skysight-inc/HackerNews huggingface dataset:
This seems like a really poorly thought out proposal.

From the draft's [1] intro, which provides motivation for the proposal:

> When security vulnerabilities are discovered by independent security researchers, they often lack the channels to report them properly [...]

Occam's Razor: they lack the channel to report those vulnerabilities because the company doesn't give a damn about security, not because of some hitherto unsolved technical difficulty.

Companies that give a damn about security already have either a "catch-all" contact for security related things displayed on their contacts page, or have dedicated pages detailing what the hell you are supposed to do to report a vulnerability. Companies that don't give a damn will continue to not give a damn and will ignore your document, and will continue to suck at security until someone starts punishing them - monetarily - for such appalling behavior.

But let's leave that aside for a moment. Researchers spot vulnerabilities. Need a way to report them. So what's the solution?

Apparently, a text file with only one mandatory field...

> 3.5.3. Contact

> This directive indicates an address that researchers should use for reporting security vulnerabilities. The value MAY be an email address, a phone number and/or a web page with contact information.

...which contains... er... a catch-all contact for security related things and or a link to a contacts page detailing exactly what the hell you are supposed to do to report a vulnerability? sigh...

But the real kicker is that that the standard doesn't even require that the contact information is up to date or valid:

> 6.2. Incorrect or Stale Information

> [...] Organizations SHOULD ensure that information in this file and any referenced resources such as web pages, email addresses and telephone numbers are kept current, are accessible, controlled by the organization, and are kept secure.

In case the meaning of "SHOULD" is in question see RFC 2119 [2], but basically, they "strongly recommend" that you keep your contact information up to day - instead of, I dunno, REQUIRING it, since having a channel to properly report security vulnerabilities is the ENTIRE POINT of this exercise?

/facepalm

Are we really supposed to take this seriously? This is simply security theater.

[1] https://tools.ietf.org/html/draft-foudil-securitytxt-08

[2] https://www.ietf.org/rfc/rfc2119.txt
They added Tracking Prevention a while back (which also blocks Google) and (so far) they haven't merged back some Chrome changes, like removing "reopen closed tab" from the per-tab context menu. Given Tracking Prevention I have faith they'll take a stand with webRequest.
The first x86 assembler snippet, example 1(a), on page 2 is really amusing. It shows a profound lack of experience with x86.
> "The goal is to appear to be a "integrative" bargainer, while actually bargaining for your own position."

Yes! I negotiate compensations on behalf of engineers (as an engineer --> tech leader --> and now technical consultant working for engineers (and tech adjacent professionals) directly, and not as a recruiter paid by companies).

While accepting a job offer in terms of the total package might be "integrative" in some sense, when discussing any one component, say salary, it is very much "positional."

Job negotiations tend to be among the most impactful negotiations we make, so if you're curious for my take: you absolutely want to be polite and work with the recruiter to find the offer package that works for you, but it's more about effective self-advocacy and making constructive, intentional statements than either "positional cageyness" or "integrative creativity."

In my experience, general negotiation advice doesn't generally apply to heavily imbalanced job/salary negotiations. Companies have more information, authority and experience when it comes to job negotiations, so leveling the playing field means increasing your information, leverage and practice in specific ways. It's not like buying a car or selling a rug... you're beginning a long-term relationship with extremely high stakes!

This comment is maybe less helpful than I intended, so if you'd like to learn more, send me a note and I'll make a better attempt at sharing more concrete tips and scripts.
>Why is this a problem?

I don't see it as a problem; my boss sees it as a problem. I've tried reasoning, but without that direct connection of "what am I paying you for" it just falls of deaf ears.
Buybacks are not about creating value, they are about transferring value which already exists back to the legal owners.

