skysight-inc/HackerNews huggingface dataset:
> $100M in bounties paid by HackerOne to ethical hackers

Not by HackerOne per se but the companies using the platform.

A better title would be “$100M in bounties paid to ethical hackers by companies via HackerOne”.

To be fair, the original message on Twitter reads much better than the title of the article:

> HackerOne is proud to announce that hackers have earned $100 Million in bug bounties by hacking for good on our platform.

I was on both sides of this: leading the security team at a company paying bug bounties via HackerOne and also reporting security problems to other companies as a freelancer. To be honest, the experience was always bad in both cases. I wasted several hours triaging bugs reported by “hackers” that often disregarded the conditions of our bug bounty program. People reporting the most trivial things and we would have to pay them anyway just to move on, otherwise they would end up ranting for days.

On the other side, as a bug bounty hunter, the experience is also awful. One of the biggest problems is the fact that you have no way to know if other person has reported the same issue, so you spend hours if not days documenting a vulnerability and creating proof of concepts (PoC) and it is only after your submission that you get a message saying “closed: duplicate issue”. Add to that all the back-and-forth trying to justify more complex issues that are slightly more difficult to prove without damaging the system you are testing.

I am glad so many companies and people are still onboard with this service, but I wouldn’t blame anyone for closing their account after all the bad experiences I had.
Again, in what way? TCP is making sure data gets where it's going and there were no errors introduced by the transmission. A raw TCP socket doesn't have any metadata about what the data is that's coming over the socket. There's a reason the Application layer exists in the first place.

You can make an argument that HTTP should be replaced with another application later protocol but just raw sockets everywhere is ridiculous.

HTTP has eaten the world of application layer protocols because it is flexible and expressive. It's also relatively easy to implement and there's lots of good FOSS server packages available. Most servers make it really easy to plug in back end applications. Combine that with ubiquitous HTTP clients and it's a super low barrier to entry.

You're not going to replace that ecosystem easily and you definitely won't replace it with raw sockets.
see, brainwashed people like you, they think HK is not chine, you don't even know the history of HK

this is why there are wars everyday, because retards like you are breathing
If you get caught, there's no plausible deniability. No way to pretend you just got confused, or that you were in a hurry and just marked "Yes" and signed without reading.

If you were e.g. applying for state welfare while living out of state, a forged bill with an in-state address would not get you caught, but may be crucial for proving ill intent if you get caught by unrelated means.

A lot of security measures add just that much security. It's easy to break, but breaking it removes plausible deniability.

Most home locks wouldn't stop even a person slightly below average strength, bump it with your shoulder a couple times, and you're in. But you can't then claim you got lost, confused, or thought it was your friend's house, or thought you heard someone say "come in". A surprised homeowner will be less hesitant to use available violence, and no court would believe you meant no harm.
Someone below pointed out that when other random users post these phrases, their comments are not deleted.

Possible alternative explanations:

1) The CCP is autoflagging comments from known anti-ccp users

2) The CCP is autoflagging comments only on chinese language videos

etc...

Given that this doesn't reproduce (i.e. there is a comment with this phrase up for over 9 hours) I'm skeptical of the explanation above that it's an automated system inside of YouTube's backends.

[1] https://www.youtube.com/watch?v=ufrR98sR7XY&lc=UgyRmEKscwt_U...
The solution here is to stay out of the merge lanes unless you need to merge.

And if you do need to merge, do so at the merge point, as per http://trafficwaves.org/seatraf.html
How do we go about getting a bike lane across the Bay Bridge? From Market St to the new section that already has pedestrian access.
Great tutorial. Now instead of the 8x V100 $24/hr p3 instance, you can use a Lambda GPU Cloud 8x V100 instance for $12/hr (https://lambdalabs.com/service/gpu-cloud). It’s crazy how much Amazon still charges for older hardware.

