skysight-inc/HackerNews huggingface dataset:
Do you seriously expect them to pay $100k for a decently serious bug in only one of their products?

In comparison, Apple paid 100k [0] for a full account takeover, using an bug so simple that it is unbelievable that it could have passed a code review and testing.

[0]- https://bhavukjain.com/blog/2020/05/30/zeroday-signin-with-a...
People complained about the game for its frame rate dips actually.
Ok. How much? And is it toxic at that level?

I mean, I could take blood sample from any, any, HN reader and find arsenic. No problem. But it’s natural right. So no big deal. And at levels that aren’t toxic.
Just like it has been for the past like, five years or whatever. Sure.

It's always on the horizon. (Read: Never gonna happen)
New York City's first dedicated coronavirus-prevention shop
great, thanks! i'm on the case
Why would you need to do the builds natively instead of cross compiled?
My son is interested in mechanical keyboards. Has built maybe six. So consequently I get involved. I’m not very impressed. The prices are extremely rich on everything. There is an extreme social media marketing bs around everything. But the worst part for me is the PCB boards are mostly all coming from kbd fans (apparently one of the better makers) and their technical support is awful. Two different boards have developed problems which I’ve gone to great lengths to debug. The assistance from kbd is awful. Basically their answer was “here is a 12$ coupon, just buy a new $39 pcb”.

And before fan boys attack me, both keyboards worked for a while and then developed problems. In the dz60 case somehow the cascading comm channel of the RGB stopped working. In the kbd67, far right column quit responding even though I trace the continuity to the atmel microprocessor.

Cannot find a schematic for the kbd67 so I’m reduced to buying another so I can compare the circuits....

Another dislike is that full size keyboards are scorned and generally unavailable. Hey check it out, I’m a full sized adult doing full size job with my pc, so I actually do use the number pad, etc.

Overall bad value for money and too much social posing.
Has the concentration of population in cities helped us in the past when things gotten quite rough?
https://archive.vn/FAJm1

Shop: https://www.cv19essential.com/
"Eroom's law is the observation that drug discovery is becoming slower and more expensive over time"...
This is about samples returned to Earth, analysis is not constrained by instruments on a spacecraft
Well plant production for meat includes things like soybeans and corn. While they're non-perishable it's not what those in food-insecure places would want to eat. Grains yes, but I hazard malnutrition is owing to lack of other food sources.

On the local level I think companies lobby against redistributing excess foods for free to keep prices high. Something's got to give, either food waste is drastically diminished or we redistribute all of it.
I got a job as a developer at 16
Wow, I was looking for a T1/E1 adapter recently for a side project and couldn’t hardly find anything. Sangoma seems to own most of the cards nowadays, and they’re awfully expensive and just awful in general. The only remotely affordable line for me was the Digium line and the documentation for their DAHDI driver outside the brief read me is basically telling you to contact support. And unless you’re using them for an Asterisk setup (I’m not) community support seems to be useless. I ended up paying around $500 for a single port Digium card which I’m not even sure will be able to do what I want now. Other than the expensive Sangoma lines, I was able to find what seemed like a perfect option from GL, except I was quoted $10k, which wasn’t happening. Only other manufacturer I could remotely find was a company making PRI cards that wanted you to fax or email your credit card info. Nice to know there’s another option now.
> Why waste silicon on anything but PCIe then?

Power. PCIe is a fairly power hungry link. On-die parallel connections are incomparably more efficient.

Special low power links like MIPI PHYs also have their place.

USB is high enough speed that you will get quite a bit of overhead from USB>PCI>memory route, and back.

Audio is a particular pita, network too needs as close, and direct as possible connection to the CPU to get maximum performance.
ISPs can't deeply inspect TLS traffic. Employers of course can, because they can insert their own trusted certificates on their own boxes.

Now, if by 'inspect' or MITM in this case you are talking about inspecting the TLS headers, that's possible, and based on the other comments it is exactly what this ISP was doing - checking the SNI of the TLS requests and blocking based on those.

