skysight-inc/HackerNews huggingface dataset:
For me a company of their size and, what I would expect, maturity, this new announcement does not satisfy me or provide me much assurance. Consequently I am still happy I have been recommending people against Ubiquiti since the original announcement from Krebs.

* Why was it so easy for a lead engineer to get access to a root AWS user without anyone else being notified? I.e. AWS GuardDuty provides FREE alerting for when an AWS root IAM account is logged in or used, this account should be under lock and key and when used, confirmed and audited by relevant persons or teams.

Start edit/

* Furthermore on the root account being easily accessed, the root account in the companies I've worked at had MFA enabled, and the QR code is locked in a safe only accessible by two people agreeing it needs to be accessed in a break glass situation, where warranted.

/End edit

* Why was he also able to delete critical CloudTrail logs and reduce their retention to 1 day? I.e. These logs should be in a S3 bucket or other environment where such changes cannot be made. Alternatively, they should be shipped to a redundant service that manages this risk to prevent data deletion

* Why did Ubiquti not announce they were compromised sooner? The hack started in early December, Ubiquiti noticed the compromise on Dec. 28. Ubiquiti told the market on January 11th. Is that a satisfactory turn around? Giving them some credit for the XMas break I'll say this partially understandable.

All the AWS configuration I'm speaking of above, I would describe as Security 101.

Most of these settings can be set and managed from AWS Organisations for free, and backed up with alarming and alerts for Guard Duty trivially. That a company of Ubiquiti's size and maturity had such basic risks not managed is still a concern.

I understand AWS Organisations can be difficult to set up for legacy AWS accounts, but even with that said, setting the alarms and monitoring up that would help manage the risk associated to the questions above is not difficult and should have been in place.

That Ubiqitui would only find relief ultimately from the developers poor OpSec rather than Ubiquiti's own security policies and procedures provides a commending perspective of their internal security posture.
There is a complex but ridiculously well-thought out pipeline for getting your order to your door, by the estimated delivery date.

If a few AusPost drivers call in sick, your package is one day late. If your Prime last-mine Flex driver doesn't show, the app texts other Flex workers with ever-escalating payments for the 'block' until someone accepts (as much as ~A$60-80/hour gross if it gets that high).
Did you ever get around to writing it?
You know, if you paused it, you closed it, maybe even mis-clicked you interacted with it, that's engagement for way too many metrics. You are not gonna consider them to not be or even be negative, who wants their numbers go down? Destroys the nice hockey stick chart, promotion, etc.

It's maybe not the best, but it's also not evil. And by that standard "somebody had a good day". I won't blame them. That's what teams, managers, corporate cultures, capitalism, the system or whatever incentive for, and that's what they get.
I’d be willing to bet that for most of the VPNs that are getting advertised by YouTubers (NordVPN, SurfShark, ExpressVPN, PIA, et al) it’s 100% marketing and they don’t actually care whether their “kill switch” works 100% of the time.

After all, they are not as trivial to implement as it sounds.
I use a lot of those in my work mail:

- open in different window: all the time. I am writing one email and searching/reading email archive for context. Also just keeping an individual message open in a separate window as a reference, while using main email window regularly.

- greetings line: I don't think it's a "feature" but I use it when starting a thread, especially when writing to people who I am not very familiar with.

- quoting entire mail: pretty frequent, for example when adding a new person to an email thread. Also handy for selective reply, it is easier to delete parts you don't need from quoted email than to start from blank and copy from original email.

- inline/attachment toggle: I don't think my email program has this

- threads split across mailboxes: not very helpful. But the multiple mailboxes is must-have.

- clickable message list: situational but occasionally helpful. Mostly when the is a thread with lots of messages, and you are looking for this rare message from the specific author.

- custom signature: I am don't have one personally, but some people put their position, office location and phone number there, and this is pretty helpful.

