skysight-inc/HackerNews huggingface dataset:
> Sanitize your inputs so that it can be safely stored in your data store,

That's not sanitizing input, that's escaping output - if you subdivide concerns appropriately. The data you're saving into database is the output of your program.

Really, the problem is of language translation. User input is an unstructured blob. SQL, or HTML, are structured languages, with their own semantics. Whenever you cross the language barrier, you need to translate data from one language to the other. Parametrized queries are the usual API to SQL drivers, and they do this for you under the hood, producing a valid SQL query string[0]. When going to HTML+JS, you need to invoke some library (or do translation yourself).

(I really don't like the term "escaping". Translating between languages is more than just sticking slashes in front of double quotes.)

This is why "sanitizing inputs" is a nonsense concept. The problem is of language translation, and you can't translate if you don't know the destination language. A blob correctly sanitized for SQL will not be correctly sanitized for HTML, and an input correctly sanitized for both will look bad in either.

SQL injection and XSS are the same bug. Failure to translate between languages. Usually caused by a pretty stupid but somehow very popular idea - building target language expressions by gluing plain strings together[1].

--

[0] - Sometimes. I remember this is how it worked in the past, but not sure if server RDBMS APIs haven't changed since. For comparison, with SQLite, you're passing the query with placeholders to the SQLite functions, and the parameter values are passed as arguments. The SQLite internals turn this into an executable query, but I'm pretty sure this does not involve a query string with actual parameter values in it ever existing in memory.

[1] - A related source of footguns is using templating engines for web pages. HTML is a tree of nodes, not a plain string. Using a template system is a recipe for XSS problems.
People are increasingly more lazy
Mental models of sea-level change: A mixed methods analysis (2015)
Folding glass: How, why, and the truth of Samsung's Z-Flip
Being attractive to buzzword scanners is a more important career risk. I'd rather be rejected by those automatic systems so I pay more attention to offers from real people that know me from the industry.
Their case is essentially that they are lazy assholes with no respect for privacy so spare them from doing their job and doing their own representative traffic pattern modeling. Just like the demand for backdoors to spare the police the burden of investigating.
I'm a US citizen in the UK on a visa where I can be self-employed and start companies. It looks like the new system has basically the same process for getting this type of visa (which is to say it's still a pain in the ass) except now EU citizens have to jump through the same hoops instead of just moving over.

This is going to be a double whammy for the UK tech scene. First, by leaving the EU, the UK hugely shrinks a company's addressable market and reduces the incentive for anyone to come here to start a company instead of somewhere with a bigger market, like the US, Germany, or whatever.

Second, by making it as hard for EU citizens to get a visa to the UK as it is for them to get one the US, there's going to be a lot less incentive for people to come to the UK. The UK is a great place to live, but tech jobs here have a lot lower pay than the US and there is a much smaller tech scene. If the effort for moving to both is roughly the same, a lot of people are going to follow the money.

Go into any dev office in London and you are likely to find as many Spanish, French, etc. developers as British developers. By cutting out that supply of labor, it's going to get a lot harder to hire developers and there will be less developers around with ideas who have the legal ability to start their own company. Maybe that will push local wages up, but maybe it will just depress the tech scene overall and push more business to other countries.
We're talking about different things. You're considering just the coding accident of an employee removing this and forgetting that. I'm talking about the intentional decision of not validating this in a better, more robust fashion, at least when it comes to issues that have a huge impact on security or privacy. This was a calculated decision. Whether it was done by not putting in place or by removing all the obstacles that could have prevented this makes no difference. After the first privacy "accident" they should have had in place all the processes required to make sure such an issue doesn't happen, then go unnoticed for so long.

If 5 years from now VW has another "rogue engineer" everybody will wonder how is it possible that it slip through the cracks again. Facebook let things like this slip through the cracks again and again.

> Of course this doesn't excuse it, just explains it.

