skysight-inc/HackerNews huggingface dataset:
Ask HN: How secure is plain text input on HTTPS web page?
Before I start, let me say that I have amateur knowledge of HTTPS and other similar protocols so this question may be simple to answer. But, as a layperson, it seems problematic.

--

Recently I was helping someone file their taxes online--nothing complicated so free software suffices--but before we could begin, they had to reset their password. Since it was related to taxes, all accounts were based around SSN and email. Again, this seems fine as it's a legitimate 501(c)(4)org and is reputable. However, the users input for their SSN was in plaintext with absolutely no delay in disguising it.

I understand this may be more user friendly as it could eliminate user error (i.e. typos in SSN) but does this then imply SSNs are being transferred in plaintext throughout their entire system? Is this type of plaintext input common industry practice? Bringing it down to the most basic level, is this type of input truly secure while being transferred over HTTPS?
Riding the subway doesn't make you sick. Not washing your hands and then touching your face with hands that have the virus from touching parts of the train makes you sick. You can't touch your face much if you have a mask on it. The virus doesn't just float around in the air. It only exists in water particles that fall quickly onto surfaces.
Just want to say the same. Take care of yourself, and illegitemi non carborundum.
I'm working on BentoML, a python framework for ML model serving.

It makes it easy for data scientists to ship their trained machine learning models into prediction services for production use.

Key Features:

- Model packaging and dependency management

- Distribute your model as a docker image, CLI tool, PyPI package

- Adaptive Micro-batching in online API model server - this gives you an average 10-20x increase in throughput/overall performance compared to a regular flask API server implementation

- Model Management for teams

- Automated model deployment to AWS Lambda, AWS SageMaker and more

https://github.com/bentoml/BentoML
New LIGO Events Destroy Idea of 'Mass Gap' Between Neutron Stars and Black Holes
Thank you for your work on F#!

While I don't get to use it nearly as often as I would like, every time I have it's been really fun to play with/use.

One of the nicest things is that I find is that every time I get to play with it, the language is intuitive enough and IDE support is rich enough that I'm never feeling like I've forgotten how to work with it.
I am no expert but I believe that when caused by an infection it is usually temporary.
Most machine learning is not on a band limited signal. I've literally seen these tactics applied to demand forecasting. And I just can't square that they should.
Counter point: My Japanese friends have been and still are going out to bars every night like nothing happened.
Yeah, this sort of bogus claim can do real damage.
The Days of Bitcoin Mining Are Nearly over (2019)
Italy, Pandemic’s New Epicenter, Has Lessons for the World
> Working on bsnes and higan were the things that made me most happy.

What about this work made you happy? What was the reward? You might be able to capture it in a different way.

I don’t get the sense that it was something to do with making the people who used your emulators happy, per se, so probably “solving someone’s problem and seeing them light up” isn’t going to do it for you.

I’d guess that helping to conserve other artistic expressions [to ensure people can experience them the same way they did on the original hardware, long after you’re gone] would make you happy? Especially if you could use your specialized knowledge and experience to do so, in a way where it’s not necessarily true that anyone else would have come along to do the same thing if you hadn’t done it.

Perhaps you could volunteer in a consulting/advisory capacity for some of the Archive.org software-library preservation projects? Not so much programming, as pointing out the pitfalls in the architectural decisions of what other people are programming. Like a software security consultant, but for “ensuring the original work is conserved and reproduced with 100% fidelity” instead of “ensuring nobody can exploit the software.”
Hey I've noticed this too. It's like I'm mentally somewhere else. Very odd. Fortunately, when I drive long distances I have other people in the car. And when I drive short distances, I can just stop wherever and change things.