But an ISP that hasn't somehow broken TLS isn't in a position to check the encrypted contents of your packets (e.g. HTTP headers, bodies etc). Your employer can very well have installed a TLS MITM device that is trusted by your company-issued device to actually inspect the contents of your encrypted packets (by acting as a proxy - you actually have a TLS tunnel with the MITM device, and it has a separate tunnel with the TLS server).

Certificate pinning can block even these types of employer MITM inspection, and it can also protect from rogue CAs issuing ilicit certs. But if your ISP is in possession of PKI certs for google.com and outlook.com, then the CA that issued them will soon be removed from the trusted list.
Yes; thus the testing of the powered external 16x risers (see the last section of the cards).
Did ghost.io not make a dent at all? it feels like aiming for the same market, with modern technology and faster pageloads.

Not easy to install compared to php, that's for sure. This may be a blocker.
"But skills can beat ageism"

I dislike this typical response, because it comes close to blaming the victim, and indeed many people do blame the victims of ageism, attributing stereotypical attitudes to them. Imagine claiming "skills can beat racism" or "skills can beat sexism". No, nothing beats discrimination, because it was never based on the existence or absence of skills. Rather, prejudiced people take one look at you, see your gray hair, and make assumptions about you, and you can't beat your hair color any more than you can beat your skin color.

Well, you could try to dye your hair and get plastic surgery, but again that has nothing to do with skills.
It has been the opposite experience for me in continental Europe.
Closed source firmware bits, unfortunately.
Congratulations on your launch! I like this idea a lot.

On your about page you say:

>> Part of our solution is the automatic scraping and aggregation of data from all over the web.
In addition, we are partnering with different organizations that provide us with verified sustainability data.

I don't understand how scraping the web is useful to you. Can you explain?

I also don't understand how partnering with orgs will provide you with verified sustainability data. What type of organizations are these?
This was a bug that affected multiple products and even crossed into the enterprise suite and google only rewarded $3.3K USD?

It’s almost as bad as Apple’s reward program
The most surprising part to me is that this works:

window.frames[0].frame[0][2].location="https://geekycat.in/exploit.html";

It's expected to me that you can change `window.frames[0].location`, since you can also change the "src" attribute of the iframe element. But you can't change the "src" attribute of an iframe inside that iframe, if it's not same-origin - so why can you change its location?

Maybe we should look into whether changing this would break any websites.
Ask HN: How will hotwire strada work?
Strada will premiere in 2021.

How can a server rendered app be compiled to a ios/android app with a single codebase?
Show HN: POP3 Client for PHP
At least UE4 is not well tested at all. Most of the code doesn't have any decent tests. It's all "developer writes the code and runs once on his machine and then pushes to prod" type of code.
I don’t want to be a downer but don’t you think it’s just way easier to learn now because we have so many great resources available to us?
which is... precisely why GP suggests that they _should_ be held to account
Your claim that people learning to play the game "effectively removes the benefit" of procgen content is false. Games like Spelunky are played by people for much longer than the average indie game precisely because the process of learning the meta-game takes time but is still engaging.

If you want to calculate how much "AI generation" or "procgen" is freeing up resources you also want to look at how long people are playing these games for and how many resources were used in making them. If indie teams of 2 or 3 can collectively make the world play their games for longer than it plays games made by much bigger teams, then that's a definite freeing up of resources. And this is what's happening today to some extent.
MDacne (YC W17) Is Hiring a Growth Marketer
Other than the integrated graphics that are directly part of modern Intel CPUs, everything else you mention is typically internally connected by PCI-e. Onboard USB ports lead to a controller which talks to the CPU via PCI-e, for example.

PCI-e lanes are a limited resource on a CPU and really fast. Dedicating one to a keyboard, for example, is probably inefficient.

I have heard (don't know too much about it) some Intel NICs are able to place network packets right in the CPUs cache for maximum speed, this probably can't be done via PCI-e.
>For example, things like "Floating-point Javascript Convert to Signed fixed-point, rounding toward Zero" should not exist at all.

