skysight-inc/HackerNews huggingface dataset:
The students do need a bit of punishment - they are adults who chose to act this way. In this context though, switching their advisor and requiring a different research track would be sufficient - that's a lot of work down the drain and a hard lesson. I agree that expulsion would be unfair - (assuming good faith scholarship) the advisor/student relationship is set up so that the students can learn to research effectively (which includes ethically) with guidance from a trusted researcher at a trusted institution. If the professor suggests or OKs a plan, it is reasonable for the students to believe it is a acceptable course of action.
> Show us an AJAX call that GETs data

<button class='btn primary' _="on click fetch /clickedMessage
put the result into me
wait 2s
put 'Click Me!' into me">
Click Me!
</button>

More here: https://hyperscript.org/docs/
It's weird, I saw it on the frontpage, came back to comment something and couldn't find it anymore. Had to search through Algolia.
One of the other emails in the chain says they already did.

> This is not ok, it is wasting our time, and we will have to report this, AGAIN, to your university...
Ad ranking and search ranking are surprisingly similar problems: show what the user is likely to click. Main difference is what dataset you draw from. So you'd likely find that there is quite a lot of overlap between their search and ad divisions and little would change by splitting out the non search ads from the search ads.
Free Stock Footage, Music, and Images
Hey Guys!
I work for Pond5.com and we dropped a free collection today that contains videos, music and photos. If you are looking for some free content to use on your projects, definitely check it out!
I did this constantly when I was on tinder. It worked virtually every time I asked straight up (and this was after barely chatting with them), but I was also somewhat selective on who I asked. I wonder if I should have asked more women so directly, but I didn't want to make someone uncomfortable if I wasn't getting the vibe they'd say yes.

The worst outcome I had from this approach is that sometimes they'd say "yes" and then just sort of trail off in communication. Not really a problem and I took the hint.

As a follow up I also met my fiance on Tinder. Though I didn't approach her immediately for sex, we went on a date first.
I mean ELI5 is clearly hyperbolic, but explaining dispatch like "Just read a void* pointer and do a goto *p" is definitely 1st year of CS level. This wouldn't be valid for teaching actual VM implementation fundamentals.

Some may wish courses about compilers & VMs would be as easily (and naively) explained, but this style misses a lot of critical and complex details. Nobody likes complexity, but if it exists, it exists.
I was more ambivalent about their "research" until I read that "clarification." It's weaselly bullshit.

>> The work taints the relationship between academia and industry

> We are very sorry to hear this concern. This is really not what we expected, and we strongly believe it is caused by misunderstandings

Yeah, misunderstandings by the university that anyone, ever, in any line of endeavor would be happy to be purposely fucked with as long as the perpetrator eventually claims it's for a good cause. In this case the cause isn't even good, they're proving the jaw-droppingly obvious.
I completely disagree with this framing.

A real malicious actor is going to be planted in some reputable institution, creating errors that look like honest mistakes.

How do you test if the process catches such vulnerabilities? You do it the just the way that these researchers did.

Yes, it creates extra homework for some people with certain responsibilities, that doesn't mean it's unethical. Don't shoot the messenger.
Thank you very much for pointing out. I didn't realize there was a security hole. I would like to study a little more about the input form. For the top page, JavaScript has been completely removed.
ARM has all these variations which make it seem as complicated as x86, but they are distict variations and future CPUs can for example drop 16 bit Thumb fairly clearly.
Do they have any interest in hiring regular employees? Most of the people I know who go after bounties barely make $30,000/yr. If I see bounties I see people who aren't really willing to pay.
Wow, that's really disappointing.
The Worst Job Interview I’ve Ever Had
I, as a user, don't expect my phone number and email do be shared automatically when I open the share pane.
The thing is, the machine barely works. Most hospitals here claim to be understaffed, the queues are immense and this despite healthcare financing being at an all time high.

