skysight-inc/HackerNews huggingface dataset:
One of the toys philosophers use to explain away anything is to divide/classify. If there is an issue with X, make a distinction between strong-X and weaker-X. First, it is strong emergence (ontic) vs. weaker emergence (epistemic). Later, it is "strong" downward causation vs. "weaker" downward causation.

This endless subdivision is a pass time.
OTOH, rando SaaS flaws don't compromise the security of billions
Is it me or is this writeup low on details? There are a couple of commenters saying that this is a great writeup, but all it amounts to is:

1. what sign in with apple is

2. sign in with apple is like oauth2

3. there's some bug (not explained) that allows JWTs to be generated for arbitrary emails

4. this bug is bad because you can impersonate anyone with it

5. I got paid $100k for it
Thanks. I've become closer to my dentist since the pandemic. We've talked about business issues, even though software and dentistry are very different, there are definitely common issues.

The things we share are definitely many and another good thing is getting people to talk that wouldn't normally do that.

So, take care yourself, and thanks for the kind words.
My read on it is the author is saying that seemingly small changes can have big impacts. I agree it could have been worded better, though I doubt he's trying to promote himself as a genius (as other people are saying) because he clearly highlights the effort his team put into the project in the footnote.
If you are part of the undifferentiated labour pool, well, this might actually be happening to you.

Immigration benefits the U.S overall but if you are hourly labour with no special skills then it is probably not helping your wages.
it's literally that simple.
I'm not sure. I come here to read about technology and technology related issues. There is some overlap -- specifically, I think Twitter's choice to start policing misinformation from POTUS is good. But I don't feel like the protests are technology related.
No you got it right. I'm actually asking for things like nginx:osx when developing in local.
In this particular case then maybe it's worth (generally, not saying you in particular) how he became anxious and disenfranchised. Maybe the problem isn't the people themselves, but the systematic circumstances that lead people down this road. If there's an upstream problem, then it's better to work on a fix for that than to out of hand dismiss people as crazy.
Tangentially I never understood. If a consumer would be willing to buy a few year supply of a non perishable product, why isn’t there a way they can purchase at wholesale prices? Assume they’d be buying in the same bulk that a connivence store would buy for a months supply.

For example, if I have a certain protein bar I ate twice a day. Why can’t I buy a years supply at wholesale?
I think it's inherently toxic to have a norm that, if something important is going on, everyone in every space needs to start talking about it. It means that people who have legitimate reasons to not want to talk about it - maybe they have intense personal trauma on the topics of police brutality or rioting - have to completely disconnect themselves from the public discourse.

This is especially true right now, when many people's normal avenues of disengagement are banned due to shelter in place.
That's beyond DuckDuckGo's control since that data is controlled and sent by the browser.
There are many addons for doing what you said though just look for user-agent changer or faker
This happens to all posts about controversial topics (I guess because they also attract lots of flags). It's the same for posts about climate change for example.
How is that not license compatability?

If the license prevents otherwise useful software from being used in the base system, what would you call it?
On Marketing Haskell
Aside of auto vacuuming, there is also VACUUM FULL [1] which does an exclusive lock on the table.
If you look for an alternative option for reorganizing tables in online mode, try the pg_repack extension [2].

[1] https://www.postgresql.org/docs/current/sql-vacuum.html
[2] https://reorg.github.io/pg_repack/
I think that aspic might be a better gelatin-based analogy. Otherwise it’s just mastication without chewing.
Life Sciences Observations #12
Indian Council of Medical Research writes to WHO about discrepancy in HCQ trial
Any idea how much snacks.com could have sold for? A quick Google search didn't bring anything up. I'm guessing at least low 7 figures...
I wonder if there's a disincentive for social networks to purge accounts like that due to MAU being a core metric in their financial reporting.
Wrong exploit target.
People hoard because they either fear the prices will get jacked up soon, or because they hope the price will get jacked up soon, so they can make a neat profit off of other people's desperation.

