skysight-inc/HackerNews huggingface dataset:
There must be something I am missing, because I dont understand how underpaid most bug bounty programs are.

If I ran Googles program, I would immediately 10x all payments, unironically. Yes, that means paying 1 million bucks for something you previously paid 100k for. Drop in the bucket. You also get a ton more eyeballs on you, letting you patch everything ASAP.

But they dont do this. I dont know why. Security through obscurity? I suppose that works if you are myspace.com in 2021. Nobody likely gives a shit to try and hack it, but at the end of the day this is still google so that really doesn't apply.

The downside of not paying handsomely is people realize they can make more money selling to third party vendors, (which some do) then every once in a while you get a bad PR story showing that your stuff was hacked and exploited for months/years and it potentially knocks a few points off your stock price.

Money is really the end all be all. If you pay more than third party vendors, I can see almost no reason people would sell to them. At that point, your only adversary's are gov employees of nation states and the staff of companies dedicated to finding vulnerabilities.
At this point, it's pretty unlikely that I'd compliment a woman I was interested in on their appearance. Far too likely for it to be taken badly.
I’ve been using the imap-backup container for a couple of years, it has been rock solid. I test a full restore quarterly.

https://github.com/joeyates/imap-backup
What's creepy about complimenting someone's belt, that is not creepy about complimenting their watch?
Yeah, the traffic is more predictable, but when something goes wrong, traffic in airspace can easily maneuver to avoid problems. And moreover, in airspace a disaster is local – the debris from a satellite collision is unpredictable and can stay around for years and years!
A helmet seems like an easy fix for that.
true, i haven't found any research paper on this too. But, I have seen this being shared in our community posts.
I think it's valuable to just blog for your own sake as well. It gets you into a habit of putting your thoughts into words, which in my experience helps my understanding of the topic.

About offending people - think of it as an opportunity to learn. You put your opinions out there, and if someone points out a flaw in your thought process, you try to see where you went wrong. If you were wrong, you get to make another blog post explaining your new understanding, and thanking the person who helped you get there. If you weren't wrong... well, there are trolls on the internet everywhere, you just learn to ignore them.
This was missing direly for support servers, glad to have this now.
That's not what I meant to say. It doesn't matter which cloud provider at all, if the product running on it is an emulation. All the assurances you spoke of regarding early Burroughs Large Systems resulted from hardware/software co-design. The hardware does not exist anymore. They ported some abstraction layer by whichever means to contemporary platforms, and now top that by making it available to the cloud, saying: 'Diz iz good! We king of the mainframe hill, Ugga Ugga!'

I wouldn't trust that. The same way I wouldn't trust that from another, very established competing vendor, saying the same things, having the same nimbus of security and reliability.

Because sometimes there are blips on my radar, wherein some conference talk pops up, and people looked under the rugs of
these systems, not even hard, just casually, and discovered some oopsies.

So it seems like that nimbus of security and reliability is more a result of very careful isolation from public networks on one hand, and inacessability for the bored and curious pranksters of the world on the other. But it is no absolute.

Especially if it's running in emulation on contemporary COTS hardware. (In the EFFING cloud!)

Just my not so humble opinion, though.
This individual case is a medical device company in France, not some garage hacker as the title might imply. No human (except the engineers on the down-low) will have stepped foot inside the device before a very late stage in the design, possibly requiring approval for human trials, at which point all those risks will have been assessed.
The debit system for sub here in HK is only possible on the user side. You can't automate it like in Europe, the dude has to go to his own account and register it himself with the company's target account.

But what you say must be impossible in SEPA too - to fake a sub registration you'd have to register with a corporation ID as a subscription receiver in the SEPA area. I'd suppose at least you fraud one person you're immediately found. But it's also that you probably can't even register without at least a sort of reputation check.
I support the effort, but I have seen these things generally devolve, fairly rapidly, once people figure out how to game the system.

For myself, I've done a ton of writing[0], but my work seems to be too long-form for most. I don't really go out of my way to promote it. I basically have them up, so I can reference them in the odd comment.

