skysight-inc/HackerNews huggingface dataset:
I'm doing this year's advent of code with literate org-mode buffers using common lisp. Been a surprising amount of fun. And I'm coming around to the idea that the loop macro is where most languages are ultimately converging.

That and format. Which is remarkable. Certainly dense, but in a "this code is clearly responsible for making a string of that list, serves no other purpose." Something lacking in basically every other language, where a depressing amount of coffee exists simply to make a string of a list of objects. (Amusing, as Java finally got streams, which can look like LOOP, but with more periods. And probably more parens...)
The RCE isn't in the parsing.

What gets parsed is a string that tells the server to make a request to another server. If you use a weird protocol for that, like jndi:ldap, you can then return a class which will be automatically loaded.

So the code injection happens as the response to the remote request. The part the logger plays is that you can initiate that remote request by having the logger log some special string.
What is their revenue model? I barely understand the use case.
Lots of “ooh, the alternatives are too expensive” but that’s just a supply & demand issue that will be resolved the moment everyone switches to lead.
I have always liked these but felt it was too much of an extravagance to buy for myself and it is 25 dollars over your budget.

Etsy Link...err tindy

https://www.tindie.com/products/stephanelec/mooltipass-mini-...

But what programmer wouldn't want their own open source customizable authenticator?

Edit** I guess it is technically just a password vault but I think it is still a pretty cool gift. Another thing I think would make a nice gift is this (I must be on a password kick tonite)

Tindy Link

https://www.tindie.com/products/russtopia/psstm-mark-ii-pass...
It's not the same in Java logging libraries. You can write `logger.info("a={}")` and it won't cause any issues. At least that was the case before I read about this misfeature. I still think that log4j did absolutely wrong thing, because there are billions of lines like `logger.info("a=" + a)` and nobody's going to rewrite those lines. Breaking trust in logging library doing sane thing is absolutely terrible approach. I'm going to stick to logback everywhere I can, hopefully they did not do those stupid things.

Safe way should be something like `logger.info("a={}", a)`. Of course nobody's preventing log4j to parse any argument in any way they like. And they actually do. So with log4j there's no safe way it seems.
Yeah they’re gonna own all eth later 2
Yep cause the cost of people who can put together a smart contract without major bugs is peanuts :)
Then it just becomes a solution in search of a problem. Utterly useless.
Gamers Assemble: Play Games to Earn Crypto GameFi Explained-Stephen Ajulu
If you are a consultant, the answer is “probably yes”. Most consulting companies I’ve worked for or otherwise know of will market themselves based on how many consultants in the company have which certifications.

If you’re an in-house “individual contributor”, then that depends in part on your company. They might place a lot of value on certifications. Or not.

For you personally, I would say whether a certification matters to you depends on what you think your career path is going to be, and what value you expect to get out of a certification.

Some certifications are hard to get because they test you on a wide array of things, and if you have that certification, then that means you actually know something about the subject. But many certs don’t fall into this category.

For AWS certifications, the lower-level ones don’t have a great deal of value in my book, although I also confess that so far I only have the lowest-level AWS Cloud Certified Practitioner (AWS CCP) cert myself. But they can be a demonstration that you’re willing to put up with a certain amount of BS in order to get the cert in question, and they can be a demonstration of your willingness to go further and deeper.

The higher level AWS certifications do appear to have at least some real value, IMO. I’m on my own path to getting there, and I know how much work I expect to put into to get them.

I can’t speak for any other cloud certifications. I don’t have any, and I have no plans at this time to get any.

Disclaimer: These are my personal opinions only, and do not reflect those of my employer.
Secrets of the Autistic Millionaire: Everything I know now about Autism and Asperger's that I wish I'd known then.
There is definitely a problem re: large parameter models, the issue is I don’t think throwing software dev tools at this is the right solution.

The constraint is largely hardware. The incremental post training done via transfer learning is generally not broadly applicable to many use cases.
Email jeff@amazon.com. Although he's stepped back as president and CEO, I've heard that someone still monitors that email, and that serious issues get routed to a team that can actually take care of them.

