skysight-inc/HackerNews huggingface dataset:
Why would access to the fingerprint sensor give the ability to forge WebAuthn signatures? An app being able to detect that the phone’s user has their finger on the sensor does not in any way compromise the security of a different app doing the same thing.

Obviously one could write a malicious browser that implements WebAuthn wrong and compromises users who register with a site using that browser. This leads to discussions about WebAuthn attestation, and there are valid arguments there both ways.
Clubhouse Desktop (PC)
I'm having trouble finding a good citation, but I think the GP is referring to a quirk of US accounting rules that causes crypto trades specifically to be counted as revenue. The same does not apply to traditional financial market trades, which I think is what your numbers are.
Then people move to a different platform; what's the alternative - you let government choose or you allow wild west where no moderation is allowed?
If the protocol police doesn't include enforcement mechanisms for animal welfare related to IP over Avian Carriers, I'm not interested.

https://tools.ietf.org/html/rfc1149

https://tools.ietf.org/html/rfc2549
Additionally, it kills me to see the Pentagon whining about not having enough money.

They have more money than the next several militaries combined, and every weapons program for 20 years has been a gigantic cluster-fuck. They got a blank check for the littoral combat vessel, the F-35 and these new ford-class carriers. If that stuff is worthless within 1,000 miles of China because it turns out missiles are a thing, that's on the Pentagon and they should own up to it.
This is very smart.
It won't help if the virus mutates to a form that can escape the immune system.
I work in the humanities and disagree. I know plenty of people in neighboring disciplines, too, and can assure you that you won't need to read Foucault in any of them if you don't want to.
I think the point is that people want to be useful, especially if they're good at something. If people can't work (for whatever reason), we really shouldn't be trying to make them. That just burdens their coworkers/peers with their lack of productivity and/or bad attitudes.

We need to abandon these protestant values because they're not doing anyone any good.
Clubhouse Desktop App – Now on PC
Would I forget English if I was?

To be clear: I’m not ridiculing anyone in particular (native or non-native). I’m pointing out that a multi-billion dollar company experiencing a major outage could probably proof read the statements they put out about that incident before publishing. Else why not just go “if ur dns is bad its probs us soz, were on it”
That would be great but even if doesn’t get there, Racket is still an amazing ecosystem for exploring new ideas and will continue to love it. But of course any improvements are welcome
True, so I guess step 0 is:

0. Be rich and have money you need to launder

1. Invent "bunglemudgeons" as a way to launder your money
This is well known, Dutch politicians have for the longest time suffered from this particular issue.
Not sure I believe that, I think it was probably drop in profits because of the pandemic. My team has stayed coherent and 75% of us want to continue working from home because we're doing a bit better than last year and productivity and profits are up. There's nothing really special either about us, just a bunch of hardware and embedded engineers working on medical projects using email, webex and slack.
Important to note this isn't a memory corruption bug, though.

This is a case of the application working as designed, but in unintended ways. A logic flaw.

I say this because I don't see a lot of effort being put into solving these types of security issues, compared to e.g. memory safety issues.
why? The confusion?
Unfortunately it's not available in my country.
What's to stop someone from selling a vuln to Zerodium and then just reporting it to Apple shortly after? You get paid and Apple gets to fix it.
Appreciate the feedback and recommendation! You're right that explicit judgments can get stale - fortunately for our document collection the information architecture and article structures themselves are slow-changing (the answers themselves might change, but the document that answers the question probably won't for some time). We also primarily use explicit judgments to label head queries/common topics, and may augment our datasets with fresh data from time to time. The team is currently exploring augmenting these human-made datasets with automatic judgments using click models.

