skysight-inc/HackerNews huggingface dataset:
> You can't sanitise, escape and reproduce correctly all at the same time.

That's why you do them at different times...

Let's go to the example:

> This is clearly dangerous input!

That's not clear at all. There is a set of values allowed for a comment, this one is probably within them, while, for example, an empty value usually isn't, as isn't and invalid UTF8 sequence. This one should pass sanitization as is.

> Change < to &lt; in the database?

You escape it when converting into HTML. It's not the same as sanitization.
Just recognize that you're holding SQL to an unfair standard here. You wouldn't reject an HTTP framework because you can't paste raw HTTP into it. You wouldn't reject an IMAP framework because you can't paste raw IMAP to it.

You're requiring that the maintenance hatch be the front door. It should be no surprise that such a design results in lots of people accidentally breaking things.

As you say, fewer than 1 in 1000 people have your needs. Why would you recommend a tool whose features are more dangerous than useful for them?
I think this policy has existed for almost 20 years now. I remember in earlier seasons of 24, all good guys used Macs, and bad guys used PC's.
Is there evidence to suggest the product placement is paid? I had always heard that Apple does not do this, and that the products are simply in the media due to the director's choice. But that's what Apple would want me to think!
Then you spend the whole movie obsessing about if it's true or not, making it even worse.
This is an interesting point that I hadn't considered. While I am resentful of pharmaceutical and insurance companies that prioritize profit over peoples' health, it does feel a little more just to tax companies creating frivolous social media ad platforms than companies doing drug research.
As long as they are identifying cases why would you say they are overreacting?
This is misinformation https://apnews.com/d36d6c4de29f4d04beda3db00cb46104
It's a bit unfortunate for people with mobility issues who needed straws though. They benefited from it being a common thing and how they'll need to pack their own or something.
That's crazy. But what I think is: considering that's an epidemic that is dangerous and quickly spreading, shouldn't the government just decide to test people coming from places with a lot of cases already? And pay for it?
Avoiding clunky UI is the raison d'être of gov.uk. You shouldn't have to deal with an awful user experience for things you are legally required to do to go about your life.
None of the competitors I'm aware of have fuzzy search though, which is pretty annoying.

"color prple"

LibraryThing: 0 results

Goodreads: 2,000+ results and they're well sorted
It's the opposite, when you are wearing one of those masks you touch your face more often. It also is a warm damp environment for bacteria.
Now if you are sick and you are travelling to the doctors or something, then yes, a mask is a good idea. If you are healthy and trying not to be sick a mask is a bad idea, gloves and frequent handwashing with soap and water is a much better plan.
Ah, the old "we know what's best for our users" mentality. Take something good away in favor of a worse UX, with no config setting to switch back, even though old and new could co-exist.
This is partisan misinformation: https://apnews.com/d36d6c4de29f4d04beda3db00cb46104
This is a spoiler. That said, not really. It's not the type of movie where there's a big room at the end with a ton of suspects and you seeing some iPhones will ruin all the suspense. It's a lot of fun with a great plot.
Thanks a lot, very helpful!
You are correct. You can use any GraphQL Client. Hasura has done an awesome job with tutorials here that you should look at:

https://hasura.io/learn/
I've worked at studios and at agencies and this is anecdotal but what I've picked up on over the years during drinks/drunks with account and creatives.

There's a whole product placement sales team that monetises brands who like to see their products being handled by the good guy. Hero saves the world with 0.3 seconds left on his shining Galaxy S20, maker logo in prominence.

Piss that brand off? You might not see revenue from them for a couple of seasons. Or ever. Oh dear.

There is also logo and other IP/copyright enforcement. Why is made-up-spy-agency's logo over the Apple logo on what's obviously a three generation old MacBook? Because somebody didn't have the budget to factor it in.

In a lot of cities you can't even include buildings in b roll without legal clearance.

It's fascinating when you dig in, the amount of payola for this kind of thing is really interesting (and thinking how to monetise it…).
This sounds like the food version of the solutions NIMBYs propose for housing costs.

"housing is expensive because of all the skilled workers moving to SF? The solution is obviously to block all new office construction so companies move elsewhere!"
There are, the machinery I mentioned is a lot more complex in humans. The expression of genes is heavily influenced by how the DNA folds (and this is affected by complexes of proteins that Methylate at different locations in the DNA)
To me this article seems to be missing the most important stat from the original article, which is that the case fatality rate as measured is 2.9% inside Hubei (possibly under-reported) and 0.4% outside.

I think this strongly suggests that, as one would expect, the situation is much worse if patients lack the medical resources for care. And it also shows how important quarantine and preventative measures are.
This is a great question for your recruiter.
> To say they don't have any way of MITM'ing a connection is wrong even if it's unlikely.

