skysight-inc/HackerNews huggingface dataset:
I don’t like the OWASP recommendation here to concatenate the pepper and password before having. Generally speaking, you should not be smashing unlike things together into a single cryptographic input. If you find yourself doing this sort of thing, it’s worth taking a step back and seeing if there’s another primitive that better meets your needs. It’s probably fine to do it this way for anything approaching a reasonable password hashing function, but it does leave a bad taste in one’s mouth.

Likewise, I’m not a fan of encrypting password hashes since there’s no need to have a two-way function for password verification. Again, there’s probably no exploit. But over and over again we’ve seen ways where attackers have been able to exploit systems where a primitive was used for a subtly different problem than the one it was designed for.

Much better: HMAC the password with the key before running it through the hash.
The 802.11 standards have always allowed up to 32 bytes which can be filled with any data, it does not have to be in a particular encoding. In 802.11-2012 there is a separate tag SSIDEncoding which can be used to specify if these bytes are in UTF-8 or "unspecified". If the UTF-8 option is set, the SSID should be interpreted as UTF-8.

It is not clear in this case if the router sets this flag or not. Either way there is no stipulation in the spec about how the UTF-8 characters should be displayed so many of these options are potentially valid.
Care to share your company then? Or your products/website that I can take a look at?
We are in agreement that there needs to be explanation on what's going on, and not just "we'll set some price yon won't know why".

In my experience, the most fluctuations were on international shipping by small vendors. Lego bricks for instance, where it makes a big difference if you request 5 small pieces that weight 20g total and can wait 3 months, or if it's 500+g in a middle sized box and you want it in 2 days.

Even with average indication on what to expect, depending on the combination you are requesting the vendor might use a different carrier, different shipping method and so on. They could make it more simple with a range of arbitrary standard fees, but then it costs a lot more to the customer, putting the vendor at a disadvantage price wise. In particular people have visceral reactions to overly high shipping prices.
Yeah that video is all kinds of amazing. I also got lost down a several hour rabbit hole watching the guy and his buddies bring up an AGC and perform a simulated lunar landing with it. Thank you for sharing!
> Both the s8 and the Firestick are rendering the result in what I deem as the correct way with it showing the name just with some of the vertical characters cutoff.

At least one is doing a poor job, though, because the diacritics look nothing alike…

> After asking around on the Apple discord server someone said it might be using the Mac OS Roman character set. It turns out it which is strange because iOS used UTF-8 internally and not Mac OS Roman as that was phased out with the release of Mac OS X.

I would guess that some part of IOKit is passing a C or C++ string to CoreFoundation using an inappropriate function or using the “system encoding”. I can’t remember of the top of my head, but Mac OS Roman might also be encoding 0. In any case there’s certainly a convention going on there with a poor default or some sort of strange compatibility story.

(I’m actually curious if there is “supposed” to be an encoding for this. Perhaps Mac OS Roman is just as correct and more convenient?)
But what if it's a glass door.
This is a very literal approach. I assume that when you watch network TV you assume everything is coming at you with the same purpose and intent (news, talking head show, some documentary like 60 minutes.) Just because you want everything you read online to be "hard news" doesn't mean it will be. It takes a bit of work to understand the context of what you are seeing. So yes, you are holding it wrong.
Google and Apple push notification services are often whitelisted in WiFi networks so they work before you "sign in" to the network.
>why the hell attackers targeting macOS haven't been doing this until now
AFAIK most companies which have business critical hardware that cant recover from ransomware attacks dont run macOS
Commodore Nowhere Near the Edge or Commodore Before Commodore (2007)
UARTs and serial protocols are still in very widespread use. A large proportion of all embedded devices use them, which is arguably the majority of all computing systems sold.