It excuses it the second it's made too look like a random accident but somehow keeps happening again and again the same way, always to their advantage.

P.S. I'm sure no company accidentally gave such upgrades to 1.5 million users and let them get away with this. And they also didn't accidentally do this again and again. You highlighted perfectly the difference between an accident and an "accident".
Add ||assets.bwbx.io^$script,domain=bloomberg.com to your uBlock filters
Great for your personal blog, but let's not assume this works for most businesses.
That font is difficult to read. Why do people do this?! They should make stuff accessible for the maximum number of people!
The situation you are referring to is actually a great plus, If you change the data model in you backend, you client consume it and thus depend on it, so you still have to change the frontend code anyway, knowing exactly what you can ask and how it will come back makes it a very powerful developer experience with a lot of test that don’t need to be write thanks to tooling around a type system and a faster feedback loop.
If you make things more expensive, less people will buy that thing. It will reduce emissions in the UK by reducing the airtraffic through the UK. Exactly the intended consequence.
Chinese medical workers cry for help through The Lancet
We impose restrictions on corporations in the name of the public interest all the time. It is completely reasonable to require that a company that has a de facto monopoly on personal video distribution uphold the principle of free speech. It's a virtual town square, and if you don't force its operator to allow free speech, the people as a whole don't get to have free speech.
Unfortunately this is not what I anticipated based on the title (a user-based tool that circumvents pop-ups). It is a suggestion for website owners that they not use any tracking pixels or analytics on their websites.

I’m sure that works great for this guy’s blog, but I’d guess that it would hobble a startup’s ability to understand/optimize their customer funnel to abandon tracking entirely.
Are there any recommended resources to learn more about the design of the fabric physics simulation. The demo with the mannequin looked incredible and taking a stab at an ml algo that could learn that sounds like a fun project.
What happens if you use cookies but for non tracking purposes?
Large companies, but none of these are anywhere near forming a monopoly.
While I agree with the sentiment the title is very clickbaity, can it be changed?
Extremely limited evidence?

How about water or electricity grids? Railroads? (City) Streets?
I'm not sure if the author is trolling or actually presenting this as some groundbreaking insight. I thought it was obvious to anyone that no cookies means no cookie notice (and there are plenty of static websites that do this). The point is that most websites try to make money, and making money means advertisements, and advertisement (often) means tracking.
From the visa aspect, what is your view upon that with the changes - does the new system seem easier to you for non-EU nationals to actually get a visa?
i hate tech blog clickbait so much
Do you think it's fair to let a private company decide these things?
It works for DuckDuckGo: https://duckduckgo.com/

However it won't work for any site that uses client log in.
Choosing a name is hard. Facebook might have committed a small freudian slip here.

https://www.history.com/news/8-reasons-why-rome-fell
plus we can invest that money improving bus services and rail networks, which will help poorer people participate in the economy. If you can't get the bus to work, you probably don't need a plane to Dubai...
A thought on Minimalism vs. Brutalism
I was thinking about this in the context of Tesla and their competitors the other day. Tesla have some little hints of good humour throughout their cars/marketing which I endear them to me. Everything is way too serious these days and injecting a little fun - with the disclaimer it doesn't get in the way - is a great thing.

Keep the emojis and witty copy coming, I say.
I don’t think login cookies require the banners.
If it is that easy and obvious why did they stop working on their own engine then?
Not sure about iterators, but they do break reference guarantees. Moving a vector doesn't invalidate pointers to the contained elements.
Haha, I discovered this loophole too when GDPR was introduced. I also removed all tracking code especially from smaller sizes. I don't care about tracking users there.
"Runways don't cause climate change; airplanes do."

I applaud the ingenuity of whomever managed to come up with and press home this argument but it feels like a stretch to me.