It's worth a try, in any case, and it doesn't seem like you have much to lose, especially given their acknowledgement that your account was hacked.
I believe one method is to dab the chin rest with a drop of perfume to mask the scent of the violin.
The phrase "defund the police" appeared a month or so after the first protests. There was an existing niche movement to abolish police and prisons that was small but organized in Portland and Oakland and online. At first there was no message or cohesive platform, just anger. The abolition movement had plenty of slogans and content for young folks frantically searching "social justice" on their phones.

Also, police departments were flush with military surplus from excess war supplies and Homeland Security grants. So they showed up to the protests with tanks, full body armor, and automatic weapons. There was shock at those images that fed an older liberal response to "demilitarize the police". That was used to soften "abolish" to "defund". Coupled with some civic movements to shift budgets to mental health response instead of armed force, "defund the police" became a thing.

Very few cities ever actually defunded their police. Minneapolis itself voted it down.
There is already some actionable advice in this thread – I would suggest that you also call a lawyer to talk it through and see what they have to say. They might be able to contact AWS on your behalf.
I've come to the acceptance that lawyers are to the legal system as software engineers are to technical systems. You pay people who specialize in knowing the ins and outs of a complex system so you can get on with your life as a citizen, founder, etc.

And people who espouse that we don't need laws or lawyers to run our society are making about as coherent sense as saying we can ship a unicorn entirely on no-code and without engineers. It's in the realm of possibilities, maybe, but it will be a house of cards ready to implode unless this mantra is, at best, sheepishly abandoned half way through the endeavor.
New Kavli Center at UC Berkeley to foster ethics, engagement in science
Common lisp is surprising not functional. It embraces that all things can be first class things. But mutable code is very very easy in common lisp.
As someone who grew up in the Northeast, I feel like there aren't very many walkable towns unless you're essentially in the Boston or NYC suburbs. So many towns in upstate NY, MA, and PA had their main streets turned into major thoroughfares for cars... which made them completely unwalkable and miserable to live near, eventually killing the town. Most of my relatives who live near "cute" downtown strips can't even walk to them because their towns haven't bothered to build sidewalks even in the moderately dense parts of town.
Thank you for sharing that!

Imagination is a "mental muscle" that must atrophy with disuse.

Off-topic, yet relevant (for you):

When I upvoted your comment, your karma crossed 500, so you should now see up/downvote buttons in hn :)
This is such a massive footgun wow...
Feeble in what sense? Even absent blockchains, I only trust the people running the government in so far our incentives are aligned, and they aren't all that aligned at the moment.

Perhaps alternative structures of implementing governments should be explored.
Recommend Russel's Human Compatible. Three principles to guide AI development:

1. The machine's only objective is to maximize the realization of human preferences.

2. The machine is initially uncertain about what those preferences are but then is.

3. The ultimate source of information about human preferences is human behavior.
Is Web3 even a thing? Outside HackerNews, I only see it mentioned in crypto-circles, but on HN there’s another article at the top every day.
Agree, I think Wyomings attempt to fuse the two together is one to watch.

https://frostbrowntodd.com/wyoming-paves-way-for-dao-legal-c...
I'm sure. The work I do on a daily basis is comprised of at least half skills i learned from videos, and that percentage is even higher for my hobbies.
I think there's a tradeoff. Your implementation is also likely to have vulnerabilities you haven't caught, but it would be more obscure and maybe people wouldn't bother as much finding exploits for it. On the other hand, using a popular commonly used library, it will get tested for vulnerabilities a lot more thoroughly, reported and eventually patched, so it is possibly more hardened.
Fundamentally this is a format string attack. You're not supposed to do "log.info(user_supplied_stuff)", you're supposed to do "log.info("User sent: %s", user_supplied_stuff)".

Edit: This is wrong - the exploit works anywhere in log messages, even parameters: https://news.ycombinator.com/item?id=29506397

Seems like a late contender for dumbest/most-unnecessary RCE award in 2021. Java is uncannily good at those for a memory-safe language.
I can’t speak for the sending of existing code you’ve already done, because I’ve never done that.