Honestly, on 101 and 280 I see drivers texting all the time and they're driving right in the lane, no problems at all except being slow to react to what happens in front of them (which makes it obvious they're on the phone). I don't know how they do it. Even glancing down at my phone instead of the center console loses so much state.
Seems like overkill for something that only a couple of decade or so ago, we used to use our own memory (albeit inefficiently, but most of us will be okay with not doing this with too much efficiency).
I am pretty sure we are going to disagree widely was to what "sorted out the problem" looks like in execution

Especially if you think Illinois is a model everyone should be following
Likely very iffy. Age alone isn’t enough. Possibly, the best check would be something like “can run x miles/hour for y minutes” (‘measures’ lung function relative to body demand), but even if you can find even halfway decent criteria, who’s going to do the testing? Who’s going to repeat that testing every week?

Also, I would think a significant fraction of “the population likely to require hospitalization” currently already requires care (they are in hospital, care homes, or even just have family or neighbors visiting them every few days). You can’t quarantine those [1] , and you can’t afford having a large fraction of those caregivers fall ill at the same time, either.

[1] technically, camps housing all those in the danger group and their caregivers in ‘camps’ would probably work, but I think that’s a step up from asking the entire population to stay home.
Why give them the option in the first place? It's not like billionaires have a good track record.
Proposal to mint two $1T coins to fund UBI [pdf]
Mazdas have a physical wheel to control Android Auto and CarPlay. I couldn't live without it. Also true for Toyota Yaris and the older Scion iA.
How better do you know your employees?
Fucking amazing that a "credible accusation" can be made under a provably false name. I know more than one person whose life has been destroyed by baseless accusations of campus sexual misconduct. The only difference was that the people I knew weren't respected faculty members with the financial resources to hire a lawyer and the connections to speak personally with the president of the university, and they lost a lot more than a single job offer.
> You can go and listen to them yourself, and delete them.

I've been in the business long enough to know that if something is digitized, it often never ever goes away. You don't know (nobody does for sure, actually) what is the internal retention policy of this information or its metadata. You can delete the recordings but the only thing you know for sure is that you and you alone cannot access them anymore.
These types of studies look so biased as they will only get covered in news channel if the results are anti-tech. There is no mention of how much distraction would "changing a radio station" or "adjusting car heating" will cause - and benchmarking against those. Good that this came out during the current COVID-19 outbreak as the political brass is distracted enough to even consider this.
A dangerous headline.
> But I still dont know if this is even worth 2 more years of my time.

Yes! 20 years from now, without education, you will hit a glass ceiling. Do it, finish it. It might seem today as a waste of time but that title after finishing the degree will go a long way later in your life.
There’s enough manufacturing capacity in the US to produce plenty of ventilators, masks, and and test kits.

But nobody took the warnings serious in January and connected enough dots to think of ramping up production. Even now, nobody seems to be in charge. There are manufacturers on Twitter claiming they’re ready to produce masks but are being asked to apply for certification by mail.
Is the Fedora Linux Multi-Seat Feature Abandoned?
I've successfully run a multi-seat Linux machine for some time. It was easy to set up (with the "loginctl" command) and I thought great, now I have a use case for systemd and its ilk, this is easy!

Only now I wanted to upgrade to the latest software, so downloaded Fedora 31 and tried it out on a testbed machine. And Multiseat no longer works. This doesn't look like an edge case, it looks like an abandoned feature somehow. It still works in Fedora 30. The diffs between the two versions of GDM (source code) are extensive so not just anyone could fix that without considerable expertise. I've not found a usable replacement (for multi-seat login).

Markus
Belgium here. My wife is creating a mask right now, based on free internet instructions. She is not alone in our neighbourhood, and I see masked people at our bakery. I'd say we're not there yet, but learning very fast.
WirVsVirus (Us vs. the Virus) Hackathon
Hey it could be worse, imagine having a link to your own KF thread in a frontpage HN article. Now that's a bad look ^-^;

Referring to GP, of course. I appreciate the link to my reply. For any folks here that read the post, please also read my reply if you don't mind. For folks who don't read the thread at all, just note that this is about me saying dumb things online, mostly when I was a young adult. I haven't actually done anything heinous nor are there substantiated allegations to that effect.

