skysight-inc/HackerNews huggingface dataset:
The main design mistake is including it, by default, in the first place, rather than requiring you to specify some kinda custom appender or whatever.

The idea that a logging framework could lead to an RCE like this is completely bonkers. The vast majority of users just want to log straightforward data.
as I understand, if we are running Java 8u121 this is not an issue... or is it?

that's what the CVE (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4422...) says:

> protects against remote code execution by defaulting "com.sun.jndi.rmi.object.trustURLCodebase" and "com.sun.jndi.cosnaming.object.trustURLCodebase" to "false".
Part of my family's muslim. I'll take my chances with the US and its guns, thanks.
Companies Rarely Grow into Their Valuations
How to Hack a Satellite
You can't separate preference from cost. Or, in other words, they prefer it because it's cheaper.
But they are practically useless outside of cities. No range so they are not an option.
Seems kind of reasonable. DisplayPort is exactly the same - just because your display supported DisplayPort 1.4 doesn't mean it is required to support 10 bit colour, VRR, etc.
My Sony would pop up a nag screen in the middle of a movie or show to remind me that it wasn't connected to the internet. Eventually, I caved and connected it.
What are the technical advantages of serving a static website with https?
Surely its $51/month (8 + 8 + 35)? Not that that isn't outrageous, but it's not 275/month outrageous
Linux Kernel Set to Finally Retire AMD 3DNow!
Sounds like cannot possibly write a nonneutral text!
> I don't want everything every day

Exists: mynews.com/rss ; mynews.com/world/rss ; mynews.com/economy/financial_commentaries/rss ...

> I'm more interested in what other readers (of my type) have found

Could be done: mynews.com/rss?u=q1w2 (upon cookie authentication)

But does a service properly clusterizing users exist? I do not know any... (I know about extremely badly implemented, clumsy attempts to automatically corner registered users into some sketchy profile.)
yes, people saw this coming well before October...
Does this content really have a place on here?
That's theoretically true, but I've seen research that shows that it doesn't actually play out this way in the real world
I’d really like to run this on a Raspberry Pi, but alas that does not seem easy to pull off unless I find a different base distro.
It doesn't matter if it was a waste of money, then

It's water over the bridge at this point
The Maven enforcer plug-in lets you fail the build if you'd depend on it either directly or indirectly [1]. Note this wouldn't find shaded usages.

[1] https://twitter.com/gunnarmorling/status/1469603432269062146
As I understand it that prevents the RCE, but not other variants like leaking environment variables.
That’s pretty much what the Security Manager is for, which Java has had since the 1.0 version. However it was rarely applied outside of Java applets, and is scheduled to be removed [0] because it is difficult to apply effectively and doesn’t cover all types of vulnerabilities.

[0] https://openjdk.java.net/jeps/411
iOS 15.2 adds new child Communication Safety in Messages feature
> but they actually had some stuff to show for.

Imagine a bug list longer than the universe. But finite supply! You could wrap them up as tokens and sell them?
Right? I'm in the market for a new SUV and I just took Toyota's off my list.
The alternative in cold, old batteries was an unexpected shutoff of the device.

https://9to5mac.com/2017/12/20/apple-statement-iphone-perfor...

> Lithium-ion batteries become less capable of supplying peak current demands when in cold conditions, have a low battery charge or as they age over time, which can result in the device unexpectedly shutting down to protect its electronic components.

They fucked up not notifying people when it's happening, but technologically the feature itself is entirely the right call. (You can also turn it off, and accept that it'll just die randomly if you do something CPU intensive in the cold.)

Regardless of which setting you choose, there's hardly a monthly fee for it.
> What should the consequences be?

The usual when you get up in front of a group and act like a jackass: social shame and ostracization. Something that's hard to do on internet platforms. Even when people are not anonymous, they have plenty of ways to "hide", and it's easy to unfollow and block people who criticize you for spreading misinformation.