I suspect this sort of frauds are way more widespread than people realize
What like in a coffee shop or some other public place? Wild.
Spy Writing in the Real World
The primary difference being the organization being tested explicitly sets up a bug bounty with terms, as opposed to this.
While technically in the same state Buffalo, NY is a city on the Canadian border that is farther away from NYC than Washington D.C. is. As a new yorker, I can safely say my fellow new yorkers can't honestly pretend to know how to tackle what issues Buffalo might be facing.
> Its a functional language which allows formal verification.

Imperative languages can also be formally verified. See the K framework for formal modeling and verification of EVM smart contracts.

Detailed list: https://github.com/leonardoalt/ethereum_formal_verification_...

> Gas price is extremely low.

Beware, the gas price might be low because there is no volume. Binance Smart Chain had a lot of difficulty the past 2 days because they underpriced gas cost and basically DOS-ed themselves:

- https://mobile.twitter.com/PancakeSwap/status/13845099723948...

- https://mobile.twitter.com/peter_szilagyi/status/13848238801...

You missed a very nice example of Tezos adoption, which was the French military police using it to pay sources

https://journalducoin.com/blockchain/actualites-blockchain/u...
Transactions are supported in Prisma, see this guide in our docs [1].

I guess the post refers to our opinionated stance on "long-running transactions" which Prisma indeed does not at the moment. The best resources to learn about this are on GitHub [2] and our blog [3].

[1] https://www.prisma.io/docs/guides/performance-and-optimizati...

[2] https://github.com/prisma/prisma/issues/1844

[3] https://www.prisma.io/blog/how-prisma-supports-transactions-...
I did request by the curl without cookies, I got the same Location header.
Therefore, I guess it's is not a cookie issue.
It is true. I usually use it in tandem with flask / fast-api to parse both: CSV and XLSX. In the near future I will add XLS (yes, someone still uses it) and also the open document format.
And, that person who has a Spike protein naturally would be in pretty deep trouble if infected with Covid -- since the immune system wouldn't trigger on the spike! Though antibodies can also attack non-spike things.
Wialon Local 2104. Platform update
France ITER will come first.
> Do you understand how dumb that sounds?

If you make a dumb analogy, that's on you.
> I could imagine accessory and case manufacturers would be keen to know [...] There's also a large ecosystem of Apple news sites that would probably pay [...]

The article says, "the group is demanding that Apple pay an undisclosed ransom for the images/schematics they obtained via the supplier by May 1 [...] Until then, the hackers will continue to post new files every day, REvil said on its blog."

The target is only Apple itself, the random group does not accept third-party payment and will make all information public if it's not payed. So I don't think the group wants to sell the information to accessory manufacturers or Apple news sites.
"The Intelligence Community has found itself making real world headlines in recent years, but spying has been a staple in fiction writing for decades. Both non-spies and former intel officers have crafted spy thrillers that have won critical and popular praise. What are the differences between writing spy novels with or without previous intelligence experience? What are the challenges of writing realistic spy fiction? How much creative license is needed to make it exciting? How much realism is sacrificed in the process? How do real life spies react to spy fiction? How different is their response to that of the broader public?

Join the Michael V. Hayden Center for Intelligence, Policy, and International Security as senior fellow David Priess talked with critically acclaimed authors Alma Katsu, Karen Cleveland, and Brad Thor about spy writing in the real world and about their exciting new novels.

Award-winning author Alma Katsu a former CIA and NSA analyst, has written five novels prior to RED WIDOW, her first spy novel, which was named in March a NY Times Editor's Choice and is in development for a TV series with FOX.

Karen Cleveland is a former CIA analyst and the New York Times bestselling author of NEED TO KNOW and KEEP YOU CLOSE. Her third novel, YOU CAN RUN, will be published in August.

Brad Thor is the #1 New York Times bestselling author of 21 thrillers. His newest, BLACK ICE, continues the adventures of Scot Harvath, America’s top spy, will be published June 22nd.

