skysight-inc/HackerNews huggingface dataset:
> Debian is particularly impressive, since they, on paper, aim to support all packages with security fixes, whereas Ubuntu's main repo is a lot more limited.

What are the track records of the claim?

I'm sure Ubuntu will patch stuff up if some vulnerability shows up outside of main that gets patched upstream or elsewhere.
Quote: "Doesn't burn out your retinas when used in late-night sessions"

I like white background and bright color themes, as in I like my retina "burned". Does it has settings where you can choose your own color scheme or this tool is on the same par with all "cool kids" who think anyone not using dark mode is unworthy?
> XPath (which is procedural)

XPath is not procedural. It is entirely composed of expressions that compose and return results. The closest common language might be SQL.
GitHub Launches OSS Sponsor Program
This is a step in the right direction.
> would a reasonable person view the combination of GPL and non-GPL code as a single piece of software?

I think reasonable people would disagree with each other.

macOS used to come with iTunes preinstalled, but you could remove it by turning off SIP and running `sudo rm -rf /Applications/iTunes.app` in the Terminal. I always did so, because iTunes sucks, and the rest of the OS always continued to work fine.

Is iTunes a part of macOS, or is iTunes a separate piece of software? Would it matter if you could remove iTunes through Finder, or without turning off SIP? Would it matter if iTunes wasn't included with macOS, but was automatically downloaded and installed a day later? Would it matter if iTunes was created by a third party, or if macOS couldn't output any audio without it?

What about Google Play Services? DirectX? ZFS? I could certainly make a case for how I think each of these should be classified, but I don't think it's at all obvious.
A Security Kernel Based on the Lambda Calculus from 1996 (http://mumble.net/~jar/pubs/secureos/secureos.html)

I've been reading up on the object capability security model a lot recently, and was pointed to this paper... I was hooked. A really compelling security model almost from first principles.
At this point, browsers should allow non-markup files - specifically JS or WASM - to be the base of a web page. Browsers will already automatically add in <html> and <body> into the DOM if they're missing on a page, so literally, you could have a website that's just a <script>//do DOM stuff</script> and it'd be parsed and run without issues.

The index page at this point is mostly just a DOM skeleton on which to hang references to CSS, media, scripts and metadata. We might as well cut out the last step already.

If there was an official HTML-to-JSON format, we could even use that as well. It would probably already exist, but the question is always what to do with node attributes, text nodes and child-nodes. There's a dozen ways to organize them in JSON.
This sounds like a similar problem to an exercise in the famous probability textbook by William Feller about estimating the total number of fish in a lake by catching N of them and tagging them, and then throwing them back in the lake and coming back later to catch another N fish. You check how many of those fish are tagged and derive your estimate from that using the hypergeometric distribution. See the pages here:

https://imgur.com/oRF0OD3
https://imgur.com/UtCZL5A
Turning down a $375K Instagram PM offer
>...what hope does the government have for protecting access to legally mandated backdoors in encryption?

None. Both the CIA and NSA have been hacked too. The only entity that should hold private keys should be the person or organization using those keys.
Google App Engine deprecated spending limits
They could have seen evidence in logs that the hackers were searching for files that likely were associated with the government, but they didn't find any.
Already being discussed fwiw:

https://news.ycombinator.com/item?id=25351349

https://news.ycombinator.com/item?id=25351719
But then you need to make up a deployment system with rollbacks and all the other stuff k8s gives you.

I've got the feeling that if you're reasonably comfortable with k8s, there's no harm in starting with it from day 1.
Wow. Hacker News is really the place to be I was just thinking of a project like this.

Only that my goal was to create a browser for that an alternative to the web.