What you're implying is historical is still current.
The messing around with stuff that adds no value or makes things worse continues. The new alt tab behaviour for edge sounds quite awful, what is wrong with ctrl + tab for this purpose exactly?
Even the cities are full of people who are progressive right up until the point that it affects them. Just look at the NIMBY problem we have in SF.
So... where are the 57 e-parliament startups trying to implement them in web software ?
The most effective venue for quick Nim answers is the Nim forum - almost everything gets a serious well thought out answer within a few hours to a day.

That said, nothing beats “already been answered” and the Rust community is much bigger.
Because Python doesn't have the performance of any JVM implementation (not counting toy ones here), not even via PyPy, and JavaScript lacks the tooling, performance of static typing and good support for parallel programming.
"After controlling for problems of endogeneity, heteroscedasticity, and inconsistency, the interpretation of our robust estimates goes beyond claiming mere correlations or associations."

They think they have showed causality. If it only was so easy...
Damnn So why do air molecules not hit the ground ?
I don't know, but its scary here. Police march the streets firing rubber bullets into crowds. A leader who makes repeated and sustained attacks to discredit the media with the deliberate intention of having a population with no trusted or reliable sources of information. Foreign interference in elections.

Oh yeah, and laws that ban encryption.
At least it nowhere caused an exploitable crash
They said "worked with" duckduckgo. I'm not clear on what that means. I think they'd have said "worked for" if it was direct employment.
We rehash this every time a NYT, WaPo, WSJ, etc. submission gets popular.

It’s off-topic.
I am quite happy that with my hops between Java and .NET, every time I land on a Java project I have been able to avoid it.
Location: Athens, Greece

Remote: Yes

Willing to relocate: No

Technical Skills: Reverse Engineering, Vulnerability Research, Exploit Dev, Fuzzing

Technologies: C/C++, Python, x86 assembly, Ghidra, Ida Pro, Windbg, gdb

Email: anastasios [at] mageirias [dot] com
Automated artifact building for both SteamVR and Oculus Quest
Company is ReadMe.com :) Here's our handbook with the values: https://readme.com/handbook
Argon2 supports peppering/secret parameter where it does a HMAC internally.
Protobuf Code Generation in Rust
When thinking about a minimal subset of Python to be truly useful, my mind jumps to MicroPython [0].

Which can be compiled to run on a standard platform, instead of the more common baremetal situation.

MicroPython does feature a REPL - though you can disable it so you can control UART in a more expected way.

A surprising amount of plain Python programs can run with the stripped down set.

Even though you won't find any of the referenced functions in sys. However, locals does work, as does builtins. You also get access to pip and a few other unexpected things like that.

[0] https://micropython.org
Having been through quite a few Apple and Anker lightning cables I'd say the Ankers last about three times as long in normal use. The plastic frays and breaks on the Apple ones.
Best Resources to Learn React Native Development
Yep. When at all possible, use cryptographic tools that natively support the features you want rather than trying to bolt them on top yourself.
Turmeric Total Boost Reviews:{99%-Work}Health Tips Cost and Buy?
What is Turmeric Total Boost?

The probiotic addendum is for the most part viewed as protected. The best issue, confirmation by reevaluation story on suit muse, is that for a country with arrangement gut bail uprightness there might be an introduction of foundational disease. For this purpose, the probiotic study is trusted to remove microorganisms assortment that is wonder medicate standing up to.

https://djsupplement.com/turmeric-total-boost/

https://specialoffer4health.wordpress.com/2020/07/02/turmeric-total-boost/

https://charity.gofundme.com/o/en/campaign/turmeric-total-boost

https://publons.com/researcher/3745240/turmeric-total-boost-get-50-off-today-check-bio/

