skysight-inc/HackerNews huggingface dataset:
That's a great idea actually!
@dang are such bots allowed in HN? I can roll it out pretty easily with Monitoro (https://monitoro.xyz) and would be happy to cover the costs.
I guess valid TLS is not boring enough for this website?
It is bad, but your are still more likely be killed by cancer or a car accident.

Ebola is a virus that could be unprecedented. That's a serious killer and I am glad it is not traveling as fast as Corona.
And I work at a European cybersecurity company and we are routinely tasked to inspect USB drives and devices EU politicians receive at conferences, so I guess we've come full circle.

I'm sure the NSA has implants in the EU systems but they're not dumb enough to just hand them out on USB drives that can be traced back to them.
I like all of your suggestions. I've been thinking about using TinyYOLOv3 as well. Provided the training set is considerably bigger than my own (I've created about ~550 samples and fine-tuned the model with them), you could end up with a very capable detection system that uses very few resources.

Object tracking is yet a very good idea. I will consider it. Anchor-box tuning is another very good idea.

Also, the CRAFT text detector that I'm using should IMHO be removed. Instead just use a very well trained text recognizer (like the CRNN I'm using). The text detector is expensive computationally since it's based on the VGG-16 model.

Then convert the models to use mixed-precision.

All in all, I think the performance improvements can be anywhere between 1 and 2 orders of magnitude.
Well, yes, I already explained that it depended on circumstances, and just let me add that I would bet the engineer quoted in the article (explaining that the memory leaks were a non-issue) knew much more about the specifics than either of us.

The Ariane 5 issue is not, of course, a memory leak or other rescource-release-and-reuse issue. It is a cautionary tale about assumptions (such as the article's authors assumption that memory leaks are always bad.)
> Obviously, nobody knows the number of people who had it but didn't report it.

Just because we don't know the exact number doesn't mean there aren't ways to estimate.

My point is that estimating a mortality rate involves a lot more than simply doing a single arithmetic operation.
I've seen several stories about how HackerOne doesn't pay out bug bounties when bugs are reported. I, for one, wouldn't submit bugs/PoC to them, and I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne.
Actually you have to, because it's your job most of the time.

What you're doing wrong then is scheduling the meeting poorly, without asking the others, which is your problem. It's typical of boss command structure. Expect problems.

Literally the worst thing is people all being forced to work 9 to 5. It's a compounding commute and scheduling disaster. Next to that, planning a meeting near those start or end hours.
The Unique History and Exquisite Aesthetic of Japan’s Ethereal Woodblock Prints
Are hackerone analysts employees of the company? If so the conclusion drawn sounds like complete bs.

If the analysts are just other users, then it definitely sounds like there is a problem.
It amazes me how many Founding Fathers were part-time scientists back in the day.
Okay reading that didn't help me at all.
Yes. The company I work for has various native, Xamarin, and React Native apps for iOS and Android (and Windows Phone..). We've used React Native on all of our new projects for about a year now, and it's working very well.
> Frequentist statistics is basically Bayesian statistics done with a "flat" prior distribution

I disagree strongly - there’s a huge difference in the kind of inference which is provided by each paradigm. To oversimplify, frequentist statistics constructs decision rules with good properties concerning unknown (but fixed) parameters, while Bayesian statistics uses probability to directly reason about those parameters. Confidence and credible intervals are not the same thing - you’re actually flipping what’s considered fixed and random.
It is my understand that it is highly unlikely an uninsured person would ever pay anything close to the billed "price." Same is true for insurance companies.

Edit: Some are telling me this isn't true, but what does a hospital have to gain from someone filing bankruptcy? Why would they charge such high prices that no one can afford? I would think that some money is better than no money.
Sure. The tricky thing about this is that there isn't much stopping anyone from starting a US shell or paying an associate to do it and then logging in to the account from anywhere. There are plenty of super functional countries that disobey court orders.

