skysight-inc/HackerNews huggingface dataset:
If that action is "./run_tests.sh", which is a top use case, the attacker just changes "./run_tests.sh", so while I agree that's useful, it doesn't secure the typical case, and makes for a hard cost/value stance.

The threat models are probably more like 1. "make sure only the right people run actions" and separately, 2. "make sure authorized events/actions only use the expected capabilities." Both largely fail today.
Well the idea is that a person submits a PR, and the action runs to verify that the tests pass BEFORE the PR is accepted. You don’t want to wait until after the code is merged in order to see if tests still pass.

The issue is that even if you don’t allow changes to the actual action workflow, running tests gives an attacker the ability to run arbitrary code. They just need to add the code they want to run to the tests (e.g. have the tests mine crypto)
> Everything you need to know to not write obscure programs in C++ is to learn C. C can provide with every basic concept you need in order to be able to program anything that you want. Maybe, if you invest enough time and dedication, you'll realize that all these fancy features that C++ implements are unnecessary.

This is very bad advice. C lacks fundamental features like unwind-protect (called RAII in c++ circles) and any metasyntactic constructs at all, all of which (among other things) help you avoid boilerplate (a prime source of bugs).

I write C code, and there is a place for it. I write a lot of Lisp code too, as there is a place for that. But nonsense like the quoted comment is like saying you only need to speak English, or the only vehicle you need is an automobile.
HN has hated crypto for a decade now and it's only recently been about energy consumption. It was and will be about monetary policy and the role of government in issuing currency. Kaynes vs Hayek kind of thing. Which in a way is about authoritarian vs market forces. For some reason Hacker News really likes the idea of centralized authority and criminalizing things like math and free association by threat of violence and imprisonment.
US sanctions are squeezing Huawei, but for how long?
There are 2 parts to UPnP.

One is service discovery, in cooperation with zeroconf (aka bonjour/mDNS). This is handled 100% by devices themselves.

The other is the port forwarding protocol, where devices can ask your router to open a port in the NAT to the wide internet forwarded to them. This is done in the router. It's also a potential massive security hole.

If you disable UPnP on your router, you only disable the second thing. The first thing keeps working.
I run a small forum of my own, which is linked in my profile.
An open-source rocket could reshape society in “A Theory of Flight” (2019)
It works for photos because the threat model is about protecting local files against malicious apps.

But for phone numbers, you about protecting Facebook API (which is publicly available via the internet) against arbitrary devices, which Facebook has no way to tell from legitimate ones
I'm a bit out of touch with American politics, please remind me which one is the 'fascist leader' : village idiot that won previous elections or creepy uncle that won the recet ones?
No, we've been fighting for equality, not simple tolerance. And btw, the cake maker won that case in court. If my business openly discriminated against Christians, you bet your ass I'd get sued into oblivion.
Sure. How many public restrooms do you think USA should have?
Where did you get the data leak, I want to check too.
"sown discord on the earth" is a bit stronger than simply calling someone an heretic.
Yeah I remember in high school spanish class learning that the Spanish eat very late but it turns out just to be an artifact of being in the "wrong" time zone.
FFFFFFFFFFFFFUUUUUUUUUUUUUUUUUUUUU
Obviously it is bad if your personal data is compromised after you (or some else) upload it to an online service like Facebook.

But in this case, it’s important to remember that phone companies used to regularly leak most of their customer’s phone numbers (and names) in the form of a telephone directory. So a question to consider is: suppose that the white pages were still commonly produced and contained most people’s numbers. How would you then feel about something like this.

Personally I feel like the problem with phone numbers being leaked is mostly the epidemic of spam calls (especially in the US) rather than some particular breach of privacy.

