skysight-inc/HackerNews huggingface dataset:
Anybody who said that about EAL4+ systems mischaracterized the standard. The standard only specifies resistance to casual and inadvertent attack at that level which is consistent with the observed outcomes. It is only at EAL5 that the standard specifies resistance against moderately skilled attackers.

Note that this is not disagreement with your later point. Most safety critical industries deploy software that is recklessly inadequate with respect to security and have no idea how to achieve the required level of security.
Shameless self-promotion: I wrote a JSON parser for node.js that specifically solves this problem of parsing deeply-nested and/or huge JSON payloads.

https://www.npmjs.com/package/bfj

It's entirely asynchronous, yielding frequently to avoid monopolising the event loop. And it uses a fixed-length buffer so it never exhausts available memory. The tradeoff is that it's slow. But afaik it parses JSON payloads of any size and any depth.
OP, calling them "native" apps is misleading here. "Standalone" may be what you mean.
These caps we’re talking about are normally a small fraction of the total stack size, and few applications run anywhere near the total stack size. I acknowledge your point (and had it in mind when I wrote my first comment), but maintain my position that this capping is protecting against the stack overflow DoS attack: if you’re able to get a stack overflow with your capped JSON parser, you were probably already able to get a stack overflow, because it’s not adding overly much to the stack.

The problem that’s being protected against is user-controlled stack overflow—that’s what makes it a DoS attack.
Yeah I was asking this question on SO - How to responsibly publish a script - but got no response, a sarcastic "Tumbleweed" badge even. My concern was that the script could be easily hosted elsewhere and we'd have multiple versions with potential malicious mods flying around. In the absence of alternatives curl-bashing isn't so bad after all because it promotes a canonical download location from a domain/site you control, even if I hated it initially as a long-term Unix user.
Hi, author here. That was exactly the intent of the title, reflecting the reaction we (almost always) get from developers: "k8s is at fault", the result of most investigations is "not really". I try to make that evident at the conclusions, but I agree without realizing that intent the title is misleading.
Elephants have roughly as long a lifespan as humans and there are parts of the world where their populations thrive, even in the wild. I don't think dying young is a cause in this case.
Pastejacking is not the only possible attack by a compromised server, you can also change the content of the script when the user download it through curl or wget.

Oh My Zsh use GitHub for their script so I trust it more than if they hosted it themselves for example
It only takes a few seconds to "program" a new chord combo into your custom per-project dictionary. You can do it dynamically while you code. (You can also use chords for editor macro commands, which, broadly speaking, are something you "learn once and use forever".)
> Potentially this can be fixable in the long term, but I think humans will almost always(?) be superior curators. Mostly because they’re approaching it from “this is what I like” and not “this is what I know you’re going to like.”

This is why I like that youtube actually recommends music channels, mixes and compilations that are curated and uploaded by humans. It'll be a sad day when totalitarian copyright enforcement makes this a thing of the past.
Any general-purpose programming language that wants to be more than a toy needs an "intricate web of libraries".

The alternative are domain-specific languages - like SQL for example - which people simply do not and will not try to use in arbitrary new settings.
I got a brief look. They were uniformly terrible.
I really disagree with this viewpoint. There's no reason Apple can't simultaneously embrace open standards while providing implementations that enforce privacy and battery life and all that. They could even push to improve those standards. What you have instead is the push for an isolated platform to enforce a monopoly and exclusion. Many of us may like it, but count me out.
We are not even sure if we need a certain amount of background radiation.
This article started life as a more general article about security and trust, but decided to post this particular part in its own article.

There is a lot to be said about trust in software, but in general I agree that mitigations against untrusted software could be improved. The problem with this is that it's often hard to do this without affecting usability and, more importantly, in practical terms for a lot of people the status quo seems to be "secure enough", even though there are areas for improvement we (as an industry) should work on.
I still don’t fully understand the mechanism behind it, but it blew my mind when I found out that you now get personalised advertising through live satellite TV in the UK.

https://www.sky.com/help/articles/tailored-advertising-with-...
What prompted you to write an, essentially, Apple marketing piece when there's no good reason to do so?
The last part of the line reads (rather politically incorrectly) that Apple has more talent available to solve this problem.
Interesting how different your experience was.

I saw the opposite, where repeated removings/suppression of people with different views resulted in the creation of echochambers from which little of value emerges.
The average non-technical user is never going to open up the terminal and run commands. The well educated technical user is going to be vary of untrusted sites and various forms of attacks (which I'm assuming the author of this post falls under).

IMO this is good advice for those that fall in the middle of these two categories, i.e. slightly technical people who run into problems and copy-paste solutions from Stack Overflow hoping that something will work.

