skysight-inc/HackerNews huggingface dataset:
Very interesting and exciting work. Michael Levin (one of the scientists in this study) has some amazing things going on in his lab. There is a few talks of him on YouTube, I have seen the following one from May this year

https://youtu.be/4sFpJF0dp8Y

All sorts of work about setting the electrical potential between cells/parts of the body to certain states to induce the desired growth. E.g. growing a eye on the gut of a tadpoles.
Client Hints (https://wicg.github.io/ua-client-hints/) move a passive fingerprinting vector to an active one, i.e. information must be explicitly requested by the site and then the browser can choose how to respond.

The default level of information exposed drops to just the browser name and major version, which is only sent to sites on HTTPS and with JavaScript enabled.

Additional hints are only sent on subsequent requests by the browser if the site sends the matching header in its initial response and the browser chooses to send a value. The current set of proposed hints define the same amount of information exposed Chrome's User-Agent string.
This is sort of circular, or tautological: “I believe in it because it’s so believable “

FWIW, I am rather skeptic. And I even have reasons: if the NSA has the power to coerce, Apple wouldn’t repeatedly gotten into fights with the US government to unlock iPhones.

Cooperating with the NSA is also clearly not in the companies’ interests. If (when) it comes out, they’d be at risk to lose a lot of business in other countries.

In any case, my usual argument about cynicism applies: spreading such theories becomes self-fulfilling, because why should MS work for the NSA/every politician take bribes/every cook spit in your food, if that’s what the people believe anyway, no matter what you actually do?
> Nobody has any idea, they're just making it up as they go along.

Ha! I came here to say this, and I'm glad you share my opinion. I realize that you're speaking specifically about software estimates, so please excuse me while I take your statement out of context and generalize it to most everything that I've experienced working in software.

I'm biased in my views on this at this point, but I tend to notice people falling into two camps (on a spectrum of course): those who are most comfortable with well-defined tasks and low uncertainty, and those who are comfortable making stuff up and running with it. That's a rough, one-dimensional reduction of many qualities, including creativity, certain types of critical thinking, pragmatism, "self-starter"-ness, enthusiasm, etc. In equilibrium, it's the people who are able to distill uncertainty into something resembling certainty that ultimately provide tasks for the people less comfortable with unknowns.

Corollary to that is the idea that "correct" is not binary but rather a measure of effectiveness by any number of shifting metrics (e.g. performance, readability/maintainability, "correctness", time and money cost, defect tolerance; all under the general umbrella of priorities).

It's one of the things I try to impress most upon junior developers that I mentor, especially when they are just out of bootcamp and haven't learned yet that most problems aren't well defined and don't have an answer in the back of the book, if you would. Essentially, our job is to "make stuff up": always "how", and often "what".
I've learned that small businesses generally have high expectations for relatively small amounts of money. As a result, I stopped doing freelance work unless there is a lot of money involved.
> It provides the required information only when the server requests it

In the interest of fingerprinting a server would request this every time.

> It provides the information in small increments, so servers are only exposed to the information they need and request

Then the server would need and request the most comprehensive list possible in order to fingerprint someone with better granularity than a UA string could.

I'm not against this as I appreciate the value of this kind on information for the developers. It would be done one way or another. But why is this billed as mainly a privacy move? Nothing suggests it intrinsically offers better privacy when facing a website configured to fingerprint you. It actually looks like it gives even more granular info over which the user has less control than they used to with the UA.
Clifford Stoll himself admitted that he was hillariously wrong. As for Ted Kaczynski - he was a goddamned moron was no sense of history or prehistory and absolutely no coherent plan.
1. Send mail bombs to iniversities and airports
2. ???
3. Downfall of industrial society
4. Industrial society somehow won't establish itself again as technology grants advantages desperately needed to survive making the whole plan cruel and pointless.
Why doesn't the partner like you? Likely in large part because you didn't say the right things.
Way to make a profit as an aerospace company is to fail
I have experienced several instances where I dream that I am with some friend/colleague/etc e.h. helping him solve some problem. Upon waking up, I check my phone and then sure enough that same friend has in fact contacted with the same or similar message as in my dream.