Banning buybacks would leave money in the hands of the managers/administrators. Only suggest this if you feel CEOs are under paid and control too weak.
Interestingly, at DefCon last year, a presentation was talking about how in Africa there are interposer SIM shims that slip over the top of the simcard and provide additional functionality. Citation needed, but I was impressed they could fit a small MCU in such a thin form factor!
Google's UX is the reason why I switched to Fastmail. Gmail became unusable on the web, even with a gigabit fiber connection it was impossibly slow, I was waiting 10 seconds+ for things to happen. And Gmail on android still doesnt have darkmode.

For sure to each their own and no app is perfect. (I would love Fastmail on android to have offline functionality for instance)
$2,000 from Syncronys and $2,000 from the attorneys fees (which totaled $35,000). That got me my first car, and a lesson... The attorneys always win.
Conversely, searching for the meaning of a forward slash is not the simplest thing in the world.
Wasn't there just a court case that ruled CBP couldn't force you to unlock your device without a warrant? Like just 2-3 weeks ago.
Wouldn't it be hilarious if the bank prior to the buyback bought a bunch of the stock (I don't know if this is true, but seems plausible). Then in that case the company would literally be taking out a loan from the bank in order to buy the stock from the bank. So then the question is if its possible for the bank to claim some sort of thing where when they sell the stock to the actual company that it is some special type of transaction and maybe gets favorable tax treatment? Wow I want to look into that.. sounds interesting / shady if thats possible to do..
For that matter, depending on your field, you don't even need to search actively... just clicking the "allow recruiters to contact me" option opens a virtual floodgate... though I do wish I could filter by salary and location in terms of those contacting me.
Make It Simple: A Tale about Robert Dewar, Ada, and Gnat
Wikipedia requires available sources, not reliable sources. Any published website is acceptable, regardless of fact check it standards.
Why is this a complaint? If you get all of the value you need out of the non Pro products, why is it a big deal that they make more expensive products for people who want/need them?

I have no need for the 12.9 inch iPad Pro. The $329 iPad fulfills all of my needs - but I did upgrade to the cellular model.
> I'm curious why this hasn't happened yet

There's significant support for drastically changing Market street to be car-free(er). The Better Market Street SF project was unanimous approved this past October! Starting January they will be closing Market street to private vehicles - no Uber/Lyft, only buses, taxis, and commercial vehicles (for eg, the farmer's market). This $600 million dollar project will add proper bike lanes, separate from the sidewalk, widen the sidewalk, and turn the boarded up storefronts into a flourishing urban environment.

http://www.bettermarketstreetsf.org/
And for anyone who doesn't know why .files are treated differently:

In every Unix folder there are two special files, named '.' and '..' - the first is a link to the current folder, the second to the parent.

It was annoying to see these two files listed every time you wanted to see what was in a folder (using ls) so `ls` learnt to not show these files by default. The way that was coded was (erroneously) to not show any file whose name started with a '.'

People eventually realised that this had the unintended side effect of hiding files that start with '.' and found it useful, so the bug became a feature.
Not really. Arbitrage opportunities typically occur when the risk and opportunity can be defined such as spread and liquidity across exchanges or contracts, euro denominated vs USD denominated assets, etc. intrinsic value is much more subjective. Yet, there are times where stocks might drift above or below their intrinsic value significantly. For instance, many CPG companies have become bond proxies due to rates, where the price only makes sense with a 3-4% discount rate.
> markup to create bindings to reactive data

Right, and my argument is building this in JavaScript directly (rather than a HTML-ish/JavaScript-ish template language that gets converted into JavaScript) is a better model.
Ugh, i'd put a gateway in front of it that transformed the status codes to a 200-response.

Instead of building your api according to the default Android client ( ps. Lookup BFF microservices)
The only thing you can do to hurt a bad manager is to quit, depriving him of your good services. Eventually he will be sacked, but not before you.
Universal limiting mean return of CPPI investment portfolios
Sacha Baron Cohen Criticizes Silicon Six Billionaires in Viral Speech
Matching doesn't "effectively triple" the donation, because the matched part is someone else's donation.

