skysight-inc/HackerNews huggingface dataset:
It creates a vulnerability for external devices -- they're trying to communicate with myhost.mydomain.com but really they're talking to whatever device has the same IP address on the network they're attached to.

Some DNS hosters disallow private IPs. Some public resolvers and consumer routers will filter out responses containing private IPs.
Exactly. To control DoH we need to start to MITM all connections and block everthing else unless whitelisted.
While I used Apache as an example here I have configured a policy to protect a php application with known vulnerabilities which was prevented.

If you wish you could go install a docker image for a honeypot and then build policies with selinux to confirm yourself.
Nope. That still supports backreferences, and resolving backreferences is an NP-complete problem.[1] And I don't see anything in that paper that addresses that. Note that there may be some versions of the problem that maybe aren't NP-complete[2], but again, not addressed by that paper.

Besides, that paper was published 12 years ago. Where is the productionized version of it? Or are you suggesting the the OP go spend a few years writing a regex eninge? :-) Doesn't seem like a particularly practical suggestion.

[1] - https://perl.plover.com/NPC/NPC-3SAT.html

[2] - https://branchfree.org/2019/04/04/question-is-matching-fixed...
The “...” at the end of the phrase is the give away that they couldn’t fit the whole article in the picture. Checkout the complete paper.
They are also at the core of Spectrum Synthesizer bundle for iOS, which is a free set of AUv3 instruments.

https://apps.apple.com/ca/app/spectrum-synthesizer-bundle/id...

(I am the creator of Spectrum)
It could very easily be said that the majority of bloatware saddled on most consumer oriented PCs sold today introduce security risks for their customers. This is not unique to Lenovo but is standard practice for HP, Dell, etc. Unfortunately it's become standard practice to bastardize vanilla Windows installations by vendors in their own interest and not that of the customer purchasing.

If I were a consumer buying a Windows laptop for Windows use cases there is no way I would trust any hardware supplier's OEM build out of the box to not include bloatware that adds a level of risk out of the box that isn't worth completely wiping the disk (including restoration partitions). Whether it be for "support" use cases or more nefarious / gray areas it's a hard sell to say any one is exemplary better than the other. Maybe niche players and those that are selling non-Windows variants, but the reality is margins are thin on general purpose computing and so these types of angles become the norm. And the reality is Windows has lost it's way with regard to being consumer oriented. A default consumer build out of the box is already riddled with ad and bloatware. It's truly a cringe-worthy state of consumer options today.
The PCBs are open source too.

I purchased 6 from https://www.amazingsynth.com and couldn't be happier. It's good fun trying to do surface mount soldering!
Doesn't look like any of these have a network port.

Surely there's a market for a laptop with a good keyboard and real ports somewhere? If I'm at a desk I'll work at my desktop, I want a portable device for doing on site stuff, which often involves plugging into a network
> Does this mean we're to be ignored? If so, I am insulted.

No, I'm sorry you got that impression. I am just setting the facts straight (20% is a completely different percentage than 10%). My partner is left-handed, my daughter might be, and I grew up with a disabled father (he ended up in wheelchair and was practically blind). I feel a lot of empathy to minority groups such as the ones you mentioned (plus a myriad of others).

In my youth, I knew a guy who'd cross his arms while gaming (he was left-handed). This was approx 1995. Quite clever. He was using the mouse with his left hand, and the keyboard with his right. It worked for him (he was a decent gamer). He adopted, though it looked weird.
Firefox turns on DoH as default for US users
Oxen pull carts at 2mph, horses 3 or 4? So using horses could have had roughly the effect on commerce that steam trains had, or what FedEx did to business, you pick the analogy. Packages delivered in half the time; half the time spent on the road; cheaper (because the drover could deliver twice in a day) and on and on.
So what if I run a Pihole at home as a DNS server and want to stop being able to resolve various domains? I would like to know how to stop all devices (actually worse, individual applications!) on my network deciding to DoH of their own accord (and therefore bypassing my local DNS server).