Aside: I think it is good to consider these counterfactuals in general for questions about information privacy, for example how would you feel if everyone’s tax returns were published publicly like they are in Sweden?
Jsonnet hasn't taken off because it's turing complete. It's a really great language for generating JSON but not a replacement for JSON.
To his credit, if you're compelled to play roulette, that's the optimal way to play. Every spin is stacked against the player (that is, the payout * the odds of hitting a particular bet are all less than 100%), so minimizing the number of spins minimizes the stacking of the odds against winning.
The hybrid AI model marketplace
OpenStreetMap contains data on businesses and which of them have a toilet. You can see this detail on apps like OSMAnd. If you really need to pee, petrol stations are among the businesses least likely to challenge someone for using the toilet without buying anything.
Some people submit and delete the post, that is against the instructions in the FAQ

> Please don't delete and repost the same story. Deletion is for things that shouldn't have been submitted in the first place.

Do you remember any recent case with a lot of deletions and repost?
Is it possible to download this without giving money to criminals? (The article says free, but my 2 minutes of googling hasn't found it, somewhat unsurprisingly).

Is doing so legal?

If the answer to both of those questions are yes... I'd like to take a peak. Mostly to check whether or not some numbers I know haven't been directly give to fb are there.
The article says that today a battery pack the size of a backpack and that weighs about 40kg, can power a house for a day. Is that really so? Would that be a normal house, being powered for an entire day? I find it hard to believe that battery would pack that much energy
No one was pulling all-nighters two weeks into the semester.

Except architecture students. I've often tried to put a finger on how the gauntlet of architecture school changes people. I'd worked around architects for about a decade before going to A-school and wondered how they made the stupid ideas they sometimes make when I looked with an engineering mindset.

But I think A-school is four or five years of the un-learning Graham describes.

At the pin-up at the end of a two week project, there's no faking it (though not to say there isn't plenty of bullshit). It's clear who worked long and who phoned in.

Because it is clear in studio who has put in twenty hours since last class and who has put in four. Between who has suffered doing it wrong and who has only been looking for a shortcut.

Pulling an all nighter the first night of a new module is only plausible if the work product is open ended. Only possible if it is possible for someone to due the best they can.

This doesn't happen until the end of the STEM education conveyor belt. Until its machinery knocks all the unroteable bad apples out. Until most all that is left are those for whom good grades produce sufficient joy.

An 89 on my test is the same as the 89 on yours. But your B+ pin-up is great and poor in different ways than my B+ is great and poor. It's the possibility of greatness that drives the all nighter. Well that and beers in the studio.
I already commented on the underlying issue but I’ll also add, separately, that this is a great example of the dangers of a “hit ‘em back” PR strategy.

Often it is senior execs who are advocating for this approach (saw rumors it was Bezos himself pushing for it at Amazon), and at some point it becomes impossible for the PR team to say “no” to their boss. Someone has to do the dumb thing anyway and see what happens, or resign.

I bet this case study gets pulled out by the PR team within Amazon for years and years whenever someone asks them to “be more aggressive” or whatever.
I remember visiting newly fitted library in Pimlico,London. There was a huge sign on the toilet door saying you need to ask for toilet paper at the admin desk. So I go to the desk and ask for it, obviously curious to know why such policy exist to start with. They did tell they couldn't keep up with the thefts of toilet paper and couldn't buy it fast enough. This is one of the reasons a lot of nice and useful things can't existing for public, because a few idiots ruin it all for others.
Where? I don't see that. What type info is below? Do you mean "mapList"? I suspect it's just what they chose to name the key.

"triestimes": 3,
"mapList": [
{
"desc": "ftp",
"nExternalPort": 6221,
"nInternalPort": 21,
"sProtocol": "TCP",
"bEnable": 0
},...
Ah, a rotary cipher! I'm currently taking a cryptography class, but so far we haven't talked much about WWII-era rotary ciphers.

When I first read the name "Hagelin", I thought it sounded familiar, but couldn't recall where I'd seen it. Then I realized Hagelin was also called Crypto AG, which generated a lot of discussion on this [0] thread awhile back.

From what I can see looking at the m209 diagram here [1], I imagine it wouldn't be too hard to find modern equivalents of these parts. Would you try to replicate the "body" of the rotary cipher as well, or just the primary functional components?

