skysight-inc/HackerNews huggingface dataset:
This is a concern somewhat orthogonal to site isolation as implemented in Chrome.

Say you have a web page at https://a.com that does <img src="https://b.com/foo.png">. That's allowed in browsers (including Chrome with site isolation enabled), because it's _very_ common on the web and has been for a long time, and disallowing it would break very many sites. But in that situation the browser attempts to prevent a.com from reading the actual pixel data of the image (which comes from b.com). That protection would be violated if the site could just use a Spectre attack to read the pixel data.

So there are three options if you want to keep the security guarantee that you can't read image pixel data cross-site.

1) You could have the pixel data for the image living in a separate process but getting properly composited into the a.com webpage. This is not something any browser does right now, would involve a fair amount of engineering work, and comes with some memory tradeoffs that are not great. It would certainly be a bit of a research project to see how and whether this could be done reasonably.

2) You can attempt to prevent Spectre attacks, e.g. by disallowing things like SharedArrayBuffer. This is the current state in Firefox.

3) You can attempt to ensure that a site's process has access to _either_ SharedArrayBuffer _or_ cross-site image data but never both. This is the solution described in the article. Since current websites widely rely on cross-site images but not much on SharedArrayBuffer, the default is "cross-site images but no SharedArrayBuffer", but sites can opt into the "SharedArrayBuffer but no cross-site images" behavior. There is also an opt-in for the image itself to say "actually, I'm OK with being loaded cross-site even when SharedArrayBuffer is allowed"; in that case a site that opts into the "no cross-site images" behavior will still be able to load that specific image cross-site.

I guess you have a fourth option: Just give up on the security guarantee of "no cross-site pixel data reading". That's what Chrome has been doing on desktop for a while now, by shipping SharedArrayBuffer enabled unconditionally. They are now trying to move away from that to option 3 at the same time as Firefox is moving from option 2 to option 3.

Similar concerns apply to other resources that can currently be loaded cross-site but don't allow cross-site access to the raw bytes of the resource in that situation: video, audio, scripts, stylesheets.

I hope that explains what you are missing in your original comment in terms of the threat model being addressed here, but please do let me know if something is still not making sense!
I wonder if most of these are now using QML or if they’re primarily adopting the older widget style.
I do! And I did implement it like this :)

Compare Infinite Jest (a big book) with other smaller books on my site. Looks pretty cool!
Apparently everyone experiences an accident once per every 17.9 years of driving.

My wife just got hit by a truck on the freeway yesterday. Amazingly there was not a scratch on her. It made us re-evaluate what we drive though as when we checked our car had only a 2 star safety rating and apparently where we live 2/3 of fatal crashes are from 1 and 2 star safety rated cars. Today we're car shopping for a 5 star safety rated car.

So, yeah it carries an inherent risk and it's important we do what we can in terms of driving safely, driving the safest car you can afford and upgrading to a safer car when you can afford in order to minimize those risks.
Teach logic. ...at a young age. Fundamental logic and reason.

That is the first step. Most of the dangerous content online is visibly illogical, and driven purely on emotion.
In Turkey, the best private universities (that are also up there as best universities in the country) are still held by the corresponding company holdings, i.e. Koc and Sabanci.

By contrast, in Germany there are no universally notable private universities at all (save for some business schools).
> But it deeply upsets me that technology is not effectively used in here to solve the most fundamental issue that is of access to education, healthcare and electricity

Just as Zuckerberg couldn't conquer India, city kids will not be able to solve problems in rural India.

Why exactly are you expecting city kids to be able to solve a problem that they are fundamentally unaware of?

Why aren't you seizing this opportunity? Find a small problem, figure out a fix for it. Start a company or empower locals to start their own company that earns revenue.
It's a mitigation for a software exploitation technique called Return Oriented Programming (ROP). The mitigation is referred to as 'Control Flow Integrity' (CFI).

https://software.intel.com/content/www/us/en/develop/article...

