skysight-inc/HackerNews huggingface dataset:
>What's more after you find hackers you often can't do anything about them as they are in China, Iran, Russia or some other non-US friendly country.

It's possible if US law enforcement bothers working with their counterparts in "unfriendly" countries (I doubt they even reach out to them).

Case in point: 10 years ago a bunch of Russian scammers scammed Americans out of thousands of dollars pretending to be a valid mail order bride business. As far as I remember, because US police did nothing ("it's Russia! we can't do anything"), one of the Americans had to contact Russian police directly. A criminal case was opened and Russian police eventually busted a whole network of scammers. I know because they were based in my city, there was TV coverage. Those scammers targeted only foreigners so our police wasn't even aware they existed, because no one filed anything.
The numbered list is about how "merit" is defined. That those definitions and the ways they are measured is, more or less, arbitrary and happen to also reinforce an unfair hierarchy is the problem with meritocracy.
My limited understanding is that the Total War take on Warhammer has been quite popular.

Or are you referring to a tabletop replacement style game?
Paywalled journals say otherwise.
> ...hints at there being empirical evidence that one cannot extrapolate from murder rates to cover all forms of victim-having crime...

I hope you see how weak your argument is when your own cited paper merely "hints" at your purported conclusion.
Show HN: New Benchmark – Mezon Router vs Power Router
script kiddie is simply a hacker term, it has nothing to do with age or even skill.
It does kinda look like Tofino 2 was delayed two years by the acquisition, eerily reminiscent of the FM6000 delay that cost Fulcrum all of its market share. Tofino 3 should probably be sampling by now.
The 6+1 'Big Picture' Actions in Business
Tucson is very close to the border though.
https://archive.is/X4QTk
I started with a "Kitchen Crop " 4-tier sprouter with a mix of broccoli and alfalfa. I start one tray every other day and harvest the off day, so it is continuous. Change the water in the morning and at night. It's low maintenance, just make sure seeds aren't getting caught in the drainage holes.

I have since branched out to multiple types of microgreens, but those get a little more complicated and require lighting of some sort. Once you have a plan though, you get to be a human-in-the-loop robot to keep the machine going. :-)
I agree with her.

Yes, there were a few years she had lost direction (as many other young famous people do -Justin Bieber, the Hilton heiress) but this is ridiculous. This has gone on too long.

She is an adult and she's been off whatever she was on before and she should be out of conservatorship --she should have been years ago.

Obviously, yeah, she could relapse, or whatever, but she has a right to fail as anyone other able adult.
Can I also add don't run MongoDB into Docker containers. Use MongoDB Atlas or switch to AWS and DocumentDB with proper VPC and a network level firewall (security groups).

@conesus It's just not worth using discount hosting providers for this exact reason. Use a M(icrosoft) A(mazon) G(oogle) cloud, yes it costs more.... But your time is worth it!
Okay, but in the grand scheme of things that's like 'Well, we know the earth is round.'

One thing that should be agreed upon, but isn't, is that carbohydrates are not necessary in the same way alcohol is not.

While carbohydrates are an easily available source of energy, one can be perfectly healthy eating a diet with purely incidental carbohydrate intake.
I can't read the article, but the fact that they include suicide in the list indicates a strong possiblity that they did not control for socioeconomic factors.

Maybe richer people drink more coffee, and also tend to die less?

Sorry if it's an easy critique but it's hard to believe the substance that basically only raises your heart rate is actually doing anything (good) long term.
Merely hints at my contention that you are succumbing to the law of averages.

It directly supports my original conclusion that there are disproportionate experiences of harms for transgender people.
Are you holding that up as an example of a functional justice system?

Because that strikes me as more dysfunctional, where people are getting preferential treatment because they're part of the German footie machine.
Intel Cyclone 10 GX FPGA Notes for Private Island Open Source Networking Project
Actually if thats really the median salary then Costa Rica is far less affordable than Toronto. Look at these prices on this website (albeit one of the first search hits that comes up) (1) I'm seeing 3-4 bedroom homes for at least $500k USD in some cases. If you can afford to pay that outright with no financing as a foreigner in Costa Rica, you can certainly afford a down payment in Toronto's housing market today.

