skysight-inc/HackerNews huggingface dataset:
Antitrust agencies are more often than not a bad joke.

They are usually lobbied for by the big players in the market in spite of the consumers and smaller competitors.

They create a legal nightmare scenario that you have to navigate to make anything happen in your business, that is hard for anyone small to comply with, but more manageable to them - going all against any free market principles.
Thanks, this seems like the best answer for me, for future folks reading this, that URL has been updated to https://www.rundeck.com/open-source
Is your ISP in the US and your government the US government? The DoH rollout w/ Cloudflare is only planned for the US.
Customers who bought this item also bought

- ALFA AWUS036NEH Long Range WIRELESS 802.11b/g/n Wi-Fi USBAdapter

- Yubico - YubiKey 5 NFC - Two Factor Authentication USB and NFC Security Key, Fits USB-A Ports and Works with Supported NFC Mobile Devices

EDIT:formatting
Apple Engineers didn't invent it, it was a 3rd party technology purchase.
If I read this correctly then if a software house wants to hire software developers as contractors then they can't do that because building software is their main course of business.

However companies like Airbnb (hospitality) and Uber (ride sharing) will be able to hire programmers as contractors because writing software is not main source of income for those firms.
> I'd rather trust unecncrypted plaintext DNS queries that go to my ISP and government!

I trust my ISP and government more than a US company I have no formal contract with and the US government.

Also, there's the whole 'applications should not override system level settings' thing. My DHCP pushes a local (caching) DNS server that also does name resolution for internal services. This change would break that for all Firefox users on my network.
Open source cloud security tools
If I sleep 8 hours or more, I wake up like someone beat me up and I find I'm tired and exhausted all day. 5-6 hours for me are the sweet spot (leaning towards the 5). I'd love to know the reason because all "scientific" literature always pushes me to take 8 hour sleeps. I always feel like I'm doing something wrong going against "science" in that regard, but long sleeps just don't work for me.
Yea, Preferences > Network Settings > Enable DNS over HTTPS

Can currently choose "Cloudfare (default)" or "Custom"

But I agree, a few more options on there would be good, and if they are turning it on by default, then there should be a setup page that appears to let you choose the provider or something
With all of these, you're often kicking the vulnerability down to the enrollment step. You've still got to find a way of assigning the authentication device/key generator to the users account in a secure way and dealing with losing the device.
It seems like this change by Firefox would bypass a pi-hole. Am I understanding it correctly?
So you're not actually talking about the TOTP codes that are generated?
How does gerrymandering affect California's representation at the Federal level? And the makeup of the Senate? It's that darn constitution again :-)
I'm glad you've experienced better. I've lived in probably 3-4 of the USA's top 100 cities and I have yet to find a place that does every 10 minute bus service, except for the most central parts of the city. Perhaps you live in the core? What is strange to me is that busses that aren't every 10 minutes aren't even GPS trackable on an app or something. If I could do that with a 10 minutes early alarm, that would make the public transit worthwhile again.
Right there with ya buddy, except for the management goal.
I think any solution will carry some kind of automation
I recommend checking https://concourse-ci.org/
People spend so much time in their companies on doing the same tasks like looking at Google Analytics

it's insane
I meant for academic purposes.
It seems very American to me to trust a private actor such as CouldFlare more than your own government.

I feel like at least in Europe, a large majority of people would trust their government and local ISP much more than some company halfway over the world with basically no accountancy in your own country, especially an American one since it means your data is basically at the mercy of the US government.
Aragon 0.8 Camino
What about FedEx? Aren't most of their drivers contractors?
Are you sure this answers my question? Note that I was neither asking why p-hacking is bad nor even why p-values are bad.
The article is a curates egg. The d-notice stuff is interesting, although mostly well known I thought (?).

The Assange and anti-semitism parts are evidence light re-heats of Canary-level reports with added "it's the spooks". Like almost all his partners Assange fell out with the Guardian pretty badly. If MI5 operatives were being paid to do this, well I hope they enjoyed the free holiday.