Essentially an attacker who has the ability to exploit the first stage of a vulnerability will be able to stitch together "gadgets" from the program to build up a second stage of the exploit.

Control flow integrity, to my understanding, applies a validation or restriction of the program's call graph. This limits the attackers ability to just stitch up their own arbitrary call graph. There are 'forward edge' protections (calling a function) and 'reverse edge' protections (ret). But of course there are more ways to control the flow of a program, as this document discusses - like longjmp.

I won't try to get more detailed as I'm not an expert. Hopefully this will help you find more information.
I see where you're coming from, but in my view that's still an offset.
And technically named after his father.
> player skill is assumed to be normally distributed when that is just so demonstrably not the case

This is close but not exactly right, and the small difference matters. Elo does not assume that skill is normally distributed, but rather that "quality of play" in a single game is normally distributed around some average quality level for the player. Obviously this too is an approximation but it's a much smaller one.
Show HN: A Slack-based social network to help remote teams interact
Our startup Culturelike is about to launch and we're looking for beta testers! We built this to help companies deliver on the promise of 'people' that they list on their careers website as a perk. The people is actually one of the main reasons why employees decide to join and stay at a company but remote work makes it 10x harder for teammates to get to know each other beyond their title. If you're interested please check out our website and I'll reach out to you (free for teams of up to 50 people)
> Is this reversing cause and effect? Battery swaps will indeed be rare if you have to disassemble the entire computer to do it.

As I said above, if you need to replace the battery frequently, that's a big concern regardless of whether it's the laptop is serviceable or not.
That's a super interesting idea. There's a ton of community incentive to participate too since everyone's sharing this IP reputation. On the biz side, policing this sucked. Ate up a ton of support time analyzing the email being sent, freshness of the contact uploaded, etc. Not to mention the fights with customers about buying lists, getting optins, etc. This might just be a really great intermediary. Cool thought.
It's really telling that, for every big project that does not support TypeScript, the number 1 feature request is TypeScript support. (And consequently, that there are fewer and fewer such projects.)
Given enough time, yes.
Turing and Wittgenstein on Logic and Mathematics [pdf]
Show HN: A new way to add and share custom functionality for Streamlit apps
If it's showing up as invalid for you, you may have locally revoked trust of the DST Root CA X3 IdenTrust root certificate.
Making "a" process .01% more efficient is not sufficient in your example. You need (the weighted average of) everything to become that much more effective.

Somebody improving e.g. the build speed by that amount will not be paying back their salary in improved productivity of other developers. While a person who increases the click through rate on ads by 0.02% probably does.
It'd be impressive enough to recursively traverse a tree using memoization in bash.
IDK, but it's because security.

Judging by the title, it helps avoiding ROP: "Return-oriented programming is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as executable space protection and code signing." (Wikipedia)
I stopped reading at the salary information for professors. Either Galloway is intentionally misleading or he's dangerously unable to represent facts.

>The average salary of a full professor (before benefits and admin support costs) is $104,820, though some make much more, and roughly 50% of full-time faculty have tenure.

He's conflating the full professor (the highest-ranking level for a professor) with full-time faculty. What's more, he ignores the fact that outside of R1 institutions, the average salary for a full professor is uniformly well below that (the chart where he got his data from is here: https://www.insidehighered.com/news/2018/04/11/aaups-annual-...). After seeing that gross misrepresentation of higher ed salaries, I'm not predisposed to trust any of his other arguments.
Musk claims Neuralink chip will allow you to stream music directly to your brain
It seems hard to say conclusively what is or isn't possible about differences in development time without knowing more about the problem domain. Since he mentions GIL in one of his tweets, it seems like his code must have involved concurrency, and Python and Clojure differ enough in this regard (to say the least...) that it seems believable that something that's easy in Clojure could be gut-wrenching in Python.
I was very curious, so I found this: https://www.reddit.com/r/Bitwig/comments/4c2zoh/what_program...

Sounds like it’s probably not much of a Java app.
> Whether or not people agree on something is completely irrelevant to whether or not it is a fact.