Specifically, my reason for stepping down is because in spite of doing my best to change and better myself, my mere presence was still dragging down the other developers working on my emulators, and my friends were starting to get dragged into things because of their association with me. They went rather easy on me on KF, but there's another 289 pages of this on 4chan. It got to a point where someone there was compiling a list of my friends' real names, photographs, and where they lived. A friend of mine suffered an anxiety attack when I replied to them on social media. Another was fearful enough to delete her Twitter account.

I can handle criticism and admit my mistakes, but I can't handle other people paying the price for them. I feel personally responsible for that, because I am. If I had behaved more professionally, this wouldn't have happened. So it's on me.
Workshop – meetings/screen sharing for small group, remote workers
> Panicking is, in many ways, the best-case scenario for code that contains a bug.

The very opposite: it's among the worst behaviors, short of creating a vulnerability.

From any modern languages we should expect an exception to be raised.
I've been promoting this idea as well.
https://www.facebook.com/edelsmurf/posts/10157054028823201

I've sent pleas to several local and national government agencies and health directors, but it's unlikely that such e-mails will be read, so information needs to be disseminated another way. The fact that the western world hasn't called for widespread use of even cloth masks is unconscionable. Presume you're already infected to protect others.
I have what I think is a probably pretty common enterprise use case.

Windows Server with file share behind a sonicwall firwall.
Large (now very large) number of remote users need to access file share.

Currently users connect using a VPN that terminates at the firewall, with access rules allowing access to file share.

Is this use case supported with tailscale? Ie, run something on server, allow users to run something, they can then connect to file share?

Anything to do on firewall to make this all go faster / easier?

As others have mentioned - we cannot let third party add nodes to our network without approval. Adding a PSK or something to let us lock network down a bit more would be good I think.

Edit: Installing at home (google wifi for router) and work machine (behind sonicwall) - can't get RDP/Remote Desktop to connect but client install / login is great and would be much easier than current approach if it worked.
Definitely stick out the degree. I was once in a similar situation.

By the time I started college I had already been programming for 6 years. I was self-taught and worked full-time (60+ hrs) as a programmer while pursuing my degree (accounting information systems because I wanted to understand the underbelly of business and I was arrogant enough to think CS wouldn't teach me anything).

While everywhere I've worked, I've been promoted and identified as a high performer, I still lack many CS aspects I wish I had gotten with a CS degree. I've even thought heavily about going back for a MS in CS, but the opportunity cost is very high for me at this point.

Based on my experiences (both good and bad) the one thing I would have changed would be to go back, set my ego aside and try to learn everything I could in the CS degree. Knowing it's not about the coding, but rather the deep and wide CS concepts I was to learn.
CatBoost: Gradient Boosted Decision Trees
Not even remotely playing in the same league as chicken
Contents – Coronavirus Tech Handbook
In my case, an appointment with my GP was billed at $200. My insurance negotiated a discount of... $10. Based on this, my expectation is that this will only get worse with more expensive bills.

I suppose it varies by plan and provider? Regardless, dealing with medical bills is indeed a nightmare in the US. I am not looking forward to doing this all with children in the mix.
Same, I was hoping for some mention of /proc/PID/fd*, but nothin'.
Hyperopt: Distributed Asynchronous Hyper-Parameter Optimization
I seriously doubt that this happens "extremely often" in Greece. First, for small fish like fresh anchovies and sardines (extremely popular and widely sold) this problem is nonexistent.

Most/all tavernas and inexpensive restaurants in Greece that have bigger fresh fish on the menu encourage you to go into the kitchen and either pick the fish yourself or watch it being picked/prepared for you. Additionally, when grilled or fried the entire fish is served on the plate.

