skysight-inc/HackerNews huggingface dataset:
I remember some (pirated) Windows XP versions that were minimized as well - with some being under 300 MB.
That's great for you, but it gives you no excuse to make other people uncomfortable just because you don't think a joke is too far. And no, saying "it's just a joke" isn't an apology.
Yes, but you do want deliberate access to specific services on the local network. Mainly NFS exports and the like.
كلمات اغنية اوف يمه مصطفى الربيعي
Factory OS is pretty interesting because it can run any Win32 app (outside of a hypervisor) via a container, something you couldn’t do with WinPE as often there were too many libraries missing to get something like Chrome running.

I wonder if they’ll ever use it to replace WinPE. They’ve had the same installer since Vista, and it probably needs a redo (it still takes forever to install Windows).
Online shopping for Boho Style Products with fast shipping
Xmake adds Vala, Metal support and lockfiles
I might further distinguish between sarcasm towards others versus sarcasm towards oneself. Most of my sarcasm is self-effacing, and I think that's generally okay with adults. (Less-so children.)
https://www.dictionary.com/browse/whataboutism
Does it? I don't think having everyone learn a functional language to write code the manage their dependencies is interoperable with everyone...

That doesn't mean it's bad, it just means that it's not going to universally cover everyone's use cases.
I don't hate it, I've said it was a hoax since the first presentation (which was… drum roll… about rolling their own crypto — soon found to be accidentally or intentionally broken). You had to be mad to believe that literal Russian Zuckerberg, who had been known for behind-the-scenes compliance while keeping the facade of uncompromising struggle for freedom, was caring about you and your privacy.

I doubt that anyone can have any trust in “secure” and “private” communication service that got banned in Iran only to be unbanned 3 days later. They were not so soft on other big names they banned. The outcome? Telegram is the most popular messaging app in Iran, and no one is searching for anything better. Perfect place to oversee the public.
The Germanic Thursday is “Thor’s day”, I guess Jupiter is more like Thor than Odin/Woden.
Unrelated hint to the author of this page:

Please enable Https for your Webserver.
Gaaah, brain fart - you're right, of course, dunno why I included it.
Gotta love those domains that can be read two ways.
It's awkward to LARP that it is all at your whim - because at some point someone will ask too much in a vacation request and you do suddenly need to explain the factors very not much in your control (before proceeding to then rip up their request, of course ;))
Great advice. But I’m not gonna tell my 7 year old he’ll have a career in Minecraft or Roblox in the future!
I truly believe that A/UX doesn't get the credit it deserves. Was it ambitious? Sure. Did it it fully succeed in the goals it set for itself? Not really. But it was really a very nice integration of the Finder and UNIX. After all these years, I still look back on it with fondness. It certainly was a cornerstone platform for me.
In my experience the issue arises not because managers are treating the position as a privilege. Rather the opposite. A regular person one day becomes a manager. They feel the same today as the day before. They feel the new power is fake, or theoretical. It becomes easy to joke about this power. In their head the joke is funny because of irony. "How could I have power? I'm just a regular person."

A further issue is the mismatch in weight given to their words over their intention. Even I hit this, once my employee told me he gave strong weight to a point I had casually mentioned. For once in my life someone remembered what I said better than me. It was a bit worrying, as my exact comment had been meant to be a minor point.

Thankfully I knew prior to "getting power" to, as I word it, "never make jokes which imply a power structure". As the listener can never truly know if the joke was speaking to an unsaid idea.
uh huh....heard that one before bro
> Nothing, probably. In a sane country and legal system doing things like that would be illegal.

It should, but it isn't always the case. Not only that, but even if it is technically illegal, it still might be done because of a lack of people who'll take the guilty parties to court over it. So, in reality, you cannot avoid viewing that as a well founded risk.

> But on the other hand forcing HTTPS means that some users will never be able access it due to old browsers and/or hardware.

In a similar argument about what "should" happen - Google shouldn't just abandon numerous Android devices out there, nor should any other vendor. There should be mechanisms in place to ensure that these devices continue to function for the decades to come.

