skysight-inc/HackerNews huggingface dataset:
I've often heard HNers state that Project Zero is unwilling/uninterested in protecting the interests of the vulnerable host, but this seems like an excellent case study where Github, the host, just doesn't think this is a big deal. I think that applies to any host who doesn't patch their vulnerabilities - if they thought it was a big deal, they'd do something about it. Actions speak.

Quoting from the post:

2020-07-21 Report sent to Github and triaged by Github security team. Disclosure date is set for 2020-10-18.

2020-08-13 Project Zero requests a status update.

2020-08-21 Github say that they are are still working on a fix and a deprecation plan

2020-10-01 Github issued an advisory[1] deprecating the vulnerable commands, assigned CVE-2020-15228, and asked users to patch and update their workflows.

2020-10-12 Project Zero reach out and proactively mentions that a grace period is available if Github wants more time to disable the vulnerable commands.

2020-10-16 Github requested the additional 14 day grace period, with the hope of disabling the vulnerable commands after 2020-10-19.

2020-10-16 Project Zero grants grace period, new disclosure date is 2020-11-02.

2020-10-28 Project Zero reaches out, noting the deadline expires next week. No response is received.

2020-10-30 Due to no response and the deadline closing in, Project Zero reaches out to other informal Github contacts. The response is that the issue is considered fixed and that we are clear to go public on 2020-11-02 as planned.

2020-11-01 Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future.

2020-11-02 Project Zero responds that there is no option to further extend the deadline as this is day 104 (90 days + 14 day grace extension) and that the disclosure will be today.
How I am able to earn 5 times more money than AdSense using an ad network?
Who Is Auditing the Auditors?
What does that look like in this situation? I agree, in theory, but _how_ is it applied to a divorce? How does it apply to the financial power imbalance of 'breadwinner' and 'active parent?'

I'm also curious, what is the 'vice' in this statement?
Career Curve of Software Professionals as Bell Curve
My GH workflows are a thin layer over the `run` action that runs shell scripts. Not only does my CI not have to rely on third-party actions, it's also extremely portable between CI providers, can be tested locally, and is infinitely more flexible.

(Apart from having run actions, the only other actions I use are the upload/download-artifact ones to share binaries between jobs, and the matrix feature for parallelizing runs.)

But to be clear, the kind of vulnerability that the P0 issue is talking about is not necessarily from malicious actions. As the issue itself says, the vuln also happens from untrusted input being processed by a trusted action, like issues and PRs.
There are dozens to hundreds of regulations governing the activities of retail establishments.. the requirement to enforce mask mandates is only one.
The crux of the argument here seems to be that the author doesn't want to pay 650euros a month in child support for his kid. I have very little sympathy. The important person in all of this is the child, not him. His life is going to suck and he'll have no money. That's unfortunate but if the choice is between his life being rubbish and the child's life being rubbish it's a bit of a no-brainer.
Closing doors on passenger elevators are limited to 17 ft/lb of kinetic energy for safety. Opening speed is not limited, and most high-use elevators open the doors much faster than they close them.
Isn't that profit for shareholders taxed as cap gains?

Edit: I mean, if I own a share I pay taxes when I sell it and make money
A Time of Reckoning for Some Emergence for Others, Biznessvibes
You know other countries also have multi million dollar companies too. At scale, I don’t ever see them importing American talent because ‘no one else can do it in our country’. It’s just pure bullshit, there’s 300+ million people across a lot of these countries. At scale, the talent is there, in every country.
Actually, except for Firefox, everything pretty much is Chromium under the hood these days.
Well, cookies are not per se evil and you can use them in a privacy-friendly way. You should ask for consent for non-functional cookies (for the Cloudflare cookie you probably wouldn't need to ask for consent, for example) and make sure your consent workflow is compliant with the GDPR. The European Data Protection Board just published guidelines on this btw (in May): https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_gui...

We e.g. offer an open-source consent management solution that is compliant with GDPR (as much as you can say that with confidence) and which you can self host: https://github.com/kiprotect/klaro

Building sites without cookies is possible but it's a bit extreme IMHO. Properly scoped and limited first-party cookies do not pose a large privacy risk to indivuals and can make certain legitimate use cases like analytics much easier (or even possible, in some cases).
I love how everyone complains "divorce is so unfair", but Mens Rights is considered a slur.
Sorry, I just couldn't read it from my mobile since the page doesn't seem to adapt to it :(
I've only seen Pi's used for hobby projects.
Can someone help me understand what 'infringement' app/project they are accused of being used for?
Really is a shame to see this common thread of most Western family court systems not caught up with the times; despite the workforce effectively doubling in the past 60 years, the financial burden is still unnecessarily placed on the man, many times to the point of their financial ruin. Yet this is never covered in any media ever. It's no different here in the US. And then some states like CA have truly bizarre things like "no-fault" (I think that's the term) marriages where after 10 years of marriage, the woman can initiate divorce for whatever reason and it always results in their receiving 50% of the husband's assets, and alimony, and the husband has no recourse at all (you can see many examples of this in celebrity marriages throughout the years).
It was actually discussed quite openly and in detail in the original paper [1].

