skysight-inc/HackerNews huggingface dataset:
Yes, likely. In 2015 and 2016 alone they paid $8.346 billion in buybacks and they seem to pay roughly a $0.40 dividend every year. Either way it would have allowed them to borrow less money at much better terms. Instead they are totally insolvent immediately and people have a more negative view of bailing them out because they appear irresponsible.
I got a call from my bank earlier today, trying to get me to finish my mortgage application. I think it was them, but I refused to authenticate, because I didn't schedule the call.
The difference is giving money directly to the worker vs giving it to an extraction business who might give some of it to the worker. Which seems more appropriate?
This page is hidden deep on the Apple website... purposely.
Is cost the only variable to optimize for? The commodity is the same in both places (barring some reports of counterfeits in Amazon's stock), but is the labor?

I'd argue that buying from Amazon has some externalities that aren't captured in the price (particularly in their treatment of labor). I pay more for some times of food that avoids things I consider negative externalities, I'd do the same for books and other commodities. That's just an opinion, though, feel free to disagree.
I steadfastly have the stance I will never talk to anyone over the phone unless I initiated the call, and this is a great reminder to stick to that, no matter what they say.
It's possible it comes from a corporate culture that is focused on ease-of-use over security. This is not the first time that they've done some questionable things to reduce friction. See for example https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-pa..., where they installed a secret webserver to save Mac users a single click.
If they have any government contracts they may be required to.
90% of our engineers use your software, but you can’t invert a binary tree
Thanks. I've spent 3.5 years on research for the Lyme documentary UNDER OUR SKIN, and 5.5 years of research for the book. I believe that some of the 20% of treated patients who go on to have chronic symptoms have undetected co-infections. The book explains the reasoning behind this. I'm giving a 20 minute online presentation on this Sat. at 11EST: https://zoom.us/webinar/register/6715850012795/WN_KUIbToN3S_...
Tick Talk
Nice, keep it going.
I expect in this case it's a matter of having magnets in the correct locations as specified by MFI.
Even in complex apps, most of the DOM remains the same and you are changing several properties (some text, changing some classes).
Do you watch breaking bad's prequel better call Saul?
I think bounty programs are mostly a bad idea for startups and medium-sized tech companies. That said, the critiques in this piece do not make a lot of sense to me.

Take transparency. The claim this article makes is that commercial bounty programs work against transparency by paying researchers only when they agree to NDAs. But transparency isn't a norm in software security to begin with; most vulnerability researchers work for labs and consultancies that rarely if ever disclose vulnerabilities. Disclosure of findings is not a norm on commercial software security assessments. Meanwhile, for any target an independent researcher can lawfully assess, the researcher retains the ability to ignore the bounty program and publish straight to Twitter.

My sense of it is that HackerOne has probably increased transparency, in the sense that I've read a lot of published reports on H1 that I don't expect I would have seen if the platform didn't exist, and, in my commercial work, haven't seen a lot of private reports that cut the other way.

Or this "Safe Harbor" argument, that commercial bounties force researchers to sign NDAs to be immunized from CFAA suits and prosecutions. Sure, but in the absence of H1, most of those CFAA immunizations weren't available on any terms. H1 doesn't enforce CFAA liability; CFAA liability is a natural default under US law. If anything, H1 is mitigating CFAA concerns, not amplifying them.

I don't know what to say about the labor law concerns here. I know that the people offering legal opinions here are lawyers and are versed in California labor law. But knowing what I know about how bug bounty people work: there is no way the median bug bounty "participant" would qualify for minimum wage and benefits at the various companies they interact with. The modal bounty participant has a grab bag of a couple dozen scripts they spam against hundreds of different companies with bounties. Is the claim here that H1 owes them a wage? Is the argument here simply that H1 needs to move out of California?

The minimum wage thing doesn't ring true either, since it implies that all project-based consulting --- that is, non-T&M consulting where clients pay an agreed-upon rate for an outcome regardless of the time a project takes to complete --- is susceptible to the "ABC" test as well. But project contracts are very common in California. I'm sure there's a subtlety I'm missing.

