skysight-inc/HackerNews huggingface dataset:
I'm more worried about forcing whole world to fix US core problems

I have to change my nomenclature, tech terms (master, white/black list) just because people in US are biased and kind of racist?

While it may be reasonable, then how often will this happen? everytime there's some nation-wide drama in US?
Ask HN: Serengeti Is Looking for Collaborators
As always, depends on your use case.

I'd say it has lower friction in general since Deno is using Web APIs, e.g. the fetch API is built-in (see https://deno.land/manual@v1.9.1/runtime/web_platform_apis).
Do we know if the silicon shortages will affect the M2 or what comes after? I wonder if they booked enough volume with TSMC to get to 4nm or whatever the next process shrink is or if they will be trying to shove M1s into everything.
Imagine you have a game with attacker controlled (x, y):

var { x, y } = JSON.parse(input);
board[x][y] = true;

// ...

if (user.admin) ...

If the attacker puts:

{x: "__proto__", y: "admin"}

Then board["__proto__"] might be `object` and then object["admin"] = true

Now `<any object>.admin` is true !
This has been the case for years now, and other manufacturers are following the same trend. I'm starting to find that I rarely upgrade things anyway because by the time I need to upgrade, things like the CPU might be too slow anyway, or ports have drifted away to USB-X and Thunderbolt 12 and the whole device falls behind.

I say this as the owner of a maxed out Thinkpad X1 Yoga 1st gen. I tend to buy used top of the line and forget about upgrades. The ram is soldered in this one as well, but I can change SSDs and WiFi cards, which is very nice.

It's been running MacOS Catalina for more than a year now and rock solid stable, so basically a $300 i7, 16GBRAM /512GBSSD 1440p 14in Macbook that is lighter than the 13in Pro.

The cons are the damn speakers, if this thing had good speakers I wouldn't even consider a Macbook.
It’s not about realizing if a toy has a battery or not, the choking hazard alone is enough. There’s also no electronic devices a child should swallow. Kids are swallowing these because parents like this aren’t thinking.
Side effects from vaccine doesn't indicate effectiveness
Man whose blood plasma saved over 2.4M babies donates for the last time
96% of WordPress security issues caused by plugins
Regardless of whether consent (which was not given) was required, worth pointing out the emails sent to the mailing list were also intentionally misleading, or fraudulent, so some kind of ethic has obviously been violated there.
I watched it but did not get it. ELI5 anyone?
Exactly, YouTube censored the panel of academics speaking with Gov. DeSantis.

You can disagree with them politically or even just substantively, but holy smokes is it infuriating to see credentialed and serious academics being deplatformed for being perceived to have broken with supposed orthodoxy.
> I usually import CSVs into a Python Pandas Dataframe and then iterate over the dataframe in a loop

Isn’t a big point of dataframes providing tools that are more efficient so you don’t have to use Python loops for operations across a body of data?
No, it’s not. Participating in capitalism is not equivalent to advocating for it.
I'm making no statements about ORMs. I'm just picking apart the mindless "SQL is the bee's knees" mantra so prevalent on HN.
> The thing that people should be upset about is that such an important open source project so easily accepts patches which introduce security vulnerabilities

They were trusting of contributors to not be malicious, and in particular, were trusting of a university to not be wholly malicious.

Sure, there is a possible threat model where they would need to be suspicious of entire universities.

But in general, human projects will operate under some level of basic trust, with some sort of means to establish that trust. To be able to actually get anything done; you cannot perfectly formally review everything with finite human resources. I don't see where they went wrong with any of that here.

There's also the very simple fact that responding to an incident is also a part of the security process, and broadly banning a group whole-cloth will be more secure than not. So both them and you are getting what you want it of it - more of the process to research, and more security.