No, it's actually the ENTIRE meaning of "fact". Because "fact" is a word, and it has no meaning if we don't agree.
SUSE releases major Linux update
I have used links-x11 as my main mobile browser back around 2009-2012 when I used it on Openmoko Neo Freerunner :) It was surprisingly usable back then!
Best Alternatives for Selenium WebDriver
collegescorecard measures the outcome. In the post, Profesor Leonard talks about doctoral programs being rated based on research outcomes.
If javascript had one (or if Node had one), wouldn't top-level await be unnecessary?
Third of NYC small businesses may never reopen, report says – Fox Business
The sheer pervasiveness across all platforms with unified messaging indicates faux grassroots shillops. Super easy to spot these days. Over-shilling broke the reputation management industry.
Founders really shouldn’t get a salary, or if they do, only the minimum to live.

Founders getting any more than just what they need to live incentivises people to raise money for personal gain rather than raising money to build a company.

It also really blurs the line between founders and employees. How can a founder justify taking a salary at the same or even higher level than an employee while also having a huge share? We didn’t get people moaning about how employees are taking risks until SV founders stopped holding up thier end of the bargain with regard to risk taking.
Correct, fixed :)
In any case, Prometheus is throwing away data if a scrap can’t be done. As clearly described on the website, prometheus is not a metrics system.
So influx and Prometheus are quite different.
Yet another reference from The League of Extraordinary Gentlemen (first referenced in Black Dossier) that passed me by. Alan Moore certainly knows how to dig deep into literature.
I don't think there's a way around tracking that `firstLoad` value. A `ref` is probably a better choice than a separate state value because you don't need to render when the component becomes aware that you're past the first render. You could do it in a simple hook:

function useFirstRenderComplete() {
const renderCountRef = useRef(0);

useEffect(() => {
if (renderCountRef.current) {
return;
}

renderCountRef.current += 1;
}, []);

return renderCountRef.current !== 0;
}
I believe the shift in meaning came about because decimation was an incredibly brutal punishment -- it was the most severe sanction that a general could impose.

What is often overlooked is not just that it was "one in ten" executed, but that they were executed by being clubbed to death by the other nine men who were not chosen to die.

So "decimation" spread from the literal procedure to "worst outcome imaginable". Much as "literal" no longer means literal.
Nope, just that Prometheus and Grafana are running together on the same node. My entire infrastructure is multi-node however.
I'm aware of these developments. I still don't think it's going to happen at scale. The economics are not favorable for electrifying these vehicles.
1) easiness is subjective, simplicity is objective.

2) simple code is easy to read, but hard to write.

If you're a programmer, and you're not surrounded by people conflating both words, consider yourself lucky. What does a coworker really means by "I did the simplest possible thing" ?
Why did they even go with 11 instead of just dropping the 10, making Big Sur macOS 16?
Eeek! I screwed up here.

But referring to more of it as institution.
3D Printing Effort Becomes Linux Foundation Open Standards Project
Firstly, DDG was blocked by ALL Indian ISPs during that instance, not just Jio. People using Airtel, Vodafone, etc. were as much complaining in forums as the Jio users. From what I recall, BSNL was the only one who didn't block (due to their inefficiency perhaps!)

Secondly, with the kind of minuscule market share DDG has, they or their users can hardly get impacted by a couple hours' block. If anything, Indian govt. made them a favor by making them more famous! I for one don't recall #DDG ever trend on Twitter in recent history.
Would not that hit the securities regulations on accredited investors where most of the employees won't qualify?
Covid-19 Vaccines with 'Minor Side Effects' Could Still Be Pretty Bad
I remember a couple departments (including the NSA) complaining about the federal cap when it came to some IT projects, so I'm not sure it is a sure deal to get past that cap.