I totally agree, it's why I qualified it with "just by virtue of them being the one validating the cert for a certain website" and later on adding that they could do so in other ways, like the one you're suggesting. Reading it again makes me realize that it could be understood that way, though, sorry if I wasn't clear enough. Sometimes not being a native English speaker betrays me a little bit. =)
From the point of view of the patient you don't 'just' have pneumonia. It's a pretty heavy thing to go through and may cause lasting damage to your lung capacity and ability to deal with future infections, the only upside is you can't spread it around.
L1B and H1B are restrictive visas. When you change jobs life is difficult.

This gives employers a lot of leverage to overwork and underpay.

I feel sorry for your friend because I was in that position in Microsoft. Once I got my green card, I got a 75% raise by going somewhere else.

My advice would be for him to talk to his boss and explain his case. If the company really wants him then they’d give a raise.

It’s really hard to get raises at an existing job. That’s been my experience. Sure they’d level you up, but % increase is pretty meh. Switching jobs usually results in a higher % compensation.
Safari will will no longer be honoring certificates valid for more than 13 months starting September [0]

[0]: https://www.theregister.co.uk/2020/02/20/apple_shorter_cert_...
There's a global map and charts at https://outbreak.cc

Also the /r/coronavirus subreddit has a daily post with changes per country.
Tangentially related: As a side project, I've been building a backen-as-a-servive platform with a GQL interface derived from the data model and business logic.

Posting here as it may be of interest to readers: l
https://massiveinference.com
It gives you a profile that's very slightly thinner at the bottom, but I've never seen a cooler that spills past the CPU where the bottom inch is wider than the second-most-bottom inch.
Quite strange that propriety systems like dragon are mentioned as motivation, surely they should fix the product or standardise.
I’ll predict Bell wins this and the FARA contract. Conservative solutions will win, but strange to be calling a tilt rotor conservative.
My mining through his comments shows he is from Beijing [0].

[0] - https://news.ycombinator.com/item?id=22149446
Multi-Language Documents Identification
My guess is that the company that beats Google will be the one that lets users create and monetize their own multifarious search engines that each has an editorial slant and an aptitude in a specific area.

Essentially, Google is CBS/NBC/ABC and their value is based on their name being the destination. They’ll be taken down a peg by a YouSearch (née YouTube).

Although Google, like CBS/NBC/ABC, will still exist they’ll just lose half the market (the middle tail).

What I’m describing is a technical challenge, but not like Nuclear 2.0 is a technical challenge. You could create an MVP for a niche market in a year or so. I think it’s mostly just hard work, doing marketing, understanding early adopters, doing the tech support, having a good feature-request-to-patch pipeline, managing investor expectations, etc... all the normal grunt work of a startup.

The search doesn’t even have to be that good if you can search psychological spaces Google could never prioritize.
Ok, we'll make the title trivially verifiable by doing the "says" trick above.
You should be fit-tested with an N95 as well. I had a job where it was required yearly and different brands and sizes work better for different people.
this is just a case of the voting public getting exactly what they voted for

Except that the majority of them didn't, of course...
It's possible, and I would venture very likely, that the problem is within you and only you, and not the world at large.

The large part of the rest of us would love for people everywhere to continue to live and thrive.
The thing about NN is that increasing the weights does improve the performance. The standard way to get good performance and see if your architecture works is just get the network huge (wide). After you see it works you get it small.

The "common wisdom" of "too many parameters will make you overfit" is most definitely not that important for the way modern NN training works.
I've noticed this true, but the same could typically be said for Mercedes Benz and BMW. I think it's less Tesla specifically and more "murdered out luxury car".
I think you are overengineering ;)

Plain text can contain anything and it shall be treated as such, it is that simple.

As for security, don't assume everything in your database came from a trusted source. Maybe there are remains from an old version of your code that didn't sanitize, maybe you improperly used admin tools that bypassed checks.
Yes, but the fault lies with both personal decisions and large corporations. The argument you've made is most often made in bad faith to guilt consumers into ineffective actions, shifting the blame from the systems that mould wasteful lifestyles to the "weak" individual who is trying their best.

Most of the items you listed are necessary or can be made to have little impact, e.g.:
>plastic packaging
Agreed here, most of it is unnecessary. However, it is a systemic issue - buying goods (especially groceries) that do not come in plastic requires significant effort i.e. shopping at bulk food stores or farmers' markets.
>cosmetics
Sure, a lot are unnecessary, but I'd hate to go into work where nobody wore deodorant, showered, or washed their hands.
>Non-seasonal fruits/vegetables
Depends on the fruit/vegetable. Where I live in Canada buying non-seasonal/local is essential - otherwise I'd be eating apples 6 months of the year. Fruits and vegetables that can be transported by ship often have a lower impact than locally-grown.
>Having pets
Most pet food is made from by-products that would be wasted by the animal murder industry. I'm vegan, but as long as people eat meat (which, let's be real, they will) owning pets brings huge positive impact to peoples' lives, with little impact - as long as you're not feeding your dog steak.
>At a system level- farms, silos, and grocery stores have no interest in storing any more stock than reasonable

That sounds like an economic failure. On one hand we have futures and maple syrup reserves to keep prices up during shortages, but we dont have reserves to address "0% safety margin for a supply shock (aka famine)"?

