skysight-inc/HackerNews huggingface dataset:
A couple of reasons, first government messing in business is almost always a disaster.

Second, I don't ever want to work in a union environment again. If I don't want to join a union it should be my choice, but as soon as one exists you get this "you Vs the union" mentality.

"Sorry, he was harrasing you? Well, he's in a union and you are not -- so we have to support him".

It's bullshit and horse shit, just look at people getting attacked for working in the UK during the 70's.
On older platforms(High Sierra), brew builds from source most of the time and I just built node(latest) on a i5 MacMini 2011. It took 76 minutes.
As another example, Taler supports this exact requirement, without bringing crypto into the mix.

So does UPI in India. Banking transactions ask for my credentials on the bank website (after a redirect).

None of this needs cryptocoins.
"When other entities in the cell notice the SARS-CoV-2 spike protein floating around, they see it as a threat." Anyone know why the immune system identifies the protein as a threat? Especially since it was just manufactured by the cell's own machinery?
There are free to play Multiplayer games, where microtransactions are for skins and other cosmetic stuff. Thats fine by me.

In other games, you can make progress faster if you pay. That is more annoying, but still no pay to win, or dishonest.

But all those lootbox games and arcade ones, designed to lure you into more buying, well, everybod gets what they deserve.
As mentioned in other comments, CSS does not run scripts. In this case, it is just used to store the content of a script as a string in a custom property, which is then retrieved by another script, and run.
If someone can insert an eval() in your website, the battle is lost and they can do other evil things. Sure it defeats this one particular obfuscation method, but the ship has already sunk at that point

(To be clear, not dissing on CSP, its great, but it can't stop all attacks)

Now if script-src CSP prevented the script tag part of this attack, that would be a good thing CSP can potentially do (depending on what type of access attacker had).
It looks like the inhibitior lock stays active. But the design is safe against clients that crash or otherwize exit without uninhibiting.

A nice feature request for logind would be an extra optional parameter for the Inhibit call that makes logind require the inhibitor to periodically write to the returned fd to keep the lock from going 'stale'.
That specific example probably originates from Tolkien.

J. R. R. Tolkien: A Biography:

> When [Tolkien] was about seven he began to compose his own story about a dragon. ‘I remember nothing about it except a philological fact,’ he recalled. ‘My mother said nothing about the dragon, but pointed out that one could not say “a green great dragon”, but had to say “a great green dragon”. I wondered why, and still do. The fact that I remember this is possibly significant, as I do not think I ever tried to write a story again for many years, and was taken up with language.’
Calling Google benevolent is laughable, but even if the aren't the most highly paid workers, these still pretty highly paid workers are stretching the original function of a union to my mind.

Its almost like unions are highly politically motivated and only there to feed the pockets of the political parties that run them, and not to protect the stable salary of workers.
Hi
My name is Per, and I am the creator of Cognifirm. First of all, you should know that I appreciate your reflections and on our product. Also, some of you were expecting a PHP error on our website. We have switched to a different version without the video link that created that error. I am sorry that you have to experience this.

Anyway, feel free to ask me any questions you might have.

I will also get back to you in the threads where it makes sense to do so.
Cheers.
Per
New Function() is just another name for eval(). It has nothing specificly to do with css.
When the Text and HTML Disagree
Covid-19 Vaccine Trials Are a Case Study on the Challenges of Data Literacy
A command-based interface is one alternative, either a text box or voice control (Siri/Cortana/Alexa,Google assistant etc.). But it's always something you sacrifice. In that case I think it's overview, especially when multi tasking.
Another is full screen applications, pretty much what we have on phones and tablets. Accessable VR/AR might open up new models.
Haha fuck those guys, they don't have real expertise
Again, context and surrounding requirements are important to consider here. I'm not saying that it's always like that, or it's like that everywhere. But most internal CRUD apps could do with worse UI and still provide the same up front/bottom line value as some internal CRUD app with slightly better UI but requiring a developer to implement.

