skysight-inc/HackerNews huggingface dataset:
The person reporting the issue specifically said that they couldn't find those pictures on their phone and don't remember ever sending them to anyone.

The recipient also wouldn't be able to find those images anywhere else because they have chat trimming enabled. The result is that because a newly received message happened to share the id of an old deleted message, the new message is now displaying pictures from the old message.

This does require the recipient to have received those pictures and also not remember them but I believe it is easier to forget a random picture you received than one you sent.

Again, this is me speculating with very limited knowledge of client internals but it makes sense to me. I would like to see a developer confirm this.
No Mans Sky does it pretty well. Who knows? Maybe when we get up to PlayStation 10 or 20 it'll actually be simulating the cognitive/sentient elements of the universe too.
Cool, my contacts can keep using their gmail account and leak all communication metadata to Google without me having any say on that if I want to talk to them. Where can I sign up?
The best way to insert supply chain exploits is to embed them in a stack exchange answer to a beginner's question.

None of these answers seem to come from SE so this might be harder than you might assume.
This could get interesting at defcon conferences (if they're still a thing), which is already famous for having the world's most hostile wifi networks. Now DIY, private stingray?
Agreed, it took me a while to figure out that I could use any control scheme and I didn't have to quickly jump and press whatever keys were presented as "press x" the moment they came up. Other than that, fun game concept, would recommend introducing the wires earlier because otherwise it will not be obvious that this is not a regular platformer.
Tesla churns out S/X in the very low thousands, so not a lot of potential customers.
Why do you need to tell riders about the gaps?
Is that actually a scam? Sounds like you just got free use of car for a while, how are you worse off?

In Freenom's case, you are giving the domain name value by using it and driving traffic to it. It didn't have value to begin with. The same thing isn't true in the car analogy.
> You can choose to have sensitive conversations in person or not have them at all.

I don't think this is fair. Most of the solution to this is "not having them at all." That's not a good solution and still doesn't solve your problem since you can still be listened to.

> There's iMessage/FaceTime, for instance.

Which also has gotten in trouble recently with Pegasus as there was a 0-click exploit in iMessage. Honestly, that is a far more serious issue than the one here. That being said, I still trust iMessage and that the devs are doing the best that they can. I just recognize that security is difficult and will always be a cat and mouse game. There is no such thing as perfect security.
There’s nothing Adam Ondra can’t climb
From memory, I believe GSMA (the industry association that helps to keep mobile technology dominated by carriers that hold exclusively licensed spectrum, if you're cynical) require everyone who provides eSim to have been security audited. They can then get access to a trusted certificate that will be able to sign the handshake to the embedded security module (eSim).

It's complex, but remember that in the traditional world view of mobile, the carrier "owns" the SIM, and the handset, and the network itself. When the carrier can't control the SIM in its entirety, you need to have someone brokering the relationship here between everyone - otherwise a carrier coming onto a device may lack confidence the device isn't compromised by the previous network that served it.

Some information that might help you start look around the topic - https://pages.arm.com/rs/312-SAX-488/images/GSMA_eSIM_Certif...
I'm sorry I think you've confused the Product Marketing role with something else.

PM's role is not to run campaigns, either brand or 'demand gen'.

That's regular operational marketing.

Product Marketing's job is to define the Product for the appropriate segments in terms of messaging, features, pricing. Then, outbound, they will provide the overall strategy for the various campaigns.

So part 1: They know the market well. Who uses it, why, what their needs are. They'll sit in on sales calls i.e. should be one of the primary conduits into the company from them. They'll do market research, understanding pricing trends. They'll generally do some kind of segmentation, even if crude.

Part 2: Direct product activities in this regard i.e. 'Each nation has different regulatory apparatus re: this feature so we need to break it down'. Or, even though our software has nothing to do with security, this specific issue is a problem and we need to have XYZ feature even if it's perfunctory.

Part 3: For everything outbound, they'll be setting the messaging and the strategy. 'What groups are we targeting' and 'What those groups need to hear'. Probably putting together the 'baseline copy' and materials.