I have done interviews where the initial stages were vague, and they couldn’t go into any more detail until you had signed the NDA.

IMO, that’s normal for interviewing for a position at a company or a group inside of a company that has not yet launched their product, or is otherwise doing sensitive stuff.
I think this video talks a bit about how Tailwind can be used efficiently.

https://youtu.be/nqNIy8HkEQ8
log4j2 supports lookups, which allows you to add additional logging context:

https://logging.apache.org/log4j/2.x/manual/lookups.html

The problem here is the JNDI lookup because for historical reasons there is code in these providers which causes Java to deserialize and load bytecode if it's found in a result for a lookup against an LDAP server. That exploit was partially fixed in the JDK in 2008, then in 2018, but there are multiple naming providers that are affected.

Yes, it's enabled by default before 2.15.0, released today to mitigate this issue.
Fair point :) I was admittedly thinking of more DIY scenarios, but it isn't really fair to only consider how it impacts programmers.

OTOH—without knowing many concrete details myself—seems like there would be plenty of room for reuse of contracts? Maybe even something like a storefront where you can grab one that matches your scenario
Mindblowing, really. There is that famous Fifth Element song, which is faked to some degree, if I had to name one example of alien music this one would definitely set the standard. It sounds otherworldly.
Facts change the minds of XXTPs, if you subscribe to MBTI.
"Yet even something as superficially simple but environmentally beneficial as removing the plastic shrink-wrap from an iPhone box induces a paroxysm of self-examination within the team. How can the unboxing experience be maintained? Can it be made more accessible? The problem was mulled over, pulled apart and ultimately solved with an elegant paper tab mechanism. The change will save around 600 metric tonnes of plastic over the life of the product."

You just removed some packaging that you initially thought should've been there, move on. It's almost as good as Apple engineering a bag and it getting a standing ovation
What to do if you fail to log in to a device?
What should I do if I fail to log in to the device through the console port in Telnet or Stelnet mode?
I watch most videos at triple speed or above. Takes some getting used to, but my brain got accustomed to it over time and now I can watch 3-4 times more youtube than everyone else in the same amount of time!
Like a company can literally spin off a division and make it public in a similar way. Or you can securitize cash flows into an ABS. The investment bank's fees will be a lot lower than the gas fees.
"20% are teaching something akin to core CS" seems to be a huge over estimate (off by 100x?). Most high schools would just have 1 CS teacher at most, right?
Hahaha, now that is pathetic! Hope the money is worth it, because everyone with integrity knows that you're nothing more than a bunch of doormats and spineless bitches for your corporate masters.
Would be great to see the thread of "replies" functionality also. I use that feature in Telegram and WhatsApp for chaining related stuff. I have long lists like that.

And separate streams for work and personal is definitely one use for me. And I create temporary streams for a project or a trip. Horizontal scroll could work great!
Pretending that something like that doesn't already exist in production, feels like a lie. As a fun example, I was looking to store durations in iso format, and saw how our analysts would have to parse that out in our data warehouse.
I thought you just rely on rsyslog or journald for this stuff...
You rely very heavily on the Høj, Jørgensen, and Schou paper. The paper states clearly and convincingly that property prices adjust for changes in property tax rates. I don't think that's surprising to anyone. Figure 1 in the paper shows this very clearly: lower property tax rates raise property values, and vice versa.

You then jump very quickly to the assumption that this means that landlords are unable to pass increased property taxes onto their tenants. The causal link is sorely lacking.

"With a Land Value Tax, the owner has to pay that tax every month whether they have a tenant or not. They're already charging the highest amount the market will bear, and as we've already shown, they are unable to change the supply of land. All the leverage is on the side of the tenants, which forces the landlord to eat the tax. The price to buy the land goes down, the price for a tenant to rent it goes down, but the total amount of income the land itself produces ("land rent") stays the same. A portion of it is just being collected by the taxing agency."

"Landlords are unable to change the supply of land" is, frankly, an idiotic statement, for a number of reasons. No landlord says "well, the quantity of land is fixed so I can't raise the rent now that my taxes are higher."

