skysight-inc/HackerNews huggingface dataset:
I dislike write-ups like these where the "researcher" styles themselves some kind of roguish hero, protecting the world from the lazy and incompetent by exposing their vulnerabilities for all to see.

I'm not opposed to responsible disclosure. But I think there's a big difference between finding a vulnerability responsibly (during normal operations, during a sanctioned pentest/bug bounty) and discovering a vulnerability illegally and irresponsibly (spending multiple days, specialized tooling and building a target profile to attack by any vector necessary.) I think this behavior gets a pass from too many people because hey, it's a cool fun puzzle that shows how great and smart you are!

This absolutely would not fly in the real world. Imagine deciding to kick down the doors of small business owners and gloat that they don't have steel doors. "I'm not here to steal! I'm PROTECTING you! Imagine if I'd been here maliciously. I'm just going to go tell the world your door is open -- your customers deserve to know how insecure you are."
I'll eat my hat for this, but effectively the mitigation to this is clearing all caches and internal buffers in the CPU on each context switch.

I'm sure we'll see more types of leaks, but unless they're actively fetching invalid data [1], there isn't much sensitive data to leak anymore.

I don't think there is much during speculation that can load _new_ data during that window.

[1]: So far almost every CPU bug has leaked something in an internal cache.
>I reached out to the CEO and basically the first question whas who was it to leak this and then basicly a statement that the company did not accuse me of anything and there is nothing that can be done about the gossip.

If it was a formal statement then you have nothing to worry about. If the slander is getting to you mentally, you could seek legal counsel but sounds like they can't actually do anything to you

If it was not formal, and there is a chance they can take you to court, then you need to get legal counsel, as you need to prep for defending yourself in court. If, as you say, they should not have anything which points to you being the malicious one here, then the hardest part is going to be the lawyer fees.
Are you seriously this naive? No matter what they will think. Facebook pays their rent... So working there and standing up agains the Zucc as a small employee is pointless.
Approach to what? User registration? Tracking fake accounts?
There is no multitasking for regular programs in DOS: if a program launches another one, the parent is simply paused until the child exits.

Also DOS used various interrupt handlers (not just the synchronous int 21h)
Half Life : Alyx, coming soon to everyone, except France.
Doesn't change that it gives more power to google to shape web technologies.
[random advice from the internet]

"Get in your car" and go see your users instead of sitting at your desk. Seeing is the best way to really understand context and understanding the context in which your customers operate is important for B2B sales. If you can't afford to visit potential customers then it is likely that either the project is under-capitalized or that the project is not economically viable. Under-capitalization and economic viability don't matter for a hobby project. But they matter greatly for a business venture.
>...and end up shifting the complexity into cluster administration rather than programmer time.

Sometimes, that is the right thing to do. The problem is when the cluster solution also adds to the programmer-time complexity.
>I think the lack of a wide college education has reduced the discourse in the country (prior cheap college in the US was largely contingent on the Cold War and the GI bill; it's very complicated, but I do think it helped us collectively in the 50s-70s).

I feel in this case, waiting for college is too late and the improvements should be done at the grade school level. Only a fraction of the population goes to college and as such even if the education from college was perfected, it would only apply to that fraction of the population. While controlling costs may help increase that fraction some, it would not help with those who find college not in their future due to academic limitation instead of financial ones.

Overall, my own personal problem with this proposal comes from my own experience at college, where I saw numerous people who took 5+ years doing so because they prioritized fun over education. Taking minimum course loads, partying instead of studying, etc. I think much stricter requirements on academic achievement would be needed for me to be willing to support such a plan.

What do you think of a shorter term solution of allowing student loans to be discharged in bankruptcy?
It's C-x M-g b in my Emacs, but doing this annotates the whole file, which gets distracting enough for this particular purpose. Still, I use it frequently.
That's kind of like asking how Vint Cerf and Bob Kahn feel about intelligence services tapping internet traffic.

