skysight-inc/HackerNews huggingface dataset:
> Don't want to end up with every C/C++ compiler being a clang skin in the same way as (almost) every browser is a chrome skin.

Why not ?

There is one open C++ spec, that's really hard to implement, so we have a dozen C++ compilers that are impossible to support properly because they each have their own set of different ten thousand bugs.

The value of supporting all of this is really small in practice, and the cost for everybody involved is huge.

Having a single, e.g., C++ parser with a single set of bugs is a much better value proposition for C++ programmers.
I have https://lbjfacts.com, which is a site full of.. definitely real facts about Lyndon B Johnson.

I was just really bored one day, and it started as an inside joke that just kind of kept going.
No, that would require mountains around it.
Fishdraw: Procedurally Generated Fish Drawings
If we were in a group, you would have noticed (or perhaps failed to notice) most people recoiling to your statement or giving you quizzical looks at your odd reaction to a valid point. The conversation would immediately shift away from the poor direction you took it, and towards something the group finds richer for discussion.

Here on the internet, we settle for letting you watch downvotes trickle in over time.
> Competition is good.

On the other hand, collaboration is also good. Why waste time reinventing the wheel?
That is the stupidest thing I heard in a while lol
There's a serious fundamental problem with DeFi that can't be solved with blockchains.

Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this.

One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a) patch the vulnerability, which will get him a pat on the back, or (b) convince himself he didn't notice anything, quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars.

Most people would choose (a)! And law enforcement is a thing! But a lot of people will choose (b), and if they do a merely decent job they will get away with it, and 600 million dollars is stolen®.

Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting.
This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.
Even without switching countries, without a VPN every app on your phone knows when you leave home (switch from residential IP in city x to mobile IP in city x), arrive at work (switch from mobile IP in city x to business connection IP in city x), or take a flight (switch from mobile IP in city x to mobile IP in city y), or drive far, or check in to a hotel, et c et c et c.

VPNs are essential for people who need to obscure their travel patterns from data brokers, for privacy or physical security reasons.

Blocking them is like making an app that doesn't work at all with location services disabled: it's a privacy-invasive dick move.
Are you talking about modifying elections as a result of COVID-19? Most states in the union did, including Texas and Florida.

https://ballotpedia.org/Changes_to_election_dates,_procedure...
> PDF.js viewer now included in Thunderbird

Doesn't this unnecessarily increase the attack surface?
Or "how we managed to re-use inline style for html elements AND add javascript overhead on top of it instead of letting the browser do it's stuff".

Bonus: MDN about inline css:

> Tip: An inline style loses many of the advantages of a style sheet (by mixing content with presentation). Use this method sparingly.
Yes i agree and i don't think there is actually a problem with that. We are humans and we should be able to solve problems like this. I try to view it just as another way of bug fixing technique. Sometimes you can just explain that you messed up and others will understand
Just a very bad move.
> I assume Apple could make it very difficult, if not impossible, to detect what they're searching for when they are using hashes created and transmitted by all their own hardware and software.

Correct, it would be easy to slip in additional hashes without the team knowing what those hashes represented.

HOWEVER, as soon as these additional hashes match something, the first person to see them will be an Apple employee performing manual review. When they see a picture of Winnie The Pooh or a photograph of some classified spy plane, they're going know that the CSAM system is being used for purposes other than CSAM.
also *via self reported education level on Facebook...

Veracity of this poll is highly suspicious.
Was looking to do the same. What software do you use to replace things like dropbox/photos etc?
You already have a company laptop, computer accessories can be bought through the company. So it’s mostly for desk and chairs.
A bit unclear from the abstract whether the keys they learned how to derive (and the secret material they're derived from) are per individual chip or for all chips ever produced. If it's the former, that means the rogue admin still needs to electrically mess with the hardware once.
Now try this: https://news.ycombinator.com/front.
Because he has done very interesting software engineering which is used in the real world to solve real problems.
Strike a "we", replace by "rich elites".

I don't agree. My 'poor' leftie friends are all about tearing shit down, while most 'rich' people I know are pretty happy with the way things are, wanting only to make small tweaks here and there.
The main points are 2 years old, with newer edits: https://github.com/OWASP/CheatSheetSeries/blame/master/cheat...

Catch-log-new error-rethrow or catch-annotate-rethrow is (unfortunately) an important part of using Promises that isn't widely taught. I've also seen some Promise replacements with better debugging (often call site carry through, so more like a stack trace) - though I like to keep it vanilla.
It's probably solvable but do people want to solve it? The republicans are clearly against more welfare but also against almost any other policy that would reduce poverty. I'm sure there are also plenty of democrats that do some symbolic action to show their willingness to lessen poverty but never do anything with lasting impact.
ADC Range of STM32L475VG
I am working on an assembly board that will integrate the STM32L475VG Kit and a couple of current sensors and a voltage sensor.