[1]: https://www.nature.com/articles/s41550-020-1174-4
I know that it's gauche to comment on downvotes, but FFS getting downvoted for my comment is a snapshot of why this pandemic has been so bad.
A nameless hiker and the case the internet can’t crack
The standardization that you mention is the problem. The court is supposed to evaluate each case separately, not on a misguided one-size-fits-all policy.
In Poland, Czechia, or even Germany - yes. In Italy and Spain they're lucky if even have a developer job and that would be considered a good salary.

1200 for shop assistant is rather unlikely.
> WHY aren't people taking action against ISP monopolies?

Mainly because ISPs are not engaging in viewpoint discrimination. They don’t care what political viewpoint you have, as long as you pay them money, they will let you post it on the internet. In addition, most people have become used to the prices and expending a bunch of political energy to save $30/month isn’t worth it to a lot of people.

Now the feeling of being censored, on the other hand, generates a visceral reaction, and people can be convinced to expend a lot of political capital for that.
Before he said no one needed multicloud, now the prediction is it will happen because it's necessary.

Well what is the value of that? Last year I knew it would happen because I started hearing first hand from people who were increasingly using multicloud.

One frequent scenario is when companies hire new staff used to one cloud and has existing apps in another. If the app can run anywhere it will likely run where the staff can deploy and manage it easier and cheaper.

Multicloud vendors are needed because there's value in being able to abstract certain functionality or parts of the stack across hyperscalers.
Economics are an emergent property of human existence. Which economists math do we listen to? Those in love with profiteering? I suppose if that’s your side.

The same way we are distributing information, we could better distribute literally to normalize human condition.

But profits demand we fill stores with gadgets versus TP.
I wonder when they'll ban laptops and PC's.

The ammount of infringement going on on those is off the charts.
Because foriegn money driving up prices is a different problem and requires a different solution.
Thanks for “educating” myself, a Chinese, about how a story goes by Chinese.

I wonder how many non Chinese people holding the same analytic rigorous as yours, claiming a story as authoritative over other interpretations, which were held by actual Chinese...

That’s manifested in popular culture, like in the well received, yet awkwardly dismissive to many Chinese people, movie “The farewell”. It has this line of thought that the life of a Chinese belongs to his/her family, and so the old granny were deprived of knowing her cancer diagnose. A hilariously nonsensical idea.

People were hiding from cancer diagnosis, because cancers were thought to be death sentence, and for many who were deemed financially impossible to afford the treatment, or is in a terminal state that death was inevitable, people were hidden from that to help them live a relatively less stressful last stage of their life.

The nonsense of “life belongs to family” is such a fitting story goes by Chinese, according the western perspective...
It was the only choice that met the performance constraints at the time.

And the common sense at the time did not put too much focus on memory safety.
Can't speak about all those applications, but from my (brief) experience in supporting engineering applications running on the compute cluster of a large car manufacturer in central Europe, I can say that setting those applications up / configuring them for batch processing might not be exactly trivial, but we did succeed eventually (sometimes with the help of the original developer) with all requested ones. Windows is used in this context only on the engineer's workstation -- in the cluster it's Linux only (no other *nix in sight).
No, morals are relative, just that. We probably have similar morals as frequenters of a tech website site in English compared to hunter gatherers, so we can even have this discussion in the first place. I haven't been convinced that there's anything universal about the morals we hold across species let alone sapiens in the past 10,000 years or across cultures.

Unless your definition of moral absolutism only encompasses humans living today (with the implication that technology makes certain things possible), which I might agree with.
GitHub has been nagging about needing to fix this for a week or two.

Just in case anyone is interested here is what the fix to rclone's build workflow looked like:

https://github.com/rclone/rclone/commit/a152351a71ce21090a3b...
Dockerfiles are far simpler than the Nix language. Likewise, sure, FreeBSD had jails first (and for a long time!), but they are more difficult to set up.

Docker allowed reproducibility to be accomplished by a person who likes the idea of it, but will shelve it if it doesn't work within an evening. This describes me, for example. I think it took off for that reason.
Why would anyone pick this over say Python.

Call me pessimistic , but I can't imagine the appeal of a closed source proprietary language when so many good open source ones are free.

It just seems like really nasty Vendor lock in.
What if that's both? What if it's neither? What if is the higher earner that sacrificed an even higher position - do you make the lower earner pay them?

