skysight-inc/HackerNews huggingface dataset:
Whats your opinion of open source tools and distributions of them (like Kali) in this space and the tradeoff between open sourcing your red team tools vs reimplementing tools that are already out there.
Also fingerprints will only stop the lowest level of attackers. You can easily change binaries in a way the fingerprint is changed but the functionality remains the same. Reorder functions, add some garbage data, etc.
To use a sports analogy, while game-time experience is valuable, it’s practice that wins games. Much of America’s military advantage is rooted in extensive, ongoing, and realistic training and exercises. Any country can train and practice, but to do so at operational scales and in a way that accurately portrays your adversary’s capabilities requires lots of money and accurate intelligence.
Cheers! I'm not a domain expert but his work seems to me to be even more advanced than things like regenerative agriculture. He's actually designing and constructing "machines" that include ecosystems as elements.
Still waiting for: The complexity of building a lie-down workstation for under $500.
There's ground drones too, well suited for delivery.
The fees that the apps charge cover (1) delivery of the food, (2) creating and maintaining the online menu and ordering infrastructure, (3) customer service/overhead, and (4) profit (if there's anything left).

Does anyone know how much of the app fees go toward (1) delivery? To the extent that the fees cover paying the driver, then it's not really fair to 'blame' the apps for 'gutting' the restaurant industry. But I have no idea if this is 30% of the fees or 5%.

Just to be clear, I'm not defending the apps and I have literally never used any of them. I just think it's not right to spend so much time framing the issue as if the apps are vampires, sucking the industry dry, without analyzing the extent to which the value they provide (actual delivery of the food) accounts for a portion of their fees.
How many thousands do you think Disqus charges its enterprise customers? Also, remember marketing, some tiers exist to get you to buy others.

Still, I have had companies on that tier. :)

And it's not basic, FastComments has a lot more features than the competition, like live commenting and such. I provide direct development and customization support, we support automated migrations from major providers, and it's reliable, covered with around a hundred E2E test suites that run periodically in production. It also has an "enterprise" multi-user/role system and SSO integration.
Very few companies will publicly attribute attacks to a specific government - both because it is hard and because of potential political blowback.

I would confidently say that the top 50 countries by GDP have a solid offensive capability. Some, like Japan, have very specific interests that don't align with what makes the news.

At some point you start getting in to the territory of Hacking Team, NSO Group, Gamma, VASTech, etc. Effectively combining the resources of many smaller governments in to a for-hire enterprise that can provide near-nation-state capabilities.

Here is a list of well known attributions of groups to get you started: https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_S...
If you are a technical lead as you claim and that's your reaction to developers' need for responsibility it tells a lot about you.

You seem like a control freak and a person who quickly puts down anyone without even considering new thoughts and opposing perspectives. Which can be completely hold against anyone who works as a consultant, because that's a red flag that the person is not cooperative enough.

Please post us your public profile so that we can avoid ever working with you.
The basic problem with XSLT is that it is strictly inferior to equipping any general-purpose programming language with an XPath implementation and just going to town. Let alone giving that programming language an even half-thought-out library designed to help with such a task.

Even Go, which is really not amenable to any sort of in-language DSL or syntactic sugar, is nicer to use than XSLT itself.

XSLT locks you in a trunk without enough tools to do what you need. I remember using a variant of XSLT Microsoft put out back in the day that let you embed Javascript into it... but then I noticed, why not just do it in Javascript? So I did. And it was soooo much better.

There are good ideas in XSLT, but they are so buried in a cascade of bad decisions and limitations and restictions and missing functionality and bizarre ways of doing things (and I mean, I speak Haskell, pure FP doesn't scare me, and they're still bizarre) that the best remedy is just to start over.
> Earth would recover

This concept always feels slightly strange to me. Earth does not "recover" from anything, nor does anything that we or an asteroid could do "damage" Earth. Make it less hospitable for us, sure!

But Earth itself has always been constantly changing due to external and internal forces, sometimes at a rapid rate and always at a slow rate, and none of that change is fundamentally positive or negative to Earth itself.
oh don’t get me wrong, i’m not advocating for root certs and MITM boxes. i’m just saying DOH isn’t really going to challenge an enterprise’s ability to sniff and intercept DNS.

notwithstanding other technical issues, it’s just bad practice to create the sort of experience MITM creates.

when people are used to seeing compromised https when on the corp network or mitm boxes prompting for auth periodically it basically lowers people’s guard on that stuff and opens the door.
i know i know, we all want things to be easy, i get it, yeah. static linked stuff is definitely that.
I think it would be better to put a disclosure that you are creator of sciter.
>Have I done a scientific study proving that Microsoft Word is less efficient than LaTeX? No.