Not very useful.

A more cogent question would be "For anyone in Facebook working on this problem, do you feel like sufficient organizational resources are being spent combating it? Is there low hanging fruit, or are we into the whack-a-mole stage of any popular platform with a financial incentive to cheat?"
The OP likely already has material damages to point to. Reputation loss falls under speculative damage, as loss of a business or job opportunity may happen in the future due to his previous employer's actions.

As others in this thread have advised, hire a lawyer and discuss what your options are.
More to the point, I've usually found those double tall Enter keys to be a detriment because if you hit it on the bottom half like a regular Enter key sometimes it binds up and doesn't register.

It's a waste of space IMHO and I tend to shun any keyboard that uses it. Especially when it shoves the |\ key to some really inaccessible location, like to the right of the right shift key or obnoxiously puts it where the backspace key should be and makes backspace even harder to reach.
Not really; hiring Python and Java devs is very amenable to keyword-driven recruitment. Hiring C++ devs in the same manner is a clusterfuck waiting to happen.
It’s a disgrace, and they won’t say boo about it. Not only that but they promoted the guy. Pretty sad state of affairs over there, no one should take their editorial board seriously.
Yeah, time estimation is really tough. When I started I figured out I just needed to take my time estimate and double it. Then I got really analytical about it. Now I take my gut estimate and add 20%, but I've also gotten away from time-based billing into value-based estimating (that's a whole other very deep subject).

The "really analytical" phase wasn't too crazy by HN standards:

- Break the complete project in Pivotal Tracker down to stories no larger than 8 points

- Track the time spent on each story in Harvest

- Use that data to figure out how much time a given point score equated to, along with variance.

- Work to reduce the variance.

I should also say...I've been estimating software for, good god, I haven't done this math lately, 18 fucking years. Do anything repeatedly that long, your instincts become pretty solid.
Very nice. I dream of the day our networking instrumentation is good enough that when I click on a link and my browser hangs doing nothing, I can switch to my monitor app and have it tell me exactly where the route is failing.
What were the creepiest declassified documents of the last decade?
Some LOLbin Examples for Antivirus Evasion – Silly Rabbit, Trix Are for Kids
Resources are finite.

A "depth-first" search is a poor choice because it takes a lot of resources fully test any given "cure". A "breadth-first" search (as you are suggesting) is a poor choice because there are simply too many things to try. It has to be something in between, and researchers use heuristics to decide which branches to pursue. Sometimes they focus too much on the wrong branch.
React Router used to be a mess. And should I use Redux? I thought it’s not cool anymore. If I do, do I store everything in a global state? Maybe I’ll use Context and Hooks. Or was it HoCs? And what about mobX? I heard it’s like Vue. I like Vue. And I absolutely need something to handle requests. Saga? Maybe some GraphQL? Now that I have my views, my state, and my data, how do I test this? Jest or something else? But why write tests if I have Types! How to configure TS? A few any never hurt anyone, did they? Too many questions. I’ll let Create React App answer this for me. Or is it Gatsby? Or even Nextjs? Oh, and is Lodash the new Underscore? And what is different about those and Ramda? We need more FP! But how do I structure my Code? Dan “Daddy” Abramov tells us to organise it any old way. But how? [0]

Angular and to a lesser extent Vue give you more direction.

This is of course not inevitable in a React project, but it does take good technical leadership not to be hindered by analysis paralysis before you even set off.

0 - An exaggerated summary of what I gather on various forum and discussions.
My problem with sync on mobile is that it appears to be impossible to manually sync the data when the phone's general sync setting is set to off (When I want no apps to sync). My email software let me manually check for new email... this appears to be a Firefox bug.
Adwords, as in you pay to advertise the site on Google?

I found your project since you previously posted it on HN and linked to it in an answer below (hope you don't mind, I'll remove it if you want).
I think his point was that these symptoms could be correlation, not causation. So you need to work to prevent each of them as you age. (Eg that flossing is good for your oral health, even though it might have no influence on other factors associated with being old)
Glad to see that http://pn/ and http://pn./ are both apparently working.