I especially enjoyed the statistic that "0.06% of the Labour membership has been investigated for anti-Semitic comments or posts."
UK 2016:

https://www.theguardian.com/money/2016/apr/16/sim-swap-fraud...

>When Sims rang EE, it soon emerged that someone posing as his wife had managed to persuade the mobile network to activate a new sim card

>Sims says that when he contacted his bank, Halifax, the call centre told him it is handling hundreds of sim scams every day, making it the fastest growing fraud in the country – although Halifax later disputed this figure.

On the other hand I'm sure I saw something about banks etc being able to subscribe to services that would give them background information about a mobile number (ie if the number has been recently ported).
I am a big fan of Knex for just this reason. It's not an ORM, just a migration manager and query builder. It makes easy stuff easy, and for complex stuff it gets out of your way.

If you need complex relationship models, ObjectionJS sits on top and will auto-manage relationship tables and all that nasty stuff for you.
I'm still digging in and playing around, but I think this could be really useful in explaining RxJS operators to new team members. I think the pros outweigh the cons for the vertical bar, but maybe you could add an option to render horizontally?
> (though what definition it is using instead is unclear)

To me it appears the definition being used is any corporate actor obstructing the current administration's agenda.
> I trust my ISP and government more than a US company I have no formal contract with and the US government.

And every single intermediary and whoever else might be listening in? This is an unencrypted plaintext connection. Which is the main point here. The whole "we trust ISP more" thing is completely beside the point. The point is DNS is horribly insecure nowadays, and it is about damn time we switch to something better.

> Also, there's the whole 'applications should not override system level settings' thing.

Hopefully, DoH will become a system level setting eventually.
Yes. FTA, "Website visitors have been taught that a footer is placed at the bottom with information such as contact, about us, privacy policy and so on."
Comandante - UI and Debugging Tool
Offtopic: You were faster than my comment!

I understand the Yubikey is popular but I do not understand the why the Wi-Fi dongle is popular. Any ideas?
I was in downtown Dallas, and it was mainly while walking between downtown and Deep Ellum.
> fascist

When did "fascism" became a tag for "things I don't like" again ?

edit: I can't reply to your reply but you should research more on fascism, it goes way beyond "bad people are bad", most of these regimen were actually pro healthcare/welfare. I'd be glad not to make it meta but every single controversial article turns into that kind of lame "oh that's fascist!" thing when it almost never is related to fascism.
I live in Europe and I do trust my ISP (and government, which has a decent track record at enforcing GDPR).

Even with DoH, my ISP already sees all of my network traffic. My DNS queries will effectively be anonymized by their recursive name servers.
eBay sells goods, Uber doesn't.
Which all of above is the reason I like D Lang, as it is ABI compatible with C/C++. So all existing libraries and code written in C can just be used but also have the convenience of modern language design principles. Which unlike the other modern languages like Rust, Go, .Net, etc... it is not corporate owned and controlled. So being completely free and open source like C/C++, D is continuing build on top of what came before, but also bringing in modern languages safety for memory, types, as well as rtti (runtime type introspection), and being multi paradigm allowing procedural, OOP, and functional to all co-exist in the same code.

So that is why I think it is the best choice for my default language of choice.
> I trust my ISP and government more than a US company I have no formal contract with and the US government.

You're not affected then, because the DoH rollout w/ Cloudflare as the default is only planned for the US.
The only thing that annoys me slightly about this, is that I currently have a couple of pi-holes running at home (one for us, and one for the kids) and I have the Mikrotik setup to redirect any request for DNS to the correct pi (So even if they change the DNS on the device it still hits the pi)

This is going to make that a pain - especially if they introduce it in the mobile version?
This is painful to read. Masses off unfounded FUD - the article deliberately buries that it's trivial to change your DoH provider if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP).