Sometimes the cost for making the UI better costs more than the value you get from having that UI better. It's not a black-and-white "Better UI is always better", it simply depends on too many variables to have that frame of mind.
Yep, this works.
Because the skimmer developer wanted to obfuscate their code a little?
I don't suppose you'd count something like the da Vinci robots as a step forward? I got to try out a demo unit once (on a dummy! not on a real human), really cool stuff. I'm really glad I tried it _after_ I had my laparoscopic appendectomy - it was somehow a little terrifying how clumsy it felt holding the "regular" tools used, compared to using the robot.
I am reminded about XCOM, which some players complained about being unfair, too. In fact, the game is cheating - but in favor of you. (first enemy critical hits get negated and after someone of your troop dies, the rest gets better chances of surviving and so on)

But actually, I don't like that behavior either ..
Customer: My lightbulb isn't working!

Software engineer: That's odd, our reference lightbulb is working perfectly.
Okay but what is the purpose of this code? why would you eval() CSS?
That's silly. This attack would be much easier to pull off with cryptocurrency.
First: Here in Australia no major ISPs provide a native IPv6 service, and if they do, they don't provide it to business. It's obscenely difficult to obtain IPv6 in Australia. None of the major telcos do it, you have to go down the list to like the 5th or 6th biggest ones before it becomes an "experimental option" for residential connections only.

Second: Ever since IPv6 has been a thing, I've offered to customers the option to turn it on for free. No added charge. We'll just flip the switches and it's there. Not one customer, ever, has said "yes". They've all actively refused to turn it on, for any purpose.

Third: The few times IPv6 has been forced upon our customers, mostly due to Microsoft Windows DirectAccess, it was the network administrators frothing at the mouth, ranting and raving about how they don't want to do it, that DirectAccess should use IPv4 (I'll call Redmond and I'm sure they'll get right on it!), etc...

Fourth: As you've mentioned, AWS, Azure, and GCP had practically zero IPv6 support until very recently. Now, they have broken IPv6 support which is worse than useless, because it gives the impression that the problem is with IPv6, not with the people holding on to an appreciating asset of IPv4 addresses that they intend to use to lock out the competition.

TL;DR: IPv6 is held back by a combination of bad ISPs, lazy network admins, and monopoly seeking public cloud providers.
A large portion of those who get COVID19 do not even feel any symptoms.
Isn't Google's name Google? I'm not a fan of huge corporate entities as much as the next guy, but none of them are nameless.

Did you mean: Faceless?
The purpose of the code is to steal credit cards.

> why would you eval() CSS?

It’s really as simple as “because you can”. This is just an obfuscation technique.
Way too expensive for my budget
If Googler's did manage to unionize what would be some of the biggest changes that would happen at Google as a result? I'm an outsider so I don't have much of a picture into how employees feel about Google. But I am curious about the bigger picture. Feel free to make a throw away if anyone wants to post
As I understand it: --script is just the name of the variable. JS has the ability to look up variables from CSS. --script could have been --helloworld, think of it as a selector (if you're more familiar with CSS than JS), which is then grabbed and evaled by the JS code.

> Is this some pattern with a popular JS framework?

I've never seen this anywhere before, JS grabbing values from CSS, but I mostly done ClojureScript development for the last 2 years.
The GP didn't say 2 weeks to effective, it was for learning the basics. Or do you disagree with that as well?
It's great to see the focus on privacy, but while Mojeek claims that its technology is new and was built from the ground up [1], it seems to fall down some of the same holes as Google. For example:

https://www.mojeek.com/search?q=shirts+without+stripes

Good luck to Mojeek, but at some point we'll need to have a search engine that's not dumb as bricks five times a day.

__________________

[1] Mojeek's technology has been developed entirely from scratch by Marc Smith, mostly using the C programming language, and uses no pre-existing search or web crawler technology. All technology and IP is fully owned by Mojeek Limited.

https://www.mojeek.com/about/technology.html
Yeah, the accounting is there, but not the actual transfer. I.e. you're not transferring the actual money to France, which the French finance ministry would then have to send back to the German one once it got it from the French company (in order for the German one to give it back to the company buying the product).