https://youtu.be/_PUw7I79PTA
Hey thank you for your response and the kind words. Very interesting reads you referenced! Your article confirms on a big scale, what a few friends have been reporting on individual basis :(. I still want to read the discussion on HN that you referred to from your blog post ... couldn't find your crawler's source code, did you publish that somewhere?
To answer your questions, I chose Rust, because of two reasons mainly:
1. I knew it was popular and I wanted to learn it. Also typical benefits of the language itself.
2. Performance. I wanted to use query selectors for scraping and I knew that Rust was at the core of Firefox' Quantum Engine. Kuchiki, the DOM manipulation library that I use, builds on top of html5ever and cssparser, both used in Servo (Firefox). Also, crawlers can run in parallel and thus make use of multiple cores.
So far I didn't have any issues with the lambda IPs. Maybe it's because I use the Frankfurt region. Or maybe because more and more business is happening serverless (or in AWS in general) these days and blocking those IPs without losing business integration is not feasible anymore.
I would like to add a filter module that just checks hard facts like prices, squaremeters and rents. However, for now it is enough or even gives more fine grained control, to use the filters on the property sites directly and then scrape the specific results pages. For the sites I have seen so far, the filter were always encoded in the URL.
Sending automatic replies is a very neat feature. What currently scares me off a bit, is that it would need to be implemented for the different portals individually.
Are you the same person who attacked ppl on D forum. The nickname is familiar and the style ;)

Chill. All languages have dusty corners and given the amount of ppl D has it's obvious that not all things are fixed in time but they were and they will, history already proved it. Besides, complaining is easier right?
(1) LinkedIn
The biggest advantage of helicopter crop dusting when fixed-wing is an option is that the helicopter dusting gets more "into" the plants because the helicopter rotor actively blows the shit downwards.
KSX Male Enhancement Scam or Not?
The essential and furthermore the Important aggravates That are added to this Kind of Male Enhancement Supplement are Actual And natural ordinarily. The parts for the most part Include the Longjack, sarsaparilla root extricate, horny goat weed remove, and Many other important mixes. This pill is so Safe as It's broke down by the Specialists with the end goal That all the Types of Male can utilize This pill on a Regular Basis. This pill is Highly productive And compelling, and its own affectability is Creating it Among the top rated and most Demanded medication that can normally improve The erectile brokenness of this human body in the most ideal manner.

http://wintersupplement.com/ksx-pills/

https://ksx-male-enhancement.tumblr.com/

https://ksx-male-enhancement.hatenadiary.jp/

http://specialoffer4health.over-blog.com/ksx-pills

https://youtu.be/g0sVYRY8420
One of the things that those sticking to Java 8 are missing out are the JIT caches that are now part of all major implementations, as those features were integrated into the FOSS variants from the commercial products.
When I had bad mobility problems, I wanted to create a rollator that converted into a lightweight power chair for when I was done walking. There are rollator/transport chair hybrids, but those still require a caregiver to push you.

In an age of hoverboards and cheap electric scooters, something like this should be doable.
Then it's no wonder he plays a lot of browser games, right?
In my experience, it's even worse: those people who spend time and effort into becoming famous on the internet tend to have less interesting content than those who just silently post to their own blog and then move on to their next adventure.

That's why I like HackerNews, because users can recommend someone unrelated to the community purely for their content.

Substack kind of reverses the incentive here, because there's no money to be made in sending visitors off their platform. So either, it'll be a little echo chamber where Substack users only link to other Substack users, or even worse it creates an incentive for Substack's "creators" to copy content from people who didn't join.
Oh, sitemaps. Maybe something like this could be a way to give a summary of a website again. https://www.spacejam.com/cmp/sitemap.html
I suspect that Apple and Facebook will control said committee. They just need to donate more money to the campaign funds of people lucky enough to be on that committee.
The cooler weather in Denver and huge focus on fitness / outdoors beats the pants off Austin for me on any given day. I do indeed want to be healthier and spend time outdoors!
This comment breaks the site guidelines which asks Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that."

https://news.ycombinator.com/newsguidelines.html

Your comment would be just fine if shortened in the way the guidelines recommend; it's a fine comment otherwise.
Nice intuition because it already exists in the UK for freelancers. Combined banking, accounting, auto tax return: https://getcoconut.com
> I have heard from multiple cold war scholars some that were in government at that time that they promised this to Gorbachev. That said, it was never formally ratified.