The 'Marketing Ops' shouldn't be making a whole lot of those decisions on their own. They should be taking that from the PM and then deciding which channels to push their budget into.

There's quite a lot of overlap in terms of customer relationship and product features, as the Product Manager also does this, but I usually think of PM's as satisfying satisfying specific customer requests, having a broader vision for the architecture that goes beyond any segment needs.

The Product Marketing team is the one that says 'We'll be selling in 5 tranches with these features at this price'. The Product Manager cares less about that deliniation and more about the product as whole including internal architecture.
OKay, M[rs] English-as-a-first-language.
And yet the yoke is so wide that it blocks the center screen and especially the gear selector part of it.
eSIM implementations need to be closed because they are considered a secure execution environment for loading eSIM profiles (in that it should not be possible to extract the keys contained in a profile).

I'm not actually sure if there is a good reason for the eSIM profile server (called SM-DP+ in the language of the specs) to be part of the same trusted computing base; maybe defense in depth against a malicious profile/SAT applet trying to access the data of others on the same eSIM?
I'm on year 3 with some AGMs. I bought used group 24 AGM batteries from a local used/recycler battery joint that were used in large hospital battery backup applications - they're typically never cycled but once for testing and always kept topped off. Very common to find these kinds of batteries in bulk a few times a year where I'm at. The flooded batteries (mostly Interstate) that I used in years prior would last at most two years even when properly maintained. The FL heat just nukes those things.
I think therefore I am. Being in a simulation doesn't make my experience any less real.
This seems very overstated to me. How many people are using Facebook b/c they couldn’t pursue their serious hobby on their tablet? Some negligible fraction of Facebook users. Further, if you want to pursue your serious hobby, get a real computer.
a.ns.cf has address 185.21.168.17
a.ns.gq has address 185.21.168.65
a.ns.ml has address 185.21.168.1
a.ns.ga has address 185.21.168.49
% Abuse contact for '185.21.168.0 - 185.21.168.15' is 'abuse@freenom.com'
% Abuse contact for '185.21.168.16 - 185.21.168.31' is 'abuse@freenom.com'
..and so on

I may have not been clear enough by "own", but Freenom are the technical operator end to end for all of these TLDs (and .tk, from much earlier before) and exercise total technical control over them.
PTFE is not really produced from petrocarbons, at least not directly. Its made by polymerization of tetrafluoroethylene, which appears to be made from chloroform + HF, the former is made from petrocarbons (methane/methanol + HCl/Cl), the latter from minerals. PTFE is quite expensive (compared to most other polymers). I suspect PP or PE could work just fine in this application.

I'm just saying that you could simply eat insoluble fiber (from plants or other source) instead of ground up plastics, which will also create a massive source of microplastic pollution and contamination as it comes out the other end.

You can easily store insoluble fiber (cellulose/chitin, etc), in vast quantities in dried form without any major issues, I can't imagine ground up PTFE being significantly better in that regard.
I can't find the video or link, but Aziz Ansari talked about this in either his book "Master of None" or one of his sketches.

He basically boils it down to we're becoming more non-committal because we think something better is going to come, whether its the better brunch, the better gathering, the better toothbrush (he specifically cites this example) so we can all post it on social media. It results in all of us being miserable and unable to foster undivided attention.

The best thing you can do really is to not opt-in.
I think a document was leaked somewhere that said they'd move him from country to country to face charges, making the process itself the punishment rather than letting the cases conclude. I doubt he'll ever be free again.
The very RISC paradigm relied on compiler change.

