skysight-inc/HackerNews huggingface dataset:
FTA

> ... the fire was part of an alarming trend in the city, last year there were only 44 fires caused by lithium-ion batteries. However this year, he said they've had 93 fires, more than 70 injuries and now four deaths caused by lithium-ion battery fires. The FDNY is urging people to charge these batteries away from areas where people sleep, preferably in an outdoor setting.
You don't really have to be a billionaire. Land is pretty cheap if you're far away from a city. And people start similar permaculture and agroforestry projects all the time.

Also the reason for more monocultural forests like that is because the soil is high quality. If you had really low quality soil (like in the Amazon) you would have developed a lot more biodiversity
It also explains the risks of most option pretty candidly.

The takeaway from this wizard is that firefox has a fuckton of not-very-privacy-friendly stuff.

Why does Firefox support Beacons, which have zero user benefit and only exist to track users?

Why is the battery API still present, when it's been known for years that it is used for fingerprinting and tracking?

Why is Punycode allowed when it's known to be used for phishing?

Why is a hidden DRM extension from Google allowed to download arbitrary code? (Mmmmm, tasty tasty sponsorship dollars!)

"User privacy" doesn't actually seem to be much of a priority for Firefox these days.

Gotta pay for that skyrocketing CEO pay somehow...
> If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it?

a particularly foolish or over-confident defendent might represent themselves, but otherwise, I would not budget less than $2000-3000 to hire a lawyer to draft and file a response to statement of claim and show up in court to attempt to get it dismissed before it gets started.
This happened last week, for real with ${dayjob} customer. Put yourself in their shoes for a second.

Imagine you are Mr SecOps guy, and you've just ran some sort of Log4j tool across literally three thousand servers. Of those, several hundred came back positive.

Those included about a dozen flavours of Linux, a smattering of manually built(!) containers, and every version of Windows from 2008 R1 to 2022. Most of the code was built by third parties, some under support contract, some not. Most was built and installed manually, with developers using RDP or SSH to edit config files an whatnot directly on servers.[1]

So what you have now is literally just a string to a path, something like "D:\apps\foo\bar\baz\libs\stuff\thingie\log4j-core.jar" or the Linux equivalent.

Now what?

No, seriously, now what do you do? You're in SEC OPS. Not dev ops. You're certainly not in the dev team with access to the Git repo of some random vendor product like Tableau, or JIRA, or whatever[2]. You didn't deploy it. It got installed by a contractor during a short-term project three years ago.

A random hash string is totally useless to you. Even a repo URL and the commit hash will more than likely just end with an "Access Denied" URL, assuming you even have a network route to the Super Secure SCM Server.

There is no way you can figure out who needs to do what to make this go away. Not at this kind of scale at any rate. Not without first-class automation for literally everything. Which you can't have, because third-party software just doesn't play nice with any one tooling you'd like to use.

Containerisation? Bahaha... haha... snort. You're dealing with vendors that literally advertise "now with 64-bit support" and are unable to comprehend the concept of unattended command line installers. Vendors that insist on USB dongles for licensing. License that expire. Annually. And are tied to CPUID values. And on, and on.

[1] Oh, you think you can dictate release methodologies to these people? They're bureaucrats and they play politics better than you. Any word of changing their workflow in any way will immediately bring their boss, their bosses' boss, and maybe a few more levels up down upon your lowly head. You will have people literally screaming at you that your fanciful notions of build pipelines is "too much" and would "impact the work". That's the end of the conversion. I said THE END, and good day sir.

[2] Just get them to update it under their support contract? Ha-ha. Ha. Haaaa... We had vendors straight up lie about the vulnerability of their software. Then another vendor said that updating the JVM already mitigates the issues and hence they're not going to release an update. (Narrator: JVM updates aren't sufficient.)
Also bypasses throttling. Much faster, most of the time.
It's quite infuriating when you have a display that changes input if it's not receiving and a source that switches off unless it's told the display is showing. You end up having to play a timing game to get both devices on at the same time before one of them turns off or changes.
Fat fingering could be fatal.
Yeah, I remember that. That was a day to remember, a victory for the open source. The explosion in forks across many other git services, was so widespread and loud that github (apparently under pressure from google) had to pull back on their decision to shut it down.
That’s exactly why I used the phrase “source-available”, not “open source” - because those licenses aren’t recognized by the OSI. I’m actually of the opinion that if AGPL is open source, SSPL is too, no matter what some dorkwads as the OSI say. But I’m employed by a company that uses the SSPL, so I try to use the generally accepted phrasing to avoid being accused of “sowing confusion”.
Read on hacker news that Ivermectin is correlated with helping covid because often people with covid in developing countries also have parasites, so the covid + parasite can kill them. So if you give everyone in a developing country ivermectin the ivermectin will kill the parasite and they won't have to fight two things at once.