I'm pretty sure that at one point I had to supply the trailing dot to make the browser (or resolver) believe it was a real hostname.
You can programmatically send hits to GA from your server, and get the benefit of the nice UI.
The problem is that if everyone involved in this aside from Bloomberg is doing their jobs correctly, we would never know the truth either way. This is not a thing anyone involved would actually want us to know.
> If I can find counter examples to that argument that simply then there is something wrong with the argument

Except that you didn't. All you did was to state your opinions against the argument without any reasonable refutation.
So Google Titan keys have a pretty bad track record when it comes to security:

https://www.engadget.com/2019/05/15/google-recalls-some-tita...

It's not possible to have a provable chain of trust on hardware as others have mentioned in the thread, even in the device you mentioned there is no proof that the code the manufacturer intended to run on device is the same code running on the device. Also its closed source so you wouldn't even know what code they intended to run.

In fact with Google Titan you have lots of other issues like that it's actually just a rebranded Feitian key, a China based company with unknown supply chain or possibly even China govt mandated backdoor. More on that here https://www.securitynewspaper.com/2018/09/06/experts-ask-goo...

You can check out the hardware of your key here, there is no tamperproofing at all.

http://hexview.com/~scl/titan/
Isn't that what StickyKeys is for?
From the 90s on what Boeing said, the FAA signed it.
I agree with your assessment. That's why I am trying to explore the possibilities without looking at the money aspect of it at all. Thanks for your comment.
Show HN: DueFocus-How much time you spent on work, communication, learning, etc.
CloudtPass Developers
Interested in building long term relationships with developers whom have experience in Stackpath, Java, & Sim Card programming. It would also be beneficial for candidates to have experience in developing e-commerce, social media and live streaming online experiences. Please send CV to mail@dxtxbxnk.com

www.cloudtpass.com

Thanks Everyone!
> Very curious about what Facebook's response is to this (outside the response mentioned in the talk, which is clearly not sufficient)

i.e. what would be sufficient in your view?
It’s not an issue of the supply, it’s an issue of the current paths inside the chip or on the motherboard. With smaller features and more complicated routing there is more inductance.
Sequence to Sequence Models in Neural Networks
Email addresses are case sensitive, at least you’re supposed to assume they are.
That's what throwaway accounts are for.
I always enjoyed one of my friends grad-school supervisors approach to letters of recommendation:

"Such and such was adequate for my lab therefore they would be more than adequate for your lab."
I'll definitely check this out. One of the issues I ran into with ES6 module importing was the dependencies of dependencies which didn't have ES6 importing options. So, I found myself editing source code for dependencies which couldn't be imported. Web development should be moving into this direction in my opinion. I hope the project works.

Webpack does more than just module importing though. Tree shaking, minification, uglifying, compiling SASS and a lot more.
You do realize that multiple domains may be hiding behind the same IP address? This is very common with CDNs (although the bigger players can afford a static CDN IP, I guess)
> This cannot be translated correctly into your language

You must also take in account culture and other adjacent factors. I born in Colombia, and you don't imagine how HARD is to try to translate tech terms to Spanish.

Even where a "oficial" translation exist, use it could convey so much wrong ideas that I must use the spanglish version of it most of time (except if the translation is of COMMON use).

And the oposite. Is very funny when a foreigner come here and discover that not only need to know spanish, but also the "Colombian" variety and the "my city" variety too.

One funny? My brother (know english and work as mandarin translator) list to a foreign friend how many ways we say "hello!". Are DOZENS of it in use here! Several of them are INSULTS! You say an insult to other and we know when is a HELLO!