It should exist because the alternative would be C style undefined behavior in Javascript. Remember how everyone says that C is fast because undefined behavior means that C does not have to encode the semantics of a particular architecture to be fast and therefore is the fastest on every architecture. Things like bitshifting have subtle differences between architectures and therefore have to be undefined behavior to be fast everywhere.

In Javascript it's the opposite. It cannot have any undefined behavior because it is untrusted code that has to be executed inside a sandbox and not infect the user's computer. But people wanted Javascript to be faster so they simply took the behavior of the fastest and most common architecture that Javascript was used on and just put them into the Javascript specs. That architecture was x86 and to our surprise: ARM is not x86. This means if you want fast Javascript on ARM, it has to adopt x86 rounding semantics. Compared to the unbounded costs of undefined behavior it's a microscopic price to pay.
How does this work with people having a single child?

This might have been feasible in the past, with multiple children, but now, the woman becomes part of her husband's family or vice versa so(but I presume the former, since having a daughter is so undesirable in China), 50% of the parents get the short stick?
The last image clearly states: "The origin is under investigation, but a probable source is aluminium scraped off the spacecraft sampler horn as the projectile was fired to stir up material during touchdown."
Can you elaborate? Experience is preferred?
Cracks in the Conversation Table: Robert Pirsig and the Great Books Idea
Private capital’s rush into the business of sport
More like because capitalism is an inherently wasteful method of distributing essential goods.

If you really think, in 2020, we can't figure out how to preserve food for people in warmer climates, I don't know what to tell you.
My first thought was "can you boot from a PCIe SSD?" (looks like the answer is "no" from what I see). I wish there was a RPi with 16GB or 32GB of storage soldered to the board. Where I work we're using Raspberry Pi devices for industrial use and corruption of/wearing out the microSD card has been something we've wondered about. We could just buy premium microSD cards but having a "proper" SSD soldered to the board would be very helpful as well.
Perhaps it shouldn't be Google paying for the security reports, but the government... who then would need the statutory authority to fine Google for a very handsome profit?
Wisp: A light Lisp written in C++
Hmm I have telephone wires in the building. Is it still possible to do landline calls?

Landline aficionados could call each others. It would be a rather elite club! Of course, the common folk would follow. And it would be eternal september from there on again.
16ms is too slow. Gaming has long since moved past 60hz. 120hz to 360hz are the current targets, even the latest generation consoles are pushing 120hz modes.
In this case, I don't see it as a 'bug' though... I would see something like not playing music at all or playing the same unencumbered song on repeat as a bug.

Playing only a single song just long enough to earn a copyright strike means this feature doesn't exist. Instead, it's an implementation of a checkbox on a settings screen that enables some side effects that are not what the text next to the checkbox describes.
Why the myth of a perfect meritocracy is so pernicious (2016)
Do you need to version your component library?
That is indeed a good question, and the answer (like many chemicals) is “extremely toxic at high concentrations and nobody really knows the long-term effects at smaller ones because this would require enormous scientific investments that nobody will pay for.” But PFOA/PFOS is different from other chemicals in that it’s extremely long-lived and so it doesn’t break down rapidly the way many other chemicals do. Putting something like this into the environment should demand the reverse of the evidentiary standard you’re describing: we should know exactly how safe it is before you dump it into the environment like DuPont did.
Amun (financial technology services) is hiring lead DevOps
A more specific version of Jevon's paradox for the VFX industry is Blinn's Law [0] which states that "rendering time tends to remain constant, even as computers get faster."

[0] https://en.wikipedia.org/wiki/Jim_Blinn
Show HN: FixScript – the annoying part of ops, automated
Can’t talk about moon rocks without thinking of this https://en.m.wikipedia.org/wiki/Stolen_and_missing_Moon_rock...
> Google rewarded $3133.7 for this bug under their VRP program.