It would work on the same principle of separating data from information
I genuinely hope your point is not lost on the decision makers. The steady push towards the 'ease' of accessing w/e you want as long as it is by 'good guys' ignores this argument and quickly pivots to cp, aml, and terrorism ( basically whatever currently works ). It is genuinely maddening.
Bill has moved on to new ventures now, but maybe you can reach him at bill.gates@gatesfoundation.com ;)
We do basically this. [0][1]

[0] escherize.com/w/hiccup.space

[1] escherize.com/w/cljsfiddle
Hi Eskil! Would love to hear your thoughts(rants?) on iOS too :)
The Webless Initiative
I agree with you. But this is a tricky problem.

The alarms go off because there is smoke - the issue is that the smoke is not dangerous. How do you solve for this? You could set a higher threshold for detection, but this also delays any response to the (very dangerous and urgent) problem.
The json.org description of an "object" is:

> An object is an unordered set of name/value pairs.

But this site seems to be assuming that the key/value pairs are parsed in their original ordering for everything to display properly. Is it safe to assume JavaScript will always parse the keys in order?
> Matthew in accounting that will open that invoice attachment so he can pay it.

This is painfully accurate. A chain is really only as strong as its weakest link :/
Bernstein's post is more a criticism of Lamport's claim[1] that

> Even using LaTeX, which does not make the final formatting very easy, I usually spend less than two minutes per page doing the final formatting to produce camera-ready output

and less a criticism regarding the superiority of logical (i.e. semantic) document editing systems over visual (WYSIWYG) editors. Lamport even says[2]

> I know of no purely logical system that is currently available. Systems like Scribe and LaTeX permit the user to describe the visual appearance as well as the logical structure of the document—for example, by inserting a command to add a quarter-inch vertical space. The need to provide the user with such commands is a symptom of the deficiencies of these systems.

[1] Leslie Lamport, "Document Production: Visual or Logical?", page 6, https://www.microsoft.com/en-us/research/uploads/prod/2016/1...

[2] supra, page 2
DahliaOS – Modern OS Combining Best of GNU/Linux and Fuchsia OS
Monorepos with Bazel
Monorepos with Buck
At the risk of getting hit with downvotes... because its oracle..

Oracle Linux actually seems to be the best way out (at least for now)

/me shudders.

Actually just installing it on a new 5900x now after aborting CentOS due to it becoming abandonware and having its name stolen by IBM.
Noise. Pass me the Red Ryder Ralphy.
Chinese spy slept with at least 2 mayors and got close to Rep. Eric Swalwell
Aside from the aforementioned "Skyport" landing pad installed in large buildings, I do not see drones becoming a large part of daily life so long as there's a housing crisis (In the U.S. anyway).

What does a housing crisis have to do with drones?: NIMBYism

The same forces that compel municipalities to heavily restrict the height of a single family home, or absurd setbacks on all sides of the property line etc, are the same forces that will absolutely not tolerate a neighbor constantly having drones buzz in and out of their property and neighborhood. If you've heard a drone fly nearby before, you may be inclined to agree, those things are loud. Until there's a way to fly drones around silently, I see no sensible path to mass market drones.

This isn't an endorsement for or against delivery drones at all, personally I think it would be amazingly convenient, but I also think building densely around transit stations as convenient too, yet NIMBYism in the Bay has all but put a stop to that.
Marin, CA will ban them on account of the noise drones make.
Not necessarily. Realistically, you can't stop a nation state attack if they want to get in. If it turns out that the breach was caused by default credentials being used on a public server, then it's a different story.
> The blog post has no details and the overuse of adjectives to describe the attacker as extremely competent sounds more like an excuse for their own weaknesses

This was precisely my read of it as well. Exaggerated usage of superlatives coupled with no actual explanation suggests trumping up an adversary's capabilities to excuse one's own security lapses. Like claiming a highly sophisticated burglar broke into your home, while neglecting to mention you left a window open.
I guess all the user "consent" for Google proxying (spying) users are included in the ocean of ToC text

Thus I am using Google Chrome only for Web Dev
Digital Dollars
It does make sense from RH's perspective that when Fedora is a testing environment for the next major version and RH wants to use CentOS for minor version test environment, so that they can release a new RHEL minor version more confidently to paying customers.