1. https://www.propertiesincostarica.com/homes.html
Yeah but you can put a radar and nice camera on the 5' one.
Just noticed the sibling comment recommended the same sprouter, more popular than I realized.
https://archive.is/gccon
Sure, but by the time I would call someone my friend or acquaintance I would assume that they would feel safe enough saying anything that might reveal that fact in an indirect way. Then again, being gay/lesbian is very much an accepted thing here. Being trans still not so much, though that is changing.

If I would meet some stranger or some person in a work setting their sexuality would not be on my list of things I would be interested in, either we don't know each other that well or we have at best a working relationship, a job to get done, and to move the subject to sexuality would be - according to me - inappropriate.
A rando on twitter is not a source, they're just citing the same circular reasons speculation as assertive truth and there's no proof.

And your citation is to:

> Discovery of a rich gene pool of bat SARS-related coronaviruses provides new insights into the origin of SARS coronavirus

Yes. There is a massive amount that we still don't know about the genoomic diversity of sarbecoviruses in bats in and around China. This is the kind of study that we need a whole lot more of. No idea what your point is.
At every layer of “breakage”, you are cutting down the chance for an attacker to access your system. While it’s possible the failures might cascade it seems likely that these failure modes are pretty independent of each other.

You’re simply pointing out that no amount of layers are foolproof. The goal is not to reduce failure to 0% but to 0.001%.
FWIW I upvoted you for contributing to the conversation but...

>1. This drone does not fit the description of any known DOD drone, so you should assume it’s classified.

I wouldn't. And I've held a secret clearance. Not fitting any "known" DoD drone means absolutely nothing.

>The DOD is meticulous about only flying classified aircraft in restricted airspace where they can prevent prying eyes and inadvertent attention.

Except for when they aren't.

>3. Classified and unclassified aircraft are not just operated by a dude that hops into a plane or sits down at a drone console. They’re planned out. They’re also not operated in a vacuum. If your scenario of a classified drone operating in this airspace were true, and the drone was picked up by a friendly chopper, the operator would most likely immediately land safely and have someone reach out to the pilots and let them know not to mess with the aircraft.

You can always spot a layman talking about this when they talk about things as "classified" or "unclassified". Classified what is the relevant question. Confidential? Secret? Top Secret? ???

>4. I consider it highly unlikely the DOD would ever use other agency resources to unwittingly run training Ops.

It's a good simulation of what a similarly advanced country might have on hand. The US, China, and Russia routinely conduct "response time" checks by putting a proverbial toe in each other's airspace to test response times and responses in general. The idea that they would never do it with American organizations is presumptuous. Our respective militaries pay close attention it when it happens but aren't particularly alarmed by it because it's not rare.
If there's anything I've learned in my life, it's that I don't understand how humans work. Which is why I'm pretty skeptical of your implicit claim that you do know how humans work.
I almost had to. A neighbor didn't think leashes or fences applied to his dogs and they cornered neighborhood children on more than one occasion and attacked one of them. The dogs went into another neighbors garage and attempted to attack him. He happened to have a rifle with him and gave them a warning shot. I'm not sure I would have, and I love dogs.
WA should be its own data point.
And the NSA does not spy on Americans.
Um, if the goal was to make investing while in Congress unappealing I would just ban that. Index funds only. Don't like it? Don't run for re election.
Functional ‘while’ loops – no, really
Without reading, I remember few years ago when every other weeks in major media I was reading Coffee good for your health, Coffee bad for your health depending what party was sponsoring study or article...
It also doesn't properly reset if you leave and come back. It seems to set the reset flag, then once the ball goes in, then it resets.
Humans can only produce two different types of gametes (sperm or egg), and never both in the same body. And it’s never a “spectrum” with “speg” or “sperg” variants.
https://archive.is/lK0c3
Reminds me of Saunt Lora's Proposition from Neal Stephenson's Anathem :D
Redis doesn't accept unauthenticated external connections by default for a while now, specifically to try and eliminate this footgun.