For realtime feedback, we've implemented (on another search product at Shopify, not the Help Center) a "near"-time feedback loop using implicit judgments to alter search results. Perhaps I'll write a post about that one soon :) . My colleague Doug talks a bit about the new systems we're building in this blog post - https://shopify.engineering/apache-beam-for-search-getting-s....
I do in fact think Myanmar's military will give multiple fucks about killing Norwegian citizens. Destroying their facilities, less so.
The difficulty is so low that it does not really matter. If you go by their bug bounties [1][2], then it is only $1M to full remote zero-click persistent compromise in both systems. If you go by Zerodium, which is a 3rd party purchaser and thus establishes a third party commercial market price, [3] then it is only $2M for iOS and $2.5M for Android. If we were to divide that price for an iPhone exploit by the number of iPhones sold in a year [4], then that is a mere 1 cent per iPhone.

As you can see, the price is so low it hardly even matters if there is a difference. There are literally millions of people in the US alone who personally have the liquid net worth to purchase a remote wormable persistent compromise that you can use to mass infect any Android or iPhone. Essentially every business with more than maybe 10 employees has enough assets to purchase such a weapon on the market. Just today I read on HN that the US government inked a deal for $22B over 10 years for 120k AR headsets from Microsoft [5] which comes out to ~$183k/headset. So, a weapon you can use to fully compromise any phone you want is equal in cost to a mere 15(!) headsets. That contract alone would be enough to purchase 10,000(!) vulnerabilities at existing clearing prices and $22B is only ~1/200th of the yearly US government budget.

Frankly, the entire thing is like two people jumping and comparing who is closer to landing on the moon.

[1] https://www.google.com/about/appsecurity/android-rewards/

[2] https://developer.apple.com/security-bounty/

[3] https://zerodium.com/program.html See Mobiles payout.

[4] https://www.statista.com/statistics/276306/global-apple-ipho....

[5] https://techcrunch.com/2021/03/31/microsoft-wins-contract-wo...
Except, like, where it's worked. Australia, New Zealand, parts of South East Asia.

Just last week Brisbane Australia had a small outbreak of 3-4 people. We locked down the whole city/region for 3 days to allow contact tracing to occur.

We've now relaxed those controls again but are preventing groups of 20+ people from gathering.

You also must wear masks in all venues where possible, including public transport.

https://www.abc.net.au/news/2021-04-01/covid-updates-brisban...

It fucking works. The fact that other western countries haven't been successful is nothing to do with the method but the implementation.

It also helps we force interstate and international travellers to enter quarantine for 14 days. But when I'm hearing friends families in Texas going to Prague for Christmas, and didn't have to quarantine when they arrived OR when they went home. Is it that much of a surprise the US and Europe is in such a fucking state?

Edit: just to add another reference to larger lock downs. Brisbane or the state of Queensland has previously had lock downs that went for months previously while we sought to prevent community transmission. Now for the last 4 months we've literally gone back to normal besides international holidays. Pubs reopened. Cafes opened. No restrictions. Dancing in night clubs. No masks.

Lock downs. Work.
Sometime in the last 20 years we simply stopped talking about fiber, and both kinds play a big role in gut biota. It's like we've simply given up on it.

Probably most of us aren't getting anywhere near as much pectin in our diets as we used to, let alone vegetables.
How many companies exist which have meaningful representation of onsite vs remote employees at various levels of seniority? Can you please name a few?

FWIW, at one of the FAANGs I worked that, HR shared data (promo rate etc) between HQ vs remote offices. But those were still remote offices and not remote employees who could work from anywhere.
When I first read Perl I was convinced all its advocates had some deep seated emotional problems. They kept insisting that the program would perform an action “or die”.
Mutt has also had a number of remote code execution vulnerabilities over the years: https://www.cvedetails.com/product/274/Mutt-Mutt.html?vendor...
Which is fine. A good leader is one who will endure some discomfort in order to benefit those they lead. Doing the right thing despite knowing it will keep you from getting re-elected is something a good leader does. Those whose greatest goal is to cling to power no matter the damage to the people they lead are not good leaders.
Besides the GPU, that's a pretty basic server config. Shouldn't cost more than 200/mo
SEEKING WORK Location: Los Angeles, CA Remote: yes
Backend contractor in Clojure, Python, and Databases.