So I don't know. Removal and deplatforming, IMO, is not the answer. You don't fix extremism through censorship; that just makes it worse and drives it underground.
You don’t fire a customer for being testy. It’s way disproportionate and if customers are unhappy you want to know this. Rude feedback is still feedback, and most businesses struggle to get honest feedback because most people are just way too nice
Dairy producers in wisconsin dump milk and put artificially short ‘sell by’ dates on their packages because they need to maintain a regular flow of product out the doors (and cash flow in) to maintain their operation. Milkers don’t keep producing milk if they aren’t milked regularly.

Whether or not the US funds rice research because poor allies can’t seems completely disconnected.
So my account was banned for 60 days , I could use the console offline but no multiplayer/chat features. I am paying a yearly subscription for Play Station Plus that includes some online features that were made useless by the ban, so I was paying for nothing (in my case I was a paying customer) . My son told me that he got threats from some guy that if he did not gifts him Fortnite stuff he will do many fake Abuse Reports to Sony , I could see this system getting abused and adding on top the chats were not in english this could have been the cause (I can't be 100% sure and Sony did not told me what exactly triggered this so AFAIK it could be a screenshot from a video game that triggered Sony bots).

The law should force this company to refund completely or partially when this ban is happening , or in this case they could have extended the subscription with 60 days. The law should also force them to tell me what phrase or image or report triggered the system, it might make Sny job harder but the law should make our live easy not some giant corporation.

In this case Sony last a loyal customer, I will do my best to avoid giving them any more money in the future, consoles or other products, so if anyone wants to implement a similar system that screws with customer keep in mind that the ones you screw over will not stay silent and will spread the word and you lose more then 1 potential customer.
Won’t be long before they have 5G chips in and that isn’t your choice anymore. Kindles have done that since 3G, cars have started doing that, Tesla trains AI on all owner driving data, VW new electric (ID3?) will be their first with a mandatory perma HQ connection, IIRC.
If your concern is only around the possibility of being banned - do you know if your colleagues were using the Play Store test track[1]? I am not sure if their service agreement would allow this, but apps in the test track do not require a review. It supports up to 100 users and is fairly cheap (25 USD for the dev account registration). I understand this is not what you're asking for, but if you will be working with non-technical people, this may be worth looking at it...

[1] https://developer.android.com/distribute/best-practices/laun...
I still had an USB 1.0 motherboard laying around not too long ago...
you forgot the link. Just submit again with it added.
Yeah exactly. As the article points out, if you give someone a gift card to a book store knowing they’re an avid reader then that person will presumably use it to buy some books they really want to read. Then when they’re reading they’ll think of you and feel good. On the other hand, if you go out and just buy them some books they might smile and thank you sheepishly but then those books might sit unread on a shelf forever.

People’s tastes can be very specific and so it may be very difficult to buy them a gift they’ll truly appreciate and enjoy unless you’re very close. It’s much easier to buy a gift card for a retailer (coffee, books, video games, makeup, fashion) in their area of interest than to try to buy something truly suited to their tastes. This is especially the case for casual acquaintances such as coworkers.
> without nonstandard log4j back-end configuration

By "nonstandard" do you mean different than default settings? It looks like they changed the default as of v2.15: https://issues.apache.org/jira/browse/LOG4J2-3198

For earlier versions (2.10+) it looks like there's a single setting you can toggle to prevent the lookup behavior:

log4j2.formatMsgNoLookups=true (or env var LOG4J_FORMAT_MSG_NO_LOOKUPS=true)
A true reality distortion api
Pro Tip: Cracker Barrel Country stores are great... They have tons of low-cost and quite universally likeable throw-away nick-nacks that you can pick up and keep in a closet of your house until an awkward "I don't know what to get this person" situation comes up. :P
It’s possible that it was exploited before the issue was widely discovered, right? I thought it had been in there for a while.
> 2. Mayfield had over 2.5 hours of warning from KPAH.[0] I’ve noted elsewhere that this tweet wasn’t a formal warning, of course, but it was a strong heads-up that something big was in the offing. At the very least, local emergency managers should have been aware of this and monitoring the situation very closely.

> [0] See https://cliffmass.blogspot.com/2021/12/a-critical-gap-in-tor...