Not the end of the world. I generally write for my own benefit; not for others.

[0] https://littlegreenviper.com/miscellany/
> it would take a sea change for Apple Silicon to take over

Not really.

Over my career I used x86, MIPS, PPC, SPARC, x86, and ARM machines. With the exception of x86 Windows boxes, they all looked and felt mostly the same. The Mac in front of me and the Linux laptop to my left incidentally use x86 CPUs but, at the core, they are both Unix-like machines and that's what I use them for. I don't care about binary compatibility and what ISA the machine uses inside it.
> ... receiving sincere and well-expressed praise can feel as good as an unexpected windfall.

Going on a bit of a tangent: I think giving "sincere and well-expressed" criticisms is just as, if not more, important.

Some of the most profound lessons I have learnt in life come in the form of criticisms from people who don't know me well or at all. As far as I can tell they all have this in common: they are not afraid to be honest and they make sure that I know they are just looking out for me.

> The effects of the flattery were dramatic, with 79% of the participants offering to help with the event publicity, compared with only 46% of participants in a control group, who had not received the compliment.

In contrast, and somewhat related to the quote above, I feel that compliments are just short term "hacks" and, at least to me, don't really shape me in any meaningful way.
If you prefer something daily, you could check https://hnblogs.substack.com/
FreeBSD is a great OS! I don't like so much Linux distributions - way too much fragmented too, and I just want something that "just works" and not "barely works". Also, coming from *BSD, Linux is too messy for me... just my opinion :)

I used FreeBSD on a Thinkpad when I was in college but switched to mac as I became annoyed by Thinkpad and wanted a MacBook Air like computer...
>And you're telling me in the US I know your target bank account to wire you pocket money at your birthday, I can also just withdraw ? That can't be right sorry.

Yes, it can be and it is right.
I can't find documentation on how to add a TCL wrapper for an interface to the sensors. Is this abstracted somehow?
Interesting, though I'm struggling a bit for when "chat initiated" is the best trigger for things that aren't in the fun category.

That is, when is chat-initiated typically a better fit than something initiated by a check-in, build, incident detection, and so on?

(Not knocking it, just curious)
Sure, it's not too different from most of people specializing in bashing China's greatest flaws.

I think everyone, from the both camps, should welcome specialists like myself. Not because I helped China, but because I helped people better understand China.

Makes sense?
Developer First Culture and Collectives at Stack Overflow with Ben Matthews
Well, not just mainframes generally, but if they created AWS on mainframes and hosted them… that would have made it accessible for startups.
CPython is not even memory-safe. The compiled bytecode is accessible to ordinary Python code able to replace it with 'incorrect' bytecode that causes out-of-bounds memory access by the C interpreter.

(Presumably an unusual thing to do -- I've seen libraries doing bytecode hacks but I'm not sure how popular any of them are.)
This looks great, I just created a command to trigger a job in circleci and it was very easy to get started.

Is there a way to have commands that are approved by another person (for example, `@abbot deploy skip-tests` that has to be approved by another team member with a thumbs up reaction or a reply?)

Is there a way to add replies to the original message from the bot directly? Or at least respond to the same channel? (like: I trigger a deploy, and the bot sends a message to the slack channel when the deploy is done)
Performance vs programming effort between Rust and C on multicore architectures
MyEtherWallet adds BSC and Binance Bridge in their new Android update
that I couldn't tell you. I'd personally pick lua (or damn near anything else) first. maybe just entrenched knowledge/tooling in certain industries monster codebases.
> For what it's worth, system-provided can be arbitrary and vary widely between systems.

Sure. That's inherent with software.

> Moreover, in the Python world a distinction is made between "software that runs your system" and "software that you use for development"; maybe Rust people think similarly.