[0]: https://news.ycombinator.com/item?id=22297963
[1]: https://www.cryptomuseum.com/crypto/hagelin/m209/index.htm
Is the rendering engine doing the spying for you?

This article seems like it's focusing on websites spying on you, and I don't think anyone (either this article or elsewhere) has made a serious allegation that WebKit does actually spy on you. It would be pretty newsworthy if it did!
UPnP is also sometimes used to refer to some forms of zeroconf/mDNS/Bonjour/DLNA.

Maybe he is under the impression if he turns off UPnP on his router (the automatic port forwarding feature), that his LAN device discovery features will break?
I'm a Linux fan, but I'm toying with the idea of getting one of the new Macs to replacement my Chromebook...

For work I am very happy with my Linux setup. ~5-6 years ago I got a good chromebook as an experiment, and I really like it in general. Long battery life, good build, high res screen, good security model, not much mucking around on it. It's a $1K chromebook that I got almost half price because refurb.

The double edged sword is that it's limited. There are benefits to that I don't expect much from it. But for anything beyond web browsing I just use it as an ssh terminal. It works fine there, but I haven't found a programming environment I can use on it. Note: It apparently will never support the Linux apps.

Sometimes I make movies, and borrow my wife's Windows laptop to run Resolve on. It's worlds better than any of the video editors I've used on Linux, and I was never able to get Resolve working on Linux.

So with the new Mac I was thinking maybe I should try one of those instead of the Chromebook? At the lower end of the spectrum, the price is comparable to a good Chromebook (and I was dissatisfied with the lower end Chromebooks). But, if I actually want to do video editing I need 1-2TB of storage, which pushes the price up close to $2K. But if I avoid upgrading both my laptop AND personal desktop because of it... One option would be a lower end Mac and an external SSD. At least until I accidentally unplug it on the couch while editing a video.

But for 95% of my personal use, the Chromebook is just great.

What's a fella to do...
There are definitely a lot of cities that do not have enough bathrooms available, and there is not much Amazon or other employers can do about that.

Where I've lived in several smallish cities in the Midwest it is generally not hard to find bathrooms. I've had jobs that involved driving a van between customers' houses and never had trouble finding one. They're not in the residential neighborhoods but the routes would always go reasonably close to at least a few gas stations a day.

But even here where we do have bathrooms fairly readily available the drivers still pee in their vans. I know because I used to work in one of the local Amazon warehouses and we would find bags the drivers had returned with pee in them.
Pair programming all day long is a decent solution to that problem
How is anybody ruining a market? If you want goods you compete in the market. If a miner is more motivated than Rusty the Rustacean to pay up for a laptop, that’s the end of the story.
No, but it lets you punish people that do them. No one is under the assumption that outlawing something means that it will never happen, and implying that people breaking the law means that the law is useless is asinine.

If we believed laws had zero effect on behavior, society would be a lot different.
vid version https://youtu.be/mDmOGN-x0ls
4-8MB wasn’t all that much if you were running more than one app at >640x480x256. It was certainly possible but fancy visual effects were going to exclude a lot of low-end hardware, which is what a LOT of mainstream users bought since hardware cost a good but more back then and the value proposition was less established.

I agree that roundness wasn’t prohibitive in general. The rectangular nature of the APIs encouraged it but you certainly saw it in applications. What I was thinking about most was complex usage where there was overlap outside of the active context (e.g. dragging a window with the expectation of a lower layer showing around the curve, rather than either not having that or being able to assume a solid fill color) or interfering with hardware accelerated painting or later video decoding which only worked in rectangular regions.
I know there are plenty of engineers with those gaps, and they learn from experience, as one does.

My issue was with the statement that all backend engineers you work with (hundreds of them!) have this weakness. Does not match my experience, so I was wondering where you work.
I agree, but also we’ve made it more complicated by using phone numbers as 2FA credentials.

