skysight-inc/HackerNews huggingface dataset:
I can still attack your local non-http-servers with a regular <form> post, e.g. something like http://bugs.proftpd.org/show_bug.cgi?id=4143

With Websockets something like this is effectively not possible, because WebSockets were designed with this in mind

- A browser will only start transmitting data over the ws once the handshake is done. So just making a request has very limited ways for an attacker to transmit user defined data (basically the Host header/Origin header and cookies... which will not really work as an attack vector for newline-delimited or binary protocols)

- The handshake itself works by the client sending a nonce to the server which the server then has to hash together with a special uuid. Only actual websocket servers know how to do this step correctly, and thus the browser will refuse to even open connections to servers which aren't actual websocket servers. So the attacker will not be able to send truly arbitrary data or read any responses.

- Even after the handshake, browser-to-server data is masked by XORing the data with browser-picked keys. The attacker therefore cannot control what the data will end up looking like when it is sent to the server. And unaware servers will certainly not try to reverse the XORing.

What you're left with regarding websockets are timing attacks to do some port and network scanning, and attacking actual websocket servers, which do not check the Origin or use some kind of token to verify incoming connections, analog to attack-able regular http endpoints that do not do auth and csrf tokens properly.

I'll readily admit tho, that a lot of developers forget about verifying incoming websocket connections. I have fucked this up myself in the past, and I have found such issues in other websites, including one problem that let me take over user accounts via an unsecured websocket if I was able to get such users to open an attack website (or ad).
Amongst the various human rights, the right to build a house should be fundamental, but somehow it was lost to political forces.
They did, as detailed in this blog post: https://www.factorio.com/blog/post/fff-303

They still had to eat the $20 fee per fraudulent transaction and deal with the pissed off customers though.
https://giphy.com/gifs/brick-mansions-c2X9dXyMh6Pug
or as another poster suggested, people might be driving more accident prone routes right now. my commute to work is a 20 mile point-to-point drive down an interstate. aside from merging, there's not much that can go wrong. a trip to the nearest grocery store is a one mile drive through a dense area of the city with many pedestrians and awkward intersections. the per mile risk of the grocery run is much higher.
I was banned from r/hotsauce because I posted a coupon-code for a brand I was interested in trying. They were trying to sell stock to help mitigate the downfall of the COVID-19. The mod said I was an advertising shill and needed to be purged... As if people posting their collections all day didn't count as advertising.
How often do violent uprisings turn out well? A thorough reading of history shows that they aren’t very effective, either.
School quality in the US is very location dependent, as public schools are largely funded by property taxes. I also went to a public east coast high school, and calculator use was mixed. Some exams allowed calculators, others not. Often the exam was designed such that it was testing your knowledge of a concept more than the numerically correct answer, showing work was required. So a calculator was useful for checking answers but correct answers with no work would get you a 20% at best.
It's ongoing, and the US has had cases brought against it as recently as 2014: https://en.wikipedia.org/wiki/Compulsory_sterilization#U.S._.... While the more recent cases are less overtly abject evil, they aren't the activities of what I'd call a free or even humane nation that has any right whatsoever to claim that the spread of its governance is an ethical good.
Seeing that reminded me of a quote I saw in a Reuters Article [1]: “A lot of people that have two-year-old trucks can get into a new one for the same (monthly) payment or lower,” said Noah Wolter, general manager of Charles Gabus Ford in Des Moines, who sold around 1,500 new vehicles last year. “That’s the easiest swap ever.”

I see that and think that a lot of money was just lost if you trade in a two year old car for a new one. Is this a common thing?

[1] https://www.reuters.com/article/us-health-coronavirus-autos-...
Funnily enough at $DAYJOB we use data from some mainframe systems.

Recently the team learnt that no, those mainframes are not on-premises, they are in IBM cloud.
I read it the opposite way- am also a layperson but have memory of reading similar distilled versions of the research into HIV.

With COVID updates like this come every week; in the 1990s with HIV it was more like every few months there was some new report/observation. But those- like these were framed with the similar- holy shit, this virus does stuff we have never seen before.

I would caution to not infer that anything like a viable solution at scale on either the preventative side or the treatment side is anywhere near deployment.
Slowly start ramping taxes of products out of China. Same strategy to use when converting the world to EV. Not an overnight change.
You needed a pretty hefty machine at the time for the splashscreen to flash by.

For example, Word 6 on my 386DX with 4 MB RAM took some time to launch and I had ample time to admire the art that went into the splashscreen. On 486DX with 16 MB RAM, it did flash by.
How does this work? Is it possible to move and get on a different waitlist? It's hard for me to see why they would setup region-by-region waitlists. Fingers crossed for you.
The song gives me the idea to be able to start anew and see remnants of your previous empire(s). A generational thing.
Low-income families often pack many people into a small apartment, so it's not unrealistic for one apartment to need 3 parking spots for two working parents and a working child, just as an example.