If the changes didn't make it out to production systems, then it seems like the process worked? Even if some of it was due to admissions that would not happen with truly malicious actors, so too were the patches accepted because the actors were reasonably trusted.
This is a really important question, and the way to answer it is for someone to try it.
I assure you that customer support reps and Linux maintainers are in fact people.
To me, this is just a tired hot take. The Daily Mail regularly covers stories that others don’t, and they do so with perspectives and plain speak that others don’t provide. I feel like everyone here attacking the Daily Mail doesn’t actually read them, but are blindly repeating an opinion they’ve been told to hold, because the Daily Mail’s existence is inconvenient for other newspapers and for certain ideologies. It’s tactically easier to attack the source rather than individual pieces of content. We see the same thing with the N.Y. Post.

During these polarized times when censorship is rampant and diverse perspectives are hard to come by, I’m glad to have someone like the Daily Mail around. A recent example of a great article is their story on COVID vaccines potentially affecting menstruation (https://www.dailymail.co.uk/femail/article-9446907/Some-wome...), which they wrote about before any other major news media. Read for yourself and decide how you feel about the content.
Adding on to that. If you need real life contracts (the law) to enforce consequences of breaching or exploiting a smart contract: why do you need a smart contract at all?
You are encouraged to trade with weaker players.

If you trade with the winning player, they win faster. If you trade with players who are behind, it doesn't really change the outcome of the game (they will probably still be behind at the end of the game)

The only thing preventing that winning player from reaching 10 points is 2 stone and 3 wheat. So as long as no one gives the winning player those resources, the game continues.

Alternatively, the winning player can try to win on their own by massing up 20 other resources and trading 4 for 1. But everyone else can more efficiently get the resources they need by trading with each other, allowing for an innate comeback mechanic.

--------

At a minimum, that puts even the weakest players always in the position as kingmaker. So everyone has something to do at all stages of the game.
I'm confused - how is this an experiment on humans? Which humans? As far as I can tell, this has nothing to do with humans, and everything to do with the open-source review process - and if one thinks that it counts as a human experiment because humans are involved, wouldn't that logic apply equally to pentesting?

For that matter, what's the difference between this and pentesting?
The problem is, the housing projects ended up being a major contributor to gangs in the cities. Growing up, "the projects" was a common euphemism for gang-infested ghettos, even though that likely was only true for a small portion of the projects.

See here, for example: https://en.wikipedia.org/wiki/Subsidized_housing_in_the_Unit...
Honest question — How is this better than say a $100 capresso ec50 15 bar espresso machine w/ steam wand?
Proposed bill to ban US government from buying location data [pdf]
Because they lied to them. They promised not to do any actual harm. But they did
From the Heinrich et al.paper:

"Lost devices. Devices that determine to be in a lost
state start sending out BLE advertisements with a public key to be discovered by finder devices. Devices are considered to be lost when they lose Internet connectivity.

Third-party accessories [6] are small battery-powered devices that can be attached to a personal item and are set up through an owner device.

Accessories are determined to be lost when they lose their BLE connection to the owner device.
Finder devices.

Finder devices form the core of the OF network. As of 2020, only iPhones and iPads with a GPS module are offering finder capabilities. Finder devices can discover lost devices and accessories by scanning for BLE advertisements. Upon receiving an OF advertisement, a finder creates an end-to-end encrypted location report that includes its current location and sends it to Apple’s servers."

Elsewhere, it is clear that this operates even when flight mode is enabled.

If you can't stand criticism of Apple, please fuck off back to reddit and fanboi there.
IRB is useless. They don't use much context, including if the speediness of IRB approval would save lives. You could make a reasonable argument that IRB has contributed to millions of preventable deaths at this point, with COV alone it's at least dozens of thousands if not far more.
I plan on giving my child something they know is a tracker and something else that they don't.
Car Design History – A data visualization of Italian car design
"Capitalism" is a fraught word because it is used both with very specific definitions, many conflicting to a degree, and it's also in very general terms. So in general conversation with people of different backgrounds, it's important to connect its usage to specific schools of thought or to more precisely define what is meant

I'll think you'll find that Marx is pretty upset about labor not being entitled to what labor produces, as well. And while Marx is not all of socialism, I don't know anybody who says that Marxian thought is outside of socialism, and I've sought out lots of socialist thought that critiques Marx.