As someone who lives under the flight path of Heathrow I can't say I'll shed any tears if the third runway is permanently blocked by it though.
> generate HTML with templating engines that encode data as HTML by default

Don't, unless you're sure the templating engine actually parses the HTML into a tree of nodes before interpolating and re-emitting it. Otherwise it's likely someone will interpolate something in an improper context, e.g. inside <script> or <style> block.
Let’s not assume most businesses ever use the reams of tracking data they collect just because “it’s what’s done”.
The title is a bit misleading. The court ruled that the government failed to take their climate change commitments into account in approving the third runway. They can go ahead with the third runway if they redo their approval taking climate change commitments into account (unlikely to happen as I understand the Prime Minister is against the third runway).
There's obvious merit to this, and it harkens back to a 'purer' day of the internet.

But, big - huge - businesses exist (often exclusively) on the internet in 2020, and suggesting that nobody should worry about collecting metrics on traffic/usage is really not feasible when your bottom line depends on making sure those numbers are moving in the right direction.

Don't get me wrong: those companies collect too much. There's no need to do some of the deep, cross-site data sharing that most big web sites do. But analytics? Advertisements? Seems like fair game. Even if you run a boutique blog, you're going to want more real-world feedback than "hit me up on Twitter."

The larger complaint here (at least in the first half of the article) seems to be the lack of elegant ways to present this compliance. Nobody seems to do it in a way faithful to the law without ruining your browsing experience. Maybe that's the point.
The centralized journal daemon and Desktop Bus broker with a single Desktop Bus are two of the major weaknesses in the systemd architecture, sources of problems as varied as log floods affecting unrelated services, journald (originally) taking everything with it when it died (a failure to understand the lessons of daemontools, also explaining why originally every service was proofed against SIGPIPE), and the Desktop Bus Death Rattle.

* http://jdebp.uk./FGA/dbus-death-rattle.html

One does not need SystemTap to see the mount unit problems, never fear. As the article notes, near the bottom, the behaviour is documented in the systemd.mount manual page; and one can look at the Desktop Bus traffic with busctl monitor.

But again, this is a failure to learn the lessons of previous softwares; in particular the lessons of the many softwares that do/did data updates over limited bandwidth channels. From everything, from redrawing the screen in a full-screen TUI program like vi, through sending the Fidonet nodelist around the world, to doing quick tape backups, one learns the lesson of sending just the diffs. As the author noted, it seems daft for systemd-logind to be told, again, all about the 1999 of the 2000 mount points that have not changed.

The sad thing is that systemd-logind isn't even interested in mount units. It registers an interest in all unit properties change announcements, but is only really interested in the properties of session and "user" slice units.
Some useful points made in other comments, tied-in to your particular problem/exploit.

I would recommend you get familiar with OWASP, and especially the 'top ten' security issues that they publish.
See https://owasp.org/www-project-top-ten/
It also helps as context to why Murray is viewed as a conspiracy theorist to read the multiple conflicting alternative narratives that Murray has pushed at different times (that the implicated Russians were telling the truth about going to England for the weekend to see Salisbury cathedral and it's racist to assume otherwise, that they were probably lying because they were a gay couple involved in the dodgy supplements trade, that they were probably meeting the Skripals but were probably Ukrainian, that there's no reason whatsoever to connect Russia with the assassination of Russian defectors using a Russian intelligence modus operandi and it's probably Israel instead)
Do businesses really need cookies? Surely logging page visits is enough for most purposes; it can be corroborated with sign-ins if you have already agreed to sign up. Anything else is usually for tracking, usually the intrusive thought.

Businesses don’t have an inherent right to your data. There’s countless bans on much more nefarious practices that “didn’t work” at the time.
You only need to set a cookie when the user logs in. So as long as the user isn't logged in or in the process of logging in there's no need for a banner.
how many startups are comparable to DuckDuckGo?
Or use the BIP39 lists since they also encode 2048 bits. If you just use BIP39 you also get a checksum. RFC 1751[1] is the "standardised" option but IMHO the wordlist they use is far too easy to misread (though this is because the words are all less than 4 characters).