But since that's not the case, it's inevitable that you'll cut off a small portion of your potential userbase, same as with many sites simply not functioning because the developers made the choice to require JS. Of course, that is your choice, unless other concerns (like security) force your hand.

> More likely though is that I mess up the HTTPS certificates, either by mistake or inaction, and lock out everyone who doesn't dare click the correct sequence of "ignore warning" buttons. I've already managed to block access for normal users to several sites, several times, by running too old certbot versions, not integrating things properly and whatnot. It's a good thing I'll never use HSTS and HPKP, or I'll make permanent messes.

I run a couple of sites through a .dev domain and i do agree with what you're saying, since locking yourself out sooner or later is inevitable, but in my eyes i'd treat it like any other problem out there, much like messing up exposing the correct firewall ports - fix the problem, set up monitoring to be alerted of any problems in the future and move on.

That's why having development/test/staging environments is really useful and in case you fear rate limits, Let's Encrypt also has a staging environment that you can use before switching over to prod: https://letsencrypt.org/docs/staging-environment/

Not only that, but there are a few web servers here and there that attempt to improve the situation with ensuring SSL/TLS, like Traefik. Personally, however, i've found Caddy to be the most painless, since with it i don't need to mess around with integrating certbot with Apache/Nginx, but instead can just use it, since it works out of the box for the most part: https://caddyserver.com/

Apart from that, you can always just expose a version without HTTPS on the server's ports locally, so that you can set up a tunnel through SSH and access it from your device in emergency situations (or just use a self signed certificate for the "private" version).
pizza is very suitable for the builder pattern:
CreatePizza()
.WithBacon()
.With(artichoke)
.Build();

or any combination of the above:
CreatePizza()
.WithMussroom()
.Build()

Even better, you can add new ingredients without changing any of the existing signatures:
CreatePizza()
.WithProsciuto()
.WithTomatoSauce()
.Build()
> With your comment you are actually insulting people

It's not a personal insult to say a paper that someone produced was of poor quality (I don't know whether or not it was, I have not read it). Someone can produce something bad without it saying anything about their character.
A previous employer did this, I think. It worked well from my perspective as a user but I don't know how difficult it was to manage.
> The more desirable sounding Modern seems to be unachievable for any real world site. I'd love to see counterexamples if I'm wrong.

I'd agree that the description of "M" in https://wiki.mozilla.org/Security/Server_Side_TLS#Recommende... is unrealistic for a site with a large and diverse audience, so far. The primary issue is that it requires turning off TLSv1.2.

Wikipedia is a good example of "about as Modern as you can get in the real world with a big global audience". It's a little stricter than "Intermediate", but doesn't quite meet the "Modern" description. The key items there are that Wikipedia still supports TLSv1.2 (but only with TLSv1.3-like ciphers) and it still supports dual cert compatibility (ECDSA+RSA). The RSA support is likely to be on chopping block Soon, as the only real use-case for RSA in this config is to support ancient installs of the last-known-good version of Chrome (49) on WinXP SP3, but Wikipedia will likely have to continue supporting TLSv1.2 for quite some time.

In any case, though, Wikipedia still gets an "M" rating in the check, so either the description is wrong or the check is buggy:

https://observatory.mozilla.org/analyze/en.wikipedia.org#tls
You should tell your old school friend that their voicemail is full. At least with my carrier, I can only have like ~20 voicemails sitting around. I listen to every voicemail I get but my voicemail inbox filled up and I didn't realize it was full for years (there was no notification or anything). To make space I had to actively go delete voicemails. Of course, deleting them just sent them to a "deleted" folder, which I had to go clear as well.
Many ordinary social interactions have become sins recently. Saying anything that could be interpreted as offensive poses a very real risk to your career, the list of potentially offensive things is incredibly long, and gets longer with each passing moment as novel outrages pop up in all corners of the world.

