skysight-inc/HackerNews huggingface dataset:
That seems to depend on some very specific and unusual definition of "free market economics." Usually there is some unspecified assumption of rights (particularly property rights), and actions which violate those rights are not considered to be "free market" interactions. As an obvious example, if you creep around neighborhoods looking for people with valuable property that isn't well-secured against theft, then offer to sell a homeowner the information about the security problems you've discovered, and then sell that information to professional thieves if the homeowner declines, I don't think that would be "exactly what should happen according to free market economics."
> the attackers might have compromised internal build or distribution systems of SolarWinds

It should probably become a requirement (for both open and closed source software) that any updates be not just signed but have their hashes available in a Binary Transparency log[0].

When you first install a piece of software, you might need to calculate the hash locally and manually search for it in a log's web interface, but after that, its software-update routine should check that the new version it is downloading has had its hash published in a known place. That way, software publishers can check an append-only independently-run log to see what has been signed with their keys.

I suppose there is a risk that an attacker could prevent users from receiving security updates by DoS'ing the transparency logs, but that should be harder than just DoS'ing the servers that host the software updates themselves. Large organisations could also maintain mirrors of these logs on their internal networks, which would help with privacy/latency/availability, and the logs should ideally be available as Tor hidden services too.

For non-critical updates, the log checking routine should require that the update's hash had been in the log for a certain period of time, long enough for the software publisher to notice and raise the alarm to their users. Updates marked as critical should default to stopping the software from running until the necessary period had elapsed, for which the workaround would be a fresh install of the newer version by whomever has the admin privileges to do that.

[0] https://wiki.mozilla.org/Security/Binary_Transparency
I read about a guy who studied this. He said that after some time (a month or two IIRC), his body's bacteria adjusted to have a lot more of the ones that ate ammonia, and his scent went from terrible to quite neutral, and not strong at all.

I would link it but it's been ages since I read it.
I just wrapped up a Go based SAML integration and I was initially using your package. I encounter a bunch of issues with namespaces, and eventually ended up using xmlsec1 directly against a formed up XML template. I agree with you, SAML should go away. This was my first experience with it, and the nuanced complexities were so exhausting. I’m glad the integration is done...
Not very surprising. Communist labour unions are very powerful in India. Most of the are backed by the communist parties who have Chinese patronage.
I think the core problem is that actually compiling for different operating systems is essentially none of the work needed for compatability and provides a stage that lets you remove stuff that isn't needed for that OS, while using bytecode makes it possible to support different instruction sets and can be compiled for the platform it is used on as needed or ahead of time.

Going the other way, if an application is distributed as a VM or other method of minimal reliance on the host OS it has all the issues of static binaries (heavier resource use, can't benefit from general updates) plus it won't have the look and feel of different operating systems unless it includes all that complexity on every OS. There are a number of other compromises that could be made vs. the most commonly used ones, but it is all a matter of tradeoffs. E.g. Flatpack has a set of base images as well as the application image, but it seems to have issues with the availability of dependencies.

The closer operating systems are the easier it is for a single executable to work. The BSDs have have been able to run binaries from various other operating systems, however as the other operating systems change it a lot of work to keep up and some OS APIs are just bad ideas that would compromise the operating system if they are adopted (in some cases a better way to allow compatibility could be created with a lot more work).

One option that I am interested in that might gain some popularity at some point would be to run a much simpler OS in a VM that can do some of the useful things you want a computer to do while not trying to do all of them but without trying to make individual applications fit in with the host OS. This would require users to learn two operating systems but would make the small OS easier to understand in detail and would have some significant security advantages due to being able to impose restrictions that would excessively restrict a general purpose OS. However, there will always be pressure to integrate more into the host OS. A major issue limiting this possibility right now is the situtation with GPU access from a VM. Also, commercial OS vendors are more than willing to make gratuitous incompatabilities to limit any alternative that starts to grow in popularity.
Yep, you make a really good point, thanks for the feedback. I think this bit would probably make sense to live in the upcoming "processing" section.

If anyone's interested, this is called the moov atom, and when you use "web playback" presets in tools like Handbrake, that's typically what it does is move that header to the beginning of the file. The progressive playback issues for files not optimized has improved somewhat when the file's host supports range requests, since browsers have gotten smart enough to try and check the end of the file for that header via range requests.

If you're interested in more along the codec/container line, one of my colleagues gave a talk on the internals of MP4 containers at Demuxed a few years ago[0] and another gave a Streaming Media keynote on the history of codecs and containers, particularly as they relate to online video[1].

