skysight-inc/HackerNews huggingface dataset:
> it was actually my idea

I didn't know that. Congratulations, I see this survived an early WONTFIX that tried to downplay the privacy implications of AIA chasing, which is even more impressive in today's "Who cares about privacy" world.

> Do they really do that? That's awesome if so. Then they don't even need to ship the roots.

I don't in fact know if they do that. They will always conclude that a typical Let's Encrypt certificate from R3 is trustworthy via ISRG Root X1, even when the "chain" provided by the server leads to the (still trusted) DST Root CA X3 but they could actually be choosing that path on the fly rather than just short cutting.

They do need to ship the roots still because

1. The UX does actually show roots, I still have Certainly Something installed here, but the built-in viewer also shows them.

2. Users can manually distrust a root. It would be weird if either: we expected users to go in and manually distrust dozens of weirdly named intermediates that chain back to that root, or, disabling the root was possible but just silently didn't work in most cases.

3. Some trustworthy intermediate CAs can exist that aren't captured. Imagine if Let's Encrypt spins up R5 tomorrow because of some disaster that makes both R3 and R4 unusable, they can sign it with the ISRG root, and it'll work for lots of people - it's not great, but it's workable, however even if they tell Mozilla immediately, there's just no way everybody's Firefox learns about this instantly. So it's good that if your server shows leaf -> R5 -> ISRG X1 (or indeed leaf -> R5 -> DST Root CA X3) the Firefox browser can still conclude that's trustworthy even though it didn't know about R5.

I look forward to seeing issue 221 resolved, thanks.
Related ongoing thread:

“They introduce kernel bugs on purpose” - https://news.ycombinator.com/item?id=26887670 - April 2021 (1562 comments and counting)
I suspect tinnitus is one of those conditions you're more likely to realize you have when you start listening for it.

Being told it's a potential side effect of a vaccination you just had might be a reason to start listening for it.
I can't tell if this is a serious question, or just some quip. Assuming it's serious...

It's not an average SWE's job to make product decisions and to steer strategic initiatives. There are people whose job it is to do specifically that.

Think just for a second what it would be like if every one of be more than 100,000 employees could bring a product plan to a halt because they had reservations.

What's in your power is to ask tough questions (people do)..
To make your opinion heard (people do). To change projects if you wish (something Google makes easier than any other company). And to take risks and make choices in the execution of your own job duties. That's psychological safety.

You may find this hard to believe, but the people working on FLoC have chosen to. They could easily find a different project if they wanted to. It may be disappointing you you that the average SWE isn't nearly as ideological as the average HN commenter, but it is what it is.
https://nymag.com/intelligencer/amp/2020/04/trump-fired-pand...
Sure, I hope it was clear from my original comment I only question whether the UMN contributors to the kernel are acting in good faith. I have identified other questionable patches personally, out of curiosity. Naturally I tend to attribute them to ignorance rather than malice... except, that bad actors intentionally pushing bad patches to an OSS project will inevitably rely on people assuming ignorance rather than malice. This has been well-understood for decades.
no not really. the study says that one of the two groups was instructed to wear masks. it's the people outside that were only recommended to do so. half of them reported always wearing them and only a small minority reported never doing so. the results of the test are in line with the sad reality in most european countries that have mandatory mask wearing since last summer.

nobody is questioning lab tests.

to be clear: the effectiveness of mask-wearing policies on a broad population can not be done in a lab, although it would be interesting to test "not wearing masks" in a country that does have that policy; this unfortunately can't be done either because it's currently against the law - where applicable.
Well put. It’s taken me the last hour to realise that it really is refreshingly transparent.

To me, it’s like the distinction between offence caused and actually showing some genuine reflection as to why there might be offence caused. This statement, to me, is firmly in the former camp.
Nextdoor adds “anti-racism” warnings to mold people’s speech
As phrased your suggestion to stop using icon menu bars is unhelpful. What should we be using instead and why?
Is there no oversight as to what research is being done? In social sciences and medicine there's the IRB, is there not some similar cursory oversight board?
My pet peeve is with the still half finished look, it jumps out as really garish now to when you open the dev tools and see the clashing styles or the bookmarks/history dialog that hasn't been updated in ages.