In several instances these are people I haven't heard from in a long time, with some very hard to guess specific reason why they contacted me. (E.g. a long time friend asking me to help his dad with something).

My memory is very clear that I had the dream and processed it (with some reaction of 'huh strange, fancy dreaming about that guy) before I opened my phone and found the text/email from that person. But is that memory being rewritten somehow afterwards?

Or is there perhaps some kind of vaguely wavefunction/quantum/etc phenomena that leads some information to be transmitted back in time by a few minutes? Hard to say, but definitely food for thought
> You pay your taxes used to pay for bombs to kill people.

Paying tax is mandatory, unlike installing a tor node on your modem.
Wow. Let's try to criticize the system without glorifying murderers!
That 95% of the workforce is there just to collect their checks and they will do everything in their power to protect that privilege.
We’re actually using ShareDB at Makeswift right now and for us it has become a horrible burden. There are very subtle bugs on their data persistence layer with concurrency and the API is a bit of a mess to work with in my opinion. I’m glad to see other people are having success with it, though.
Just as the efficient market hypothesis would predict.
Dear mods, we are called Red Hat. Two words. Not Redhat or RedHat or redhat. Thx. A Red Hatter.
That's a seperate key, which doesn't seem to have an interesting name, not _NSAKEY:

> In addition, Dr. Nicko van Someren found a third key in Windows 2000, which he doubted had a legitimate purpose, and declared that "It looks more fishy".
Has anybody, ever, raised a seed round (say more than a $100K) by cold calling a fund?

Lets say u r decent developers, and a web site, and some revenue, and usage is growing. But its not doubling every month, and you are not 4 FAANG technical leads.

Do serious people spend more than 10 seconds on reading such an email?
> But I don’t see at all how music is connected to experiencing emotions.

Wow, unless I don't understand this sentence, I'm surprised by it.

Music instills emotional reaction all the time -- it can change your mood, it creates the emotional feel of movie scenes, and all sorts of things. It is connected to emotional response, is it not?
This seems to be the indented submission URL http://theautomatic.net/2020/01/14/how-to-import-python-clas...
Not saying it's not useful, just that this arose from them not using a hard-coded comma, but referencing some default separator, that happens to be the semi-colon in some locales. I might be wrong and this could have an older precedent.

Now, whether it would've been better to stick with the comma and just properly quote all the values for locales where the comma is a decimal separator and thus often used in spreadsheet columns is a moot point, the damage has been done.

Personally I just call it "character separated values" anyway. I quite like tab-separated values. Makes it okay to read quite often and I think it's the default output of Postgres' COPY command.
Well, I would think so as well, but we have at least some anecdata (N=1) in the other direction [0]:

> In doing this I discovered that the NSA public key had an organizational name of "MiniTruth", and a common name of "Big Brother". Specifically what I saw in my debugger late one night, which was spooky for a short moment was:

O=MiniTruth CN=Big Brother

[0]: http://www.cypherspace.org/adam/hacks/lotus-nsa-key.html
I’m standing right now near the window on the 20th floor of a cancer center, typing this on my phone while my wife sleeps 10 feet from me.

This is high stakes medicine, yet the current environment has the docs on this floor terrified of doing anything that isn’t in the standard of care runbook. My wife has had elevated blood glucose levels for six months, which is not good when you’re fighting cancer, yet i can’t get anyone to treat it because there’s no clinical evidence that managing glucose levels for her specific type of cancer has any benefit.

Guess what. Nobody’s doing that trial any time soon. Meanwhile there are thousands of diabetics managing their blood glucose while fighting cancer and there is endless material available demonstrating that cancer cells thrive in hyperglycemic environments.

