skysight-inc/HackerNews huggingface dataset:
I think most of the suspicions so far have been pointing to a sim swapping attack.
It is. The consequences of hacking e.g. @RealDonaldTrump would be disastrous (especially if the adversary is a hostile nation state whose hackers are smart enough to make plausible, but damaging statements).
Also the guy who wrote vim is now at google
That doesn't mean it doesn't increase the fraud score assigned to you/your transaction. e.g. the same behavior could trigger a ban with a virtual credit card but not with a physical one.
given his less than clear, very confused thinking, which also infected his company, this is no surprise, or even newsworthy.
Interesting, thanks for pointing this out!
I thought I had read something about it reflecting outside of the visible range. Could be mistaken.
Exactly, it's all about power.

On one hand, in the online ads biz, Google is king and is happy to outsource its customer support for its most premium customers both large network of agencies and advertisers. I know it quite well, I was one of those guys for Doubleclick many moons ago. That is if you are big enough to be worthy of being a Google (DC) customer in the first place, which means, you have to be a large spender.

But on the other hand, if you sign up for their Google Cloud thing despite being a nobody (me again), you'll have their sales folks hounding you for an upsell, mostly because GCloud is ridiculously behind both AWS and Azure.

Funny how it goes.
I won't violate any NDA still binding me to Mozilla by agreeing that the default search deal in Mozilla is and historically has been done for funding the company. If they wanted to switch, they could -- but it would hurt financially, big time. That could imperil the project as a whole. It would definitely limit salaries at the top.
Of course it doesn’t support contactless. Apple wants you to use Apple Pay for contactless, not the physical card.

Edit: in a comment much lower down someone mentioned that the fact the card is made out of titanium may have made contactless hard/impossible. That had not occurred to me.
I do have my own email server, but it is only for receiving and not for sending; the ISP's SMTP server is used for sending. Probably anyone could do this, if they have a ISP with email (which they ought to have, for this reason).

(Also, it seem that in Ubuntu, when installing Exim there is an option to do specifically this.)
I don't think "keep very close tabs on" can prevent an attack on an account before it happens. All it can do is help clean up the damage quickly. Which is what happened here. The offending tweets were deleted in 10-15 minutes. That's a pretty good response time.

What could prevent an attack is limiting the features available to high-value users. One could imagine, for example, limiting 3rd party API access. Depending on what actually happened here, that might have prevented this. But there is a downside of reduced functionality for the owners of the accounts in question. There's always tradeoffs.
Ask HN: What are some small/mid SaaS companies that don't get enough attention?
I'm especially interested in companies that were majority self-funded, built while working a full-time job, etc.
My friend has a kind of reverse saying: It is not possible to please everyone. But to piss everyone off, that's not a problem.
A console.log in your npm package post-install is an attack vector? Sure, there are many nasty things you could do in a packages post-install, I think a text based ad is the least of your concerns.
As others have mentioned, we only currently have one data point on this. However...

Google is well known for terrible customer support. And if you think of it, it makes sense. After all, if you can server 100M users via an automated support systems and only 0.01% have issues a year, it's probably far, far cheaper to just drop those "problem" users, than hire thousands of customer support persons.

Note: just threw the above numbers out, but you get the gist.

EDIT:

Speaking of algorithms, I wonder if the OP was below some adsense fiscal threshold of 'it's worth it to intercede here with a level 4 manager' or some blather.
Imagine being a child and having this picture of you slewn across the web like this.
I don’t know about others but for me a metal credit card is a novelty. Heck even a transparent plastic card was a relative novelty to me. That makes it interesting (in the short term).
The financial risks parents take to pay for college
You could call this the "maze principle": there is one way to get out of the maze, and all other routes are dead ends. (Actually, there's often more than one way to get out, just like not all "happy families" are the same; it's just much harder to find another correct route than it is to run into a dead end)
Yes! Build for oculus quest
One part of the article that I noticed particularly was the line about "some hospitals and doctors offices sell their debt to debt buyers, who pay pennies for each dollar owed...".