This kind of centralised ability to block DoH is very useful to me.
Maybe, but there are a couple of more likely explanations.

(1) You're working on a system that is poorly structured for testing.

(2) You're trying to make a unit test do an integration test's job.

Both are incredibly common. In particular, if you find that you're spending a lot of time creating mocks/stubs to support unit tests you'd probably be better off finding a way to inject errors in an integration test. Error injection can be done at any level, works even when the code structure makes mocking difficult, and exercises code paths that cross multiple components in their "final" close-to-production form. IMX most of the people who go crazy about unit tests just haven't thought deeply enough about the problem to realize that error injection is strictly better (and a lot easier) most of the time.
Anyone know whether Lenovo still ship with Linux? Or have any experience running Linux on a modern Thinkpad?
The AutoSpotting author here, always feels great to see my little pet project mentioned by happy users. Thank you for making my day!

To set matters straight, AutoSpotting pre-dates the new AutoScaling mixed instance types functionality by a couple of years and it (intentionally) doesn't make use of it under the hood for reliability reasons related to failover to on-demand. To avoid any race conditions, AutoSpotting currently ignores any groups configured with mixed instances policy.

In the default configuration AutoSpotting implements a lazy/best-effort on-demand->spot replacement logic with built-in failover to on demand and to different spot instance types. To keep costs down, it is only triggered when failing to launch new spot instances (for whatever reason, including insufficient spot capacity).

What we do is iterating in increasing order of the spot price until successfully launching a compatible spot instance (roughly at least as large as the original from CPU/Memory/disk perspective but cheaper per hour). If all compatible spot instances fail to launch, the group keeps running the existing on-demand capacity. We retry this every few minutes until we eventually succeed.

There's currently no failover to multiple on-demand instance types (this is a known limitation), but this could be implemented with reasonable effort.

We're also working in significantly improving the current replacement logic to address a bunch of edge cases with a significant architectural change(making use of instance launch events). I'm very excited about this improvement and looking forward to having this land, hopefully within a few weeks.

At the end of the day, unlike most tools in this space(including AWS offerings) AutoSpotting is an open source project so if anyone is interested in helping out implement any of these improvements(or maybe others), while at the same time getting experience with Go and using the AWS APIs, which are nowadays very valuable skills, you're more than welcome to join the fun.
Check out the movie Mr. Jones. We've all read about the results of communism. From Lenin/Stalin to Mao, it has catastrophically failed many times over. Giving up your property rights to the state results in famine when the state corrals all resources to the capital.

Queue someone saying "what about the problems with capitalism?"

Capitalism, the worst economic system, after all the others.
Wake on voice? In a business laptop? Creepy as hell.
So what would be the best brand of laptop to buy and put Linux on?
The two stories are unrelated, though the reporter cites the former. From the vulnerabilities disclosed in that report, it seems pretty unlikely that yesterday's stories caused a rash of thefts; they were all pretty low-severity.

Note that here, Paypal paid a substantial bounty a year ago.
This is the first result on Google for the same question. It's a good and vast guide https://developer.mozilla.org/en-US/docs/Learn Good luck.
The author of the post also calls out that the mistake was his, despite the occasional muttering about "dark UI patterns."

I spend a lot of time in AWS, and I have trained myself to be extra careful about reading the fine print when using the UI exactly for the reason the author describes.

The author calling out his own stupid mistakes elevates him in my eyes, not the reverse. Honesty and recognition of wrongdoing in oneself are important traits.
By default, AWS already automatically notifies you when you exceed 85% of your free tier usage. The author did not get these alerts because he ignored the multiple warnings that he was using services not included in the free tier. Because he wasn’t using the free tier, he didn’t get alerts for the free tier.

And even when not using free tier, one of the first things AWS tells you to do when creating an account is set up billing alerts.

I’ll be the first person to line up and say that the AWS console and UI is atrocious, especially for hobby devs. But this wasn’t that. The author completely ignored the multiple warnings, got himself into a pickle, got it resolved, and is still complaining about it.
> They don't disclose that you can not transfer in or out.