And the accounting is there because of tax fraud, I guess. And I also guess that the US has a similar accounting system where they have to report the amount purchased per tax bracket and the IDs of the companies they bought from.
It doesn't look for `--script`. The hackers just retrieve the value of the `--script` value in JS and pass it to `new Function()`.
From my understanding, the code that the devs wrote is not to steal credit cards but to create some UI, however they do it in such a way that JS hidden in CSS that would normally won't run. gets run and which results in credit cards being stolen.
Nope, that is not what I'm thinking about. B2C applications have different constraints, sure, but that's not really anything to do with this.

> If you look at the output of many software agencies, most of what they are producing is simple CRUD applications (and some startups do this too, I guess) which probably could be built by the users themselves, if it's basic enough.

...said every business manager ever. It's simple! Let the client configure it! [And normally] let's burn an absolute shit-ton of cash building unecessary things!

I'm sorry to be dismissive here, but B2B UIs almost always have to reflect very specific business rules, they require careful turning for the clients. This doesn't mean they needs to be complicated, but they will have complexity.

If a company allows their client to use a no code framework to build the UI of the product they are selling the client (I stress this is what is being suggested here, I am absolutely not saying that the UI itself cannot be built using prebuilt components), then there is another UI required to underly that, then an API/various APIs, etc, inception style. What the company has to build is a general framework to allow a client to use a framework to use the company's tool.

By analogy, if a business is selling a tool, sometimes yes, it is correct to sell the parts of the tool instead for assembly by the client, but this adds an enormous amount of complexity to the product production and maintenance. More often selling the tool itself is the better option.

Other commenters have noted how "no-code" tools will lead to productivity wins in some cases, as it's done for all similar tools in the past.
Did anybody plan to breathe polluted air and experience climate change? The more people there is, the harder the impact on the environment.
Interesting find! Thanks
Well, those lava lamps are cool looking, but that's about their only value. A 256-bit seed is enough to generate all the random bytes you'll ever want: just use Chacha20 with fast key erasure, and you're done. (Fast key erasure crash course: start with an encryption key and a stream cipher. Encrypt 512 bytes worth of zeroes. The first 32 bytes of the ciphertext are your new key. The rest can feed /dev/urandom. Once a byte is served, erase it. Once you run out of bytes, generate 512 more bytes. New generators can be forked off by simply requesting 32 random bytes.)

From https://blog.cr.yp.to/20140205-entropy.html

how can anyone simultaneously believe that:
- we can't figure out how to deterministically expand one
256-bit secret into an endless stream of unpredictable
keys (this is what we need from urandom), but
- we _can_ figure out how to use a single key to safely
encrypt many messages (this is what we need from SSL,
PGP, etc.)?

I don't. Those lava lamps are cool looking, but that's about their only value. We don't need that many random bits.
There's a plaque on the wall next to the lava lamps that explains the connection.
Which is why I usually writw the CSS completely myself (at max reusing my own css cose). I want to know the things I built, both for security and in case something doesn't work.
Ha, sorry pieter, I didn't know about it being a ripoff, I guess I was one of the confused ones.

I can't edit now, should I ask @dang to change the url to remoteok?

Sorry for the slip up!
Because any kind of predictable noise can be easily calculated and removed. And randomized noise that changes on each call can be removed by making the call multiple times and averaging out the values. So a constant noise value isn’t the worst possible idea, as long as it cannot be retrieved of course.
You can see the code in the tweet linked earlier. The hackers injected a small JS snippet on the page that fetches the value of —script from the CSS and evals it.b
I think we'll still see some people doing NAT66, unfortunately.
But your point about not trusting an app is the same. At some point you’d need to trust some app.

