skysight-inc/HackerNews huggingface dataset:
Slightly mitigating:

Merchants can request Address Verification (AVS) from the network, but the result is purely advisory: the merchant can ignore a mismatch if they choose. In my experience, most do ignore it.

This is also true of the CVV/CVV2/CSC/etc. Most web vendors require it, but it is not required to complete a transaction. Theoretically the provision of a correct CVV indicates that the consumer has the card in-hand. Chargeback appeals are somewhat more likely to succeed if the transaction included the CVV.
previous (related) discussion: https://news.ycombinator.com/item?id=28210642
How do you plan to handle maintenance, especially maintenance that can be deferred until it suddenly cannot, like foundation/slab issues, sewer line/septic replacement, site drainage problems, roof replacement, etc. The interests of the owners may not be aligned.
It's not illegal where OF was founded, the UK.
>cookie theft

I think that's quite likely. I have a (somewhat throwaway) FB account, not much of a profile and mainly used for a local cause. Co-admining a page I'd clicked on a clickbaity headline posted to the page and several days later my account was disabled.

The account recovery process was completely broken/circular but somehow the account revived itself after a week.

The fact that my 'friend suggestions' were untainted by a friends list seemed to confirm the hack as all my suggestions were from people in an entirely new continent.

Nd ads/CC attached to the account.
As a rule of thumb, yes.

(children vs adults)
I thought it was "let's put it in the backlog".
One area we differ from a timeshare is an Ancana home is an investment in real estate. If the property increases in value, you capture the appreciation and if you decide to sell you make a profit.
https://arieh.substack.com/p/inside-israels-delta-outbreak-p...

> it looks like recovered people — people who had tested positive for the coronavirus in a past PCR test — are massively under-represented. Recovered people are around 9% of Israel’s population, but they’re less than 1% of current cases.

> That has led to speculation that recovery from past Covid is more protective against infection from the Delta Variant than vaccination. Known recovered people in Israel are mostly not vaccinated, though some chose to get a single booster dose ... From data I was passed last week, recovered people were testing at only 0.1% positivity, compared to more than 1% for vaccinated people.

> I wouldn’t be surprised if natural infection turned out to be more protective against variants than spike protein vaccination. It makes sense that the body’s immune system would find more ways to attack the whole pathogen and would recognise different parts of it compared to the changing spike in variants.
>" I don't think I'm breaking any NDAs by saying that that is just entirely not what happens. "

Could you please rephrase this? I don't understand that sentence.
Example of unfalsifiability:

Alice: Trump won Georgia, but the Dominion voting machines flipped it. Look at how many votes came in for Biden late at night.

Bob: It took a long time to finish counting the mail in ballots, and precincts report their results in large batches. Anyway, there was a hand recount of all the paper ballots that were scanned by the machines. If the machines had flipped votes, the paper ballots would still show the originals.

Alice: Then the hand recount was faked.

Bob: But observers from both parties were present for the recount. By this time the machine flip theory was widespread, so the Republican observers would be on high alert to make sure the recount is right.

Alice: Those might not be real Republicans. Like the Secretary of State, they are probably RINOs. Plus the paper ballots themselves were fraudulent. The signatures were faked.

Bob: So do you still think the Dominion machines did something wrong, or did they accurately scan the fraudulent paper ballots? Anyway, the state bureau of investigation did a signature audit in Cobb county and found no intentional fraud and only a couple of mistakes where somebody signed for their partner or something.

Alice: The GBI is in on it. The fraud was really in Fulton county, so that's where they should've done the signature audit. Didn't you see that batch of secret ballots they hid under a table and pulled out when nobody was looking?

Bob: The security camera footage shows that the ballots from under the table are the same ones that were opened from envelopes while the observers were watching. They were just the next batch waiting to be scanned, nothing abnormal about them. The state released the whole footage online, including the parts Trump's lawyers conveniently skipped past.

Alice: I know it was stolen. The details of how they did it might never come out, but I can tell Trump really won.
I hope this isn't a trend where journalists are shoving "truth" down our throats instead of letting their sources make the claims. It's patronizing and off-putting to be told what to think so directly. I want entertainment, not indoctrination.
Given the market, is there anywhere that isn't seeing an exodus?

If you don't like your employer for whatever reason, now is the time to go.
Frame is one off the few creative software endeavors I’ve seen lately that excited and inspired me. It’s very disheartening that the worlds most toxic stains on modern creative technology is going to gobble it up. What a bummer.
Twitter boggles my mind... One large thread of information broken up into tiny pieces that can easily be taken out of context by retweeting or even worse by quote tweeting.
Truly the pinnacle of how we should report/publish information.
Luckily no important institution or politicians use this as their official information channel, am I right?