There's an organization called RIP Medical Debt that takes donations, uses the money to buy medical debt, then forgives the debt, which (should) clear any credit rating problems. John Oliver even covered the issue on one of his programs, and mentioned RIP Medical Debt. His program then donated enough money to clear millions of dollars in medical debt.
Wikidata From a Research Perspective – A Systematic Mapping Study of Wikidata
There is a wonderful corollary in basic statistics modeling that success tends to be a long-tailed distribution.

Reason: the easiest framework that allows modeling "the resulting random variable R is zero if any of the incoming variables vₙ is zero" is the product formulation,

R = Πₙ vₙ

which by taking the logarithm of the individual variables becomes a standard central-limit-theorem prediction; as a result success in such contexts follows a log-normal distribution[1], which is long-tailed, even if the individual factors fₙ = log vₙ do not look very normal.

This then leads to a growth pattern called Gibrat’s Law[2].

[1]: https://en.wikipedia.org/wiki/Log-normal_distribution
[2]: https://en.wikipedia.org/wiki/Gibrat%27s_law
See https://news.ycombinator.com/item?id=20842247

and https://news.ycombinator.com/item?id=20841976
I was going to suggest destroying the card in a fit of anger, but that won't be easy - titanium is rather strong.
Linux is only a monoculture on the server. Server-side applications will sometimes use Linux
-specific features but generally are written to be ported to other POSIX systems with little work.

Of course the git monoculture is bad. Have you seen how many people complain about git on Twitter?
How long it takes to make a friend
On a multi-core system it applies to both.
Why would this make you batshit insane? Would a long enough password negate this or would you never want the login to be obscure?

I appreciate the answers here!
Let me also add that "the author wishes to remain anonymous" is a usual BS for 100% affiliate-scheme funded 'we care about your privacy and here are the best tools' sites, while also claiming total independence and honest editorial process. Sure. How they don't lose all credibility instantly when it's not clear who runs it is hard for me to gauge - I can only go back to "if it's on the top SERP on Google/DuckDuckGo or main page of HN it must be valid".
Autonomous Energy Grid: Delivering Electrons with No Human Intervention
I've started to get really interested in lower-budget and/or easier motion tracking for special effects. I've been looking at optical motion tracking with a multi camera setup, and optical facial tracking. With the right math and assumptions, you could capture a full performance with little to no specialized equipment. I've been wondering if ML could output enough detail to make it feasible.
Hey! We might be just what you're looking for :)

www.openphone.co

Happy to answer any questions and talk about my own setup!
That's blatantly not true.

I use TDD to pick apart the problem bit by bit implementing the next (then unknown) step in a very piece meal fashion.

edit: also, what kind of gatekeeping is

"You can only solve a problem with TDD well if you know EXACTLY what do you want to implement".

The end result is the same: a set of covering tests & working code.
Although technically available to anyone, Google has an "advanced protection program" for highly targeted accounts. It has the follow (may have missed some) effects on your account:

* locked to 2fa with security keys
* limiting the set of apps that can access account data
* better scrutinized account reset - i assume this means it makes your account more resistant to phishing on Google employee's part.

https://landing.google.com/advancedprotection/

Its nice that Google apparently makes this available to anyone who is willing to buy the security keys. It would be nice if all major social media services had such a program.
Friend of mine pointed out.

Scientific facts aren't the same animal as legal facts. And I'll add not the same as political and engineering facts either. Root cause analysis facts are social and engineering facts.
Just use the mobile version, works fine on android ff
The psychology behind what hackers say in these high-profile attacks is far more interesting than the account takeover itself.

Some of them say racist things or speak about Hitler because they know it will attract far more attention than say: posting a link to some shady website to spread malware.
You'd need an interpreter at least, to avoid some kind of hideously complex system.

So it's a question of interpreter vs. JIT, and a JIT makes it more feasible to use an ultra-simple language with aggressive verification, without losing too much speed.