I would expect excess farm production to be stored for famine, as a stability control function of government. The farms still produce, still get their money, and the government has a safety net for keeping the peace during chaos.
It's pretty much a case by case basis with events. RSA happened although some companies pulled out. I'm attending a smaller (but still fairly large) US event next week. It's still on but they're asking people to certify they aren't sick and haven't been to China in the last couple of weeks. (And some other precautions like a no handshaking protocol.)

This is the first one I've seen cancel that far out. (Well, I know another but I think there were other factors at play there as well.)
Indeed, that's a nice example. I felt the design could even improve public relations. If I were a UK citizen, I'd be relieved to find the information so well-designed and presented.

I've read here and there about the UK Government Digital Service, and have a very good impression. Reading a recent related article, it sounds like they have their priorities right!

https://gds.blog.gov.uk/2019/11/05/transforming-gov-uk-the-f...
Considering there's a semi-contiguous allocation in the kernel I bet you'd find some interesting bugs that way. I don't think very many people mess with the pipe sizes other than to tune to a multiple of the input/output block size for the application. And if you're trying to maximize throughput you're likely to reach your optimum block count long before you start blowing out buffers.

Actually, come to think of it named pipes would be another good place to fuzz.
Would be interesting to see the normal yearly death rate of these age groups. Is Corona just advancing natural death rates for the old people (i.e. bringing forward by a few months), or do more old people die?
The more “important”, the more engaging
"Apple products do not appear on screen by accident. Apple pays for them to appear"

It has been reported by people in the business -- quite a few times -- that Apple does not pay for movie or television appearances. At least not directly. Instead they provide hardware for free to be utilized for placements, at least if they're good with the content of the show and format of the placement.

"Apple products do not appear on screen by accident."

If your movie or show is about American upper middle class teens, they're probably going to have iPhones. Apple doesn't need to pay for that to be true, though competitors need to pay for that to not be true.

I mean, tonnes of times you see Apple hardware and the show goes out of its way to occlude that fact (e.g. the MBP with the Apple logo covered). There just happens to be a lot of Apple stuff in the business, and it's what people are comfortable with.
Problem with this kind of description is that input and output are often two names for the same thing. One processing element's output is the next one's input.

Basically, don't substitute HTML cruft onto text, except at that stage in processing when that text is just about to be inserted into HTML.

Don't do HTML-ization prematurely.

You wouldn't encode and store data in Base64 just in case it might be needed that way in some future processing step.
Performance Evaluation of Shared Hosting Security Methods [pdf]
And the 14th Amendment was meant to act as a constraint on the general government but that hasn't stopped it from being used to constrain state governments.
Only if the certificate authority doesn't implement a way of not submitting their cert to the CT log servers. Of course, eventually someone might notice (if the certificate is used widely enough - if it's used to attack specific known people, maybe not) and realise that a certificate is being served that doesn't have corresponding CT info, but browsers don't check that.
Many anti-vaxxers reconsider and become staunch pro-vaccine activists when it's their own kids who get sick from preventable diseases:

https://nypost.com/2016/09/20/i-was-an-anti-vax-crackpot-unt...

https://www.self.com/story/from-anti-to-pro-vaccine

https://www.theatlantic.com/health/archive/2015/03/i-used-to...
Arrrghh, it's 2020 and developers are still too dumb to understand the difference between a string (list of characters) and a tree (sql, html, ...).

No, the solution is not to "sanitize" input, output or both! The solution is to not use the same type for text and trees!

We should rid the world of brain-damaged templating solutions like jinja, go template and similar garbage that pretends your SQL or HTML is some flat string that just needs a bit of extra contextual "escaping" magic [1].

If you interpolate into a proper AST there is no problem and you need no "escaping". For efficiency reasons you may not want to directly interpolate into an actual ast and then de-serialize all of it to a string again just to output it down a socket in the next line, but that's just an optimization.