https://github.com/redis/redis/commit/edd4d555df57dc84265fdf...
Weird question, but is it safe to sign into my Apple account via some random novelty app like this? What's the worst a bad actor could do?
my hunch is the ccp is powerful at manipulation and convinced the left that lab leak theory is “racist” but somehow saying they eat bats isn’t. (likely to cover up for the fact it was lab leak)

and the establishment is very easy to manipulate with the R word
There is no doubt.
Bad idea. Distributed development ensures the kernel is difficult to corrupt or destroy.

git was designed for this purpose.

If a dev cannot be bothered to learn the distributed process, they should not be submitting code to the kernel.

No corporation such as github, can be trusted with so much power.

+1 respect to Linus as usual.
The company had less than 20 employees, everybody knew each other, and my manager was the owner, a self-made man with a really high opinion of himself due to survivorship bias. Also, it was my first job after my failed startup right out of college. It was really tough for me to give feedback, and I didn’t even know if I was just being lazy or the problem was the way things were being run.

Looking back at it, I understand why I quit, but back then I couldn’t even put it in words. Thankfully, I managed to keep all the friendships I made, including my ex boss.
One of two things is true. Either they believe everyone should be doing 30 years (preposterous) or they know they are committing a grave injustice against someone.

There is no reasonable interpretation of selective enforcement.
A "boneyard" with three doppler radar stations with diameters close to half of a B-52's wingspan. They saw this UAV the whole time it was in their airspace or I have a bridge to sell you.
As a counterpoint, Germany uses fines much, much more as a punishment than the US, which can easily be seen as a regressive punishment – it is a punishment which is much worse for the poor than it is for the rich. Meanwhile prison is something both the poor and the rich want to avoid equally.
Not every US STEM degree gets you a six figure job. STEM majors are some of the most awarded degrees in all colleges; there is a huge oversupply in the labor pool unless you are able to differentiate yourself which is not easy and usually requires post graduate education or nepotism. For the vast majority of STEM B.S. degrees, even a computer science degree in the midwest, you might be toiling for 60k-80k too. No one I knew who graduated in computer science in my undergrad has some glamorous bay area life today. Most ended up getting jobs in places like Nebraska or somewhere humid in the south writing terrible enterprise software and they complain to me how much it sucks. The bay area and that high income tech culture is a tiny little bubble, despite all the ink spilled over it.
I back up my notion data to sqlite or postgresql using a Python package I wrote (that in turn uses notionpy). It's pretty easy to run. I can share my code with you if you want, let me know.
I've found that this was true 5 years ago, but these days recent CS grads just don't know how to code like they used to. Many have never even toyed with web dev of any kind before, and lack many fundamental concepts outside of the traditional algorithms/data structures column of material. For example, I've found many junior devs with only a CS background don't understand client/server boundaries and often need to be taught how web browsers work on day one. Many have also only ever used Java and/or Python and seem to lack significant systems understanding that used to be commonplace in CS grads as well.

I think one contributing factor to this is it has become increasingly easy to be a math major and easily get a CS degree by dipping into a few CS courses at a lot of schools.
Check out masscan [0]. It’s extremely easy to scan IPv4 very rapidly and find targets in an automated fashion. It advertises scanning the internet in 5 minutes.

[0]: https://github.com/robertdavidgraham/masscan
Supporting content decision makers with machine learning
Transducer
We need it so we can pirate 4D movies.
Thank you for letting us know and being clear about it. Really like NewsBlur. Hope it comes back soon!
It’s the new anorexia or cutting. These things come in societal waves, and tend to impact teenage girls the most.
On the internet, you're nobody. On your iPod, you're everything.

