you need free & open-source tool for draw orienteering maps (or other types of vector+raster maps) and prepare it for printing or export it in many different raster and vector formats (powered by GDAL lib), including PDF with CMYK or Spot color separation.

Mapper sources available on GitHub[1] and binary builds provided for Linux, Mac OS, Windows and Android (including Android-x86).

[0] https://www.openorienteering.org/apps/mapper/

[1] https://github.com/openorienteering/mapper
Hispanic Woman in a Dark Blue Sleevless Shirt
A woman in a dark blue sleeveless shirt and black hair in a ponytail is being prejudice towards people for no reason at a wholesale store in Palm Desert California.
Sure but that's the same story with helos as well. The A-10 definitely has a valid role in conflicts like Iraq / Afghanistan.
What do you mean by recently? We did do a bunch of new work on this and I'm curious if you noticed its effects.
Interesting -- I actually see three different versions of the splash screen at that first link! (One with red text on a gray background and 1.0 graphics, one with blue text on a gray background and 1.0 graphics, and one with gray text on a gray background and 2.0 graphics.) There's also two different 3D-rendered splash screens.
I think the gist is that Oracle vastly overpaid for Netsuite in order to enrich Larry.
Brilliant!

The algorithm looks pretty lousy. Even so, it's a big improvement.

With a really good algorithm, I bet you could get much better results (source: I do similar stuff with a 3d pen). I hope this triggers a rush of researchers seeking to one-up each other. This could get super-impressive if it copied what human artists do, or surpass it.

This is one of those things I (and probably a million other people) feel dumb for not having thought of before. It's so obvious in hindsight.
this is how I feel about every Geocities archive I've seen...everything except MY page. Mine was up well into 2001, but the Wayback Machine is the only site that has even a trace of it.
For me this future has already arrived. Yesterday I cancelled Netflix because I realized that even if I pay money each month for legal content, I still have to pirate the content that is not on Netflix. Asking people to subscribe to multiple streaming services is not just expensive but also crazy inconvenient.

By contrast the music industry manages to cooperate and get their content available across the various streaming services and consequently I haven't pirated music for a long long time.
Per the Reuters article [0], it sounds like Ellison had a vested interest (of the financial variety) in Oracle acquiring NetSuite at a premium unreasonably higher than NetSuite's actual value, so that's why the shareholders are suing him.

[0]: https://www.reuters.com/article/otc-oracle-idUSKCN1V91UJ
iMessage has a large base of existing users that need to be able to continue to use messages, and presumably it was thought that by restricting with the NSSecureCoding API it would be safe, but as you say any API where the remote specifies the class to instantiate is going to be something of a footgun.

iMessage also predates MessagePack, BSON, and many of the other now "common" and "obvious" serialization formats, so you're (kind of) saying "why didn't it use a format that didn't exist".

The reality of course is that in addition to everything else NSCoding is the language supported serialization system, and not using it would have been an example of "reinventing the wheel". The reality is that the engineers using NSCoding + NSSecureCoding quite reasonably expected it to actually be secure (it's right in the title).

All those things aside it irks me that any of the message processing happens in the springboard process rather than a separate sandboxed process that doesn't have essentially complete access to everything that exists.
>Valve seems to be pretty explicit about the fact that the issue was due to bad rules over what is and isn't in scope.

I could perhaps forgive a misunderstanding over fringe-cases or a company that is new to the H1 platform. However, we are talking about a LPE in this case, with a company who has themselves bragged about their familiarity with the platform. I would expect that they would spend some time checking their scope for something like LPE's and making sure it is crystal clear.

>Un-banning the researcher is one HackerOne's end, isn't it?

I was under the impression that each corporation running a bounty is in charge of allowing or disallowing users to their specific bounty, not H1. But to be fair, I'm not positive of this.

I understand you may think I'm being hard on Valve, but given how many computers the Steam Client is installed on, the age and size of the company, their familiarity with H1, their past responses to situations like this, not attempting to get in touch with the researcher they said it was a mistake to turn away (and there was a 2nd researcher turned away), and the half-hearted response - I simply can't understand making excuses for them. They should be held to a higher standard than Ma and Pa's coffee shop.

They do not appear to be acting in good faith, but rather trying to put out a fire and sweep it under the rug.

Edit:

To pile on, here is an open letter sent to Valve in 2014. This is not a new pattern for Valve.

https://steamdb.info/blog/valve-security-open-letter/

An excerpt:

"This letter is collaboratively written by various members of Steam’s developer community regarding our concerns with Valve security behaviours, in particular Valve’s inconsistency in rewarding those who report bugs (occasionally punishing people), the speed at which Valve addresses bug reports (if at all), and the problems users face attempting to report bugs to Valve"
There are lots of filters based on past activity by spammers, trolls, and so on. But in the scenario you describe, moderators would eventually review your comment and restore it to visibility, assuming it wasn't bad in some noteworthy way.

Users with 'showdead' turned on in their profile (and who have karma > 30) can do the same: if you see a [dead] post that shouldn't be dead, you should vouch for it by clicking on its timestamp, then clicking 'vouch' at the top of its page. This is why we added that feature.
I also wanted to comment here. Cheering you on. Working with a professional has been the biggest relief for me. It's absolutely worth the money if you can afford it (and you can always ask if therapists could offer "sliding scale" meaning they charge less for folks that can't afford the full price). I went on Psychology Today's website and used their listing of therapists. It was scary emailing the first one but I did it and I showed up to the appointment. Now years later I am no longer drinking and have all sorts of tools for my anxiety. You can do this.
Ironic; even Oracle execs ain't immune to being sued by Oracle.
Except clisp is quite useful without readline; cmucl (a contemporary lisp implementation) lacked any readline support.