The email is different than instant messaging - it is harder to use, but is much more powerful if you learn to master it. The deltachat (judging by screenshots on their website) seems like a very basic and low-featured client, which unfortunately promotes bad habits in email, like writing short messages and expecting instant replies. I am glad it has not caught on.
I can only use translate for the text of the first link, and from the title/abstract of the second both appear to support the portions of your comment I didn’t dispute. I agree with those. To clarify where I take issue, I’ll requote the portion that stands out as unsupported to me:

> The same effect could be achieved […] by replacing the therapist by a doctor

Therapists, across a wide spectrum of practices and disciplines, are doing a whole job without also addressing their patients’ medical needs. The inverse is true too. While some increased focus on emotional wellbeing by medical practitioners would absolutely be welcome, I think it’s a very bold claim that they could replace therapists even “just” in a medical context. It’s also quite a lot of burden to place on doctors and patients alike.

I’m all for doctors appreciating the psychological benefits of emotional care, but I don’t think that’s nearly enough to “replace the therapist”, even if anyone involved actually wanted that.
The worst "attack" I've ever had was with spaghetti squash. I got the usual: bloating and diarrhea but on a scale I had never experienced before. I felt extremely tired void of any appetite for a couple days after. Really wonder what in it did it for me. Maybe it was a coincidence, or an allergy. Haven't figured it out to this day. Other than that, any enriched flour pretty consistently gives me light bloating.
lex and yacc depend on global variables, flex and bison, which are one the implementations of lex and yacc, don't.
They already are separated, in the sense that you can, and people do, embed Chromium-powered webviews in custom apps. I don't know if the particular app you're asking for exists, but there's no fundamental reason why it couldn't be built.

(Having to re-log-into everywhere on every new session sounds like a nightmare, though, especially with phone-based 2FA, which unfortunately is still the best that most sites offer.)
I’ve always assumed signal was a honeypot. They publish some source code but obviously we can’t verify the actual code running on iOS or (I assume) Android devices am I right? It seems like publishing open source could be a smoke screen. When they push code to devices they could link in alternate libraries that do whatever they want. They may even be able to push special code to targeted phones, avoiding detection by security researchers.
No.

That would take value add away from apple et all.

Install Xorg.
Remember, (one of) the revolutionary things about iPhone was that Apple just straight up refused to allow carriers to preload apps onto the phones.

I don't miss the days of Verizon attempting to hawk songs and ringtones on a janky, zero-upside store for $5 a pop.
like this? https://www.freepik.com/free-photo/hacker-with-anonymous-mas...
I have tenure and I may sign it, but I think it’s hilarious that several are at the same institution, Stanford, where this cancer is emanating from.
> No wonder why normal people like walled gardens, the UI is more streamlined and (mostly) more respectful.

Have you seen someone use Facebook as of recent? Respectful?
Danube Cloud, create cloud data centers on your own hardware
> tbf they're fairly competent with it, I don't think I've ever had anything Google related compromised.

It doesn't need to be compromised. The biggest ad and ad tracking company in the world has all that data.
I have crohns disease.

Many people with my disease report improvement or even remission with specialized diets, but what's interesting is how disjoint these diets are. Some people eat only meat, others only vegan, others high-fiber, others low-fiber, and so on.

The only similarity I can draw between these diets is that they greatly restrict the variety of food eaten. It makes me wonder if the modern practice of eating a variety of foods is harmful to our gut biome. I reckon variety results in constantly changing bacteria bloom/die-off scenarios. The blooms cause immune response flare-ups and accelerate bacterial evolution, while the die-offs cause extinctions, reducing the variety of our gut biomes.

Anyway, this is just an armchair hypothesis, but I'm curious to hear if anyone has thoughts on it. I note that it fits the story of Crohns being a modern "first-world" disease, as for most of history humans ate the same few foods everyday, just as animals do.

tl;dr: eating everything in moderation may be terrible advice
Container ships are crazy efficient in shipping dollars per kilogram not emissions. They use the worst most
Polluting fuel there is and because of their efficiency present a far more polluting option (ship across the world) as a logistic possibility to cut costs.
Accounts and actions like this are easily managed in AWS GuardDuty since they were so foreign from the user benchmarks. Outside of the normal security standards you'd expect of next level monitoring from companies such as CrowdStrike.

