skysight-inc/HackerNews huggingface dataset:
It unbalances access to jobs by family wealth and creates yet another:tm: skip annoying thing if you are rich enough and/or have enough friends who are rich enough.

Somebody coming out of a life hiccup like family issues or health issues is gonna have a harder time skipping the interview while also having a harder time interviewing.

The return on investment aspect could just get gamed by companies being excessively selective on which candidates they allow to stay past 2 months.

And finally it extends the worse thing that exists in our society: "It's easier to make money if you have money."

This is what creates and enforces our class system, this is what makes it harder for historically disadvantaged groups to get a head, and such a product would just extend this, while benefiting the company.

The anger is justified, such systems can not be allowed to exist.
In terms of the topic in this thread, it's not the customers responsibility to deal with expired root certificates. That said, I understand that there is a large issue with devices that drop support way too soon, even though the hardware is good. But the solution is not the weaken the security, but instead to force better standards for how hardware is maintained, and ensuring that there is a long lifetime where either the manufacture supports the device, or the device is completely unlocked and allowed for easy community sourced modifications and updates. That sort of critical information should be secure, because taking an example from elsewhere in this thread, I'd rather be confident I was reading the exact page as intended from the government source regarding how to apply for unemployment benefits and not have to worry that malware in the router is modifying the information on the page to steal information and use it to redirect those unemployment benefits.

And this theoretical attack on home routers is not out of the question at all. How many unmaintained unpatched IoT devices have been abused with malware/botnets. The clock is ticking on mass exploitation of home routers being attacked and it's firmware replaced with one injecting/stealing information from insecure webpages. If the devices can't be updated, we should make sure there are _safe_ alternatives to accessing the information, rather than hoping that no actor is doing things they should not.

I can list so many scenarios with critical information and attacks that could be made if the webpage was not HTTPS with proper certificates. Including school districts in the United States being force to block inappropriate content in order to receive federal funding, and those firewalls abusing non-http content to decide what to block, and school districts abusing that capability to block anything and everything they want. How about a student trying to understand more about LGBTQ+ individuals and the school district inspecting and censoring the exact content inside the pages to remove words like "lesbian" or "gay" because the school considers them "questionable." Or a school blocking articles pertaining to hacking. I have seen that exact last scenario in fact, where certain articles posted here were blocked in my highschool years ago because they were considered hacking and that was apparently not appropriate to view in school. These are real scenarios and not hypotheticals.

For more info on some other various types of fun attacks, see https://www.troyhunt.com/heres-why-your-static-website-needs...
That's a pretty clever thought in general, but yours is only a first approximation.

First, permeation decreases with pressure, at different rates for the two gases. If you consider only this fact you will find that the partial pressures of O2 and N2 asymptotically approach homeostasis, rather than simply all the O2 leaving and all the N2 remaining.

Second, permeability changes with temperature, so the ratio of O2 and N2 exfiltration rate changes seasonally, as each gas has a different permeability-vs-temperature curve. Third, the ideal gas law causes pressure changes seasonally which will also decrease exfiltration in winter, and once again, each gas will have its own permeability-vs-pressure curve, so these become very confounding factors.

All in all, the reality of the situation is that filling up your tires with atmospheric air will probably settle on partial pressure ratios of, say, 85/15 rather than 100/0. The deflation that you get comes from only about 5% of the O2 leaving the tire; and of course you get another big deflation when the weather first turns cold.

I don't know the exact numbers because I've frankly never thought to look into this before. So like I said, it was a clever thought! But it needed to be taken a few steps further.
I survived the JavaScript Cambrian explosion and all I got was a disenchantment with computer programming
Thanks for your commment. I belive in a being who said "Blessed are all they that mourn, for they shall be comforted.", and who is utterly able to keep that promise. Our current vision is limited. I have found that one can know this for oneself, not just because someone said so, and doesn't have to believe "fairy tales". There's more at my web site, how I learned this. (not selling anything, but honest feedback is appreciated.)
Mapping the Insights That Drive Startup Ideas and Theses
CocoNFT lets you effortlessly mint and sell your Instagram posts as NFT's
In the US their unit share is now greater than 50%.

It's too bad that they're taking all of our money and not exporting much.