Nuts!
Sorry, didn’t mean to twist your words; I misinterpreted what you meant by that example.
I'm calling bullshit on the claim that languages can be placed on a scale of expressiveness. You will first have to define expressiveness and then how to measure it.
Yup - I LOVE temporary containers. I feel so cripple when developing outside of Firefox now.
Poking around the ruby code, it looks like it's any place that GitHub attempts to generate a link back to itself. The formatter generates the URI and then validates it against the route matcher, notices that the username constraint isn't matched and bombs out at that point.

I'm not familiar enough with this code to know the potential side effects of changing that, so I'll file an issue for now, but that' the gist of it, for those curious!
Everything from https://simpleisbetterthancomplex.com

I love his simple and elegant tutorials on very tactical topics.
Yet another reason to take a look at current coupled logic again
Ring and Amazon Sued for Security Camera Hacks They Blamed on Customers
Python Was Shaped by Leaky Internals – Armin Ronacher
By some metrics, sure.
Gotcha. Well, I'm not really sure. Maybe just making likes private or banning likes (as suggested in the talk).

Or banning political advertising completely (see the part in the talk on political parties in Germany buying likes).

Or something that completely destroys meddling and fraud and is observable by the public. The "we are working on it behind the scenes"-response is just not sufficient in my view.
But then cherrypicking doesn;t preserve commit metadata, does it?
On macOS 10.14.6 the command starts but the frames stays empty (silent error) because of SIP

"Sandbox: lsof System Policy: deny(1)"

Otherwise, really nice idea and work!
For a lot of employees, Facebook pays enough that paying your rent should not be an issue after a couple of years working there if you're in any way financially responsible.
Any plans about create a library around this tool?
This is trash panda Marketing.
Well, in my case described above, single server solutions include an automated backup sub-system, and my servers expect multiple instances of itself to running on the client network, and these multiple instances synchronize with one another via additional endpoints specific for the purpose. The whole issue of HA and backups is critical and one of the areas my approach shines.
Ring and Amazon get slammed with a federal lawsuit
This is a great presentation, goes into a lot of details. Thanks for sharing.
Despite working mainly with TS and React, I almost agree with the first part. There are all to many cases where a minimal setup works just fine. My hope is that such a restrained setup inherently suppresses stupid features nobody asked for. And yet here we are.
Low-Income Baltimore Blocks Host Bigger, More Dangerous Mosquitoes
Good News for Dogs with Cancer
Yes, as noted, there are accessibility options for that, but that's possibly not an option, depending on how locked-down the PC is the people are working on (one person I've seen this doing was at the ticket counter in a train station; I'm not even sure whether they still had their DOS-based system back then). People tend to use an option they know over one that may be objectively better that they don't know ;-)
Svelte was mentioned here yesterday. It's not like the old jQuery days, but it did look simplified to me as compared to other popular toolsets.

https://svelte.dev/

Some examples: https://svelte.dev/examples
I love kākāpō so much. They had a record breaking breeding season last year and it was an absolute joy to watch it play out in real-time on Twitter.

Follow https://twitter.com/takapodigs there - he works directly in their conservation and tweets a lot of photos.
Yep, tried this recently after being out of JS land for a while, and Parcel just worked. So +1
Why don't schools scan letters or request them in electronic format and use NLP to see if letters complement grades and test scores in predicting future grades and graduation rates?
Sounds like you must have chosen the expert install option (or whatever they called it) in slackware install scripts..

Are you sure there wasn't also an option to just install a typical server or desktop application set, or just install everything? :)
Actually, no.

But I consider it a useful and unexpensive feature so I'll support it on my blog nevertheless.
Statistically, sitting in a 737 Max is still safer than sitting in your car
"Zwitterion lets you get back to the good old days of web development."

I'm OK with people pining for simpler times. There's a lot of projects that are overcomplicated these days. But the good old days of web development didn't require three files for "Hello, World."
Firefox has bad performance for my use cases. It crashes around 50% of the time I open Gmail, and the other 50% of the time it crashes with any old tab. I know Gmail is bloated and less performant now but it's been my address for 15 years. Does Mozilla want me to deal with the constant crashes or abandon Firefox or abandon Gmail?
Get someone to ask them for a reference for you and see what it says.
The article also mentions it's a calque which emerged only recently.