The "ISO compliance" thing is just silly. By the logic in this article, practically none of the thousands of commercial application pentests performed in 2020 to date will be "ISO compliant".

Ultimately: I think if you have to ask, you shouldn't run a bounty program. But that's mostly because I think bounty programs don't work very well, and generate an avalanche of noise. I don't think many of the reasons in this article matter.
I think I may have heard it from one of his talks.

https://www.fsf.org/blogs/community/201cthe-printer-story201...
I have fuming anger over the whole world deciding Google will set the standard for browsers. I wonder if EFF and similar orgs are doing anything legally, perhaps EU can armtwist again?
What a great story - a surefire cure for Dunning-Kruger. I'm in awe of this guy.
Pointer Events, nearly one full decade after Microsoft implented them in IE10! Way to skate to the puck AAPL!
I always would buy up 75% of their stock. Never thought to take it as far as you did, though—I just cashed in on the inevitable rise in value over time (unless they built an impossible or unprofitable route to start, in which case I quickly cut my [relatively small] losses and sold).
The tooling is still JVM based and feels very heavy compared to Nim. (And the Kotlin/Native compiler is still very slow, although they're working on it.)
DIY mask meta-guide: the best online resources for making masks
Definitely an okay sentiment in my opinion. First world countries haven’t had to face reality in a while apparently...
They’re pulling a bait and switch.

There are video technologies they can license so that they can keep things running without forcing students into having to enter into abusive third party agreements. They can hire people to set up simple first-party HLS streaming systems—it can be done in a day. There are tons of non-abusive alternatives. Zoom makes malware. Can you imagine being given the option by a university to whom you have already paid tens of thousands of dollars: “install this malware or you don’t get to come to class”?

You could say the same about Amazon and their backlash against workers. “There’s a pandemic, and this company is doing what it can to keep the supplies moving, and your reaction is “sue them”?”

Yes, that is the appropriate reaction if they break the law.

A pandemic does not justify abusive, coercive behavior. If anything, it makes it more abusive.
I do this in my sleep. But then, so does everyone else.
Fascinating, thanks for sharing. Makes me reflect on the (relatively few) comments I've made here, and if I'm making a positive impact on the community.
You greatly overestimate both the image quality of crappy videoconferencing streamed video, the amount of pixel-wise sensor noise after noise reduction (pretty low actually), while underestimating the ingenuity of crypt-analysts and the power of having a lot of data. Like seriously, the only way the shitty 1mm or less sensors on webcams are able to deliver HD video is through an abject amount of noise reudction, sharpening and filtering. All of which greatly reduce entropy.

Hint: You don't need to know the plaintext exactly. you just need to be able to build a reasonably precise probability distribution.
Used bookshops have been on abebooks.com for years in the USA. This is new booksellers.
We use it for the core of our AGI and our in-memory graph db in full production - very very fast. The web libraries for lisp are very good as well with Fukamachi libraries, such as [1] caveman and [2] woo (fastest web server), [3] dexador, [4] websockets, also [5] parallel processing, [6] rtg-math incredibly fast math library including quaternion support, etc.

[1] https://github.com/fukamachi/caveman
[2] https://github.com/fukamachi/woo
[3] https://github.com/fukamachi/dexador
[4] https://github.com/fukamachi/websocket-driver
[5] https://github.com/lmj/lparallel
[6] https://github.com/cbaggers/rtg-math
You're making some faulty assumptions about what I'm saying, which means I probably wasn't clear - sorry.

What I mean is: making software like this for sale to the highest bidder should not be something a company is able to do legally.

It should be as bizarre as the idea of incorporating a business in the US specifically, and publicly, to rob banks or commit securities fraud.
They observed keys being transmitted to Chinese servers, which makes them to suspect that Zoom is distributing keys via these servers. They have worded this very carefully to avoid claiming something that they cannot confirm (distribution to multiple users).
There was actually a proof by a German mathematician a while back (name escapes me and I'm admittedly too lazy to look it up now) in which his proof was met with criticism for being difficult to understand.