In addition, when you’re first starting off with Deep Learning you should just build a GPU machine under your desk and use that to train. The suggestion in the post to do horizontally scaled distributed training is a great way to horizontally scale your monthly bill too. I’ve seen dozens of people spend $500 on an AWS training experiment only to realize they could have bought a 2nd hand 1080 Ti with that same money and been able to train for the next 2 years.
Plowing it back into the fields means less fertilizer is needed for future crops. How is that waste?
If you earned exactly the UBI before the UBI started, you now have no fiscal requirement or incentive to keep that job. If your employer cut your wage to zero... you might not even have reported to work to hear about it. So that's a benefit.

For most employment, especially lower-paid, I would say there is a hassle factor, and if a job doesn't pay UBI plus hassle compensation, it won't seem like a good deal to keep that job.
...observed patterns a priori?
Here is the entire text of the first amendment:

"Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances."

Note that it says that CONGRESS cannot make a law that abridges freedom of speech. It says nothing about individuals or companies abridging freedom of speech for others.
That's something I didn't know about. I'll save this comment for later and will have a think how we can give a better experience. Thanks for the tip!
So in terms of after-effects and alternatives, should we all start investing in... Singapore real estate?
Sigh, again, I should have looked this up...

% Documents/Dotfiles

[~/Documents/Dotfiles] % ../Blog

This does the trick.
> Hong Kong is lost.

With that attitude it certainly is. Maybe if we had the balls to sanction China for its myriad of human rights violations, or you know do what we have 0 problems doing in the middle east, provide arms and training to resisting movement (but I guess we only have to balls to do that when the country poses no real military threat to us).
> Also in Chinese thinks are a bit more complicated due to how different glyph can be combined and/or used in conjuncture. So I wouldn't be surprised if there is a situation where commenting with a single Chinese glyph is saying as much as a long sentence!

Chinese characters aren't magic. Putting two characters next to each other isn't fundamentally different from putting "Russian" and "propaganda" next to each other. You could write a sentence with just a single-character word, but that's not going to be more expressive than a single word in any other language.
It depends. YouTube's comment section doesn't have a particular editorial purpose, the closest thing it has to a mission is letting people comment on each other's videos for some vague sense of "community."

That's not an objective fact-oriented mission, and a moderation system that allows users to flag and kill comments that make them feel bad is still satisfying the constraints of the design.
It's actually a drone ship (https://en.wikipedia.org/wiki/Autonomous_spaceport_drone_shi...) named "Of Course I Still Love You" after the fictional ship of the same name from Bank's novel "The Player of Games" (https://en.wikipedia.org/wiki/The_Player_of_Games).

- Your friendly neighborhood pedant.
Isn't jet fuel basically kerosene.
I feel that bug bounties are still undervalued, and the market is still inefficient because the prices are unilaterally set by companies.

The only other publicly disclosed signals for market price come from third party companies and state actors.

The other signals are not public and hard to quantify, they come from trying to weaponize and monetize exploits yourself. This results in potentially incurring various forms of liability, or reducing that by selling information to a different broker, who will eventually find someone to weaponize or monetize a piece of the exploit. This part is a much more efficient market, but it is not vertically integrated.

The prime bug bounties seem to be trending upwards in value, with the bottom being crowded and with non-serious companies testing the waters.

Does anyone have any ideas to make the value of bug bounties be more dynamic and elastic, trend upwards towards their true value inline with the growth of the sector?
This is good.

Curious what was the usecase for this solution ?
Most of intelligence that states sponsor is of the military variety. Things such as:

- Where are all the SAM installations?

- How many aircraft and tanks does such and such country have?
The Boogaloo Movement Is Not What You Think
I don't know what is it about every of my post that fits troll personality. Maybe because my first language is not English?

As for the rest of your post, fair point.
Clearly, we should trade out corporate censorship for government censorship.

Wait.
I have to disagree with his final suggestion, lazy loading images for a faster load. In my opinion, unless your page is extremely image heavy, lazy loading images causes more problems than it solves. It's a janky and annoying user experience every time I scroll a Medium post and have to wait a few seconds waiting for a big blurry square to pop into an image. I would much rather that stuff was loading eagerly and ready for me when I scroll.