[0] https://www.youtube.com/watch?v=iJAPTY3B7yE
[1] https://www.youtube.com/watch?v=9Qo3WfsK4vc
Having done a quick search for fun:

US law actually uses "state" in a sense closer to the European and broader international sense. e.g. a "state actor" includes both the states and the federal government, and is used to describe any entity bound by the restrictions of the Bill of Rights. (e.g. state actors are bound by the First Amendment, whereas private actors can restrict speech all they want)
> the severity of the exploit, not the potential damage you could do with it

Isn't severity measured in terms of potential damage?
> Surely the point is that this developmental ability to persist is wasted on FPS?

It's anecdotal, of course, but I always notice vast diffference in spatial conceptualization between people who have played first-person videogames set in complex 3d environments and those who have not. Me and my gamer friends could easily draw you an aproximate map of a location after being there once, correctly oriented by cardinal directions.
See this is what I mean by antagonism.

Before roads were for cars they were for horse+buggies, or chariots, or other transport. Cyclists are not first-class citizens on roads and they never will be. And frankly I don't want to get stuck behind one on a road with a dramatically higher speed limit than what you can pedal at. That shit is just rude.

The amount of entitlement that seems to come from the cycling community makes it really hard for others to empathize with your situation. You can make a bad faith argument comparing yourselves to BLMers if you want, but I can see right through it.

Appreciate your sitaution as a minority among minorities and plan your moves appropriately. But thinking that cyclists should get higher priority over multi-ton cars and such you are mistaken.

> People fearing for their lives are allowed to be agitated.

Don't forget that by cycling you are choosing to bring a knife to a gunfight.
Civil forfeiture is a shakedown on the face of it. The fourth amendment to the US Constitution specifically prohibits it, as long as one reads its language as being written simply and plainly. The logical contortions in having this meeting the simplest sniff test must be very creative.
No broken bones probably means strained tendons / muscles and a (badly) bruised chest. Both are known to hurt a lot and for days if not weeks. Pain is a good thing in that it reminds you to rest.

If the doc already declined stronger painkillers, it's probably not without reason. I dont get why you would suggest opioids being the less evil in this case. I once got 60 pills of codein for a torn off toe nail while visiting over in TX. Needed maybe 2 of them.
Off-topic: but why does nautil.us still on unsecured HTTP?
Here in Brazil too, for instance the NF-e (electronic "nota fiscal", the English term seems to be "receipt", the documentation is at http://www.nfe.fazenda.gov.br) and the recently released digital payment network (PIX, see https://www.bcb.gov.br/content/estabilidadefinanceira/cedsfn... for the current release of the relevant manual) both use XMLDSig.
I really appreciate you taking the time to give feedback. It's great to hear from people that have a clear sense of their priorities.
You got me. It makes sense.
I don't find my example contrived at all, having functions assuming non-NULL pointers call other subroutines that defend against such a thing is definitely a routine thing in my experience. Maybe "do_substuff" is called in contexts where the pointer could be NULL, or maybe its developer was paranoid.

I don't think it's reasonable to expect compilers to issue less optimized code to defend against coders doing smart things that are well beyond the scope of the standard. If you want to play fast and loose with segfault handlers then be my guest, but if you want to play with fire you better know what you're doing.

Note that many of C's UBs are also generally effectively unportable, different systems will react differently to things like NULL pointer dereferences (segfault, access to some mapped memory, access to nothing at all or a special handler like the one you described) and signed overflow (overflow to 2s complement, saturation, trap etc...).

I think blaming UBs is frankly the wrong target. The problem with C is that it doesn't let you express those constraints to let the compiler enforce them and let you know when you're doing something wrong. I can't tell the compiler "this pointer is not nullable" and have it keep track of it for me, warning me if I mess up. In contrast in a language like Rust I could use an Option<> type to encode this, and I get a compilation error if I have a mismatch.

That's what I want to see in a more modern C, not a babysitting compiler that emits suboptimal code because it's trying to make my coding mistakes somewhat less mistakeful.
I think this sort of issue is more common than non-medical people realize. It amazes me how often in movies and real life you see people wake up after a night of heavy drinking (sometimes still drunk) and take tylenol or other NSAIDs with liver/drinking warning labels. Or guzzling more NyQuil than they should (contains acetaminophen). The movie industry has cracked down on showing smoking, yet they still show people doing things that could cause liver damage in a unintuitive way.
I suppose I should clarify, since you're right about reaching a certain level and being content with it (which is fine, naturally.)

What I mean is that 2000 hours of my life can simply vanish into a video game black hole, absent any other life events. Why? It's possible to play Counterstrike (or whatever) for 14 hours in the day. For a week. Or two. or 52. I've never in my life met a person who can enter that kind of state for 14 hours when playing an instrument, where the ease by which it consumes your life is just so breathtaking. The only two activities I've found which have this addictive ease are generic web browsing (e.g. reddit) and assorted video games - and my life has definitely been degraded as a result.
> However, there now exist a number of contexts in which namespace prefixes can impart information value in an XML document.