And furthermore, while that statement is true in a very academic sense, tenants don't live on land by itself. They live on land with a building on it. There is plenty of land out there that can support new construction. The supply of land in this sense is not fixed.

Provided the right incentives, nearby vacant land will be developed with new housing. And other buildings will be repurposed into housing if that's their most profitable use. Over the long run, housing supply is very elastic. People will get roommates or choose to live in RV's if the incentives are right. The iron law of supply and demand works for housing, just like cigarettes and gasoline.

Landlords operate to make a profit. They look at all of their expenses when deciding what to set their rents at. They don't care if the land is taxed, or the structure is taxed. They're looking at total expenses and seeing if they can get a tenant in their property paying rent at a level that gives them some amount of profit beyond their expenses. If you make it unprofitable for them to rent, you'll go from sky high rents to no rental units available in a heartbeat.

You're basically arguing for sky high property taxes, with the cherry on top being your Citizen's Dividend: "look what we could do with this new tax revenue!" That's fine, but maybe you should try owning a rental property before you make such authoritative claims with such little basis in reality.
Yeah. I’m not saying it’s perfect, there may actually be some limited use for blockchain technology, but casting it as an alternative to the modern liberal state beggars belief.
of course they do, that's the whole issue. in many situations it is better for the whole if people don't get everything they want. that's where regulation should come in. "people like it" is shortsighted thinking, prone to local optima, and should not be the sole criterion for policy decisions
I think you prob can raise a 10 mil seed round with this idea
Britain is in the anglosphere. We’re not exactly the Netherlands but we’re a whole heap ahead of the US, and getting (very slowly) better. Same goes for New Zealand.
Kushly CBD Gummies Reviews (Latest Update) Price to Buy
CBD Gummies and Hemp Gummies are being sold in many spots relying upon where you search CBD Gummies close to me. At the point when the producers of Kushly realized that they planned to make probably the best CBD chewy candies, they realized that individuals needed to purchase more than one container of it. This is the reason CBD chewy candies will have rebate codes, coupon codes and promotion offers, yet their ordinarily just temporarily. You should tap the button underneath to check whether they're actually offering it.

https://scamlegit.com/kushly-cbd-gummies/

https://www.facebook.com/sccamlegit/posts/1333049210472282

https://kushlycbdgummiesreviews.footeo.com/news/2021/12/10/kushly-cbd-gummies-reviews-latest-update-price-to-buy

https://bumppy.com/tm/read-blog/11270_kushly-cbd-gummies-review-2022-is-worth-of-money.html

https://www.protocols.io/view/kushly-cbd-gummies-reviews-is-kushly-cbd-gummies-s-b2rnqd5e.html

https://promosimple.com/giveaways/kushly-cbd-gummies-reviews-updated-price-2022-benefits-where-to-buy/

https://issues.apache.org/jira/browse/AAR-9027

https://www.tickaroo.com/ticker/61b2eda6855bb5b87769614c

https://kushlycbdgummiesbuy.substack.com/p/kushly-cbd-gummies-review-100-clinically

https://www.provenexpert.com/kushly-cbd-gummies1/

https://brand.sparkamplify.com/kushly-cbd-gummies-price-side-effects-and-more

https://www.folkspaper.com/topic/kushly-cbd-gummies-reviews--does-it-really-work-price-to-buy-5140062251515904.html

https://issuu.com/kushlycbdgummies/docs/kushly_cbd_gummies_reviews

https://groups.google.com/g/kushly-cbd-gummies-use/c/1_f83h-GRDs

https://twitter.com/kushlycbdgumm

https://brand.sparkamplify.com/kushly-cbd-gummies-reviews-scam-or-legit-what-to-know-before-buy

https://soundcloud.com/user-706666395/kushly-cbd-gummies-reviews-pros-cons-uses-scam-benefits

https://bumppy.com/tm/read-blog/11272

https://dribbble.com/shots/17034751-Kushly-CBD-Gummies-Reviews-Stunning-CANNABIS-ALERT-Is-it-R

https://sites.google.com/view/kushly-cbd-gummies-review1/
The problem with 3 driveways per block is you've just made a really low density set of stores. This means that you massively increase the average distance someone has to travel to get to the store they want. One of the main reasons to separate streets and roads is that it encourages tightly packed small shops which (especially when combined with mixed zoning) create low average travel distances. Lower travel distances mean fewer cars on the road (cause more stuff is in walking/biking distance) and therefore lower traffic.
Looks like 180 days