Every feature has an attack surface, but you have to compare against the alternative, not the lack of feature.

(This assumes that you can't force it to use a kernel interpreter despite the JIT existing. Otherwise perhaps that is the part that should be disabled.)
Safari on Mac (and iOS), In the Safari settings under Websites, Reader, you can set "Other Websites" to "On", and it's on by default except websites you turn off (which you can do from the reader button on the left part of the address bar.)
Not the first time. Remember when he gave away secrets to the Russians in the oval office meeting with them?

https://en.wikipedia.org/wiki/Donald_Trump%27s_disclosures_o...
> literally any other card can get scratched or discolored.

Uhh, what?

I'm looking at my wallet of cards right now, all of which I have had for multiple years. I have 2 metal cards, 4 plastic cards. Only one of them, the one that I have had for 3 years, is discolored in any way, and even then the discoloration is minor (its more of a dulling of the shininess, not really discoloration).
What to Inspect When You Are Inspecting – Jerrygamblin.com
Doubt it - if it's system libraries, I'd expect them to be immutable outside system updates.

I would expect them to potentially grab the list of apps separately from that though (Some Ad SDKs do that, not sure if Facebook also does it - https://www.androidauthority.com/sdk-invasion-a-privacy-thre...)
It's an interesting book but it's got a ton of glaring holes.

https://www.reddit.com/r/AskAnthropology/comments/1rzm07/wha...
"If you build it, they will come" is the worst line in a movie ever for actual humanity.

Most disadvantaged kids have access to Microsoft or Android adding a layer doesn't help.
Various impossibility theorems say otherwise, eg. the CAP theorem for distributed computing, the scalability trilemma for blockchains, Arrow's impossibility theorem for voting systems. Many times you have mutually incompatible constraints that are both desirable, and the best you can do is pick a point on the continuum that's satisfactory to the particular subset of users you wish to serve.
Funny you'd mention that. Philip Morris was a Media Lab sponsor in 2004 and 2005.

http://web.mit.edu/annualreports/pres04/07.05.pdf

http://web.mit.edu/annualreports/pres05/07.06.pdf

(Those are the years I happened to know of -- looks like there are more.)

https://www.google.com/search?biw=1183&bih=978&sxsrf=ACYBGNR...
Remember that HN post the other day about someone going on a massive mission on voice recog because they can't use a mouse due to pain?

Stuff like this makes me hopeful even if it seems like a gimmick when viewed in isolation.
This is the same kind of reply I got when systemd implemented IP accouting in unit files. Lennart said systemd gets a lot of flak, but in the end it's only implementing kernel features. I proceeded to ask him: why is it necessary to have this ? Do you feel obligated to make every single feature available ?

Parent comment raises a very valid question. How do you manage the firewall policy with this system ? Netfilter configuration is already a mess on Linux (iptables ? nftables ? iptables-persistent package ? netfilter-persistent package ? some custom shell script that calls individual iptables rules ? rules dynamically inserted by scripts ?)
Each of these tools/methods has its flaws, but it becomes completely unmanageable if two are used at the same time.

When this won't work as expected, how should a sysadmin handle the situation ? Where do you even start debugging ? Is he/she expected to inspect every single unit file in search of the one that is amiss?
Can one get a list of all currently loaded rules ? (preferably with counters about matched packets and ideally with the possibility to log a packet matched by a rule)

systemd making this 'easy' to use may be a bad idea. In my eyes, it's just giving users more rope to hang themselves with.
The unit file format is often touted as an asset, because it's much simpler than the shell-goo you would find on most distributions (Debian and derivatives for example provided a skeleton file for people to write their own init.d services. Just the boilerplate was almost 100 lines of sh. Contrast with OpenBSD where most scripts to configure service startup are only a couple of lines).

Having a key=value format was touted as a plug as it made things easier. Turns out that's not exactly true because some settings will have the expected effect only if you add enable a different setting at the same time. In my mind, this translates as an if/else which makes me think systemd.unit(5) format is not INI style configuration, but a small programming language masquerading as a configuration.

