skysight-inc/HackerNews huggingface dataset:
> namely "DOM Clobbering" where an attacker can rewrite DOM methods from underneath you

I don't see that as a valid security concern in this case. Yes, it will break your code or do unintended things. In order for this to happen an attacker must have access to the page in your user's security context, which means some other preventable security violation has already transpired. This applies equally with any application/language. Even if you could freeze the DOM such that nothing can be assigned to object properties then you might be able to ward off DOM clobbering, but there is still a malicious user in your security context reading all your secure and private details. If you prevent the malicious agent from access this security concern with the DOM is eliminated.

In other words whether or not DOM clobbering occurs a prerequisite security violation is necessary and hardening the DOM won't provide the necessary solution.

Aside from malicious third parties intentionally writing over event handler assignments DOM clobbering really comes down to poor code management, which is the real security problem here. That makes this a stylistic concern. Additional layers of concerns isn't going to make people instantly less lazy. There are better ways to solve for this.

> HTML elements implemented in completely different ways

HTML is not the DOM. These are separate and unrelated technologies that are maintained in very different specifications. This separation is not an accident. It is by design. I know this is a contentious point, about HTML and the DOM being far separated.
SQL.

>it comes with a number of performance and memory/storage consumption implications.

Instead of selecting sum(), CREATE TRIGGER then and update a singleton on insert. You can even create a view with N recent transactions and catch inserts into it to maintain that N, if you don’t want a full history.
The high-bandwidth, low-effort interactions you're talking about might only work with quick, two-way exchanges, as in a spoken conversation. In that regard, I definitely have a weird English variant among friends. I enjoy the broken English of so many memes.

There's an additional layer of language where you can switch to a different variant of the rules as part of communication. Speaking in another register defines the tone of the interaction.

But I'd still like to defend standard English as the default even in informal groups, because the standard makes it readily accessible to many people and ensures as much permanence as one can get from language.

All that said, I have one more flip-flopping disclaimer. I think some of the rules agreed upon before are really dumb. Putting punctuation in quotation marks if the punctuation is not from the quote is monstrous. I will not follow that rule in any context.
> Have fun explaining to your spouse why your household's TV is showing more dating site ads than that of their friends.

Because she refuses to heed those weight loss ads ;-)

JK - my wife is very fit and sexy.
Could you summarize the results for those of us not in the US?
Thank you. I love VLC.

Pass my sentiments along to the collective. You all did great work.

I donate every few downloads. It is not much, but maybe enough people do it to matter.
Prymeo – Cheap Flights and Hotels
Prymeo is a mega search engine for Flights and Hotels, including Low-cost and Charter.

Our search engine will help you compare prices for thousands of cheap flights and hotels, save your money and time, and plan your next trip.

We will help you find the best deals from more than 200 booking sites in more than 190 countries at no extra charge.

Get your trip with Prymeo at the most affordable prices, save money and time when ordering!

Download it now and start planning your next trip!

Get more information about booking flights and hotels at info@prymeo.com!

Visit https://www.prymeo.com

Android Google Play Market — http://bit.ly/2kuvliL

İos Apple Store — https://apple.co/2lZjzgC

Amazon Store — https://amzn.to/2m2xq5X
Slightly off-topic, but what the fuck have the font designers been smoking? That looks absolutely terrible!
If you take an equation from physics (like the mass-energy equivalence) and rearrange it to solve for t, you don't seem to get anything that makes any kind of intuitive sense. Time is very confusing.
It also goes a long way to explaining why the leaders of so many open source projects are vulnerable when sleazy marketers come around waving life-changing amounts of money.

When one gets little help and support and it feels like ungrateful demands are the only thing anyone ever contributes, it's not hard to see why one might just take the money and ghost.

A moment of respect for what jbk personally passed up to keep VLC free for us.
To me , most college university major are just luxury, and you should only go there if you have fine finances.
It's has been proved that a college degree in the right major is the best investment you can do, even with the big loans you have to take.
The problem with people not being able to payout their loans is because they did not took a good choice in major. And why should my taxes go into someone spending their time in a liberal arts major? or anyother with little or no relevance to the market? Those kind of loans are never pay, and yes, if it's free it's a loan as well, the state will use the tax money to fund these students, expecting to get some bigger tax money later when they graduate. Well, bad majors won't find well paid jobs, the tax money wasn't well invested.

Maybe I'm just a sad adult, that just sees everything around money/market value. Maybe I should have spend my college years in some place where college was "free" perfecting my art skills. Now I pay for my art classes after work... What an absurd idea, to pay for an hobby, rather than having taxpayers funding some years into my hobby research.

edit: I'm talking mainly about tuition, things like access to classes references/books/material, it's ridiculous to be paid, as the ones that wrote those were already paid to do it, and a lot of it, done with research payed by taxpayers
Agreed, that makes sense.
No, they don't externalise anything since that's not their responsibility to start with.