If your problem is the bank’s app something like PSD2 will solve this by allowing you to connect to the bank directly and having your own app, right?
Don't confuse long-range www traffic with the total number of endpoints. Serving a single page might take dozens or even hundreds of interacting services.

Not one of our enterprise customers has IPv6 enabled.

Not one of the public clouds we manage have IPv6 addresses on their virtual networks.

Meanwhile, putting a CDN in front of an otherwise 100% IPv4 web server will add an IPv6 address whether you like it or not, and that traffic will contribute to those stats you mentioned.

This article is about public cloud providers hoarding IPv4, which applies to things like the PaaS and SaaS services, internal APIs, etc... which are nearly 100% IPv4 in all three of the big public cloud providers.
> An adult working full time on acquiring a language can learn to use a foreign language at an adult level within maybe a year or so. It's just that nobody does that, because there are other things to do...

...

> There is one major disadvantage that adults have though, and that's at acquiring correct pronunciation. I think I've never met a person in my life who didn't learn a language from a very young age and who didn't sound slightly off to a native speaker.

I think an adult working full-time on their pronunciation would get within the native range of variation fairly quickly. Even native speakers only adjust their accent very slowly after moving to a new area, but accent coaches can speed up that process a lot. It's just that it involves a lot of tedious practice consciously controlling your tongue when you'd rather just speak freely and have your subconscious take care of tongue movement. So most people who do that are actors or public speakers, for whom pronunciation matters a great deal. The average language learner has better things to do...
Studying grammar is studying the building blocks of what defines the way think about reality —- language.
The article calls stickler anyone who’s interested in the intricacies of grammar. Multiple times.
Since some people are very mobile and others are not, it is possible. But what would be the point of further discussing it?
Black and white ;)

It's more like 80% / 20%. The disparity is huge, documented, and factual.
Yup. Go for the most boring hardware you can. No fancy GPU. Or be willing to spend time editing blacklist files, or writing your own rmmod/modprobe hooks for sleep/wake.
The Trend in Darkmode Adoption Is a Sign for a Huge Demand for E-Ink Technology
> Where you think processing the data just means loading up an excel table (or running a CSV through R)

Is it possible you could construct an even more ridiculous straw man?

> I am certainly frustrated with the speed as well... Yes, maybe it could be faster.

Oh, so you agree with what I'm saying and your problem is the straw man argument you created.
They are local maxima for normal people. No reason to believe better global maxima don’t exist, or that they can’t be improved to work better for more people (e.g., better accessibility features).
Maybe point a strong laser at the cam instead so its "blinded" and all pixels have max brightness. Or even destroy the sensor with a laser, that way it may permanently produce non-random data.
I can understand why I got downvoted. I might have come across as an EV hater. I'm not one. I do appreciate the technology and acknowledge that it's the future. I was pointing out some of the flaws. I don't argue against the torque figures and everyone knows that EVs have more torque. Even the base model Teslas are faster off the line compared to some of the ICE super cars. I'm hopeful that we generate electricity from more renewable sources than burning coal or gas, which defeats the whole purpose. Long charging times, range anxiety and battery longevity are real issues for customers. I don't know if durability of electric motors for these sort of applications haven been proven yet. Hydrogen based EVs can fix most of these problem. But only if we can create Hydrogen more efficiently.
What's specific about the beer can? Couldn't any material be used for a pinhole camera?
For web serving it's possible to have IPv6-only server accessible to anyone. Just use Cloudflare. I'm not sure it's documented but I started using IPv6-only origin server behind Cloudflare and it seems to work OK for people connecting both IPv4 and IPv6. The client IP is in CF-Connecting-IP, even for IPv4 connections. For me it just works.
* known to humankind?
* successfully developed?
Why would they fetch --script from CSS instead of getting the information from the DOM and sending it to their serves straight away if the can already put a JS on the page that gets executed?
> I find it really disconcerting how many people on Hacker News want a corporate entity to decide what information is deemed acceptable to know.