Ok, thanks, bye.
>Only fair they adjust accordingly.

Er, not serve? Or a degraded service which entails what? Begrudging looks?

Always a chuckle to behold America's fetish for tipping.
Xfce, Cinnamon, and MATE all have a significant user base and they use GTK.
They're saying that Stream will be getting the normal package updates first as a kind of testbed, which is different than before.

So you're getting some instability by being first in line for updates, but you're still second fiddle for security fixes.
Hey! Yes, however now I notice that this is only when running locally. I took your page, replaced script and css with absolute links, and loaded locally as file://
> Matthew in accounting that will open that invoice attachment so he can pay it.

Matthew in accounting shouldn't have permission to run an untrusted binary.
This comment seems highly lauded, but it doesn't ring true to me. You can't really split people up into light and dark, can you? Like most people, I try to do the right thing, and usually succeed. In most cases where I got to know someone who had "dark traits", I eventually learned that they were doing the best they could within the framework of their own lives, and that she is those decisions made a lot more sense when you understood more context of their situations.

After all, the fundamental attribution error is the human tendency to assign agency over decisions to people instead of situations.
> Is it safe to assume JavaScript will always parse the keys in order?

Technically, no. Functionally, probably yes.

Any browser vendor that decides to muck with the current status quo would likely break enough code to be a non-starter.
Where can I get these from?
the crisis doesn't exist for most lumps of land, but it exists for most _people_ because the places where the housing crisis is, is where the people are. NYC has more people in it than a third of the landmass of the US
This isn't new to DoH. Malware has used alternatives to DNS for getting command & control server IPs for decades. IRC used to be common, for example.
Show HN: Is Website Down Today?
Wireless noise-cancelling over-ear headphones are not a solved problem byfar. Every produce out there has some flaws.
"try not to use markup on the JSON, because this would make it difficult for others to consume your website with JSON."

Since there is no standard for representing rich text in JSON, if you want rich text, this is simply an unavoidable problem. At least Markdown is semi-standard and people can get libraries for it. Embedded HTML would also work. Defining an ad-hoc rich text embedded would be worse.
>I think a hard problem ahead would be how to convince other people to also adopt this framework, and how to make sure that people are using the same JSON keys to mean the same thing.

At first, I was thinking to use some kind of general schema, but those things never work. So I decided something much simpler: the render determines the schema. This is an important aspect that I am working on. If you choose some specific render, your JSON will have a specific shape. For example, if the render is for a landing page, the JSON could be something like "about", "products", "team", etc. (never <section>, <h1>, etc...). But it is too soon to tell I'm still thinking about it.

(but an interesting corollary is that the render could be also a program with the "config" part. It would be an alternative to website builders. Every render would be a different WB tailored for the website)

> I'm curious how you plan to prevent your JSON format from being (ab)used for presentation purposes, where people add extra content to make the page display a certain way. And if you have a plan, is this plan feasible using HTML as well?

I don't have a plan for that yet, and it will be difficult because we are accustomed to mixing data+markup. But I think the mindset is to stop thinking the website for just the browser. The website could be information first, presentation later.
Previous discussions: https://hn.algolia.com/?q=golden+state+killer
> Where, in God's name, on my above comment I even hinted at that?

This your comment if I remove the gaslighting and disdain for people with disabilities wanting to be able finally use some software:

> is lightmode still an option?
Naturally occurring equivariance in neural networks
You can get a database of everyone's metadata communications by sending them a phishing message? Certainly, I don't keep even all my information on my computer, or even a single phone, and I think phishing _everyone_ is harder than you're making out. On the other hand it's all sitting right there at the NSA et al. Your other attacks are similarly focused on individuals, although the credit and health agencies are prime surfaces for data mining, you're not going to get the metadata/connectivity needed.

I'm interested to know what you're proposing, but I suspect you simply misunderstood what I meant, and perhaps what your (and everyone else's) file at the TLAs looks like. It's a mighty plump target, and not comparably secure.
I can't read the whole article since it paywalled but hasn't his always been the case? Perceived value is the only thing that really matters in the stock market. Just look at Enron. I am really curious what will be the next Enron of our generation.
Because the tooling getting out impacts everyone and thus warrants a public post. Some government information being stolen only impact those customers and only warrants notifying those customers.
Why would ant victim conclude anything else? You can't prove them wrong and this is what anyone trying to CYA would say.
Drones are roughly as loud as a gas powered leaf blower [1]. I bet the hype is going to die real quick when people realize how annoying the noise is. Or at least I hope. Drones are cool but imagining the high-pitched whine of a even a few of these at all times gives me a headache.