Anti-gouging and rationing prevents that hoarding, as long as they are implemented intelligently.
It seems low on details because the exploit was incredibly simple. AFAICT you didn't have to do anything special to get the signed token, they just gave it out.

> Here on passing any email, Apple generated a valid JWT (id_token) for that particular Email ID.
Why is that? I am genuinely curious but did not find any good links. I use filtered water from a Brita system with my Sodastream and it definitely does not taste like, or as good as, industrial carbonation. I had always assumed the limiting factor was the amount of pressure the system can withstand so the water is not as carbonated.
Until someone finds a buffer overflow in Apple Mail MIME handling or some such.
Wouldn’t whales catch as much plankton as krill? It doesn’t seem like they have a way to distinguish.
React: Under the Hood
> and how his connections to very many very powerful people

It's funny how the true Epstein case turns out to be so broadly similar to the Pizzagate and Qanon conspiracy stories. I mean, Epstein did not actually own a pizza place somewhere in DC, but he could have.
See the Cortex project
> Now, the idea that we should be fine with marginally increasing the misery of third world countries is morally wrong.

It’s funny, I totally agree with you there, and the following paragraph. The poor should not be paying the price of the climate crisis. Many on the left—including me—are of the believe that economic disparity of the poor is part of the same problem that is causing the climate crisis. We want the rich to pay the price. I am very much for poorer areas of the world getting the infrastructure they so desperately need to make all of our lives better (and the rich should pay for it).

Note though that I don’t say that poorer countries are paying the price, but the poor in general are affected to a greater degree. I consider my self very much a victim of the climate crisis even though I live in one of the wealthiest city in the world, but I acknowledge that the effects of the climate disaster will affect the homeless population in my city to a greater degree.

Let’s talk about the scale of the climate crisis. I think you realize how dire the situation is, it is not a matter of saving the economy any more and keeping our lifestyles, we literally can’t afford it. There is already so much carbon in the atmosphere that our climate is changing into a more inhospitable one. We are already loosing massive amount of species to extinction. We can’t afford to wait for a technical solution, we must act now. And the only solution that we know of—which has been proven to work before (apart from nuclear energy which we are too late to convert to)—is laws and regulation. And who do we regulate? We regulate the producers. It is on the polluters to stop producing stuff that does so much harm to our shared lives.
Magit is great! I use everyday. The more useful feature for me is partial staging by simple text selection. Help so much to create better atomic commits
Did you try contacting a wholesaler?
Ask HN: What was programming like before internet?
I recently talked to someone who helped a company with their main-frame architecture in the 80s.

As a 90s kid, I grew up with internet, github and stackoverflow so it can be argued that I got everything easily.

But I'm eager to know what was it like before internet or personal computers were a thing.

Who hired you? What did you work on? How did you learn ? How did you fix issues? How did you find talent? How did news spread? Do you have any war-time stories ?

Thanks
Let's not call them incapable. Just not practiced :)
Apple's goal for Swift is quite clear on its documentation, to replace C and Objective-C. As for anything else it isn't quite clear.
The title implies that Pepsi will stop supplying grocery stores, while the article makes no such claim. Very misleading.
In some of the cases there’s no chance to agree with the TOS or leave before you are scanned.

> For example, Citibank, Ameriprise, and TIAA-CREF immediately port scanned our computers when visiting the main page of the site.
Oakland protest following death of George Floyd turned violent
Die analysis of the 8087 math coprocessor's fast bit shifter
I don't think it's likely that you ever really need query hints.

Even if updating analyses, creating indices, changing the query, etc. fails, you can always either use CTEs or temporary tables, or use a stored procedure that manually iterates over results to implement whatever strategy is desired.

It might be more time consuming than having query hints, although this is compensated by the fact that almost always queries just work after creating appropriate indices.
That's what the article says and I agree.