There is no passing the buck to public services either. Laws varies per jurisdiction, in general it is for landlords to pay and hopefully recover costs from tenants.

The issue discussed here is not specific to AirBnb and is a well-known issue in property law.
The protocol they use is open and very reliable, and it can be verified relatively easily from the outside that this is the protocol they're using.

If you enable backups in WhatsApp those backups aren't stored on Facebook's servers, but they are probably not encrypted very well, since you don't enter your own encryption key, and WhatsApp has to be able to decrypt those backups if you lose your device. So those probably aren't secure if you are directly targeted.

Also if you are directly targeted, it's not completely impossible that Facebook has a way to send you a custom "update" that simply sends all your messages to Facebook encrypted with their keys.

But in terms of mass surveillance, it seems fairly unlikely that Facebook can read WhatsApp messages, because something like that would not be hard to find for someone from the outside, especially since the protocol WhatsApp is supposed to use is completely known.

Facebook probably cares more about your meta-data (who has who in their address book) anyway than it cares about the content of your messages.
Handle Race Conditions in Node.js Using Mutex
How Sustainable Are the Leading Chemical Companies?
I think the EU is right to take a serious attitude to data privacy even if it doesn't always get it exactly right. These are new issues and the other approach is the the US approach which means tolerating the likes of Equifax et al data breaches with no real compensation or recourse. So I'd take the EU apprach with its flaws over the US approach with its flaws.
I don't think "Popular commenter on HN" is a position in many companies.
You're supposed to check the "Who's hiring?" threads and see where your skills would match the job description and contact them. That's about it on HN, this isn't really a job seeking board.
Yeah, I don't get the thin obsession. It doesn't provide improved function (or decreases functionality). It's really just a vanity thing for Apple.
As somebody who has not been struck, but been damn close to a strike twice, I'd like to note that the folk wisdom that your hair stands up (like when you get goosebumps, I guess? Not like an Einstein picture?) before a strike and gives you some kind of warning is utterly false. What you're supposed to do when so warned is is unclear, but nevermind that.

How close is damn close?

This summer I was doing some work on a house when a storm rolled in. Went inside and waited out some heavy wind, lightning and rain. 10 minutes after the rain let up, the guy I was looking at and I looked at each other, shrugged our shoulders and figured we'd get back to work. I went out to the patio and was pulling the tarp off the tablesaw when lightning struck. I reflexively count after a strike (I spend a lot of time in the woods), and the interval between the lightning and the thunder was long enough to register a lightning strike, but not to begin counting.

Needless to say, we went back inside, packed up our stuff there, and started loading the truck. As we were doing so, a fire truck came by inquiring where we might find a nearby address. Knowing that address and the address of the house we were working on let me determine that we were about 80m away from the strike using Google maps.

That's the second closest I've been. The closest was on the Appalachian Trail in 2010. I ducked into a shelter in the Shenandoahs to wait out a storm. The rain tapered off and stopped, and I figured I'd shove on for a few more miles before calling it a day (around 3:00 PM). As I was about to leave the shelter, lightning struck close enough that the lightning and thunder registered in my brain essentially simultaneously. Best estimate based on this summer's experience? 30m, maybe less?

In neither case did my hair stand up. If you need to be closer to the location of the impending strike to observe the phenomenon, I reckon you're pretty well boned.

If you're looking to not get struck by lightning in the first place, which seems advisable based on TFA, I'd suggest that the notion you're going to have some kind of warning before a strike is nonsense.

I would similarly note that just because it seems like the storm has passed doesn't mean it has. In high school marching band, the rule was that a football game couldn't resume until an hour after the last lightning. It seemed ridiculous at the time. Now it seems well-founded.
The way to make a counterpoint is not to bring up someone else and say "this other guy's claim is unsupported by evidence."

Instead, you'd do this by showing how Peterson's claim is unsupported by evidence, specifically on how his view pertains to the current topic.
VLC has minor issues (though it’s MacOS support has gotten much better over the years) - but as far as FOSS software goes it has among the best UI/UX along with FireFox.

I’d say there seems to be far less interest in improving, in particular, the UX (not even UI, but UX specifically) of usability disasters like Gimp or Blender.
Well of course they did; they were busting their butts all day. I doubt they would have been bothered much by a one pound difference in a laptop though.
Juul to end advertising and lobbying efforts of e-cigarette
You raise an interesting point. If you are doing anything non-trivial, you should definitely be using a main loop and catching errors inside that loop. You really don't want to rely on the default behaviour of orphaned timers, because that can get interesting.