The change happened, but not as fast as we would like it to.
Generally speaking lesson 1 on building queries skips over injections and only after the basic premise is explained do you go into the details on how to be secure in lesson 2.
In its current form of being deposited monthly into people's accounts? No, it's very new.
UK councils to display EU flags after UK dips into Covid recovery cash
> If you can’t take part in your children’s lives…

That’s a question without an objective answer. For example some people are better off in the foster system. It’s an oversimplification to assume some kind of standard life for other life choices.
English is my second language.
I had intended to add Windows to that, but my brain-to-typing-fingers skipped over it. The word "Windows" tells me nothing about what it does in the "same contenxt" as what's being discussed here. We've just had that crap shoved down our gullets for all this time it has become synonymous with software operating system not because the word is descriptive of purpose.
The canonical representation of DOM content is DOMString (https://developer.mozilla.org/en-US/docs/Web/API/DOMString), which is not UTF-8. Your HTML being encoded in UTF-8 is irrelevant, it gets decoded when it's loaded into whatever the canonical representation is. Your HTML could be in Shift-JIS or ASCII or whatever and not UTF-8, same difference.
What does it mean for it to "not be acceptable?" Accepting or not accepting the bug is not an option on the table. It happened. The options you have open to you are to use or not use the freely provided software, or donate or not donate to the foundation providing it. Users cannot be assured that future bugs will not occur. That is an assurance that is not available with most consumer software, and certainly not with software delivered for free by a not-for-profit.
>serious alternatives

How is Quill Chat that's proprietary and not E2EE a serious alternative?

Element's UX is behind Signal but at least the encryption is E2EE by default.

Session is a Signal fork with bad metadata protection: There's 60 entities owning Loki nodes, and top three players own 80% of nodes.

Delta chat leaks metadata to email providers, and PGP has no forward secrecy or deniability.

Element is the only one that's even remotely fixing the issue.

The issue here was client side, and no architectural design, not even hardware system can prevent the "wrong contact receives plaintext message" vulnerability categorically.

The fix is now in place, and I'll eat my shorts if they don't have a unit test in place to detect reintroduction of this issue.
So… forever microplastics?
I'm going to push back a bit on the no powerlifting. Like any other sport or exercise, risk vs reward needs to be looked at, but increasing strength is almost always useful. I would tell everyone to power lift, but also tell them there is zero reason to ever do 1RMs (use 3RM or 5RM and just calculate). And if people are really conservative, then set sane maxes like no more than 2x BW for squat/DL.

I powerlifted for many years, and have only had major injuries from sports - a torn ACL (wakeboarding) and disc herniation (basketball). In both cases, my doctors/PTs said my base strength accelerated my recovery.
I can't imagine that bulking up my foods with teflon powder wouldn't also alter the texture, possibly the taste as well, although simply by diluting with tasteless powder.
You can abstract it, but AssemblyScript did not. So it's not a trivial change, it's a complex migration. Similarly, you can use UTF-8 in Java and C#, but you can't just "switch" them over to the encoding directly, it has to be exposed via new types/etc.
CBRS is very US-specific...

It is indeed an innovative way to give access to spectrum, but it's a pity it has been done in this band (which had a huge potential for usual operators in terms of site reuse).

I suspect in Europe a light licensing approach such as CBRS might be considered in higher bands such as 26 GHz...
You are arguing against a hypothetical situation of your opponent's creation. This is like when Ross tried to beat Chandler at Cups
Our society used to have places for these people, like farmhand jobs, cheap poor houses in the city, etc. Perhaps it is a failure on our part that we have now have nothing better for these people then a desire to push them out of sight. It seems they get a lot of blame for not being able to keep up with an increasingly demanding modern consumerist society.
If anyone knows the answers to this for USA I'd be very curious (at this time I don't see one). People are mentioning possibly using a 5ghz band?

Very weird that the ubuntu article talks about how easy it is to do this and makes no mention of spectrum license concerns.
‘Five years since a white person applied’: the immigrants milking America’s cows
> One of the benefits of coding in the open, and ascribing to opens standards and protocols is transparency and the ability for all to interrogate the code.

They already do all of those things. https://github.com/signalapp/Signal-Android
Ask HN: Composable Capabilities?
In unix, you can compose operations by piping text between various tools.

What would it look like to be able to compose capabilities (as in [1]) in the same manner?