It took Ubiquiti weeks to notice these issues and he used the AWS root account, this account should be actively secured and alerted for abuse using AWS GuardDuty or similar.

I've made my own top level comment raising where I have more questions than answers from this announcement.
Curious, why isn't Edge an option? It's supposed to be the best alternative right now.
The word on this, I believe, is:

'The first strong law of small numbers (Gardner 1980, Guy 1988, 1990) states "There aren't enough small numbers to meet the many demands made of them."

The second strong law of small numbers (Guy 1990) states that "When two numbers look equal, it ain't necessarily so."'

'...the first few values of the interpolating polynomial (n^4-6n^3+23n^2-18n+24)/24 (erroneously given in Guy (1990) with a coefficient 24 instead of 23) for n=1, 2, ... are 1, 2, 4, 8, 16, .... Thus, the polynomial appears to give the powers of 2, but then continues 31, 57, 99, ... (OEIS A000127). In fact, this sequence gives the maximal number of regions obtained by joining n points around a circle by chords'

https://mathworld.wolfram.com/StrongLawofSmallNumbers.html
Chrome also offers the option to use end-to-end encryption.
That wouldn't solve this problem. The VPN issue was a 'killswitch' mode that was turned off, or didn't work 100% of the time. You could encounter the same issue with Tor. They didn't have their IP leak via webrtc or some special protocol, it was the VPN app itself with the bug.
All this got me to thinking: how did Russel and Whitehead originally compose PM, and how was it typeset? They obviously didn't use TeX. Whatever they did, it must have been a truly staggering amount of work.

For that matter, what is the source material for PM-RW and how is it being processed? Is there a manual translation process from a printed copy of PM, or are they using OCR?
This increasing placebo effect over time has been discussed for a number of years now. I'm familiar with it in the context of antidepressant efficacy, which has shown decreased effects over time relative to placebos for the reasons outlined in the piece.

There was supposed to be a big study of it jointly between the FDA and pharm companies, but the results were never published. I have this fuzzy memory that the FDA arranged something where the pharm companies would basically open their data vaults under the condition that nothing would be publicly released.

The speculation was, at least with antidepressants, that when antidepressants were first gaining traction, that people were unfamiliar with them and skeptical of the idea that a pill would decrease depression, or would do so without lots of side effects etc. As time went on, the theory goes, people developed this schema that "pill equals feeling more happy, less depressed" and so the placebo effect increased. So the increase in placebo efficacy had more to do with changing culturally mediated expectations (marketing?) than anything else.

Or at least that was the theory last time I read about it in any depth.

This stuff is fascinating to me for all sorts of reasons really and I believe it's really understudied.

There's some analogous debates in the psychotherapy literature, for what it's worth. The problem there is that therapy has been shown to work in all sorts of ways, but different types of therapy don't really have differential efficacy, espcially when you control for publication bias etc. But designing a "behavioral placebo" is really difficult, in part because it's so transparent, but also because at some point a behavioral control starts to look like a therapy. You can use drug placebos as controls, but that's not really the same.

My guess is the implications of placebo effects extend far beyond medicine into all sorts of other things, into psychosocial phenomena etc. E.g., what about a placebo for quality of living increases? Relationship satisfaction? Etc.
I can’t say I’m familiar with those myself! Sounds cool though.
They'd rather make NetBSD device drivers to support development - every OS (incl. Haiku etc.) would be able to port them then.
> Password protection via HTTP Basic Authentication.

> ...

> Optional TLS support.

I know it's supposed to be pretty minimal, but this is a bad combo. Great that TLS is offered but it should be mandatory if you're using the authentication.
My guess is non-Windows user.
This is a top-picks list, but I am obliged to self promote a demo I'm working on.