We don't even have to dive into content aggregation/recommendation algorithms to realize how terrible this is.
I don’t use GV, but presumably if they can make Google send you an auth SMS then they have already input your password. I’m guessing it was leaked in some big password leak, and not phished at an earlier time.
Apple was talking about the chance of accidental false positives.

There is a 1 in 4 billion chance that if I send a message to an IP address, it will be yours. The fact that I can know your IP address and send you a message intentionally does not make the previous statement false.

> As Apple's hash algorithm is entirely broken and useless, a malicious actor can easily craft a NSFW, but otherwise legal image, that has a hash matching one in the CSAM database, that is visually ambiguous in that context (for example, a close-up). Targeted attacks could be launched on unsuspecting victims as simply as sending them an image.

Everybody keeps talking about this scenario as if it is any different whatsoever from sending people actual regular old-fashioned CSAM, which A: already happens, B: requires less effort on the part of the attacker, and C: isn't reliant on the recipient uploading them to iCloud, triggering several layers of filtering and detection, which may or may not result in law enforcement interest depending on your forgery's ability to fool professional investigators at NCMEC who are comparing it alongside the original.

The attack you're describing is less effective and more difficult than existing ones.
Identity politics is a very convenient power framework. Dealing with a nation of billion intelligent individuals is an arduous task. Instead, they could be boxed into 5-6 groups, every group gets assigned viewpoints that its members must adhere to, and suddenly you only need to deal with 5-6 individuals. We call it abstraction and encapsulation in software. The only problem is enforcing the in-group behavior, but it turns out groups can do it themselves: the "crab mentality" makes people pull down anyone who tries to climb out of the box. This arrangement of 5-6 boxes with crabs is very stable, but whether one can downgrade a well established and intelligent society into this state is a big open question.
There was an excellent article [1] in The Atlantic about the Books project. It was really a tragic situation which no one in Congress of either party is interested in fixing.

Full disclosure: I joined Google in 2005 when this was still an active project, and in fact walked around GWC-3 and saw the Yellow Badge people (great symbolism there) taking their breaks. These were contractors who actually scanned the books for Burger King-level wages, and whose badges wouldn't even let them into the micro-kitchens.

Anyhow, I don't know if the University of Michigan (early volunteer) was supposed to get the scans. Supposedly, the whole world would. That didn't happen and you can read [1] for details.

As of 2015, at least, not even a Google employee could get at them. I was told I could go to someone's desk and read the book on their computer if I really wanted to see it (this was for patent research).

[1] https://www.theatlantic.com/technology/archive/2017/04/the-t...
Why are Americans allergic to aerial cable runs? Fiber and Ethernet are low/no voltage and don't need to be buried to comply with the electrical code.
I agree that the balloon example makes the result believable but the leap from there to “obvious” is enormous.
The whole discussion at the end of part 2 feels so strage to me.

>using the standard RE, it's impossible to match only DD-MM-YYYY or DDMMYYYY strings without matching DD-MMYYYY or DDMM-YYYY, because it's impossible to represent this in DFA form.

And then there is the reader comment that finds a DFA for this particular problem but then wonders about another:

> now whether one could also accept YYYY-MM-DD/YYYYMMDD format with
the same regexps, it might require some sort of deeper magic and
back-tracking

Regular languages are closed under union and there is even a straightforward translation to regular expressions (the | operator).
Am I really missing something here? It has been a long time since I took a compiler course, but I would be damned.
> In the end it worked out for Apple but not for Vector.

Did it? It very nearly did not.

Unlike Vector, Steve Jobs always had a focus on something very special in mind: the very best design, of course (perhaps similar to the Vector CEO), but, more importantly, technical things that would re-define the industry, like windowed OS's and mice.

And, even that relentless focus on having the best user experience was not enough to save Apple! The only thing that did save Apple was bringing Steve Jobs back, who immediately did the only thing he could. In a stroke of sheer genius (and/or luck), he wrangled a huge investment out of... Bill Gates, who was probably the name most associated with PC compatibles!

The Vector story has none of these attributes, except for the nearly (or completely) going out of business part.
Lying to your family and not telling them that you came into a ton of money would be the thing that could piss them off the most. It would seem like either you are being selfish and want it all to yourself or they will think that you think they are money grubbing moochers.

Also, yea, I could see not sharing some of that wealth with your family could come off as bad as well.

It's not about paying them off. If you love someone, you want to help them and make them happy. Not doing so seems selfish and the opposite of that.
End-to-end encryption only means something if you and whoever you intend to communicate with control the endpoints. With an iOS device, you don't: Apple controls the endpoint. You may have paid for the device, but Apple has exclusive control of the software. You don't have the ability to replace it with third-party software or even to audit the source code for the software Apple supplies and verify that it matches the binaries. Consequently, you have to assume that anything you put on the device has already been shared with Apple, simply because Apple's software has access to it. This move just makes their control over the operation of "your" device more explicit.