It's a pretty odd amount too. I'm curious how they arrive at that number.
If it was very deadly, it would be an obvious problem. The worst poisons are the ones that are deadly after decades, cause a broad range of diseases, and cause problems when the perpetrators are no longer around.
Monitoring data quality at scale with statistical modeling at Uber
"Raising children in China is extremely expensive"

I do wish more countries thought about childcare as part of their industrial policy and engineered large social changes to make it easier for parents to raise children.

Basic things: free, organized weekend activities (give parents back some leisure time), free babysitter services from teens on wednesday nights (give parents back going out nights), free child care accessories like carseats, diapers, bottles, etc (stop the implicit massive tax on having a child).

Imagine if we lived in a society where public school didn't exist. It would be virtually impossible to raise children while earning income. We live in that world in many regards, and then wonder why people don't want to have kids.
I'm 51 and I don't think I have ever experienced ageism in IT. I just switched to a new area (big data) one year ago for instance and had no problem finding a job. Maybe it's because I live in Europe and in the USA things are different, who knows.

But there is one thing though that can make switching jobs more difficult for senior developers, and that is the salary. Chances are that when you're older you are supporting kids, a house, or you just have become used to a higher standard of living. So you will probably look for a higher salary in a new job and yes, that limits your opportunities.
I'm author of a similar monitoring solution :) https://github.com/Cyclenerd/static_status
I’ve only ever experienced salary-ism which is just a side effect of being in the industry for so long.

The issue with getting decent reviews and salary bumps is that eventually you’re making more money than many people are willing to take on.

I’m 57 and working with a lot of people my age. We’ve hired a lot of older people.
Works fine for me on Ubuntu 20.04 (also WSL2) and binutils 2.34. Have you tried updating binutils to newer version? (>=2.32)
And Lo! This topic has been cancelled.

BTW: I like to read things from both sides of the political spectrum. And from reading the DailyKos and ThinkProgress comments I learned that the Left hates the "Koch Brothers" because they (falsely) believe that they're Jewish!
> which shot it down since the Saturn was supposed to bring the arcade experience into the living room and didn't need 3D.

This doesn’t add up when their most popular arcade experiences were Virtual Racing, Virtua Fighter, Virtua Cop and Daytona
> Cosmopolitan even takes care of the chore of translating your UTF-8 strings into UTF-16 when polyfilling functions like open() which delegates to CreateFile() on Windows.

That shortcoming of the MSVC runtime has been the bane of multiple projects I've done on Windows. Even without the portable executable trick, Cosmo might be useful as an alternative Windows CRT that can be used with GCC or clang. (Edit: Except that ARM64 Windows is now a thing, whereas Cosmo seems to assume the continued hegemony of x86-64.)
I think someone tried to be cute by having '1337' in the sum. If the figure wasn't so insultingly low it would've been fun.
Coronavirus: Hundreds of British skiers flee Swiss Verbier quarantine
Very true. One of the creators I interviewed - the Nemui - told me it took him about a year to create just the design. Figure in the prototyping, IC, and group buy stages, and then quality checks after the boards have been sent, then shipping them out, it can take 2-3 years from creation to completion (where the customer has it in their hands), and like you said 6-12+ months from ordering the board to having it as a customer.

But that's on the higher end, the "good" stuff. Lots of kits available now that can be assembled at home, or even pre-assembled.
Seems fine on Safari for me.
> You'd be surprised how many great FOSS (free & open source
> software) are out there that you can deploy on your own VM
> and have unlimited number of team members and OWN YOUR OWN
> DATA!!!

I'd love to run some open-source stuff for analytics or error tracking or application monitoring. And we have, in the past. And they work pretty well. When they work.

If the VM disk starts filling up because log rotation wasn't set up right, or the ElasticSearch instance we only run for this service starts flapping, now I've gotta pay one of my devs to work on that instead of work on our product. And in your example, where I've only got three folks, that interruption could be ruinous.

$200/mo ($2,400/yr) is nothing compared to the financial and opportunity costs here.
I don't deny ageism existing. It surely does.

But I regularly see "I want to reboot my career" mixed into the conversation and I wonder if the industry just doesn't value the decades of generalized experience a veteran brings to a rebooted career.