> you’re not running some random shell script from a random author

This is exactly what is happening in the vast majority of these cases. These users are going to be vary if linked to an executable or installer, but "hey just run this simple line of code" sounds like a very appealing solution.
“Third party”. In this case it just means “not Amazon”.
If curl loses connection to the source website while downloading the script, then partially downloaded script will be executed, no matter what. This is a main drawback of curl-to-shell piping approach, and the original article is missing it entirely.
No, they just like stealing, and we're not really going to solve this issue until people like them are imprisoned.
You did something wrong if that cost you 400$ a month
The key features used here for PG seems SKIP LOCKED, and the PG notification system, which informs all clients that are directly connected to the database that "this table has changed" so that they can restart their work.

The notification system comes with a cost. You can't scale up the number of connection to a PG database instance.

Therefore you need to go pooling.

And for SKIP LOCKED, I just checked and mysql/maria do have it.
Using random numbers affects the condition about determinism not computability. If universe is not deterministic then the choice made does not depend only on the human making choice but also on the state of generator that creates random numbers. Of course even here it is possible that the state of human is organized in such a way to change probability distribution to not depend on randomness, but that becomes equivalent to deterministic universe with additional complications.

The computability is relevant to the argument because it allows us to create simulation, and to observe a universe from outside. If it was not computable, say required real numbers with infinite precision, and the finite approximations were not able to describe complex things such as humans, then we would not be able to complete our thought experiment.

> The very action of pausing or modifying the universe from without would make the universe non-deterministic.

There are two parts, the starting state and the evolution rule. Here the evolution rule is still deterministic, and the requirement is for it to be able to continue from different starting states.

> Who's choice? If the algorithm is making the choice then the humans simulated by such an algorithm would not have any more free will than a video game NPC.

If human is a part of universe, and does not have a soul, then he is equivalent to its starting state plus the algorithm. If the computation cannot be reduced to a simpler algorithm then no matter how you compute the future state you get that human thinking, feeling and making a choice. The difference with game NPC is that the algorithm doesn't have a hardcoded set of inputs and outcomes but can accept any inputs and produce outcomes that can't be predicted by anything other than that algorithm with that starting state.
Pull Request Done Right
> There's a reason iTunes switched to DRM-free formats early on.

iTunes has spent the last five years very aggressively moving away from that to subscription revenue because it makes no money.
Even though you’re happy with the way Apple is handling the user rights you’ve abrogated to their control right now, make sure you’re still going to be comfortable with that indefinitely because the tighter you’re locked into their ecosystem the harder it’s going to be to escape if different leadership with different priorities or incentives comes into power and starts making changes you don’t like.

Enlightened despotism is the ideal government in many ways. The fatal flaw is guaranteeing succession of another enlightened despot instead of an ordinary tyrant. This is why preserving choice, however messy, is so important.
Is that really much of a problem? I can't remember the last time I had a download fail part the way through and they are usually much bigger than a bootstrapping script.
> How would Fair Use and libraries work if copying alone were illegal?

Libraries pay content owners in virtually every country in the world.
No. It's addressed in the second last bullet, Partial content
Baby’s Anti-Slip First Walkers
Keep the hot stuff on a nvme.

Your archive on bigger drives next to it. Problem solved.

If that's not enough use zfs with a nvme cache and add a few more sticks of ram I to it.
That's not how I'd define patent trolling, honestly. I'd include some restrictions on the patent itself, and how novel it was.

What the Wright brothers did was like planting a tree and then claiming that the fully grown tree came from what they did. Patent trolling is like adding a leaf to an existing tree and then claiming the entire branch it's sitting on.
If people have access to change the content of the script then they can also change foo-1.2.3-src.tar.gz or foo-1.2.3-linux-amd64.gz. These are all general problems with downloading anything from the internet.
If validation is necessarily included in parsing, then the title -- parse && !validate -- is impossible.

The title of the post says "don't validate," and so I initially expected it to relate to the mantra of being liberal in what you accept, etc.
C++ was not intended to be "opinionated" in the way that you believe; consider taking a look at Bjarne Stroustrup's "Design and Evolution of C++", or just his presentations at CppCon conferences over the past several years which focus on the history of the language.

Now, it's true that C++ has seen significant changes, but:

1. C++ is, indeed, a multi-paradigmatic language; and in recent years it is becoming easier to write code using other paradigms - particularly functional. But your old code, and programming style/paradigm, still work just fine. C++ changes by addition, not by removal (with tiny tiny exceptions to this rule). So you can keep your opinion.

2. It was "always" known that C++ is a work-in-progress language, and that a lot of its idioms are temporary studs until something better is formulated, implemented, tried and standardized. In a sense, we don't even have C++ yet, we're just gradually getting parts of it.

3. The most significant ones so far were in 2011, while you were still writing. (C++2020 is arguably as much of an update as C++2011.)

