skysight-inc/HackerNews huggingface dataset:
Keep in mind that it triggered on three separate strings. The chance of them all being malware/vulnerability signatures seems pretty low, unless their method for generating those is particularly reckless.
SIM swaps are relatively easy in Australia, requiring only some fairly simple social engineering of staff in a phone store.

Number porting is trickier, requires a name and account number (or DOB in the case of a prepaid account) of the victim and they receive an SMS informing them their number was ported in advance.
Perhaps not today, but it's a competitive, operationally heavy, low margin business. Doordash is public now. The growth has to come from somewhere, no?
> Imagine if they demanded your SSN to sign up? A phone number is no different or less sensitive a unique identifier, perhaps even moreso these days.

I have extremely bad news for you. US Social Security Numbers are not in fact unique, and the fact they're "sensitive" is a terrible joke because it's pretty easy to discover the SSN for an individual based on public information, especially older people because SSNs weren't even randomised at issuance until relatively recently.

Any system that depends on keeping public facts secret is horribly broken, yes that also includes "verifying" credit cards based on a bunch of digits that are written right on the card itself.
Also in fairness to Stephen Hawking and Neil deGrasse Tyson (I don't know about Bill Nye), I don't think they were adversarial toward religion. Certainly not like Dawkins.
Before going backpacking last year, I decided to learn a bunch of knots while I was watching TV and relaxing. It was really helpful during the trip; I'm usually a "use a variation of an overhand or square knot for everything" type of person, but knowing a few specialized knots was really helpful when setting up camp (securing tarps, hanging hammocks, attaching gear to the bag).

This is my favorite knot, its called the midshipman's hitch on animated knots but I knew it as taut-line hitch from my book: https://www.animatedknots.com/midshipmans-hitch-knot
No matter who you are, vaccination is safer than catching covid. The vaccines are designed and tested for safety; covid gains evolutionary fitness from making you sick. As a result, the risks from vaccination are orders of magnitude lower, no matter what the covid risk is.

(Edit: Deleted second paragraph that wasn’t clearly worded.)
My strategy is to have a second phone that has Authenticator and is also the phone for any SMS based 2FA.
The phone is locked in a file cabinet when not in use and never leaves my desk.
An extra phone only costs me $10/month. Well worth the peace of mind.
But we often don't. I just got my covid shot and with it a request to sign up for vsafe, which needs a phone number. (Which means i can't sign up since I have anti spam protection on and so their texts don't get through )
I’ve used Firefox almost continuously since the Firebird days but the dumbing down of the browser, along with dubious moves by Mozilla over time, have caused me to recently give other alternatives a shot. I was surprised by how nice Vivaldi is, and it seems like the new “power user” browser (https://vivaldi.com/). Brave (https://brave.com/) also seems innovative for its monetization model for the web.
One requirement seems to be that the driver can access the mailbox without leaving the vehicle. So the equivalent in Europe would be the bikes (or, nowadays, electric scooters) that are used to deliver mail. They are typically specifically designed for the postal service.

So it might be less different than it seems at first.
Yep, I saw how communication in M:tG Arena worked, and I thought about how much less toxic that community is, possibly as a result. There's still ways to troll, but they're limited and hard to cause any real trouble with.

My problem with accountability is that it doesn't seem to matter. Facebook users have shown us that even linking terrible content back to real people won't stop the real people from sharing those terrible content. Anonymity (or its inverse) isn't the answer.