For example, to build a capability that only allowed read-only access to files in /usr/foo/*, and run process bar with it

[edit]
Would "gencap /usr/foo/* c| capreadonly c| crun bar" be reasonable?

Where c| was a capability pipe?

If capability based security is to ever take off, this will have to be one of the building blocks. I'm having trouble even imagining what kind of syntax or tooling would be required.

[1] - https://en.wikipedia.org/wiki/Capability-based_security
> But it would work just as well on positive thoughts

Have you heard of toxic positivity? There’s a growing movement against incessant positivity that has become endemic to a lot of online discourse in particular on Instagram (def not on twitter).

Nothing ever sucks, it’s a challenge! Nobody is sick, they’re a fighter! Nobody is a mean prick, you just need to understand their perspective! Nothing you do is ever stupid, people are just haters!
> Workers don't want to hear about their alienation. They want a raise, dignity, childcare and a stake in the game. They don't want to be surveilled, or fired by an email generated by an NN.

All of those things are encompassed by a single word—alienation. They are all a consequence of a loss of control over your working life.
I am a small l libertarian, have observed politics since the mid 90's it has been interesting to see how how the political parties have changed

Democrats seem to think they Republicans have gone "far right" but from my point of view the both have shifted to the left socially with the democrat party taking a HUGE left turn starting around 2008, but really accelerating in 2016...

Where Socially republicans are more "left" or libertarian on many social issues from Gay marriage to Abortion[1], and economically are more open to "Blue Dog" democrat economic positions but now Democrats are "Democratic socialism or nothing".

[1] I recognize with Abortion there are a few state laws they may go against this statement, but this is a direct reaction to Democrats moving away from "Safe, Legal and Rare" of the 90's to full on celebration of abortion as a primary birth control method and women's empowerment issue.
If you live outside of the US, yes quite a lot. That's what cctld's are for, the weird part you are observing is that nobody in the us seems to want to use their cctld.
At some point this will be like taking out the trash. Lots of money in making sure it's done right.

Companies who can do this correctly and cheaply will be able to charge for this service.
PMI is shutting down cigarette production in all its forms anyway and focusing on using their inhalation expertise in the medical sector + e-cigarettes and IQOS products. Just some context.
I don’t think much will change until the incentives change. Right now there is basically no consequence for doing the wrong thing. Software is unique in that defects are generally tolerated. Minimizing time to market can be everything where often winners take all. Thus an incomplete solution today is worth more than a flawless solution in the future.

I’m not saying it’s good, but it is a predictable consequence of the market incentives.
The ToS have plenty of "gotchas" that allow them to pull the domain out under your feet.

The content policy bans domains that show errors (last bullet point): http://www.freenom.com/en/dottk_contentpolicy_version21.pdf

So if the DB behind your CMS crashes and you don't notice it quickly, bye-bye domain. I believe a variant of this is what happened to one of my domains (just a joke/toy project, and was able to re-register it once I noticed).

The TOS itself http://www.freenom.com/en/doc_tcfree_freenom_v0110.pdf basically says they can do whatever they want (removed some of the redundant legalese):

> you ... agree that if we determine in our sole discretion that
you have violated any of the terms of this Agreement ... we shall have the right, which may be exercised in our sole discretion, to terminate this Agreement ... in such event you will forfeit to us all of your right,
title and interest in and to the domain name ... we may hold, cancel,
sell, transfer or otherwise assign or dispose of such domain name at our sole discretion.
Alexa also lists amazon.ca, google.ca, canada.ca, kijiji.ca, realtor.ca, (ebay.ca), walmart.ca, cbc.ca, bestbuy.ca, airbnb.ca, homedepot.ca, and several *.gc.ca sites.

In my experience, outside the USA many ccTLDs are commonly used – including the "domain hack" ones, in their own country.
And what to do with that teflon after it passes through humans?
A 40 person Eng. Org. is not going to be led by one person with a bunch of direct reports.

IT and Eng. roles will probably be sub divided.