It ended up being correct.

Not saying Mochizuki is correct, but (without getting too philosophical), a proof can still be a proof even if almost no one understands it.
CDC Now Recommends “Use of Cloth Face Coverings” (DIY Masks)
Hello Peter!

Can a person here on visa apply for Tourist Visa and await the deicision while saying in the US (being out of status but staying here due to the pandemic)?

I made a comment before but I believe it was too specific of a case so I apologize. The general question is more my concern.

Thanks so much for doing this!!
Real title is too long, so I tried for something shorter but similarly informative.
The highest paid athlete of all time was a Roman Charioteer
I think this is where NASA went wrong in many respects. They got so risk adverse, they built a bureaucracy of checks and oversight that moves slow. That’s one of thew reasons the industry needs fresh blood like SpaceX
Unemployed Engineer here. I can also sew. Not sure what I should be doing. Should I make non government certified masks?
Right? FINALLY. I hope that people don't need too much convincing after having been checks notes lied to by the public health authorities.
Official Recommendation:

Cover your mouth and nose with a cloth face cover when around others

- You could spread COVID-19 to others even if you do not feel sick.

- Everyone should wear a cloth face cover when they have to go out in public, for example to the grocery store or to pick up other necessities.

- - Cloth face coverings should not be placed on young children under age 2, anyone who has trouble breathing, or is unconscious, incapacitated or otherwise unable to remove the mask without assistance.

- The cloth face cover is meant to protect other people in case you are infected.

- Do NOT use a facemask meant for a healthcare worker.

- Continue to keep about 6 feet between yourself and others. The cloth face cover is not a substitute for social distancing.

https://www.cdc.gov/coronavirus/2019-ncov/prevent-getting-si...
5 & 6 seem incorrect here. Apple could do it regardless of whether they deploy this sort of thing. As for 6, the idea is that the journalist knows they have a doctored device
This is going to be a mass extinction event for small businesses.
> Here’s the tl;dr version: Do not ever, as in never ever, give out a verification code over the phone.

The deeper lesson here is the power of cognitive dissonance. If you get even slightly fooled, your egotistic brain will Stockholm Syndrome you into working for the attacker, to postpone the embarrassment of acknowledging to yourself you got a little bit fooled. The worse it gets the deeper your denial will grow to stop you from cutting off the attack.
That animation was 20 years ago. The author probably has different priorities now?
> But that's mostly because I think bounty programs don't work very well, and generate an avalanche of noise.

I think this perception might be because H1 didn't provide triaging for a while, but I think the situation is much better now. Bugcrowd has been triaging bugs for yonks. That makes it even less attractive for bounty hunters to spam low-quality reports.
Ask HN: Offline Windows 10 parental control to limit screen time?
I would like to control my kids screen time. Windows 10 parental controls require Microsoft account (email) for kids. I don’t want to create one for privacy reasons. Are there any decent alternatives? What everybody else are using in Windows and Mac?
No connection, just a very happy user:
https://darkreader.org
The thing that connects a train to overhead wires is called a pantograph. The connection to a third rail is not a pantograph.
This seems like a macOS bug, not a Zoom bug, right?
I've had the flu in the past that really kicked my posterior. Took about eight weeks to feel fully recovered.
If you’ve got the money honey / I’ve got the time. —Willie Nelson (American Treasure)
Then, we’re “flattening the curve”, infecting old and infirm people for 6 months, until a vaccine is ready.

That’s the plan.

That’s a bad plan.
But Time Machine is just a file system volume, mounted like any other? It has some unusual hard links in it, but it's just a regular file system mount.
Hyperurl.co/pakcovid

Goto last Tab
Still doing everything they can to hold back PWA's, I see.

Their browser monopoly on ios can only last so long. The same strategy backfired horribly for ms in the ie6 days.