And there was a lot of pressure to not separate from USSR up to coup of 1991. Especially from Western europe. Looking at our politicians from early 90s memoirs, Gorbachev broke those unwritten agreements with West by using military in January events of 1991.

> This is just one example, another one is the non-adjustment of borders without agreemnt. But this was broken in the 90s when the US created Kosvo.

Wasn't non-adjustment of borders some agreement in Helsinki in mid-70s?

> Arguably the Cold War ended with the treaties between the Soviet Union and the US before it devolved. That is at least what US negotiators believed and you can listen interviews with them.

Got any examples? Because

> Yeltsin was weak and had to agree to a lot of stuff that he didn't like. The Russian elites certainty never wanted the NATO to expand east.

While Yeltsin was rather weak (just like any politician in 90s in ex-USSR/Warsaw pact), the main difference was split between democractical vs imperial powers. Russian SSR government was were pro-democracy people congregated while pan-USSR structures were held by imperialists. When USSR dissolved, it took some time for imperialists to regroup and take over Russian Federation (ex Russian SSR) structures.

> They are incredibly friendly right at the point in the history where they are weakest. Lenin was so friendly he signed over half of European Russia.

Lenin only signed over non-ethnically-Russian territories of tsarist Russia. Tsarist Russia was called "jail of nations" for a reason.
Anyone who thinks this is okay has not studied history in the 20th century.
> you may be well outside your paygrade on this.

Not as worse as publicly denouncing an honest engineer while referencing his paygrade. I hope there is no affiliation you have with DDG to be honest, because this is much, much worse.
Meanwhile this stupid idea from Tesla to use touchscreens for everything is starting to spread to other car makers. Why do we always have to take steps back?
I think the title they chose is just misleading (wrong?). Otherwise, their conclusion is

> we found that articles downloaded from Sci-hub were cited 1.72 times more than papers not downloaded from Sci-hub and that the number of downloads from Sci-hub was a robust predictor of future citations

> The results suggest that limited access to publications may limit some scientific research from achieving its full impact.
FWIW I got higher quality results with Searx.
I don't know if Denver has any food it's known for. Maybe craft beer?

Mountains are the thing.
Via https://amiga-news.de/de/news/AN-2020-07-00002-DE.html
The most basic definition of stoicism is "indifference to fate". In that scope Taleb definitely is a stoic. His approach toward stoicism, though, is less philosophy focused and more (that's kind of unique) targeted toward statistics. Ancient stoics don't write about their philosophy in such a way, but the logic remains similar. The whole concept of antifragility Taleb has promoted is pure "opportunistic" stoicism. Taleb is like a Seneca the Younger, minus some charm ;)

Regarding his online presence, anyone knowing his works also knows that he's using Twitter purely to mess with people. He stated that many times in his Incerto series.

Sometimes it's easy to forget what is the actual core of a given philosophy / enterprise / etc. Hence my whole comment. It's worthwhile to know, I think, that stoicism has a very important component comprised of pure logic, which Taleb seems to be hyped about (not without a reason).

I wouldn't call Taleb a member of the top-3 stoics though. He's balancing on the verge of being an outcast rather than hanging out with mainstream stoic crowds.
I think the problem is that even with breaks, you can still be mentally exhausted by the last interview or two. For a normal work day, I wouldn't expect people to switch between writing completely different algorithms and problems so often. In a day of interviews, switching to a new problem five or six times can be exhausting.

Make sure your interview process isn't stacking too many in a row, or the signal from the last few is going to be pretty bad.
It is not relevant to this sub-thread, and should have been a new top-level comment.
I mean nowadays i see a lot of motivated and young crowd in India who have become very knowledgeable due to the explosion in many scientific and other such youtube channels in India. Previously amateur researchers could not get access to research papers due to the prohibitive cost of access (unless they are in a really top notch university, which frankly told is highly limited in India as it is purely a numbers game). Sci-hub really enables access to many such folks.