Bourne shell fucked this up as well (for an easier case of interpolation, since there is basically no nesting) and it remains a constant source of severe bugs and security holes in shell scripting as well. By contrast lisp has been doing this right for literally decades:

`(html (div ,some-string-to-interpolate ,@a-list-of-inline-elements-to-splice))

[1] Yes, I get it's "convenient" to have a "universal" solution that works for any type of file. But html and sql in particular are easily important enough to have a correct solution and it's not hard, it's not inherently slower and it's way more convenient in any real sense than puzzling about several rube-goldberg sanitization schemes, running some stupid security linter and paying $$$ to pen-testers for hunting down this crap.
If that's the case then if I'm a thriller author and my bestseller is going into production then I will be lining up a whole artillery of attorneys and probably some court orders equivalent to Anton Pillar orders which is the England copyright abuse evidence seizure order and the nuclear option and also capable of being treated as international when the agreement is operated from England the location of parties subject to the Royal Courts is irrelevant unless you can't obtain LEO cooperation in which case your judge chews the England based entity a new one for starters. My objective being to secure definitive evidence whether the movie producers are debasing my moral copyright in a criminal defacement and distortion of my artwork.
In Julia, where the paralleization options are explicit (SIMD, AVX, threads or multiprocessing), it always depends on the load, for small operation (around 10000 elements) a single thread is faster only for the thread spawning time (around 1 microsecond). And there is the issue of the independent Blas threaded model, where the Blas threads sometimes interfere with Julia threads...
In a nutshell, parallelization is not a magical bullet, but is a good bullet to have at your disposal anyway
Two Novel Server-Side Attacks Against Log File in Shared Web Hosting Servers [pdf]
Indeed. Just like 32-bit integers, having fixed size floats as the default representation of numbers with a decimal component is a bad holdover from days of limited hardware.

Let programmers use floats when they have the performance analysis to justify it. Before then, it's just another kind of premature optimisation - and high level languages should be avoiding it.
ah right right
Can someone explain what a PWA is? I tried reading the official Mozilla docs and wikipedia. I don't understand - how do these apps work like "native" apps if they are not using native UI kits and running inside a browser? That's not really "native". Native app to me is like macOS Mail or Sublime Text. I don't consider any of the electron apps (Slack, VSCode) as "native".

There is a real beauty of using native apps. I don't like this move towards PWAs(from what I understand) - its like the developer has to put up with 3 different dists (macOS, Windows and Linux) so let's make the entire app extremely bloated, fuck the user experience and native integration and lets all go full wild wild west in the Javascript land. Developer's laziness has lead to Electron and Javascript spaghetti world we live in. I have noticed this and its controversial but everytime I see anything done in Javascript, 9/10 times it is awful and convoluted. Slow. Javascript developers appear to be a lot more inexperienced in software engineering than say a C++ developer. BootCamp courses teach you how to make bloat. Don't get me wrong - there are some good Javascript libraries but they're rare. I am sure there are a lot of good Javascript developers out there, but the general observation I've got is not very positive.

Ever used Sublime Text? Instantly different than any web app or electron app. I kind of want us to go back to old ways of doing things.
Wanted to add that after the dns-01 challenge went live, it has become even more awesome. Many customers saw opening up port 80 as a security concern for their firewall.
CAA DNS records aim to make that more difficult, actually, but otherwise AFAIK you're right. =)

https://en.wikipedia.org/wiki/DNS_Certification_Authority_Au...
Comparison of Routing Protocols in Mobile Ad-Hoc Wireless Networks [pdf]
transmission is bad, as they might carry it to more vulnerable people, but also it gives the virus more opportunities to mutate, which could hinder vaccine/treatment progress
Logos and names are trademarked, not copyrighted. Theoretically, Apple could sue if they could argue that their trademark is being used in a way that could deceive consumers. That's the test for trademark infringement: would a reasonable person think that you are passing off a trademark as your own product?

But you don't need permission to say or use trademarks in a movie. Josie and the Pussycats is a famous example: they used a ton of trademarks to make it look like product placement, where in reality they weren't paid for all of the trademarks they used (nor did any of the named brands complain):

https://en.wikipedia.org/wiki/Josie_and_the_Pussycats_(film)...
They may not be transparent with their numbers, and certainly weren’t in the early days, but what about their response has been not competent? And what does gutter grease have to do with this virus or containment?
Oh no, that platform was a horror show 10-20 years ago, and I'm not sure it has improved...
If the airline suspends flights you will get your money back. Apart from that, trip insurance? Maybe your credit card offers it.
142,857
A Comprehensive Approach to Abusing Locality in Shared Web Hosting Servers [pdf]
It's not the video that YouTube creates; it's the metadata of recommendations, classification, and advertising association.

PragerU attempted to argue YouTube infringed PragerU's freedom by arranging that metadata in a way PragerU didn't like.
Ah that makes sense, didn't even think to look there. Awesome, thanks for the help!
Amazon MWS revoked our credentials. Can anyone help?
Amazon MWS revoked our credentials. We have order automation software relying on the Amazon API and can't get through to anyone. We do many millions a year on Amazon but support is through cases only and takes ages for them to make a move. Would greatly appreciate if anyone can help.
Email me at heshie.b@adarmedicaluniforms.com.
Thanks in advance!