skysight-inc/HackerNews huggingface dataset:
> HP can only request that Apple revoke the cert, but there was no reason for Apple to grant this request

This is a security-usability tradeoff. Do you eagerly grant revocations, in the process protecting more users in cases of disaster but exposing yourself to the pain of false positives (like this one)? Or do you verify such requests, thereby making accidental revocations unlikely but increasing the time it takes for compromised software to get pulled?

Given revocation is more easily reversed than fixing a compromised computer, I stand with Apple’s decision to revoke first and ask questions later. But this is a preference, nothing more. Based on how Apple has positioned itself with respect to privacy and security, I imagine this is not an uncommon preference among its customers.
To be fair, writing apps that tries to throttle the use of memory is harder as you might have to let go of unused data onto disk instead of read and forget or process data little by little instead of all at once.

So, as soon as devs realize their apps fit in 1GB or something these days where even mid range phones have 4GB of RAM, they see no reason to optimize further.
> No, HP requested that Apple revoke the cert. Inexplicably, Apple complied with this unusual request.

Inexplicable!? Not at all.

Unusual? Nope.

While I certainly can't claim to be familiar with Apple's code signing program (it's not relevant to me at all), pretty much any CA will revoke a certificate upon a request by the entity that possesses the private key.

In fact, in the "Web PKI", a CA MUST do so (per the Baseline Requirements) -- within 24 hours! -- and, although I haven't read them, I suspect the "Code Signing" BR's have the same or a very similar requirement.

Now, you might say "the Web PKI BR's don't apply here" and you'd be correct, obviously. I'm not even sure if the "Code Signing" BR's are relevant in this instance -- I don't know whether this is some private, Apple-only program or something broader.

However, either way, I'll bet you a beer that the "rules" -- whichever are in effect -- explicitly state that the issuer will revoke a certificate upon request by the subject.

By the way, this doesn't even consider the case where a private key becomes compromised. In those instances, you're pretty much always obligated to notify the issuer ASAP. That's besides the point, though, as that's not what happened here.

(Note: The generally accepted way to request revocation is to send to the CA a "revocation request" signed with the private key.)
You are right. I wasn’t aware about the last bit. Thanks.

UBI universal basic income : [..] Universal basic income (UBI), also called basic income, citizen's income, citizen's basic income, basic income guarantee, basic living stipend, guaranteed annual income, or universal demogrant, is a theoretical governmental public program for a periodic payment delivered to all citizens of a given population without a means test or work requirement.[..]

So I guess this vs that that is the subject of this post is valid?

Conditional UBI vs Unconditional UBI ...would that have been a better way to word this?
Something I wonder, doesn't require copyright assignment reduce the number of contributions? What is the philosophical standpoint behind requiring copyright assignment, wrt. being part of the OSS community?

A copyright assignment gives power to the project owner to end up relicensing all those contributions as proprietary, effectively extracting free labor from contributions that were originally written under the implicit social contract of being part of the OSS community and all the Good Things that come with it.
I know we've probably all moved on, but just for the record, I saw the ad on Australian tv. It was a BHP ad. (I've seen it again since the earlier comment)
>> To go into another timeless paradigm, logical programming is famous for unexpected exponential execution times.

I have never heard of those famous "unexpected exponential times" in logic (not "logical") programming. Could you please give an example of what you mean?

I'm also not sure what you mean by "this or ensuring the type system detects determinism". What logic programming languages with a type system do you mean? Why would a type system be required to detect determinism?
X was really bad for me and Wayland has been very reliable. Good enough for my work.
Your posts are very political stuff too. If you want to be strictly technical just skip all the meta/drama and the boogeyman talk. In the post and in the comment section. It doesn't put you in a good light even if your statements turn out to be true.
Your projects look very interesting. A suggestion for your next blog post would be talk about what you want to achieve, your real intentions, and how you plan to do that. If it's just a showcase make that clear. It's unfortunate that you don't want to work with what they have now but I hope you can find a compromise. It would be great if your contributions could make Wayland even better.
Right. So if file a.php has:

<?php $MY_SOCKET_TIMEOUT = 5;

And file b.php has:

<?php require(‘a.php’); $MY_SOCKET_TIMEOUT = 10;

That’s a problem. Same with every function and class name. Oh and requiring/including a file is not idempotent because it’s just string concatenation because they are not modules. None of that should be a part of a modern language. If they haven’t fixed that in PHP 8, then it’s still broken.
The article presented evidence for the primacy of humans. That things are sticky because they are built for humans.

Your counterclaim to this piece is that humans aren't a thing that matters. Do you have reasons?
Again: bad people with modest tech skills (Hawke, the AirBnB founders) are not the same thing as bad people who are actual technologists (McAfee, Gates, Musk), or even bad people with modest tech skills who lead actual technology companies (Zuckerberg). In particular AirBnB is really not a tech company, it’s a rental company that uses fairly standard commercial/open source tech.

