skysight-inc/HackerNews huggingface dataset:
You can find most of security issues with Pysa that you can model as a taint flow problem. Examples could be flows to function that enable code execution or shell injection, SQL injection, SSRF, XSS and many others. As long as you can model the security issue in a taint-flow model then Pysa should be able to detect these issues. These are the configuration we share with Pysa where you can find examples of bug categories we detect https://github.com/facebook/pyre-check/blob/master/stubs/tai...
They've been already doing that for all the iOS version of their apps (which are now way past a simple player or viewer).

Why not ? It's probably only a matter of time.
May I offer my apologies for saying the USA act violent and dominant. You're not all violent and dominant. I'm sorry. Friends?
Pysa can find any bug that you can model as a flow of data from one place to another. That includes your standard web app bugs like SQLi, RCE, etc., also some AuthN/AuthZ bugs depending on how you do your checks. Concretely, this is a list of the vulnerabilities Pysa able to catch out of the box without any customization:
https://github.com/facebook/pyre-check/blob/6975ff55fc59b7b9...
I always wonder where is the VB6/Windows Forms for web apps?

Me too. Dreamweaver once did that. But the Javascript/CSS crowd complicated layout so much that writing WYSIWYG layout tools became extremely difficult.

Blue Griffon is perhaps the last remnant of that era.
Linux is the one that won. I don’t see how things would be much different if some BSD version or another Unix won out for server market share.

I assume disruptive means the world would be different without the product.

Similarly, Git not being around wouldn’t change much practically speaking. For all we know, Git won because of Linus. Otherwise other version control were and are similar enough. Mercurial is a prime example for the nascent time period.

OTOH, GitHub changed things. Moved from Sourceforge and in some cases, some of the mailing lists/personally hosted source codes + being part of the reason some open source stopped using some of the popular but in my opinion, kitschy and lackluster bug trackers. GitHub also inspired the copy cat Gitlab project which is now itself a unicorn worth $2B or so. Yes I know Gitlab has differentiators before and even more now. It being very heavily inspired if not lifting from GitHub for parts of it is a point of GitHub’s influence, not a critique of Gitlab.

It isn’t as certain that we would have one such dominant platform like GitHub and the new runner up and alternative of Gitlab if GitHub didn’t exist.
Cool links from syllabus:

Origami Simulator: http://www.tsg.ne.jp/TT/software/index.html

Treemaker: https://langorigami.com/article/treemaker/
> They found that it was more efficient to have a single thread managing all the dataflow operations for a graph than to distribute operators across multiple cores.

That's going to depend on operator cost. Since we target general stream computing, our operator costs vary widely - operators can be as cheap as a simple filter, to as expensive as speech-to-text. We also had follow-up work [1] which tried to dynamically figure out which sections of the graph are best handled by a single thread.

> While I have lazily not looked at the paper, is there a possibility that the control scheme happened to be faster because closely-related threads landed on cores together?

Certainly possible, but I doubt that's the case. I'm more inclined to believe it could be because they landed on cores which share the same NUMA node - which, if that's the case, then kudos to the Linux kernel scheduler for detecting and acting on such affinity. Because even if it happens sometimes by accident, if it happened enough to make such a consistent difference in performance, it would almost certainly have to be a policy. But we did not dig into if there was any core or NUMA node affinity helping out the over-subscription case.

[1] Automating Multi-level Performance Elastic Components for IBM Streams, Middleware 2019, https://www.scott-a-s.com/files/middleware2019_multi_elastic...

edit after reading the Materialize blog post: Our system benefits from the same fusion optimization where operators can be executed in the same process, in the same thread, as simple functions calls. Our language allows developers to easily control the threading model of different sections of their application, as well as just letting the system try to find the best one.
Taxes should cover this sans abusers.
> Apple is massively inconsistent here

The one consistent truth of the app store.
Right. Because nobody else will buy an iPhone if I don’t.

As a developer, you can’t have a successful app and not be on the Apple app store.