The VA is a whole other land of bureaucracy that plays by its own rules.
FWIW, the original versions of Ardour were "extensible in Guile" too. The entire program (well, the GUI) ran inside the interpreter's REPL. We ripped that our before v2 came out. These days, we use Lua.
TRX40 with a Threadripper 3960X supports PCIe 4.0 (64 CPU lanes) and 8x ECC UDIMM. This would be a quad channel configuration (2 DIMMs per channel), not 8 channels and DDR4-3200 ECC UDIMM may be hard to find at retail. Threadripper is based on the same silicon as EPYC, though, so it may be close enough for your purpose. ASRock TRX40 Taichi, ASUS Prime TRX40-Pro or maybe ASRock Rack TRX40D8 could be a suitable motherboard.

Threadripper Pro will be even closer to EPYC with 8 memory channels, 128 PCIe 4.0 lanes and RDIMM/LRDIMM support. However, you'd have to wait until September and the Lenovo ThinkStation P620 may be the only choice at time of launch.
Curious about your math. $400k x 960 employees = $384 M.
> What you describe is exactly the property of Bitcoin. Have a look at how many forks have tried to create "Bitcoin2".

I am saying we don't have yet that Bitcoin2 yet and the sum of people and organizations using cryptocurrencies is pretty low comparing to their potential of a Bitcoin2 occurring with more user base.
The bots scan the entire public IP address space for open ports.
The Culture of Narcissism by Lasch or Democracy in America by de Tocqueville might be of interest to you.
Not to mention the extremely large foreign born workforce who usually also obtain significant education at home.
Build something that exercises the gaps you want to fill and you'll learn from it. Make your code open source and there's your proof of knowledge. Unless the thing you build is in production with reasonable traffic you won't get to truly experience some of the good or not-so-good decisions you made but at least you made decisions and have some experience.
Does a startup's equity in the pool vest over time? I'd be concerned about a startup joining the pool, and then immediately dissolving their company.
They built a vastly cheaper, more efficient network. That’s not dumping, just healthy competition.
I use eww in emacs for a lot of browsing. It copes extremely well with the modern web.
http://admiralbumblebee.com/music/2020/02/25/20-Mixbus-Featu...
What would it bring in ergonomics and expressivity versus Vue ?
It’s true, but they were a literal decade behind in their suspensions. IRS was a big deal for pony cars. And GT is probably not the most commonly owned trim level. I say this as a person who has bought a new Mustang every ~5 years since I have been able to drive (~24 years). Guess tech catches up eventually, but it was a sore point until around 05 to 08 when they really started taking the suspension and handling seriously.
What is simplicity and how it differs from ease? I haven’t got a chance watching the talk yet.
1Password emergency kits are a way of achieving this.

They allow you to provide a third party with all the details they need to access your passwords. It's therefore highly recommended to keep these kits at a safe location only trusted parties can access in case of an emergency.

You can also opt to keep your master password in a separate location or with a separate party, which precludes a single party from gaining access outright.

One could even envision combining it with something like Google's Inactive Account Manager (https://support.google.com/accounts/answer/3036546?hl=en ) to implement a dead man's switch by having an email sent on your behalf after a set period of inactivity.

I wouldn't want to trust them with my master password in plain text, though, which would defeat the purpose.
Really full of data!
From the point-of-view of a developer working there, in practice this means that if something breaks in an application I'm responsible for, e.g. when the markets open in Tokyo, which is 5am my time, the company can and will phone me and expect me to log in right away and do whatever it takes to fix the problem :-)
> The monopoly of Jio is extremely bad for India.

Jio made Internet affordable to 100s of millions of Indians. It resulted in huge drop in data price. The results so far have been pretty good to the Indian society in general. Let's see what happens in future. Also Jio only accounts for 50% of Internet users.

> Any of the big tech companies who wish to make a significant presence in India have to go through Jio.

Okay. So? American tech companies have millions of users. It's almost impossible that one day Jio/Indian gov wakes up and decides to ban these websites. The public is not dumb. Banning Chinese Internet is not the same as banning the Internet. Unless the US decides one day to start claiming land in India or ban non US internet companies in USA. The likelihood of that happening is very very low.