If you are making a podcast and want to share clips on social media, I made a free-to-use (no sign up required) audiogram tool.

https://app.milkvideo.com/focused-flow

How it works:

Upload a full podcast or a small part, we transcribe it, and you can add a title + subtitle, and get an audio wave animation + word-by-word captions. You can export as various dimensions for social media.

Please share any thoughts to lenny@milkvideo.com.
I've started using brave. Feels just like chrome and I can use the Chrome extensions. There's settings for everything so you can disable the parts you don't like.
I took a leaf out of zfs’s book and make all my apps’ output look like zfs/zpool.

Optional header, selectable columns, one line per record, machine readable (raw) vs human readable numbers.

I’ve nothing against JSON output but I just don’t need it when you can print out two columns, select on the first, and print the second.

$ users -H -o name,hair |
> awk ‘$1 == “gorgoiler” {print $2}’
gray

Admittedly, that awk invocation is so commonly used it could probably be a lot more terse. Also, this whole house of cards collapses when you have data containing spaces.
Covid Resilience Ranking:The Best and Worst Places to Be as Winter Meets Omicron
It's wild that the number of people in Israel who were both uninfected and not vaccinated is so tiny and skewed that they do not compute the number of risk-days associated with that group. I wonder how they make that judgement call. I also wonder what the risk-day values were during the beginning when there was no vaccine. Is it possible to construct a cohort of fully-vaccinated followed by infection? I wonder if this also becomes too rare and skewed at this time.

If I'm reading the numbers right, it looks like previous infection is better a year out by a factor of >2 than 2x vaccinated 6 mths ago (note they are not even comparable on the same time scales)
It's good that prefixes are now possible, but it's still something additional to know (I have never seen them in the wild and I've seen a lot of yacc in various projects), while most C++ programmers don't have to search inside some manual to know that two parsers must not have the same name : while with yacc / bison, you generally only discover it when it crashes at run-time.

Also http://gnuwin32.sourceforge.net/packages/bison.htm is not what "work fine on Windows" mean (hell, it does not even have the prefix thing you mentioned in the other comment). If there's anything ressembling a ./configure / some step that requires bash in its build pipeline then it's a complete no-go and given the GNU history of bison I doubt it'd use CMake.

Though even if all of this was solved, it'd still not be as convenient as Spirit.
Firefox recently started refusing to render pages for me on some sites, no amount of resetting the profile fixes it.

I'm curious why Edge isn't an option for you? I've started using it recently and so far it's a fairly decent experience. Sure, it's Microsoft and run into the same trust and privacy issues you get with Google Chrome, but that being said, my browsing habits are pretty benign so I just accept it for what it is. Let's be honest, options are slim when choosing a web browser.

Another browser on my radar is Valvadi [https://vivaldi.com/], another Chromium based browser with a ton of bells and whistles, most of which can be turned off. It has very much an Opera vibe.
This is literally the same nonsense your average HNer type says in reply to anything, so I won't bother explaining you shit, but if markets worked to fix things the world wouldn't have turned into shit after neo-liberalism.

So yeah if my barbershop is playing loud music I ask them to turn it down please, and if barber queues are too long, maybe it's time for barbers to be nationalised because the private sector is failing to keep up, no?
DB queries are a good analogy, especially if we qualify them as atomic operations. I’m hard-pressed to find a situation where procedural mutation-in-place makes more logical sense than an atomic update of the whole list, so why not make atomic updates the default?

It’s different if you’re working in lower-level code. I don’t intend to trivialize performance; the option to “go procedural” should be available. I just think it’s the wrong default. Operating systems and some kinds of Big Data need those perf boosts.

But for your run-of-the-mill CRUD app, map/filter is both clearer and safer than a for loop. Strong language support encourages this both algorithmically and syntactically—unlike what Java did, which is what I originally replied to.
Can addons remove these headers? Like say I'm using uBlock Origin, does that do anything?
loop optimization is intimately tied to being able to assume the index doesn't wrap and exit the array, no?