4. While the changes make the language larger, they also very often simplify a lot of coding tasks. A prominent example: With C++2017 you can avoid a lot of "template metaprogramming" voodoo in favor of compile-time-evaluated code.
There are some cluster parameters you simply cannot change because api refuses or are not available (node cluster dependant parameters also). Example can be HPA downscale grace periods..
I'm not following. Can you give an example of such changes which make C less-usable? Also, are you referring to changes in the C standard or just the implementations?
I mean it's unlikely but imagine it did happen and something in the script like "rm -rf /some/path" gets truncated to "rm -rf /" & immediately run

Even if your connection is TLS secured an MITM attack of causing a connection reset after X bytes could be a viable attack
I'm right now notperfectly happy about the streaming situation but it is much better then ever before.

I don't cancel Netflix because I don't mind anymore. There have and still are a few really good shows which would have cost me much more money what Netflix costs me.
http://philsci-archive.pitt.edu/16088/
Does anyone know a good technical comparison of swift vs Kotlin (and eventually vs rust and typescript).
I would like to see their singular features and their misfeatures.
Right but the attacker can make it look legit even for someone that look at the script. The attacker can change the content of the script by the user agent or even by detecting when you pipe it to bash[0]

[0] https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...
3p == 3rd Party Seller.
Yes, any idea about why isn't it used in the original article above?
Please check how aws recovers from lost master node. Its pretty straightforward from there.
Wtf?

Any more information on your comment?
I love Swift very much but every time I look at the disassembly view in Xcode while debugging, I lose faith in it bit by bit. With my (rather limited) knowledge of what a C or C++ program would compile into I have some expectations of what I'll see in Swift's case but the reality ends up being orders of magnitude more complex. Orders of magnitude is no exaggeration. For example this:

(myObject as! SomeProtocol).someMethod()

translates into hundreds of executed instructions, a bunch of nested calls that somehow end up in objc_msgSend (!) even though none of the objects on that line have anything to do with NSObject. Let alone ARC atomic acquisitions, etc.

For one thing, Swift is hardly ready for application domains like audio, video or games. No doubt it can make the development process so much faster and safer, but also less performant by exactly that amount. Swift is beautiful, surprisingly powerful and non-trivial (something you typically don't expect from a corporate language, having examples of Java and C#), but the run-time costs of its power and beauty are a bit too high to my taste. A bit disappointing to be honest.
Yeah "it will happen anyway" misses the point that curl will notify you of the failed download before you run it, whereas piping it to sh will immediately run it
Developers: It's super easy to bypass Android's hidden API restrictions
> copy-paste solutions from Stack Overflow

On the other hand, a solution on SO that would be a hidden attack would not gain upvotes and be an alternative for the one seeking advice there.
I always install docker using simple command

curl -fsSL get.docker.com | sh

Instead of copy pasting dozen of commands from docs / SO
> If your users are on iOS

This discussion is about the Mac App Store. Electron apps have never been allowed on iOS (nor should they be, given the resource constraints of mobile devices - Electron apps would be murderous on battery life).
>I mean, I guess it would depend on how you are introducing the gene. How many cells it is getting into.

It's cancer. You're trivializing the ultimate source of the problem. If we could ensure universal targeting of cancer cells, we wouldn't need a technically elaborate method of cellular death, like gene modification.

You might as well suggest solving world hunger by just feeding everyone.
Are our brains so inferior? Wouldn't someone who studies those ground-truth records long enough learn to see the data?
I would love to hear the original audio from that game between a precoscious 6 year old and Garfield. It sounds like it would be totally adorable and also informative. I got the Magic bug in junior high school in the early 90s and it was a blast that definitely enhanced my life and expanded my friend circle throughout high school. I vividly remember going to a small local tournament, meeting a ton of people and very much having a feeling of 'these are my people'. It was amazing.

That was back in 4th edition days I think (I know it was during release of The Dark expansion, I bought a box of boosters for that... was a bit disappointed). It seems the rules have changed a bit since then and the game itself is quite a bit more complicated. Lots of counters and tokens and such that weren't so much of a thing back then.
Thanks, this looks good. I'm reading it and it does make it seem hard.

> "The product sells itself? ... But as many startups discover to their horror — after they “land” users and try to “expand” to more departments in a large company or government agency — this is far from the truth. "

> "Decision-making in large organizations is a long, tortuous process due to legacy technology deployments, internal politics, entrenched homegrown solutions, sunk cost of integrations, account control by incumbent vendors, and the sheer size and scale involved"

How can 1 person even approach this difficulty?
Minor correction: it's "status quo" and I think it should be italicized.
> A 4K intro (a decent one anyway) is much harder than a larger one. "If I had more time I'd write you a shorter letter..."

Disagree. Yes it's hard, but all good demos are hard.