Website: https://butternotes.com

-- tech stack in butternotes: clojure, postgresql, vuejs, musicxml and other music-related libs.

github: https://github.com/dt1

During the past few months, I've learned some NodeJS and VueJS. I'm currently learning how to build audio VSTs, using C++ and the Juce framework.

email: dbtoomey@gmail.com
I remember being shocked to hear my father say that he thought etymology was poppycock — after all, it was in the dictionary, so how could it be wrong! The older I grow, the more I agree with him, and this article doesn't change my mind much.
> Contrary to what you say it is the best language I've ever used for concurrency. It has it all, structured concurrency, cancelation, Flow, transparency (no await), etc.

I disagree.

Have you ever tried to actually implement something non-trivial that takes advantage of structured concurrency with cancellation? It's pretty hard to do correctly. Can you really tell me off the top of your head what the difference is between `withContext(coroutineContext) {}` and `coroutineScope {}` from within a suspend function?

Coroutines use unchecked exceptions for control flow. Kotlin also uses unchecked exceptions for fatal and non-fatal error handling. Figuring out how all these things interplay when it comes to coroutines and suspend functions has some subtleties that, IMO, are very difficult to figure out from just documentation and blog posts.

Also, Kotlin's standard types are entirely unsafe to use concurrently. The fact that MutableList inherits from List means that a function that accepts a List parameter CANNOT assume that the list wont change while the function is executing. So if you write `if (list.isNotEmpty()) { doSomething(list.first()) }` - that's a race condition because the list can literally become empty between the if clause and the body.

"But, wait! You should have just been smart enough to make a copy of your List before sending it between threads/coroutines." Okay, great. Let's do full copies of potentially-large collections. Thank goodness Kotlin is so concurrency ready that the standard collection types are persistent .. colle..ctions... oh.

Kotlin's concurrency story is really not that awesome. Scala is better, but still not perfect. Clojure is better still. Rust is good. Elixir (or anything with some kind of actor framework, I guess) is good. Haskell is good.

But I agree, overall, that if I had to pick a best app language today, it's either Kotlin or Scala, or Swift if you're writing for Apple stuff. I'll admit that I have a glaring experience gap with .NET languages, so I can't honestly say anything about C# and F#.
Location: Los Angeles, CA Remote: yes Relocate: no
Tech: Python, Clojure, VueJs, PostgreSQL, etc.

Website: https://butternotes.com

-- tech stack in butternotes: clojure, postgresql, vuejs, musicxml and other music-related libs.

github: https://github.com/dt1

During the past few months, I've learned some NodeJS and VueJS. I'm currently learning how to build audio VSTs, using C++ and the Juce framework.

email: dbtoomey@gmail.com
I think most people wouldn't be able to provide a dollar value for the upper limit, but could confidently say that $100B is over it.
I know this is a joke, but it really might be worth an experimental implementation, just to see where this leads. (Decent editor support would be critical.)
> You'd think Apple would have learned from others' mistakes.

Why would you think that?
You could also argue that it is still better than always-green status pages of cloud providers.
You wouldn’t hire someone who pours 100% of their technical efforts into the job you’re paying them for?
Did you read the same article I did? Because it seemed to be talking about all the programs that exist that feed people. Is your issue that sometimes private groups do it, and sometimes the government does it, and you would just rather have the government do it all?
I often use MMS. Whats the expiration date?
If I was worried about it I would build a process that didn't have a single point of failure like that.
It's not even a perfect analogy but I was instantly reminded of an episode of TNG where the Enterprise is booby trapped inside an ancient device that amplifies and redirects their momentum towards them as radiation (hurting the crew) and the ship cannot move. There is a way to quickly move the ship but it means handing control over to the computer and only has a 50% success rate. Failure means death. The crew refuses to hand over control to a computer* and, add a little Deus Ex Machina, and they determine that very slow thruster maneuvers could also free them.
They do it old school, with skill and human (Picard's) intuition. Tada -

I honestly instantly re-experienced this episode when reading that title; there's nothing wrong with analyzing data, in fact, I probably would and the article isn't suggesting a machine write headlines, but it feels like writing for humans should feel human and not be machine optimized...