China for example does have a functioning court system. Like many countries, they don't cooperate with US court orders as a matter of sovereignty. Not even when Nike is trying to collect a couple billion dollars from counterfeiters: https://www.thefashionlaw.com/home/in-18-billion-case-over-c...

As you note though it's actually an important distinction about the retailer, because the retailer carries most of the product liability. Amazon makes people fill in a check box stating that they have liability insurance once the seller gets to a certain size, but they do not really check this at least to my knowledge. I encounter a lot of people who should have liability insurance, certified to Amazon that they did, but do not. There's not much wrong with a seller located in a country that cooperates with the US selling into the US because they can be held liable for any bad stuff that they do. They at least have a stake and can be held accountable. Not so when they are retailing from a safe haven.
Right, but it is better than having to wait more years until browsers reach consensus. I'm not sure but specifying a WASM-native string representation might be more favorable to a specific JS engine than the others, depending on its existing JS string implementation. This might cause disagreements.
An interview with Paul Graham on writing
I'm amazed Scotland have a real time map with also how long ago a road was gritted - much respect to them.

And the Gritter names are hilarious - but sadly don't (in my mind) beat Doncaster's "Gritsy Bitsy Teeny Weeny Yellow Anti-Slip Machiney"
Richard Hammond's (from Top Gear fame) Engineering Connection is a continuation of the original Connections. We found ourselves watching it on the weekends during breakfast as a gentle jumpstart to daily thinking. It's fantastic and highly recommended.
Because LEOs are oversteping their mark by a billion each and every fucking day, but the populace is too fucking computer illiterate to understand that ”data reading” (the norwegian euphemism for hacking into citizens computers) is extremly damaging to the fundamental concept of democracy.

ACAB
Depends on how the meeting is scheduled. There are a few times where it's near impossible to get everyone on time no matter what you do: on start of work day or before, right after dinner break.

It's sometimes a signal the meeting is perceived to be of low value.
In WASM i32 can be treated like a 8-bit byte too.
They had out-of-scope issues closed as being out-of-scope, which automatically lowers their reputation on the platform. The researchers are outraged:

> When we submitted this to HackerOne, they responded that this is an “out-of-scope” issue since it requires stolen PayPal accounts. As such, they closed the issue as Not Applicable, costing us 5 reputation points in the process.

But Paypal's policy really couldn't be clearer:

> Out-of-Scope Vulnerabilities

> Vulnerabilities involving stolen credentials or physical access to a device

( https://hackerone.com/paypal )

If Paypal says "don't send us this type of report", and you send one anyway, are you really surprised when your account gets a warning attached saying "this person usually files low-value reports"?
The submission and this entire thread is about learning math. That, to me, implies learning to do, not learning about. Yes, you said:

> if you're not trying to write a dissertation or pass a qual (and you're just interested in learning and being exposed) then you don't need to do them

There's ground in the middle, and this thread is about that. This thread is not about learning for tests and qualifications, nor is it about "being exposed", it's learning how to do the math.

And for that you need to do the exercises. You don't need to do all of them, you don't need to be completionist about it, but if you don't do the exercises, if you don't actually do the math then you won't actually be able to do the math.

Specifically, you said (quoting again):

> if you're ... just interested in learning ...

There's a difference between learning about and learning to do. If you meant just "learning about" then you are at odds with the entire thread. True, in that case you don't need to do the exercises, but I don't think that's what people are talking about here. I think people are talking about being able to do the math.

And if you meant "learning to do" then in my opinion you are wrong, and one needs to do a large slab of the exercises.

Otherwise it's fairy floss, and not steak.

My apologies if all this seems overkill, but there's a real danger of talking past each other and being in violent agreement, and I wanted to state explicitly and clearly what I mean, and why I thought you said something different.
> They deemed this issue a Duplicate, and we lost another 5 points.