And for a country that loves "freedom" so much, it's also too bad that we don't make Apple sell us devices that we can actually own and control, by simply voting with our dollars.
What if your government is comprised of your petty neighbors, and now with the full capability to surveil you beyond just what you say in your garden? Stop accepting that monopoly on surveillance, it does not need to exist.
Almost without exception. There is no way of knowing without careful study which burner will turn on when you turn a knob. (generally you know the side, but not front/back) Every time I move I need to figure out a different stove, and so I'm often turning on the wrong burner because I have the wrong habit. Most people think "opps, I'm stupid again" when that happens, but I have enough UX background to know that the real problem is the UX is terrible.
why does it have to be exclusive? If both are false, then there's no confusion on making a charge. If only one is true, then someone being lazy might think it matches.

along your lines of considering the forum, wouldn't it need to be aiding && abetting? i don't know how to bitwise compare aiding to abetting.
The quote was literally a copy & paste from the parent post. No distortion there. I am genuinely curious why people think we should aim to grow even more in numbers.

More so, I am genuinely curious what the same people propose we do when we reach whatever they consider to be the maximum sustainable population. Clearly, we can't grow infinitely in a limited space.
There are a couple issues tracking FreeBSD support for Nix [0,1], the package manager indicating it works there. Depending on the level of integration you want that might be sufficient, that would already be enough to generate the system config files for example, but to get the sort of integration you get on NixOS with different generations and the ability to rollback at boot would require more work. This would look something more like nix-darwin [2] than NixOS really.

I wouldn't be entirely surprised if OpenBSD works too, I might spin up a VM and see...

[0] https://github.com/NixOS/nix/issues/3280

[1] https://github.com/NixOS/nixpkgs/pull/81459

[2] https://github.com/LnL7/nix-darwin
When I inspected, and added transform: scale(0.4) to the div of the checkbox array, the game seems to run smoothly.
Linux, Firefox nightly, Webrender, generic nvidia card. Will try the AMD later tonight.

I wonder if the transform: scale(0.4) issues are specific to his computer or to Chrome.
For any kind of inspection body, conspiracy theorists can suggest that everyone involved in the body form a conspiracy.
Apparently, the SSNs were all embedded directly in the HTML file. Like … what?
But when the ego self ceases to exist, to whom is it unjust then?
Probably just "View Source".
>Can you send me some of these random hashes? Since they're worthless?

WKRQE0GD2T074CCH6ZOH5DYFI4TX3RMEIKHS7AWEUVYEH030GA1B36U8C1L4OWEC

5DYFI4TX3RMEIKHS7AWEGEALOI1LNLZLHKGQ2I8MJEU1XAAQPRG5MUYXXNFR9QRQ

W1T7OR1UZ20L6MAXB202PWTN0YQR4IXZ851CS6LB1HUL7AALT9Z8K1OZW7FIK9IS

Y112I5BI0RQ04G6LS1XZ3V4C6CY5G97IOYQ0EJSLRQ6CK4ZGCMNXHH2O3NQQ4RVK

XEIKU2MHPTOQOBPG3TCT09SBPGKR0WZ0UX119IBBBB0HORXV1F0YNF18ADQHE21I

Go wild
> Covid is not low risk for 35-40 year olds.

What threshold are you using to define “low risk” ?
Yeah, also limited by size of the layers. She's been doing pop art style stuff lately, and we got her some backgrounds that emulate paper and stuff. They are higher resolution images so they definitely take up more memory.
I've invested in several private equity funds, and many times those funds negotiate things that are far more lucrative than equity, such as temporary or permanent revenue splits, convertible notes which may be partially paid off before converting into extremely large positions in the companies, you name it. In this structure, I realize from experience, that it is not possible to compare the fund's performance to the stock market, as every limited partner has their own unique exposure to investments that all perform differently.

I've seen the headlines that match what you said, the S&P returns more than picking various startups to invest in most of the time, and that many funds also mirror that, in reality I think all discussion about this is inaccurate, because there are additional variables to account for. Maybe actual equity will underperform just picking S&P equity. But so much more is actually happening which will never show up on a cap table or comparison of valuation growth or any mandated disclosure.
I have the same problem, but I am not sure other software is much better. Say Maya or 3DS Max. Try spending an year away and then come back to them :)

Blender does seem to have a UI that's optimized for power users. It's amazing to see someone that's experienced working with it, seems to be very practical. Maybe there should be a 'beginner' view though, hiding some more 'esoteric' options.
Its really easy for engineers to get a feeling of superiority because they 'get it' and to wonder why everyone else is so stupid, how could they use this thing they don't understand etc. etc. etc.