Most critiques of capitalism are that workers are not entitled to the fruits of their labor, that capital steals from them. So if saying that somebody is entitled to work and to keep their labor is capitalist, I'm having trouble understanding where you come from, and would like to hear more. In particular, I don't think George declares that capital is entitled to the fruits of others' labor, which is what you seem to be saying.

Georgism is about socializing land, about preventing people from hoarding it and the wealth it produces. Land is the one input to production that we can't make more of, so therefore hoarding it is by far the most harmful. It's about restoring commons, after the commons had been taken away and privatized. It's about restoring all land to some form of social control, no matter who owns it and how much that person owns. And it's about redistributing that wealth that people are unfairly taking from society when they pocket unearned land rents.

My problem with Georgism is that it tends to be politically unstable and lead to tax revolts. And my problem with the typical Marxist visions (Marx himself was not super prescriptive, but in that void, Marxist thought must expand upon Marx) is the tendency to dictators and totalitarianism, something which George also predicted.

I think George is extremely compatible with, and perhaps required for, the type of socialism that was sought in the Spanish revolution of 1936.
If the attack surface is large enough and the duration of the experiment long enough it'll return to baseline soon enough I think. It's a reasonable enough compromise. After all if the maintainers are not already considering that they might be under attack I'd argue that something is wrong with the system, a zero-day in the kernel would be invaluable indeed.

And well, if the maintainers become more vigilant in the long run it's a win/win in my book.
A 27in display with some sort of cable-less Macbook dock in the back or underneath could be a pretty good iMac replacement no?
Others would call it stupid to submit the patches and it would be fine if there were further consequences to deter others.
Thank you very much for your comment. There was a part where the HTML of the top page was recursively repeated. We will consider how to improve it.
Try r/stupidpol
This reminds me of that story about Go Daddy sending everyone "training phishing emails" announcing that they had received a company bonus - with the explanation that this is ok because it is a realistic pretext that real phishing may use.

While true, it's simply not acceptable to abuse trust in this way. It causes real emotional harm to real humans, and while it also may produce some benefits, those do not outweigh the harms. Just because malicious actors don't care about the harms shouldn't mean that ethical people shouldn't either.
I don't like this university ban approach.

Universities are places with lots of different students, professors, and different people with different ideas, and inevitably people who make bad choices.

Universities don't often act with a single purpose or intent. That's what makes them interesting. Prone to failure and bad ideas, but also new ideas that you can't do at corporate HQ because you've got a CEO breathing down your neck.

At the University of Minnesota there's 50k+ students at the Twin Cities campus alone, 3k plus instructors. Even more at other University of Minnesota campuses.

None of those people did anything wrong. Putting the onus on them to effect change to me seems unfair. The people banned didn't do anything wrong.

Now the kernel doesn't 'need' any of their contributions, but I think this is a bad method / standard to set to penalize / discourage everyone under an umbrella when they've taken no bad actions themselves.

Although I can't put my finger on why, this ban on whole swaths of people in some ways seems very not open source.

The folks who did the thing were wrong to do so, but the vast majority of people now impacted by this ban didn't do the thing.
I've seen from a distance one CS department struggle with IRB to get approval for using Amazon Mechanical Turk to label pictures for computer vision datasets. I believe the resolution was creating a specialized approval process for that family of tasks.
Does Intel sell their laptop processors directly to consumers?
Being able to control the base platform is sometimes important - in this case the target is aws lambda, and even building on Ubuntu 20.10 we ended up with links to incompatible GlibC library versions compared to the lambda runtime environment.

Quick fix for all of this - whatever platform you run the build on, do it in docker on the exact same base image that lambda uses at runtime.