A dupe costs points?! On bugcrowd you GET points for dupes...
AI Trends in 2020
So what's your plan? Socialized medicine? I mean, it's working out so great for those Chinese folks, right?

Making everyone else pay for you is no better of a solution, it's just shifting the costs around someplace else, which honestly is selfish of you to decide how I should deploy my ever-dwindling supply of cash reserves. I have two kids to put through college but Bernie and all his Democrat pals want to confiscate as much of my money as possible to pay for someone else's stuff, probably the 20 million illegals who showed up here unannounced, or maybe just swindle the money the way Democrats have done for DECADES.

It's coming to the point where guys like me might as well take up arms against people like YOU and just put and end to it. Get my drift?
In same situation in USA, government informed people, so conflict was resolved via court. In Ukraine, government kept peoples uniformed, then used armed police against people, despite the law.
not sure: https://www.hackerone.com/blog/Getting-to-know-the-HackerOne...

"When they aren’t triaging reports on our platform, they are spending time on their own bug bounty hunts."
I don't think most people who aren't Vine reviewers are happy with how it works ('cause they get free stuff). I have seen Vine reviewers leave bad reviews, and I know because I've been yelled at over it.
It's a self-fulfilling prophecy.

Programmers develop new technology and paradigms to solve problems caused by existing technology and paradigms. As those new technologies are adopted, they are perceived to give an edge. And so, this creates a demand for experience in this new technology.

As time moves on, the impact of the new paradigm or new tech is getting better understood and the initial optimistic bias aligns with reality. Meanwhile, programmers develop new solutions to solve problems caused by... and the cycle repeats.

The problem here is that the problems that are being solved aren't necessarily new. It's just this foundational "how do you build a website or web interface efficiently" problem that underpins everything.

In a way, it's not much different from re-inventing the wheel. There are only so many specific ways of doing that before the entire exercise turns silly.

The bigger issue here is that - unlike tire manufacturing - the subsequent cycles of innovation are too short for a majority part of the workforce to keep up with changes. Why? First, because the complexity of those solutions creates a prohibitive cost for their employers to easily migrate on short notice and keep up with the cycle. Second, because the vast majority of new tech are just small optimizations in the real world with a limited impact on business making migration a risk and not an opportunity.

Hence why, once a tech has been chosen, companies stick with it for the long haul at the expense of individual developer experience keeping up with the innovation cycle.

That's what turns this into a self-fulfilling prophecy. The faster the cycle goes, the more tight the labor market becomes. That's why you'd see those crazy "Must have 15 years of React experience" requirements.

Finally, what we see is developers are being goaded into whimsical HR hiring processes that shake them down. In reality, it's not developers being "unemployable", it's the hiring process that's essentially broken as it is driven by individual business needs that aren't really that sustainable in the long haul.

When businesses lament that they can't find good talent, but at the same time reject the vast majority of candidates because they can't possibly be proficient in the latest cycle of hype technology (unless you're a core contributor to a particular framework or live a monastic life foregoing any and all other aspects that make life worthwhile living, that is), well, that's a form cognitive dissonance I would say.

As a developer, I feel it's important to keep an eye out of how things evolve, but there's little to no point in trying to keep up with the nitty-gritty at all costs without knowing if you're ever going to need it.
Very appreciate the work on bastion, which really gets the spirit of erlang actor programming with the supervisor-ing strategy!
The code is clean and well documented, and I cannot believe the project is not well-known by rust communities.
> I would actively, publically, and immediately disclose bugs that affect anybody who is a client of HackerOne.

Sadly you can't feed your children from media drama.

Maybe, in the long run, but it's more likely to get sued.
This looks promising, though the "No Forced Trait Implementations" seems to instead require using a strange looking msg!() macro?

https://docs.rs/bastion/0.3.4/bastion/macro.msg.html

Seems less clean to read than Riker (https://riker.rs), though that doesn't really do async well.
"(I was shocked when I saw the they put the name of the illness on the note. That's so far from my employers business that it should be illegal to even ask. Employees and consumers rights in Germany seem to be seriously limited.)"