Not to mention the white title bar in some dialogs even with dark mode enabled.
screens have less height than width, and yet they manage to waste more height space than ever.. that is not a good UX
Holi + Mahashivratri + Kumbh + IPL + election rallies
Woah woah woah, no need to whip out the litigation here. You could try that, but I am fairly certain you would be unsuccessful. You would be thrown out with "this does not qualify under the law" before it made it to court and it wouldn't have much bearing except to bolster the university.
Are they sufficient to have vaccinated all their health care people?
Yeah so long as it is stable low energy per Carbon is a feature and not a bug. Not only is it less dangerous for energetic reasons but it means producing it is more energy efficient.

That is a weird sort of anti-symmetry. If we burn novel carbon fuel it is better to burn energy dense ones (natural gas vs coal) but if we want to sequester it the filthiest fuel for the energy is best in the situation.
https://www.goodreads.com/about/terms
Those are not related issues - it's malware or not malware based on what it does or did (e.g. did it corrupt data on someone else's computer system because it was intended to do just that thing?) regardless of the reason for placing it there.

If you can't figure out a way to satisfy your desire for your devices to be resistant to surveillance tools with legal means, well, then you can't satisfy that desire.

Furthermore, not only the ends don't justify the means, the ends can be prohibited too - if you explicitly design something to destroy your own data knowing that this data would get used in a criminal investigation, that may be a crime on its own (tampering with evidence/obstruction of justice, location matters of course); you don't have to testify against yourself, but destroying evidence is a crime even if it's your property (e.g. throwing your gun into a river after a shooting so it wouldn't be found) and furthermore in that case the court may be allowed to assume that the destroyed evidence was unfavorable to you, that the data contained the damning things they expected to find there - so if you want to protect your devices from surveillance tools operated with a legal warrant, you might want to consult a lawyer to find out if that's a good idea in your jurisdiction, it may well be worse for you than doing nothing.
"We'd like to insert malicious code into the software that runs countless millions of computers and see if they figure it out"

I don't think this was the pitch they gave to their IRB.
The contents of the root.zone have always been available by means other than DNS queries. That is to say, one does not need DNS, or encrypted DNS, to retrieve all the DNS data that the root.zone contains. For example, the data can be retrieved by FTP or HTTPS. The later being a TLS encrypted stream of DNS data preceded by an HTTP header.

curl https://192.0.32.9/domain/root.zone

If there really is serious interest (I seriously doubt it) in encrypting DNS queries sent to authoritative servers, I would be happy to start a TLD that accepts encrypted UDP DNS packets and returns encrypted UDP DNS packets, using CurveDNS, a time-tested implementation of DNSCurve. DNSCurve is per-packet (individual query) encryption, not the same as "DoT", or "DoH". Whether this hypothetical TLD gets listed in ICAAN's root.zone is of little consequence; there are easy workarounds.
Another day, another pointless UI redesign that moves things around for no reason.
Buys a lot of astroturf, apparently.
If his $10k/year rent goes to $50k/year he probably won't want to live there anyway on account of the constant looting and rioting.
I feel like you are willfully misunderstanding: netdata transmitting the data without consent is unethical: it's not their data to send.

I did not choose to willfully install Netdata - I don't use it because it is unethical spyware.

Telling someone "if you stay where you are, I am going to do $THING_REQUIRING_CONSENT to you in 20 minutes" is not obtaining consent if the person doesn't, say, leave the building. Being in the hospital is not a blanket consent to anything the doctor wants to do, for example.