Extending this, if someone made an API compatible BSD licensed readline clone, and the configure script will link with either that or the GNU readline, depending on what is in the system, would that still need to be GPL'd?

clisp itself ended up being moot because the author was happy to use the GPL and if they hadn't they could have just removed the readline support, but it is an interesting corner case of the law.
George Jackson, Angela Davis at Attica and San Quentin Prisons [video]
> why can't you do this by simply making an impression on people around you?

It's easier to make an impression on someone if you are nearly constantly around them through their most impressionable years, starting at or near birth.

If you aren't the actual (natural or adoptive) parent, the actual parents will probably get tired of you trying to do this relatively quickly, unless you have an unusual relationship with them.
Thanks for the pointer. I’d like to keep mine free and open-source for now.

I hope the newsletter is friendly enough for beginners too. I also have https://github.com/hoanhan101/ultimate-go for learning Go better and faster.
I have to agree with you. Without research, JWT is basically a foot-gun. I was aware of these issues from reading like-articles about JWT in the past. We work with a security engineer to try to ensure we're using JWTs appropriately.

One can argue that any generic tool can be used in an insecure fashion - common one is JSON.parse() in Javascript. By default, it's susceptible to prototype pollution. I can guarantee you that most devs will use that call on user input without appropriate sanitization.

Just like how the JWT spec hasn't been updated to disallow a lack of an algorithm, I'm unsure why JS doesn't offer a 'safe' version of the parse in the API.

We only use JWTs where it makes sense. For browser-based access, we personally prefer cookies with opaque ids to represent a session.
Larry Ellison owned 40% of NetSuite when it was purchased at a very high price. He effectively ran both sides of the deal (between oracle and NetSuite) and funneled shareholder money into his own pockets via the transaction. Allegedly.
From the video, it looks like they do.
How did you practice CBT? Yourself? With a therapist? A workbook?
Yeah, I'm not sure how far explicitly restricting the list of classes you can instantiate will go because of class clusters, etc which make it basically impossible to actually create "just" an NSString or NSData. However, it's still possible to have "secure" decoding if all subclasses preserves the semantics of their superclass, since applications will not be able to tell the difference. The issue here is that some classes did things that were outright incorrect with regards to their subclassing contract, and NSCoding made it possible for these poorly-written classes to be instantiated in unexpected contexts. (Oh, and thanks for fixing your formatting.)
Another thing you may not have known, libedit[1] is mostly readline compatible, and BSD licensed.

[1]: https://thrysoee.dk/editline/
Hi, the source was the torrent which we needed to patch up with other sources
As someone pointed out to me recently, while waxing poetic about VMWare and K8s, Dell owns a big chunk of VMWare.

Private Cloud buildout plays into Dell's interests, but if their execution is worse than even one Public Cloud provider, then they risk this becoming an exit strategy.

You can make a lot of money off of being an exit strategy, and for quite some time. But when the evacuation is over you have nothing.

Honestly if Dell does this well enough I could see them using some of IBM's old tricks. One in particular I'm thinking of is that IBM would overprovision the customer (installs are more expensive than dormant hardware). Fast forward to your next crunch time and you're oversubscribed, you call up IBM and they send you a piece of code to unlock the rest of the servers. No scheduling, no deliveries.

If I'm running my own server room, it turns out having a bunch of hardware around I don't use is prohibitively expensive (in part because corporations use funny math and account for labor costs in weird ways). Which kinda bums me out because I used to get excited about ideas like running servers where it's cold to save huge amounts on electricity.

But if I'm leasing hardware from Dell, then the math is simpler. Labor and travel time are the same color of money as the hardware. Installing a whole rack of servers and only leasing you a half or quarter rack at a time (and using some of the extras for hardware failure) might be more cost effective. And I'm sure IBM knew what they were doing. The immediacy of picking up a phone and having 'more hardware' today versus scheduling it three weeks out (and having the team decide to prioritize optimization work) must be more lucrative. If a little bit like drug dealing...
The whole Dell related ownership structure is just ... odd.

Under the terms of the transaction, Pivotal's Class A common
stockholders will receive $15.00 per share cash for each
share held, and Pivotal's Class B common stockholder, Dell
Technologies, will receive approximately 7.2 million shares
of VMware Class B common stock, at an exchange ratio of
0.0550 shares of VMware Class B common stock for each share
of Pivotal Class B common stock. This transaction, in
aggregate, results in an expected net cash payout for VMware
of $0.8 billion. The impact of equity issued to Dell
Technologies would increase its ownership stake in VMware by
approximately 0.34 percentage points to 81.09% based on the
shares currently outstanding. VMware currently holds 15
percent of fully-diluted outstanding shares of Pivotal. The
transaction is expected to be funded through cash on the
balance sheet, accessing short-term borrowing capacity, and
approximately 7.2 million shares of VMware Class B common
stock to Dell.
I appreciated reading this as it shines a lot of light on how my partner experiences his anxiety. Thank you.
He wasn't against shorting. He was against naked shorting and its side-effects.
Basically: Larry Ellison had a vested interest in Oracle buying NetSuite, and (allegedly) abused his power within Oracle to kickoff the NetSuite acquisition at a premium far above NetSuite's actual value, thus (allegedly) financially benefiting Ellison rather nicely.
When I used the app a couple years ago, it was to skip the in store line and it was forcing me to pay a minimum $5 or $10 for Starbucks credit, and then use that to pay for the $3 item I was planning on buying. Basically, asking me to pay $5 for $3 item since I go to Starbucks once every few years. I don’t know if it has changed.