The Hayden Center is located at George Mason University's Schar School of Policy and Government in Arlington, VA. General Michael V. Hayden, our founder and former director of CIA and NSA, has been a distinguished visiting professor at Schar School for 11 years. David Priess, COO of The Lawfare Institute, has joined the Schar School as a visiting professor this year."
This is the example repository: https://github.com/metachris/typescript-boilerplate
Thank you very much for your comment. We scrutinized the user's items and frozen users with porn related items. In the future, I would like to consider the reporting function and improve it so that it can be frozen efficiently.
The US navy did actually basically this with some pathogens in the 50s: https://en.wikipedia.org/wiki/Operation_Sea-Spray ; the idea of 'ethical oversight' was not something a lot of scientists operated under in those days.
God help us all if people like you become judges; "I don't like the plaintiff so this case is automatically invalidated"
I can see some logic in buying second hand devices, but wouldn't be better to buy new ones with cash since second hand devices already have a history of usage that could lead to locate you?
Can anyone enlighten me why these were not caught in review process itself?
for me its the fact that its a simple, fast loading, ad-free, no nonsense list of interesting tech articles and news
Reminds me of the George Carlin joke. "Have you ever noticed that anybody driving slower than you is an idiot, and anyone going faster than you is a maniac?"
Indeed . You could run Apple II software on an add in card though.

https://en.wikipedia.org/wiki/Apple_IIe_Card
These are real malicious actors.
I'd concur: the university is the wrong unit-of-ban.

For example: what happens when the students graduate- does the ban follow them to any potential employers? Or if the professor leaves for another university to continue this research?

Does the ban stay with UMN, even after everyone involved left? Or does it follow the researcher(s) to a new university, even if the new employer had no responsibility for them?
Same analogy... there's a vulnerability and you want to test it? Go set up a test, and notify the people.

You really think the Linux kernel guys would change their process if you did this? They'd still do the same things they do.
At annual review time for my first management job, HR gave me a list of my team members and their current compensation. One of the entries was a name I had never seen before. I responded to HR and told them they had made a mistake about that person.

They informed me that no, he was on my team and were incredulous that I wasn’t managing him. I showed them that I had never received his name in any e-mail or Slack history since I started at the company, and no team members had ever worked with him. I messaged him in Slack to ask who he was working with, but he never responded despite being online.

HR was very secretive after that, but from what I can gather the employee was reorganized into my team but no one ever told me. He worked at a remote office, so he simply sat around waiting for someone to contact him with instructions for what to do next. I don’t know how long he managed to collect paychecks without doing anything at all, but he disappeared from Slack shortly after this incident.

HR at that company had other issues. I’m glad I don’t work there any more.
I believe this is so that the university treats the reports seriously. It's basically a "shit's broken, fix it". The researchers are probably under a lot of pressure from the rest of the university right now.
Not that many users expect to sit next to an attacker running this system AND be sharing something.

No question should be fixed - but compared to the rce s Apple has had (which do get fixed quickly) this is relatively lower risk
Exactly. Users contributing from the University addresses were borrowing against the reputation of the institution. That reputation is now destroyed and each individual contributor must build their own reputation to earn trust.
ResponsivelyApp works nicely for this.
But that seems pointless. Exactly-once covering a subset of the pipeline doesn't guarantee exactly-once. At best it improves your chance of exactly-once delivery.

If you really need exactly-once delivery you need to make it end-to-end. If you don't support end-to-end exactly-once than you are really just an at-least-once delivery system.

So you are making a guarantee that provides little if any benefits because it can not be tied into the whole pipeline.
Nym

The pseudonym a person selects and uses to sign his or her postings to websites, blogs, etc. so as to create a unique online identity without revealing their actual name/identity.

"With his most recent idiotic post, Little_Brain really lived down to his nym."

Source: https://www.urbandictionary.com/define.php?term=Nym
Any app that gives my peers even an inkling of what I'm doing without me explicitly sending that information gives me the heebie jeebies.