What?
I’ve been working on an OCaml by example page. It’s not really ready for prime time but you can at least learn the basics with it and hell, even contribute if you want :)

https://o1-labs.github.io/ocamlbyexample/
Totally agree with this sentiment... the Geo-engineering is in full swing... I do find the DEWs intriguing, as the footage of them sparking off fires in CA are pretty compelling, but not entirely believable....

I find the massive floodings in Germany, Belgium and also China to be very interesting...

It was already stated many times regarding the chinese using weather modification to create effectively what we referred to as "acid rain" in the 1980s - in an effort to sequester particulate pollution in some cities -- there are several possibilities:

1. Freak 10,000-year flooding

2. Weather warfare via HAARP or such

3. Weather modification fuckup gone awry (or intentional)

4. We broke the weather system some time ago and weather modification and technologies such as HAARP are being used in a failed attempt to fix the weather system. (I love this science fiction take on it, personally)
This looks similar to the Zulip implementation which I sorely wish Mattermost had (since we use that at work)
You can't just change the license to a copyleft license, but you can make changes to it that are licensed under a copyleft license. If your fork/derivative project gets enough attention, you've practically changed the license anyway.

If one is contributing to a project with a permissive license, that should also imply being a-ok with it getting rolled into a copyleft project too.
Yep, the Chinese market is not market in the sense people are not free to buy and sell based on market influences but party demands.
Tax billionaires out of existence, free college, free health care, limit investment in rental properties and do away with vast chunks of zoning laws. Stop forcing Americans to life all their life to pay off their debt and making children expensive luxuries that only the rich can afford.

(And I can already feel the aneurysm I just gave half the people on this forum)
Bug bounty prizes are set to encourage a certain quantity of bugs to be reported.

If you offer 10x as much, your triage channels will get overwhelmed and you'll have to deal with a bunch of hostile researchers and development teams who hate your guts because you just blocked their next 2 sprints.

If a bug bounty program is effective, then the payouts should trend up slowly over time as your security program becomes more efficient and produces more secure code.

It's important to remember that purpose of bug bounty programs is not to reduce the number of bugs in the code base - it is a validation measure to check whether your controls are effective or if additional controls need to be added elsewhere.
Note the middle right side has a line of text:
Yumen Gansu windfarm

This screenshot from Planet's earth photo is used for missile silos...
Cool! From my layman's read of that, the odds are good for new physics and/or a new particle, and it sounds like said new particle is actually in a soon-detectable range. That's pretty ideal!
>This would allow validations to build on each other, as well as validating arbitrary combinations of fields.

Validations "building on each other" is a common requirement, but in this style of code is often deliberately left out.

The trouble is that the goals of "collecting all the errors possible" and "allowing nested validation" are incompatible, in general - the system would have to be aware of dependencies between pieces of data in order to do it correctly (i.e. capture as many errors as possible). It's typically much better to have the programmer direct the nested validation, so that they can opt in to discarding error messages.

There's an interesting case of this in Haskell code, in the `Validation` type [0]. It's not identical to the OP, since that type is a functor rather than a cofunctor - but the idea is the same. Importantly, `Validation` is not a `Monad`, because that would let you write dependent rules which discarded errors (and therefore broke the typeclass laws).

[0]: https://hackage.haskell.org/package/validation-1.1.1/docs/Da...
I'm trying now, can you help?

https://imgur.com/a/cuYsnpU
Government considering 100 points of ID to get Facebook, Tinder account
I imagine that wouldn't be very powerful.
Show HN: Finding DORA with Sleuth – the most accurate Accelerate metrics tracker
> You think the poster invented the haircut example? Interesting.

No. I’m not sure how you got the impression.

My point was that HR isn’t anti-compliment, they’re anti-compliments on people’s physical appearance, which includes haircuts.

I’m not commenting on wether that’s appropriate or not, but thought it was an important qualifier.
Size variation, maybe? If you're building an industrial robot you control the size precisely, but if you've got to make everything variable - and not just variable, but to be as comfortable as clothes - I can see that throwing a hell of a lot of complexity into the mix.
Compliments are a little tricky, but I've also been trying to get better at giving them out.