[1] https://theconversation.com/drones-to-deliver-incessant-buzz...
> once the fed's spigot dries a bit expect to see huge drops in the market

I used to believe this, but no more. The Fed's unstated goal these days seems to be to never allow the market to drop.
You are right, although NAT could be classified as a firewall feature, that runs on routers.

But in any case it's irrelevant in this context as ATT shouldn't be doing any NAT
It's not just the values they place on the end user and simplicity, it's their huge amount of cash they can use to test and deploy technologies (think spatial audio partners) and their tight grip on supply chains (try sourcing some of the same materials an iPhone is made of).

I mentioned elsewhere in the thread, the best chance at making a wave as a consumer product concern is to make waves on some sub-component of the larger product being produced by the majors. You aren't going to compete with Apple, Sony or Bose directly, but you can improve on new technologies or extant processes and hope to get subsumed. That's the truly sad part.
>you are also screwing over the employees at those businesses

Not to open this argument but it's not the patron's job to ensure the staff are paid appropriately. If servers don't want to run the risk of not being paid at least minimum wage, they should ensure their conditions of employment guarantee it and the business should reflect it in their prices.
Who is offering new grads $150k regularly? What new grad making $150k is going to qualify for a loan on a million dollar house? Where are they getting a down payment? Where are they saving up hundreds of thousands with $3-4K rents before other expenses? How the shit is a dual engineer income saving up $2m in cash by the time they're 30 even with no student loans?

A SWE in their 20s banking $100k a year? Must be nice.
Information pertaining to government customers invariably impacts civilians under that governance (and potentially civilians outside of it).
Ptrace long predates Linux: https://en.wikipedia.org/wiki/Ptrace#Unix_and_BSD
You could have drone ports installed in convenient locations like Amazon locker. In fact, just build out Amazon lockers supplied by drones all over your city. They could handle like 90% of traffic? The large packages would still be delivered by humans. Or maybe ... have them dropped off at the drone port, and then have a wheeled bot make the last mile delivery, since they are quieter.
Tesla co-founder on QuantumScape's new battery: it's a breakthrough
I can do this but cannot do that at the same time.

Having 2Gb is pretty limited
I don't think it is honest, though. I believe the real reason why it's only being filed now is that all the other challenges have failed, and they didn't think they'd need to resort to a judicial Hail Mary until everything else had failed.
Don't forget "press enter on an empty password prompt with feeling to get root"
>They were numbering paragraphs, not line items, and lines that wrapped were supposed to be left-justified. I don't think this is a strawman.

Word allows you to adjust the indentation on numbered lists so that the text in a paragraph is flush with the left margin. In Word 365 there are at least two ways to do this:

1. View -> Show -> [check Ruler] -> [Adjust the indentation on the ruler]

2. Layout -> Paragraph -> [click lower right arrow] Paragraph Settings -> Indentation -> change Special from (hanging) to (none), or change the "By:" value to 0

So the author's motivating example doesn't seem to be a particularly fair criticism of Word.
> No, they are not recording your location or your “travel history”.

Another lie. They are recording your location. You already agreed to that except last time, you said it was "anonymized." Then you said that it was recorded but not queried. Now you're saying they're not recording it at all? Keep your facts straight.

The worst part is that you're paying for this abuse from Apple and then justifying it to others. Nobody else is falling for it.
Can you file suit if you don't suffer damage?
Not sure about PubSub, but Kafka doesn’t store messages on disk forever by default. So hydrating the state from a message bus may not be a good idea depending on what you’re doing. I’d say DB is the way to go here.

Don’t have any resources though. I’m only speaking from experience.
Building Something New: Public Changelogs of Interesting Things
That's why we use tunable brightness and white point like f.lux.
presumably he opened a pdf with a zero-day from an untrusted source
Etsy 007?
> The idea is to separate the data in JSON completely to be consumed outside the browser if needed, but still render correctly in the browser...

I'll accept that answer. As controversial as this comment may be, XML/XSLT is a very good fit for this purpose. It might not be particularly modern, however it's almost universally supported.
did you pay for a support contract for centOS ? or is this something free you expected to be some contractual thing?
Then people with 8Gb laptops are limited to what they could do.