Has anyone tried putting up a paywall to use comments? I feel like surely someone has, but I can't think of an org off the top of my head.
tell me. On some little-used accounts of mine i need a new password for every login. Then there's one particular account which never lets me login. I have to make a new password every time...
Lodash has deprecated these individual packages and they will be removed in v5: https://lodash.com/per-method-packages

They recommend adding the main `lodash` package and then importing only the functions you need.

import throttle from 'lodash/throttle`;

I prefer using the `lodash-es` package for the reasons outlined in these 2 blog posts

https://til.hashrocket.com/posts/dnzttruljf-prefer-lodash-es...

https://itnext.io/lodash-es-vs-individual-lodash-utilities-s...
The performance is awful. If they just did a site wide CSS and HTML makeover, that would've been fine. But they somehow crammed enough JS in there to make my computer beg for mercy.
There are large swathes of the world, where significant fractions of the population refuse vaccines out of fear of witchcraft and voodoo.[1]

Do you think we should add an FDA phase five stage, where exorcists and witch doctors carefully study Covid vaccines for evidence of black magic and evil spirit? Because it's perfectly sensible to let rational people die to satisfy the whims of whoever holds the most irrational beliefs? Because you're making the exact same argument, except just substituting out Western anti-vaxxers for folk superstitions.

There's no evidence to indicate that anti-vaxxers are sensitive to clinical evidence whatsoever. A third of American adults are considering foregoing the vaccine[2], despite it being the most extensive and sophisticated safety trial in vaccine history.

Why would you believe that the minutiae of the FDA approval process would have any effect on anti-vaxxers, when the vast majority of their beliefs come from wholesale fake news.[3]

[1]https://www.econstor.eu/bitstream/10419/172046/1/884014355.p...
[2]https://apnews.com/article/ap-norc-poll-3rd-adult-skeptical-...
[3]https://www.thelancet.com/journals/landig/article/PIIS2589-7...
"emacs-ng's JS implementation clocks in over 50 times faster than emacs 28 without native-comp for calculating fib(40). With native-comp at level 3, JS clocks in over 15 times faster."

I missed the native-comp note the first read through. Thanks!
It's an unfortunate accident but I'll write down why I think it's good.

> having countless hours of work be obliterated by an automated system without manual review (presumably) is terrifying

The code in question was "obfuscated" to an automated system, yeah they're unicode escape string for a utility library but a lot of usages of binary/unicode escape strings in code is considered to be some malicious obfuscation.

What they did is smart. They have their analyzer set to fire on obfusacted code. They direct it to you. If you're a perpetrautor you'll say oh noes they got me, if you're innocent - you'll request manual review, contact support or escalate in some other way and they get their manual review from you actually.

I would guess that their false-positive rate for this static analysis has to be low. There aren't many legitamate usecases for these escape strings.

The solution they could consider is to after this alert is fired to check whether the file in question matches a checksum of some recent lodash releases but in the end "using lodash" is not an excuse, as a developer you're also responsible for the dependencies you bundle with your extension so you should be mindful of what code malicious or not is in there.
Doesn't Microsoft have an end-of-life date set after which they will only support Edge? It seems like the IE horse is guaranteed to drop out of this race.
Someone like Pine64 will make it work, then Apple will "invent" it and add another trillion in market cap for doings do... /s
How about a big, multi-line URL text field on mobile browsers?

Can't stand horizontal scrolling to the beginning or end of the line to change a domain or parameter. Let me edit in multi-line mode when I tap on the URL.
Microsoft Authenticator is good, and there’s a reasonable chance they already use it at work.
However, I understand that maintaining features & options can incur costs,

Don't be persuaded by that argument unless you have a good idea of what the actual costs are --- especially when the one making the argument is also spending what is almost certainly a lot more on new features that almost no one cares about.
Maybe not, but it's possible many post offices would need electrical supply upgrades to handle having their entire fleet plugged in all at once. Not impossible or even difficult, but not free either.
> Our company follows pretty standard practices. Before anything is worked on, everyone has to write in pretty excruciating detail what is being done, from juniors all the way to our marketing department.