I know, you’re going to tell me there’s an easy way around this with cross-compilation. But when you already have docker available , quite often everything looks like a nail.
You can absolutely hide it - it's in the settings, as mentioned in the article. The tradeoff is you won't be able to see anyone else's status.

I do agree I don't particularly like that it's on by default.
I think so. With a large project I think a realist attitude that raises to the level of mean when there’s bullshit around is somewhat necessary to prevent decay.

If not you get cluttered up with bad code and people there for the experience. Like how stackoverflow is lost to rule zealots there for the game not for the purpose.

Something big and important should be intimidating and isn’t a public service babysitter...
I my experience working for both government organizations and large private ones, the problem is noticeably worse and more pervasive in the government.
Looks like jQuery without punctuation.
That's still 10 thousand words you're linking to…

I had a look at section §46.104 https://www.hhs.gov/ohrp/regulations-and-policy/regulations/... since it mentioned exemptions, and at (d) (3) inside that. It still doesn't apply: there's no agreement to participate, it's not benign, it's not anonymous.
Measurable Detection and Response: Mitre ATT&CK Evaluations for Carbanak+FIN7
> I will not be sending any more patches due to the attitude that is not only unwelcome but also intimidating to newbies and non experts.

Woah, this attempt to incite wokes and cancellers is particularly pernicious.
> You must be super important to have attackers following you to lunch. Or maybe you eat at restaurants that do their best to harvest all visitor data, even going so far as to use cutting edge vulnerabilities?

… and do not use all of the other options for getting data from people in close proximity such as cameras or microcell sites. If your threat model goes far enough that this matters you should be more worried about all of the other options. I would be more worried about a Bluetooth, WiFi, or cellular exploit given the history.

(No, this is not saying that Apple shouldn’t improve this - only that it doesn’t seem like a huge change in the amount of risk you’re exposed to)
No wonder the Europe is on decline and very soon it will be worse than Africa. Laziest employees I ever seen in my life are all from Europe.
What the US failed to understand about Afghanistan
Hey HN,

For context, I spent the past month crawling the Clubhouse API and have aggregated ~2.7M Clubhouse users, ~15M follow relationships, and ~1.2M invited by relationships into a neo4j database.

This website is a fun side project aimed at making it easy for anyone to visualize and explore their own portion of the Clubhouse social graph.

Because whether you're bullish on Clubhouse or think it's just the latest fad, there's no denying that the underlying social experiment and data is really interesting.

Would love to hear the community's thoughts. Everything's open source and free btw — you can read more about the project here: https://www.clubhousesocialgraph.com/about
That sounds like a disconnect from reality.
Account created 3 hours ago and only commented on this article posting pro-Russian comments or just plain propaganda.

All this user did was put a _ at the end of his other Username so they could comment more.
I was enjoying Linus being less aggressive, but maybe we do need angry Linus.
Me thinks that If you hold a degree from the University of Minnesota it would be a good idea to let your university know what you think of this.
I really like hyperscript et al. They seem to apply the 'everything-in-one-place' approach from modern JS development to HTML itself, extending hypertext without papering over it.
And this is just the tip of the iceberg. As described in the article, you can avoid this by hiding your "last seen" status.

But why use the "last seen" feature, if WhatsApp also has an "online" indicator? Funnily enough, that one can't be disabled and is visible to everyone! That has been criticized for over 5 years now, with no reaction from whatsapp/FB.

There was even a similar tool back in 2016 which used this "online" indicator instead, called WhatsSpy [0]. It's no longer maintained, but you can see screenshots of it on this old German article [1] or you might be able to find English articles as well.

I don't know of any current tool which does this, but I'd guess there are a few out there, since it's so easy to do and can't be prevented.

[0] https://github.com/jorik041/WhatsSpy-Public

[1] https://www.heise.de/security/meldung/WhatsSpy-Beliebige-Wha...
Exactly. Just run `chmod +x igrepper` and then put it into your PATH.
I updated the README.
I wonder, if mRNA tech offers the possibility of reintroducing lost of function for cells with mutations like p53 defects. E.g. maybe just do what p53 does, if it's present or not.