There are other factors involved too.
If you wanted months of uptime in the early 1990s it had to be some kind of Unix - even Linux was not yet reliable enough.
He points to Intel’s Sapphire Rapids as an example of hype-driven engineering versus the kind that could pay real dividends for broader HPC. “Maybe in their second generation they’ll put high-bandwidth memory in the CPU, but why did that take so long? It’s been available for years. We think this is attributed to LINPACK, for needing higher rankings. And now they’re just thinking about dense linear algebra and not about memory or throughput or how the memory and cache can allow these vector engines to work effectively. That’s just bad engineering. If we continue like this, we’re just going to keep wasting resources.”

To be fair, NVIDIA is also guilty of this. Their marketing is highlighting their tensor core units, claiming order-of-magnitude speedups on deep learning workloads, when in practice, workloads that involve convolutions are actually memory bandwidth bound and will not see a significant benefit.
It’s not a people problem. eBay used to make bidding or even Buy It Now a contractual obligation. If you bid/bought, and didn’t want it anymore it was too bad for you. You would be charged for it anyway or lose your account.
Done. https://github.com/alire-project/alire/issues/603
HN is small enough that timing matters even more than on Reddit. So a script would have to take that into consideration. HN also works against duplicate posts, so a post at midnight US eastern time wouldn't see much activity, and then reposts later in the morning would only add to its upvotes rather than getting new (better timed) listings.
My guess is Kodi and MAME boxes. They're big for retro gaming or media centers.
Only baffling because you dont fully comprehend how much communication monopolies control they playing field by financing both political parties. Not behind my computer, but look up the legal bribery that has prevented municipal broadband in the US. I worked for Cox when this was a thing back in the early 2000s. There is no amount of money they would not spend to subvert competition.
Stealing the Election Game (Iffycan.com)
Tends to vary by building in London. Gigabit fiber is available in a decent portion of them. (Though tends to be more in the 700-800 range in practice)
So the question becomes then why people believe so much this - "that those monopolies are too rich and powerful to be attacked by politicians" - to not act, while they, the same people, don't seem to have similar beliefs in other issues.
It's great I didn't invest a moment with this vaporware.
Nepal's “magic” surgeon brings light back to poor (2012)
> "Japan's easy geo spots are already all famous Onsen towns and tapped. Sure it happens, but geothermal cannot pull much weight."

At least one agency of Japan's government disagrees:

"The Japan Oil, Gas and Metals National Corp. estimates the country’s geothermal potential at 23,400 megawatts, putting it at No. 3 in the world... However, Japan has an installed geothermal capacity of only some 500 megawatts"

https://www.japantimes.co.jp/life/2019/03/09/environment/unl...
So it worked despite all the bias and fraud. You could even call it luck. The reproducibility implied by the fact that at least some of it is true is not a "nice-to-have", it's the whole point of it working. We wouldn't call it true if we couldn't confirm it to be true.

To me it seems you're conflating reproducibility with insight. Of course insight is also key, and it may be useful even if it's wrong, as long as it causes others to recursively have new insights and create hypotheses and do experiments that eventually turn out to be true.
ISPs are "natural monopolies" like water or electrical companies, especially in areas with low density. This means that even a level playing field was not enough, because small competitors can't afford the cost of building their own infrastructure (nor would we want them to lay redundant cables). Measures like Net Neutrality are ways of keeping the natural monopolies from abusing their position to gain advantage in other markets.

Here Biden clearly seems to be for net neutrality while Trump is, obviously, against it. So it's not as if this issue is not visible to both candidates. It's just never spoken about in terms of "monopoly" because there's no clear way to eliminate natural monopoly without a ton of regulation (e.g. sharing the last mile) or outright public takeover of the last mile infrastructure.
> and they break more often than unit tests.

That isn't my experience, unit tests breaks all the time and has to be rewritten from simple refactoring while larger tests pass as long as you keep behavior the same. This means that the bigger tests are way better for refactoring and safely making changes to your code. If most of your tests are unit tests and you don't have bigger tests covering the same things then refactoring safely is hell.
I mean, no one can expect different thoughts from financial gamblers. Jack Ma was totally a non innovative person. Like his whole enterprise so far is following western examples and the playbook. Now he is happily adopting the financial revolution narrative, disguised under the tech innovator facade.
I know that spammers, PR firms, marketing teams, etc will buy accounts with good karma(for how much, I don't know). I wonder approximately how much $/hour a good karma farmer could generate with techniques like this? Could it be an alternative to mechanical turk for some?
> end-to-end tests are slow as well as difficult to write+maintain

Citation needed, sounds anecdotal.

End-to-end tests should run as fast as any given use case (for most software, that means relatively quick), plus some set-up time as testing overhead. But that testing overhead is often self-inflicted and can be managed. I have anecdotes to prove it.

For the speed to write end-to-end tests, shouldn't they be the easiest to capture? I need the system inputs and I need to capture the system outputs. If you imagine usage-driven development, then the last step is to capture your initial state, use your new code, capture the final state and voila, here's your new end-to-end test.