You get multiple papers in Germany. The one without (!) diagnosis is for your employer.
Bug triagers may be employees of HackerOne, employees of the company (e.g. Paypal here), or contractors indirectly working for the company (I worked in this role for a year). They're not going to be random other researchers.

The screenshots in this article show a "HackerOne Staff" stamp, so those triagers are employees of H1.
I don't doubt there are countries that are worse at it, but "the Dutch sites work" is not always true, or sometimes true for questionable definitions of "work".

I mean, we've got this nice secure login system for government sites: DigiD, which works fine. So you need that to submit your taxes. A few years ago, it turned out you needed any valid DigiD to submit your taxes, not necessarily your own. There are tons of other sites that cost many millions, and resulted in an atrocious user experience. And some projects simply failed after going way over budget.
Because people only want what they can’t have.
Fundamentally, some people are allergic to actually profiling things and collecting data. I don't understand it, but there are lots of people who would rather spend hours talking over things in the theoretical sense, rather than spending a half hour coding it both ways and benchmarking it to get some actual data to make a decision on.
Further to this, in Canada at least, all DSLs are subleasing lines in bulk from one single backbone provider (Bell). Competition is legislatively required but de facto questionably existent; in addition I would be surprised that Bell doesn't have all the aggregate data on traffic through subleasing ISPs as well.
It's a bit easier if you think "the other way", so 1ft ~ 0.3m or squared it's 0.9m2 so, divide by 10 and take 10% off and you get the ft2 -> m2 (or multiply by 10 and add 10% for m2 to ft2)

Still approximate
Probably the wrong crowd? This is a forum for developers and such, many people here wouldn’t look at a website builder with their ass.
I think there should be a clear distinction between your tools and... let's call them "utilities" what comes to UI. It is perfectly okay to make electricity plug, water faucet, toaster and the power button on your computer not only so easy that an idiot can use them, but so easy that an idiot can't use them wrong. Not only because requiring mental energy to use these is irritating but also because it can be dangerous.

Your tools, then again, chainsaw, microscope, text editor... have no reason whatsoever to have an UI that is intuitive without training[1]. Because without training you are anyway going to be either dangerous, useless or in best case just really unproductive.

[1] of course, the UI needs to be efficient after training.
but this is it:

"This happened even when the issue was eventually patched..." which, based on that, I understand their gripe here
I've come across that. And it looks awesome! Might give it a chance, why not. I see Tesseract's OCR engine is based on LSTM networks.
I've seen speculation that the virus in Iran has mutated (or the environment is somehow different), and is producing extremely aggressive complications, killing patients within hours of their hospitalization.

At this time of year, there will be even more mass face-kissing and hand-shaking going on than usual. There are entire communities of travelling super-spreaders in Iran right now, this is extremely serious.
One of the comments at the site finally cracked a little bit of light for me on Bell's theorem. To quote from the comment: "What his theorem says is that the world can not simultaneously be local and have hidden variables. His own position was that it seemed exceedingly likely that the world was non-local and that there were hidden variables (such as where is the photon at any given time)."

I don't know why, but I kept imagining non-local scenarios and thinking, "This seems like it should be OK, so I don't understand what's going on". Having it spelled out is tremendously helpful. I still don't understand what's going on, but at least I don't feel completely crazy ;-)
Sound like PayPal business as usual. Crappy company with crappy attitudes. It's fascinating when people spend their time and effort on good causes instead of joining the dark side just to be shown the middle finger instead.
I think this could recreate the problem to some extent, as the shared infrastructure would be owned/administrated by someone, who then would have lots of aggregate data to sell.
> a site full of VC entrepreneurs

If this ever was true (and I guess it was at the beginning if you counted YC as a VC back then), it's certainly not anymore.