Now suddenly a “white pages of cell numbers” becomes a very convenient tool for getting in to people’s accounts.
American political discourse 101:

Republicans = Fascists and Literally All Nazis

Democrats = Marxists and Literally All Pedophiles
Who would get this money? I agree that it needs to be some solution involving a cost, given that most of these companies have shown multiple times that profit isn’t just their main concern, it’s the only concern.
"It depends" as not all the names you listed as examples use the same technology, but in general "UPNP is more useful for thins which need an incoming connection" (kinda sorta). This might be, say, a bittorrent client needing to allow other clients in on a port to share the file... sharing. To share. :) If you understand how Active vs Passive FTP works and how the incoming connections might need to be tracked (nf_conntrack for Linux folks), UPNP is more like that - apps which handle bi-directional conversations with the outside world beyond your router.

Airdrop uses an ad-hoc WiFi network (peer-to-peer) with TLS, as does I think (Android) Beam. If I'm not mistaken some other devices in this area (Chromecast, Roku, etc.) use similar techniques, and sometimes leverage bluetooth ad-hoc networks. Discovery services like printers and fileshares tend to use (I'm assuming you're macOS) Bonjour (Rendezvous, renamed awhile back), which is sort of like an ad-hoc multicast (mDNS) solution if I understand it. On Windows it would use something like Netbios - conceptually the same. I just set a static IP on my wifi printer and call it a day, it's trivial stuff being a printer.
What problems do people solve with strace?
Seems you're missing my personal favorite, extensible data notation - EDN (https://github.com/edn-format/edn). Probably I'm a bit biased coming from Clojure as it's widely used there but haven't really found a format that comes close to EDN when it comes to succinctness and features.

Some of the neat features: Custom literals / tagged elements that can have their support added for them on runtime/compile time (dates can be represented, parsed and turned into proper dates in your language). Also being able to namespace data inside of it makes things a bit easier to manage without having to result to nesting or other hacks. Very human friendly, plus machine friendly.

Biggest drawback so far seems to be performance of parsing, although I'm not sure if that's actually about the format itself, or about the small adoption of the format and therefore not many parsers focusing on speed has been written.
> Alt-tabbing in the middle of a presentation risks displaying random information no matter what.

When presenting, I keep close track of what information I have minimized and unminimized.

It would severely hamper my work (all of which is disclosed) to quit apps that have minimized windows with information I do not want to show to undisclosed parties.

To be clear, command-tabbing on macOS may not behave the same "Alt-tabbing" on other platforms (I honestly don't know). Specifically, command-tabbing does not give focus to apps that are hidden until they are selected and does not reveal minimized windows without user intervention (holding option down while releasing command.)

Automatically disclosing minimized windows for command-tabbed apps that have no disclosed windows would actually remove a privacy feature rather than enhancing command-tab app switching.
During Covid, why would you want to use a public restroom if you can avoid it? In fact, thinking about this makes me want to put an empty bottle in the car in case I end up needing to go sometime on the 2 hour routine trips I've been doing, despite there being plenty of rest stops.

I'm not defending Amazon's general financial screw-turning, but I think the "peeing in bottles" has only become a meme because the idea seems gross to everyone who hasn't spent a long time alone in vehicles.
Advice for finding a technical co-founder
You should read about Accelerationism. You have a left-wing interpretation of Accelerationism (we should create new laws to handle technological divergences) and I have a right-wing interpretation of Accelerationism (as systems becomes more fragile from cryptocurrencies, such as in this example, corporations will be motivated to find cheaper ways to produce electricity, GPUs. Thus I believe that because of increased chaos, "Corporations find a way").
You are being downvoted but I think you are onto something.
A lot of machines in a casino may be quite ancient and we learn new things about manipulating each other every day.
Mostly governments resolve it without needing to subsidise toilet use by requiring licensed premises or anywhere serving food and drink to have toilets
> If one side has breached another’s rights, the injured party is no longer bound to respect the treaty rights of their assailant

This norm creates a market for casus belli.

I am reminded of how the Serbs kept talking about how the Croats massacred their ancestors and collaborated with Nazi Germany. Well, yes, that happened. And yet.