Much harder to identify the misbehaving cells, DNA deletions, than making all cells behave, I assume.
It may seem like something of a click-baity headline that’s guaranteed to lead to some awful article, but I found this to be a thoughtful & interesting piece. Worth reading.

(Read for the stats, stay for the author laying into Robin Hanson in the comments.)
That's right, but nothing mandates that the web page configures these event handlers, and sends these events to the tracking server operated by Stack Overflow.

My point is: "We can make this thing happen, and we do so and record the results" is more accurate than "this interesting thing just happens, and we observe" which is the tone of the original.

Most sites do not configure their pages to track copy events. SO does the unusual thing. They should be honest about that.
Python Community Interview with Moshe Zadka
> Like the housing projects in the inner cities?

The problem with US housing projects isn’t that they are social housing but that they are deliberate concentration of the poor (and therefore also marginalized, as those are correlated), with the same consequences that always has, whether or not it involves social housing.
I totally agree, you still have to be diligent, and set ground rules on what is acceptable and not. I've sadly had to fix the same issues and have those same discussions.

I should probably have said that, but part of outsourcing is setting those types of ground rules and holding the agency to them. Good agencies generally don't have an issue with this, it is the lowest cost ones or the "friends, cousins, kid" type are where you almost always get the bad result.
Show HN: I built an app to generate Clickable Digital Business Card
Sampled in this track by techno duo Minilogue

www.youtube.com/watch?v=XZznUiv1Q5s
Thank you very much for your comment. The top page has been modified to "wtf" characters for malicious users. Now that all the input forms and JavaScript have been removed, you can browse correctly.
Podcast Subscriptions vs. the App Store
Know Java? Interested in Distributed Databases?

Come collaborate!
BGP Keepalives are not request-reply, they are simple scheduled transmissions. Which means even if one side is not reading, it may still be sending keepalives. So the other side keeps the session open, despite its own keepalives sitting in its send queue.

Also, any valid BGP message resets the keepalive timer, so the reading side just needs to occasionally pop something off the full queue and process it. Which, say, if you're swapping to hell and back, can still get done. (Assuming it even has the scheduling get to killing things due to holdtime expiry. It might just not be expiring anything anymore for reasons of floating face-down in the river.)
The Linux project absolutely cannot trust contributors to not be malicious. If they are doing that, then this work has successfully exposed a risk.
> Because we the devs & admins know the nature of the beast,

I would not lump all devs under 1 group. While the technological aspects of M1 are impressive, the compatibility issues and Apple "being Apple" for lack of a better word are significant enough for some of us to steer clear away. My work issued MBP just doesn't recognize the external display 80% of the time without me having to plug and replug it or usbc hub back in, and the fact that its an issue is simply unnacceptable when my 5 year old Dell, running Linux, has no issues.

Especially for the devs that use desktops on a regular basis, as the speed that you talk of is something that we have had for the past 3-4 years.
It doesn't. It's the same trash as any other aggregator; HN is just specific to a specific area of interest.

- I like this, upvote

- I disagree/dislike you and I won't pitch a civil discussion, downvote

Just the same as any other platform, not to mention that HN can be too serious most of the times.
Things like localmonero you can trade fiat and monero without KYC.
The Linux kernel is one of the largest open-source projects in existence, so my guess is that they were aiming to show that "because the Linux kernel review process doesn't protect against these attacks, most open-source project will also be vulnerable" - "the best can't stop it, so neither will the rest".
Not sure how much is required to brute force these, but AirDrop has been used in notably sensitive situations like the Hong Kong protests[1], where I’m sure anonymity was assumed.

Proximity doesn’t mean I would like to share my phone number. Seems like an unlikely attack day-to-day, but one with definite privacy and personal safety concerns.

1: https://qz.com/1660460/hong-kong-protesters-use-airdrop-to-b...
Here we go again...

This is why people just stick with winforms.