I don't know much about STM32 and to be able to have the readings of the current sensors and the voltage sensor directly to the ADC, I have to know the range of voltage feasible.

Can someone help me know the range? Also, if the sensor's output voltage is out of that range, is the only way out to make a voltage divider circuit?
True, but transistors are designed by humans (for now), so you have an upper bound on complexity as well as a certain degree of modularity. Whereas biology has no such limitations because evolution doesn't care about the understandability of its designs.

So I tend to err on the side of biology being more complex than not.

But it's absolutely possible that the high-level behaviour is simple while the underlying implementation is complex and chaotic, as in the gas laws.
I assume it also used by every browser.
Judges can write lots of orders but that doesn't make them search warrants which are defined by the US constitution as requiring probable cause. FISA court orders are not search warrants.

FISA Amendments Act (FAA) section 702 is the legal basis claimed by the NSA in a secret interpretation by the FISA court as the basis for PRISM targeted collection without search warrants, including US persons/citizens.

It's on Wikipedia if you don't believe me:

https://en.m.wikipedia.org/wiki/Foreign_Intelligence_Surveil...
1990’s CGI. All over again.

Never trust user input.
*laughs in Minix land
<div x-style="max-w:80; mx:auto; radius:md; e:2; e.hover:4; transition:all 0.25s; cursor:pointer">

< insert the office gif here >
No! God! Please! No!

-------

Even worse this runs on the client and is transformed from js back to css.

How is this even helpful?
Why not use inline style directly then?
What do I miss?
This kind of corporate "we need to be seen to be doing something rather than nothing" stuff does wind me up, it just makes people more annoyed (by breaking scripts and causing unnecessary UI changes etc) and less receptive to actual arguments for social change while at the same time producing no practical increase in social justice. It's just inauthentic tokenism designed to keep the baying beast that is Twitter away.

"Show, don't tell" is as good advice for PR as it is for storytelling in my opinion. I don't want you to tell me how great you are at tackling the issues of the day with token changes like this, I want you to show me by actually doing things that demonstrate you believe in the stuff that's coming out of your mouth rather than just trying to appear like a "good person". Changing "master" to "main" or "primary" is as authentic as Facebook or Google saying they care about privacy.
Anghami Lab Venue to Bridge Digital and Traditional Entertainment
Reading the docs, the talk of "other CSS frameworks" seems to be primarily aimed at Tailwind; but fails to discuss the trade-offs.

The key design difference seems to be to use a runtime script and data/x attributes to allow customisation and perform style pruning, rather than using config files and build scripts. There are clear downsides to this (as well as upsides, such as faster ramp-up time), but they're not really being presented honestly.

From my perspective, it's hard to imagine someone adopting this as core tech for _websites_, because requiring a blocking script before any styles can load is an absolute deal-breaker for me. But perhaps people will find some utility from it for prototypes, and in environments (perhaps electron apps) which are less sensitive to blocking scripts.
Hetzner is cool unless you are in the US. Latency sucks across the Atlantic.
I don't see as very different from a wallhack if it's any good if it's an in game overlay. I suppose if it's an offline thing that you can study but need to apply yourself that's no more of a cheat than any other prep.
> I'm pretty sure a company like Google that has no problem killing unsuccessful products after multi-billion dollar investments, knows how not to fall for the sunken cost fallacy.

You're making the assumption that people behave rationally.

In actuality, rationality takes effort and as such, is rarely used.

We are irrational beings who are capable of rational thought, that doesn't mean that we always do.

Additionally, as you go up the hierarchy, people disagree with you less and less, which means that you start thinking that your ideas are better than they are.

Like, I fundamentally believe that pushing employees back to the office is not going to work out well for many companies, but they'll do it for emotional reasons rather than rational.

(And I say this as someone who misses the office).
From the front page:

> We've decided to develop Assembler CSS as a reaction to the current state of the ecosystem, not just as a solution to our company's needs.

I cannot comment on the company’s internal needs but, to be honest, I would consider the need to reinvent the wheel with custom attributes for styling to be one of the problems with today’s JavaScript ecosystem. And having a styling framework that only works with JavaScript turned on seems like a bad idea, even for single page applications.
You forgot /s.
A lot of new features. Does anybody know why there is such a surge in development? Did any big company adopt Thunderbird?
I am also not sure, but in compiler design semantic analysis includes checking to see variables match their types, and obviously lisp macros are partially so powerful because their is no type checking.