[1]: https://tools.ietf.org/html/rfc1751
I've eliminated cookies from my systems too ... I just put my tracking information in local storage.
They're okay. Login cookies are fine for instance, so are temporary shopping cart cookies, etc. Everything that you use to deliver functionality that the user explicitly requested is generally fine.

IANAL.
Show HN: Automatic Version Increments for CI Pipelines with Reliza Hub
Looks cool! I cloned it and ran it locally. I noticed there was no backend running locally, and then saw it points to https://low-code-api.herokuapp.com/v1/graphql. Is the code running there available in a repo too? It would be super nice if you could link to it from the project README.
ZoomInfo S-1
The rules are somewhat imprecise, but basically any functional cookies do not need to have consent as it is implied by the user using the service. This includes thinks like the user-identifier to know who is logged in for example.
Introducing version increments workflow using either Reliza Versioning library or Reliza Hub.

Versioning library is open sourced and found at https://github.com/relizaio/versioning.

Reliza Hub is in public preview mode and operating at https://relizahub.com.

This is the first of several workflows that would be supported by Reliza Hub.
On that last bit, we recently added actions: https://hasura.io/blog/introducing-actions/

Writes (mutations) are delegated to a REST endpoint, the GraphQL mutation response can be synchronously (blocking mutation) or asynchronously consumed (mutation + subscription).
How to conduct user research: A step-by-step guide
Internally, that's what C++ is doing..Converting the abstractions into code. There is a lot of complexity hidden from view (you might see some of it when you get some esoteric template bug in your ide)

Btw, that code is using std::unordered_map which is notoriously slow compared to an ordinary std::map for a small amount of elements. And the unordered map of register names each with a pair, why? Why not use std::vector for fast lookup?

The crux of what i'm saying isn't anything new, Bjarne Stroustrup admits that C++ is mainly a high-level abstraction language. There is some new things, but really, the things that are new like << etc. are operator overloads which are just more abstractions.
Where are you getting "hardly" from? In this example, it normally would have been P0 (release-blocker) but was downgraded to P1 (still the second-highest priority) because of a special consideration on the customer's end.

The point of severity is that it's an objective metric determined in isolation based on specific technical guidelines that any developer on the team can follow (such as https://www.chromium.org/developers/severity-guidelines). Whereas priority is a higher-level determination that isn't purely technical.

It's like the difference between body fat percentage and attractiveness. Any "engineer" (doctor with a DEXA scanner) can tell you your BF%, and attractiveness will typically correlate with BF%, but ultimately your "customers" (romantic partners and targets) decide how attractive you are. Not a perfect analogy (priority is still something you'd decide internally, not your customers directly), but hope that clarifies things.
In Europe, realtime court reporting just isn't as much of a thing as in the US, were court cases are more easily sensationalized.
Advertisement doesn't mean tracking. When someone buys a radio/TV Superbowl ad they don't track who heard/saw it. When you buy a newspaper/magazine ad you don't track who reads it. You can sometimes target a particular neighborhood, but that is all the more you get, and no tracking of who got it.

The ability to track doesn't really add that much value to most ads. The only time it is helpful is if you want to get a specific person across many different platforms. If you have a niche product that is useful, but niches generally have better ways to get their target (ie the forums frequented by their target). When someone advertises a car they don't need to track - they need to get everybody in the world because that is their potential customer base.
Save yourself two minutes of reading:

> Want to know why I don’t have a cookie notice on this site? It’s because I don’t track you.

Obviously doesn’t work for any website that requires creating an account and logging in.

Thanks everyone for upvoting a nothingburger to the top of front page.

Edit: Okay, I didn’t know cookie notice isn’t required for login cookies (apparently I never used a cookie banner on my sites anyway, cookie law be damned). Anyway, the nothingburger point still stands.
> ... what's the user doing?

$ telnet minjiexin.com 80

Trying 208.80.153.224...

Connected to minjiexin.com.

Escape character is '^]'.