That's not at all standard, at least not if you're talking about documentation that's actually available in a useful fashion.
Clickable survey link: https://www.surveymonkey.com/r/JN7V3WG
That's really neat! I'd never heard of that. I think you just saved my future self many many keystrokes.
Since we know the answer to the question already, hopefully this is just giving political cover to cancel this program. Even if it were free to finish development, a 1x per year, expensive, risky rocket, with minimal extra lift capacity would not meaningfully change anything about space.
Ideally they would make money by making a better product, not neuter their existing good product to force users to use the worse but more lucrative product
it shouldn't be necessary for users to know this because the permission-granting relationship is potentially adversarial, so the user will always be on the back foot unless they're technical/power users. It should be Google's responsibility to ensure that extensions only request the permissions they need.
List of Founders Speakers for Your Next Online Event
Leetcode is only worthwhile if you want to break into the FANG/unicorn type companies. These jobs often pay the most but:

A) They are not the only companies that good software engineers work at.

B) One's happiness is not predicated on getting a job at FANG and getting paid a boatload of RSUs. People that work there aren't as happy as you would like to think. See here: https://en.wikipedia.org/wiki/Hedonic_treadmill

Also I call bullshit on anyone that claims they did all 1600 leetcode questions in a year while also managing a full time job AND maintaining any actual quality of life. The solutions to all of the problems are available in the comments and mastering 200-300 problems is enough to get a job at Google. There are many poorly worded questions that honestly aren't worth doing either so I wouldn't be concerning myself with someone who has done all of them because I don't even believe that they did them all without looking at some of the solutions first.

Lastly, if I were interviewing you and got even a whiff of the terrible attitude that you portrayed in the OP I would not hire you - and this is coming from somebody that has had a depression diagnosis and takes anti depressants. You need to get help if this is how you usually feel.
They used to work just fine standalone. Have had one for years.

Would join such a class action if it existed, except the machine was a gift so probably don't have standing.
but it still works on an individual basis.

It's less effective if the recipient believes the vaccine is ineffective or dangerous, and can make side effects more likely to occur (nocebo effect).
The chance of catching COVID between now and the other vaccines being made available is quite low.
Hi, OP here. Most importantly, mega thanks to Fabian Keil, the lead developer of the Privoxy project. After 17 years and over 4,500 commits, Fabian’s dedication to Internet security, privacy, and the open source Privoxy project is unequivocal. Additional thanks to the entire Privoxy team and our incredible team for getting us here. Our project, Security and Privacy Plus, is to provide commercial support for the preconfigured appliances we created which allow for easy spin up, testing, and usage of the incredibly effective and flexible filtering system Privoxy provides. Our goal is to make this necessarily technical software available to a wider group of people via a cloud control panel and a virtual appliance, and we have successfully done this. The Privoxy project made it effective, we made it shiny. Give it a spin
Also wouldn't that raise the height of the driver's seat? Would make it harder to reach standard-height mailboxes from the driver's window.
Template Rendering Failure at %Company%
More generally I want more levels of access for apps and extensions.

In particular: Why do we assume that all apps and extensions should have unrestricted access to the internet? Why is that not a privelege like "read and write" contacts in mobile apps or "read all tabs" in extensions?
I think some platforms that use SMS 2fa explicitly ban this path for some reason. They can detect it and don't allow those numbers to be used.

It's a really backwards and confusing system, I agree.
The original piet-metal codebase has a tweak where very thin lines are adjusted to thicker lines with a smaller alpha value, which improves quality there. This has not yet been applied to piet-gpu.

One of the stated research goals [1] of piet-gpu is to innovate quality beyond what is expected of renderers today, including conflation artifacts, resampling filters, careful adjustment of gamma, and other things. I admit the current codebase is not there yet, but I am excited about the possibilities in the approach, much more so than pushing the rasterization pipeline as you are doing.