If instead what you worry about is the government spying on your traffic then complaining about DoH is even more silly - DNS requests are routinely intercepted and monitored by ISPs in many countries, with the information available to the security services, who have very few restrictions on what they are allowed to do with this data. This is especially true in the country the author appears to be based (Germany).

DoH is vital to protect users around the world from censorship and worse. Enabling it by default is a good thing - protecting users from abuse shouldn't only be opt-in. There has to be SOME default chosen, and the default needs to be a site large and well run enough to a) handle the load, and b) be in the firefox HSTS preload list. There aren't a lot of good DoH providers that fit these criteria - CF is one of the few.
Emoticons were never a position. They served as support of a claim.

More importantly the claim wasn’t that Socrates was absolutely right, it was that he had a legit point when he argued that there are inferior aspects. I however acknowledge these drawbacks are dwarfed by the benefits conferred by writing. So yes writing is great, no doubt, but it does lose something while gaining us a lot more in return.

Never the less, I admire his steadfast refusal to write even while acknowledging we are poorer for not having his thoughts first hand. Yet, he nor anyone else owed or owes it to us.
This misses the forest for the trees. In the UK ISPs are already legally mandated to log your web requests and provide them to the government. Those who live under free regimes should not deny those of us who live under oppressive governments the right to privacy of our communications. The fact that cloudflare is a US entity and thus not subject to UK law is the whole point.
Can I put in a note saying that "Don't transfer unless I physically show up with ID in a brick and mortar store?"
Yes, a DoH request would never hit your Pi Hole
It's currently proxying 10.2% of all known websites (by the surveyor) on the entire Internet.

https://w3techs.com/technologies/details/cn-cloudflare/all/a...

Not big, but not insignificant.
DoH and DoT are very interested technologies, disabling them 'cause Cloudflare is ... strange.

From another side, DoH/DoT prevents ISPs/government from DNS modifying/rerouting.
You have to be in a place where you're grounded, secure, so you can self-regulate where social media becomes a tool you aren't or won't become dependant on, addicted to.

“Rule your mind or it will rule you.”
- Horace
Sure. Apply some fuzzy logic. Highly significant. Somewhat significant. And honestly, we're in an age where somewhat significant can often be bolstered later (in the drug industry) by coupling drugs. It's really time to stop believing everything has to be unifactor. Everything that we care about is multifactor and even slight significance could make a difference if added up.
Absolutely. This warning seems disingenuous and will confuse many normal people. DNS over HTTPs and DNS over TLS are good things and increase our privacy. People should switch to them.
I think it's to draw the attention of people who want to tell others to do the same thing. E.g. if you're saying the title of this article internally while looking at an infinite-scrolling web site, then the title will get your attention.
There are two points:

1. centralization of all dns lookups is worrisome

2. Dns should not be handled by applications. It should be handled by the operating system.

I see a lot of people conflating the two in the comments.
The main benefit behind TOTP is that you can tie its value creation to a second factor, such as something you own like a device (instead of something you know like a password).

It’s arguable that you’re removing that second factor when you store the parameters needed to create the TOTP in the same place as you store your passwords.
surprised they didn’t mention bork at all...

[1] https://www.washingtonpost.com/news/wonk/wp/2012/12/20/antit...
There aren't many intermediaries if you use your ISP's internal resolvers.
> I feel like a time delay would help with this too.

It used to take a long time and the carriers caught grief for making it hard for people to port out to another carrier.
I really only want read the story told by Snowden's bank accounts and use of cash. Pretty sure this isn't that.
Anything that requires a specific time and place to do it with others is a non-starter for me as a primary form of exercise.

If I lived near a body of water, kayaking would be a good alternative in summer (or more if I move to a different part of the country). That could still happen some day, but not now. Cross-country skiing is an alternative, and one I intend to pursue more this winter since I now live near some good places for it, but of course that's only in winter.