And if they don't value that, why not focus on the hungry 22 year olds who are easier to fool into focusing on work rather than life or family?

I think this is truly boneheaded, but that wouldn't surprise me...
The success of WordPress comes from outsourcing and business built around it.

You will find thousands of companies that do only WordPress projects, deployments, customization, and support. Ghost has none of it.
My bad, I see what you mean. You're quite right, although there is some research in using MEMS to move the projected foveated region physically, which would remove the need for ultra-high density displays.
Yes, that is how the survey works. None includes anything that can't be identified and raw html, too. That makes WordPress's achievement all the more impressive.
Unusually, for the time of year, the wind in early November dropped so low, that wind power in the UK, dropped to around 1GW, something like 2-5% of the grid total demand.

The uk needs to diversify its green energy, instead it seems to be consolidating on wind.
Shenmue does a better job at building the feeling of a particular place than most modern open world games.
Serious topic but article is a bit overly mysterious. Never goes on to explain the mechanism by which the "poison" leches into the creek and kills the cattle? Where it originated?
Their main point is wrong... but it is worth pointing out that a lot of the soils in the northest _do_ need to be tested not because of industrial pollution but because of agricultural pollution.

Apple orchards in particular up until the 70s often used lead arsenate pesticide sprays. Yes, you read that right; lead and arsenic. Sprayed onto plants. It accumulated in the soil and basically never leaves, and is a serious potential health hazard.

There has been insufficient discussion of this, overall, and it's basically "buyer beware" for land.
Of course and even more for me that I’m in Latin America and now I can easily access to resources from US and Europe
We're making an attempt with Peergos.
It's an old hacker reference to "eleet":
https://en.m.wikipedia.org/wiki/Leet
Python and MySQL Database: A Practical Introduction
If you open your eyes in the real world you'd notice that most surfaces are shiny and not dull like you see in games. You just mentally filter it out. Plastics? Shiny. Wood? Shiny. Leather? Shiny. Paper? Shiny. Grey rock? Shiny. China? Shiny. The lack of shininess is how you see it is a game.
its mostly that the bootloader has to be patched to see the devices, this is no easy feat as it would bloat the bootloader pretty hard. a chain boot of MicroSD to SSD is best at this time.
https://www.nytimes.com/2016/01/10/magazine/the-lawyer-who-b...
When Wonder Woman's Jet Made a Brief “Appearance”
Chinese Citizen Journalist Sentenced to 4 Years for Covid Reporting
Oh this is the one that's returning samples to earth. Doy.

Thanks.
> I only knew the home screen and browser were built on top of Windows CE.

The homescreen wasn’t. Not sure about the browser (this was booted off a disk, not built in like modern consoles) off the top of my head. Pretty much everything that was you got a CE logo while booting it.
Why not? As long as you distribute the software in source form and the means to compile and flash it?
What to Include in the Team Slide of a Pitch Deck
> But spare me the pearl-clutching over excess social orthodoxy from the side of the aisle that has for my entire life been foursquare for ideological orthodoxy and social conformance to their preferred norms. Change begins at home.

That's precisely why you should be concerned...

If the moralizers on the right, the ones you seem to resent, realize the left is taking it too far - it must be bad.
Had the opposite experience in London and I am not even 36 yet.

Could quote almost 10 companies that cancelled the interview in early stage or didn't interview at all, saying too much experience and worry I'd leave after 6 months for a better company (higher pay).

Gave up on interviewing for startups and medium companies. Get a job in a top tier company or starve to death. (Top tier is mostly finance in London because FAANG don't have big offices here).
Singapore is different compared to China or India because it has pretty high population density but acute shortage of land that can be used for farming. It is also a country that likes to plan ahead and have contingency measures to reduce dependencies/risk and actually has the political climate, knowledge and willingness to do what is necessary. I think it'll achieve great efficiency in this field.
Going by that criteria then I'd give the nod to Sony. Their dual analog sticks was really the game changer and has gone on to be the standard.