I've gone back to using SMS for messaging these days. No more read receipts, no more "last active 10 minutes ago", no more "Alice is nearby!", and no more "you haven't messaged Bob in a while, send a message?".

Sure SMS is insecure, but at least it doesn't drive me insane with all the bullshit of so many messaging apps.
The researched yielded non surprising results: Stealthy patches without a proper smoke screen to provide a veil of legitimacy will cause the the purveyor of the patches to become black listed....DUH!
This article gives the distinct impression that Deno is an alternative to node and solves the same problems.
Don't underestimate the skill and ingenuity of pissed off 15 year olds.

With near unlimited time on their hands, and an information rich internet, they can find how to start pentesting.

Blind devotion to a cause and a flexible mind can overcome many problems.
Seems to me that the statistic is designed to hide other possible stories. Consider that those unhappy with the M1 move wouldn't buy older Macbooks, they would leave the Apple ecosystem all together.
What a great day is the day I received my first science book, learning about the great scientist named: Nikola Tesla, was very important to me, not just because he's very great in his field, but after this day I win a hero in my life.
Some people like Super-man but my hero have electricity powers to show for everybody around the world, without the works of Nikola Tesla, maybe we don't have this great opportunity in Digital age to help each other in a remote way.
> You do not experiment on people without their consent. This is in fact the very FIRST point of the Nuremberg code:

> 1. The voluntary consent of the human subject is absolutely essential.

The Nuremberg code is explicitly about medical research, so it doesn't apply here.
More generally, I think that the magnitude of the intervention is also relevant, and that an absolutist demand for informed consent in all - including the most trivial - cases is quite silly.

Now, in this specific case I would agree that wasting people's time is an intervention that's big enough to warrant some scrutiny, but the black-and-white way of some people to phrase this really irks me.

PS: I think people in these kinds of debate tend to talk past one another, so let me try to illustrate where I'm coming from with an experiment I came across recently:

To study how the amount of tips waiters get changes in various circumstances, some psychologists conducted an experiment where the waiter would randomly either give the guests some chocolate with the bill, or not (control condition)[0]
This is, of course, perfectly innocuous, but an absolutist claim about research ethics ("You do not experiment on people without their consent.") would make research like this impossible without any benefit.

[0] https://onlinelibrary.wiley.com/doi/epdf/10.1111/j.1559-1816...
> A real malicious actor

They introduced a real vulnerability in a codebase that lowers world-wide cybersecurity used by billions so they could jerk themselves off over a research paper.

They are a real malicious actor and I hope they hit by the CFAA.
Nitpick: as a CL programmer, I shuddered when I noticed that they use SLIME from 2014. It can work, sure, but it's ancient by now!
Thumbs up, thumbs down, and comments. The very things that she would still like to see go away.
Why does Diners Club still exist?
The article is clearly greenwashed with respect to the potential impact of the tech (it's at such an early stage lord knows where if any applications in which it will be used). This is corporate press release SOP. Calling it out as wasted words to be ignored or disregarded isn't "editorial bloviating".

And they're guidelines, not a ToS.
Protobuf Decoder Explainer
Regular people also don't really understand much about how cars work, and they love that modern ones start with the push of a button and that they don't have to fiddle with the carburetor or the choke to get it going.
Thank you very much for your comment. I felt that I hadn't studied enough about input forms and JavaScript. Learn about injection attacks.
I thought about mentioning it but that doesn't really count as a transition like the others. You could not even run the card and MacOS simultaneously:

> When emulating the Apple IIe, only a full-screen mode is available and all native Macintosh functions are suspended while running (a proprietary graphical control panel, running outside MacOS, is available for configuring the virtual Apple II slots and peripherals; however, both native and emulated computer function are suspended during this activity). Macintosh functions and control resume only once emulation is completely shut down and exited.