Page 63

https://www.sec.gov/Archives/edgar/data/1720671/000119312521...

"We and all of our directors, officers, and holders of approximately % of our outstanding stock and equity securities are subject to lock-up agreements with the underwriters that restrict their ability to transfer such shares of stock and such securities, including any hedging transactions, during the period ending on the date that is 180 days after the date of this prospectus, as further described in the section titled “Shares Eligible for Future Sale.”
Agreed. It's like when people starting throwing around "blockchain" as the solution for every problem. The same lot has adopted web3 as the thing they are shouting from their soap-boxes, without really understanding the difference between concept, technology and implementation.
It's not random noise. Look at the images in the paper. Horizontal lines, vertical lines, snakeskin patterns, Minecraft textures. Examples of miscellaneous surface patterns, in other words.

Back before deep learning, people used to make recognizers for features like that as a lower level of feature recognition. Now it's expected that features will be derived automatically from real imagery. This is kind of a return to that level.

A useful training set might be a big texture library used for game development or animation. Those are easily available.
No. Various 'consultancies' will tell you otherwise, but the only thing you really need to provide is a chance for users to delete their data. Ideally also an option to extract/download it, but I don't think anyone has ever really been hassled for that.

Contrary to all the BS the tech lobby says, you don't even have to have a cookie banner today I'd you don't collect datat beyond what is technically needed.
Yes in theory. In practice, justice is expensive to procure even when you're in the right, and sometimes even then you can lose just by being out-monied.

This leads to a more nuanced view of web3 and smart contracts: a way to acquire law-like order in business dealings at a vastly lower cost. Or put yet another way, if lawyers and the government got their act together and used technology to reduce the cost of their services (and actually passed on those savings) then smart contracts would never have been a thing.
An interesting angle to look at Web3 is the media angle. How it is talked about in the media.

It seems it is:

1: A very popular topic

For example, it comes up very often here at Hacker News.

2: A very controversial topic

On one side, there are many people who expect it to change the world in a fundamental way. Investors are investing billions of dollars into it.

On the other side, there are many people who call it useless, a fraud and outright evil.

3: This has been going on for years now.

Has there ever been any other technology for which 1,2 and 3 held true?
"Merry Christmas, friend. Please fuck off to Norway." :D
I have a car, and was excited to get one when I moved out of NYC a couple years back.

But I hate using it for day-to-day tasks. For me, it's a machine that lets me take fun trips on the weekend, or go see family in their car-dependent towns and cities. If I want to go to a brewery, or stop by the post office, or shop for a few small items, or just go to a park, I would literally always rather do it on my bike or on foot. Driving around cities is miserable.
When you grant a monopoly over items that have zero marginal costs, you are creating massive dead-weight losses. The reason that we use artificial scarcity is because then we can use supply and demand on that, and use the funds to reward the creator.

There will always be new things to create. Some think that because IP is a monopoly, you should tax the monopoly. But that's going at it from the wrong direction. Creating new things produces a positive externality to others. You want to reward that. This is a scheme that might possibly do so.
I can just add that WindiCss is worth testing. In my small trials it worked a lot better than Tailwind with jit. Windi with Vite gives me a really fast dev experience.

We'll see if UnoCss takes over.
So you're saying it's an outrage channel based on what evidence? You say that the car centric cities of North America are like they are by thoughtful design and that NJB creates outrage by depicting this design as verfiably inferior while in reality it is just "what works for the country". So can you elaborate what is better (and works better) about the design of a car centric "stroad" City compared to a walkable city?