So, i don’t know anything about Juno, they could be sociopaths. But i have no issues with high risk attempts as long as the patients are informed and there are ethical standards for transparency. At least they are trying.
That's not an active fingerprinting vector, especially within the context of https, still passive one with a minor protocol detail.
interesting - i have not seen that yet, but maybe i dont have apps doing that. i dont have uber on my phone but I have lyft, Im surprised I have not seen it from them.
Feature detection isn't the only use case User Agent strings service, two I've seen frequently are:

* Exception Tracking
- The User Agent string is usually attached to exceptions to aid in reproduction.

* Outdated Client Detection
- Primarily in internal dashboards in BYOD environments, I've seen the server display an error when a known outdated/insecure browser connects.
>And also why would 12.5 years payback make it not worth it, if your salary was double for the rest of your life?

You're forced to work for 12.5 years.
Even if you look at a gold backed currency. Then someone (whoever issued the money and backs it with gold) ows you an amount of gold.
I have experienced several instances where I dream that I am with some friend/colleague/etc e.g. helping him/her solve some problem.

Upon waking up, I check my phone and then sure enough that same friend has in fact contacted with the same or similar message as in my dream.

In several instances these are people I haven't heard from in a long time, with some very hard to guess specific reason why they contacted me. (E.g. a long time friend asking me to help his dad with something).

My memory is very clear that I had the dream and processed it (with some reaction of 'huh strange, fancy dreaming about that guy) before I opened my phone and found the text/email from that person. But is that memory being rewritten somehow afterwards?

Or is there perhaps some kind of vaguely wavefunction/quantum/etc phenomena that leads some information to be transmitted back in time by a few minutes? Hard to say, but definitely food for thought
Is there a price?

Taking a raspberrypi zero, a camera, 4g modem, a couple of batteries and a charge circuit can turn any large-enough object into a hidden camera, for <$100 + the price of object itself (+ some dremel-ing and superglue).
I'd still like a way to feature detect, rather than make a round-trip to the browser. This would let me embed webasm rather than js+branch to begin a second download if feature found... etc

I suggest UA string be a bitmask of features. Then feature detection should stop being broken

Extra bits could be used for js-on/js-off, and is-bot/is-human

--

Ah I see they're kind of doing the bitmask, but keeping a round-trip, and making things complicated (though I realize latest http standards can probably remove those round-trips in the average case)

I'd still suggest the bitmask for non-sensitive information, and have everything else simply js-tested as it currently is

Maybe is-user-blind might be a nice bit too, since canvas based websites could switch to the dom, or whatever
You do control what version of libraries you're using. You include the exact SHA256 of every dependency of every dependency, down to the toolchain itself.

If you're saying "your distribution can't automatically update you if libc is vulnerable to something", that's true. More CPU time is required to react to major vulnerabilities, as everything has to be recompiled. However, it's not much CPU time, and the downsides of requiring more compute time are lower than the upsides of knowing exactly where your dependencies come from. And having your "getting started" instructions be "1) install bazel 2) bazel run //your:binary".
How important it is to be able to inhabit another person's viewpoint and see things from their perspective. So much time and effort is saved in doing so.

Much of my job has become translating and mediating between stakeholders going around in circles, because each one believes their viewpoint represents the entirety of the issue. They can not understand one another because they assume the other understands everything exactly as they do. The engineer sees the issue as a technical problem, while the BA sees the issue as a process problem. They're both right, but each is only seeing half the issue.

Forget what you think you know about someone, shed your own views, listen very closely to what they're saying, and interpret what they're saying not through your own lens, but through theirs. Their viewpoints are formed through their experiences, not yours.

It's not easy and you'll get better at it the more you know someone, but there are plenty of shortcuts you can take based on your assumptions about them. Just be sure to update your mental model of them as you learn new information, usually gained by listening to what they're saying.
To be honest I find both the fastest C and Rust answers ("C gcc #6" @ 1.64s and "Rust #6" @ 1.70s) highly unreadable.