> your important business logic

Consider the reality that no one cares about your backend. No one. Is it correct enough for the application is the only business question concerned with the backend (and most applications have a HIGH fault tolerance).

What does everyone care about? Your frontend. The colors, dropdown box or search field. That column should be over here. Focusing your testing on the parts of your application people could shrug about is not sound reasoning.
The first time I saw a Sun was in '87/'88 and it was a demo during the Vision class in the final year of my CS degree - what completely blew me away was the size and clarity of the screen and the fact it was running Unix.
All I can figure is, I know that there's a tree harvesting device that picks the trunk up vertically and cuts it to lengths before dropping it.

Maybe there's a model that's twice as wide as the distance between the rows, and they're going to take out every second row and every other tree. But then it's driving over trunks and leaving an awful lot of logs on the ground behind it...
Will training the immune system against allergens help fight real pathogens better? Can childhood exposure to pets, camping, gardening or even supplement pill full of allergens boost total immune system function?
What is new in Qt Quick 3D 6.0
Oh definitely an innovative project and I think F# is such a good choice for the purpose.

Hope it works out!
Nuclear ION reactors are orders of magnitude more efficient. I think you’re being confused by not actually modeling what’s going on.

Smaller nuclear detonations are less efficient in that they directly liberate less energy from their fuel. A nuclear explosion in space also radiates most of it’s energy as X-Rays which on earth you heat the atmosphere but in space mostly just do nothing. So their directly turning less nuclear energy into motion. Further, a smaller percentage of that force is then collected by the pusher plate compared to the Bell nozzle at the bottom of a traditional rocket. https://en.wikipedia.org/wiki/Bell_nozzle

Now as nuclear is so much more energy dense than chemical energy on paper they look better. But compare ISP’s and you see just how much energy is lost.

All of that can be simplified by just looking at ION thrusters ISP and vs the ISP of hypothetical Orion rockets. At that point it’s just a question of what percentage of mass is reaction mass vs the reactor + fuel and it turns out you can get reaction mass well over 80% making at least 60% more efficient before considering the pusher plate assembly’s mass vs physical ION engine’s mass.

PS: And that’s when looking at existing ION engine designs. Hypothetically, you could eject matter at a large fraction of C using energy giving orders of magnitude higher ISP, at the cost of lower energy efficiency etc.
Most GPUs now have hardware backed support for DRM. That's why those GPUs get 4K Netflix.

The compromise of Apple's T2 chip was significantly overstated.
Aren't the two distinguished in the billing? And AFAIK you can get 'just an xray' from one provider then contract another radiologist for the analysis.
This is the result of government corruption. For example: the government paid ISPs $400 billion dollars (!) to create a nationwide fiber network, and the ISPs pocketed the money and didn't do it. No investigation into what happened or anything. The money is just gone. Clearly corruption is the only explanation. Politicians have been bought.

Why voters don't know/care is another issue, but it might have something to do with the fact that the news media has also been bought.
A Complete Guide to Start a Blog and Earn 6 Figures Online
On the other hand, the "PC Master Race" gang is a home/enthusiast demographic and from their perspective, they're probably correct.

They don't need that value add from workstation companies. And heck, they probably welcome excuses to tinker on their workstations.

And this is great. It keeps the open, build-able computer market going -- contrary to the alarming trend of locked down computing devices.
> I felt pleasantly surprised and never felt like there was anything bad about the language itself.

I mostly only miss modules/functors, and being able to use them for abstract data types.
Building Synthetic Life
They have a reasonable historic reason to be extra sensitive with xenophobia.

I'm not saying its the correct ideological position, but it sure is understandable.

If you consider the structural and institutional racism in the US, and how many innocent people die because of it, one could wonder what the lesser evil is.

IF it would work. But it doesn't. It actually increases polarisation and radicalization. The more you treat the population like idiots the more they will become that.

The best strategy is always for the state to lead in humanism, by example. By showing mercy, patience, tolerance and respect.
> Anytime a new workstation makes the news (see Apple's latest workstation).

If you where talking about Workstations from the usual suspects (HPE, Dell) I'd agree but Apple really do put a fantastic markup on their kit.

There are also a lot of people buying those Apple Workstations where they only need one or two of them and someone like Puget could build something faster for much less.
Reddit calling it karma is a throwback to its early days when "upvote posts that meaningfully contribute real value to the discussion, even if you disagree with the content" was a closely held ideal of the reddit community. Sort of closer to how Stack Overflow upvotes are currently intended.
Indeed, if that timeline is to be believed—and I have no reason to doubt it—it’s pretty damning. GitHub just kept putting it off. When they asked to delay the disclosure indefinitely at the very last second, of course they were told that would be unacceptable.