(And no, you can't install an alternate browser on ios. It's just a crippled "skinned" shell on top of safari)
Thank you for your work on PRTK. As a forensic practitioner during your time at AD, it was always an invaluable tool in my kit.
I kept expecting to read that the password on the zip file turned out to be “password123” or something like that.
I hated that. When I was buying real estate, it's an endless stream of of warnings to not give away all your money to scammers, interleaved with a stream of messages from the bank, brokerage, and escrow company that look and act exactly the way scammers behave. No security in the phone based transactions. No challenge-response. Constant handoffs to new associates and affiliates.

They don't care about security at all; they just want to be able to say "we warned you" if you get robbed.
No, they're incredibly noisy with triaging. I can't even imagine how bad they are without it.
I'd like to continue as a C# .Net developer because that's my strongest skill. I'm starting to wonder if telling employers that boxes me in.
Dude, you’re in here throwing out Piketty to begin with while confusing basic concepts; I don’t think you’re the one who really gets to chide about funny attempts to inflict worldviews on people :P
> Why does this matter? Because although Hungary is a small country, it is one whose creeping authoritarianism is widely admired. In early February, I wrote about the rapturous reception that Orbán had received at a conference of self-declared nationalist and far-right intellectuals—American, Israeli, and European—in Rome. I fully expect his tactics to be imitated: Anybody who disagrees with my emergency laws is trying to spread illness

The Canadian Civil Liberties association is apparently seeking donations right now as it helps keep an eye on how the government is using its new power. I imagine most other democratic countries have similar organizations
Latacora is paid in part to manage bug bounty programs, so the motivation is not in the direction you suggest it is.
If true what would explain the increasing number of deaths?
It's a very useful way to generate OIDs! Odd microsoft didn't get a nicer one.
Ahh, so that's the scalable magic trick they're playing. Thanks for the insight!
One can exercise motivation outside of work.
2 weeks ago: "don't buy masks because they won't keep you from getting sick and doctors need them to keep from getting sick. Plus you probably wouldn't understand how to use something as complicated as a mask anyway"
Yes. A Lua-style longstring is delimited by [===[ and ]===] where the number of = signs can be arbitrary (including zero); the end must have the same number of = signs as the beginning. Any string can be encoded inside of a longstring without escaping, simply by using long enough delimiters. There are a number of advantages to this notation: it's more readable (usually), it generally results in shorter code files, and longquoted substrings can be directly addressed without translation (though there may be other reasons not to pass that pointer around).
The whole rocket industry is considered relevant to national defense, and thus "essential", so they don't have to stop if they don't want to. And Elon doesn't want to.
Social struggle is quite different than the day-to-day struggle to survive that was the default until recently on the human scale. Not sure that needs a reference.
1st and 2nd Amendments, baby
Lots of people need to be fired once this is over. This has been known for a long time. There is no excuse for it that stacks up except incompetence. You can argue about funding but being honest and factual is free.
Which is probably the dumbest approach to generating OIDs as getting your own subtree is simple (and in many cases you already have your own subtree without even realizing it).
Zoom Has Security Flaws. It’s Still Fine to Use
I really wish they would release as free PDFs the Usborne Book of the Future series. I'd also love to get my hands on PDFs of the Neil Ardley 'World of Tomorrow' series as well!
It's https://opensource.org/licenses/AGPL-3.0
Or summary of what it means bit.ly/2JD0Yj0

If you are talking about info on the site & git, we are working on it. There will be many changes over next few weeks. Stay tuned :)
Personally, concern that if they fail, the innovation they've been forcing everyone in the industry to push forward with stops.
I believe this is for additional XSS protection - if a user clicks a suspicious API link, the worst that happens is the browser downloads a json.json file instead of rendering a potentially malicious payload.
Lonliness is not struggle in the same way we struggled to survive for thousands of years not knowing what next week would bring. Your examples kind of bear out his point.
Being bored for 10 hours a day when you have the capability to do so much really is terrible. Couldn't agree with you more.
University of Pennsylvania to conduct clinical trial of hydroxychloroquine
> Your "summary" curiously omits one of the most important details — That the battery could be replaced and the phone would perform like new.

