skysight-inc/HackerNews huggingface dataset:
SQL injection draws attention to the fact that almost all web applications run as root, in regards to the most important asset: the data.

It’s odd that this hasn’t got more attention. It should be easier to write backends that tie data access more closely to user credentials without the backend trying to enforce that itself. Is there anything out there that makes this easy to do?
"the most popular way to build apps these days for certain projects" -- there i fixed that for ya.

been building web apps for 20 years and what you describe as most popular was never the best choice for my clients. (and i hope to keep it that way)
You've been lied to by the MSM. Read my comment below.
The only magic in a good bur grinder is its consistency. You can look at what you're getting out and bump the pressure up or down slightly compared to your last shot.

It's not just consistency. It's grind size distribution. The cost of a high end burr grinder is crazy and I don't understand what's going on but you can do simple comparative tests.

I have a 2 different burr sets for my grinder with different cutter geometries and the mechanical properties of the grinds and the puck are different. Never mind the taste. The way the water pours through the puck and what's happening inside the basket as you pull the shot is different. You can easily tell by the amount of channeling I get and the integrity of the puck after the shot.

The espresso also tastes different BTW.

I've also done blind taste testing with my grinder pitted against 3 other grinders. Having only tasted the coffee from 1 of these, I matched the coffee to the grinders only based on the theoretical properties of the burr sets.
Thank you for this!
I posted elsewhere that I've enjoyed the Iron John book many times over.
Your post is yet more information about it.

Thank you for taking the time to type it up!
You think transactional updates are a mistake? I guess you’ve never had to worry about the integrity of your data?

Bank -> debit card purchase -> perform all required database work in a transaction -> transaction fails -> decline debit card purchase

Without transactions, in this scenario, maybe the debit card transaction fails but money is still taken out of your account? Doesn’t sound very pleasant.
Windows also runs Microsoft HTML Applications (HTAs) out of the box. These are useful if your script needs a GUI.
> They do arithmetic's perfectly.

So does abacus. Even something like this: https://www.youtube.com/watch?v=GcDshWmhF4A is capable of doing arithmetic. Does that mean that the marbles somehow understand what addition is?

> look them up and spit out answers,

Wolfram Alpha does this, and let me tell you: things I couldn't understand listening to lectures and trying to work through handbooks (well, most of them were hand-me-downs from the '60s, so take that as you will), became clear in just a few days of work. I didn't cancel my subscription for 2 years after that, out of gratitude.

But, most of the papers out there don't use interactive platforms for publishing. Even though they could. But as you said, that would be too much work, so they simply don't. I accepted it, it's all good now.

> Pure mathematicians mostly works on problems that are too abstract for programming.

I was pretty sure we're not talking about "pure" math. I mean, we both agree that that particular branch is of interest to a tiny minority. Of course the pure mathematicians can stay inside their ivory tower forever, nobody cares. Notice that I repeated the word "use" multiple times. I was trying to imply having a goal that's not mathematical in nature.

EDIT:

> Why doesn't CS do the same? You can't expect mathematicians to do that work for your field, as there are too many fields depending on math and too few mathematicians to handle everything.

I... don't know. That's a very good question. Yes, teaching math in CS depts is generally outsourced to mathematicians. It was like that for me. You may be right, that could be the reason to all my problems.

So, you mean that if we want to have math that's understandable for programmers, we need to make it ourselves? Fair enough if so, I think.
> “The function hmwp_get_user_ip tries to retrieve the IP address from multiple headers, including IP address headers which can be spoofed by the user such as X-Forwarded-For,” reads a blog post published by Jong yesterday (November 24). ”By supplying a malicious payload in one of these IP address headers, it will be directly inserted into the SQL query which makes SQL injection possible.”

> wpWave [adressed] both flaws in Hide My WP version 6.2.4, released on October 26.
So the incorrect opinions based on weak evidence that the experts had over the past years of covid should not have been "reinforced to others"? That sounds to me like a criticism of the experts.
Has anyone ever attempted to intentionally spread a less lethal variant of a virus in order to speed up the crowding out of other strains? I could see us trying this if a quick spreading but innocuous strain is found.
These measures are good and necessary but on their own will not solve the problem. It is not sufficient to say "no", you need to provide (=invest)in alternatives that show what "good" looks like.