You can still be kind, empathetic and polite to everybody you work with. But avoiding authentic personal relationships at work is very sensible, along with having very clear personal boundaries. Normal colleagues can form cliques of people they trust, but it’s not a great outcome for management to be participating in that, even though that’s what usually happens.
For peers at same level in their own setting that is indeed true. When with people that report to you, might not be a good idea because, one can't tell if even the laughter is genuine or obligated to.

There are some instances where it might potentially help - when your team is under stress (real or perceived). Light humor (if well done), might alleviate some of the tension in the room and let them focus on work.
I successfully used it as a writing/typesetting (NROFF) system. It was the cheapest Unix system I could buy, that the family could also use (it was dual boot). It was expensive, but I used Sun's at work, and I wanted to get as cross as I could.
Step 3.5: IPO and exit before investors discover that step 4 is impossible.
Chile is not a counter example. Almost all the population lives in the middle third of the country, and even then the Santiago area is drastically more dense.
In this case sure, I was just making the argument for integrating ad blocking into the browser in general.

I would prefer a world where all browsers have integrated ad blocking, in which case I only have to make a decision on browser, not browser + ad blocking extension.
"Always punch up, never punch down"
Show HN: SAT Solver/Constraint Programming library in Go
Ha, just now I realized "Jeudi"... lucky day today!

But just some romance languages. Portuguese does not.
Not really, the https://en.wikipedia.org/wiki/Chelyabinsk_meteor was 20 meter diameter and hit the atmosphere at about 20 km/s. While there were some ~1500 injured people, the Earth as a whole did not really notice.
So when engineers left the company, was their knowledge portable? And attracting new talent, did they come with X years knowledge for the custom code?

With fewer LOC I'm not sure what you mean, the provider code is pretty small, smaller than custom ansible, salt or puppet modules. Smaller than CDK and Pulumni as well. Sure, you'll have to write Go, but that's about the only hurdle.

Everyone doing a round of NIH for internal tooling is ultimately not making the tide rise.

Edit: don't get me wrong here, writing internal tools to do a job the right way for the right needs isn't "invalid" or something like that, but people often dismiss the rest of the lifecycle of knowledge and maintenance when making something completely custom.
3 years ago, I had a talk with the Chief Senior Physician of the hospital my mum was treated. She was terminally ill, she was fightiing for weeks, but there was no hope left. So it was decided to end all life support measures.

When I went back to my car, where my then-minor sister was waiting for news, I said: "Sie hat es geschafft.", which literally means "She made it" in German - however, I meant it in the meaning of "She doesn't have to suffer any more.", which is also a valid meaning. After seeing the rlief on my sister's face, I immediately apologized and explained the situation.

Ever since this day, I a) think twice before I speak and b) try to avoid double meanings as much as I can. It still haunts me, though she's fine with it.
not necessarly.

First of all, this

function pizza(boolean pepperoni, boolean bacon, boolean mushroom, boolean artichoke)

breaks down when you want to add ham, potatoes and sausages to the pizza.

Secondly, you can optimize for the common case:

fn pizza() # -> default pizza e.g. margherita
fn pizza(list_of_ingredients) # -> your custom pizza

if you we are talking of simple functions and not more complex patterns, such as piping, in Elixir I would do

pizza |> add_ham |> add_mushroom |> well_done

when using boolean parameters you are also passing down a lot of useless informations (a pizza with pepperoni would include 3 false just to remove the ingredients from the pizza and only one true) and confining yourself to a fixed set of options, that could possibly also represent an impossible state.
You can look at:

- A collection of public threat intel reports [0]. Lots of reading though. I did some Splunking on it last year and at least 50% uses phishing for initial access. You could call that a structural vulnerability.

- Exploiting vulnerable public facing stuff is another initial access technique. Here someone collected all the CVEs used by ransomware crews [1].

- VERIS community database [2]. Collection of 8894 security incidents. If you look in the JSON there are some fields describing the vector and the actor.

[0] https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_C...

[1] https://twitter.com/uuallan/status/1437068825636265985

[2] https://github.com/vz-risk/VCDB
You could have made this same argument for AdBlock Plus a few years ago.