Deceptive tactics like this are toxic to charitable giving culture.
I do know what it's like to do nothing. I don't know how you've lived your life until now, but I bet this situation is new to you. You'll have to learn how to fill up your time with meaningful things despite of negative thoughts overflowing your mind. You should one of this days sit down, put down the cellphone somewhere it doesn't distract you, grab some paper and a pen, and write down how you feel. You'll see that writing down your situation and feelings will help. Don't underestimate the time needed when doing this, and don't think it'll be easy to find something worth your time. And lastly, don't hesitate to try new things, unless they're drugs or alcohol.
> The decisions are based on the battle to recruit and retain top talent. More of those companies are moving to the Beltline.

The fourth paragraph.

Less directly, they quote a spokeperson:

> This new office space will allow us to grow while inspiring new and existing talent
Christina Coleman, director of campus planning and operations for Chick-fil-A
What's the recommended way to deal with projects that have system level dependencies? (E.g. in C). I have build scripts but no way to install anything. Do I have to use docker or some other container technology?

Edit: sounds like they plan on allowing docker containers which would be really nice. Great job on the MVP.
This is nonsense. The spec is wrong. There is no chance I would consider two URLs with equal local parts and query parameters, but different authorities resolving to the same addresses as equal -- that would be WRONG. The authority could easily provide different semantics for the same URL based on differing Host: values.
Plundervolt: Corrupt the integrity of Intel SGX by controling the voltage
Her post linked to in the original blog post makes a good point too: Even if your theory is consistent, it is only as valid as the assumed axioms. Consistency, of course, is necessary in any correct theory of physics, but it is not sufficient and definitely does not make the theory "inevitable". Also, if the consistent axioms are underspecified, you get ambiguous and un-falsifiable theories. Her main target has often been multiverse theories (i.e. how would you define a measure over universes/how could you verify a probability distribution over universes).

In her book "Lost in Math" a target of ire has also been supersymmetry, though she dislikes supersymmetry for another reason, namely the fact that it relies too much on justifications of "beauty" to survive all of its empirical short-comings. In her view, the fact that supersymmetry solves the hierarchy problem is more an aesthetic point (and therefore irrelevant), than a mathematical or logical necessity.
A stock buyback is not like the company is buying its own stock and holding it in a brokerage account.

Think about it like ... the opposite of an IPO. Instead of dividing up the firm into n shares and selling them to investors for cash; it's buying back n/m shares and effectively canceling them.

After the buy back, there are fewer shares of the company which are proportionately more valuable assuming the market capitalization has remained the same.
If Archive.org had your attitude, I would actively oppose it. Removing private, personal info is not censorship. And nothing about "just don't put it on the Internet" is simple. What if someone hacked your devices and then put it on the Internet for lolz? What if you shared it in confidence with someone you trusted, who is intentionally putting it on the Internet to hurt you? What if you accidentally pasted the wrong thing or uploaded the wrong file? What if you were a child and didn't understand the dangers?

There obviously should be ways to ameliorate your mistake, which is why it is absolutely critical that Archive.org has a removal process.
It’s the integration and testing and support that Apple offers.

In fact, the more demanding your requirements, the more likely you need all of these fairly exotic components to work seamlessly together.

If you’re working on the next Star Wars movie, there are billions of dollars at stake; you can’t rely on some Linux box a guy you know put together, no matter how good the specs supposedly are.

Even if you could get comparable components, you’re not going to have the driver support you need. If you have downtime, you can’t wait for some guy on an email list who’s day job is not supporting this mission critical driver, to get back to you.

And you’re not going to get the performance of Apple’s APIs like Metal2, etc. which blow OpenGL, etc. away.
The barely contained boiling jealousy this author has for Paul Graham makes is really difficult for me to read this without immediately dismissing it.
In some countries
>The problem is people disabling that existing 400’ limited mode without FAA approval.

>Would mandating ADS-B on drones provide enough warning to other aircraft?