I think the comparison you are making, and asserting that this is a “phenotype” common in tech leaders, is baseless and silly.
My understanding is their software decisions made stolen phones worthless for resale. Except they can torn down and sold for parts to dodgy repair shops. These changes continue the quest to make the theft of these devices a worthless endeavour for criminals.

It is the case the verified repair shops are able to make these repairs and have the correct tools isn’t it?
On the other hand ꙮ has found a new use as "ornament". I sometimes spot it in pagination markers etc.
I should also mention that there is another remedy to that concern (which I don't necessarily agree is that big of one) is another cultural component of the OSS world: forking. If the party you assigned your copyright to (and remember this would almost always be to a project not an individual), you have the option to carry on (or lobby for other developers to carry on) the project from that point under the GPL, one of whose main points is to guarantee your right to do that. Given the way the community would tend to react to such an attempt, a forked project would almost certainly end up being the new de facto standard.
I believe you only need to swap the filament once for each different filament material that will be used. That's the whole point of the article.
It will take a few serious accidents that most humans would have avoided.
This is the one from Prusa https://shop.prusa3d.com/en/upgrades/183-original-prusa-i3-m...

I know three people who own this, two think it works fine and one thinks it is junk. I have been tempted but haven't wanted to burn up $300 on the off chance it does what I would want.

My original Makerbot Creator 2x has two extruders so you can do two materials, but print failures where one of the filaments stripped were more common than print successes. It was why I didn't bother looking for a dual extruder when I replaced it and ended up with the Prusa MK3S (which basically had everything on it that I would have put into a printer I built myself).
Yet another alternative to floating-point numbers
Starlink Beta Specifications, dimensions, initial impressions
If you're looking for an open-source implementation of a string-like sequence as a tree of chunks, consider absl::Cord.

https://github.com/abseil/abseil-cpp/blob/master/absl/string...

Do read the caveats in the header comments before using it in lieu of std::string.
The early evidence in humans was based on radioisotopes present in the atmosphere after atomic tests. You could diffentiate neurons in people's brains (after they died) if they had been born before the 1940s.
11. Good design is expensive

A base model of their chair is GBP 3245 (USD 4200).
I love XFCE! Thanks for your work! I love that it gets out of the way and lets me work.
You can read the post at https://github.com/samyk/slipstream
The truth is a lot of startups get started using unethical tactics.

A reason so many startups fail is because unethical methods fly over their head, they don’t even consider them. Meanwhile, competitors are juicing up their startups by using shady gray hat or black hat growth hacks. It’s like body building competitions where the serious competitors are all using steroids. If you’re just coming in all natural you will likely do poorly.

The reason black hat growth hacks work so well is because the marketing channels are not yet closed or saturated. A marketing channel is most effective when competitors are not yet using it, and since many startups are unwilling to do something unethical, there is a big window of opportunity available before it gets shut down or patched by some authority.

Frankly if you really want to build a successful tech startup you should get comfortable with the idea of doing the wrong thing first and then seeking redemption later when you’ve accumulated some wealth than to try and do the right thing from the beginning and die a pauper because someone else ate your lunch doing shady things or misrepresenting themselves. If you’re not willing to cast ethics aside to be successful then you obviously care more about being ethical than being successful, so don’t be surprised if you end up a failure.

The only time I would support going 100% legit is if you could guarantee every competitor would do the same, and I’m not aware of any scenario where that would be true.
War is destructive enough to make it all not worth it.

That's its job.

Excess preparation for war is resource distribution, with variable effects on perceived prosperity.

Stockpiling guns & ammo costs many people a lot but others make their money this way.

Not as much as actually deploying or fully waging a war though.

With military discipline and strategy another problem comes when the myth is perpetuated about this being the strongest form of discipline and best approach to overcoming objectives in other challenging pursuits.

The complete faultiness of a military-style chain-of-command for non-military purposes is often overlooked simply because when such a visible chain is in place aboard something like a corporation, it is recognizable and familiar.

Too bad.

If you want to get the most out of your resources you're going to need a lot stronger and more effective discipline than the military, and a whole lot different style chain-of-command, from top to bottom.