For some bizarre reason the European continent has outsourced digital infrastructure. It is then no surprise that what is on offer is not congruent with the values and attitudes of its citizens.
How is the Corona world going to look like in 5 years?
My guess is the following: We have vaccines, but they only work for 6 monhts. More and more people will get sooner or later tired and will refuse doing it twice a year. Plus with all the antivaxx madness there will be medicine divided into 2 groups.
1. regular medicine like we knew before corona
2. covid nedicine
We will have twice as many employees in the field and this will become something like a brand new industry. We will not ge rid of covid. It will be here from now on forwever. We have to learn to live and die with it. What is your prediction?
WP can't fix this entire class of vulnerabilities properly or it won't be Wordpress any more. It is unfortunate that Wordpress is one of the worse options for making websites today (not WP itself, but any theme or plugin can easily be coded to have SQLi), yet it is the most popular.
Actually he’s convinced me. He does have a non-mainstream opinion on China. The boots on the ground, lived reality and perspective of Chinese domestic experience is literally a non-mainstream opinion on China.

You’re being extremely rude here, accusing people of being shills and telling them to literally “fuck off”. If anything goes against the HN ethos and rules, it’s terrible behaviour and bad faith behaviour like that, not a veteran Hacker News member with an account that’s twice as old as yours arguing a refreshingly non-mainstream perspective.
Polio and a few other vaccines really spoiled us in terms of what's realistic when vaccinating against a Coronavirus. Vaccinated != Immune, sadly.
Apple leaker Kuo: Apple plans to replace the iPhone with AR in 10 years
Same in Poland, we have many days, one of the more popular is "Black Frajerday", Frajerday meaning Sucker Day. Our deals aren't even that good. The prices rise over few weeks before, and then you get 10% or 15% discounts which usually are above the base price anyway. At least in the US, especially for virtual goods you can find some actual 70-90% discounts.
> almost all web applications run as root

That‘s largely a configuration problem. They don‘t have to run as root, most of the time.
More Improvements:

- Grouped shortcuts

- Consistent left to right order

- Moved note to the bottom to make more shortcuts visible on smaller screens

- Added icons to make each easier to find at a glance

- Simplified shortcut descriptions
When you go to the movies, you hand over your ticket, they tear off the stub, and hand the stub back to you. If they instead threw them both in the trash, but offered you the stub for “only” $70 on top of your ticket price, would you still feel the same way?
Not surprising to me. I work at a small company, focused on industrial automation. It can be very expensive and time-consuming to automate things, so our internal processes are ironically manual. Customers don't pay us to automate our internal processes, so that never gets done.
Can we distinguish between the prerogative of a state to wage an offensive war against another state (eg., US vs Iraq) *from* a state engaged genocide of its own people?

When a state attacks, on-mass, its own citizens it's essentially failed. Absent a functioning state, any outsider can do what they want here: invade, preferably.

The "whataboutism" here isn't solved with yet more whataboutism. Every state today and in all of history has waged war, and holds itself to low standards on non-citizens. There is nothing exceptional in the US having Guantanamo; it is a world-wide exception not to have one! (And I agree, incidentally, that there shouldnt be one).

A genocide isn't part-and-parcel of the nature of states; it is the opposite. An exceptional event which represents a profound failure of the state. It was the genocidal conditions of slavery which caused the US federal state to fail: civil war.
I've found that you have to use less heat on them so that the coffee extracts slower than the traditional bialetti and the "knockoff" that I bought was about as good. With similar heat I coudl tell just by the color it wasn't extracting the same
I missed that back then. Interesting idea, but I'm a senior developer with 20 years of experience, and my 12 year old son is better at Factorio than I am, so I'm not so sure about this.