For me this was the biggest challenge when I was introduced to lisp: everything is just a list. Powerful, yes, but in other languages the ground felt firmer underneath my feet when I knew a class was a class, a struct was a struct, and array was an array, all with their own unique syntax. In lisp everything just looks the exact same. That is part of why it is so powerful, but at the cost of semantical references that can help users understand a lisp program.
I recall instances where they fought slavery by capturing slave trading ships, freeing the enslaved, and given them freedom and the opportunity to join them and fight the assholes that captured them in the first place. The history of Nassau is pretty interesting.
Yeah people think it's like some kind of psychological illness like bipolar disorder just because it has "syndrome" in the name. It's not a syndrome. When you're feeling nervous at a job interview do you have "interview syndrome"? No. That is dumb. This is all dumb.
My understanding (but I'm not an ICC user) is the majority of the performance improvement are from the vectorized math libraries (that technically you can use from GCC as well).
Of this 1 individual application, yes. But it's a tradeoff against the user's attack surface of using multiple apps.

PDF.js is run in a secure sandbox so has no direct filesystem/OS access, and is very actively maintained (e.g. for Firefox), so it's not unreasonable that it may leave you much less exposed than launching an external app would.
> I think the truth is that we don't feel like we need a release.

Maybe issue a point release where the only change is updating the documentation (man page, output of --version, ...) to state that it is 2021 and you are still here, stable, free of security issues, but not adding/updating features ATM. Then the project doesn't look dead (which can be a security concern) when it is in fact just quietly carrying on with achieving its goals without the need for changes.
This gets more and more baffling. Everyday another totally useless framework gets released – and they never tell you what usecase this shit has. Seriously, what problem is solved by this?

What is wrong by just writing VanillaCSS? This is becoming ridiculous.
It doesn't. I wish they would have called it Super Password, which I just thought up and makes more sense while hopefully not offending anyone.
A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.
Why you wouldn't demand all voting software in use be openly auditable I don't know.

While I'm sceptical of claims that there was widespread fraud, the fact that there's so much pushback against just counting and verifying the integrity of the ballots is pretty insane. There's zero stakes if everything was fair, and even if it wasn't there's no legal mechanism to remove Biden from office.
Not just that, random folks can send you media through multiple ways & you could get embroiled unnecessarily too, innocuous QR code might automatically download an image if your apps are configured that way.
Does Thunderbird share code with Firefox?
So this one time I was tasked to verify a complaint of child pornography and image the infrastructure for evidentiary purposes, if necessary. It was the first time I’d ever been exposed to it as a naïve operations kid at a hosting provider.

Imagine my surprise and horror to find that not only was the complaint accurate, it led to a completely polished thumbnail site on par with PornHub. Boom, right there, no login. No nothing. Five high, seven wide thumbnails. No two of the same child. A complete search engine based on Solr that could filter the thousands of images by age of the victim. By the number of adults participating in the rape. A threaded comment section on each image where people discussed children in their neighborhood and their fantasies of abducting them. An erotic literature section where parents wrote about how they’ve been sexually attracted to their children since changing their first diaper.

I’ll never forget a photo of two men brutally raping a girl of about 9 or 10, because it was one of the highest voted on the site. One of the comments, which I still remember when I close my eyes at night, simply said “its better when they cry”. It’s been eleven years and I’ve seen and dealt with much more of it since then, and I still weep to this day thinking about the pain inflicted on those children, the pure evil of those who enjoy it, and even the design and engineering team who bafflingly put their skills toward building that nadir of human achievement.

Tell me again what “the real abuse” is and educate me, please, because you sound pretty confident that the frighteningly common story I just told isn’t that big of a deal. I can’t believe anyone sane would compare going through your photo collection, even egregiously, to the rape and exploitation of children and think, yeah, you know, based on my value system door number one is the “much worse” injustice. Your opinion is fucking sickening and the exact type of detached inhumanity that is poisoning this industry top to bottom.
“You can’t really write software without bugs” - which is why crypto will never be for me
That's why you're supposed to be a contractor at that pay level.
I own https://56k-modem.online
I think it's pretty cool.
both part, that I have access to my political representation (which is a very American thing, not so much around here) and that a single government has nowaday the agency to impose tariffs irregardless of what wto, eutc and whatnots allows
I think this rings home. I work as a software engineer in Western Europe: programming is my hobby I and love it, but I only show "passion" on personal projects. I do my 9-5 at my work because it just doesn't make much sense to me to give all my "intellect" to my employer.
I concur, but at the same time have a counterpoint. It always trips me how I can user Perl regex for powerful searching in grep, but then these are somehow not available in sed. The Extended syntax it has is not the same, still too verbose in comparison
Why are you saying that? There's a Linux version. Although I'ld expect a Linux user to be using their package manager instead anyway. But maybe Thunderbird should eventually release a Flatpak or Snap or AppImage which are cross-distro.

https://www.thunderbird.net/en-US/thunderbird/all/
I think modern Tailwind supports runtime generation.
I bet that we will see insurance companies emerge in the market. Contracts will send a portion of the transaction to an insurance company. The insurance company would mandate "layers" to validate the contract. Users can then claim damages if there was a bug in the contract.