Preparing for exponential growth requires a naturally different mindset compared to preparing for exponential mutual destruction.
> Failing on the last 2% (or whatever small number we want to set) isn't a shortcoming of deep learning

Citation needed. Deep learning is used to power some of the biggest money making machines in the world (like google or facebook ads) and they're still bad. It's also used to power products like voice recognition and it'll still add dog to my shopping list instead of soap.
What kind of progress have we made since 2005 in preventing (not treating) SQL injection? I remember reading a book about PHP security that year where escaping strings and bound parameters were mentioned.
Basically you can always add more clauses to the license, but you need copyright to take clauses away.
I'm not a software engineer so this criticism directed at them will probably get down voted. Why isn't security - and that includes secure code - one of the first priorities in design?
BP invests $30m in technology to produce animal feeds from natural gas
I know, it's not really the same thing, but this reminded me of the RYRYRY test code used with Baudot at the beginning of teletype messages.

https://en.wikipedia.org/wiki/Baudot_code
Stories for Visual Studio Code
Sure! I was thinking in terms of public opinion.
You might be interested in this [1] 'Rise and Fall of Great Powers' - they go through the industrial output numbers in great detail from 1500-1950 and articulate Russia's constant problems at length.

And yes, Japan and China were 'way behind' as well in most of the modern era.

[1] https://en.wikipedia.org/wiki/The_Rise_and_Fall_of_the_Great....
We don't need to speculate, the Certification Practice Statement is here:
https://images.apple.com/certificateauthority/pdf/Apple_Deve...

See section 4.8 in particular. "The Subscriber may initiate a revocation request by sending an email to product-security@apple.com. The request for revocation will then be evaluated by Apple."
The Next Homestuck Will Not Be Made in Flash (2018)
The only living known species. Maybe there are other species that we just didn't discovered yet.
That ruling did overturn the specific rigid quota system which that university used as unconstitutional and therefore illegal discrimination, but that is different than ruling that it was racist because racism is not illegal in the US. Literally, going up to someone on the street and using a racial slur at them is not illegal in the US, despite it being very classically racist. As another example, the federal law against race-based discrimination in employment does not apply to employers with fewer than 15 employees who meet certain frequency-of-work requirements; mere failure to meet that statutory threshold does not eliminate the racist character of racist behavior, but it does make it legal in the absence of a relevant state or local law.

Many specific racist behaviors are of course either sometimes or always illegal, but those concepts are individually known to the law, not outlawed as racism per se.

What's more, the ruling you linked did not address the kind of quotas which the FANG company was discussing in the quoted email. The university was setting aside a certain percentage of the total and rejecting white people who might otherwise have qualified to keep room for racial minorities, which was key to the ruling. The FANG company was evaluating white people just as it would have done without the quotas, but it was simply allowing extra hiring of racial minorities beyond the normal budgets until certain targets/quotas were met. Whether this is legal or not is out of scope of that ruling. (Maybe other rulings have addressed this; I'm not sure.)
This gives me the feeling I think I would have on a holodeck- everything is superficially very realistic if you don't dig too deep.
How do you segment hobby CNC from commercial CNC usage?

Seems like “how quickly they need the job run” is a good compromise. For commercial use time is money, for a hobbyist something taking a bit longer is pretty inconsequential.

The alternative you’d suggest is just to cut the hobbyists off. How is that better?
It is hoped among Ethereum enthusiasts that moving from Proof of Work to Proof of Stake in Ethereum 2.0 will solve those massive energy usage problems without introducing vulnerabilities into the system.
TruffleRuby is an implementation of Ruby that uses ropes instead of character arrays for strings, if you want to see a modern implementation in practice.

It works brilliantly for mostly string concatenation workloads, like rendering web page templates.

Gets tricky when you decide to flatten it if people are repeatedly mutating single characters or indexing.

Cool thing is that it can provide a char* interface to a rope data structure, in order to support C extensions not expecting ropes.

https://rubybib.org/#menard2018
Styled.macro: A Utility-First Styling Library for React Native
Is there any evidence that they actually stopped him from running it elsewhere, or that they actually refused to publish it? The start of the editor's memo specifically states that they are "comfortable with publishing". And he did publish it elsewhere (on Substack). So both claims are weak.

It seems like he was looking for an excuse to bail from The Intercept, and this was it.
It's tight, but run the figures and it's possible with current tech.

We would have to be vegan, live in apartments, a lifestyle the same as many happy people today live, and even better for many people.

You'd use a lot of current deserts (particularly the ocean).

If you could sink all the environmental groups you could work on ecosystems that actually matter, use nuclear energy and make real improvements to the world.

With technology that should be very soon, like fake meats, VR, a cheap hydrogen economy, cheap medical. It could be better than today.

Of course 100 billion is just silly atm with current tech. No point thinking about it until centuries time and we have far future tech, if we need it.
Ray Bradbury Windows Unveiled in South Pasadena
Absolutely true. But the cost to prosecute an IP related civil case on average with less than $1 million USD at stake is $250k USD. With out the financial / legal support of lets say the FSF are any of the 60 or so 3rd party contributors willing to put up $250k USD to protect their 1 line commits? Are they willing to risk a quarter million in legal fees on the chance that the repo owner proceeds to trial without undoing their one line commits the night before making their claims moot?