I considered this omitted because it's obvious given the technical details surrounding the throttling to begin with.
How would you develop a protocol that doesn’t use TCP at all?
Ask HN: How to Use Zoom Securely?
Now that Zoom web-client isn't working, how are people accessing zoom without installing it on their native OS?

OPTIONS:

* Install in a VM e.g. VirtualBox
* Only use on IPad or IPhone (better security model)
* Don't use Zoom : 95% of my social activities are on Zoom right now, so this option is high-cost

... Other options?
It was used that way before it was named waifu2x. It’s just NNEDI3.
Yes, everybody should do that!

/s
> I've heard doing document.getElement... and then modifying the DOM is costly.

So, manipulating the DOM uses more memory than, say, manipulating strings.

But assuming you're going to change something on the DOM anyway, the framework has the exact same API's to manipulate the DOM that you do. And they have their own overhead to figure out what operations they want to run.

Almost by definition, vanilla will always be faster.

That doesn't mean it's always better. If you need the DOM to reflect changing states in complex ways (think Trello or Notion) I'll be the first to admit it's simpler to let someone else's algorithm morph the DOM. And that's okay.
Actually, I have not though about this before, but now I want it.

It totally makes sense, and in the modern world too many people put covers on their cams for this not to be considered a valuable feature.

There used to be such flip switches for Wi-Fi, so it is not too far-fetched.
About fucking time. It's impossible to know how many people the previous advice cost. Or how much trust was lost.
I see opinions like this and then see corporations like Costco that you’d have to try hard to find a reason to hate. Ultimately you’re not going to align the interests of different groups perfectly, but profits and competion align value with consumer value we’ll most of the time. And I think it’s fair taking Apple at its word for now— you can bet a lot of tear down people want to test this.
In part.
Yes, this. There's very little serendipity in browsing amazon. I often discover just the book I never knew I always wanted when browsing a physical bookstore's shelves.
I don't know how you get from "find a way to change things" to reading "the current state is immutable", but I meant exactly the opposite, it's changeable and dynamic and changing.

The brightest minds are working on ad-tech, not as an immutable law of nature, but because that's where the incentives are, and if the parent commenter wants that to change, whining about how the OP isn't more charitable won't solve it, like whining that open source developers don't work on what users want instead of what they want won't change it; If it's all about incentives, we [1] should look towards finding a way to incentivise the more desired outcome.

[1] parent commenter alone, or society generally.
I'd find it hard to believe a company that was positioning itself as experts in security wouldn't be motivated to talk down the output of other security vendors.
Is it just me to whom it seems obvious why they've gone with ECB?

Zoom's design has a single key for everybody and for everything [ in the context of a particular video conference call ] . It's simpler and, to a layman, it sounds secure. [ We arguably contribute to this if we say e.g. "the key" implying it's just one thing when we mean something like a master secret in TLS used to derive lots of actual keys ].

Once you've committed to a single key ECB behaves exactly how you'd want.

You've got some audio, or video, ready to send? Just encrypt it with the key. Receive some encrypted data? Just decrypt it.

What happens if you have some network trouble briefly? Nothing, everybody decrypts whatever does arrive and maybe a few frames are missing.

All of the other modes don't work at all if you try to use them this way. They all expect you to have thought about the problem and track a bunch more state and then maintain that state despite an unreliable network and other issues.

Unless there is somebody in the room who says we can't do ECB because it's fundamentally not a secure choice, ECB is what you're going to get from this design decision.

And I've been in rooms like that as the only voice, or at least as the only person who spoke up. I've been in rooms where I was part of a chorus too, but as organisations get bigger and "security is everyone's problem" becomes a phrase people learn but don't act on, it gets lonelier.

Also, I actually can't even work out what a "correct" key rotation strategy could be for ECB with a variable number of parties all encrypting stuff at once. As a result it seems unlikely that Zoom did figure out such a strategy and then correctly implemented it. Instead it seems safe to assume there is no key rotation, everything sent by every participant for the life of the stream is encrypted with the same key, even though that's a terrible idea.