I realize I've just been rambling, probably connected with no one else on the forum but I've typed all this, so I'm submitting it.
Is there a website or screenshots? I’m not quite understanding what it does, but I want to share in the excitement.
Why was this flagged? It's simply the abstract for the article, useful for people to read (to determine if they're actually interested in reading more) before clicking through.
FinCEN Rule Would Expose All Your Bitcoin Transactions: EFF
Places like Bugcrowd act as a go-between but the company will have to be on there.
Is it really? You would maintain an entire parallel stack built on an entirely separate infrastructure stack, with completely different deployment patterns and all the data synced? DR is really hard if you just want to fail over to another AWS/Azure/GCP region. I can't imagine what a nightmare it would be to maintain an on-prem DR standby. To mitigate a couple hours per year (in a really bad year) of cloud downtime?
John le Carré: Spy novelist 'died an Irishman'
Open Source Monetary Policy
There's a vaguely entertaining esolang ‘Shakespeare’ in which programs look like plays: https://en.wikipedia.org/wiki/Shakespeare_Programming_Langua...

BTW, in the spirit of art that uses two mediums with one source, there's this thing ‘oscilloscope music’: as far as I understand, the same signal goes to the speakers and the display, so it likely doesn't get more raw than that. Though, most of it is abstract shapes.

E.g.:

https://www.youtube.com/watch?v=_6a_nz4uRd0

https://www.youtube.com/watch?v=Y04LBDTsGIk
While my controller is on 6.0.43 and APs (uap-ac-lite and uap-ac-hd and uap-pro gen1) are on the corresponding firmware.

I believe this controller version is December 2020 and predates the January issue disclosure date(though possibly not the incident).

I have suricata taps on my net that are clean. Aps and controller are predictably trying to get to their telemetry call homes but nothing more.

That said my Ubnt controller and aps have almost no internet access and haven’t for a long time. I only enable it when performing upgrades and disable it.

I’ll pull the firewall logs and see specifically the IPs they are attempting to hit.
https://en.wikipedia.org/wiki/One_Second_After

I teach some outdoors skills and other self sufficient skills, and people ask me what the best “survival” book is. I tell them One Second After is the most realistic situation that could happen, and not ending up naked in a jungle with a stranger.
What're they going to do if you break it? Sue?

They might pay out over a long period of time for some guarantee that you'll play by their rules, though.
That's going in my codebase some day
My guess is that next year's flu season is cancelled too. It doesn't take much to push the R from slightly above 1 to slightly below 1.

Just putting a mask on half the symptomatic infected people (or even better, getting them to stay at home) would probably do the trick.

Also, the flu has to start from a very low level. Might miss this flu season completely.
Haha, you can’t be serious. That’s an incredible amount of shade? Gimme a break
Google already allows online banking apps to block screenshot functionality, which is in my opinion total bullshit. The owner/user of a device should always be able to take a screenshot if they want. At least every bank has a market based need to allow regular browsers to sign in to online banking, to support desktop clients, so one can just ignore the provided bank's app if you want.
Weirdly, it seems there are no GAAP accounting rules for cryptocurrencies yet. Apparently there is informal guidance that it should be treated as an intangible asset:

https://news.bloombergtax.com/financial-accounting/tesla-bit...
Those gains went to people who owned stock.

Public pensions are worth more than twice as much as all the billionaires in the US combined.

401k balances also grew greatly.
Wow, I followed this so closely back in the day[0]. It was a fascinating thing to unpack in real-time as it was happening.

I burned hours per week on Groklaw, partly out of fascination around all of the parties, especially outside of SCO and IBM, and the moves they were making to take advantage of the situation. But I think I simply enjoyed reading the deep analysis the community around that site, and it's author, maintained.

One can sue for any reason, no matter how ridiculous. Hopefully this just gets tossed out early on this time around.