Not to mention, knowing about their ecosystem, I shudder to think of the size of some of these JS libraries performing the lazy loading.
Yep, I'm not even that impactful.
Elon Musk is the greatest entrepreneur and coolest billionaire in our lifetime, change my mind!
> while also introducing a sci-fi vibe. This is a reasonable position.

I think that's my main grumpy objection. May be I am just old.

I also found your dismissal as "conspiracy" a low blow. How can I engage in a productive discussion when the other party dismisses your entire proposition as a conspiracy theory - you don't seem to see any issues with that?
Not if you, I dunno, actually resume taxing rich people and giant corporations?

Create money, put it into the economy at the bottom. Take it back out when it bubbles up to the top, and destroy it. Kind of like how your body creates red blood cells that bounce around transporting oxygen for about three months before breaking them down again.
I have a feeling I found a gem
Philips Lighting is interesting, since they're a spin-off of a merger of a sell-off of Westinghouse Electric.

Both GE & Westinghouse were huge conglomerates (Westinghouse began its sell-off decades earlier than GE), so is this the market deciding that these companies were too big to be successful?
The solution is to simply wash your produce.

I'm not sure how the examination can be done at a later time than picking. Either you want to pick it or you don't. And different people have different standards.

The picker should just always choose the best available. Running low on selection is what naturally forces suboptimal picks.
The problem with a recommendation engine is that it breaks down when content options are limited. In Netflix's early days of streaming, they had a similar approach to content as they did with DVDs, i.e. capitalizing on the long tail and offering an enormous selection. That proved to be inefficient for streaming because there's a minimum bar at which rightsholders will sell licences, and it's far higher than just the price of a few DVDs. Thus, Netflix switched to a more limited acquisition model, and then began a more aggressive program of content creation to effectively gate its offer from competing services. The upside of this for consumers has been a shift by many talented creators into series-style content; the downside is that the market for independently-produced films has bottomed out considerably.
That context doesn't change my comment. Affiliation with the CCP, past or present, is an ideological affiliation. 'Syrian' is not. Comparable to 'Syrian bandit' would be 'Chinese bandit'. If you want a Syrian analogue to 'communist bandit', you might try 'ba'athist bandit'.

'Communist' and 'ba'athist' are ideological affiliations, as are affiliations with the Chinese Communist Party or the Arab Socialist Ba'ath Party specifically.

'Syrian' and 'Chinese' are not ideological affiliations.
Another data point against the wage gap being a result of sexism
FYI the live stream is playing on YouTube right now.

https://www.youtube.com/watch?v=Aymrnzianf0
I believe that the ships pick their own name rather than having it picked for them by the ship that built them.
> Don’t use JavaScript to create custom input elements like text boxes, combo boxes, or scrollbars.

You can style input elements heavily, and in some cases you can shadow them (associate a manufactured UI element with a real input element, and then conceal the real element). In fact for certain interactions you have to do this due to user agent hardening against CSRF attacks.
Sign up for all those gig economy platforms before the rush of people starts to them. You never know when you might really want to have that option.
Robe and wizard hat is epic.
They are quite different. Personal take, imagine Scottish English vs American English but 2x that.
It’s for sure a slippery slope, but it seems to be the way the courts have ruled. Thankfully, they’ve generally taken it case by case (except for the Miller Test), and (generally) rejected the concept of “prior restraint”. It’s why I said it’s a good rule of thumb, not an absolute.

> Does emotional or mental or spiritual/religious harm count?

Actually, it depends. Sometimes yes; sometimes no. Anti-bullying laws are very much a thing, but then there’s the Westboro Baptist Church (where the courts have ruled their hate speech is protected).

Wikipedia has a list of “free speech exceptions”[0]. Among those include fraud (sometimes in the form of depriving someone of property through lies), CP (harm to minors), threatening the President, and others.