We've all run into people who use compliments to socially separate people ("thanks for not being overbearing like chris") or to try and push over work boundaries (telling a colleague "your pants make your butt look good" and then saying you were 'just trying to be nice'). I also think about the complicated patterns of noticing and reinforcing certain behaviors - I've been frustrated when I get compliments on things I didn't choose instead of the things I am trying to do. Not that the compliment is bad exactly - but it's a data point that suggests that my work may not be appreciated.

So my "strategy for safe compliments" goes like this:

- Don't compliment things you have no experience with (compliments mean more from peers and knowing the area helps avoid...)

- Don't compliment things that aren't stylistic choices or a demonstration of mastery (both of these things are difficult to identify outside of our own areas of experience)

- Focus your language on what you like about the style or efficacy of the other persons' work, not the person themselves ("I like that you did it like X" instead of "you're so competent" -or- "oh, I always struggle with that part - I'm impressed how quickly you did it"). This phrasing also can open conversations into mutually validating conversations about stylistic choices.

- Do not use universal language ("You do that really well"), use I language ("I'm impressed by how much detail you put into your comments"). I-language grounds the compliment in your own experience and makes it more of a conversation between you and the other person and less of a 'global statement about the world' kind of thing.

The heart of all of this is that we've all had the uncomfortable experience of having someone else admire something about us that we do not like. Those feelings are a fact of life, but we can avoid tripping over them in our personal and professional relationships while also speaking freely and enthusiastically about why we admire and appreciate those around us.

Edit: added I-language note
New Feature: Contents Publish Box Support Visual Web Editor
We are so glad to announce that Kunming.io now supporting Visual Web Editor on Contents Publish Box, And it so easy to use! Every member can publish contents directly through Contents Publish Box with articles, videos, audios, photos, code snippets, run code output/results, blog posts, etc. So please come and post whatever you want with your company blogs, product informations, personal articles, individual videos, musician audios and so on and enjoy with contents publish worldwide.
"Treat all people as people."

Which also means taking into account that some people are, in fact, unfair assholes and that you may fail to recognize them in time.
1password raises an extra $100M at a $2B valuation
Bertrand Meyer: A Standard Plan for Modern Requirements – The PEGS Approach
No this is literally the example we were given. I have no idea if the trainer actually heard of a case where someone was penalized for this, or if they concocted a trivial example to make the lesson clearer.
The abstract says "I find no evidence that the shift towards larger vehicles improved aggregate motorist safety." That driver deaths have fallen doesn't imply SUVs caused them to fall. Occupant safety has improved across all vehicle types.
that's interesting story. this is quite huge and I think that could be crucial to tether and its reputation i wonder if the companies that accept tether now (like those mentioned here https://nowpayments.io/blog/businesses-accepting-tether) will continue to do so? what do you think
Ah, but those environments allow for a super-subtle diss disguised as a compliment. "Nice font selection on that presentation!"
If you don't promote it, how do you want people to discover it ? Long post do well on HN comparatively with other boards.

[1] is exactly the kind of post that I include in my newsletter, but if it is not posted on HN, I can't see it

(there is a typo in the link you posted)

[1] https://littlegreenviper.com/miscellany/the-road-most-travel...
I registered a HN account just to comment on this. Thank you so much for writing this small yet powerful software. I used it in grad school when I needed to write paper with latex and compile it with pdflatex. 2 features are killers:
1. auto reload the newly generated pdf.
2. double click on pdf and it jumps to the corresponding place in the tex file.
It was such an productivity booster.
Thank you!
Deserved. It's a special town, a unique place. I can only hope this spurs town planners to reconstruct the "Jette":

https://i1.wp.com/thegoodlifefrance.com/wp-content/uploads/2...
If you're using a wheelchair due to a joint issue, as opposed to paralysis?
If you haven't seen it yet, Tim over at the Way Out West Blow-In Blog[1] has been building a cartway to do farm work where a tractor wouldn't serve the purpose well. I haven't watched recently but last I checked he had built a wagon or two and a boom-mounted trenching wheel. It looked like a neat project!