To transmit a user's private data (their usage) to the app vendor is unethical unless the user has specifically indicated that they want that to happen. If they haven't (and simply installing the software is not that), transmitting it anyway is, at best insanely rude, and at worst actively malicious (like, for example, how Netlify's CLI used to transmit "I opt out of telemetry" events, before I got them to stop).

Calling nonconsensual spyware "basic telemetry" is a euphemism.
That's the greedy, shortsighted, tribal way of looking at things, sure.
> This research had the potential to cause harm to people

I don't buy it, and you fail to back that claim up at all.
It's occurred to absolutely everyone. What doesn't seem to have occurred to many people is that there is no such thing as a review process robust enough to prevent malicious contributions. Have you ever done code review for code written by mediocre developers? It's impossible to find all of the bugs without spending 10x more time than it would take to just rewrite it from scratch yourself. The only real alternative is to not be open source at all and only allow contributions from people who have passed much more stringent qualifications.

There is no such thing as a process that can compensate for trust mechanisms. Or if you want to view it that way, ignoring the university's protests and blanket-banning all contributions made by anybody there with no further investigation is part of the process.
I agree and find it more than irksome -- it really makes me want to stop using Signal and stop recommending it to anyone; moreso even than the recent scamcoin integration.

The reason I want e2e encryption is because I want control of my devices, control of my information, control of what's going on. It's not Moxie's phone to drop random files on to, regardless of purpose. It's my phone, and I consider programs that are doing things that I'm not aware of malware.

(Admittedly, Android is rife with stuff I don't want going on, so it's not really my phone, it's Google's and Motorola's and a bunch of other entities who have their tentacles in it, but still...)

Maybe the last paragraph is a joke, and they have no intention of randomly placing files on unwitting client machines. It's open source, so I could compile the client myself and make sure it's not doing anything funny. What a pain though. At that point, so much trust is lost in the organization and codebase that really I need to find some other messaging protocol / app / network.
At my last job a low quality paper was written about "my work" despite me saying that it's too early. It was based on my idea and resulted in our research groups grant participation being extended, despite our professor saying that the grant won't be extended since he switched universities and continent.

It was written while I was working on the software and my name was then put in third position on the list of authors. Only way I was able to defend myself was, asking them to remove my name from the paper which resulted in the paper not being published.
Sure, but I upload my experiments to a Linux cluster and only use my machine for development. Windows IO performance is more important to me than compute.
This rocks so hard. Also the Prodigy soundtrack! Takes me back.
This is not a scientific paper. Sometimes sharing your experience/opinion for a place you grew up and lived your whole life, is ok too
Ask HN: SaaS Customer wants to pay us to build a new feature, how do I estimate?
Working with a data/sass startup and a customer expressed really wanting a feature in our roadmap scheduled for Q1 of next year (at least). Offered money and/or engineering resources to help us bump it to the front of the line. This is a feature that requires building a new data pipeline and so on, talking months of work. It's not a small feature.

I hear that this is a common thing, customers offering money to have features bumped forward. How does it work? I don't want to create any ambiguity about the ownership by accepting engineers from their company. It's also a little bit weird to co-mingle like that when money is exchanging hands.

The next portion is money, if we request money to hire additional people or for materials, what percentage do we ask for? We're still building a feature that will live in our product after this build out is done. I almost feel like it doesn't make any sense to let a customer sponsor something with money.

Can anyone provide any advice? Is there a term for this? articles? is anyone willing to advice me via phone for a free? Super confused, don't want to mess this up! Thanks in advance.
You could run a more general software house-type company, and spin off successful startups if it's necessary.

Wait until you actually have a business, though.
>You will see a lot of people do strategic defaults

Worth noting that not everyplace is California (although half of HN may live in CA, I donno).

There are 12 non-recourse states in the US: Alaska, Arizona, California, Connecticut, Hawaii Idaho, Minnesota, North Carolina, North Dakota, Texas, Utah, and Washington.

Outside of those states, you couldn't necessarily just walk away.
Mozilla ends development of Deep Speech and announces grant program
It is sad seeing another Mozilla project going down to the hole.