Once all this is done, the transaction fees will be equal or higher than traditional banking systems :-p
> I get it, there's no money to be made in just implementing all your optimizations in clang directly.

ICC Classic is legacy/dead and also free now. The LLVM-based DPC++ compilers are free as well. These are only making money indirectly and through support contracts.
The rates in Poland have really risen as of recent (so has the inflation, but that's a different story).

There's a lot of offers in the 120-150 PLN/h (26-33 EUR or 31-38 USD) range; not long ago I had three offers from the top of this range to choose from, and I eventually stayed at my current place since they equalled this rate.

And yes this is wage per hour, because self-employment/B2B is highly popular in IT, for financial and fiscal reasons. After all the deductions, you'd pocket roughly 70% of it.

Once you factor the living cost in: eg. "you would need around 2,827.20€ in Warsaw to maintain the same standard of life that you can have with 5,670.18€ in London (assuming you rent in both cities)" (according to Numbeo), it becomes pretty clear how living and working in Poland can be an attractive deal.
“Find a hash matching these digits” is roughly Bitcoin’s proof of work system. Maybe another way of looking at this is that these weren’t hackers, they were just miners who found a more lucrative coin to mine.
When you add escape from Tarkov auditory radar let me know. You should be able to use software to tell me where the enemies are and what direct they are roughly as well as what weapons they’re shooting. Been looking for a good passive cheat for that game that doesn’t require DMA. I love that YC is getting into ‘passive’ game cheats. This has huge potential people pay good money for cheats.

I learned programming reverse engineering last kingdom, Everquest and others.
It's a neat solution, indeed. But is that actually viable and useful?
Not sure.
First, you need to open firewalls to UDP port ranges.
Second, you still need SSH to be in place and reachable.
Third, as soon as you kick off mosh you loose all bells and whistles by SSH (like TCP forwarders, SOCKS proxies etc.).

So my idea is: nice for amateur small infrastructures, pretty useless for real world (cloud) infras. Maybe you can make mosh-reachable a bastion or two, but no more than that.

Nonetheless, i stress, it's a neat idea.
> a PR with a long discussion https://github.com/mobile-shell/mosh/pull/696 on why it's not merged

I'm confused. I read the whole thing but couldn't find the specific reason for why it's not been merged. But I assume it's because of the things that were pointed out in the code review comments?

Also, the issue you linked is about SSH Agent forwarding, not port forwarding.
But if I invest in an Xbox then that’s capex, so I’d only be claiming the depreciation. Better than nothing though ;-). How do I do depreciation on a beer I’m investing in?

Also first time I’ve heard hoi polloi since Thatcher era.
Thanks.

This can be entirely explained if the NSA had already performed a "solar winds" supply chain attack on the vendor that supplied the TLS encrypt / decrypt endpoints. Is the vendor of that hardware known or discoverable?

Google would have no idea the traffic could be intercepted. The NSA could use the Smiley face, perhaps with a nudge, nudge, wink, they are now a "supplier of data" on slides.
For many years, anti-virus vendors were able to do that. Why haven't those vendors been already co-opted by governments (Kaspersky on the Russian side, Microsoft in the USA side) into scanning for illegal, copyrighted or secret material and reporting on it?

Even open source products like ClamAV rely on a opaque database of virus strings.
Up to 256.
As someone who has been part of the a11y community for a while now, the short answer is: yes, in general, both the awareness and the technical knowledge are quite bad among developers. Other hiring tech leads share this opinion, e.g. [1]

[1] https://twitter.com/KittyGiraudel/status/1414556623176179715
> Dumb question but would an S3 bucket be scanned by CSAM?

Maybe, but if you E2EE it can't detect anything, anyway. (Please don't take this as an endorsement of child porn)
NextCloud has preliminary E2EE support built in, but not for photos - yet.
Of course its not; no more than the 2008 financial crisis was entirely opt in. Individuals do not have the opportunity to fully control all aspects of the financial system they're exposed to.
Yeah, I used in my last job (commercial CFD code), and it was widely used by others in our sector. It's nice if you need to support Windows/Linux as well as brings for e.g. MPI, etc. and compiling scietnfic libs like FFTW on Windows is a PITA, so using MKL which comes bundled with it is very easy.