Anyway, even if neither of those were true, as human beings we certainly always have the right to talk shit about Apple and tell them to go fuck themselves. Even while we’re using their products.

I make sure to cost Apple money by convincing entire companies to not use their stuff. And any Apple products that my family buys aren’t new. We also never buy apps from their app store.
Surprisingly, I had 4 sites dating back to 2009 on my account. There was absolutely no content of interest on there, but it was a nice trip down the memory lane for me.
What a little asshole!
Yeah, that's basically what I said. My comment was more that outside of a normative sense, it's actually a good system.
It was once put to me that Google's promotion system creates this dynamic.

Starting a new project that garners widespread attention looks good in a package, but replacing lightbulbs and scrubbing floors doesn't. Folks create a splash, get promoted, then move on and are not replaced.

I've never worked at Google, so I do not know if this dynamic is real. I would be interested to hear from Googlers about incentives to work or not work on something.
Hmm it doesn't seem to recognize numbers very well. If the first stroke of 7 is slightly upwards it thinks it is a 3. Example https://imgur.com/a/Eshy2qm
Interesting...

You started with "OP seems [...]", which sort of implies you are interpreting as well...

Whatever, I'll stand corrected I guess. My (and everyone else except you!) reply is not meaningful.

Edit to add: If I ask for a product that does X and respects Y, and someone says "Here are the criteria I use to make sure any product respects your Y requirement", I would accept that as a valid and helpful reply. Maybe it's just me.
> Without careful priority tuning

Which might be as simple as marking the throughput tasks as SCHED_BATCH. It'll make their latency even worse but preserve throughput, give priority to the shell and reduce context switches on an oversubscribed system even further.

Or you could use taskset/cgroups to reserve 1 hyperthread for interactive things.
I find json output massively valuable because I combine it with `jq` instead of having to try and cut (or other command) slice up responses.
I was gifted one as a 15 year old. It had 8mb of ram and spent lots of time running warcraft 2. Good times.
From my perspective, that's partially because CMD is so stunningly incapable as what a reasonable person might think of as a shell. I'd guess the other half is the amount of pressure Microsoft has placed upon management tooling using PS

If Apple shipped some Swift-powered shell and all of their management documentation started using it, I'd bet a non-trivial portion of administrators would start to use AppleSwiftShell (although I do deeply appreciate that's a severely flawed comparison since macOS already has a sane functioning shell, but it's the best I could think of as a huge company that owns the platform pushing such a concept down)
If you assign maximum niceness to worker threads, and minimum niceness to all threads that deal with your shell (i.e. bash or ssh etc) does it improve the predictability of latency? A couple years ago I tried to do something like this really quick, but wasn't able to get good latency. I'm wondering if it's possible if you do it right.
> Not sure how that can help poorer members of society, since most people are quite unlikely to be doing their own case law research anyway.

That's frequently the only way the poor can pursue justice. Pro se representation is a thing; sometimes they even win.

But aside from that, without knowing what courts are doing, there is no way to assure they're acting in the public interest. The public must be able to inspect the work output of the courts if a free society is to stay free.
Very, very few people want to pay $99/year for Hey. Their needs don’t represent the needs of iPhone users in general.

And if Hey is typical of the vast majority of SAAS services, they pay affiliate fees and other marketing fees based on a percentage of sales to third parties that promote their service. So why not play Apple their 15% for a seamless in-app purchase system to add new users with?
EFF Creates Tool to Detect Stingray Cell Phone Snooping
QuickPublisher brings the fun back in blogging with its easy to use interface. Be able to design your post your way using a WYSIWYG editor, monetize your blog without using ads, moderate comments easily and more.
Not your fault at all, I'd never expect such childish behavior from a website either.
> I'm no expert

That seems obvious.

https://www.wired.com/story/android-zero-day-more-than-ios-z...
We are on the same page here it seems. This isn’t the only case of this issue, but mixing popularity with disruption is a prime example. Another common one is the most popular product is the best because otherwise it wouldn’t be the most popular. Android and iOS vs webOS (I am incredibly bias in my love for it) or Windows Phone 7.
Then Geforce Now should be permitted, since it's just a virtual desktop you can access your game library from. But they're locked out of the app store as well, afaik.
Actual title: Google and other tech giants are happy to have control over the Web's metadata schemas, but they let its infrastructure languish

I know that hating on Google is fashionable, but that's a bit too much editorializing. Especially considering the content of the post, and Google just being a small side note.