[1]: https://github.com/linebender/piet-gpu/blob/master/doc/visio...
Not exactly, but I use privacy badger and ublock origin, like I think a lot of people do, and that seems to block a lot of javascript, mainly the kind of stuff you don't want - tracking, ads, malware-ish etc.
Average users are absolutely not gonna read all that stuff, much less understand it, when they accidentally install a malicious extension. I'm all for more powerful browser extensions (I really miss vimperator...), and I agree that permissions should be more granular, but I don't think that's gonna fix the issues that the average user of chrome has with them.
Yes, but isn't this exactly one of those exceptions?

You need this exact model of X, Y, and Z, because those have been validated as a working combination through a huge one-time capital expenditure; and changing anything would entail going through that again.

Vendors tend to not mark down prices for components, but rather just sell them for MSRP for as long as they can, and then immediately stop producing the item. The margins on each component were usually thin enough that there's no way to sell the component any cheaper but "make it up in volume." It's either "sell it at the MSRP" or "don't produce it at all."

As such, the only place to get the component after the original vendor ceases production, is the secondary market, e.g. new old stock. This is where you see governments buying old 5.25" floppy disks for huge markups.

In that case, like I said, why not just buy all the 5.25" floppies you'll ever need in advance? They know they'll be using them for 50 years, because that's the decomissioning schedule for the system they just built, and they'll be unlikely to ever get budget to replace/upgrade it before then. They also know how long a floppy lasts in use. So, do the math, buy that many floppies early, and toss them all in an airless vault. Right?

And the same thing would be true here with particular-model CPUs, no?
Agreed! I don't know why everyone seems to think they look weird. They certainly look different, but I really like how they look.
What's weirdest to me, what's suuuuuuper weird, is they're just crappy little vinyl cutters. Vinyl cutters have existed for decades, they're cheap, reliable, and fairly straightforward to use. They're just not saturation-marketed to the JoAnn Fabrics crowd.
From my experience, if you are unmuted, and the host mutes you, they can unmute you again. If you mute yourself, the host is unable to unmute you.
Hmmm you might have a point. That way of reading it is way more amicable. Thanks.
It’s important to understand that this is a big problem. If a type system is Turing complete, than it either has to be inconsistent or incomplete. In other words it either must allow type invalid programs through, or it must prevent some type valid programs (or both!).
I keep a couple lengths of rope (550) next to my desk. When I’m pondering a challenging problem and I can’t take a walk, I practice knots. I find it to be a very good way to get my head completely off the problem and yet easy to stop so I can start working again.
Isn't that kinda the opposite of the issue here? The people doing the designing were given strict requirements for heights and clearances; there aren't many designs that would have fit those requirements.
It got upset at something that wasn't even changed by the minification.
Ironic that the company which makes the most used software on the entire planet (their search engine) can't read code and was spooked by some Unicode escape codes...
How do you differentiate your company from https://www.bidgely.com
Acts like a denier? Either he does or he doesn't.

If he's not denying climate change, then it's a lie or willful disregard for the truth to say he is, and encourages the people who think it's a religion and a conspiracy. The morality of slander is not even the point, it's that tactically, you don't want to be seen making unfounded attacks because you're essentially ad-hominem'ing yourself.

I read a book of his a long time ago, and I am not 100% sure he isn't a denier these days, but he wasn't then, even though he definitely was trolling as hard as he could.
I think this is likely to be down to the different expectation/requirements of people who use their soldering iron a few times in 30 years, compared to people who have theirs hot most or every day.

I bet your soldering iron is fine for everything you want it to do. I also be it won't let you work with tiny SMD components or reattach micro usb connectors out at the drone field where you damaged it in a crash...
Chrome has very fine-grained control (both per-feature AND per-domain), and makes you jump through hoops to get access like this extension has. It's really hard to write a Chrome extension with access like this and get approved in the first place, and also explains why they're trigger-happy.
The "View page source" pages too.
Very efficient reduction of overhead.