You've got weak spots in the tech stack too. I'd wager there are tools that you use without knowing even about their existence. The point isn't to do dumb shit, the point is to have empathy and consider the perspective of other humans who are just as intelligent as you but knowledgeable in different domains.
How to Avoid SQL Injections, XSS Attacks, and File Upload Attacks in Web Apps
This long-form article, I discussed in details how to prevent SQL injections, Cross-site scripting, and file upload attacks in web applications. I brought together my 10+ years experience with Linux server administration and 4+ years experience with full-stack software development to draft one of the most detailed post on the subject matter on the internet. I'm looking forward to your feedback.
How the pandemic changed employee perks
Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million

Talk about waste of resources.
If responsibly reporting a flaw is as bad as using it for evil, you might as well just sell it on the dark web.
Plus ~30% of your revenue.
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs.

After I shopped a few other companies to see how our plans compared, I notified the marketplace operator via the only link on the website for customer service. Within about an hour, someone from their IT department rang me on the phone and started grilling me about how many other plans I browsed, and insisted that I clear my cache and browsing history, and notified me that they would be watching to make sure nobody at our IP address didn't access any other plans while the issue was being fixed.

I was pretty surprised at his response, and assumed they would be more grateful for exposing a pretty basic flaw, but I guess a natural human tendency in these situations is to try to externalize the blame. Perhaps it's more difficult to hold yourself accountable than it is to assume that others who've found your shoddy work are malicious actors.
* The newspaper said it found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. In other words, the information was available to anyone with a web browser who happened to also examine the site’s public code using Developer Tools or simply right-clicking on the page and viewing the source code.*

The state's website was sending SSNs to the browser of every visitor. Visitors didn't ask for that info but got it anyway. Everything the state sent was viewable thru View Source.
On paper, you are absolutely right. But we don't live in theoretical world, rather in one where corporations like Monsanto will use any technology available to extract as much profit from everybody as possible.

Even if it means doing highly amoral stuff and tightly coupling crops enhanced for mass, immunity to pests and diseases with things like inability to breed, so farmers have to keep buying their seeds.

Its not hard to see why everybody has issues with this - not many want to be slaves with the very thing that our lives depend on to company thats extremely greedy from the start. GMs without those traits, having just weaknesses adressed might be much better sell for poor countries.

Rich countries like Europe will react when its time to react, no need to freak out now when as you describe serious issues will be present in next century. Crops can be changed pretty fast if there is strong enough motivation and one has enough cash.
An employer that allows some employees to endanger others is negligent, most importantly in terms of ethics, but also in terms of productivity.

Your right to swing your fist ends at my face. If you want to work with people, you have to take reasonable measures not to harm them.

An employer that is willing to tell me to come in to work with people who refuse to get vaccinated is one that doesn't care about my well-being, and one I don't want to work for.
And literally protected by the 1st amendment.
I guess some will see this as good news, but further entrenching Metal is just sad in my opinion. So much wasted effort just because they can't admit they lost the standards game and won't move to Vulkan.

The generous interpretation is they just don't want to invest into that if it isn't "broken" but the cynic in me can't help but think at least part of the motivation is being different and maintaining the wall around the garden.
So you did your regular work and in your extra time during normal work hours, you also thought of and executed on these ideas? Did you ever seek approval or just go for it? By the time I proposed ideas like this in a PR or something, I imagine my manager would question why I'm spending so much time on this kind of thing
Facebook Teaching AI to View the World Through Human Eyes
Color me surprised.

I really don't understand the whole "double down" approach to doing things.
Google a decade ago wasn't like that. I learned so much about software development from reading internal wiki pages for things like MapReduce, GFS, Colossus, their search serving system, search algorithms in general, their authentication/ID system, GMail storage, Google Reader feed ingestion, Google Moderator voting algorithms, etc. Not to mention snooping on code reviews from folks like Jeff Dean, Rob Pike, and Guido van Rossum.

It's not like that now - things are so much more locked down. The first time I was there I could basically treat it like a Ph.D that I got paid for, in terms of learning new things. This time, it's a job where I do my tasks and receive lots of money in return. I think this is kind of a shame - I liked the environment much more when most people were there to learn and invent rather than collect a paycheck - but perhaps this is the inevitable result of a company growing past 100K employees.
> Exactly, Debian has you covered depending on your needs. I run Debian Stable on servers and Debian Sid on my desktop and laptop. Had 2 or 3 non-booting Sid systems over the course of 20 years, none or which weren't solved in 10 minutes after asking for help on IRC.