It was trustworthy, until it wasn't.
If you use Chrome, the extension Video Speed Controller: https://chrome.google.com/webstore/detail/video-speed-contro...
This is one of the few positives I'll give to Comcast/Xfinity. I'm able to purchase my own DOCSIS modem (as long as it's on their compatibility list) instead of renting one from them.

AT&T U-verse I couldn't bring my own modem, and I understand that they're not a DOCSIS network either.
Ever attempted to hold your breath for as long as some characters are shown to be submerged doing this or that in a movie?
Similarly disappointing. ;P
Open up dev tools and go to a console. Enter:
document.getElementsByTagName("video")[0].playbackRate = <rate you want>
This was found by an amateur astronomer in Brazil, who was taking pictures of Jupiter to see Io's shadow on the planet.
> I think a lot of people are looking for that. This is especially true for folks with lower-end hardware where hardware decoding may be supported by the system but not (well) by the browser, or at least the rest of the browser runtime would use way too much resources.

That's what I'm trying to archieve with a C++ client. I feel like picking C++ with Qt is the best in terms of portability and performances. As a Youtube binge watcher I feel like I'm wasting resources by going through a browser.
Honestly that's still really basic. A few API calls for search and recommended, and then delegate the core functionalities (playing and downloading media) to vlc and youtube-dl (need to switch to the new and maintained equivalent btw)

> If your project's architecture is not too complex and the dependencies are easy to package, some external contributors (me?) could help with that.

I plan on doing some cleanup and post an MVP on HN, I'll keep you updated!
Sure! I hope it's helpful!
There are six internet links on my office on wheels—seven when Starlink arrives
To match the calculations by JPL/NASA, assume that the objects are falling into the Sun from infinity.
We had a similar issue in the UK with our actual voting system switching to AV.

Either it would kill babies or it wasn't going far enough and our chance of iterating improvements to our system were squashed, just like that.
It's trivial to do that with Wireguard or IPSec when you are manually provisioning everything. As soon as you add any kind of UX or discovery layer on top, things get more complex and you are by definition delegating trust.

You either trust multiple third parties such some kind of SSO provider, multiple SSL CAs (to secure https), and a configuration service, or you have some kind of cryptographic discovery system with certificates. ZeroTier does the latter, and the certs are issued by something ZeroTier can host or can be self-hosted.

> WireGuard, by design, is a fairly simple protocol that requires some other software or out of band configuration

The core ZeroTier transport protocol isn't much more complex than Wireguard and is basically the same thing. Then you have the certificates, identities, etc. As you say to make Wireguard useful for large scale or auto configuring networks you have to build something analogous on top of it.

Vulnerabilities are almost never in the transport protocol unless you're dealing with some hairy legacy protocol like SSL that has a lot of modes and can be vulnerable to downgrade attacks or unless it's a totally incompetently designed transport that uses cryptography wrong. Vulnerabilities are almost always in higher layers, management layers, authentication code, etc.
Something I learned the hard way at the student newspaper is that the word "Fired" has some very strong psychological implications in US English -- it implies someone no longer has a job because of something bad they did.

We got some strong negative feedback about a headline saying that people had been "fired" when the story was that a kind of lab technology had become obsolete and a number of lab technicians had been laid off. I had signed off on the headline, was responsible, and have never forgotten.

People take their jobs very seriously; it's the thing we choose to do -- or have to do -- instead of being with our families and friends. And "fired" is one of the strongest words in our language. We need to be sure we understand what we are doing when we use it.
"""
People often ask me what is special about XMake and what are the advantages compared to existing build tools such as CMake and Meson. Why should I use XMake instead of CMake?

Let me talk about the features and advantages first, XMake has the following points:

- Concise and easy-to-learn configuration syntax, non-DSL
- Powerful package management, support semantic version, toolchain management
- Lightweight enough, no dependence
- Fast, the build speed is as fast as Ninja
- Simple and convenient multi-platform and toolchain switching
- Complete plugin system
- Flexible build rules

"""

Personally, I just love that it's not another DSL to learn

You can read more at https://tboox.org/2021/05/03/please-use-xmake/
Android devices in some cases don’t have H264 HW. Libwebrtc also doesn’t support SW H264.