The best for privacy would be E2EE where the backup software never even has access to the unencrypted data. In other words, the backup image(s) are created locally by auditable open-source (or at least source-available) software, encrypted and signed using a key or password known only to the device owner, and provided to the backup service as opaque blob(s). The backup service never has access to the raw data and is incapable of accessing or tampering with the content of the backup. Untrusted services would be restricted to have access to either plaintext data or the network—never both. Any network application wanting access to local photos, e.g. for sharing, would need to go through a privileged photo-choosing interface and would only be granted access to the selected photo(s). Even this has some concerns since the local photo software could embed information into unrelated photos to exfiltrate data to the network when those photos are shared, but you could at least compartmentalize the data to limit the potential for cross-contamination.

Or, you know, just use a fully open device and open source software in the first place so you're not playing silly adversarial games with a device you rely on for everything.
FFmpeg for browser and Node, powered by WebAssembly
> Finally, if you have senior anywhere in your title or job description: an implicit part of your job is to make the people around you more effective. Diving into – and fixing – tools should be a meaningful use of your time.

This, 100x. The internal tools function is often forgotten by other teams when dealing with things like ongoing education, professional development, code quality initiatives and even hiring practices. (Ironically, because a lot of those things end up leveraging tools that the tools teams own!) The tools team should be a rotation or an area for open contribution, not a permanent destination or specialty.

> There are downsides, of course. Toolsmiths are at least one step removed from the actual work that's going on – it can be hard to explain what we built to anyone without context (or violating NDAs). Depending on how enlightened your management is, your team might also be severely underfunded for what it needs to accomplish, mainly because the effect of good tools isn't generally easy to measure.

The other downside to tool building is that when you build something, you're competing against "there's no tool for this that fits our need", but when you're maintaining and evangelizing the tool your competition is often "open source software on the internet", which can outdevelop you by sheer weight. So you should always bias heavily for buy/download over build, and you should always minimize how much you fork and customize those tools let you get left behind by the broader community.
I have no criticisms of Nolo, but "the truly wealthy" hire lawyers. Those professionals are skilled at determining whether to set up partnerships, C-corps, LLCs, whatever. Besides we're talking about anonymity for anonymity's sake (well, also tax minimization and probably lots of other rich people priorities we peons can't imagine), not for dodging creditors. If the principal is poor enough to need to dodge creditors, probably the whole house of paper collapses.

(Probably also the lawyers are the first to know, so they'll get paid up front and be long gone at the time of collapse.)
Not the argument of the article but I'm tired of this meme about automation and speed of execution ("worked one week to automate this task that takes two seconds").

Automation is not about completing tasks faster, it's about correctness, predictability, consistency, reproducibility, developer workflow, processes as code, code reviews, audit trails, knowledge sharing etc.

It's about being paged for an issue in production and not having to wonder if John entered a typo in his laptop and deployed by mistake in the wrong environment.
> I’ve gone from a position of caution about Oculus + Facebook to a position of “Run, don’t look back.”

As if this wasn't an obvious problem.

Relying on any of Facebook, Twitter, Instagram, TikTok, etc. for anything is a risk. Doubly so if it involves your business or a product that won't work without permission from $PLATFORM.
Gen Z trends, first time founders & fresh business ideas
What does the US have coming for their treatment of Native Americans then?
Turns Out the Hardest Part of Making a Game Is Everything
So basically, on message boards, the notion of a "Thought-Terminating Cliché" is deployed the same way "Logical Fallacies" are, to appeal to the celestial referees for a TKO in an argument. And in that sense, "Thought-Terminating Cliché" is itself a "Thought-Terminating Cliché", disappearing down its own throat uroborotically†. Neat!

† A term that now exists.
So glad to see this happening. Screen scraping is unsecure and imo a per account APIkey based solution with a read-only access is the way ahead.
You invoke "you people" and then draw an unfounded and non-sequitur conclusion about your interlocutor's motivation while asking them to think with a logical framework???
New contract changes are unenforceable without compensation in most cases. If you're getting a new NDA or somesuch rolled out it's why it usually comes with "Free 10$ starbucks gift cards for everyone surprise!" but a lot of the time any contract you sign that does nothing to benefit you is illegal - you can also refuse to sign new contracts and, depending on the company, they might just shrug and carry on with the old contract.
If I send Bitcoin to someone in China, and they happen to send Bitcoin to someone in Iran, who broke the law?