I assume CentOS Stream will be based on the previous RHEL minor version release which would be stable and puts improvements for the next minor version release before RHEL releases it which doesn't sound like the end of the world like some people seem to think.

You actually get improvements earlier than later and you also get to throw feedbacks in before the next minor version gets released which feels more community oriented.

Unless your server needs absolute stability like RHEL (in which case you might as well just pay for RHEL), then it seems ok to use Stream.

For those that need absolute stability but have no decent flow of income, then you might be burned but I suppose a new community supported RHEL clone would come out sooner or later.
We use CantOS in production. Our servers are typically replaced once in 3 years. But we update our software stack on bare metal only once in 5 years or so. We however spin up VMs all the time on these servers, and having a single standard operating system base that was extremely stable did not have licensing issues was a positive. This changes the calculus for using RedHat based OSes. So we initiated a migration to Debian.
Was going to say the same thing. It was well known at the time that amber was better, but manufacturers mostly continued pumping out green anyway.
I wouldn't discount a bored teenager yet. And yes, I am serious (as there is no info on how the attack took place yet).
It depends on where the vulnerability is. Everything is all ad-hoc, each piece of open source software decides how they want to handle it, attempting to juggle the chances of a leak. The fewer you tell, the more likely the secret is to be kept, and you want to keep these things secret until a patch is done.

The linux kernel maintainers have a private list where they co-ordinate some of this stuff, and every major Linux distribution will have engineers on it.

That's partly why you see things like OpenBSD etc. being left on the margins. Certain maintainers have been quite vocal about not adhering to embargoes, which really doesn't help them. It's an idealist vs pragmatist thing going on there.
You mean more drone traffic that are louder than cars?

ICE engines are going to be extinct anyway.
wow, it's super fast.

what runs at backend?
No, you can't. Or create your own browser that can. Remember, HTML, JavaScript, CSS, XML, JSON, etc etc - are only instructions for an interpreter (or even compiler/linker if you feel the need).
Original CentOS founder intends to create new fork of RHEL
The original founder is intending to create a new fork of RHEL due to the recent news coming out of Red Hat/IBM over the switch to CentOS streaming. There is now a new community forming around a linux distribution called Rocky Linux. In fact there is now a community forming on Freenode, as well. The MOTD on their IRC channel reads:

> We're #rockylinux and #rockylinux-devel on freenode
> cannot be monitored by any intermediary

Key word is any single intermediary. The announcement even explicitly says "no single entity can see both at the same time".

I wonder what it would be like if there were multiple entities in cooperation, each sharing their component of your request with their partners to recover the entirety. You could cover the entire planet with access to even as few as three or five or so large networks.
Other than wealthy suburbs that are exclusive by their very nature the "housing crisis" only exists in a couple cities. Those "forces" of which you speak don't seem to exist (or if they do they don't have teeth) in most places.
It's taken like 15 years too long, but GIMP finally has 16-bit and 32-bit linear light color channel support. GIMP is pretty sweet.
Ah, interesting to know that Nim's system uses some form of affine/linear types. I'm not sure of the extent or details as I've been busy making use of other parts of Nim, but I really want to read up on linear types. Nim's type system is powerful enough to pass write effects which would be pretty handy for first class immutability [1]. Not sure how much that overlaps with linear types though or if it's an orthogonal aspect.

On a side note, my use case of a Bacon-Arjan type collector ...

Interesting story! I enjoy reading those, and I know the Nim team had a lot of work to get ARC & ORC working well, which also required a lot of work on move/sink as well in the stdlib. I could see it being very difficult to implement in a big C++ code base. From the article it seems M&S can even be a bit faster than ARC, but with higher latency, more memory usage, and harder to target various platforms like WASM. I'm glad as it makes Nim excellent for usage on microcontrollers! No worries on shared heaps or unpredictable GC pauses.