Instead of a VP it might be possible to have just a manager or director, but it depends on the seniority of the people you're bringing in.

The CTO's job is not just downward focus, they have strategic things to to.

A few titles could be mushed around but it's just about right.

For the VP product with only 11 reports - that's a staff position, it doesn't have to imply a lot of headcount.

You might have a Colonel in charge of an entire Regiment of Soldiers, but another Colonel in charge of a much smaller detachment of Medics, or Intel, Communications, or even just a Chief of Staff etc..

Aside from handing out VP roles to possibly people that are too young or inexperienced, the 'tree' itself is just about right.
Nothing prevents someone from posting under an account otherwise used as a submission bot. If you actually look where they're commenting, it's usually only on stories that they submitted.
Yes, logically: If it were becoming harder to spread harmful misinformation, then the need to restrict it would be less; if it's becoming easier, then the need to restrict it becomes more acute.

One would think that's fairly obvious. What did you think; that there would be more of a need to restrict it if it were becoming harder?
If you agree with the treatment of Assange, it's because you're either a literal fascist or because you let fascists tell you what to think. Those are the options.
Amit Singhal's method for maintaining Google's search business unit was its success. Hopefully they realize the ML pipe dream is a failure sooner than later.
https://github.com/dotnet/aspnetcore/blob/8b30d862de6c9146f4...
(Note: I've shortened the title slightly to fit within the HN limit.)
Wow. And sadly many "small government", "pro police" folks are for this until they find themselves on the list. Those that support 'law and order' (authoritarian values, as opposed to 'orderly justice' values) never think they'll be wrongly accused or harassed until it's too late. "First they came for the ..."
Haha, "your social score is too low citizen!

And you should get a haircut."

Sometimes it looks like China and US are converging.

Maybe those in "the program" should be temporarily reeducated like the Uyghurs.

Amazing.
I understand that they base their research on CVE data because it offers normalized quantifiers of severity and scope, but in my experience vendors by and large don't bother with CVE's for API bugs even when the affected primitive is clearly malfunctioning (memory or correctness issues).

I've been deeply fuzzing cryptographic libraries for a few years and found about 130 bugs [1]. The vast majority of these did not receive a CVE. Now some of these are merely theoretical, others will only manifest under particular circumstances like specific calling sequences, others were caught in the development phase before landing in stable releases, but a number of them are outright vulnerabilities. The usefulness of CVE incidence is questionable when it is so strongly influenced by the vendor's propensity for reporting these.

[1] https://github.com/guidovranken/cryptofuzz#bugs-found-by-cry...
I don’t think the methodology is showing anything conclusively. The peak could be due to a linguistic shift or due to a difference in the type of work being published. Even if books use phrases like “I am a” more often I don’t think that necessarily means people have more cognitive distortions and if people have more cognitive distortions that doesn’t necessarily mean they are more depressed (only the inverse has been shown afaik).
Very interesting but I don't know if I'd hire this person: "How did you handle the meltdown situation in your production infrastructure?"

"We did everything that needed to be done, nothing wrong, all taken care of, dropped no ball at all, amazing job, all heroes. If there was anything, it was just other teams".
> I'm being facetious, but why talk that way? You are an individual. If you have an opinion state it.

This phrasing makes clear the policy preference of the polity of San Francisco while also implying that the author does not agree with it.

As you say, the author is an individual and does not need to pretend to agree! This author seems to agree with you. They have expressed their opinion as well as noted that of of the polity.
I don't know for sure if they sell services at a loss, but they give away some glue infrastructure at no cost to the customer. AWS Batch, AWS Lake Formation, EC2 Auto-Scaling, Data Migration Service (free for 6 months, no-limits), AWS CodeStar, AWS BeanStalk as few examples. I believe, in almost all cases (save traffic over transits like cross-account VPCs, load-balancers, internet-gateways, NATs, etc), intra-region transfers are also free.

https://duckduckgo.com/?q=%22There+is+no+additional+charge+f...