But crazy worldview is crazy even if it's created by the circumstances.
Filling out fake data for your testing or demo environments is also a good use-case.
>But you never hear the same rhetoric about irresponsible promiscuous heteros.

We did. Sort of. Heterosexuals weren't singled out for caution about promiscuous sex, because most of the public messaging assumed heterosexual relations anyway. But the emphasis was always on promiscuity.
Indeed, my main issue with my shower is "why tf doesn't this thing have some heat recovery". But that wouldn't be considered an alternative to more radical solutions like a mist shower in the same way a water cycle would.
Well, if the database has the number of tables, triggers, stored procedures, etc that SAP or Oracle’s ERP has then this seems less unreasonable. We’re talking thousands
Beautiful and simple dark-mode notepad in PHP
They have a bug bounty program: https://developer.apple.com/security-bounty/

I actually think they have a good approach. Rewarding major finds with good payouts and avoiding the flood of info and low level web app ‘bugs’.
I was really off-put by it too.

"I did it by myself in one day, well actually it was one week but had I known the stack I would likely have done it in one day. Oh, and by the way, after that week, there was yet another month of work involving at least two other persons from my team and then even more work from other teams. But let's not dwell on boring details".

It's nearly as infuriating as the "Appendix: stuff I screwed up" which doesn't contain actual screw up. It's a shame because the rest of the writing is interesting and doesn't need to be propped up.
Nearly everything is loaded on demand. Start up time is less than 1 second.
I’m still very disappointed that DuckDuckHack was ended…
Those are all application concerns which you should get right and no database out there can do that for you short of exotic ones that are purpose-built for this domain. You specifically said that "[SQL has] zero built in machinery to detect what double entry knows to be an error in the data" And I mentioned that's not the case because double-entry is solved by mostly two things: Zero or two transactions happen on separate accounts, not 1. And that the separate accounts happen on uniquely identified accounts (and not by string-identifiers that can have typos), which is solved by unique & foreign key constraints. The other side to that is that the sides of the double-entry have to be identical in amount. There are no "math rules" beyond that, but again this is an application concern.

Relational databases are perfect for solving a ledger problem, and as long as you build a solid application layer above it to solve the domain problem, you won't have any issues. I understand there is a point that this thread is making that "block chain" and "NoSQL" DBs are somehow better for modelling a ledger, but that's inherently false and the same criticisms you apply to relational databases for this, you can just as easily (if not more) apply them on exotic database types.
There are lots of clicks to be gained nowadays from highlighting the very stupidest people you can find and poking fun at them. It's entertaining but it's dumbing down discourse when people are discussing positions that are essentially strawmen.
> Social media is what is making people anxious in the first place.

What you're saying is ignorance is bliss. Without social media, a few phone calls to media houses would have been sufficient to squelch the recent murder of a black male by the police.

The medium is not at fault.

We all hailed Facebook helped organize 'successful' revolutions in some 'oppressive' states.

It's easier to believe tales about people I distrust.

I prefer we focused on ways to increase transparency and fairness in government. That's the conspiracy theory vaccine we need.
publish over tor with steps to replicate. lack of authority shouldn't be a problem because anyone can replicate it. reputable people might even be able to say they endorse the findings without running afoul of the EULA, considering they're just saying yes/no, not disclosing the results of the benchmark.
That's interesting. How much do you make a year, if you don't mind me asking? Have you ever tried to purchase a large asset such as a house?
"Apple also did an investigation of their logs and determined there was no misuse or account compromise due to this vulnerability."