YC-funded company founders are a tiny minority of participants here these days, and founders of other VC-backed companies barely register as a presence at all.
From PayPal's response to a 2FA bypass:

> If the attacker has the victim's password, they would already be able to gain access to the account via web UI too. As such, the account is already compromised. As such, there does not appear to be any security implications as a direct result of this behavior.

Seriously? This means PayPal's 2FA is just security theater. I'd rather they didn't offer it at all in this case, at least then I'd know how insecure my account really was.
PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed.

According to this image [2], they did not respond or refute within 30 days.

If PayPal’s PCI-DSS compliance certification isn’t revoked then PCI-DSS is a farce.

[1] https://www.itgovernance.co.uk/blog/a-guide-to-the-pci-dsss-...

[2] https://cybernews.com/wp-content/uploads/2020/02/paypal-2fa-...
Looks like ecto went too far by using named prepared statement by default? Should work just fine with unnamed prepared statement: https://github.com/elixir-ecto/postgrex/blob/master/README.m...

Postgres planner is very fast, so there will be no noticeable performance difference by having to plan the same query again and again. This is unlike, say MSSQL, where a semi-complex query may take more than 0.5s to parse/plan, thus requiring the rather lousy query plan cache.
My 72 Hours in a Viral Tweet Vortex: A Diary
There are, but it should be simple enough for non-techies (politicians) to understand. They could use Threema (Swiss) or Wire, but either-way it's better than plain SMS.
Turing has destroy everything what Alonzo Church did ;-)
Must've stuck a nerve there.

> Do you want to mean all Clojure developers are garbage?

Of course not, many Clojure programmers are excellent at programming in Clojure.

> You would do better by, instead of being lazy in your thinking and offensive to other communities, to actually try to use your head and try to understand the problem.

I don't have to do that, because I'm not using Clojure.
> Sure, this is a LEGO-style experiment in reinventing the wheel

If I'm not mistaken Larry Page used to be praised some time ago for building a printer out of LEGO pieces (that may just be an urban legend, I admit I never verified this information).
The points associated with a duplicate report depend on the status of the report you get duped to. I assume in this case the original report was Not Applicable.
I don't really understand why we have decided that static html pages need to have a TLS certificate
Data Science is dying out
> Being sick means being unpaid, and many people cannot afford to go unpaid.

In Germany being sick means full payment by the employer for 6 weeks, after that you'll receive around 90% of your last net income by your healh insurance company for 72 weeks, after that slightly lower unemployment payments for another 12 month. So around 2.5 years of being sick are required until you're actually unpaid.
Is It a Pandemic Yet?
Oh so an N/A dupe? That sounds plausable.
It’s probable PS4 and Nitendo users are too busy playing so they have no time to write a review I’m just saying.
The market for a freelance security researcher out there is hard, no doubt, but disclosing bugs publically is an addition to your resume, akin to any other professional development you do. It demonstrates you can do the work and it shows the skills you have.

Suing someone for disclosing an actual bug is a long term losing proposition for any company in a competitive industry.
Rain is essentially distilled water (evaporation from terrestrial water bodies and then condensation in the atmosphere). It picks up some contaminants in the atmosphere and some dissolved gases when it condenses but it's going to be mostly free of minerals (i.e. not be hard). So collecting rain water is one source of bulk 'distilled water'.
Lancet: Preliminerary research, case reports, evidence based coronavirus updates
For a semi-fictional humorous take on American military procurement watch the movie The Pentagon Wars
with the acquired information, the researcher has a few options:

- bulk acquire stolen credentials, bypass 2FA, bypass the security checks when sending money, and accumulate wealth

- sell above process to anyone that has an internet-connected device, the desire to accumulate wealth, and willingness to commit fraud (which I would guess is a non-trivial % of the world's population)

- disclose the vulnerabilities to paypal through any available channels

The fact that they went with the latter AND were punished for it doesn't shock you? Jesus.