I lived in a household like that growing up
Good riddance, IMO
We are building something similar to the clubhouse, but focus more on a broader and more diverse communities. We call it Voicehub. https://voicehub.app/
You can basically create small sub-communities within Voicehub and host Live Group conversations there. We also have the option to share recorded audio clips.
I agree an objective viewpoint is possible to find, but any conversation about "America being over" needs to start with confirmation that the speakers have agreed upon an objective viewpoint.

Decontextualized, the fundamental rights Americans celebrate are at odds with each other (right to life and right to liberty are the obvious examples, and some good criteria for discerning how to maintain those in coexistence has been established, but others, like "Freedom from fear" or "Freedom from want" and "Right to liberty," are much, much murkier. And this is all, of course, in the context of an ever-changing world that brings new technologies and experiences that must be interpreted against those rights).
Facebook has been managing distributed teams for a long time. Nothing new for them.
What benefits do downvotes provide over just an upvote sorting the best content to the top and ability to report a link or comment for some greater infraction than difference of understanding?
I don't believe that's what's happening here. The accept attribute just filters what files show up in the file picker. And iOS devices will take an extra step, and on the operating system side convert HEIC files to JPEG.
Oh, they absolutely would! Every music streaming service is already beholden to a tiny record industry cartel, even though there are a number of music streaming services.

But it’s simple, video is more versatile, and by removing youtube’s monolithic dominance, you remove the single point of failure that copyright cartels have been able to attack.

As an example, imagine a separate youtube-clone dedicated to education that was actually willing to fight for fair use! Or a youtube that didn’t automatically demonetized you for swearing.

Internet already gives these kids (and the rest of us) both access and audience, we have just been stupid enough to lock large parts of our cultural heritage into corporate silos, protected by “intellectual property”-laws. Competition wouldn’t solve this completely, but it would make it harder to distort the market.
Arte Y Técnica Del Teatro. Espacio Vacío, Peter Brook Federico Herrero
There's a difference between a charity and a regular for-profit corporation.

If the charity started stalking me to sell my data onto advertisers in order to pay the salaried staff or other stakeholders more money, I'd stop doing any work through them.

The charity's mission is not maximising revenue / profits.

Any VC/PE backed corporation's mission is to maximise revenue / profits at any cost.
I've got a connection/channel question for those who have built solutions with rabbitmq-- how did you decide as to how many connections and channels-per-connection to use? Does connection pooling even make sense for RabbitMQ? My impression is that channel pooling may make more sense. Thoughts?
> After a few months, I came to terms with the label of 'criddler' and realized how it would come up in my mind as a form of negative judgement on a person that was not healthy for me. I realized their decision [to ban everyone's use] was a good one

Note how your conclusion doesn't actually follow: just because something isn't healthy for you, doesn't make it unhealthy for everyone else.

Trying to police too much is likely why moderators get such a backlash when they employ heavy-handed tactics like outright bans.

Moderators also very likely operate in a like-minded bubble: the sort of people who would volunteer to be moderators are far more likely to have more in common with each other, than with the average community member. As such, mods will likely always get backlash.

For instance, I'd bet it's far more likely that your fellow mods debate to what extent language should be policed, and there are probably almost no mods questioning whether language should be policed at all.

Some kind of moderation system with strictly limited mod terms and random promotions to mod status would likely improve relations, but achieving the right balance would be challenging.
>People coming to the meetup spend money on the pub's beer and pizza. Am i doing free work for a for-profit public house?

Yes. Unequivocally, yes. If I were the owner of X thing and Y person was sending lots of people my way I would be more than happy to give Y person something in return. In your example I would offer free pizza and beer at the absolute minimum. You are selling yourself short.
There are a lot of libraries that do most that this service does. Usually if you're processing pdfs, the pdfs might be sensitive or you have a lot of them, so its better to not share them with other companies / people and to use the library to parse it yourself in-line (or hosted as a lambda service).

The pricing would have to be really low or I would need to be unable to find a good library for me to want to use an external tool for this.
"Facebook will reduce the pay of workers who move to less expensive areas."

That is ridiculous. A job is a job. Also what prevents anyone from keeping a California phone number and a PO Box in Menlo Park or wherever? At what point have you 'moved'?

Note: I don't advocate doing this. I neither work in CA nor at Facebook. I just wonder if this doesn't open things up for being to game the system.
You can win with few cities. I’ve won with one city on emperor difficulty, and regularly win on immortal with less than 6 cities. It’s harder, but doable. You can also do smaller maps, or island maps where space is too limited to have tons of cities.
I don't follow. How does the "Accept" header factor in here?
Nearly half of Twitter accounts pushing to reopen America may be bots
People Ready (aka Labor Ready). Be there early before they open, and if you're lucky (because I'm sure they're swamped these days) you'll get a full day's work. You get paid that evening.
You can do Virtual Visits at Papa.

https://www.joinpapa.com/papa-pal-qualified-application

Help out senior adults through the aging journey.
I'm sorry. This is clearly my fault and I'm sorry this wasn't communicated.