Well, yeah. They've given up to a mass amount of half-ass implementations? So what? I think it's our moral duty to ignore it :)
> A reasonable claim like "I think this should be higher because XYZ" gets investigated and, if justified, higher bounties issued.

That's highly dependent on the individuals and the company doing the bounty. It's incredibly reasonable that people are suspicious of the process, when it is opaque as it is, and the disparity in negotiating power being the company and the person submitting the bug.

My personal experience is the FB bug bounty process has been generally positive, but inconsistent at times in the graded severity of issues and transparency of the decisions being made. I've clearly presented my case, and asked for additional information, but not gotten very far. My only real option in response is in how I allocate my time.

Having reports and payout amounts be permanently hidden results in stories like this being the only insight to the process.
This seems relevant: https://en.wikipedia.org/wiki/History_of_slavery

Obviously GP's claim is a dumb one, because all you have to do is say "Here is one counter example, you're wrong". But looking at that page makes it very clear that slavery is a big part of most of world history.
This seems an unfair leap. The most common cause of a checksum mis-match is going to be a partial download or something similar.

It's also not relevant to the current attack since the code was legitimately included in the official release and, as such, baked into the valid checksum results.
I'm also curious how far back these reparations are supposed to go, and where exactly the responsibility is supposed to lie. Should the people who 'employed' the slaves be responsible, or should the people who enslaved and sold them also be considered at fault?

If the second, then note a lot of slaves were initially captured and sold to white slavers by their own kind. [1]

[1] http://www.understandingslavery.com/index.php-option=com_con...
Off topic but what does “tolerably spare made” mean? Is a euphemism for slightly overweight?
Sort of a backfire effect here. I didn't realize it was written by a woman until you mentioned it.
https://en.m.wikipedia.org/wiki/Demographics_of_Honduras at the very least you need more than that, Honduras itself is 87% mestizo
"always" is too much of an absolute. It really depends on a variety of factors, not least if which are other medications you might be on and underlying conditions. For example, ibuprofen doesn't play nicely with prednisone. Or if you have any sort of existing liver problems then acetomenophen is really not a great idea.

If you have a regular doctor, it's probably a good idea to ask which of a few different options are safe for you for occasional use, and probably check in if you find yourself needing something for longer than a few days. (And if you don't have a regular doctor, find one... If you lack insurance, it's still probably worth the money to pay once a year for a physical, and also have a resource that knows your health history that you can consult with. For basic questions, like "does my medical history rule out acetomenophen", most doctor's offices will take a message for the doctor and then call you back with an answer)
From the article:

> Each A2DP service, of possibly many, is designed to uni-directionally transfer an audio stream in up to 2 channel stereo, either to or from the Bluetooth host.

This matches what I has heard: Bluetooth devices with A2DP profile can either receive or send high-quality audio, but not both at the same time.

I don't know if there are Bluetooth headsets that have separate A2DP devices for input and output sound, I have never heard about them, but I would be very interested in knowing of their existence.

Also from the article:

> These systems often also implement Headset (HSP) or Hands-Free (HFP) profiles for telephone calls, which may be used separately.

This is the common case for Bluetooth headsets, the Bluetooth manager switches profile when the microphone is needed, but that greatly reduces audio quality.
Not very surprising. Communist labour unions are very powerful in India. Most of them are backed by the communist parties who have CCP patronage.
I agree that it wasn't perfect, no doubt about that. It definitely restricted the ability to mass communicate into fewer hands.

In general, the reduction in communication friction is THE big advance brought about by the Internet. Instant, effortless, and basically free communication for everyone everywhere.

Businesses like Facebook, YouTube, and Twitter are economically incentivized to push as hard as possible to get you to consume and create more so that they can show more ads. That means that when a video catches the attention of 50 people long enough to show an ad, then they can quickly encourage the spread of that video very rapidly to maximize that attention grabbing clip.

Nowhere in that equation is there an evaluation of the benefit/harm of that content to the end user. The evaluation is solely on whether it grabs attention. Because the product now being sold is human attention and its being bought by advertisers. The humans being influenced have no say and don't actually reap any gains from the transaction.

Car wrecks are attention grabbing and slow down traffic even the other side of the highway as people gawk. But of course they are not great for anyone....UNLESS you somehow have a business model that makes more money when there are more car wrecks. What happens then?
I think Canada is taking some steps in this area too but for the life of me I couldn’t find any details, just mission statements
They seem to be hooked up to a digital circular file. I've submitted probably ten of these and never gotten a follow up. Their forums where you can request help and note issues are infuriating, they have some low level person come in and annoy the asker with canned responses and irrelevances. Google is where customer service goes to die, then have its body exhumed and desecrated.
Compromise and work morning/evening for calls.