What does this even mean in the real world though? You can instantly transfer your crypto back to fiat and have it in your bank account virtually instantly, which is better than any crypto exchange I’ve ever heard of. I’ll take this over Last Days of Mtgox any day...
Payment platform for underbanked online sellers
Rescheduling upfront is fine, but just not showing up and rescheduling later is a huge red flag for me.
Same.

Gotta also make sure I don't get a US Firefox build somehow.
Set up a lambda function that looks up billing. If billing reaches certain threshold, start shutting down resources. We do that and it works just fine.
Sure: the ProPublica article linked elsewhere in the thread about how the IRS keeps saying "we should just do Free File soup to nuts", Intuit does a bunch of lobbying, and the IRS goes "oh okay I guess we won't do Free File for a while".

You're of course correct that they do not have every document to prepare a return from scratch: but they do have the vast majority of them (in the cartesian product set of (Person x Document)), and certainly a similar to what other industrial nations who have reduced taxes to a postcard notice have--so the assertion also seems credible to me.
there is no doubt that a "nursery"-like construction can be implemented in Go in the same way like any language with "goto" can implement structured loops. The point is in constraining what can be done.

There is a trade off: "goto" is powerful but it is likely to lead to a spaghetti code. "nursery" introduces constrains but makes it easier to deal with error handling/cleanup, back pressure issues such as https://lucumr.pocoo.org/2020/1/1/async-pressure/
How to Enable the Mac Startup Chime on New Macs
I've noticed some problems with eSNI so far unfortunately. Some domains like discordapp.com have some access points with eSNI enabled and some without, so when clients access the ones without eSNI, they believe that they are under attack. I cannot wait for it to be finished and implemented though, it would be a huge benefit for the privacy of millions.
> You can also splurge an even extra 10% to get next-business-day onsite service.

It is worth to note that it does not actually mean that Lenovo will come next business day to fix. It means that they "try" (whatever that means) to do something next day, and if they fail, they shrug their shoulders and come later.

Source: My NBD serviced Thinkpad was bricked for something like 10 days.
Isn’t a zero hour contract just casual work where you’re
Not guaranteed hours? Sounds like every bar job I’ve ever had.
No, foo() and bar() will each execute once, but the methods performs some underlying operation on each item in the underlying collection.

Yes this is a cool and useful pattern, but it is not bind. It is just a different thing.
I have long loved org-mode and repeatedly tried to get into org-brain. Roam, to me, feels like what org-brain should have been—and I spend less time fiddling with it and more time using it.
She released the designs years ago and her influence on the scene has been growing for years. Having a well engineered production example makes all the difference for people learning how to make electronic music devices
I've been building MI modules for a while. Émilie is such a boon to the SDIY community. Not only does she design incredible modules and release the entire design for free but she also actively encourages modification and improvements buy offering a complete development VM.

It was pretty much expected whenever a new module was released that people would get right to work designing 'µ' versions of the modules that use less space on a rack or in some cases "double" versions of modules.
Small DNS queries and answers fit in one UDP packet, but larger ones don't and have to be retried as TCP.

HTTPS/2 over TLS 1.3 (which is the baseline you should assume for these relatively new services) is one TCP setup plus potentially 0-RTT TLS on all but the first visit.

0-RTT is safe here because a DNS query is just a question with no side effects. Replay attacks (the risk 0-RTT incurs) don't do anything:

Gumby: "What is the IPv4 address of news.ycombinator.com?" encrypted so that only DoH Server and you can read it

Server: "209.216.230.240" encrypted so that only Gumby and the DoH server can read it

Attacker: Replays Gumby's packet with no knowledge what it means

Server: Same reply, also unintelligible to attacker just like the original

For HTTPS/3 (over QUIC rather than TLS+TCP) it's UDP so the only "overhead" is from the crypto setup which is modest on even a relatively weak machine.
> Start out on AWS/GCP/Azure in the initial phase when you want to optimize for velocity in terms of pushing out new functionality and services.