Cycling is the kind of obvious alternative, but I'm not really sure I'd enjoy it any more at the same intensity. As I said, it's the intensity itself that creates discomfort, and I've seen too much mayhem involving intense cyclists too. Seems like that focus on results can have pretty serious consequences at bike speeds.

It's great that you feel like you have tons of options that both meet your goals and provide enjoyment at the time. Consider that it might not be the case for everyone, and some might still put the goals first.
> and I wouldn't want a magic pill or treatment which would make me that way. We need 8 hours of sleep.

I mean, it's literally a magic pill that would make you not need 8 hours of sleep.
> DoH means that Firefox will concentrate all DNS traffic on Cloudflare, and they send traffic from all their users to one entity.

Why does DoH necessarily mean that Cloudflare will be handling the traffic? The article barrels right to that conclusion without explaining why.
If you use your ISP's DNS servers, there is no intermediary between you and them.
Yes, unless you configure Firefox to not use Cloudflare DoH.
jve is short for j onathani ve? Anyway, I thought the same when I saw that slide (and a couple others).
We trialled Clubhouse 6 months ago, but didn't find it a good fit for us. After another 3, we settled on ClickUp https://clickup.com/ and have been very happy.

Our clients even use it and they _love_ it. So much so that one has now adopted it internally.
Also does this mean that there will be limits on how many drivers are allowed in a locale?
Out of the box? Yep! I realise that will annoy people but honestly it's a good thing - any solution that would not bypass a pi-hole would allow governments and ISPs to do the same.

To retain your pi-hole, you'll need to run a DoH proxy on your pi-hole device, configure your browser to use that as the DoH provider, and this will allow your pi-hole to inspect and modify DNS results. Your pi-hole can then use any upstream DoH provider that you want.
Last bit is so true, stop wasting my time and just tell me the costs. It just indicates that either you're too expensive or you're bad at concisely making a case for your product. Both are a red flag.

"Call for a quote" for software needs to die.
I'm a strong believer in solving problems at the single point of failure. If you solve it at the Twitter level, what about any other internet/cloud based service that is designed just like Twitter? It would still be a problem. If you solve it at the phone company level, all the companies that operate like Twitter are protected.

Even better still, solve it at both levels, but definitely don't let phone companies off the hook.
> There has to be SOME default chosen

It seems trivial to select a half a dozen likely candidates and let the user choose between them on install.

Honestly I'd like them to do the same with the search engine. Yes, it's simple enough to change the default, but it'd be nice to choose up-front.
Is there any reason to believe the ride sharing companies won't reorganize their drivers using a similar model to what Amazon uses for their delivery drivers: contract to external firms that employ drivers so the parent entity is absolved of responsibility?

https://www.nytimes.com/2019/09/05/us/amazon-delivery-driver...
Comparing SAST to SCA it’s like comparing apples to oranges
No, a book is not a large page.
It's very disturbing to see the overreach that Mozilla has resorted to and the "privacy" argument (it was "security" before that...) being used to justify essentially ignoring system configuration. My ISP has more accountability than a company in another country.

The correct way would be to standardise DoH and DoT and add support into it into automatic address configurations and operating systems.

Exactly. If Mozilla wants to, it's more than welcome to reach into the VPN area with its own products, but I don't believe this functionality should be part of a browser. They're already reaching into the VPN area[1], should they also investigate bypassing Chinese censorship with their own "firewall-busting" obfuscating VPN? That's not something most users want nor need in their browsers, and such functionality is really a cat-and-mouse game that I think is best left to smaller and less-well-known entities.

It's unfortunate that browsers are already beyond "neutral", when IMHO the only thing they should do is fetch exactly the page URL that was entered and display it.

Edit: yes, apparently people disagree and want Mozilla to control what the Internet (and every user, ignoring his/her default configuration) does. This is really really disturbing.

[1] https://news.ycombinator.com/item?id=20927832
I've done a piss poor job of describing it, but the way TOTP works is there is a "setup code" or a setup "string". Often in a QR code format.