Also, why do they pay people to develop on something that is not being maintained?
I agree that silicon valley companies are anti-competitive, but I think you are dead wrong about lobbying.

Lobbying can be a lot of things, but one of the most common is basically marketing & PR for lawmakers. If you're going to be in the news, you pay some clever marketers to make hyper-focused versions of what happened for every single individual law maker. The company wants their view to be easily understood by the 535 voting humans who are seated in congress right now. It's the second oldest trick in the book (after bribery which also ofc happens to a degree).

Lobbying can also include skullduggery and dirty tricks and also other mundane things, but it is not (and never will be) a clear sign that a company is doing something wrong.
Can’t wait to run “native” Linux GUI on Windows10 (ARM, of course), on my bare M1X iMac!
Is that really a thing? At home I can play speakers at low volume vs. needing headphones to drown out office background noise.
Are you using the beta? If not, that's expected unless you have the mode=1 setting I mentioned in my top level comment. I have that set on Linux and everything works as expected. (I haven't tested this on macOS at all so it's possible the setting isn't even functional in Firefox 88 for Mac.)
Which One Won? With or Without Delivery Date?
Indeed, wanted to check out a few other articles, sadly the "Random page" link only keeps sending me to the very short, and rather unspectacular, article about "Wushu".
It doesn't seem like this new UI does much in terms of changing UX though? Besides compact mode being hidden this looks like more of a new "skin", so there's nothing new to be learned to use it.
I guess I have a different perspective. I know a fair number of world class scientists; like, the sort of people you end up reading about as having changed the textbook. One of these people, a well-known bacteriologist, brought his intended study to the IRB for his institution (UC Boulder), who said he couldn't do it because of various risks due to studying pathogenic bacteria. The bacteriologist, who knew far more about the science than the IRB, explained everything in extreme detail and batted away each attempt to shut him down.

Eventually, the IRB, unhappy at his behavior, said he couldn't do the experiment. He left for another institution (UC San Diego) immediately, having made a deal with the new dean to go through expedited review. It was a big loss for Boulder and TBH, the IRB's reasoning was not sound.
Notably the dose makes the poison as well. If just "helps plants grow" was enough to be an environmental good then fertilizer run off would be a good thing.
The text in the menus / tooltips depends on your system. That part is not specific to FF. It does match the rest of the gnome environment. (used for screenshots) I'm not sure the thin font complaint really belongs here.

> the gray-on-gray colour scheme ("accessibility, what's that?")

As long as the contrast is large enough, it doesn't seem like an accessibility issue. (Accessibility has to account for people who don't see colour) For accessibility you don't want black-on-white either, so you do need some level of grey. It would be interesting to see what does the high-contrast system setting do to the display, but otherwise... are you actually commenting about low contrast?

On the active window the lowest contrast I can find is 4.64:1 (for placeholder text in the address bar) which passes WCAG AA for normal text (AAA for large).
Interesting, thank you. I did some light research in the past, and it was always "contact us for a quote".
Honestly, I'd rather have consistent and accurate colors across multiple monitors even though it would be limited to sRGB. Most content on the Web is for sRGB anyways, so it's not like much was lost.

It's still much better than Windows though... I clamp my wide gamut monitor to sRGB because Windows is so infuriatingly inconsistent.
Higher Than the Shoulders of Giants; Or, a Scientist’s History of Drugs
I think icon menu bars are great
Apogee Is Back
If every "modern UI" designer was required to go through a single hour of senior citizen IT support, most would realize they need to confess their sins and beg for forgiveness.