Have you ever done this? It's exorbitantly hard to migrate off of a cloud provider, and few ever do.
X1 Carbon or X1 Extreme? They're two different laptops.
I concur. BSc course in Mathematics is good, just try to pick hard subjects and avoid anything with computing.

First year is a high school level - you do not have to take it if you are good at that maths. Second year courses are a bit more challenging, but real fun in on 3rd year. I did Complex Analysis, Fluid dynamics, Further Pure Mathematics - they are solid and interesting.

I thought about some physics like electromagnetism or quantum theory, but decided to stick with pure maths.

I think to also go get MSc with them - they introduced Galois Theory this year, although the choice of subjects is limited there.
There's quite a bit of "no true Scotsman" in there? If few get 'unit testing' right, then I believe there may actually be something wrong with it, not just a failure to 'do it right'.

Mocking is for exercising all inputs to a method, not just error injection. In fact that's fundamental to unit testing, and a necessary part. And it can grow to become a nightmare.
Because personal responsibility and due diligence is hard! /s
I said above I understand the hatred for academic journals. This thread is about whether all knowledge by otherwise uncompensated creators should be available for free.
PCILeech
Show HN: GeoDB – Managed & Hosted GIS Platform based on Carto (OS) & PostGIS
>In other words, and this applies to all tech platforms, don’t worry about me. Don’t worry about anybody. Us rubes can figure out how to sift through b/s and make our own determinations on what passes the smell test.

Does this guy have memory loss or something. There is a reason why twitter is looking at these changes and just saying "Oh yeah go back to how it used to be" is not a sensible response to this.
The longer you ignore Behringer, the longer a thriving community of module builders can exist. Cheap ripoff modules sound great (no pun intended) but provide one more angle to screw the little guy.
Alliteration is not a pun
For point 1, Windows 10 plans to implement this.
I agree that it's a bad example. I suppose the ellipsis at the end indicates an omission of a whole section.
If a malicious power takes over your country they’ll hit you with a rubber hose until you give up your secrets much before they give a shit about your internet history, I suspect.
I had long thought that Apple was about to have a big shift in native UI components, because for years they have been shipping first party apps that have card based interfaces that progressively disclose complexity as the card is pulled up from the bottom. Maps and Music are the most obvious examples of this paradigm, but ever since iPhone 6 Plus, a back button in the top left has been a bad paradigm (although the system wide swipe-from-left-edge has helped).

I've been pretty disappointed that Apple has not pushed harder in this area, has kept this first party by not updating native components, and has not updated their HIG. We've had to move to third party libraries. It has been at least 3 years since they started using this paradigm.
There is plenty of evidence, and it is not new or western. This claim was made in the 1980s, by Soviet defectors.

https://www.goodreads.com/book/show/700262.Ice_Breaker
This is why the paid version of "Agent Ransack" is instead called "File Locator Pro".

If I ever get around to releasing any of my own little projects they will have deliberately slightly offensive names to take advantage of this as a user filtering property. If at some point I want the difficult & demanding sort of user who is going to take issue with a project name, I can rename at that time. (of course if a project is intended to be breadwinner that may be a poor strategy!).
thanks it so useful
> If my tax payer money helped fund the research, I better get access to it.

I agree, I don't know why you think I don't. I said I understand why people don't like academic journals.
Dell is selling XPS and other business laptops with Ubuntu installed at the factory. Not sure if it's a Dell spin of it, but it'll save you ~$40 by not paying the Microsoft tax.

Purism has an open source laptop that looks good. Expensive, though. Voting for FOSS hardware with your wallet ain't cheap.
My two cents in this great discussion. The climate change emergency and the biodiversity collapse with no corrective measure taken whilee the stakes are so high for our survival seem to be proof that the world is NOT run adequately.
Everybody who writes code that's going to be supported by other people, should be writing for the average programmer.
I meant technical debt for the Rust project, not for fuchsia. I don’t disagree, Fuchsia would end up incurring this debt in the kernel too.