---

On-topic: I recently looked into using schema.org types as the basis for a information capturing system, but many of the types are somewhat outdated, of questionable quality or just missing. Development indeed seems slow, while changes that are needed by one of the larger involved companies get pushed through quickly.

I think a big part of that stagnation is a lack of interest though. The whole semantic web domain has been pretty much inactive.

It's a real shame: having canonical types for most things in existence, and have those actually be supported as import/export formats or for cross-app integrations, would be immensely valuable! But there is absolutely no business incentive there - rather the opposite. Easy portability of data is not something most companies would want.
The FFTW package is no longer included in the stdlib. The only GPL dependency that is shipped in there is SuiteSparse.
Adding Identity to OAuth XYZ (2019)
“Trusted” doesn’t make them secure.
I don't recall if this happened or not but it feels like a Star Trek plotline for them to be near a star when it explodes, have some drama about keeping the shields up and then at the end of the day everyone goes home safely.

But the TLDR here is that the radiation flux from only the neutrinos is enough to kill at 1 astronomical unit from an exploding supernova. Maybe whatever ridiculous process that lets them block phasers but is transparent to visible light and sensor arrays also blocks neutrinos.

The problem with scifi is that each person has a certain proportion of bullshit they are willing to ignore, and at some point it's just too much.
GDPR was a direct reaction to the USA Patriot act and the Snowden leaks.
Docker Enterprise Edition Guide
Why does the author use "sound" instead of "consistent"?
Former Googler, 16 hours ago, stated: https://news.ycombinator.com/item?id=24077692
Mental Health Disorders in Quarantined Adults in China
Another tip if you are mousing through a native app's menus in the menu bar, holding ⌘, ⌥, ^ and ⇧ (or combinations of them) will show you the alternate options in that menu that those extra keys in the combo perform.

One of my favorite things about the macOS shortcut system is this idea of variations on operations using variations on shortcuts. They've kept the system remarkably consistent.

Last tip is that if you want a quick way to type keyboard shortcuts, set up keyboard text expansions for things like "commandkey", "optionkey", "shiftkey" etc that resolve to those symbols. I found it slightly fast than bringing up the emoji picker with ^ + spacebar and typing e.g. "place name" for ⌘. (What is the icon for spacebar??)
You guys should look into the font size and text colors (contrast) on your website. It's really hard to read.
This has some good advice for working on cool/difficult things that don’t fit into traditional roles

https://guzey.com/personal/what-should-you-do-with-your-life...
You mean like this?

> Just because your company is named Microsoft doesn't mean you have a perpetual and exclusive right to use that name wherever you want.

Hmmm. :)
Yea, it's not always immediately apparent. Here are suggestions for your use cases:

For sleep, I use ctrl - cmd - q (shown at this submission's link)

Resizing windows with keyboard is indeed the missing piece in macOS. Hence, Magnet* is consistently the top app in App Store (others are Spectacle* or Better Snap tool)

---
Spectacle is free and i've been using it for years, even if apparently no longer maintained:
https://www.spectacleapp.com

Magnet: https://apps.apple.com/us/app/magnet/id441258766?mt=12
sorry for triggering u
My first laptop was a Satellite 2100 CDT
although the Australian visa deemed to match the US work visa for Australians is available without regard for nationality. I think reciprocity is common, but many states work in their own self interest first.
If you want to change the US Government, you don't do it by packing up and moving to Japan. "Voting with your wallet" isn't voting for change; it's giving up. Apple can do better, Apple must do better, and they don't listen to people who aren't their customers. Why should they?
Ongoing incident with compromised mod accounts
I don't know about balance but the person that embodied every human virtue renounced his citizenship and he lived happier than his peers, lacked nothing and stood taller than kings. We can't all be Diogenes but he's something people should strive towards.
Currently its just Bing: https://gitlab.com/infinitysearch/infinity-search/-/blob/mas...
There is a live demo here https://p2customers.p2.blog/

I don't get it. Looks like a regular news wall with endless scrolling and comments expanded.