1: https://nim-lang.org/araq/writetracking_2.html
"no evidence" != "didn't happen", either, tho, especially if the attackers really were that capable as they claim,
Reverse engineering is mostly a side interest of mine, but I do have a bad habit of overestimating the complexity of the bugs I encounter and launch into reverse engineering software to figure out why it's not working properly.

I actually work on compilers, so training myself on reverse engineering isn't totally useless, especially since a lot of what I like is about the pattern recognition of more advanced compiler features. And if you're trying to retrofit high-level optimizations in a low-level backend, reverse engineering the high-level structures is exactly what you need.
Is this possible on a rooted device?
IDK what's with this gas lighting about "cool kids" and "unworthy", do you really have this much callousness towards people with disabilities? Do you also think we should get rid of wheelchair ramps just because they don't cater to you?
That’s nice but as someone on the opposite end, I have been able to book appointments for home remodels in the next week or same week consistently. Basically every project we put aside because it didn’t matter so long as we had an office to retreat to has been done and tradesmen in my area are consistently free.

Most notably these are all high dollar jobs so it may be different on the low end.
A Mid-Career Bet on Entrepreneurship
Or until your country makes some friends and they decide to share their piece with each other until they recover your whole request.
LumiLor – Controllable Glowing Paint
Why don’t you all use Find my Friends?
>I feel like it would be better if we just tagged poverty as being off-topic to Hacker News.

I understand where what's underlying this sentiment, but "you don't get to talk about this subject unless you've personally experienced it" is ultimately unproductive at best.

If for nothing else, when it comes to poverty in particular it's worth keeping in mind that educated people earning middle or higher incomes make up the most generous and most frequent donors to charity. "Shut up but pay up" doesn't read all that well.
The david guy is he real? I felt he was a render.
If batteries last only a year and there is no third-party alternative, this is a subscription.
Estimated delivery date from the online store.
Someone needs to remind the author that fear is the mind killer. Poor soul sounds afraid of everything around them at the present. Perhaps some mindfulness would alleviate some of their fear?
I was curious what drove the decision to deploy that way. I was under the impression most new applications being developed today would choose a more modern deployment method. There’s a lot to maintain in a VM image like that, containers just seem easier to me. Helm chart or otherwise
> I will be shocked if Trump doesn't run again.

I would be pretty shocked if Trump ran.

But I'd be more shocked if he didn't spend the next 4 years mouthing off & sewing discontent & pissing about as though he were running. Making a big stink, and pulling in millions of millions of dollars.
If I understand your comment correctly - even though the fingerprints are published, the attacker can still reverse eng the implementation from the tools and bypass antivirus systems at least in the near future?
How Does Push Kit Bring a Better Learning Experience-Huawei Developer
It shows they turn over information it does not show they do the bidding of the US government. There is a legal process in the US that must be abided by while this isn’t true of the PRC. The line between corporation and state is a blurry one in China, to say the least.
crashed on the first page I tried it on
CentOS started out as just such a project...
> The FSF made a huge effort to make GPLv3 not scary.

If they were serious about that effort, the metric would have been a simple boolean: "Will the Linux kernel make the switch?" That's got to be your most visible, most well-funded GPLv2 project in existence.

If no (and it was a resounding no according to Linus' very public rant at a Debconf a few years back) then the license would almost by definition appear to be "scary" from the outset. The only exception would be some very rare edge case in Linux that makes it impossible to switch. In reality-- again, at least according to Linus-- it was a complete breakdown in trust between a holder of the old license and the organization writing the new one.

I don't know the intricate details, but it's clearly a bigger problem than "large companies" spreading FUD.

Edit: clarification
Any of these is suffice but I thought it was nice adding a mention of a lightweight Qt application.
If I may share some advice - don't bother. As another commenter pointed out, relationships are inherent in a lot of the data you'll store for your platform, and for those elements that you'd like to keep the full data hash, just use jsonb in Postgres.