[1] https://www.youtube.com/channel/UCSViWfOV4pEcYnzpV6w548Q
If all we had was observations of modern day plate tectonics it would be foolish to back-propagate the same motions billions of years in reverse and claim ones methods were "scientific".

Luckily, we have things like fossil records to justify such conclusions. They provide the second point with which we can "fit a curve" when exploring history.

With this "origin of life" stuff, we don't have that second point of confirmation. We think up a bizarre process, execute it, and see that it produced some molecules that we see in modern day life. We then have the gall to say that we've discovered "the origins of life"? Yeah right... https://news.ycombinator.com/item?id=27974369
Yes! I often write LaTeX in vim under WSL with this setup and it works pleasantly. VimTeX re-compiles whenever I save the document, launches SumatraPDF on the first compilation, and SumatraPDF hot-reloads it without any extra effort on my part. I'm pleased to see a native Windows program and VimTeX under WSL interoperate so well.
I'm so traumatized by silicon valley that I immediately assumed this was about Naval Ravikant. Sigh.
Huffman-compressing Monkey Island PC-speaker music to fit it into an ATtiny85
I don’t know why you would stick with the gas station model, it’s completely unnecessary for EVs.

An EV charger requires minimal infrastructure compared to a gas pump, and zero attendances. That means that supermarkets etc can just convert normal parking spaces to chargers. Reducing the need for quick charging because people will shop while they charge.

On highways you can install huge 350kw chargers that can add hundreds of miles in the time it takes you to go to the loo and again chargers are incredibly cheap to install and require so little infrastructure compared to a gas pump.

The cost of a 4 pump gas station is about $500k[0], the cost of a 4 “pump” supercharger station is around $100k[1]. That’s 5x cheaper, and far easier to expand because you’re not dealing with flammable liquids.

[0] https://www.commtank.com/services/gas-station-construction-c...
[1] https://techcrunch.com/2013/07/26/inside-teslas-supercharger...
Prior to the vaccine rollout (at least in the US), positive cases were used as a metric for public health officials to gauge whether the virus was spreading, whether containment efforts were effective, and how to manage the presumable change in hospitalizations and fatalities.

As vaccination efforts have rolled out, there is still a relationship between positive cases and deaths, however the ratio of cases to deaths has dropped dramatically.

If you Google "uk covid cases" and flip between new cases and deaths you will notice that the "2nd wave" in December/January had an increase in deaths 2 weeks after the increase in cases. The "3rd wave" has had a large increase in cases but no resulting massive increase in deaths.

The only metric the public should be concerned about is whether they have or have not been vaccinated.
A Practical Guide to Cryptocurrency Security
https://archive.is/pDQsW
> Receiving compliments has always made me squirm, even suspicious.

To add to that, it feels weird to GIVE compliments for the same reason: fear that somebody will be suspicious that you're flattering or "sucking up." If they think you're flattering them, they might feel like you don't respect them, which is the opposite of the intention. This is 10x as true if the other person is your boss.

There must be some art to how you deliver it that helps with that
Are these no-code solutions essentially Microsoft Access forms, but with a hosted database and mobile and web clients?
Salmon nearly roasted alive in Pacific north-west heatwave captured on video
Nobody pressured Turkey (or Russia, in the era of Peter the Great) into trying to become more like Europe. They chose it on their own. If you're going to say that their choice was wrong, that would be rather paternalistic, don't you think?
My provider mailbox.org keeps last one week’s daily backup (but it does say that that’s an additional gratis feature so no guarantees). Though it has rescued me twice. Once I had nuked all the mails.

Other than that all my mail gets downloaded on Mac via Mail.app and I backup that Mac mail folder[0] to rsync.net, borgbase with borg/vorta and to backblaze b2 with restic. That folder is simply part of my laptop backup setup.

[0] I know this is not ideal but there aren’t many simpler options.