That's what I miss.
The TL;DR is that IPv4 means there's only 4 billion IP addresses, which modern 1-10Gbps backhaul links can ticker-tape through in a few minutes. IPv6's 18,446,744,073,709,551,616 IP address limit will sadly make broad scanning utterly infeasible going forward until users have 1Tbit connections or so :(

But for now we can do this with the v4 parts that are left: https://www.youtube.com/watch?v=nX9JXI4l3-E

Also, some crazy person good-haxed a bunch of routers and modems back in 2012 and made http://census2012.sourceforge.net/paper.html (without access to fast connections and before the advent of masscan and other straightforward tools, too). Of note is that the "Unallocated" grey areas in the the analysis images are a curious illustration of how much less-full the IPv4 internet was just ~9 years ago.
Half right. He is mixing up vitamin A toxicity from some animal livers with vitamin C, but vitamin C is also found in liver, fish roe, and in small amounts in muscle.

Adequate amounts? All I can tell you is that I know a small handful of people who have eaten an exclusively carnivore diet for years on end without suffering from scurvy.
Interesting, this definitely happened with a more recent version... Wonder if theres some other exploit at play too (could also be the containerized version?)
> Most ended up getting jobs in places like Nebraska or somewhere humid in the south writing terrible enterprise software and they complain to me how much it sucks.

Hello, friend. No but seriously, if anyone has any good advice on how to escape this, I’m listening.
An Xbox Monitor from Philips is available
Doesn't fit the risk profile. 0days are used with surgical precision, not simply to dunk on hundreds of random businesses.
The big takeaway here is that you simply should not use any technology on an internet facing server that you are not 100% committed to. There is no such thing as a 'casual' SaaS, you either dedicate the time and the effort required to intimately familiarize yourself with the crappy little details of all the tools you are using as well as their caveats or you will end up getting hacked.

That said, software suppliers have a serious responsibility to choose sane defaults, especially for security related items. If that inconveniences the users to the point where they have to explicitly overrule the safe settings and that reduces adoption then so be it, that's a small price to pay. Failure to do so will make those suppliers accomplices in all future hacks due to their lack of respect for reality: the internet is a hostile place and anything that can end up facing the unfiltered net will eventually do just that.

Finally, we will eventually end up with a regulated internet because of all these script kiddies and other wannabe hackers, where just like in the real world you'll need a permit to operate a server, mandatory pentests and so on.

The likes of AWS already make it a bit harder to expose an insecure server to the net by checking for common configuration errors such as the one that caused this particular failure.
Didn't Kickstarter kill the efforts to unionize?
I had an issue where I used the redis docker image and didn't understand docker networking properly so I set the network mode as host so my other container could connect. Not knowing this had exposed redis to the world unauthenticated (in about 2018).

Eventually a kind script set a password on redis which caused me to notice and fix this issue.
Signal didn't back up contacts and settings to their servers until they implemented "Secure Value Recovery", which relies on SGX to rate-limit guesses of a weak PIN. If SGX is broken and Signal's database falls into the wrong hands, encryption keys could be brute-forced pretty quickly (most people have 4-digit PINs).
It seems that you are using DigitalOcean. They offer a cloud firewall [1], which sits in front of your droplets, and you can limit inbound ports to only the necessary ones (e.g. 80, 443, SSH).

I'm always using this with providers that support it, since I've managed to mistakenly open ports that should be private (either by misconfigured firewall, or due to the Docker "issue").

[1] https://docs.digitalocean.com/products/networking/firewalls/
ZMap claims to be able to scan the entire IPv4 space of the Internet in about 45mins. [0] There's no reason not to believe that claim, either.

With many people doing this, it is kind of surprising that it took so long for a vulnerable server to be discovered.

[0] https://zmap.io/
Show HN: Howuku – A/B testing, video feedback, heatmap all-in-one platform
I think you misunderstood me - I mean that you want multiple layers to your security, and you need to be careful to select layers that fail independently. If Vault has a sufficiently bad unauthenticated bug, then attackers can simply use it to request database credentials and query the DB, which is now on the open internet.