I would say, that as debt goes, this seems like something not egregious, but I can understand not wanting to take it on. But, with every passing year and no significant flaws having been discovered (I mean language destroying not some of the unsoundness bugs that exist), empirical evidence is getting stronger and stronger that Rust has an excellent model.
My favorite part is how half of the screenshots include a clearly marked "Free Usage Tier" option that OP did not select

https://blog.andrewray.me/content/images/2018/03/Screen-Shot...

Dark UI indeed.

https://blog.andrewray.me/content/images/2018/03/aws-rds-now...
This argument can be applied to the encouraging the rollout of HSTS and HTTPS by firefox and google, which cant be disabled very easily by administrators.
Can we get a link with no paywall / adblocker ?
This thing should never be on by default. Mozilla here has decided for me that it is an acceptable layering violation on my system/network. IMHO, this thing is bordering on malware.
How to add social sharing icons to the default Ghost Casper theme?
I think you may not appreciate how much $100 a month is for many people around the globe.
Classic drug dealer move, the first hit's free. I would have probably passed on a Chronoblob2 before, but damnit now I want one.
The difference being that Lenovo did it at the firmware level. Even if you reinstalled Windows from scratch, the malware would still be installed.
See eg the various initiatives against Elsevier's pricing practices with all/most German universities and a number of American universities refusing to pay Elsevier's fee/ransom.

Similarly the whole 'open access'publishing movement which sadly has been somewhat coopted by the big publishers.
Nitpick: That’s euro, not GBP
That's interesting to read about re-seating the connector. I have a 6 year old TP T540p which experiences half of the screen flickering. When I first got the T540p the wireless signal strength was terrible. I replaced the wireless card with two different other brands but they didn't improve the signal strength. Lenovo sent a tech onsite that opened the computer up to discover that the antenna which is routed from the mobo up through the hinge was being pinched when the screen was opened.
We take the pain out of configuring and running a Geographical-Information Analysis platform. This way you can concentrate on building the next generation of location aware apps and services.

GeoDB is based on popular open source software: Carto, PostGIS, Postgres.
So much business jargon (or honestly, just BS). You win on buzzword bingo in the first three sentences.

"built leveraging the core tenets of design, innovation and quality."

I do appreciate their naming, which includes now the screen size (T14,X13).
So I should block outgoing TLS requests to be able to stop DoH?

Seems a bad idea....

At least with DNS I could run a local DNS server and block outgoing port 53 from anything else. Now I no longer have this option and each app gets to look up what it wants, when it wants. Sure, it's great that my ISP cannot see what's in these requests but nor can I! And it also means that any application (eg. any Google product) can query for advertising/tracking domains without me being able to do a thing about it.

It isn't solving a problem - it's creating a far, far worse one (for me).

If I have got this wrong, or there is a method around this - what is it???
Novel Coronavirus NCOV/2019-NCoV/NCP/COVID19 News Summary
2% of all withdrawals?! WTF is this insanity. I thought it might be interesting for a bit, but never mind.

Are they preying on people that live in countries without a working banking system?
> But other cases (CockroachDB is one)

And GIMP. Some people just work so hard to get offended by an acronym that happens to also be an almost-unknown slang, that they created a fork called Glimpse.

That project declares that the name alone prevented adoption by thousands of companies and universities. If this is true, we should expect Glimpse adoption to skyrocket immediately.
How 5G's Acceleration will move through the Mobile App Development Space?
I stand corrected. I still maintain my point about (idiomatic) Clojure being terribly slow though.
So members of the other 20-30 parties are not PEP? What about councillors of other counties, would they not be PEP?

Specific organisations were targeted.
Really? What is eating meat and sugar responsible for?
Man that's bad.

Also didn't know about the "Download Valley"

https://en.wikipedia.org/wiki/Download_Valley