Turns out giving ivermectin (parasite killer) in a country where a lot of people have parasites is good public health policy. It's just butt stupid to use in a developed country like the US where ivermectin probably won't help people, but that doesn't stop people from taking horse dewormer in Florida :/.
> A lot of people mocking the author or others for being scared and worried are basically blaming the victim here, and I would like them to stop.

I don't think this is mocking (excluding the few obligatory spammers). It's a known fact that if you have a public e-mail, you will receive a lot of spam and threats. Also, an actual request could've very well taken a similar form - would you have been okay with this if they actually requested their data?

I'm not saying these actions were great. Sending out these mails was definitely not the nice thing to do. And yes, the threat of a lawsuit can be very scary. But, unfortunately, this is something you must be able to handle as a webmaster. It's also not great or nice that people try to log into my ssh server all the time, but this is just something you get when you have an ssh server on the internet. Same thing.
>thinly veiled legal threats

How is asking someone questions a legal threat?
Shokunin. They apply to the simplest and most complex tasks.
See https://www.businessinsider.com.au/shokunin-japanese-and-ame...
You have to do that in Rust too. But only if you really want to avoid a copy. Who needs to avoid copying strings? Chances are that is not the slow part of your program.
They had a functioning compiler and decided to concentrate on other areas and it's not too uncommon for a languages's compiler to NOT be written in that language. Afterall Rust relies on the non-Rust LLVM.
You write that reads will not trigger wear leveling, and then you go on to explain multiple scenarios in which reads will trigger rewrites. Those rewrites can cause elevated read latency. I have done SSD code reviews with multiple SSD vendors, and there are some which will trigger wear leveling after a set number of reads, instead of waiting for elevated bit error rates. And yes, the elevated read latency should be in the order of 5ms, which shouldn’t impact a properly buffered audio application, but the world is full of incorrectly designed applications.

https://storageswiss.com/2019/04/18/not-achieving-the-ssd-pe...

As for enterprise drives, there are dozens of tricks to ensure lower latency. Reading from other members in an erasure code, read prioritization over writes. It all depends upon how low of latency you’re trying to achieve, and with what level of consistency.

My point was that this drive may be using some innovative techniques to achieve consistently low read latencies in a “consumer” class drive. Possibly novel.
Wow, I didn't know it's possible to nerd out so hard on bike theft.
> The Institutional Review Board doesn't seem to be much of an "ethical board"

YES! I know you intended this as an insult, but it is actually one of the most insightful comments in the thread. An IRB is not supposed to be an ethical board. They have a much more limited scope of overseeing human subject research.

> How did they conclude this doesn't count as "human subjects research" given the expectation is to measure a human response to an email (framed as from a person)?

Because there's a precise definition of "human subject research" which is actually a lot more limited than many people think.
Seven e-bikes, one apartment, family of four. You do the math.
> People regularly get calls saying they are in violation of tax law and must pay.

This is an interesting point you bring up, which merits diving into a bit further.

I think it's precisely because CCPA is so new that this experiment is more unethical than if they were just calling up people saying "you owe money to the IRS, send me gift cards". The IRS spends a ton of money every year telling people that these calls are scams; but Christine or the operator of freeradical.zone likely had no such public service announcements from the State of California. On the other hand, they probably did hear news items about this new data privacy law that California passed, and thought the emails were from actual individuals.
Please close this thread on 26 responses
Obviously a word without vowels is an abbreviation of sorts. The only context I had learning the shell was from using DOS. The equivalent would be DIR, MOVE, COPY, DEL. DOS sucked but I did enjoy playing Lemmings.
Yes, I have had friends jokingly say they would request the information I have on them because of GDPR.
What's in it for them, if it turns out the community forks their project and do it better than them?

I don't see it as a sound argument.
For most people, availability is the key part of security instead of confidentiality, since for them losing their data is both much more likely and much more painful than someone getting a warrant to take their data from Apple.
I will if I want to target that kind of user. Personally I much prefer targeting people who have nice laptops.

Poor people are frequently low LTV customers unless you’re getting paid by someone else (say the government) and even in that case you only have to please the buyer not the user.