Please look into Go1.15. It should all be backwards compatible, but where the session resetter is called changes, and a new call is added for verifying if the connection is valid or not. I'll have the release notes updated soon for Go1.15, but until then, look at the driver docs for tip.

I'll make announce the change on the golang-sql mailing group.
Seriously? Nuclear war with China would probably end up devastating the entire planet. That is not the solution. It would just cause even more innocent people to suffer and die.
> We are not property of the State therefore, society has no claim on it. If we are property of the State then...

You're trying to force this into a "We {are|aren't} property of the state". Both sound completely wrong to me, on multiple levels. It's a TypeError. You're applying words in ways that don't match.

(You might as well try to convince me that "Beethoven's 5th is either color, or black-and-white". No, those are both wrong. I'm not going to agree with any conclusions you reach starting from either condition.)

Humans aren't "property" (of themselves, or anything else). And the state doesn't own something today just because it may own it after your death (e.g., when a person without a will dies, their house may go to the state, but that in no way means their house was "property of the state" while they were alive, and definitely not that all houses are property of the state).

> Do you want want [your least favorite politician] writing this policy?

Again, that sounds like a fallacy that's trying to goad people into a false choice. I don't want my least favorite politician writing any government policy. There is no framework yet conceived under which a malicious administrator would not be able to cause great harm by instituting a policy of their own design. That doesn't mean all such policies are inherently ill-conceived.
Is this the start of the end of Silicon Valley (and other major tech hubs?) I know I'm being dramatic, but they can hire smart developers anywhere in the world.
You could say what works for them won't work for a young startup but I'm not so sure honestly
While Redis needs to keep the dataset in memory (which is why I added that it kind of depends on the size of your stuff) it does have quite robust persistence features [0] so it's very unlikely you'll ever lose your data even across reboots or crashes if it's configured correctly.

That being said, it's still not really a database engine on itself and would also require a slight paradigm change on how you think about your data and how you create your schema so ymmv. But I've personally used it across a few non-data-heavy projects as primary datasource and have been quite happy with it. It was also famously used as primary datasource for a well known adult website generating 200M pageviews/day even back in 2012 [1] [2] although I don't know if that is still the case.

[0] https://redis.io/topics/persistence

[1] http://highscalability.com/blog/2012/4/2/youporn-targeting-2...

[2] https://news.ycombinator.com/item?id=3597891
> British culture is completely incompatible with any kind of successful resistance against a hostile government.

Wat?

I mean, do you count the Revolution? https://en.wikipedia.org/wiki/American_Revolution
I mean, the Civ franchise is the golden example of the 4X genre: Explore, Expand, Exploit, Exterminate

That said, if you're going for cultural or science victories, tall is still the way to go.
A violation or complete destruction of the Joint Declaration does not result in HK returning to Britain because the territory has already been handed over. The consequences aren't really defined and would probably just be sanctions by any nations who happen to care enough.
> ok. Why do you consider your arguments against WFH not biased and useful.

Because what I'm saying is objectively true: physical colocation with your coworkers is inherently easier to work with than working remotely and no one in their right mind disputes that. The best you can argue for WFH-first is that it can be made to work.

Your other clue is the choice of language. I said, for example, "I hate WFH" and (paraphrased) "I like having a catered office". These are my personal preferences. You can't really argue that it isn't my personal preference. You can argue that those preferences don't work for you, which is 100% fine and indisputable.

In comparison, so many things I see written about WFH are stated with broad generalizations of "WFH is better because ..." when you can clearly tell that really means "I want to WFH and I'm going to argue my preference as being a general good".

You've had other people in this thread and elsewhere agree that a mixed WFH/in-person team is (to quote another commenter here) "the worst of both worlds". If you take that as true it then means that for people to most effectively WFH they need everyone else they're working with to do it as well. It's intellectually dishonest.

To be clear, if you can make WFH work for you and you like doing it, great. I hope you find an employer who works like that or will allow at least some of the team to work remotely. Prognostications that Covid-19 will lead to some seachange in WFH-first employment strikes me as unsubstantiated wishful thinking however.

Just go and look at all the blog posts and articles written about how to make WFH work. Why aren't there just as many (or more) articles about making WFO (Working From Office) work if the benefits are so self-apparent?