Given the simplicity of the exploit, I really doubt that claim. Seems more likely they just don't have a way of detecting whether it happened.
See. Gone from the first page already. Looks like it got flagged this time. The moderators don’t want social discussions.
Why the ranting shouts of 'bullshit' and claims of 'political axe-grinding'? Posts like this, that rarely have any facts with them, just suggest someone's angry at something they don't like. They don't tell me anything except someone's temperature is rising.
I'm not a DB expert by any means, but the DB experts at my job are pretty insistent that (given the way we deploy our software) it's not practical to do in Postgres what we can do with Oracle query hints.
This reminds me of an art history class in college; amidst a lecture covering works in the '80s and '90s, the professor just broke down in tears as a lot of the artists he knew personally, and had passed from AIDS at the time...
Sorry to inform you. But nothing will change.

They’ll get this to quiet down. Then it’s back to business as usual.

The oligarchs have too much power over the plebs. And they have the heavy weapons to enforce it.

We all knew it, but the virus exposed, how predatory, capitalism truly is.

I must admit though, the protesters are very brave. The cops are just running people down now, if you get in front of their patrol car.
"Based on its license it's very hard for any one company or individual to 'own' Postgres"

I know you already know this, but it takes a lot more than just a license. I'd like to call attention to the very enlightened (and noble) work others have done to build a robust political structure and community for Postgres.

The core team, committers and major contributors are spread across many companies and continents. There are different foundations across different regions for handling finances, trademarks, domains, and other basic business operations.

Amazingly, a lot of this structure was being put in place a long time ago, when Postgres was still the weird database option to choose.
$100,000 (!)

Props to Apple for raising the bar on bounties!
Like all those who spouted the evidence free Russia-gate conspiracy theory? Thats a lot of mental health defects. I'm obviously being hyperbolic but you should get the point.

On a more serious note, it's important to remember the power of inductive logic in places where we lack evidence, such as in the conspiracy theory realm. Not everything has to be deductive, though of course it is preferred.
I mean, I'm more afraid of the dudes who are throwing rocks, not merely holding them.
Is the dev team that wrote that line of code fired?
Not sure about protein bars, but sodas are often sold as loss leaders at grocery stores when on sale. I doubt you could get them cheaper wholesale.
Official response in the thread:

> As the Vice President of Open Source at Sangoma, I can state unequivocally that we're not at all preparing "to close the FreePBX source" as Rob put it.

> Yes, our Marketing team messed up and archived some old blog posts. They've since restored them. But please don't think that somehow that translates into use closing the source on FreePBX. That is absolutely not our intention.
This post has also been flagged, which is both disappointing and unsurprising.
I think the write up is so short because the bug is so simple. Send a POST to appleid.apple.com with an email address of your choice, and get back an auth token for that user. Use the auth token to log-in as that user. It's that simple.
The best lies have a kernel of truth inside them.
Dan Luu is not "fresh out of academia."
Except when it doesn't. HSV encephalitis is not trivial. Post HSV neuralgia is no fun.
Glad to hear you opted for adding another tool to your toolbox :)
Those shock jockeys didn’t use your browsing history to determine exactly which conspiracies you will be most susceptible to. Denying the responsibility of YouTube, Facebook and other platforms that pursue viewer engagement at any cost by calling them a “symptom” of society is disingenuous and almost ill intended.

“Hey the cancer that put you in bed is just a symptom of who you are.”
Cigarettes causing cancer was once a conspiracy theory.
From your point of view - assuming you do not fall into the black hole yourself - nothing you throw into the black hole ever crosses the event horizon so you will have wait forever. You can only see something cross the event horizon if you cross the event horizon yourself and you will see everything cross the event horizon at the moment you cross the event horizon.
Why would you ever write a get_size function that drops the object you call it on? Surely in an actual, non-contrived usecase spawning another thread and letting the drop occur there would just be plain worse?
Remember that the NSA spying thing was considered a conspiracy theory until the snowden leaks. Same goes for things like the Glomar Explorer. Being aware that there are conspiracies and being sceptical is not a mental defect, but rather a successful evolutionary strategy.
If there were publicly specified rules for getting to the front page, then people would game them.
hmm my first thought its, having to do that is a lot like c and cleaning up my own allocations. This feels like something rust should automatically do for me?
Is uBlock blocking port scanning by default, or one has to enable something in settings?
Here's the research article from MIT.
http://news.mit.edu/2019/storing-vaccine-history-skin-1218
MIT article on their research.
http://news.mit.edu/2019/storing-vaccine-history-skin-1218
The things you are referencing are known as limited-hangouts, and by a few other terms as well.