Finally, the really expensive gourmet fish restaurants have a reputation to uphold and wouldn't risk it to target "clueless tourists".
It seems to me that impact on life expectancy should be considered. For somebody who's very old, a very high mortality rate may represent a fairly small impact on life expectancy.

Numbers from: https://www.ssa.gov/oact/STATS/table4c6.html

In the general case: a 70 year old man is expected to live another 14 years, while a 90 year old man is expected to live only another 4 years. So something that kills half of 70 year olds is depriving the 70 year old of much more life than the 90 year old.
Maybe this shows the relative importance of different measures?

Not saying that we elsewhere should go out to bars, since we're thoroughly lacking in the other parts.

Edit: downthread people suggest a lack of testing, probably a better explanation.
To be clear, the symptom I'm getting is that the second seat does not get a login prompt, and attempting to log in on the first seat in fact logs in the second, leaving the first screen without activity. Others have described the same symptoms.
Was this peer-reviewed? How does it compare with normal radio head units?

Anecdotally, I find CarPlay to not be distracting at all, mainly because I don’t fiddle with it while driving. I set up things ahead of time or I have a front seat passenger to help.
HYDROXYCHLOROQUINE & AZITHROMYCIN, taken together, have a real chance to be one of the biggest game changers in the history of medicine. The FDA has moved mountains - Thank You! Hopefully they will BOTH (H works better with A, International Journal of Antimicrobial Agents) be put in use IMMEDIATELY. PEOPLE ARE DYING, MOVE FAST, and GOD BLESS EVERYONE!

Wrote president Trump a few hours ago on twitter.

I really hope this is right as the two drugs are cheap, generic and have been around for some time.
Why "Locked-down" in the title? It's pointless.
Note that these are results for aerosolized bacteria that tend to hang in the air. The new coronavirus is only spread via droplet transmission, which would make even rudimentary masks way more effective.

TL;DR of the results though: homemade mask filtered ~50-70% and surgical mask ~90-95%. Homemade mask reduced transmission into the air by ~75-80%, surgical mask by ~85%.
I grew up in a communist dictatorship, where illegal wiretapping by the government is still an open wound in society's culture. Given that, I cannot understand who willingly buys this crap and puts it in their house.

A couple of days ago, I lost all respect for a coworker when we were in a meeting and somebody said something which woke up the Echo he had on his desk.
> 1. Closing stderr in Python is not a good idea because that’ll swallow any other errors that occur at exit. Redirecting stdout to devnull is really just a way to prevent the flushed output from going to the now-closed stdout and triggering another SIGPIPE. That’s more preferable than closing stderr and losing error output at exit.

I don't follow. The standard for EPIPE/SIGPIPE handling is to silently exit with an error status. It's fine to close stderr to prevent spurious warning messages about flushing stdout.

> 2. Ignoring SIGPIPE is a terrible idea for a process that should do stream processing. Try making a yes clone and ignoring SIGPIPE - your process will likely run forever trying to shove “y” into a closed pipe. There’s a reason SIGPIPE was invented! Very few programs bother to check the return value from write/printf/etc.

Programs can correctly handle lost pipes masking SIGPIPE entirely, with error checking alone. Python's BrokenPipeError is raised on the basis of EPIPE, not SIGPIPE.

Re: programs not checking error returns of write() and close(): that is not really true in a language like Python with exceptions raised on IO errors. It always does the check, and the unwinder aborts the program if nothing handles the error. Sigpipe is completely unnecessary for Python programs. (It's also not necessary for C programs, but I guess AT&T didn't want to fix their programs to check for errors.)
Have you seen the trains? No amount of mask would stop some spread there.
Is this an open-source project by chance?
This article says one study estimates 5 fold reduction: https://www.google.com/amp/s/amp.theguardian.com/world/2020/...