I am NOT talking about me intending to send Bitcoin to people in Iran when I pay someone in China. Just because someone makes something available to people in China, doesn't mean they are responsible for what other people in China will do later. So, if someone ORIGINALLY uploads a public domain file on BitTorrent, for instance, and sometime later, that file winds up being downloaded (via Chinese nodes) by Iranians or North Koreans, does that mean the original uploader broke ANY law?
How many of those were infected and recovered in the last 18 months?
ok, Marxist.
Ask HN: Did Acorns Get Hacked?
Reading lots of twitter posts about an email that went out to everyone, anyone know whats going on?
Tempting, but I personally worry about a glut of talent. Truth be told though, I would probably have anxieties no matter what the market looks like.
That's the reasoning used to vilify unvaccinated people, which is my point. Cheers
The most important message of CICO is not "count your calories". It's "you're fat because you eat too much." Matter isn't materializing out of the aether and putting itself into your ass, it comes from you eating too much food. Fat people are fat because there is an imbalance in how much they eat and how active they are. And in modern American society, the vast majority of it is from a culture of binge eating. This is what I've observed not only in myself, but in every other fat person I've met.

There are all kinds of coping mechanisms people use to excuse themselves and stay fat. "I don't eat more than normal, I'm just a genetic anomaly who absorbs more nutrients from food than everybody else.." Well assuming that wasn't BS, the answer is still to eat less. Or "CICO is just a thought terminating cliche"; if I had fallen for that BS, I'd still be fat. I'm glad I saw through those lies.
How long do you think we'll be keeping up the mask wearing given that "more variants are inevitably coming?"
Fantastic animation, thanks for sharing.
Why should already-immune, recovered people be vaccinated?
The recommendation is to have at least one backup key.

There's also a WebAuthn extension in the works to at least make it easier to maintain a backup key by not having to pull it out of the safe every time you register MFA with a new service:

https://www.yubico.com/blog/yubico-proposes-webauthn-protoco...
W^X is a good mitigation to prevent attackers from just spraying shellcode into a RWX heap. This is how most JIT engines used to be attacked, and many exploits continue to include WebAssembly just because Chrome will create a RWX arena for this. Many of the OpenBSD mitigations are actually a good idea, but some are fanciful junk. The posture that the team has towards pushing those latter ones is what generally makes people unhappy.

Also, do note that Apple silicon puts everything behind a DART (essentially an IOMMU). This is noted in the article:

> Device isolation was another M1-only feature, that uses the more powerful IOMMU of that platform to make sure hardware devices can only share memory with the operating system and not with each other. Cross-device memory sharing is a historical custom, based on a blind, unfounded trust in hardware.
This is roughly my theory on long-covid too.

The social isolation, stress, lack of sun and exercise, bad diets, and other side effects of the hypochondriac society we now live in are largely responsible for what is called long-covid.

I think lung damage found in some cases is likely fairly typical post-covid, but my theory is that this is common after any harsh illness involving the respiratory system whether it’s cold/flu/covid, we just weren’t looking for it nearly as often before.
Funny how I never thought about chemical additives being added to cat food. Explains perfectly why when I fed a cat home made chicken gravy it turned its nose up at it and waited for the gravy to be poured from the cat food packet
Apparently the "P" in your middle name stands for "non-standard Pedigree"?
Not sure which spreadsheet you're talking about, the page I linked to has a series of feeds, and if you download today's CSV and sum all 4 case count columns it adds up to 650. 426 is the unvaccinated count. 650 is the count of all cases.

Date covid19_cases_unvac covid19_cases_partial_vac covid19_cases_full_vac covid19_cases_vac_unknown
2021-08-20 426 64 103 57

BTW, it's not "my page"; it's the official gov't of Ontario COVID data API. It's where the other link you pasted gets its data. There's another feed that provides just testing numbers, but doesn't break down by vaccination status. It also reports yesterday as 650. So the two accord.

But please, go on. "Your biggest problem" is that you don't read. Just like the 90% in Israel stuff.
Most adult Americans do have a medical condition, being overweight, which is the point.

Also, any idiot knows what a single medical or social study is worth - they get overturned daily.
If you have consumer gear with connectors you can add some high gain antennas and get decent distance PTP - you could do this with the old favorite WRT54G

Main thing is mount them high up and you need some protective enclosures.
Agreed. Many "obvious" things are only obvious in hindsight.
It always is! (in a good and bad way)
> One of many reasons I pay Google to host my email rather than use a free Gmail - when you are generating a non-negligible revenue stream suddenly companies' willingness to answer emails and pick up phones increases.

If you think that does any difference, I hope you good luck. Google is unreachable for support, even if you are a paying user.