It's modern psyops to make legitimate conspiracy theories and theorists look crazy by association... and it is very effective. (case in point)
> It might be more time consuming than having query hints

The queries in question can't be allowed to get any slower than they already are. They bottleneck certain critical uses.
Interesting. I hadn't thought about it that way before, but it does seem to predict the bimodality; the lower mode is (presumably) programmers who either aren't skilled enough or don't work in the right areas to be able to take their ball and found a startup with it.
You probably can. Use the same wholesaler as your connivence would go to, as they probably do not go to the producer either.

Some require a registered company for tax/accounting porpoises, but I have not had any issues buying stuff with my own company which I otherwise only use for consulting.
I've heard of others prohibiting benchmarks before, which I can at least begin to comprehend (fair benchmarks are hard) even if I disagree. But prohibiting discussing things a product can't do is a new one on me.
Are they actually mainstream anywhere other than places like HackerNews? I feel like the majority of the mainstream info I see is on the opposite side, where everything is always terrible.
Thanks! It's a bummer though: it sounds like a movie I'd like to watch :D
> None of these claims is real.

Dude, you can’t even form a grammatically correct sentence.
It's not like we have a lot of empty slots in trade schools or apprenticeship programs either.
Given:

- the context that the author already has a very successful career as a well-known developer

- the humility he evidences in most posts on his blog

- the fact that he explicitly highlights the work of others in this post alongside his own

I really don't think Dan is doing this as any form of personal marketing. He has no need of personal marketing, his blog already has several million views per month and frequently shows up on HN as it is, and it isn't really his style.
Oh my good god.

I'm hoping this is down to developer naivety rather than being a feature of rust.
My grocery usually has soda not in sale so it's $6.50 a 12 pack and I know it doesn't cost that much since it's on sale for $1.62 the rest of the time. Which leads to the soda not being bought or the aisle is empty as the only two conditions
It's for the even fat marbling. The high grade cuts cut through easily with a fork because of the fat distribution.
Intellipedia
I appreciate your comment and I agree that maybe people come here as an escape. That is definitely something to consider.
I am still so confused on why this vulnerability exists. For AJAX, you have CORS. Why was this even permitted for web-sockets ?
Might be good to compare against Shopify on your site, show why/if you're better. Also do a show hn
I stand corrected and removing my message now since my scenario wasn’t related to this zeroday bug.

Thank you to everyone who educated me.
Datagram Congestion Control Protocol
Facebook deactivates influential accounts in Tunisia including journalists
More links

https://twitter.com/Sarah_bh/status/1266479439187247108
https://twitter.com/moezbhar/status/1266476115293585408
What do you mean by "permutation-dependent"? I'm curious, because I write an article about permutations and I'd be happy to introduce some astrology :)
Of course you cannot relicense someone elses git repo.

Copying BSD code and distributing it under another license (even a commercial one) seems to be totally OK though as long as you put in the correct notices.

That is what GPL is meant to protect against.
> He didn’t. He was a fad of high school English teachers in 2000-2005

"The Waste Land is a poem by T. S. Eliot, widely regarded as one of the most important poems of the 20th century and a central work of modernist poetry. Published in 1922"
OpenSUSE for INNOVATORS Project is born
I wasn’t aware of the heavy moderation happening. This is good to know because it helps me understand why certain things are discussed. Thank you.
I'm not very familiar with Rust, but I don't understand why you wouldn't just use a reference-to-HeavyThing as the function argument, so that the object isn't moved and then dropped in the `get_size` function?
Go Micro – a distributed systems development framework