I think the author of that blog post made a time zone error. He is referencing this tweet in support of "2.5 hours warning":
https://twitter.com/NWSPaducah/status/1469503102218760194
but Twitter tells me that tweet was sent at 9:03pm CT, not 7:03pm (Twitter would show him 7:03pm if he's on the west coast which I believe he is). So that would be more like 20-25 minutes warning (which is still impressive for a tornado), not 2.5 hours.
If it's 'bad-faith' actors, then you're saying that the misinformation is intentional, which makes it disinformation.
Thanks for the suggestion!

I have looked into it and it seems that even internal testing apps have to pass Play's content review [1]. I will check out Code Push / App Center.

1. https://stackoverflow.com/questions/64296562/google-play-con...
Better in what sense? It seems unlikely that a cup repaired with lacquer and gold dust would be suitable for hot liquids!
this is not worth upvoting ppl.
Help out in the comments and move along.

here's a previous recent thread on similar: https://news.ycombinator.com/item?id=26916096
It's not about race it's about access to modern medicine and the jobs an industrialized economy brings. The reason access to these things correlates with race in some nations is, said briefly, colonialism and its continuing impact. There are plenty of nations with birth rates below replacement where white people are by far the minority as well.
I'm learning Japanese (very slowly and more of a hobby) and being a caricature of a "gaijin who speaks like a woman" has always been a fear of mine haha.

Fun fact, katakana (more sharp and right angled lines) used to be for men and hiragana for women (more round and swift).
What is incredible here is that a UI developed in the 1980s is still attractive, and is arguably better looking and more usable than Windows 11 and Mac OS 12. What does that say about the last 40 years of usability and user experience research?
It's definitely appropriate to apply to multiple job posts at once. Jobs are reviewed by different hiring managers who look at your application independent of other jobs you may have applied.
It’s typically one page that hits Reddit/HN/whatever with its fixed set of static images. It’s pretty much the ideal scenario for the kernel’s in-memory cache.
Guys this is remote start. Not a key fob entry/start service.

Sometimes this can be done via cell phone app. And there is always a monthly subscription for this option.

But no it is not a monthly subscription for starting your car with your key fob in the pocket.
> I have also tried F-Droid, but at least on my Pixel 2 XL, updates of some apps downloaded from F-Droid often fail to install.

I've never experienced this issue when the app was originally downloaded from F-Droid (as opposed to apps downloaded from a different source). Apps in the default F-Droid repository are signed with F-Droid's signing key. Since apps signed with different signing keys cannot be automatically updated without manual uninstallation and reinstallation, apps in the default F-Droid repository can only be updated through F-Droid if it was originally installed via F-Droid.

Instead of using the default F-Droid repo, you can also set up your own F-Droid repo on your own server. This allows you to distribute the app through the F-Droid client, but signed with your own key instead of F-Droid's key. You would also have greater control over the release schedule, without needing to wait for the F-Droid build bot to release updates.

Repomaker instructions: https://www.f-droid.org/en/tutorials/create-repo/

Manual repo setup instructions: https://f-droid.org/en/docs/Setup_an_F-Droid_App_Repo/
The US society will have collapsed by then.
If they are drawn to scale, even the most biased individual would wonder why they are sending people to die to defend it.
Narwhal Project: Accelerator Rankings
I love Production IG for Ghost in the Shell SAC. Too bad the new series is so hollow and no real substance.
I for one will never buy a new car again unless there is a massive move back away from these "features" - even the ones that don't require a monthly charge. I don't want a car that phones home (much less that has components that phone home) to send information that has been harvested from my activities. I don't want a car that beeps or flashes when people pass me or the car thinks I have driven to close to something. I don't need a camera to back up. I don't want headlights that intermittently decide to change to brights. I don't want a car that is a glorified computer that's open to contact by blue-tooth and wifi. Its all just something else that will break and need to be repaired.