I assume the same type of person might just disable the beacon..
Real-Time email marketing insights for the 2020 U.S. presidential election
When I read your rationale, it feels a lot like literal programming, as I experienced it when reading PBR[1].

But without the documentation around it, I'm not sure I feel the same way about it. It feels harder to reason about what where why.

Also, I'm assuming bugs should be fixed without using this layering. After all, without that layer you got broken code. But often I find there's not a clear-cut distinction between feature and bug fix. What then?

Anyway, interesting idea, would have to try it to get a feel like I said.

[1]: For example http://www.pbr-book.org/3ed-2018/Sampling_and_Reconstruction...
But then again, an HTTP server is allowed to provide different semantics for an URLs depending on the authority portion of those URLs.

So, no, this is not remotely Ok at all.
That's quite a feat, at 16 years old I was still solidly stuck in 8 bit 6809 country, and I'm fairly sure I would not have been able to follow the mechanisms at work here.
for most public websites, you can reverse engineer the rules pretty easily by trying to create accounts. this can be automated pretty easily.

in any case, the only reasonable rules for passwords are probably a length requirement and possibly requiring numbers and/or symbols. knowing that a password must be at least 8 chars and include at least one number and a symbol does not reduce the search space by much.
My favorite is when I correctly type the next letter of my intended result because I don't notice it in time to "cancel" the keystroke but Windows 10 search removes the result from the list anyway. Then I have to delete 3 or 4 letters to get it back for some reason. Ugh.
You framed it perfectly! There are so many non-private sector institutions out there that I refrained from calling them even quasi public sector. In fact the example you mention of "professional associations" that have acquired regulatory powers is great as most of them are rife and riddled with corruption and act to either the benefit of their management or members and against the public interest.
And with just a tiny bit of effort in corporate politics your technical (or whatever you aim for) impact can become so much larger.
Non-AMP link: https://www.zdnet.com/article/stingray-detector-apps-andorid...
As a drone owner, there is no drone that would cause that much damage, but its easy to blame a drone because what will happen to news crews if anyone can fly a drone and capture their scoop.
Aren't many of those rated 0 because they don't report?
And what ubiquitous built in software would that be?

You're aware there are myriad non DJI options for drone photography platforms yea?
The plane cannot be certified without MCAS or some other stability augmentation. This is not unusual in itself, almost every jet aircraft has some kind of instability. The problem was that MCAS is not reliable and doesn’t fail safe. The fix they’re testing actually makes it less reliable, but when it fails it will disable itself instead of making a smoking hole in the ground.
I don’t know—“culture of trying” sounds too much like “reality distortion field.”

Companies need a few skeptics around to put the brakes on crazy ideas. I’ve seen far more half-baked money pit projects than risks that paid off in my career. In tech in general there is way too much optimism and ignoring inconvenient facts/constraints until disaster is clear. Someone who can EFFECTIVELY steer teams away from horrible decisions is worth their weight in gold.

In the OP’s case, he simply couldn’t effectively communicate this, and failed to notice the rampant nepotism up his management chain, but his heart was in the right place.
What else is small, isn't a bird, and flies? It certainly wasn't a birthday balloon.
If you genuinely have nothing to do then you're a prime target for layoffs. Move on and get a new job or your company will force you to move on when you are least prepared.
...and the given example of something that should be idempotent is posting to create a new VM instance. Which you certainly may do. It's just a funny choice of example since that's the one example where the behavior he describes is potentially expected.
Everyone is attempting to rise to the level of their competence and ambition. I've had the opportunity of dealing with a few billionaires, and their teams. It showed me that we are all just trying to navigate a difficult world.
Microsoft/Facebook Deepfake Detection Challenge: $1M Prize Pool
> It's interesting that this list closely mirrors the precarious stages and situations in life that can often lead to homelessness.

It also has direct knock-down effects.