Anyhow, this turned out longer than I expected. The fact that it would be possible to do with sysvinit does not mean it would be a good idea to do this sysvinit.
I found https://webkit.org/blog/8685/introducing-the-jetstream-2-ben..., with a graph at the end, but of course that is written by Webkit (JSC) developers. Then there is https://johnresig.com/blog/javascript-performance-rundown/ from 2008. https://www.railsmine.net/2017/12/browser-benchmark-safari-1... from 2017, similar results to the JetStream 2 post.
> I don't see any of those as reasons to commit dependencies to the same VCS repo your source control lives in.

Why not? What's the downside except having a "update dependency" commit from time to time.

It's a great solution to always have your dependencies at hand, offline and even versioned. Makes it easy to see when a bug got introduced by a dependency or roll back an update. Especially for projects that don't have a build pipeline, cached dependencies or just smaller dependencies that aren't very well backed up from other people.

I think it's a great way to make sure things are still running after a few years (personal projects) and everything still works without having to hunt down some dependencies or find alternative mirrors.
It probably is the least of the concerns, although still it is one thing. (However, note there is a --ignore-scripts switch. There is also --no-optional, but I don't know how commonly such thing is in use that it would help; it would need to be marked as a optional dependency for --no-optional to work, probably. And then, there is also --dry-run.)
there is a web version at https://followup.loophq.com/ and just sign in at the top of the page.
or you can try the full product at https://www.loophq.com
All else being equal, and ignoring the question of perceived loudness, (massive hand-waving ahead), shouldn't a power of 10 increase in speaker wattage result in, at best, a sqrt(10) increase in loudness since that power is used to drive something with area to actually move the air?
I kinda agree with banning the ads because it would have grown out of control and a race to the bottom on who can make their ad more efficient than the others.

But here's an idea instead: we already have a Sponsor feature on Github, so how about a command in the package manager that lists all packages that could be sponsored, similar to how packages can be audited ?

That way everyone in on an equal footing instead of money going to money.

And if it's not enough, how about using private repos where you need a subscription to access the package ?
“Is it not analogous to letting my children play with the bleach under the sink?”

Oh, my sweet innocent child.

https://sciencebasedmedicine.org/?s=Kerri+Rivera+bleach
what would you like to see?
happy to elaborate
I'd agree that there are always trade offs however, you could do a number of things to detect an active attack, changes in user agent, location etc can be detected and flagged for review. Now that's not possible at scale, but for high value users,it would seem like a not outrageous countermeasure.
Scientists Discover Photovoltaic Nanotubes
I love my Apple card. The noise it makes when dropped onto a desk or table hasn't gotten old yet. It's actually kind of ridiculous how loud it is. I don't plan on using it for anything but app store purchases, and maybe a new MBP next year.
Did you read a particular translation? It's a book I've always intended to read and I started trying to read Constance Garnett's translation recently, but the writing felt awkward and it turned me off pretty quickly. It felt like I was reading poorly written fanfiction or a book intended for young adults with limited vocabularies.

An example from one of the first few pages:

"There happened to him at that instant what does happen to people when they are unexpectedly caught in something very disgraceful. He did not succeed in adapting his face to the position in which he was placed towards his wife by the discovery of his fault."
>where announcements are made by world leaders and major corporations, control of these accounts could have repercussions

That control should not be solely in Twitter's hands.