[0] http://www.groklaw.net (kind of surprised at the lack of "s", but most of my reading pre-dated LetsEncrypt)
I think it'll be more a matter of "I don't want to get sick and I'm your manager, so {put on a mask,stay at home until you're no longer sick} or stay at home forever".
Probably a payout over a long period of time. Lots of people would prefer a free $50k over the course of one year.

(Just guessing though.)
The part where it backs up all your messages without using a device specific key.

The only things end to end encrypted are listed on this page: https://support.apple.com/en-us/HT202303

If you turn on iCloud syncing, basically you're falling back to simple "in transit" and "at rest" encryption.

A lot of iPhone cracks involve just attacking your iCloud account, and then reading all of your messages from backups. This is not possible on Pixel which encrypt your device backups with on-device hardware encryption.
I think so, but would Zerodium etc be able to prove it was the same person in each case? An independent researcher might have submitted the same issue to Apple coincidentally shortly after, presented in a slightly different way.
Let's do some math! According to the SSH handshake described here[1], I believe there are 6 one-way trips. Given communication times according to this[2], we can average a one way trip to be about 11min.

6 trips x 11 min each:
That is 66min for the handshake.

@_o

[1]: https://techieuniversity.com/ssh-work-flow/
[2]: https://www.mars-one.com/faq/technology/how-does-the-mars-ba...
You don't personally need karma for your post to have visibility. I found your post on the hiring thread and for some reason it had been downvoted once. I upvoted it once just to counter that.

There were actually a few downvoted posts in the hiring thread, which seemed weird to me. None of them seemed to violate thread norms or otherwise be objectionable. I upvoted those too.

Dang has stated before that they are working on trying to improve the HN software so all comments show on a single page, but currently comments get paginated when there are a lot of them. That includes the current hiring discussion. You need to click the "more" link to see comments that don't fit on the first page.
I hope you’re not suggesting inserting and relying on tracking pixels and other unreliable junk into outgoing emails in order to measure.

Besides, guess what, many times, “engagement” is precisely what I don’t want to be coerced or manipulated into doing.

Cursing while clicking around your funneling website to find a place to do a GDPR data delete request and eventually giving up while filing your sender as spam also counts as engagement. Whereas plaintext email is way less likely to trigger that response.
> That 100% of the population would be prohibited from leaving their homes? What about food? What about medical emergencies? What about a house burning down or a tree falling on the roof? What if a watermain bursts?

Other countries actually addressed those questions. The most stringent example is china: They restricted everyone to their immediate neighborhood, then delivered food and other essential goods to each neighborhood in a centrally planned system. Medical emergencies were allowed to leave a neighborhood and drive to the nearest hospital.

Not pleasant, but it worked.
wait I thought fiber vanished in the 1950s due to nutritionist of the day going all in on the 'calory is all that matters' but a lot of people started to talk about fibers in the 2000s (my memory is blurry though)
A lot of people still use flip/feature phones as well and other people just don't have cell phones. I guess these people are just forbidden to travel.
Shelf Engine | (https://www.shelfengine.com/) | REMOTE or ON-SITE (post-COVID) | Full-time | Backend & Full Stack Engineers, Data Scientists.
We're hiring for multiple positions across the Engineering and Data Science teams (and in many other non-engineering roles). We just raised a $41 million Series B led by General Catalyst.

At Shelf Engine, we're taking on arbitrage risk for perishable goods. We do daily demand forecasting based on a number of factors, including historical information, product margins, etc. We have an operationally sophisticated product for automatically managing, dispatching, and recording orders, and tracking sales and waste information. Domain areas range from ML and statistical forecasting, to full-stack web services and mobile apps.

Tech stack: For the front end, we use Angular for desktop and Ionic for mobile. Backend, we are running a C# stack, with a SQL storage layer and utilizing CQRS and event sourcing patterns. For forecasting and ML we use R and python.

See (https://jobs.lever.co/shelfengine).