Except anybody can post an announcement on top? and the previous ones disappear under the constant flow?
ah okay that kind of audible feedback, I don't know, I never miss, and the changing color is kind of clear imho
I prefer this personally, but what does annoy me is that ⌘+` doesn't work with any windows that are fullscreened. I don't use it often, but when I do it's annoying to lose all keyboard navigation.

I use an app called Contexts which hijacks ⌘+` with extra functionality (and includes fullscreen windows), but it seems to be abandoned so I fear it will stop working eventually.
Replace PGP with an HTTPS Form
Five charged with felonies for tweeting or retweeting a cop’s photo
It’s still far more trusted than buying on the web. That’s a significant benefit for developers.
also alt-tabbing between recently active windows of any app (rather than between whole apps, windows of the same app, or tabs of the same app) is curiously difficult.

after years of frustration, i finally found that "Move focus to active or next window" is the analogue functionality in macos keyboard shortcuts, and it's now mapped to the slightly-less-awkward alt-cmd-tab, from the very awkward ^F4. it's not quite the same in keeping the stack order however (in some nebulous way i haven't really determined yet).
Stop the purchase many if not most thought was an overpay by a company that was still possibly a fad? Facebook fully opened to the public in 2009. IG was bought in 2012 as an iPhone only app. No web app, no android app. iPhones were not a big market at the time.

Edit: I don’t recall now. The android app may have been in public beta or just released at the time.
PyTorch Lightning masterclass [video]
Your attempts to draw parallels between the nazis and facebook by invoking schindlers list hasn’t gone unnoticed. FB has its flaws, but isnt half as bad as what you are trying to paint it to be. Not everyone who disagrees with your point of view is a nazi.
> Spending some time typing on my homemade switches has given me a newfound appreciation for just how good Cherry MX switches are.

I know at least one mech keyboard enthusiast from reddit who went from cherrry mx brown -> clears -> ergo clears -> gateron brown -> zealios v1 -> zealios v2 -> custom switches -> cherrry mx brown making a full cycle.
I don't understand what's so interesting about pointing out things you personally dislike in whichever discipline without making any attempt to justify why you think they're wrong. That's simply prejudice of the lazy sort.

I can improve on this.

Cosmology:

If there isn't any dark matter out there, there must be gremlins pushing stuff around to make it look like as there is. Otherwise there's no sensible way to explain the Bullet Cluster for starters.

If the Universe is not expanding, there must be much bigger gremlins stretching homogeneously everything everywhere out, otherwise there's no way to explain the observational Hubble's law.

If the Big Bang is wrong, there must be very naughty and ubiquitous gremlins matching somehow the primordial nucleosynthesis ratios and the CMB distribution everywhere you look at.

I would have continued with the physics section, but I can't picture the gremlins doing theory atm.

It's one thing to have a problem with whatever you think you know after reading pop sci, but there's textbooks and papers. That's way harder, but it's all there, the arguments, the counterarguments and more importantly the observational/experimental facts. You can't allow yourself to have problems with facts, if your intuition gets in the way of accepting them, just get rid of it.
What's missing from Safari in order to just implement this directly in a browser window?

AFAIK, Apple has never stepped over the line of blocking specific websites.

As soon as it's possible to reliably remote stream an interface through the browser then the App Store and pretty much any native app at all can become totally irrelevant, offline mode aside.

If a device is reduced to a touch interface, video stream decoder, and a bunch of radios... your upgrade cycle becomes essentially driven by the carrier baseband upgrade cycle, which is quite slow. Who care how fast the phone CPU runs Javascript, when the Javascript is running in the cloud?