[0]: https://en.wikipedia.org/wiki/United_States_free_speech_exce...
I see, I'm not familiar with that as well that's why I'm asking.
Where this would be most useful is automated testing suites just by specifying what you are testing for. A product manager looking to test portions of a system that absolutely need to work can specify code comments and generate 1000s of tests this way.

This is a gamechanger for ensuring the reliability of software. Many more people can be involved in the software development process, and inject their domain knowledge into it.

Are there any plans to open source the model? I would love to play around with it.
Rethinking real estate business model
All true. But they are cheap, available, and have well understood limitations. Which means you can design and build your project quickly and cheaply, then upgrade to brushless motors with encoders or whatever when you have the time and funds. I think from that aspect they are a great way to get a project started without flinging cash at it.
I hope when they do launch all goes well.
That's indeed a janky setup :P

What libraries / frameworks do you use in Common Lisp to generate the site?
Guessing most people on here talking about maybe getting it in February are from the Bay Area.

February was the last time I got sick, covid-like symptoms, and going back through my slack out-of-office channel a lot of people at my office did too.
I doubt we're going to verify it. But if an employee can't provide a quiet, nice looking location for calls and reliable internet, they'll be fixing that situation or getting a different job. It's part of our planning on going remote in a way that is likely to succeed. iow, we're being explicit about requirements.
It's a safe assumption that many of the explicit verb based surnames will face the same barrier to trending. Equally proud names like Shittings, Crappings, Fuckings, Dickings, etc.
Thanks for that informative reply
Exactly. To the corporation, you're "human capital stock." [0] Never forget that.

---

[0]: https://news.ycombinator.com/item?id=23316697
If a field is harvested too efficiently it needs to be left fallow to rebuild lost nutrients. Leaving some in the ground is not waste by any definition.
A fact check would be fine if it led to objective analyses of some sort, or even Wikipedia. But when I clicked it, it displayed some highly partisan sources, including a CNN article with its usual "Trump bad" vitriol. Maybe it was an algorithm's fault, but it didn't work at all.
Some politicians campaign on a platform of running government like a business.

Although most of the time, what they mean by that is much worse.

Your federal government can print money, your province can't. It's much better for your province to have the same loan on the federal books, than it is on theirs.
I think that's where "good enough" comes in. It's likely that some companies will be just compliant, whereas the market leader is well ahead of compliance. e.g. a car that safely comes to a stop in an unhandled situation vs. a car that can handle the situation. It's also possible that the space also reaches commodity status where no differentiators emerge ( as one would expect with a big S curve in performance ).
AMP is the one reason why Duck Duck Go is now my default search engine on mobile.
In March, my wife had hers cut 10% and I was laid off. (She works for a major top-ten multinational engineering firm, and I worked for a major travel industry company in tech.) Everyone in her company above her took a 20% pay cut. These weren't small companies; my employer cut 3,000 people and reduced the pay of a chunk of their other 20k employees, and my wife's company employs more than 40k-ish full time and many more contractors and subcontractors.

It's the knock-on effect that I'd worry about. We immediately cut all of our luxury spending, canceled our wine club subscriptions and gym memberships and started buying boxed wine and lifting weights in the garage again... we're not sure yet if we'll go back to those things when this is all over.
I'd love to know if this is it, and if there's a better picture of it. https://media.glassdoor.com/l/74/a2/5e/2a/pokemon.jpg
Saying that somebody under the influence of the left for a long time can be a secret communist is not a joke concern at all.

You know, just 40-30 years ago USSR, was recruiting millions of communists in the West in the most literal sense of this word during the cold war. They were ready to launch attacks, kill, sabotage, subvert. Nothing funny.

https://en.m.wikipedia.org/wiki/Left-wing_terrorism#History
Indeed! It's so much more interesting to learn about what people are interested in, beyond just their professional competencies. I really like that you have your guiding philosophies, hobbies, languages and even Hogwarts house on your about me page.