Or suppose you are an Indian Muslim, and you have been worshipping at the Babri Masjid (a mosque) just as your parents did. But then a Hindu mob is reminded in 1992 that, when it was constructed in the 16th century, it was built on top of a temple to Rama (indeed it is His birthplace!) -- what an outrage! So they tear it down with their bare hands. Have they delivered justice to your community?

(What actually happens: Violence breaks out between Hindus and Muslims, and pretty soon 2,000 people have been killed.)

There are people who benefit when society switches to "war mode", and they are not good people.
> "You don’t really believe the peeing in bottles thing, do you? If that were true, nobody would work for us."

The more you unpack this statement, the worse it is.

1) It's a lie.

2) It's tells you 'you're dumb if you believe [the truth].'

3) The problem they're lying about is a really awful one.

4) They seem to not even know what it's like to do this role (but that doesn't prevent them from confidently making things up).

5) It shows a worldview that's super, well, privileged. Whoever wrote that probably couldn't imagine not having the option to just walk away from a job.

6) Whoever wrote that apparently doesn't believe that anyone doesn't have the option to just walk away from a job.

They seem so incredibly disconnected from this part of their workforce, that I couldn't imagine them making good calls about what these workers should be doing.
I thought it was generally accepted that we should tolerate most things except intolerance.
+ Has binary format.

+ Avoids ambiguities.

- The format seems to feel the need to support everything, including things I am not sure are actual usecases (what's the point of Markup element for example? What does Metadata save us compared to just including it in document, given that parsers must parse it anyway?). This must make implementation most complex and costly, and makes reading the text format more difficult.

- Not a fan of octal notation. At 3am not sure I can't confuse 0 and o given certain fonts. Does anyone even use it these days?

- Unquoted string were discussed in the thread, I'd like to point out that it's very easy to make an unquoted string not "text-safe" (according to the spec) without noticing it, at which point document is invalid.

Just add white-space (maybe a user pasted a string from somewhere without noticing whitespace at the end or forgot the rules), a dot, an exclamation or a question mark. Having surprises like that is IMHO worse than a consistent quoting method.

Basically all the things I don't like are about the format supporting a bit too much. YAML 1.1 should teach us more is sometimes less.
I meant that it gives Kotlin adopters the sense that there is no vendor lock-in on the code they write, while at the same time they keep a strong bind on the present and future market IDE for Kotlin (if a competitor appears, Jetbrains will be first to market for everything Kotlin so they will have a persistent edge), capturing with the IDE the dollars of those who seriously plan to develop for Kotlin.

The fact that they have a freemium model is irrelevant to that goal of owing the Kotlin IDE space.

The free offering you mention is used both for funnelling or for having customers do the market segmentation themselves, as there are customers that want to pay for everyone in the team, there are customers who want to pay for only some of members of the team and those who do not want to pay for anyone in the team.
Far from only a feature for pro users. Notably, it is a must for VoIP (without going through a relay) and BitTorrent when you don't want to manually configure a firewall. (allows to create holes in a controlled way for a NATted network)

Without UPnP, you specifically have to configure your NAT for this...
UPNP is pretty important for a lot of online games.
Yup. Once you know, you know.

SoBe bottles are available at many gas stations. Not the biggest mouth, but having fresh bottles makes up for it.
Show HN: Show HN: Webp.to – Webp to SVG, JPG, PNG, GIF and an API
Coding as a Form of Psychotherapy
The "new" risk with phone numbers is the overreliance on them for login and 2fa and the relative easy of taking one over. I use security keys but still have accounts I can't remove the phone 2fa from despite having two keys tied in.
Show HN: Daily Read – Receive a chapter a day from popular public domain books
Or just opening your browser and trying out norwegian on a QA environment.
The government typically... who might in turn do something like a tax rebate (write a check to everyone, ontario has been doing with the carbon tax) or just stick it into the general pool of taxes (reducing everyone's taxes).