An easy way to get independent failures is to layer a private network with strong auth and firewall rules. While it's certainly possible to expose your DB to the internet safely - given sufficient protections - you won't get that with just a TLS key. And even if you try to implement the "obvious" additional layers here (Vault, right?), it's easy to inadvertently include design problems that reduce to "only one failure and the system is exposed."
Definitely. Only make something configurable if you know there are people you want to use the software who will use different values for that configuration. Infinite flexibility equals infinite complexity.
> Would China stop at Taiwan?

Guesses follow. Mainly based upon my suspicion Chinese are falling into the curse of empires. Similar to how a billionaire will ascribe fiscal success to acumen in other fields. But on a national scale. This is extremely atypical of China’s history, but here we are with them rattling a bunch of their regional neighbors.

If they invade Taiwan, they won’t likely stop at Taiwan. But they probably won’t take another bite for a generation or so.

> If not where would they invade next?

Either Korea (both) or Japan. India antics are a feint. They’ll opportunistically “regent” Pakistan if a Pakistani collapse falls into their lap. If whatever they attempt after a successful Taiwan invasion is also successful, they’ll want a rematch with Vietnam.

> Where does the US draw the line?

From the Alaskan rhetoric, China is indicating they strongly suspect the US won’t ever draw a line as long as China continues to slowly bleed out the US. Doesn’t matter what US will do. China sets the cadence, it matters what China will do.

> Where would the US have the best chance of making a decisive stand?

Best time to plant a tree is 30 years ago. Next best time is today.

> Taiwan, unfortunately, is not easily defended from China.

With several hundred fusion bombs hypersonically delivered, a ham sandwich is defensible. Taiwan doesn’t need to mount a defense that convinces China that Taiwan will win. Taiwan just needs to convince China that China will lose, too.
Or they thought they had a stealthy little bird the locals wouldn't ever see, and got busted.

Being full of human beings out military is fallible.

>Also, I would have to imagine that any supervisor involved would have immediately contacted the civilian agency involved to say "it's us, please back off."

I would imagine them doing no such thing. Most of the nuclear program wasn't disclosed to anyone until Kodak discovered it on their own.

Our military has a host of secrets and everyone in it does their sincere best to keep them, particularly when ordered to.

>would have immediately contacted the civilian agency involved to say "it's us, please back off."

If the civilian agencies - or any entity really - doesn't have "need to know", they won't be told a thing. Based on this thing escaping, they don't need to know anything at all.
I'll say that you'd probably want to set your null hypothesis at "presumption of innocence" here.

The general trend I see in the community is that there's a strong belief that google, and by extension, the tech industry, is biased in favor of white workers.
Right but you can also chalk those areas you mention up to something wrong with masculinity in our culture / toxic masculinity. For the prison population this conditions men to commit more crimes and conditions courts to be more likely to convict them. Men commit more suicide because toxic masculinity puts pressure on them to be a provider/breadwinner and when they fail they can't take the pressure. More men are societally encouraged to become soldiers, and then feel the need to "be a man" and put themselves in danger, so more die. Homeless and drug addicts -- there is increased mental illness in men, why? (more pressure to succeed and provide and compete for females, pressure creates psychological problems), drug addicts = escapism from failure to meet society's requirements. All of this stuff comes from a toxic masculinity embedded in our culture, and it can be fixed slowly over time by breaking down gender-based stereotypes and expectations.

Point being, toxic masculinity is super harmful to men, in addition to being harmful to women.
Relevant xkcd https://xkcd.com/1217/
> There shouldn't be a cherry pick involved

There is if you discover the typo in the middle of working on something else, which is usually the case for me.
Show HN: Cybersecurity Compliance Management Software
Yes, Debian - and Ubuntu, for that matter - have some pretty bad defaults in some places. Having users' homedirs UGO rwxr-xr-x is pretty bad.

The defaults should be secure with explicit unlock steps for those that know their environment well enough that they can explicitly relax some restrictions.