For me, "Rust #5" @ 1.98s is the first readable solution in the list, and seems comparable (code wise) with the Java, Python, etc implementations. ("C++ g++ #6" is also quite reasonable, but that's C++, not C).
Ugh, where was this when I needed it in 2013? At $OLDJOB my boss and I wrote pretty much this entire thing, in an unholy mix of bash and Tcl, much more poorly.
Really? I’ll get something out this week. My Twitter handle is in my profile. I’ll probably tweet about it when I write it.
Microsoft is listed as a provider in the NSA's Prism program in Powerpoint slides released in the Snowden leak. In fact, the timeline indicates that they were the first on board.

https://upload.wikimedia.org/wikipedia/commons/c/c7/Prism_sl...
We Prevented App Performance Degradation from Sudden Ride Demand Spikes
As someone with a degree in Physics I'm all hears ? This is actually about time zones, isn't it ?
Reading between the lines of the Verge piece, I got the impression that weird abusive behaviour aside, she just wasn't very good at managing her company. They seemed to have chronic supply problems that she didn't seem to have any idea how to fix beyond yelling at her customer outreach staff. And when her customer outreach people kept getting behind, she tried to con them into working extra till they started quitting or complaining to Verge, instead of just, like, hiring 3 more people
It most certainly will.
They released a security patch for XP last year.

The reason they won't support they systems forever is the cost of doing so (and of course they want people to upgrade), but the cost of fixing a really bad security issue in an otherwise unsupported system every other year is probably fine.
LSU’s JoeBurrow completes greatest single season by collegeQB with nationalTitle
Yes, but the fear remains that all sites will just always request everything from ua-client-hints. It is also totally unclear how browsers will handle this. I think making this permissioned will just add to the PrivacyNagOverload. Also, browsers will continue to lie in the hints because sites will always make broken assumptions or even try to do mischief with the info.

I think the only winning move is not to play: Freeze the User-Agent and do not provide a replacement. Or at the very least, make the replacement based on actual feature bits, not version numbers and device models.
Packet's blog post: https://www.packet.com/blog/ping-power-processors/

This is probably a good play for Equinix as it provides a lower barrier to entry to a segment of the market that they typically haven't engaged (Packet being largely profitable probably helps).

In addition, I believe Packet already had presence in a number of Equinix datacenters so "landlord buys tenant" comes to mind...
I have a feeling that's a bug. I have an app that I want to have background location and was asked twice soon after upgrading to iOS 13, then iOS was silent for about a month, then started popping up a prompt for it 2 or 3 times a day for half a week. After restarting it stopped popping up again, so it seems likely that something was broken about saving whether it had prompted for that app.
Kan tried to sell $36k/yr fixed price legal packages as "efficiency" to early stage startups. He generated leads with bait-n-switch tactics - by pretending to be a startup accelerator with a YC-style application - afaict the accelerator did not actually exist. I will never forget that he tried to pull that on me.
> Google recently introduced a new “secure” login page which forces my chromium based browser (qutebrowser)

That's an embedded chromium browser and according to [1] you should really be switching to oauth for login, not faking a UA string.

[1] https://security.googleblog.com/2019/04/better-protection-ag...
"Microsoft said that the key's symbol was '_NSAKEY' because the NSA is the technical review authority for U.S. crypography export controls, and the key ensures compliance with U.S. export laws"

Occam's Razor.
Fun, but maybe not terribly educational.

It'd be easier to internalize the pitfalls of concurrency when shown a problem, and a way to (attempt to) fix it, and the ways the fix breaks, and the correct way.

You can play this game like a zombie without really understanding what the code is trying to do; all you see is a broken attempt at doing something and you don't need to understand much to break it.
What about a head?
It’s not what I want, but what we all need. The nice aspect of climate change is that it obliterates our tired notions of self-interest
there are three bold theses in this article,

> Better technology means higher expectations—and higher expectations create more work.