Arguably, the transition from MacOS to Mac OS X does belong in the list. Apple did a ton of work to provide the Carbon compatibility layer to make it easier for developers to port to Mac OS X. And there was also the ability to run MacOS 9 under Mac OS X using Classic.
They should be reported to the authorities for attempting to introduce security vulnerabilities into software intentionally. This is not ok.
A dating app is only as valuable as the number of (attractive) women on it. Men pay the bill because they wouldn't pay it if the women weren't there. So the first priority would make more sense to get and keep women on the platform.
Linting is not the same as typechecking. Take a look at the default available rules [1]. For example number == NaN is valid Javascript, but 99.9% of the time an error. Or you might want to require always using === over ==.

Generally, linting is things that are valid in the language, but still better to do otherwise.

[1] https://eslint.org/docs/rules/
This isn't friendly pen-testing in a community, this is an attack on critical infrastructure using a university as cover. The foundation should sue the responsible profs personally and seek criminal prosecution. I remember a bunch of U.S. contractors said they did the same thing to one of the openbsd vpn library projects about 15 years ago as well.

What this professor is proving out is that open source and (likely, other) high trust networks cannot survive really mendacious participants, but perhaps by mistake, he's showing how important it is to make very harsh and public examples of said actors and their mendacity.

I wonder if some of these or other bug contributors have also complained that the culture of the project governance is too aggressive, that project leads can create an unsafe environment, and discourage people from contributing? If counter-intelligence prosecutors pull on this thread, I have no doubt it will lead to unravelling a much broader effort.
Artificial Intelligence, Facial Recognition Face Curbs in New EU Proposal
From the looks of the dialogue, it was all of the above with the addition of lying about what they were up to when confronted. I would think all of this constitutes a serious violation of any real university's research ethics standards.
Very embarrassed to see my alma mater in the news today. I was hoping these were just some grad students going rogue but it even looks like the IRB allowed this 'research' to happen.
No. There are processes to do such sorts of penetration testing. Randomly sending buggy commits or commits with security vulns to "test the process" is extremely unethical. The linux kernel team are not lab rats.
The page has four sections, divided by <hr> tags;

1) The email message, with a few headers included

2) A thread overview, with all emails in the thread

3) Instructions on how to reply

4) Information about how to access the list archives.

You need only care about (1) and (2). The difference between prev and parent is indicated by the tree view in (2). The previous one is the previous one in the tree, which might not necessarily be the parent if the parent has spawned earlier replies.
Thanks, added a note to the post.
Thanks for explaining. Didn't know that format. :)
Their whole department/university just got officially banned. If they attempt to circumvent that, the authorities would probably be involved due to fraud.
What you do during pentesting is against the law, if you do not discuss this with your client. You're trying to gain access to a computer system that you should have no access to. The only reason this is OK, is that you have prior permission from the client to try these methods. Thus, it is important to discuss the methods used when you are executing a pentest.

With every pentesting engagement I've had, there always were rules of engagement, and what kind of things you are and are not allowed to do. They even depend on what kind of test you are doing. (for example: if you're testing bank software, it matters a lot if you test against their production environment or their testing environment)
You can see the window size is zero though, so I think GP is suggesting sending a TCP reset or something similar.

Maybe this isn’t a good option because it would have too many undesirable side effects?
There is difference between:

* system of "haves and have nots" where haves have advantage,

* two tiered system of "haves and have nots" where haves have build in advantage in the rules and have nots have additional disadvantages on top of lack of money.

Also, making everything into dichotomy where something not being perfect is a reason to make it even worst is also a very American cultural tendency. No, just because it is not perfectly fair now does not mean it is ok to make it even less fair. And just because solution of problem is not perfect does not mean it is pointless.
true, my point is more about the tendency of using groups of people to quickly share. Which SMS does not do properly.
openpyxl has good xlsx support and is easy to use. This seems to be an abstraction layer on top of both. Unfortunately this will use a lot of RAM working with large files.