> The monies that Facebook and Google spent buying stakes in Jio is to assure them that their operations wont be hurt.

Or they want to invest in a promising tech company and don't want to be left out?
Nice story, but Lynx != Links :)
We got a Trump University. Does that count? /s

Not to point out the obvious, but 2 of your examples never bothered to stay in undergrad university long enough to get a degree and they managed to succeed beyond all of their contemporaries.

Perhaps it says something about our current university system/paradigm that the current wealthy have chosen not to support this route. Or maybe it says more about the Gilded Age robber barons that they chose this route (in addition to the large inheritance fortunes they left).

Marc Andreessen's "Build Stuff" article[1] pointed at the lack of university capacity in the USA (I doubt this is accurate[2]), but leveling up the average university to be closer to the top tier universities would certainly help or at least justify the current cost of university.

[1] https://a16z.com/2020/04/18/its-time-to-build/

[2] https://www.quora.com/How-many-college-students-are-there-in...
Pro tip: right-click to remove blocks.
Given the article is talking about DWARF debugging formats, I believe the numbers in the article are for Linux binaries. I'm not sure if Windows binaries store line numbers in the same way.
IME, you are over estimating how quickly this happens.

For me, I was well past my 10th year into the profession when this realization struck. And now, as a hiring manager, I frequently interview senior developers who are not able to explain the business goals of their software. I consider it an important part of my job to coach engineers in my org to understand the business context of their work - a benefit I got only well into my career.
Legend has it this is why Windows skipped version 9 - too many apps broke when they checked the version string just for “Windows 9” to capture both “95” and “98”.
the question is not really whether they use Qt. It's how much of Qt they use. Ardour, for example, uses GTK, but hardly uses any of GTK for the majority of the GUI.
Classic modern HN comment. The hard working person with a history of success who is trying a risky ambitious project will fail, because they didn't consider the few things a commentor instantly spotted as problems.
I'm surprised Ben didn't emphasize aggregation theory here - it might be the biggest example yet!

The American internet is a disintermediated morass or tech product/service providers each building on each other to make the internet work. But each foundational industry that makes it up - chips, infrastructure, consumer products, applications - has relatively few players. By selling bits and pieces of itself, Jio is not only getting people to invest in it's vision, but getting a share of the oligoplies at each layer. Google's staying power can become Jio's, and by extension, the government's.

India's telecom market is crazy competitive, and another ISP will quickly develop if the government lets it. The support of American tech companies will be Jio's real moat in the future.
All the more focus for posting to the most distracting site of them all, HN :)
I'll give you an example. MIT was founded in 1861. OK. Sorta bad timing. (Two days after it was chartered, the Civil War broke out.)

But even after it got going and moved to its Cambridge campus in 1916 (significantly funded by George Eastman--as in Eastman Kodak), it didn't really become known as a premier institution until WWII.
The twist to this is that no matter what you ask the model, it will make you a TODO app because that’s all it’s been trained on.
> Not sure I understand why you believe Bitcoin's network effects are lower than golds. The more people willing to accept a unit of Bitcoin, the more useful Bitcoin becomes.

Gold is more connected to the regulated financial world than Bitcoin. The network effect is not only about user base but interrelation with other systems. Not saying that Bitcoin could not have a bigger place but it is not there yet.
Ok. So it might be a language thing. Not being a native, easy and simple from pov of a customer is the same for me.

For example, for me, statement 1 is false. Simplicity is also subjective

I am one of the people conflating the terms.
Are they used from the devs pov? Like what's easiest for you (add one more parameter to this function or another special case handled with its) might make things more complicated.

From the customer pov simple or easy is the same, or?!
How is Webstorm support with Svelte ?
Using ROP techniques in a binary bypasses a lot of stuff such as ASLR, canaries and even DEP (I think...).

I’ve seen ROP exploitation in binaries and is pretty handy when there is no other way to get a setuid binary to give you a shell as root.

Watch Rope from ippsec on YT (on my phone atm).