> A lot of modern overwork is class and status maintenance—for this generation and the next.

> Technology only frees people from work if the boss—or the government, or the economic system—allows it.

It seems high expectations and class and status maintenance are just capitalism masquerading as culture. In France, the slogan we hear is "Work more to earn more," to which people reply in complaint, "I'm working more and earning the same!" But why can't we do "work less, earn less and have more time?"
I remember that part of the Windows 2000 source code leaked years ago.

I'm presuming people looked at it for dubious keys.
When Safari froze their UA, another big one that came up was browser bugs. Specific versions of browsers on specific platforms have bugs, and you need to be able to tell your user to upgrade.
Same thoughts here on the downward trend. It feels like a good concept, luck and good timing re Twitch exit. A bit less about the product per se.
Comedians Are Not Philosophers
What if it is a case of malicious compliance like Lotus Notes' backdoor someone else already has mentioned (the classic O=MiniTruth CN=Big Brother)?
Protecting your privacy: symmetric cryptography (part 1)
This seems to work with a candump format input, does it works with canalyzer *.asc format ?
Sounds like there is a gap between what people actually want and what they say they want. People claim they want leisure but instead they work themselves into the ground. This is not the fault of technology.

With humans it is better to watch what they do, not what they say.
And of course - theres a javascript library for that: https://peeinears.github.io/MagicEye.js/
Yep, they can receive those crazy UAs, see https://wiki.mozilla.org/Compatibility/Go_Faster_Addon
This looks well designed and thought out. Does anyone know if it has been applied to NMEA-2000 (a marine electronics flavor of CANbus)?
Triaging issues, sure. Progressive enhancement? If you’re parsing User-Agent to implement that, you’re doing it wrong. (Feature detection is the correct approach, when necessary.)
Windows used _NSAKEY (and another key) to check that Cryptographic Service Providers are signed. Otherwise it wouldn't allow them to be used. This was explained in the article.
If people don't want flats, why do they need a mandate against them? I'm a bit confused. Just don't rent nor buy them, if you don't like them?
They also removed a blog titled "Why You Should Never Pay For Online Dating" when they were acquired by Match.com (a paid dating site) [0].

[0] https://www.themarysue.com/okcupid-pulls-why-you-should-neve...
Many folks will acknowledge the secular or scientific benefits of e.g. temperance with food or alcohol, or even restraint with sex. One thing I’ve heard few outside of religious encourage is humility. Some people will just be better than you at different things, have more stuff than you, be more honored, etc. If you can’t deal with that situation without becoming emotional and working 100 hours a week, you’ve got, on some level, a similar problem as the guy who can’t see a cake without eating the whole thing, and becomes overweight as a result.
"Leaked?" "Privacy nightmare?" Last time I used OkCupid was like a decade ago. Back then you could view everyone's answers to their multiple choice questions right on their profile. It's purpose is (was?) literally to be read by others. Just like the purpose of this HN post is for others to read.

Edit: I think you could view them only if you both gave answers to the same question.
Interesting. What do you mean by "companies" and "inquiries," and what documentclass do you use?

Edit: Or, were you joking? ;)
Could be a nameserver.
Quite happy that the market leader is taking this step! Hopefully this will decrease the problems with lacking feature detection.

I was surprised that the post doesn't contain any example user agent strings for a sample of how they are expected to look starting from the different milestones.
The only problem with this incredibly basic web page is that it isn't listing the best podcasts and is recommending listening to an anti-democratic extremist. No indication where this list came from either.
Client hints are not any more useful than traditional UA for privacy or progressive enhancement. Its the same content, just split up. Any browser not sending everything will have atrocious permission UX, nagging websites or just get the broken IE5 version.

UA hints solve nothing, even after reading the spec