When everyone has a large (historically speaking) private home, what need is there for public spaces?

If I have a bunk in a shared room, suddenly a well-run tavern seems more interesting.

And maybe, in that public space, I meet people who are dissimilar from myself. And maybe that broadens my view of society and knits my local community more closely together.

... Or I could sit in my home, watching my TV, being recommended media that agrees with me.
Considering no machines are conscious, yes, it is absurd.
I think it will largely depend on your skillset, job role and where you are located.

For me it's like a floodgate and my current and a couple of past job roles were from LinkedIn contacts only.
@ng12 right, you made a claim, I'm just saying, your claim seems unconvincing, and the example you gave doesn't seem to make for good evidence of your claim.
I don’t think this is a function of organization size...

At the megacorp where I work, my manager and I have a very positive relationship. He values me and my contributions. When I am frustrated, he tries to help.

My partner works in a very small firm. Nepotism is the norm, and an utterly incompetent person is tolerated because firing them is politically untenable.

I have no doubts that similar dysfunction can exist anywhere. Surely this is a very per-company, per-department, per-manager sort of thing.
Low interest rates as well as high cash levels. The whole point of markets is to raise cash then pay it off. Not to tank the price and rip off investors.

Also, buying back shares keeps stock prices high, makes each outstanding share worth more (less dilution), so more value for the remaining owners.
No. Most aircraft don’t have ads-b receivers and TCAS doesn’t use it.
Agree, CODEORG-3 adds a bunch of pain. There's a reason other languages don't have headers but since C programmers have to live with them can't I just include the single relevant header and move on with writing my code.
Yes there is a shared cost to that (compile time) but '#pragma once' is well supported and futzing with header order is a non trivial time-sink too.

On the same lines the template 'cute tricks' are where you get your performance, stability and readability from C++. I definitely agree that you should drop into assembly to see what the compiler is doing with your code but that can and should apply to heavily templated code too.
I true for large or institutional investors, but not with 401ks and IRAs though. Also, for large institutional investors, they can time sales to use capital losses to avoid tax burden.
Regarding effectiveness, localizing an access point is trivial, so it's a matter of motivation.
> her video comments are full of climate deniers

Not commenting on the rest because I don't know much about it, but saying that the quality of youtube comments under a video says something about the quality of the video is, I think, quite unreasonable.
Although tan has a set of discontinuities when it jumps between +∞ and -∞ through complex infinity (∞~).

tan(π(x + 0.5)) = ∞~, x ∃ ℤ

(π on my screen doesn't look much like greek pi.)
When I see people using the "sandwich" method on me it is usually pretty clear that the only reason they are giving compliments is just to soften their criticisms, so I would rather just get the criticisms on their own. Not every criticism or set of criticisms needs to be accompanied with something positive. If there are many points of feedback, some positive and some negative, I think they should be split into logical categories, mixing together positive and negative feedback, rather than trying to completely surround criticisms with compliments.
Which is exactly why it's a fairly unusual choice for an example.
I know Google, Facebook, and Github now have this, though Apple, Microsoft, Amazon, Stripe, and Square do not (to rattle off the other tech companies with huge security teams.)

But I don't really get it. Why is this a good idea?

As 'DyslexicAtheist related, if you put this page on your site, people will crawl for it and find you, and then kick off horrible automated scanners that generate bogus bugs on every site they check, and then submit bounty requests for them.

Meanwhile: what serious tester would be impeded by not having this page to refer to, if you have a /security page on your main site, which you have to have anyways for this to work? Recall that most of the fields in security.txt are themselves just URL pointers.

I also think the RFC itself is kind of funny. Do not rely on security.txt as authorization to test a site! it says, as if an RFC really had the authority to establish that, rather than an expensive court case in which both sides of the argument will have competing claims about whether testing was allowed or (the US default) not.
I wonder what this means for manned spaceflight that SpaceX is working on. Is it still a waste of money, or have things changed enough to make it worth it?