But it's interesting to compare his factorio style to mine. Or my factorio style to my regular programming style. They're very different.
I have seen the same concept where they show 5 cards, ask you to choose one and then click the button.

Then it shows the other 4 cards, with your card removed.

In reality of course it’s a similar set that contains none of the same cards.
The most recent one which I'm currently working on is to take notes on the structure of SaaS product intro videos (the one you find on the landing page, usually above the fold)

Another one I had in the past that it will make easier is to add time marks on the video description (youtube segments the timeline and adds a section list to jump between the marks)

I think it can also be useful for people taking online classes or learning from videos
These sites are great. Some device I'd like to buy is discounted 3%, and I can see that the manufacturer's old model steadily dropped in price between Christmas and summer. I know it's better to wait than to bite at the current, laughable discount.

In Germany, https://www.billiger.de/ https://www.idealo.de/ and https://geizhals.de/ are just three of the many sites that aggregate prices.

I know Idealo has a price history that goes back one year. The unfortunate parts: they only list price history for new items, and incorrectly listed discounts (refurb instead of new, different model/color, etc.) stay in a product's price history, so there are sometimes price valleys that should not exist.

It would be nice if you could see (on the price history chart) which site/seller had the lowest historical price, since there's more credibility in a listing from Media Markt (probably the largest electronics chain in DE) than from Ebay.
Somewhat off topic: I imagine someone here could design a printer that a person could stand in or lay down in and use Henna to make temporary but very artistic and detailed tattoos on ones self to test these theories. This could be a way for people to test out ideas without making a permanent and painful mistake. Henna tattoos will last about 2 weeks or so before starting to fade. Alternatively there are people you can pay to have them drawn on you by hand.
Index HTTPS://www.facebook.com/Phil-Mickelson-CBD-Gummies-103877878800666
Product Name — Phil Mickelson CBD Gummies
Side-Effects — NA
Availability — Online
Rating —
Official Website (Sale Is Live) — Click Here To Order Phil Mickelson CBD Gummies From Official Website Now

Where To Buy Phil Mickelson CBD Gummies?

Phil Mickelson CBD Gummies is the most recent popular item that has assisted many individuals with resuscitating issues like a sleeping disorder, tension, gloom, persistent joint torment, and so on, and different medical problems.

Rank : https://www.facebook.com/Phil-Mickelson-CBD-Gummies-10387787...

https://sites.google.com/view/phil-mickelson-cbd-gummies-get...

https://www.spreaker.com/show/phil-mickelson-cbd-gummies-buy

https://philmickelsoncbdgummiesbuy.yolasite.com/

https://philmickelsoncbdgummies-buy.jimdosite.com/

https://philmickelsoncbdgummies.blogspot.com/2021/11/PhilMic...

https://www.homify.in/projects/1095791/phil-mickelson-cbd-gu...

https://caramellaapp.com/philmickelsoncbdgummiesorder/vXQDRm...

https://www.crunchbase.com/organization/phil-mickelson-cbd-g...

https://promosimple.com/giveaways/phil-mickelson-cbd-gummies...

https://groups.google.com/g/philmickelsoncbdgummies/c/qCnpN5...

https://phil-mickelson-cbd-gummies-get.footeo.com/news/2021/...
With regards to the database. Not UNIX root.
Sounds like the big problem here is the sheer API size rather than the language.
I recommend searching up "Handmade Hero" if you're interested in getting into C programming and are okay with videos instead of text (though there are text transcriptions)

I think technically he uses a C++ compiler but he doesn't use C++ features. It's the mindset of thinking about the hardware that helps in my opinion.

Also I'm not sponsored or anything. I just really enjoy the series.
Do you think it would be worthwhile to upload something like a master's thesis that ultimately did not get published through a traditional journal? That happens to be my case. I am alright with my supervisors' decision to not pursue publication, however I still wish to have it out there in some form, as it took a sizeable amount of effort, and it might be useful as a way to advertise myself.