It's like thin terminals all over again.
> I'm not sure about similar xml cli tools, but they probably exist.

I :heart: xmlstarlet (sometimes installed as that name, sometimes as just "xml"): https://formulae.brew.sh/formula/xmlstarlet#default => https://xmlstar.sourceforge.io/

The xsltproc that ships with libxslt1 is also pretty handy, although more verbose

While not quite xml, pup is super handy for doing quick html selections: https://formulae.brew.sh/formula/pup#default => https://github.com/EricChiang/pup#readme
Exactly!

This is why I started my shell. Eventually it will have the ability to run both POSIX and other shell languages in the same program.

Assuming everything is a table is overly restrictive. Assuming everything is text is the UNIX way. It's then the job of the terminal to render it.
Postal Service loses $2.2B in 3 months as virus woes persist
So, the choice was Apple vs. Android: if you want an open system, with all the isssues that accompany that, you pick Android; if you want a more curated experience you pick Apple. As an iPhone user, I tend to like these restrictions: since I picked to buy into their walled-garden, I expect them to pressure 3rd parties to integrate with the garden, rather than to plant weeds in it.
People survived fine without automobile. Taking away their automobiles is “devastating” seems rather hyperbolic. There are multiple alternatives to automobiles, such as bicycles. “Inconvenience” would be a better term.
What is it a difference of then? Shoe size?
Julia can already do this in its `remotecall` API (actually has done this since v0.1), which serializes a closure and sends it to a remote node for computing.

https://docs.julialang.org/en/v1/manual/distributed-computin...

However, this is not related to the system image (sys.so) that is used to start the Julia process, which has a compiled version of base, stdlibs and whatever else you choose to build in.
Can’t the web browser be used as the client here? Safari iOS has websockets as well as WebGL, if local rendering were needed.

I’m surprised Google didn’t develop it that way to begin with.
EA tried to play hardball with their Origin store and only recently started selling on Steam again.
Agreed this is valuable public information and should be paid for using our taxes before they’re used to pay for useless wars and more aircraft carriers
This is very interesting work. I've been looking for something exactly like this to use on a large C application -- specifically to be able to annotate various API's as sources of different kinds of data, checks on how the data types are permitted to be used together, and operations that transform one kind to another. Compared to taint analysis we want to allow more categories than tainted/untainted, and transforming items between categories. Do you have any recommendations for similar tools that work with C?
Unless the seed was used elsewhere / in another similar device.
Not sure on steam link specifically but I have streamed games from my PS4 remotely using their app.
Not that with Toshiba it was necessarily the case, but are there any Made in Japan laptops left on the market?
He says incentives and recognition began to shift by 2010, which is good to hear.

But that leaves me wondering how the linked situation occurs. It's a cliché that Google shutters projects or loses interest. I don't know whether that's particular to google or if it's due to an availability heuristic (Google is well-known, so its wanderings-off are widely publicised).

But if there are such dynamics and incentives, they are worthy of attention. Google exerts enormous gravity on the fabric of the technology industry, it would be helpful to avoid hurtful externalities arising from internal incentives.
Another aspect of this is that a JIT has to dynamically generate code to work: afaict, it's basically impossible to audit such a program to ensure that it only uses the public APIs it's supposed to use. Unless I'm wrong, the security of the Sandbox depends on such auditing being valid.
How do you avoid the Bike-Shedding problem?

Would forcing the proposer to quantify costs and benefits help?
Assuming the worst is just plain bad journalism.

Like you said, it's most likely a collection of compromised accounts collected over time (hence the odd collection of subreddits).

The article (since updated) now mentions that some of the compromised moderator accounts admit they did not have 2FA enabled.
BeOS on a 166Mhz Pentium with 128MB of RAM (luxury!) felt positively spacious. Like you were lavishing it with far more resources than it needed and so rarely risked even approaching its limits, so far as maintaining UI responsiveness while multitasking, at least.
From Minecraft Tricks to Twitter Hack