I did a quick test just to see how bad things might get if you were to rely on orphaned timers like this. The important thing to keep in mind is that each of those timers is effectively its own thread, which can throw errors and terminate itself. But if those are orphaned outside of a runloop that can handle those errors, they will not be caught by the catch outside of main (which only catches errors thrown in the "main thread"). Rather, they become top-level, uncaught exceptions, which also terminate the process.

Here's an example illustrating what happens:

async function main() {
setTimeout( () => console.log( 'Hello' ), 3000 );
setTimeout( function() { throw new Error('error 1'); }, 1000 );
setTimeout( function() { throw new Error('error 2'); }, 2000 );
throw new Error('oops');
}

main().catch( x => console.error( x ) );

The result here is that `oops` is displayed (the caught error from the "main thread") and then `error 1` is displayed, but the process is then immediately terminated. Neither `error 2` nor `Hello` are displayed.

Note that I use the term "thread" loosely, in the "green thread" sense. Hopefully the meaning is clear.
This works because no-one is demanding estimates because they want to know the answer, they are doing it to apply pressure to get it done. The project manager is being subject to the same thing, and if her minions are savvy enough to provide a story that she can take to her management, and if she's smart enough to realize that's the most she can realistically hope for, a sort of equilibrium is achieved.
Anybody who has every known the pain of running RealPlayer, knows what a Godsend VLC was. A free player that just works and is simple to use, it put those companies that didn't truly offer anything on ice.
We have quite nice summers actually here in Lithuania while they become quite hot recently because of climate change. Anyway, weather is not the main cause of suicides.
I appreciate you not getting on me for being "stuck on words".

On your opinion on RAM - I disagree. I feel like the way memory modules are psychically, they would probably be detrimental enough (thickness, keyboard, battery, maybe eventual water resistance) that it would out weight the benefits. Besides, you can get enough RAM when you buy the notebook that the amount you get will be good enough far past the date of the CPU being good enough.

On SSD though, I agree. I think with M.2, now with Gen 4 M.2 (and SFF NVMe?), Apple could and should of went to the lengths of allowing that. Even at this thinness, there is not great excuse why not. Besides, its STORAGE. It goes bad, people want to back it up, extract it, recover it, etc. Apple should not have to replace the whole logic board for that.
The arrogance and tone-deafness of such statements astounds me when they come supposed professionals. Those “idiots” you so frequently run into? Yeah, polite people call them “your customers”, or “your boss”, or “people who will complain to your boss”. Or just “people who look at the world differently than you do”.

If you consider the “general population” to be idiots, you:

a. Don’t know how intelligence measurement works. (Hint: they cant all be idiots. Maybe it’s you.)

b. Are still an amateur who will hopefully someday mature into a professional who works with the circumstances at hand rather than complaining that conditions aren’t right for the world to appreciate your genius.
I am happy with my life.
And it breaks keyboard scrolling (at least on Firefox) which pisses me off more than anything else about it.
https://slatestarcodex.com/2014/04/28/the-control-group-is-o...
> When you say you are going to fix UX issues, do you mean you're going to address concerns, or do you mean you're really doing an overhaul.

Both :)
This looks like an impressive accomplishment, and I'm glad Cloudflare got the idea before Google did, because the latter are very interested in hoovering up every shred of data about me to better target their ads. I'll install 1.1.1.1 and give it a try.

However, I had to previously uninstall 1.1.1.1 after I found it draining my battery. I had a few mysterious instances of my phone dying a day early, and I couldn't figure it out until I found it warm one day and dug into what was using the CPU while idle. Turns out it was 1.1.1.1. I uninstalled it and the problem went away. I very much hope that's been identified and fixed by now (I use Android on a Pixel One.)
SoftBank job posting for a valuations director
I'd perhaps consider Warp+ on a computer or the router, but on the phone it seems a bit overkill.

(Though I haven't tried it. So far I haven't received the 10gb Argo credits described, despite being on the waiting list for yonks)
The Health Officials Who Alerted the World to the Alarming Vaping Illness
In fact, once the content and data are liberated, there is no reason to assume it is well-protected from criminal access. Personal facts that are not directly incriminating are often just as valuable for extortion. Those facts need not be about you, to affect you. They could be about a federal judge's brother.

As extortion is the central procedure of spycraft, people trained in its use by the government also have access to the "goods". Criminal intent is no bar to employment by Booz Allen, or by NSA or FBI proper, never mind Russian GRU or FSB or their Chinese counterparts.

Extortion works for anybody.
Circl: A collection of cryptographic primitives written in Go
Deploying Outside My Comfort Zone – 3 Lessons Learned
I once reverse-engineered the complete instruction set of the CPU in a pocket calculator with a built-in BASIC interpreter. That was fun. My disassembler and assembler BASIC programs are still functional today.
The main benefit of let/const over var is that it's block scoped. The benefit of const over let is pretty much nothing, much. It only prevents some limited form of re-binding. You can still easily re-bind const variables from inside a function:

const x = 1;
(function() {
const x = 2;
console.log(x);
})()

or from an argument:

const x = 1;
(function(x) {
console.log(x);
})(2)

So it has limited value in any code that uses closures.
> based on data that they don't tell us how they've collected somehow

For the time being, GDPR solves this.
>Sure, more money would be fun, but most of the people I know who have more money are annoying.