On a tangent, is publishing the LaTeX source of a paper or thesis on GitHub something that people do...? I was also toying with the idea of writing my thesis with org-mode while including the code snippets I used for numerical calculations and graphs.
From memory the most applicable prior art is the "region free" firmwares for various DVD drives and, the drive hacks used to play "backup" (and some homebrew) games on the Xbox 360 while bypassing some of the attestation protections for online.

> It would be great if you could have more control over the existing hardware in these drives

You can blame the DRM lobby basically forcing manufactures into a veil of "security by obscurity"
How to DeFi? What are the trends, top dApps and sites, Discord servers? How do you follow the meta? It’s hard to find the signal when crypto and DeFi by proxy are already so spammy and noisy. And I say that as someone genuinely curious about this stuff.
But FAANG do. So why don't they raise salaries?
So, a store can't record that you bought something from them.
There's also a musician called E. He apparently chose that name because he wanted his music in record stores to be directly next to that of his band Eels. He kinda forgot that the Eagles alphabetically sort in between him and his band.
Blouson moto avec dorsale intégrée
Une élégante blouson moto dorsale intégrée de haut niveau. Introduisant des caractéristiques spéciales sur les fermetures à glissière, le devant entièrement zippé et le collier à pression. Profitez de la veste de moto en cuir noir avec un soutien dorsal exclusif pour un prix très abordable.
Why it is not only your fault
Should there ever be a web application that needs to run as root, it should be rewritten.
All logic requiring root privileges should be moved into a separate system service with a minimal attack surface to which the web application delegates those special tasks.
You don't really need this extension to use containers -- it just adds some convenience, but the main functionality (creating containers, opening tabs in containers, moving tabs between containers, ...) is in Firefox core.

There are also other convenience extensions that use containers -- like Simple Tab Groups, which allows creating groups and assigning them to containers. I use it and have no need for the "Multi-Account Containers" extension.
Congress decimates 911's digital upgrade
> But making the current state the primary thing is a huge step backwards

Why?

When is "I need to query all of my log to get the current view of data" is a step forward? All businesses operate on the current view of data.

> OK, fair, ad-hoc queries are one thing that relational databases are legitimately good at.

Not just ad-hoc queries. Any queries.

> But you're asking for trouble if you use them in your live dataflow or allow ad-hoc queries to write to your datastore.

In our "live datafows" etc. we use a pre-determined set of queries that are guaranteed to run multiple orders of magnitude faster in a relational database on the current view of data than having to reconstruct all the data from an unbounded stream of raw events.

> What do you do when a transaction fails?

I roll back the transaction. As simple as that.
I found an updated version online
If programing stopped there we wouldn't have an argument, its when you design high performant code that is maintained for over 10 years etc.
The only way Google could claw me back from DDG at this point is finding a way of eliminating the endless SEO spam and useless content mills from their results. It plagues both of them but at least DDG makes a point of being less insufferably nosy.
There is row level security. But that usually means many db users or sometimes usergroups are supported.

https://www.postgresql.org/docs/current/ddl-rowsecurity.html
Googly eyes and a dinosaur. For when you want to leave nothing to chance
The counterpoint is that it's now actually useless to craft a query that tries to match exact terms, because there's this extra layer on top of it.

So you might be lucky if the inferred intent of the engine was correct, but good luck steering it away. It doesn't help pretty much all query logic operators are merely hints nowadays, more often ignored than not.

I very much preferred a dumber engine for this reason, since it was way easier to search precisely and avoid SEO, even as the SEO game changed.

I'm also using a local searx instance now. I'm not terribly happy about it as bing/ddg also have very similar issues, so searching for exact terms still doesn't work the way it should. But it's much easier to blackhole SEO silos, pre-filter queries NOT matching my exact queries, as well as yielding more obscure content.
It's a convention. Same with small-o and e.g. Taylor polynomials in first-year calculus. Writing e.g. sin(x) = sin(a) + (x - a)cos(a) + o(x - a). We used an equals sign, even though the meaning of this string of characters is "belonging to a class" and not "being equal". It's kind of convenient for long calculations.
Nvidia DLSS Support Added to Valve Proton
There are XSS attacks abusing this behaviour named DOM Clobbering

https://portswigger.net/research/dom-clobbering-strikes-back
What's the problem having a HTTP client running in tests?
> Wolfram Alpha does this, and let me tell you: things I couldn't understand listening to lectures and trying to work through handbooks (well, most of them from the '60s, so take as you will), became clear in just a few days of work. I didn't cancel my subscription for 2 years after that, out of gratitude.