Oh sure, has Debian testing or unstable resulted in a non-booting system for me in the 15-20 years I've been using it? No. But that's an incredibly low bar to set. Issues absolutely pop up that, while not that catastrophic, remain problematic.

Just recently (like, in the past 2-3 weeks) the move from pipewire 0.3.36 to 0.3.37/38 broke bluetooth audio for me, which is a dealbreaker as I use a headset every single day for work. No idea why, but I had to go pull the previous package versions from /var/cache/apt/archives (thank goodness I didn't run a purge!), manually install them with dpkg, then pin them in my apt policy until the issue is fixed.

Similarly, the wifi drivers that ship with the kernel have periodically broken and worked again across major kernel versions.

These sorts of intermittent surprise issues are far less likely to happen with a snapshot distro due to the stability of the package set and the additional testing those snapshots undergo before being released.

The problem is the Debian snapshot distro is stable which, again, has an ancient package set.

Ubuntu strikes an interesting middle ground, giving you up-to-date packages that are vetted and then the whole distro is snapshotted which minimizes the potential for surprise breakage.

Now, again, I use Debian testing. I'm fine dealing with the intermittent issues that pop up. I know the system well enough to diagnose issues, manually downgrade packages if needed, pull things from sid if I have to, or even build packages by hand when absolutely necessary.

But that certainly isn't for everyone.
From a US perspective, it's a strange mix of these two things( from consumer electronics):

- We don't open more chip factories here, because labor/regulation/land/etc is too expensive

- We don't have enough logistics workers (docks, truks, etc) because it doesn't pay enough.

Right? Am I seeing this wrong? Because what I keep reading is that we have ships just waiting in California to be unloaded but not enough dock workers to unload them and truck drivers to move the goods out?
When something goes wrong that doesn't cause more global warming either, it just creates a durable refuge for wildlife.
Yeah explaining it is great. Just don't want people thinking it is only a Rust thing.
The distribution of the SSNs to the client, where they can be seen by everyone using a Web browser by clicking on a standard menu function is clearly the government's fault.

They are obviously trying to deflect their incompetence - nobody audited the design nor the resulting implementation.

If the journalist acted as described it is professional behavior (notify and postpone publication to give the Website operator a chance to fix things), it is ethical and complies with security disclosure best practices.
If memory serves - they introduced Metal as a high efficiency low level API for games, not a generic rendering API.

Deprecating opengl was confusing for me.
The UK is something of a contradiction when it comes to privacy.

On one hand, there has been a consistent popular trend over the years towards trusting our government agencies and tolerating surveillance up to a point.

On the other hand, the mere suggestion of introducing any sort of compulsory ID card that had to be carried at all times -- a measure not unusual in other countries we would consider modern and democratic -- would threaten any UK government.

On one hand, many people here carry around devices every day that include cameras, microphones, means of tracking their location, and networking capabilities that can transmit data from any of the above.

On the other hand, there have been a few experiments done by academics and journalists that forced ordinary people to confront the realities of the surveillance they were under and in some cases facilitating, and the responses are typically a mixture of surprise and hostility.

I think it would be fairer to say that much of the UK population has been tolerant of, or perhaps resigned to, the increasing surveillance, rather than that they accepted or condoned or positively wanted it.
Counter example: This was used fairly commonly to discover spies in EVE Online.
> No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages

How is an HTML page source not considered "publicly visible"?!
Astronomers Found a Planet That Survived Its Star’s Death
https://archive.is/OzICq
This one is a good, understandable example, though I wonder how I would pitch the value add for these things. Usually my team is so busy I imagine my manager telling me to focus on other work first
> "A hacker is someone who subverts computer security with malicious or criminal intent," the statement continued. “Here, there was no breach of any firewall or security and certainly no malicious intent. [...]"

Then I guess HN better find a new name.

Seriously though, this defense bugs me because it outright dismisses the idea of ethical hacking by re-defining "hacker" as someone with "malicious or criminal intent". They should embracing the label and explaining the difference between white hat hackers and black hats (the actual criminals).

Our world needs more white hat hackers. All it takes is one security flaw to compromise a system and the deck is always stacked against those securing it. Re-defining "hacker" as a term to describe criminals stacks that deck even worse by dissuading future would-be white hats.
The US doesn't like losing tax cattle.
Aside from everything else,

"According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."

I expect there will be no consequences for the mindless idiot who put SSNs in the HTML output.
One thing a newspaper has is lawyers (including plenty of places that will do pro bono on 1st Amendment cases)