GET / HTTP/1.0

HTTP/1.1 400

[...]

<!DOCTYPE html>

<html lang="en">

<meta charset="utf-8">

<title>Wikimedia Error</title>

[...]

Big mystery.
Everyone here is raised learning the history of USA, overthrowing a tyrannical empire and creating our own democracy. We're taught that the Constitution was designed with inherant distrust and selfishness of politicians in mind. Many of us in non-urban areas grew up in areas with police response times greater than 20 minutes. All this and more combines into a self-reliant culture somewhat distrustful of the government that makes us ready to protect ourselves and our families. When considering this culture and context, guns and ammo during times of stress makes more sense.
It's pretty easy to do raw sql rails migrations. I do it all the time.
Google's Abandoned Android Authenticator App
1k Workers, Go Home: Companies Act to Ward Off Coronavirus
By invalidating iterators (and pointers and references) when swapping: https://stackoverflow.com/a/8191356
Yep. I've stopped counting the amount of websites that force me to use weak passwords. It's crazy that this is still a thing in 2020.

I wish the controls on browsers came with a green V that implements best practices (8+ symbols, no filter) so that people who made websites understand that this is what they should conform to. Not their own misconceptions about password security.
GDPR anticipated that trick. It doesn’t work.

https://law.stackexchange.com/questions/30739/do-the-gdpr-an...
List of Network Effect Resources
Hello, avionics friend!
Please no. It makes a good point.
Ha. I see what the writer did here. I was expecting a legal or technical solution of a different kind lol.

Now if I were to send this article to the business team at my company in order to make a point about privacy I’m sure it would result in one way.

They’d be pissed I wasted their time telling them not to track based on the views of the author who clearly doesn’t understand and hasn’t fully articulated the business implications of not tracking which are numerous.

No track is like security regulations in healthcare. Yes it makes sense but when you think about the implications to the system as a whole there will be negative impact.

1. Loss of jobs (lack of data collection in business)

2. Loss of lives (greater security requirements in healthcare)

Why loss of jobs? Because guys like Jeff Bezos will lay-off staff before impacting his and his shareholders wealth in any significantly negative way.

Tell me why I’m wrong.
You only need a banner if you use cookies for tracking. If all your cookie does is enable the login form, you don't need the banner. That's the "one weird trick" TFA describes.
Big Data and AI World Conference London 2020
Could privacy based browsers implement a way of giving bad data to cookies? Poison the cookie jar, so to speak. An add-on would be nice but being able to point to a browser and say "this is attacking the issue" would be nice.
G4S, though, has little incentive to address issues like audio quality in the glass box.
I live right next to Heathrow and am starting a micromobility company to tackle air pollution in this end of town, and hold an (albeit expired) PPL.

Air quality is bad here for humans on the ground due to the dilapidated 10 year old diesel buses that tfl allow in West London, and the vast amount of Single occupancy vehicles that commute to and from Heathrow every single day.

With the disaster that is Brexit on the horizon it's definitely not a good idea to scrap the expansion of LHR. I more than anyone want to clean up the environment in West London, but all things considered, it's not worth it to shoot ourselves in the foot and not expand Heathrow and a scrapping of the expansion is a hollow victory if all other issues impacting the West London environment are not addressed.

Cleaner buses, better incentives against SOV use, better alternatives to SOVs, steeper landing slope and other landing policies, properly maintained and seperated bike lanes, expedited and expanding plans for CS9, revised electric micromobility legislation (>500w & upto 20mph), more funding for local offsetting initiatives.

These make a difference for people on the ground, not not expanding Heathrow.

Edit: also right under the flight path. As most everyone else, got used to the noise.
No, only rumors of it.
I watch that guys channel from time to time. A lot of this stuff is easier thanks to forums and Youtube tbh.
> Can't you just disable DoH?

I'm just going to tell my mother in her 60s about editing about:conf settings.

This shouldn't be opt-out.