Like a boss.
Social Media Marketing Trends You Should Not Ignore in 2019
Don't know where you got this idea. My mid-2014 MBP has a physical click, where the trackpad actually sinks when I press on it.
Move Tabs from Chrome to Firefox
Laravel background Jobs and Artisan Command Monitoring with Inspector
Did they remove this from the git history? I cannot find the original code or the commit that fixed it.
You don't use any Apple-only software? The hardware I buy has always been determined by the software I need.
If you made a histogram of random phone numbers that people think up when asked to provide one (when they don't want to) it would be cool to see if there are any patterns too. People with certain numbers are probably less lucky in terms of spam.
Have you considered that it is not your job to make a determination?

If someone shares a story like this you politely believe them and move on, comfortable in the knowledge that it may or may not be true.

"Your understanding" is purely anecdotal.
I think you must be crazy to mix in statistics.

That's why each individual case is being judged individually according to evidence, facts gathered and etc.

With the same mindset you could say that if a member of some group is accused of murder, he must probably be guilty because this group of people statistically are convicted more that exonerated?
Find the best paraphrasing example online https://blog.freearticlespinbot.com/examples-paraphrasing-in...
I tend to learn high value software. At this point, there have been so darn many UX paradigms... OK fine.

Unless there is an actual use bug, like things do not work, for high value software, it pays to just work the thing the way it works.

All improvements welcome, of course. And the interesting there is I hope they are good, not just a pretty pass, or rearrange. That takes time to remap. It is nice when it is time well spent.

I tend to give a wide berth to high value tools I get to use gratis.

Perhaps a better UX can be funded somehow.
The iPhone has gotten steadily thicker since the iPhone 6, and has generally increased battery size year over year for the equivalent models.
My counterpoint is apt; it points out that even people who have credentials can be wrong, and it's important to consider that.
Here is the repo on Github https://github.com/arangoml/arangopipe
Revealed: How TikTok censors videos that do not please Beijing
Accurate statement or not, how many people in 1938 had seen a “real card” with which to compare? Having been born several decades later, I think I’ve seen one real SS card in my life: my own. And I lost that years ago.
Building a Rails CI Pipeline with GitHub Actions
I love the cone. It is totally recognizable.

You should keep it.
Both Gimp & Blender have been working on a major new UI/UX. Blender 2.80 was recently released to critical acclaim and Gimp 3.0 is expected in 2019.
I have a question that is more likely to be answered here and now than at any other opportunity I've had before-

For a long while now, VLMC has been a work-in-progress. It is a video editor being made by the same organization as VLC. I've been eagerly anticipating having this as a free/open source video editing tool that I can trust will be available in the long term.

I haven't seen any evidence that it isn't vaporware in a long time. So to those in the know- when can we expect to see VLMC finished?

https://www.videolan.org/vlmc/
I'm using this: https://github.com/uxbh/ztdns.
Or in other words, quoting James Mickens:

> My point is that security people need to get their priorities straight. The "threat model" section of a security paper resembles the script for a telenovela that was written by a paranoid schizophrenic: there are elaborate narratives and grand conspiracy theories, and there are heroes and villains with fantastic (yet oddly constrained) powers that necessitate a grinding battle of emotional and technical attrition. In the real world, threat models are much simpler (see Figure 1). Basically, you're either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you'll probably be fine if you pick a good password and don't respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU'RE GONNA DIE AND THERE'S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they're going to use a drone to replace your cellphone with a piece of uranium that's shaped like a cellphone, and when you die of tumors filled with tumors, they're going to hold a press conference and say "It wasn't us" as they wear t-shirts that say "IT WAS DEFINITELY US," and then they're going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN'T REAL. When it rains, it pours.
Question I wish had been asked: Why wasn't .NET Core given a different name to distinguish it more from legacy .NET? Is there a chance that might happen in the future?

The name was "merely okay" in the late 90s... but then again, the one time Microsoft had an awesome name for a product and didn't change it as part of go-live was Silverlight. Microsoft simply cannot do naming well.
It's depressing. I recently finished a hike from Chamonix to Zermatt, which passes near a ton of glaciers in the Pennine Alps. They are all dying. Moraines exposed everywhere. What is supposed to be a glorious celebration of the beauty of the Alps turns instead into sombre contemplation of whether the next generation will ever know such beauty.

Mer de Glace, near Chamonix, is a particularly tragicomic example because the authorities need to add more and more steps each year in order to take the tourists down to the glacier. It's receding that fast.