It's incredible how much modern UI design principles just... blatantly conflict with reality.
كلمات اغنية راعي مصر ياسمين علي
What mystery meat is in that tsconfig.json though?
Or is it more about smoking? That could mean that standing around a campfire is better for you, in regards to COVID. The article mentions nitric oxide.
Smoking also reduces the amount of oxygen inhaled by anyone smoking. Perhaps COVID needs clean air, or oxygen rich air.
Conversely, I thought one of the theories for Italy experiencing high problems(mortality) with COVID, was the preponderance is smokers.
Then again, there were reports last year, of air pollution as contributor to severity. It will be interesting to see what we learn five years from, when we have been able to look at more complete data sets.
I don't believe the CCPs exact figures, but they locked down hard and fast to eliminate the virus and had very extreme contact tracing and wore masks. The results are in line with liberal democracies have achieved with the same mitigations.
Not OP nor well-versed with any of this, but the standard csv module doesn't parse xlsx files. Since the majority of people who work with spreadsheets use excel [citation needed], this probably greatly increases the application potential of the library.
People usually view psychological safety from the manager- report lens, but that's actually the easy part. Some training and good intentions on both sides will usually get you most of the way there.

Often the biggest challenge is team dynamics. An introvert on a team might feel his psychological safety reduced by what he perceives as relentless criticism my an extraverted teammate. However, said extrovert might view psychological safety as being free to express his opinions as he sees them.

I've had to manage for PS at several organizations. It doesn't mean that everyone is free to say/do whatever they want whenever they want. It's team-oriented.

It takes a lot of work to establish if you don't have it. It's incredibly easy to lose if you abuse it in any way. But it's an awesome way to work.
And likely some of them know about each other's exploits, how to detect their use through honeypots, etc. It's a big playground of deception.
From his message, the ones that triggered his anger were patches he believed to be obviously useless and therefore either incompetently submitted or submitted as some other form experimentation. After the intentionally incorrect patches, he could no longer allow the presumption of good faith.
Can you have the skill to come up with a good design if you have no clue how to implement it or how someone else would?
Ordered and promised is not the same as delivered. So far I think it's about 800k doses delivered - enough for 0.5% of the population - and the EU has announced they are halting Covax for now.
I'm trying to reconcile what you are saying with all the "write your senator" I've heard all my life, you know? I think the answer is "yes it will help, in as much strong arguments may be persuasive".
Honestly I'm not sure there is a good answer considering that part of what we're weighing against is the potential for the internet to help create an outsized or aggravated response.
I don’t understand the news cycle on this. What happened today that lead to the blow-up if this was already public in December ?
It's to their detriment to do this. If this is on your Gmail, mark that email as spam. With enough people doing that, Comcast will either have to be more transparent about those emails or face the consequences of getting dinged by Gmail.
Kernel maintainers are not human. TIL
Indeed. But this seems like a good place to start.
Related : "Sometimes you cut corners, sometimes the corner cuts you"

From the movie : "How fast can you take your time?"
Not to downplay this, but the authors "You can track any mobile phone !" claim seems comically overblown. Not everyone has What's App, some people who have it rarely use it, and only knowing when someone's online is a pretty weak form of "tracking".

That said, I agree it's not good that you can spam strangers phone numbers and see when they're online. I'll be turning off that feature on my phone.
Exactly it an order of magnitude number that helps you assess the official numbers.
Where ever the emission is produced and the cost would be pasted on to the consumer. This causes incentives to emit less.
Oil and gas companies would pay the loins share of these taxes, gas would go up in price.
I've found https://www.theodinproject.com/ really valuable. The resources they've gathered have a good balance of fundamental theory & practical exercises.
That's a good point.

I did a bit of walking away, had some water and feel a little better. It's sometimes difficult to separate things from being personal. Sorry, this whole thread has my BP going a little hot because of some things like this I've had to deal with.

It's not you, I probably went a little far there with "fuck these people".
Thanks. Was this added in the last few versions? I'm usually on top of these things but I hadn't noticed that setting in the home page section of preferences until now. (For me, toggling it didn't add or remove any sites from my list, so it had no noticeable effect.)
Seems to me like they took design cues from Microsoft Edge Chromium.
Damn. That video say it all.