Because 'äwwritzing kauntz in laadsch ämmauntz'.
I’m a newbie to this stuff - is BSD usable as a daily driver on a personal laptop?
Show HN: Tutorial - How to create a simple path based Microservices architecture
> I wouldn't really know though unless UCB is really only sourcing its main-stage talent from their classes, which I highly doubt. because if they were, that'd sound like a pay-to-play type of thing

This is exactly what was happening. You have to understand, this is not a one-off $450 dollar class but a “curriculum” (101, 201, 301, 401). There were requirements after graduation from 201 and 401, where to pass 201 you pretty much had to prove that you didn’t shout racist profanities on stage, and after 401 you had to prove that you were able to carry a bit, and there was a weird tiered culture where improvisers would only associate with people who had attained specific levels.

Once you went through these four classes, you had the opportunity to audition for improv house teams which performed every Tuesday night in a marathon 4ish hour block. I remember there being like 6-8 house teams with 8 members each, but even then competition was incredibly fierce. Sometimes, at the highest levels, comedians who were established elsewhere would be brought in, but talent was mostly internally sourced. I remember being somewhat shocked to learn that the house team members were not only unpaid but also had to pay monthly dues.

It was an incredible opportunity to get on these house teams and there are a lot of wonderful comedians on the national stage who cut their teeth at UCB. I took classes on and off from like 2007-2017ish and remember them being around 200-ish dollars at the start, and I don’t regret any of it. Nothing will ever beat the experience of being in a groove with your fellow improvisers and bringing down a house. I’m also incredibly thankful that I got to meet all the instructors, who are all hilarious comedians in their own right.

I apologize to the OPs; I don’t really know how funny they are or what their classes were like. I just had the sudden image of being a kid who moved to NY for comedy, trying to climb the UCB ladder and saving for classes, only to be in a room where most people literally made five times what you made, sitting and watching two “senior software engineers“ do two person scenes in tinnitus inducing silence, listening to them try to get rise from the room with references to things like Amazon EKS as they pantomimed scrubbing dishes next to each other, and then having to listen to as many minutes of notes on this scene from the instructor. Truly bleak.
[[citation needed]] specifically for vaccines.
Someone is going to have to take one for the team and SIM swap a senator if we ever want that requirement in the states.
> It appears the algorithms are crude by Google's standards.

I’m not Google but I’m not sure if I agree here (though I agree with you and the parent comment generally). It’s extremely uncommon, lodash notwithstanding, for JS code to have a dense set of regex partials full of Unicode escapes, even with modern build tools. It’s a lot more common for malicious scripts.

Determining which is which would require a level of static analysis of dynamic code that, if Google had it, they’d be showing it off in hot new build tools. They’re just making the somewhat reasonable assumption that it smells bad, and overreacting.

And if they were to whitelist known popular libraries there’d be an uproar about playing favorites and excluding some extension which uses, idk, xregexp, to improve accessibility.
I disagree that the USPS shouldn't exist in its current form, but I am always dismayed at the quantity of mail I immediately chuck in the recycling bin (easily 95% or greater). I bet if USPS raised their bulk mail pricing, we'd have a lot less junk.
I then checked about:config (which was also sabotaged recently to make it slower and remove features),

For many years I've lamented the usability of about:config and wish they'd turn it into a tree structure and/or at least provide useful descriptions of the options (if something as space-constrained as a mobo BIOS can provide some descriptive help text next to each option in the setup screens...), only to find the next big change they did was that abomination of "designer-ism" (for lack of better term.) That felt like a punch to the face.
It is.

You can also hit ^C, and it will prompt you with instructions.
Two knots: bowline and trucker’s hitch. You’ll need them one day.
> I wish Chrome and Firefox would adopt a content blocking system similar to Safari, where the author of the ad blocker can essentially tell the browser what content to block, but the ad blocker itself doesn't get any information about user activity.

Please, no. This is exactly what makes Safari all-around worthless, despite all the hard work they put into it.

Chrome will get forked the minute they do this, and the forked version will restore that functionality, and I will immediately install that fork and uninstall Chrome.