It's up to a corporate entity to decide what should be in its platform though. The issue in the case of Youtube (and other social platform) is that there are a few players that get much of the cake, so their decisions have wide effect. It is this last point that should be addressed in my opinion
Nice research! Was that trick with mutation observers necessary however? If they add a constant noise vector, all you have to do is creating a canvas with known data, then call toDataURL() and compare what you get to the original data?
I think he must have sold it for couple of mills at minimum.
Linuxfx / Windowsfx 10.7 Plasma running virtual assistant
This is an obfuscation technique, it’s not supposed to make sense.
Around March I already saw some reports detailing the different strains of the time.
h e t e r o d o x
Better usability is always better.

The UI directly affects usability.

If a problem is so straightforward it doesn't require designing, sure .. then go ahead and let anyone build it. If not, find someone who has spent time solving similar problems successfully.
"Passionate" is usually BS for "has no boundaries and is willing to work overtime for free".

I love my job, and I leave work at work so it stays that way.
Mm, that’s interesting, because as annoyed as I am about sales tax, I find myself not at all annoyed about the 10% automatically added to my bill for service in the UK or 7% in Thailand.
Yeah I am curious too. How to own a public IP? Does it work like getting a domain name?
This again. When will it stop?
Yes some people get reinfected. These are extremely rare. Usually it is because of the weakened immune system.

Others should be fine for months:

https://science.sciencemag.org/content/370/6521/1227

https://www.bmj.com/content/371/bmj.m4257
Previously discussed: https://news.ycombinator.com/item?id=4235876
Oh O.K, so it's not a CSS hack. I thought it's something smarter like exploiting a JS pattern to trick it to run JS from CSS.

So, the hackers need to have access both to CSS and HTML to put the malicious JS that looks innocent in the HTML and load the malicious JS from the CSS.

Now it makes sense, thanks.
You now have billions of people to share that happiness at any time !

And I had to pause to decide if I mean that sarcastically or not, but I’d say it’s still true in so many senses, be it in a facebook way or a video chat with grandma, or share achievement with your gaming team across the net.

TBH the “time spent alone” line in this graph would require an asterisk in these days and age.
> said every business manager ever. It's simple! Let the client configure it!

And apparently some developers as well, as I'm not a business manager :)

> but B2B UIs almost always have to reflect very specific business rules

I agree that some B2B UIs have to reflect specific business constraints, but there also others that don't, they just have to be a document storage. And others that don't even need that. And others that for sure have to have very specific constraints, maybe outside of the business or maybe not.

I understand that you have a specific perspective on this, but I think your perspective is just considering one of many use cases of having an UI. There are others beyond that, especially when you talk about enterprise use cases, as many of those are hidden from the people not actively in enterprises, it's really hard to know as those details/workflows are often not public.

But they are there, and anyone making assumptions about what others needs, are bound to be wrong at one point or another.

I'm throwing my hands in the air and saying "probably some UIs could be done by the users themselves, if they have the tools" while also saying "there are UIs that needs professionals to be done correctly". Basically that the whole area is a large gray zone of "maybe this, maybe that", as there is no "almost always should be like this". The use cases are so many, and so different, that it's impossible for you to proclaim that someone is basically stupid for even thinking that users could implement their own UI.
Ppl enjoy convenience. If we are to move to your solution in a matter of months or years we’d have Chrome integrate their wallet system as a new feature so you don’t need to open a new app. I think you can see how this is a very probable scenario
That's a competitive advantage they have, which dis-incentivizes them from pushing IPv6 adoption.
To be fair, your example would (according to the official spec) be shortened to 2001:cdba::3257:9652, which would not be hard to communicate over the phone.
GUIs are also fundamentally more expressive for some types of work, e.g., Photoshop.
My point exactly. How can we expect tiny cheap linux computers like the PI to replace PCs for the average joe if they can't even run Youtube?

Unless the hardware powers datacenters or mobile/IoT devices, HW manufacturers don't even bother supporting linux with drivers.