Looking forward to paying up for a 1975 era 4x4 when my current car gives out.
Your district is going to remove the mandates when pigs fly, I'm sorry to say. The "nightmare" is really about continually-shifting goalposts and the false promises of administrators. The funny thing is that those figures won't be reached, thanks to parents with enough common sense not to inoculate their kids with something they don't need. If the parents are vaccinated, let the kids alone. If the parents aren't vaccinated, well, that's their choice - so let the kids alone.
Nextstep did exactly what MacOS does today with the pinwheel of death.
Personally speaking I wouldn't see that as an alternative. Just doing a little above-the-table consulting work comes with periodic obligations. Why make a fraction of your income to still deal with the distractions?

I think you could just ask retired people who volunteer about the subject and get a good take on it.
I’m rolling — this is perfect.

Civilization has used dot notation in basically all thought, as evidenced by pretty much any nation’s laws / code
Idea: “unlocked” public bitcoin wallets with autogenerated key pairs that can be given to someone without them needing a pre-existing wallet.

1) transactions are instant and free, ie giving over physical ownership of a pub/private key pair (this could be done via scan of a QR code)

2) no prior onboarding necessary (avoids the repeated question “do you have this wallet/app?”)

Before, if I didn’t have cash, to tip a valet I’d have to ask them “do you have Zelle or Venmo?”, then I’d get their details, then send them money. Here, I could just pull out my wallet, create a new wallet with the specific amount, show them the QR code and say “scan this and it’s yours”.

Basically bitcoin gift cards without the store-specific lock-in.
> I could have just bought the device with a remote at Auto Zone for 1/4 of the price

But you didn't? I hope your realize at least half of the responsibility is on you as a consumer. You pay for and enable these idiotic ideas.
The problem is that Gutenberg is giving the village idiot a megaphone. Gutenberg can't say:
- Amplify your commercial business message to billions of people worldwide.
AND at the same time

- Well its your individual choice whether or not to listen to the village idiot.

You guys gave them a megaphone, how do you expect society to behave?!
I see it as a problem with the abstractions being on the wrong layer.
Those are fair points, I agree this is subjective. That's why I said "to me at least".

I've done this kind of work in the past and would certainly enjoy learning more. Your book was inviting. I just won't have the time at this moment. Need to focus elsewhere, as I said.

When thinking about business, the initial scale is quite small and managed services are cheap (and a variable cost) compared to the time I'd spend on self-managed (high upfront, fixed cost).
Optimizing Package Wrapping Efficiency with Machine Vision
std::optional<std::reference_wrapper<T>> is how we deal with this [lovely isn't it?].
Under the -- very rocky -- assumption that a Ministry of Obvious Bullshit could still avoid scope creep into moderating truth, I still don't think this would fix things. People who actively want to spread bullshit will find a way. It's like spam vs. anti-spam, ads vs. ad-blockers.
> it would be much better for it to be either me or my recipient who benefits

Better for whom?
this is the correct way, fast, no transaction fees, no one takes a cut
Why it's so hard for US workers to ask for time off
Well, we use Mailgun at work and it’s pretty great. I’ve only ever had one issue with it and it and their support was outstanding.

As somebody who used to work in enterprise support, I don’t see them as having done anything wrong here. It’s just somebody reaching out to do their job.
Unrelated, but one of my favorite quotes from PKD is this one from Now Wait for Last Year:

---

“All right," Eric agreed. "If you were me, and your wife were sick, desperately so, with no hope of recovery, would you leave her? Or would you stay with her, even if you had traveled ten years into the future and knew for an absolute certainty that the damage to her brain could never be reversed? And staying with her would mean-"

"I can see what it would mean, sir," the cab broke in. "It would mean no other life for you beyond caring for her."

"That's right," Eric said.
"I'd stay with her," the cab decided.
"Why?"
"Because," the cab said, "life is composed of reality configurations so constituted. To abandon her would be to say, I can't endure reality as such. I have to have uniquely special easier conditions."

"I think I agree," Eric said after a time. "I think I will stay with her." "God bless you, sir," the cab said. "I can see that you're a good man.”
For sure, nobody needs to worry about reading any of the books other than the original. The story begins, happens, and ends, all in one not-very-long novel.