So... 'yeah' to both of you.
Yep, my guess was and is that someone was attempting to short sell supermicro and related named companies.
What sites need that to run efficiently?
Out of curiosity, is there any disadvantage in making the TODO comments and then removing them before merging the result into master?
> It’d be more interesting to talk about them, and how they came to make the wrong decision for what they thought were the right reason

My guess, essentially holding their finger to the wind. Most orgs can't afford to do real engineering.
Yes. It's still the most convenient way to keep up with news, blogs, product updates, etc. It's also a fantastic way to keep an eye on the competition :)
> In this day and age, feeding into the narrative that science is just another competitive team sport where people compete with whatever means necessary is downright dangerous.

I think that narrative is correct. We can't fix the problem if we don't discuss it. The whole "I believe in science" thing (which you seem to be pushing) is really quite silly.

Funding is a political game and the people who are best at politics tend to be the worst at research (and vice-versa). I think this is exacerbated by the fact that a lot of scientists are hangers-on, i.e. not capable of doing original research. These scientists are terrified of people who can do original research since it makes them look bad (and feel bad, it's actually depressing to think about all the people out there who are way smarter than me).

You can imagine funding schemes that attempt to account for these issues. "For every dollar of funding for interpretation A, earmark 25 cents for alternative interpretations". View science as a market, something beyond our powers to predict, then diversify your investments.
Really? Neutering it how?

Tesla already has a “Allow remote access” toggle, which defaults to OFF, that prevents you from connecting to it via the app etc.

(Whether this fully prevents Tesla connecting to it remotely, I’m not so sure...)
For fuck's sake.

> For instance, it's impossible to write an executable program in Java that adds a string to a number.

Wrong [0] and misleading and not a reasonable summary of type-driven development. The article goes rapidly downhill from there. It tastes like an undergrad who has just learned about the very basics of things and is still trying to figure out how to put them all together.

> So it is possible to statically verify that a function always returns the square of its input, it just needs a proof (aka its type).

This is not sufficiently convincing. What exactly was that type, and which language was it written in? The type "int -> int" is not at all enough. This sort of handwaving logic seems to come up constantly with folks new to type theory. And each time it comes up, it seems that a massive argument must happen [1] in which folks who actually understand type theory have to remind folks that no, type systems do not automatically save us.

Here are two analogies in the article. "I'm lying" is a reference to a famous paradox [2], and the barber story is a truncated part of an older set of stories told by Russell, Gardner, Smullyan, and others [3]. All fine and well. However, they then try to claim that types somehow fix the underlying paradoxes, but of course, they don't. This is because the underlying cause of the paradoxes is of course Gödel's first incompleteness, which works even in statically-typed environments [4]. Worse, the article author makes it sound like incompleteness is some barrier to be climbed over, when in fact it is a basic (if tough-to-prove) categorical property [5].

[0] https://hackernoon.com/java-is-unsound-28c84cb2b3f

[1] https://lobste.rs/s/yyhu4w/real_problems_with_functional_lan...

[2] https://en.wikipedia.org/wiki/Liar_paradox

[3] https://en.wikipedia.org/wiki/Barber_paradox

[4] http://r6.ca/Goedel/goedel1.html

[5] https://ncatlab.org/nlab/show/Lawvere%27s+fixed+point+theore...
Chinese scientist who edited twin babies' genes jailed for 3 years
How does this compare to non-American media and culture? Is it simply a human problem?
Yes, reading all my subscriptions through Feedbin is part of my morning routine. So much less stressful than trying to read a social media feed with everyone sharing about whatever outrage of the day is.
To be clear, there is absolutely no practical means of high-speed data communication using neutrinos.

That is not to say there will never be any.