That has added lots of complexity/confusion for people building stuff also. Quite a few footguns in this area :)
some blogs that are available on domain etc have form with email subscription (for example by using Convertkit service). i did this on my blog website.
yes shellac has a noticeable odor which is not entirely the alcohol. I enjoy petroleum solvents, mainly.
Your pricing page seems to have a typo in the Unlimited Plan. It still says 1 website in the table. Copy paste issue perhaps.
Eh, honestly I usually have Windows Update disabled anyway because it causes much more headache than it is worth. Occasionally, once a year at most, I re-enable and update and it has about a 50/50 chance of not making me wish I'd just reinstalled instead.
> not tolerating assholes/toxic people

Both of those descriptions are metaphorical. I don't know what you mean, and neither do most of the people reading the comment because different people use the words very differently.

So while I do put in an effort to respond to questions in this case I cannot.
I wonder how well paywalled programming languages do relative to more openly available languages.
If he told you that he was worried about being fired, then you made the right choice of what to say. Imagine if you'd just shrugged. The only reason you'd respond that way instead of in a comforting way is if you thought there actually was a chance he'd be fired. He'd certainly realize after getting fired that you expected it and that because of that you must not think highly of him.
For me this is a matter of timeblocking my personal life too. If I don't have anything else, I basically procrastinate by browsing the Internet (Reddit! HN! All shiny new stuff!) So every quarter I have my objectives (I shudder to write the OKR word) and then time block my personal calendar. I have calculated I have around 20 hours per week of "me" time (besides work, sleep, home stuff, and so on). Do I want to get healthy? Bam! There goes 3 hours per week! Do I want to learn to play the piano? Bam! That would be 4 hours sir. Meditate? 2 hours per week. Read fiction books? Bam! 4 hours and you're done.

Visualizing that time is scarce helps me a lot.
So all the while, for almost two years, Virgin didn't do squat about this. Gives me flashbacks to some of our disclosure interactions with PayPal and others.

Wonder why issues like this are so common - do they just de-prioritize vulnerabilities reported by researchers to death?
Had almost identical idea for startup about a year ago. I was thinking about it as a SaaS, but then I figured out there is not enough interest for such product.

Idea was to run almost same set of checks as tab HTTP Observatory does using CLI I created: sailor.
We decided to have it as CLI, for sake of simplicity of integrating it into CI & CD.

After I decided we won't be trying to build a business around it, I removed SaaS dependency and open-sourced it.

You can check it here: https://github.com/hidalgopl/sailor
Yes it's true that not everybody who makes a living from it has multiple employees and a studio, PewDiePie is a good example of somebody who didn't ruin his channel by transforming the nature of it once he got more views.

Sure, content creation is a job whether they're compensated or not. I'm not saying that we deserve free content, I'm saying that there will always be people bored enough to create content they want to share.

Image macros are created daily but nobody is creating them with the expectation of compensation. (There are social media accounts who compile them so they can gain followers / post ads, but the original creators aren't)

People write blogs knowing they get 20 views per month. That's the voices I want to hear. Not from someone who reads a book about how to get $5k in passive income per month by churning blog posts and growing a mailing list!

The number #1 post on the front page about blogs has this comment

"As a minor counterpoint: I've come to dread blogs and newsletters because so many of them are written by grind culture freaks who only write faux-insightful SEO'd content as a way to build an audience to sell snake oil to."

Just replace blogs and newsletter with YouTube channels and that's my sentiment.
> On an unrelated note, there is a really fun infosec podcast named Darknet Diaries, worth a listen.

Are these guys paying people peoples to advertise here?
I can hear the squawking now… “Flat white! Flat white!”
Link to the impact video https://www.youtube.com/watch?v=ImVl_TfTFEY
The patch was on the roots and was applied within 6 hours of learning of the vulnerability. A new release wasn't needed since the issue was not in there.
Atlassian Services Status