Those leaders and orgs need to take a strong look at authenticity via ActivityPub self-hosted on their own namespaces.
My understanding is that it allows you to write a program to decide what to do with a packet and allow that program to run in kernel space for efficiency. The limitations of bpf are to protect the kernel from the non-kernel code running in its memory space and ring 0.
The Left Hand of Darkness was published in 1969. TFA's illustration is from a novel published in 1975. I can remember reading some scifi short story in which one of the main characters was trans basically as soon as I could read without vocalizing... so about 1982, '83? and that was something off a clearance pile at a used bookstore... This stuff has been around a long time. It wasn't always so blatantly political, though. The LessWrong folks are right about this one. [0]

In the past, whenever someone got pissed off enough to make a stink about some challenging detail of scifi, most fans just laughed at them. We should do that still. It's fine to criticize the less evolved assumptions embedded in old "space opera"-type stuff (or, really, more recent stuff like The Windup Girl, yeesh...), and it's fine to have tastes that don't perfectly mesh with such progressive authors as e.g. Miéville, so long as we don't take our own feelings too seriously.

[0] https://www.lesswrong.com/posts/9weLK2AJ9JEt2Tt8f/politics-i...
MISLEADING HEADLINE : Facebook is only copying meta data about the libraries.

THIS is a good thing.
Hopefully if that's the case, more attention will be paid to the fact that using mobile phones for 2FA or identification on high value services is a bad idea :)
Ask HN: Concept for Monetizing Open Source Projects
Looking for feedback on a concept:

I've been reading a lot about the financial hardships of open-source software and I had an idea for a solution.

It seems that the value OSS has on a business should be returned in some way but OSS creators seem to have difficulty getting companies to donate (or pay) for their software.

What if there was a license that explicitly laid out company by company what contribution they must make to use the OSS... this license would be available to all OSS so that it was relatively efficient for the creators to use generically. E.G. "Sun Microsystems must donate $50 a month to use this software, Netscape must pay $50 a month to use this software... etc" The costs could be simply relative to the companies valuation.

Interested in feedback... (yes I do understand its basically creating a large company database)
NPM to launch open source funding platform by the end of the year
The us has high resolution satellite surveillance, news at 11.
Shipping the required network settings alongside makes sense. i.e.: a smtp mailer declares it needs to access tcp/25.

How does one get a global view though ? What am I allowing on this host and more importantly, how do I fix it when things go wrong ? (they always do at some point!)
On the other hand, I'm sure it simply pays nice.
Did all of Twitter get hacked, or did a single user get embarrassed?
Jacob Bronowski on Science and Art (2010) [video]
I'm not saying they will, just saying they can. There's no magic coating on those cards making them particularly resistant to discoloration.

Odds are the Apple card would be exactly like your other cards.
This post has a misspelling. Can you fix this?

`s/Katerina/Karenina`
That's a view for sure, however it seems that some world leaders and corporations have decided that the trade offs are worth the risk...
I prefer xeyes
The specific capabilities of spy satellites are very much classified. It’s for similar reasons we don’t release exact number for fighter aircraft top speeds etc. Countries over or under estimating US capabilities is useful.
Zero is not an indicator of success. It is a lack of failure (NULL). That distinction is why some people think the "flag" is inverted.
What are you talking about? The appearance of the card itself is one of the primary selling points that multiple card issuers tout. AmEx is very proud of the Platinum appearance. Chase/Marriott and Chase/Amazon made a big deal out of the fact that they have appealing metal cards. For many years one of the biggest marketing points about the Chase Sapphire Preferred (and now Reserve) was that it was a good looking metal card. I personally remember it being made a huge deal by Barclaycard when they redesigned the Arrival+ card.

Hell, some banks even use the customization of debit card appearances as a selling point for extra fees.

And yet, not with a single one of these have I ever seen anything warning about the card becoming damaged/discolored/scratched. Indeed, I personally have multiple AmEx cards, as well as the CSR and CSP, and after years of use (and gasp storing them in a leather wallet) there is very minor discoloration on one of them while the rest still look great.

The entire discussion about the appearance of a damn credit card of all things is absurd. It was absurd when every other card issuer did it, but it's even more absurd now that it seems to have been brought to the forefront by the Apple Card.
It can work because when sleeping the only cost is literally the size of the stack (that you can set to a low value).
For me - it's sometimes like that, but sometimes it's the exact opposite: I understand the problem through starting to code. Depends on the coding task; also on the language.