Without financial/legal support from someone like the FSF, the only way this would proceed is if the aggrieved parties were independently wealthy or could find a lawyer to take the case pro bono.
The Phaistos disk sort of makes sense to me since, single use or not, it's (probably) some sort of script. I'm not really any kind of expert in ancient scripts or Unicodery and this was a while back but the gist I got from the docs was something along the lines of 'no one-time/decorative uses' and the eye thing looked like it was exactly that. The submission was from an academic in Slavic studies of some sort, I thought about emailing them to ask but couldn't really come up with a way to phrase what amounts to some version of 'did you mess up Unicode or what?' in a non-dickish way.
Yes, It is. It's so common, in fact, that it has a name... breakfast. Break the fast.
Long story short. US contracts (common law) require consideration (both parties give something to the other). License couldn't be contracts because they give rights without getting anything in return. That's why it's a separate concept.

European contracts (civil law) don't require consideration. Thus there's no need for a separate concept of license. (Allow me to skip the Europe vs UK debate for brevity ^^)

You can have a read at this article on a recent GPL court case in France, see section "French Law" that explains how some of the major differences https://thehftguy.com/2020/09/15/french-judge-rules-gpl-lice...

Guess I should write a dedicated article on licenses vs contracts so I can just point people to it. Is it something you would be interested in?
> In iOS Safari, using the font for entering HN comments, ℂℍℙℚ renders a bit taller and bolder for me. ℝ and ℤ render taller, but not bolder. Why beats me.

Font fallback. HN specifies Verdana, Geneva, sans-serif. Geneva has the six characters mentioned. The rest will be rendered using a different font that covers more parts of Unicode, or that covers Unicode math specifically. With the built-in system fonts, that would be Cambria Math on Windows and one of the STIX fonts on macOS.

(Source: Firefox → Inspect Element → Fonts tab of the right Inspector pane. Chrome can do that too in a slightly different place, macOS Safari is too user-hostile to have this feature.)
You'll want to test against stable API/ABI, and use positive and negative testcases. The problematic parts are mocking, simulation and how tests affect the codebase.
> ... how closely do CAs look at requests to revoke certificates?

If they want to remain a CA, very closely!

--

Per the (Server Certificate) Baseline Requirements [0]:

> 4.9.1.1 Reasons for Revoking a Subscriber Certificate

> The CA SHALL revoke a Certificate within 24 hours if one or more of the following occurs:

> 1. The Subscriber requests in writing that the CA revoke the Certificate;

> ...

The Code Signing BR's [1] have almost the same requirement. For code signing certificates, the CA "MUST*" revoke the certificate upon request "within one business day" (cf. 13.1.5, IIRC).

I'm not sure if this particular certificate falls under those BR's or not, though (see my other comment). My guess would be that it does not.

--

[0]: https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-... (PDF)

[1]: https://cabforum.org/wp-content/uploads/baseline_requirement... (PDF)
> I stand with Apple’s decision to revoke first and ask questions later.

There are only 2 reasons to revoke a code signing certificate:

1) The private key is compromised.
2) The owner of the certificate is signing malware.

Obviously HP is not a malware author, so unless HP emailed Apple and said their private key is compromised, there's no good reason for Apple to revoke the cert. There aren't questions, plural, there's only one question.
People are working to include Kaypro's 2x4 mosaics for the next release.
iFixit – Smartphone Repairability Scores
I extended it to engineering and marketing fields: https://neil.computer/notes/good/

It's a stretch, these principles are just extremely abstract and perhaps even non-actionable; the devil is in the details :-).
THS, specifically, seems to me less about moral relativity and more about coming face to face with a naked Will to Power.
What other service do you use?

I use it mainly because I have a Pixel and the integration is great. I love at AI search/tagging.
I asked a related question last week - https://news.ycombinator.com/item?id=24883463. See if you find anything relevant in answers.
MIT/BSD licenses allow for proprietary forks. The most popular BSD-based kernel is Apple's, which isn't distributed under the BSD license. The most popular GPL kernel is Linux, which still is.

So with the BSD license somebody can take your work, improve it, distribute it under a proprietary license and supplant you in the market. Compare macOS or iOS installed base to FreeBSD.

But then the codebase is henceforth tied to that company. If Apple is dead in twenty years then probably nobody is still using the iOS kernel (and not because they switched back to FreeBSD), but if Google is dead in twenty years most likely Linux is still popular all over.
There's about 300k bitcoin transactions happening per day and apparently a few million active users. So about a very small fraction of a percent probably.