Wolfram Alpha didn't program everything, but it includes most things you will see in an undergrad. In my undergrad we used a 500 page reference book containing most of the formulas and notations of STEM undergrad programs, wolfram alpha is basically that book written as a program.

> I was pretty sure we're not talking about "pure" math. I mean, we both agree that that particular branch is of interest to a tiny minority. Of course the pure mathematicians can stay inside their ivory tower forever, nobody cares. Notice that I repeated the word "use" multiple times. I was trying to imply having a goal that's not mathematical in nature.

But then your main problem are mostly with computer scientists or statisticians math papers, not mathematicians. The problem with papers written by people who apply math is that usually they don't really understand the math, they just apply it, so they can't explain it well. There isn't much you can do about that. And papers written by pure mathematicians, they sure do understand what they do, but it uses mountains of abstractions in order to make the problem possible for a human to reason about so it wont be easy to understand either.

For example, most who study statistics views the math as a tool to solve problems. They wont put in the effort to fully understand it, and can therefore just give you the second hand explanations they learned themselves, and the result is that those explanations likely will be missing a lot of things. Pure mathematicians however wont understand the way you want to use the math as a tool, so they might have a full explanation or the math but they wont understand how to apply it in your field, so their explanations will also be bad. What you need is someone who did the work to study the pure math side, and then did a lot of work applying math, and then explain it. Such people are extremely rare though. I went that route, I knew a few others who did, but most of those I know didn't. They either went pure or applied, not both.
I even distrust myself. I don't run everything as superuser / with admin rights whole day long just because it's me.

The point is you should use elevated privileges when you need them. Not because some use case which is currently irrelevant for you might need them.
It's unlikely that they'll die from climate change. But it is much more likely that they'll die from wars caused by climate change. It is pretty much certain that their lives will be much worse because of climate change.
First of all, thank you for sourcing it. I don't have access to the paper, but the synopsis is very interesting.

I do however find it very weird. For example, how far-spread is Alzheimer's in Italy, where the Al intake must be through the roof. If this was to be believed, then all italians would have AD. (I am fully aware that logically, this is not correct, and that they could perhaps have developed some sort of immunity).

The same could be said about soda/beverage cans. Their use is so widespread that virtually everyone in America should have AD.

The scientific argument may have some truth to it, but I still find it weird that it's not "evident" in populations where Al intake would be through the roof.
(For those wondering, it's a unit from the old cgs system, rather than the mks we typically use today.)
If such a variant was not spreading faster, how would it ever become a dominant new strain? Just because of some unlucky incident on the other side of the world?
Some things to Try:

1. Microsoft Immersive Reader
- It has a nice text-to-speech feature which makes slogging through textbooks a lot more interesting

2. Active Recall
- After a study period, do active recall on the material by writing it down
I was asking the question to get a handle on base process pricing and experiences for a design currently utilising 500k LUTs and residing in a fpga. But I didn't want to get too bogged down in details.

Do you still recommend the 74LS30 for that?
Being immune doesn't mean that the virus doesn't "attach" to you, or that you somehow repel the virus. You still get the virus and you can transmit it too. You won't get Covid-19 (the pulmonary decease) but you still carry and spread sars-cov-19.

> This kind of cowardly

Your behavior is not 'bravery', but selfishness.
I built a $10k/year business while on a full-time job
I can't attest to ArXiv publication, I didn't consider it actually (I may now, though to be honest mine is not groundbreaking research by any stretch of imagination), but publishing the LaTeX source on GitHub is definitely relatively common. I and a few acquaintances I knew from my Master's program did that.