If that reduces the R infection ratio 5-fold, it would drop below 1 and change exponential growth into exponential decay.
head is just an example, if you pipe rm -vfr (or any program that does more than just output) into _anything_ the reasonable and default behavior should be to run rm to completion. (And from a programmer's POV, the reasonably thing is for syscalls to handle errors by returning an error, the way every other error is handled.)
Why shouldn't they? There are probably no cases in the community.
Did you read my entire comment? Feel like I addressed this here:

> We already have small pilot studies showing this stuff that have the same problems. Repeated science is often underrated, but these results are uncontroversial, they are just over interpreted and old.

In general I am strongly in favor of reproducing science, this study doesn't really test anything helpful for either outcome though.
Not true. Go deeper. There was ~10% false negatives in South Korea too. But it is still much better than nothing. But of course no on here will say anything about it since everything America does is likely bad and foreign countries are always a step ahead.
To be fair, I have a much better fursona now ^-^;;

https://twitter.com/Kampidh/status/1234029776144175110

(it's G-rated, don't worry.)
I have several times in my life thrown my phone out of reach with no regard for who's on the call

They understood, later. They weren't necessarily happy but when you explain to people "do you want me alive or do you want me to talk to you", their self-interest seems to kick in, at least.
Unfortunatelly, this (mandatory masks) seems like one of the Czech Republic rules that has not yet been widely copied elsewhere.

BTW, its quite an interesting cognitive change - basically in a span of about two days everyone in public has a mask, even anchors and politicians in news coverage! Even the sign language interpetters!

Also I found out I feel rather uneasy now watching footage from affected areas, some of them in worse situation than us, with people not wearing any masks.

Such a simple way to protect otjers once you thing about it a bit, yet not universally adopted so far...
You're literally saying your shit doesn't stink. No wonder everyone hates vegans.
I have heard the same from a Japanese friend, not in a major city either. Seems even families are going about normally with their children, to McDonald's and such.
ONNX: The open standard for machine learning interoperability
The OP was praising high taxes. If he paid lower tax, he would have more money to spend, also on helping others. Do you think it's ethical to force people into charity?
Processing 10TB of Wikipedia Page Views – Part 2 Data Visualization
Rockchain.
Don't get to excited on the other hand they fire workers who are ill and can't work.

E.g. you have people still trying to come into work to get paid and spreading the sickness.
I have never gotten my Tesla to understand a voice command like this. I could get music and phone calls, and that was it. The second-to-last update that supposedly made it better instead broke voice commands almost completely. Supposedly the update from a couple days ago is better.

In contrast, IIRC a 2007 Prius could do this type of voice command with no obvious difficulty.
If the intended goal of wearing a mask is to protect others (since you have no way of knowing that you're not infected), then there's no practical reason that a mask can't be reused, whether sanitized or not.
> This is squarely in conspiracy theory realm. Nothing in the Snowden documents or other leaks hinted at this (except for the NSA snooping on unencrypted internal links, which is useless now that everyone encrypts everything).

This is absurd. Plenty of leaks clearly indicated that they succeded at breaking different types of SSL.
The cloud can push changes to the wake word (because changing it by the app is possible), it can add new ones, and the real question is rather or not amazon servers can instruct it to not turn the lights on for certain wake words.

You can see this in their home defense feature on the echos, where the echo can have the sounds of broken glass and wood breaking added as wake words so it can notify you and/or police in the event of an intruder.
You're arguing different things here. They're saying that we have to question allegations, you're saying that we have to take them seriously. The way we should take them seriously is to investigate them, which means questioning both sides of the story.

We will probably never make a perfect system, but we can't leave large vulnerabilities that are easily gamed or they will be. We should investigate all of these accusations and shut down operations like NXIVM. We need to seriously look at allegations by Juanita Broderick and co. But we can't believe either side until we actually investigate the evidence.

If anything, we need to do what we can to make it safer for victims to come out earlier while there's still enough evidence to investigate and to take the allegations seriously enough so that they don't remain obscured for decades, or there will be nothing left to investigate when the allegation is finally made public.