After that novel is a whole series of novels that follow Ender into distant futures and places, as he literally runs from his past to keep it from defining him. The first one, Speaker for the Dead, is very recommendable for follow-up reading. The others I would only recommend if you've already decided that you want to read more of the series.

However, there is also a different set of sequels, and the first of them is the first book I would recommend to anyone who wanted to read more: Ender's Shadow. (Like Ender's Game, it won both a Hugo award and a Nebula award.) It takes place during the same time as Ender's Game, but from the perspective of one of the secondary characters. This second series of sequels generally takes place on Earth in the time shortly after Ender's Game, and follows Ender's siblings and the other Battle School characters. Like the first series of sequels, I won't go out of my way to recommend these to people who haven't already decided they're interested in reading them.

AS I write this comment, I learn that Orson Scott Card has been writing prequels: a trilogy in 2012-2014 (Earth Unaware, Earth Afire, and Earth Awakens) describing the First Formic War (which took place ~50 years before, and is heavily referenced in, Ender's Game), and a not-yet-complete trilogy since 2016 (The Swarm, The Hive, and the not-yet-published The Queens), which appears to be about the actions that were taken after the First Formic War to produce Ender. The reviews on Goodreads are promising; I might read some of these.
Do you have a desirable username?
Some people seem to be blind to the fact that access to a firearm lowers the cost of killing (by making it easier to do so); and what lowers the cost of something will encourage that behavior at the margins. But Switzerland! Sure, they've managed to thread that needle through education and regulation. But just relaxing gun laws without counteracting that in some way will of course increase homicides (and suicides, similarly). The US is case in point.
Exactly. You can have very sophisticated, non-linear, dynamic models developed over many years by brilliant people, then still see the models fail miserably.
Some ISPs inject their own ads on non-encrypted pages. It was a prevalent practice in Russia as early as 2007-2010. Not sure if it's true for other countries and modern times, but the technical point is still valid: by using HTTPS, this kind of attack on your personal blog is eliminated.
I tried the request mapper link, with two URLs.

http://news.ycombinator.com

http://cnn.com

Warning, the second one takes a while. I remember hand-coding HTML and "bloat" was a page that took annoyingly long to load on dialup. Has it really been worth it?

Coincidentally, last time I used dialup, Hacker News worked just fine.
It comes across as desperate for outrage. "One of my vendors tried to upsell me", the horror!

I get a half-dozen emails like this every week. Most I ignore. If I'm feeling uncharitable I mark it as spam.
> Personally I'd like to see more runtimes with some concept of capabilities. As a user, I'd like to be able to say "this package cannot make outbound calls" rather than doing so at the program or host grain via layer 3 or layer 7 firewall rules. I think maybe Deno allows this, and I wouldn't be surprised if JVM or .Net did as well.

Unfortunately both of these platforms have removed their security controls - the JVM's SecurityManager[0] was deprecated and recent versions of .NET have dropped
sandboxing.
[0] https://openjdk.java.net/jeps/411
Are you suggesting there are no car makers without monthly key fees?
Eureka 7 hits like this in parts, once you get past the first bits, you get to see the reality the world is built on.
Its brilliant!
This headline is all over the internet. But if you read the article till the end, it turns out that the account was restored, and Instagram apologized.
As always, when it comes to headlines, clickbait is more important than truth.
China Unleashed Its Propaganda Machine on Peng Shuai’s MeToo Accusation
I'm not sure it's that one. There isn't anything going on with the subject, it's still in nominative case, while the verb is doing funny things.
Thanks. I'm glad to know it's not what it appeared at first glance. And apologies if I drew any unwanted attention to your account.
...so well defined that famous art posted by museums now gets blocked by over-eager bots and moderators...
https://www.sqlite.org/whentouse.html

See: Situations Where A Client/Server RDBMS May Work Better
Is it really confusing? The people who need the specs of HDMI2.1 (like gamers) will do their research.
As the other commenters have pointed out, "better" is kind of a weird take. I don't think the linked story uses the word "better" at all, and kintsugi isn't really about making something better - but rather about embracing imperfections and finding beauty in something that was broken and could have been discarded, but was instead restored to use.