It works fine if you have an employer who recognises this and doesn't expect you in the office from 8-6 too.

I used to have 2 bosses/teams, one in Dallas other in London while I was Sydney based. I'd have meetings outside typical hours morning/evening.

The company was fine if I was regularly out of office and taking part of the day off as my job was getting done so it worked.

If I had managers that were "why is he coming in at 11am today" it would have been a nightmare.

Also it can run quite well for task lists, work getting done while you sleep. Often I leave tasks at the end of a day and they are done when you wake up. This offset if you miss resource access during your day depending on setup.

Personally I find it fine, but I've always been ok with doing a bit of work out of usual hours.
Ah yes the two genders: American and Tatar.
Thanks. I learned something. Maybe now I can fix our video playback on our website
One mature oak tree is like 20 kg / year. You can easily plant a sufficient quantity to cover that. Especially since Earth is not at carrying capacity yet.

But that's hardly necessary. I can just pay you the minimum necessary to get you to shift off fossil and I make some good savings.
Google Voice is back. They forced everyone off of Voice and over to Hangouts; now, they’re forcing everyone back.
> not that it's comparable to book burning

Nazis burned porn and trans literature, they're more alike than you apparently realize.
I share your opinion of SAML, but I have to ask, as someone who has also implemented it in Golang: what gave you any confidence in an implementation backed by encoding/xml? It was to me immediately pretty obvious that DSIG and encoding/xml aren't a fit, if only because of encoding/xml's poor namespace support. There are other DSIG Golang libraries that use an etree-style interface for what I presume is the same reason.
Machine translation. Dictation. Assistive devices. Robotics. Control systems. Protein folding. Search that's better than ctrl+f. Helping you find a good movie to watch tonight. And much much much more.
There are electric (battery) versions of these vehicles for use in tunnels, where diesel fumes would be a problem. Much construction equipment is often converted roadbuilding equipment, and that's still diesel powered.

However, railway vehicles tend to last for decades, so it might take a long time for everything to be electric. The people buying them can both afford and have the expertise to purchase reliable, repairable equipment. It's then run on a perfectly smooth "road" without much rough handling.
> With WSL2 there was never before LESS reason to switch away from Windows.

Yes and no.

WSL 2 provides a decent development environment (I've been using WSL 1 and now 2 since it's been available), but there's still much to be desired. Such as not having horrendous file mount performance on Windows mounted drives, not having to worry about WSL 2's VM eating up and not reclaiming your disk space and memory. But let's ignore those things because IMO they will be fixed in due time.

Windows is way behind the curve with tiled window managers vs native Linux and while technically you can run VcXsrv and run a tiled window manager through WSL 2, it totally fails on multiple monitors and also requires installing everything within WSL's file system. It just feels like you're battling 2 operating systems.

Also from a "just let me use my own computer as I wish" perspective, Windows is still spying on you with telemetry even with basic mode and using Windows Pro and it forces updates on you. This likely will never change and if you lived in a world where you could run everything you wanted on either Windows or Linux, I think most people would probably opt to have the OS that doesn't spy on you and reboot on its own right?

IMO native Linux is more than just features vs lack of features. It's a whole mindset shift on how everything works and how you can mold your dev environment to do exactly what you want instead of being forced on what to do by some company. I would switch to native Linux in a heartbeat if Davinci Resolve worked well on my hardware (a video editing tool that runs on Linux). Video editing is the only use case stopping me from switching.
That can be solved with the right company culture and a good manager. If someone was disturbing my work in that manner I would mention it to my boss, who would probably tell me to not spend time answering them next time and direct them to the proper support channel. If it happened repeatedly, then my boss would escalate it with the salesperson’s boss.
Very cool! How are you acquiring users and marketing the service?
Exactly. Every Facebook design change was decried loudly. Then no one really gave a single faint fuck about it in a few weeks.
Its the NY Times article and then Mastercard threatened to cut access to their payment platform which is why Pornhub acted so fast.
I agree with a lot of these but the option to opt out would be your choice already by stopping use of the service. Or are you thinking that by opting out you could pay for the service instead?
Yes.

https://www.facebook.com/BugBounty/posts/approaching-the-10t...

CDN bug report... Earlier this year we received a report from Selamet Hariyanto who identified a low impact issue in our CDN... a very sophisticated attacker could have escalated to remote code execution. As we always do, we rewarded the researcher based on the maximum possible impact of their report, rather than on the lower-severity issue initially reported to us. It is now our highest bounty — $80,000.