A similar story played out in the last decade (2000 - 2010) when affordable streaming platforms did not exist. Many folks got familiar to global movies and shows due to piracy as the price of even legal DVDs were prohibitively expensive.
In a nutshell: EMI (Electromagnetic Interference) is the main reason why cables got smart in the first place.

Many people in IT think, that data is just 1s and 0s. But in reality we are living in a physical world and as such some form of power is used to transmit those 1s and 0s. This power may is electrical power in terms of voltages with defined generated current or in terms of current with defined voltages (20mA communication heavily seen in industrial equipment). If you have a slow communication link, EMI and other environmental thinks like temperature is not much of an issue. But as faster you like to communicate you need to cope with those things. The electrical contacts in the connectors doesn't help. So people started to put the transceivers into the cables. Those transceivers with additional electronics like ringing suppression circuitry and other "magic" are then best fitted for the desired cables for the desired environments. Then you started to makes those cables smart like to detect the capabilities of the cables like is it really possible to talk at 10Gbps or is it more a cheaper type where 100Mbps is the max. As more smarter those cables get people get creative to put other things in it like "hey, the cable could become a converter as well".
Because to code in C++ with the safety of Java, specially in distributed computing scenarios, I have to make people go through this.

https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines

https://docs.microsoft.com/en-us/cpp/code-quality/?view=vs-2...

And most of the time is a lost battle to force people to change, so it is easier to bring in people that have other culture towards security when plugging software into the network.

As for GraalVM support for LLVM, that is mostly for language interoperability purposes.
Even if you had your own domain, their ToS would prohibit you from collecting email addresses of "your" audience. Because in their lawyer's opinion, it's not yours.
>I'm amazed how many people fork over $50,000

Obligatory Money Mustache article:

https://www.mrmoneymustache.com/2015/04/28/what-does-your-wo...
For mobile computing, there's no comparison IMO. With a touchpad, you have to shuffle your hands to the palmrest area to move the mouse. If your machine is on your lap, that might put your hands in a quite unergonomic position. And it of course interrupts keyboard input. And there's the subject of accidental inputs when typing.
It’s more than just the title. The conclusion from abstract reads “The results suggest that limited access to publications may limit some scientific research from achieving its full impact.”

My uncharitable read is they slapped an interesting yet unsupported conclusion onto a rather boring observation.

Edit: In particular, it seems to me that papers in their control group are available on SciHub (correct me if I’m wrong), just nobody bothered to download them in the time window they analyzed. Which directly contradicts the “limited access” part of their claim.
Substack has been successful in creating buzz among the media crowd, and there's definitely a business there riding the trend toward subscriptions in the media biz, but unfortunately taking on $17M in VC money has set them up for a disappointing end.

Here's how this plays out. The successful writers on Substack will eventually leave the platform for more control over their audience and lower fees (there's a reason Ben Thompson isn't on Substack).

As this happens, and as the honeymoon PR period dies off, the journalists will turn on Substack, just as they do on every single thing Silicon Valley puts out (see Lambda School).

Prior to taking on a16z riches, Substack was a cool indie brand. Now they're officially "big, evil tech." The fickle journalist twitterati just haven't realized it yet.

Inevitably as more non-influencer writers head to Substack they'll start to see, like with Patreon, that only a small minority of creators will ever generate enough income to make a living.

This, combined with competition from Patreon, Podia, Memberful, Ghost, Revue, the next indie platform darling, etc. will spell doom for a16z's growth goals for the platform.

My guess is 3-7 years from now, after more funding rounds, they get acquired by Patreon for roughly the same amount of money investors put in. Employees will get nothing, founders might get Cush jobs and possibly a minor payout, VCs would have done better investing in the S&P.

This is the type of business that works better bootstrapped IMO.