Kinda makes me want to make a more detailed about me page. If I enjoy these kinds of details, surely some other people will too. Might do it this weekend.
in a competitive market (which US groceries mostly are) if the store has to "eat the cost" of bruised fruit, then the price will necessarily have to be higher on the fruit they sell.

Think of it this way, you have fruit at home to be shared by all the members of your family, it was fine when you bought it, but now some of it is bruised. So now you own a mix of fruit: what do you do, throw away the bruised fruit, or trim it, or give a loved one the good looking one and eat the bruised one yourself? Those costs (tossing or trimming or eating slightly lower quality) have to be borne by somebody, in this case the whole family or a member of the family.

You buy a car and you buy insurance for it; that's because a car is expensive and you don't want to bear the burden of a bruised car yourself, you want to share that burden with all the other people who buy insurance; and yet, the insurance company is making money, so apparently you are paying a little extra for this decrease in the variance of quality.

Same with your theory of purchasing fruit: you are not saying (in your original comment) what you think you are saying, that bruised fruit is too expensive; what you are actually saying is that you prefer to overpay for expensive fruit all the time and not deal with imperfections. Because otherwise, if the supermarket could sell all their fruit and not just perfect fruit, and was competing against other supermarkets, then the fruit would be overall actually cheaper across the board; you say "you don't get any discount", but with time you actually would.

I explain all this because it allows you to live your life feeling less miffed.
> I don't mind H1-B at all, but when companies exploit humans from other countries so they don't have to pay American wages, that's where I draw the line, it's bad for everyone except Boeing. They are specifically gouging people from India. Couple this with their time tracking policies which I wont cover, their business practices are fairly absurd and rather disgusting.

Lot more to it than that, I'd say.

https://www.brightworkresearch.com/enterprisesoftwarepolicy/...
Flash was an amazing, low barrier way to make games that could be distributed with almost no effort. In a single weekend I was able to make a game, do all the art, integrate a video advertisement API into it, and release it to hundreds of websites. I made tens of thousands of dollars doing this from my dorm while going to school and working two jobs. I have yet to find an alternative that can come anywhere close to this.

I wrote a bit about this on my blog, if you'd like to know more: http://web.eecs.utk.edu/~azh/blog/8lessons8games.html
I think the relevant questions here revolve around simple "and? so? what?". The mere fact that they were certified before with ample indications the autonomy was stripped away suggests that the decision is largely political as opposed to the noble goal of preventing human rights violations. Just to add to this ( I don't want to spend too much time on this ), note that Iran was for the longest time certified to be compliant ( until suddenly it was not ).

In other words, I am not sure what you are arguing here. You are absolutely right, but you do not advance your point as far I can tell.
Show HN: an animation tool for kids
I would argue that the "using a compiler"-class would be the programming class!
There was no nuclear Holocaust because all of ours and the Soviets nukes were deactivated. Had they not been, the idiotic leaders of our past and present would have already killed us all over petty trivialities and power games.
Previously: https://news.ycombinator.com/item?id=12024217 (original site has linkrot)
Please do not spead false information on HN. The tweet in question is:

> "There is NO WAY (ZERO!) that Mail-In Ballots will be anything less than substantially fraudulent."

Twitter labeled it as unsubstantiated, and provided a link to facts on mail-in ballots. Even if they didn't, his tweet is factually incorrect.
They do!

If you need to label an image for both screen-readers and screen you can use the aria-labelledby attribute. [1] [2]

<img src="sunflowers.jpg" aria-labelledby="my_txt">
<span id="my_txt">Foo bar baz</span>

However some UX copywriters prefer to have extra information in the alt attribute.

[1] https://www.w3.org/WAI/GL/wiki/Using_aria-labelledby_to_prov...

[2] https://fae.disability.illinois.edu/rulesets/IMAGE_1/
Perhaps there will be laws against that behavior soon after UBI! I'm sure you'll fight against them being enacted, of course.