That string is all that is needed to generate all of the TOTP codes forever. So while the TOTP code that you type is different every minute, it's generated by doing some math on the setup string and the current time.

Some password managers (like 1Password) allow you to have them generate your TOTP codes by putting in your setup string into them (often using the exact same process you would do to setup your TOTP codes in an app). But i'm saying that's not a good idea if you are going for "most secure", because at that point if something were to somehow exploit your password manager, they will not only get your username and password, but will have that setup string as well so they can generate their own TOTP codes for you.
Am I wrong for stating that a social mediate is basically trying to say nothing happened to get more "atta-boys" from the social media empire at large?

I mean what you focus on is what has power. Social media doesn't deserve the power or respect that academia has, nor will it ever.Enforce social media to be purely academic and I might feel differently.
The problem is, I think a lot of these hacks have an internal connection. How much access do these 3rd party carrier stores have to transfer numbers?
I don't think people buy apple products for the amazing cutting edge features. Android has beaten apple to just about every feature ever.

People buy apple for the same reason they buy a Mercedes. It does all the same stuff, but it feels nicer.
> Tying health care to employment is a historical accident long overdue for change.

This, 100%. It wouldn't solve everything, but it'd be a huge positive step to roll back tax incentives that encourage this.
Actually 2fa via SMS is a bad idea. Check out Troy Hunt's HIBP project to get an idea of how common password reuse is.

A good way to think about the SMS problem is this: As a second factor, your cellphone is considered by many to be "something you have". TOTP like Google authenticator does verify you are in possession of that device through a shared secret key.

SMS does not verify this and the factor is not something you have. Instead, SMS is more like "something loosely associated with you that is transferrable and vulnerable to social engineering attacks".

Anything is better than nothing. However this may be worse because it provides a false sense of security.

https://i.pinimg.com/originals/8d/6e/f3/8d6ef375e012df303faa...
Stopping ID Fraud with Thumbprints (2017)
About Btc
Thanks for the great chart,
@hcburger1
, and letting me use it! My estimates deviate from the model, because it seems unlikely to me that BTC would stay as volatile at 500k+ as in the past
Correct, a lot slower; Hence I specifically mentioned 'internal' storage.
Yes, it answers your question.

What you call "p-value" is a sample from the "p-value distribution" of your experiment.

Taleb shows you can sample a p-value of 0.05 when the actual "true" p-value is 0.12.
> if you're silly enough to believe that CF is actively logging DoH requests and selling them (CF is involved with serving vast swathes of the internet anyway - if they wanted to go down this route they have far more lucrative avenues open than selling DNS requests by IP).

I don't think anyone believes CF will start selling data, that's not what the article argues.

Regardless, it's opt-out not opt-in. Which is against newer consumer protection laws such as GDPR.

> DoH is vital to protect users around the world from censorship and worse.

This isn't black and white. Yes there is upside (as both you and the article agree), but the downside of how DoH is implemented here is that you have to point all your DNS queries to a US company. Historically we've seen how this is a bad idea for global internet privacy (eg. PRISM, etc).
Looks like a technical analysis of a greedy broker
That wifi dongle in particular supports packet injection, and supports aircrack-ng for penetration testing.
Every question you make a potential user/customer answer is a potential loss of conversion.

Most Firefox users do not care. Those that do can figure out how to change it easily enough.
This is exactly why DoH is enabled by default in the US only.
Would it be hard to make pi-hole into a DoH provider so you could just point your browser at it? Or does that defeat the "just works" factor of the pi-hole?
It's terrible for image galleries too, as the images stay in RAM and the memory usage can quickly become insane. Animated GIF galleries are especially bad for this.
Exactly the point I was making. I was not trying to imply US Letter is the “normal size” (if I did, then I’d be doing the same thing they ran afoul of).
Machine Learning for Physics and the Physics of Learning Tutorials