There are certain kinds of work that could be remote and would be just fine to do so but they still generally aren't (eg call center work; apart from obvious offshoring cases, a lot of US domestic call center work is still from an office for some reason). But I don't put software engineering at scale in that category.
While it sounds like the College Board may be at fault for some of the issues, like the test timing out when HEIC images were sent or the initial communication of the issue, I wouldn't be so quick to place all of the blame on them. Part of the problem is how we more-or-less glorify an ignorance of technology. This can be seen in both students trying to change the file type by changing the file extension and JPEG being referred to as a "most compatible" rather than by name in the settings.

EDIT: the comment about "most compatible" was based upon information from the article, rather than access to an iPhone. I have since looked it up, and JPEG is mentioned underneat the option.

I am saying this because people need to have a degree of understanding of technology in order to have some control over it, even though I recognize that some people will construe such statements as being elitist. That depth of knowledge does not even have to be particularly deep. In this case, understanding that photos may be represented in different ways by the computer and that you have to ensure that the recipient can accept that representation is important. After all, this is not the only case where they will run into this issue. It is a big part of the reason why businesses settle upon some form of standard for the exchange of data, may that be through common business practices or a standardization body.
Show HN: Facebook Ads Targeting 101
Hey Guys,

How is WFH doing to everyone?

I have been working on Facebook ads for six years now & the last two years have been running my own performance marketing agency. I have started investing some time everyday in creating these courses & have launched the first one. Do check it out.

Investing in Facebook ads can be tricky & it can wipe out the ad budgets if not done right. If Facebook ads are the cake, targeting is the cream of that cake. This ppt+video webinar will teach how to use the right targeting, creating audiences, case studies & best practices.

Link: https://gumroad.com/l/aZmeh

Have a discount code for the first 50 buyers. Code: welcome20

Would love to hear feedback :)
Cheers!
I love my home in SF and have been deeply enjoying the COVID-induced work from home life. Many people don't invest in making their home comfortable and enjoyable to be in and it shows when it comes to these types of conversations.
OR decent mass transit. But forget that in California.
https://slate.com/business/2012/07/xerox-parc-and-bell-labs-...

I’m surprised you are the only one mentioning this. You change the rules of the game, you change the game.
What if I live in San Fran, but just live in my car? That should save a lot of money.
It doesn’t make one money directly, but when a block is mined, bitcoin are created and can be sold for money. I’m not saying it’s a good idea; it’s not. But wouldn’t putting that computing power to factoring RSA keys be a better use of electricity? It could be run in a distributed fashion where, if a node says it found it, it’s checked?
It only took me a few square clicks before I could understand the interface which is pretty quick with no instructions presented.
Missing HEIC support (and Apple support in general) is not an issue of quality; it's an issue of "knowing your customers". I doubt there could be any certification body for that.
I'm mostly in the zigbee space, rather than bluetooth. Aquara / Xiaomi have a load of cheap sensors available on aliexpress. Get yourself your own zigbee dongle (suggestions at https://www.zigbee2mqtt.io, no affiliation, also available from aliexpress) and you have no vendor lock-in either.
The average user has no idea what those buttons do and will click whatever makes the popup go away, which will be either 'yes' or 'no' at random
Sxmo: Simple X Mobile – A Pinephone UI that is simple and suckless
If you're a North American native English speaker with a college degree you can pretty easily get certified to teach English online to Chinese children with VipKid
I completely agree - this certainly isn't a configuration I would think works well for management. Meeting in person certainly are highly valued for even the most junior managers.

But for a lot of white collar professionals at an associate to mid senior level, there's plenty of work that you should be able to do independently.
That's what I mean with "faster". I cannot keep up when chasing them. They often move one hex further than I can on the same path (and I think it's usually across rivers, but I don't remember it particularly clearly).
The College Board's Monopoly on Education
Related from yesterday: https://news.ycombinator.com/item?id=23251909 ("Organ donation in England has moved to an opt-out system").
There isn't really a win condition in Stellaris though, just survive the end-game crisis.

The most recent update to Stellaris (with admin offices) makes going wide the strongest strategy to do this by far. Still fun though.
I have some experience with NYC transit, which is what my post was based on. Crowded, sketchy, stressful (more so than congestic traffic to me), and all the points I said before. Specifically coming from upstate to the Museum of Natural History. Train ride was nice at least but it did involve running across the PA on the way back.

I've driven/been driven in NYC a few times (pre-pandemic) and it wasn't /that/ bad, but I don't think it was ever in Manhattan. Most recently was going to JFK and back from somewhere more upstate.

I looked into transit options and they were seemingly expensive (might have been a wash with crazy bridge tolls down there), had a bunch of connections, and long walking periods or uber connections adding more expense. Definitely didn't sound fun to bring luggage along.

NYC is supposed to be the country's shining example of transit, isn't it? I can't say it enamoured me. If I lived there I'd probably end up biking a lot.