Hardware matters more than people

Do you really wants to limit your folks in such way for something like $150?
Stopped reading at:

"In the past week or so, fortunes have reversed. Technology stocks have sold off. Value stocks have rallied, as prospects for a coronavirus vaccine raise hopes of a quick return to a normal economy. This might be the start of a long-heralded rotation from overpriced tech to far cheaper cyclicals—stocks that do well in a strong economy. Perhaps value is back."

Haha. No. It's not back.

Over the past YTD, AAPL has returned 70%. The article's publish date is 11/14/2020. Around that timeframe, AAPL moved less than 5%. This is not evidence for collective change in investing philosophy. Perhaps tech is over-bought, but you have to argue better than this. It took me all of 2 minutes to check.
This is true, however I think that the perceived "viral" nature of the GPL gives the impression that patent invalidation can easily spread around to proprietary projects as well.
I would welcome our Octopi overlords.
People in 2020 were a huge disappointment
I am trying it now. How can you guarantee that you protect privacy? Is it open source or do you have some other way of guaranteeing it?

Also, is the layout and key shape patented or is it an open standard?
I feel you've picked that one paragraph to focus on and ignored OP's point. Namely:

> The whole issue I have with it is that they pretend otherwise. With go many people laboured under the misapprehension that they could have more input than was actually possible.

> The cathedral model is fine but be honest about it.
Why Vim Uses hjkl, and why JavaScript months start from 0
Ahh OK, then this is really more against large enterprises and less for lean/smaller aaS companies. Seems like there's some leverage here to be taken advantage of.
The people who lost containers get paid compensation. If they don't want it, the shipping company doesn't care.

The people who didn't lose containers are the ones who have to pay up their share of the losses. If they don't pay, you seize their cargo.
Why wouldn't you just do gifs or asciinemas? So much extra work for no gain.
A vulnerability that is secret is the biggest threat to security. Publishing tools makes them public knowledge that can be defended against.

If you are doing penetration testing and basic security work, there is no value in having private tools. It becomes important in red team work because you are trying to emulate a real attacker that has access to non-public tools.
Add the Patagonia and an oversized Yeti water bottle and you've got yourself the VC starter kit
While I agree that we need to 'return to reality'(as much as the market is ever tied to reality...), the "something" that is going to happen could just be inflation, and suddenly those asset valuations might not seem so crazy. What I do not know, however, is if you should expect better than average growth during/after an inflationary period, or if it will drag down growth and reduce market performance in 'real dollars'.
Excel allows you to perform queries for almost arbitrary data on a spreadsheet. I wouldn't doubt for a minute that with sufficient time and motivation you could write a full sql engine with excel functions.
The widget screenshot comparison shows a Win7 style which isn't that archaic.

This thread seems to indicate that Win10 style is also possible which would make sense since it uses native elements
https://forums.wxwidgets.org/viewtopic.php?t=46574
Sendov’s conjecture for sufficiently high degree polynomials
It's too late https://github.com/bdougie
Does Matthew in accounting need access to the same network as the engineering staff?
I get why someone wouldn't like it. But it's not a battle you can fight at that scale. The wait staff get paid $2.13 an hour. They feel the pain, not the business or the American fetish meisters.
It's more insane than the monitor stand. That monitor stand is for a monitor that is aimed at professionals working on HDR content. It's a very low volume, specialised part, $1k isn't entirely unreasonable.

These headphones will be mass produced in huge volumes. It's a consumer product. Just a very expensive one.
Matthew in accounting should be given an ipad pro instead of a laptop or pc, with a glued in lightning cable that can only do power.

^ This is the solution I have been mulling if and when I am responsible for an org where security is kinda important. Sure, iOS is still hackable, but hopefully we put more hindrance steps between the attacker and the org, and move the exposure more to the cloud services (like box). Curious if this is feasible.
Previous discussion: https://news.ycombinator.com/item?id=16868006
I was one of DoorDash's first 50 employees. Here's how we did it
That tactic never really works in big, open markets.

See eg Herbert Dow and the Bromine cartel. https://fee.org/articles/herbert-dow-and-predatory-pricing/ (or any other write-up on the story that you prefer.)
> I never heard about them getting any special extra compensation for working that much and also a bit risking their life

Nurse pay has increased quite a bit this year, now reaching $5k-$10k a week...
The idea of treading water, 50 meters down, in the middle of the ocean, in pitch black, makes me so anxious just sitting on my couch thinking about it...I couldn’t imagine just...sitting there, knowing that in every direction it effectively goes to infinity but I can’t see much beyond my hand in front of me.

Scuba diving is very much not a pursuit for some folks.