GCC says:

> -faggressive-loop-optimizations
This option tells the loop optimizer to use language constraints to derive bounds for the number of iterations of a loop. This assumes that loop code does not invoke undefined behavior by for example causing signed integer overflows or out-of-bound array accesses. The bounds for the number of iterations of a loop are used to guide loop unrolling and peeling and loop exit test optimizations.
Add some random diacritics to make text look creepy.

<https://lingojam.com/CreepyZalgoTextGenerator>
It’s not a great experience in a lot of ways, but it’s 10x better than every time I give in to curiosity and follow a Reddit link (all from here, this bastion of good web).
You were mischaracterizing the strength of their argument and only rebutting that straw man.
Chrome at least lets you opt into end-to-end encryption of your sync data. Unfortunately that isn't even an option on Edge yet.
When the article was initially posted, it was "Correlation between the advent of refrigeration and the rise of Crohn's disease."[0] Now that the title has been improved by dang/admins, I can understand and appreciate your confusion and misinterpretation.

Mocking was not intended. Thanks for your feedback.

[0] https://web.archive.org/web/20211206002300/https://news.ycom...
How would one have prevented their IP from leaking?
It's silly to think that WhatsApp wasn't sharing data with FB.
Their terrible advertisement [0] is a major turn-off.

[0]: https://arstechnica.com/gadgets/2021/12/microsoft-edge-will-...
>give consumers the ability to trade off visual (and audio) fidelity for usability on the system they have

They are able to for the video. You just think the tradeoff is too great.

With my OLED, I'm yet to see a scene in a movie where it is too dark to be able to tell what's going on. I agree that too many movies are too dark for pleasurable viewing though.

So I think if you bought a crappy TV then you can't see it properly, if you bought a good TV then you just find it a bit dark.

Unfortunately, with the audio complaints however, everyone is suffering, even people who bought high end systems.

I have a medium-high end calibrated 5.1 surround system with a sub. I still have the volume issues like everyone else, having to turn it up to hear the dialog and then having to turn it down for loud scenes so I don't blow the doors off.

Thousands of dollars worth of speakers and I still have to turn subtitles on to understand the audio sometimes.

So the annoying sound is clearly an "artistic" choice, or incompetence by the directors to ruin the audio for everyone.

But I don't think every single scene has to be bright just because some people bought systems that can't display dark scenes properly.

I agree to an extent with you, but regarding the visuals, because I use an OLED the dark scenes don't bother me much, so because it's adequate for me, I think it could be argued that there you have made a tradeoff with the equipment you bought. Sometimes I watch movies on my IPS PC monitor and that is bearable too.

With audio, there's no amount you can spend to make it adequate.

I'll put it this way, I find the audio nowadays much more terrible than the video.

I don't know why directors insist on annoying people in every way available to them though. It should be their job to make good movies, and a movie is about audio and video. So they're literally bad at major parts of their job.

It seems to be a fairly recent thing though. I wonder why this is happening?

Why do modern directors want to piss off their customers??
Microsoft now provide binaries for Debian and RHEL based Distros. Used Edge on Ubuntu for more than 6+ months for work, probably one of the best experiences I had with a browser now that I think about it.
When you’re actively persecuting a portion of your population, why not monetise it too?
My $50 TP-Link router came with a card in the box explaining their GPL compliance and giving me a link to their changes. I would think if I'm going to blow hundreds on Ubiquiti gear, they could at least match TP-Link when it comes to actually following the law.
Microsoft provides Linux and macOS builds (I use it on macOS whenever something doesn’t work right in Firefox, which is thankfully rare). If the reason you’re not using Windows is a Microsoft allergy though, that doesn’t help. Ungoogled Chromium works for that use case though.
thank you; i take pride in my documentation =]. and it's a lot of work; one ought have fun in the places you can.