The difference is that you can write a 4k as a one-person project, enter a competition and have a chance to end in the top-three.

As soon as they get bigger, and IMO this is already the case at 64k, you need a team of at least 2-3 people to be competitive. You're going to push as much code/data into 64 kilobytes, and once you get the hang of this, you'll realize this is in fact already an ocean. There's no way that a single person is writing the audio synthesis engine, the musical score, texture generation, model generation, scene direction, animation sequencing tools, and whatever else. Yes, demosceners are very interdisciplinary so certainly a single democoder could take on a few of these roles. But if you want to be competitive in the 64k compo and win a prize, I'm going to argue that these are just too many roles for a single person to really excel in all of them.

For bigger demos, the expectations are even higher, and I really can't imagine doing it as a single person (except with no intention to win).
Oddly enough, I find that I type fewer keystrokes when writing Java than, for example, Python. The boring predictability of the language allows the IDE to guess what you're thinking most of the time.
Yeah, I agree with that. But it's one thing to say "sorry, I had no way to test against your browser", but quite another to say "I am going to intentionally break this browser because it's too 'old' by my standards".

You can apply for a free BrowserStack accounts for open source projects btw[1]; it's still a bit of a pain, but better than nothing.

[1]: https://www.browserstack.com/open-source
C++Cast: CRTP and Israel Joining the C++ ISO
A large proportion of the more interesting and shareable stories are creative writing exercises. This is almost certainly one.
A common solution is to wrap all code within a function. This way nothing gets executed until the last line, the one that calls the function, is executed.

function main () {
# all code goes here
}
main
One issue with these graphs is that they show a linear response, from which people extrapolate a linear forecast. People talk about the impact on future generations and such.

But if you closely on the ice cap graph for example you’ll notice an increased oscillation in more recent data. This has been described as a sign of a complex system reaching the end of the linear response, a tipping point if you will.

You’ll need to listen to the experts to interpret the data, and what most of them seems worried about is the non-linear changes.
A very detailed explanation how team building happens and will be interesting how the startups retain this culture when they grow further. Great initiative .
I'm surprised that no one has yet mentioned that piping curl to bash can be detected by the server (previous discussion at https://news.ycombinator.com/item?id=17636032). This allows an attacker to send different code if it's being piped to bash instead of saved to disk.

IMHO, "curl to shell" is uniquely dangerous, since all the other installation vectors mentioned don't support the bait-and-switch.
Solve Problem My Site
He's probably hoping to remain anonymous...
How would it not?
That doesn't follow logically at all since we don't have to choose between the extremes of allowing sites to push ads, or disallow images altogether (your figure of speech is called the fallacy of the excluded middle in classic logic I believe).
>Dude ...

>This comes off as incredibly self-entitled and arrogant.

>That ~~piece of art~~ bag of Rice? It takes years and tremendous amount of people hours to bring these ~~films~~ grains of rice into existence your enjoyment. I grew up in ~~Hollywood~~ a farm, in family of ~~filmmakers~~ farmers. My friends are ~~actors, producers~~ farmer, harvesters, and well anybody else who is involved in the business - and we all dedicate unbelievable hours of love and labor into the ~~“non copyrighted cat videos”~~ bags of rice

>Yes. The system isn’t perfect, but ... what you’re doing is quite frankly, stealing. It’s offensive. We’re entitled to our livelihoods as much as you are.

>Show some gratitude please.

Now that I have changed the object that is "being protected", do you see how unreasonable and senseless your argument is?

Those arguments you used could be used exactly as they are to argue for any monopoly whatsoever, and then we would all be worse off.

Of course you're entitled to try to make a living, but if you making a living requires the state to subsidize and enforce your business model, then maybe you should change your business model.

There have been artists, writers and inventors for millenia, and for the vast majority of time they haven't needed an intellectual monopoly l, so why do you ?
You're trivializing the ultimate source of the problem.

No, I'm not. But it's occurred to me that I'm imagining this as treatment for Tasmanian devils that already have tumors. Maybe other people are envisioning it as a preventative measure.

And maybe that's part of the problem in trying to discuss it.
I was on Firefox back then as well, and the only place Chrome(ium) ever seemed faster to me was initial startup - which was irrelevant because I always had the browser open in the background.
On a phone they stack up vertically, in that setting it’s quite natural to want to have the time axis aligned too. It makes correlations stand out more.
Unrelated to the issue:

I've been asking this hundreds of times but never got an answer, why doesn't Sendy add a visual e-mail builder?

Customers are going crazy over the issues with Wysiwyg and tables to make simple two-column designs, while drag/drop builders are straightforward and simple while keeping the code fully compatible with mailers.

Basically all competitors have drag/drop builders now, even the simpler one-time-pay scripts on Envato.