Once you're at several million in revenue, then you can think about splitting off some parts of your data into document storage solutions for certain efficiency reasons, but that is by no means necessary.

This is a great video on the topic: https://www.youtube.com/watch?v=HaEPXoXVf2k
I mean, containerizing isn't harder than anything else. It makes distributing your artifacts much easier, and building across people's computers easier too. It takes O(minute) to containerize something, so I don't see why not do it.
Is FireEye the kind of company that has a cache of 0days?
And then compare that number with a lockdown that only targeted those at a higher risk of extremely poor or death outcomes from COVID.
Every year the flu causes (or caused, until this year) tens of thousands of deaths which theoretically could have been prevented (or really, postponed, since no one lives forever) by bringing human social and economic relations to a standstill. Wherever one falls on this question, it's extraordinarily obtuse to focus solely on the fact that people are dying from COVID and advocate any measures necessary to reduce the number without taking heed of the broader risks of doing so.
Have you seen this implemented recently like in the past 5 years?
If the bar tender only handed you a beer bottle - sure, don't tip if you don't want to. Although you should, even if it's a single dollar (ie. proportional to what you are receiving).

But if you order some elaborate drink that takes time and skill to craft - you should tip as a way of saying "thanks for the effort". That was the original idea of tipping, after all - ensuring, measuring and providing direct feedback of service quality.
What are you talking about? Where, in God's name, on my above comment I even hinted at that? All I am saying is if you go the trouble to create something that has different color scheme than your underlying operating system, then be smart enough to create settings to let users select their own colors.

You either create your app with default coloring and you let the operating system set your colors according to the user's theme preference OR add these in settings. I hate programmers who think their color preference should be the only one, and not just that, but also state it proudly with a "it doesn't burn your eyes".
Well yeah, I'm talking about multiple seats connected to a single computer directly. I could see applications in the thin client space.
I think this a bunch of words which are profound but don't look that way to many people.

Value investing is another name for allocating your resources to things which are minimally speculative. To things which presently have value. There is somehting deeply wrong with a society which is no longer interested in this.
OK, but then the interview continues>

" In his own field of thought Einstein follows every development with keen interest"
Miniature blimps maybe?
Why is enduring poverty not helping the world?

Poverty = less resources = less pollution/damage to environment.

There is only so much a poor person in Africa or Indian village can do to hurt the environment compared to a person in West probably producing 20x the greenhouse gases.
I’m not sure where you’ve been diving or if youre intentionally being pedantic.

Your typical open water course qualifies you for depths to 30m. I’ve been past 40m, but on air you’re not staying there very long (let alone 50m). And if I remember my nitrox training correctly, on EAN 35 you want to stay at 30ish meters or shallower.

My insurance through DAN also only covers me for up to 30m. Most of the colourful corals and fish that you see on TV, typically at shallower depths anyway.

Past 30m you definitely need further qualifications and more gear if you want to hang out at those depths.
Coincidentally, I have a project using the same technique that periodically regenerates animated SVGs based on changing data for use specifically on GitHub. The generated images are styled with CSS in imitation of the actual GitHub site.

Since I could "borrow" the CSS actually used on GitHub, it was possible to make the images look like a natural part of the real UI.

https://github.com/jstrieb/github-stats/
Is it possible to use this for a business to put on their employee phones? Before anyone pounces on me (I actually have strong opinions about privacy)... I have a client that has 300 employees that are enforcement officers in the field on company issued phones during their shifts. (think tow truck drivers or parking enforcement officers) and they'd like to be able to quickly dispatch the "nearest" officer to the scene. Is this something we could use to get real-time locations of these officers?

I was asked for advice on coming up with a solution and I had a tough time finding a good solution that is API-first, battery optimized, and has solid Android support, and a privacy-friendly DNA. We just need the real-time location tracking piece so we can use the information for dispatching them.
Sure, but they could already reverse mimikatz; having another implementation from FireEye doesn't really help.
Bash-5.1 Release Available