So maybe if I was building like payday loans or something.
How did Googs put pressure on Microsoft to have Github change their mind? What concern was it of Goog's?
On Android, you can inspect what activities are available, and invoke them directly. It's not a part of the standard installation but tools are easily available. This way, you can create shortcuts to get to most activities in one tap. With more complex automation software, you can even run them in a chain, or conditionally.

It's the closest thing to URLs I've seen on a major platform.

AFIACT most desktop software, built using whatever tools, is not structured this way, and cannot be easily converted.
I posted the link that is from the Homeland Security Digital Library.

It's pretty much not a troll post from 4chan.
I'm still waiting for concurrent COBOL...

PERFORM x CONCURRENTLY WITH y BUT NOT WITH z.
You’ve clearly never dealt with lawyers very much. The implied threat is pretty obvious to those that have.
Just going to tag along to my comment above. I can't help but notice the difference in tone of the responses to this article vs. the one yesterday (https://news.ycombinator.com/item?id=29599553) which I did not see. It seems those who participated in the thread yesterday had a quite different opinion.
> actually an incredibly common, totally everyday problem encountered by tens of thousands of developers everyday

I never said they're umcommon. As I said, I user them all the time. They're incredibly common in specific fields. There are many systems programmers who barely ever use them.

There are a lot of footguns with bitfields in C. (1) they know nothing about defaults, (2) they have no way of restricting values beyond bitwidth, (3) they are often inefficient, producing multiple load-modify-stores for what is really a single operation, (4) they are not endian portable.

svd2rust addresses all of those: (1) it knows what the defaults are and you can tell it to load them for you, (2) it will restrict the values for each field to only those that are valid (you can use unsafe to bypass the check), (3) it produces a single load-modify-store (or less) for any given operation, (4) it produces shifts and masks internally so doesn't depend on the compiler to behave as expected.

Of course, C bitfields don't require tooling, and I'd say they're a little easier to use. It's a trade-off, and I personally prefer the rust side.

> I don't think that requiring third-party tooling to implement something so basic is a suitable solution to this problem.

Don't most people auto-generate bitfields, too? Like sure, writing a couple by hand is fine, but I didn't think that's typical.

> What if the manufacturer of the device I'm working with hasn't released an SVD file? What if I'm not actually working on an MCU at all, but a peripheral driver?

You can write your own SVD, or write yaml and convert that to SVD. I think that would probably work for a peripheral driver, too.
You have found lots of old code.

... which we already knew existed.
I think SpaceX & others have a huge huge lead & democracy has let a failing policy of keeping jobs alive poison the job it needs to be doing. The governments can & should be competing, we shouldnt have to be letting private industry dominate, but politics prompts leaders to keep riding out inefficient & bad systems. Itcs not an inherent fault of democracy, but it is a present fault, & one we should try to safeguard against. The public should not give up advancement to the private sectors. A healthy cross competition is good.
I just shared that because that's how I learned I could SSH into my router at all. I'll be very careful around this stuff.
Management of Space debris & preventing Kessler syndrome seem like important things. Wish the article focused on that, rather than the political hot takes.
EDIT: Some grammar, and minor clause clarification in second-to-last paragraph.

Yes, frequently. And throwaway.

About once a week, I pick an account in my LastPass collection, and initiate the following process:

1. Initiate a CCPA data request using a form or email, and I always include language about the timeline. I am not a lawyer, I'm just a person.

2. Then, once I have the data, I delete the account.
I'm trying to purge my web presence before I move out of California. I have about 200 accounts left, and have done this with 50.

Admittedly, these are all large businesses, so far. Think Google, where I've worked myself, so I know they are equipped to handle it. But, I will be working my way down to small businesses eventually, and I am surprised to find out that simply quoting the statute (which is what I do) is considered anything but vaguely legally threatening. If the website doesn't fall under CCPA, or hell, if it does, I just expect it to be ignored. I mean no ill will.

I'm personally pretty conflicted, since I actually fully agree with this [1] about the study being unethical, but if I send an email as an individual to a website with my data, quoting a California law, that doesn't seem wrong to me, even if it causes $10k in legal costs, since my request is truly genuine and not intended to cause harm.

I would agree that there is a distinction at the study level, but I'm not exactly sure why.

[1] https://news.ycombinator.com/item?id=29599553#29601020
I think the derision illustrates a low ethical floor in the industry. Intimidating users with legalese is standard business practice, for instance in user agreements. The fearful effect it has on the less knowledgeable, competent, and resourceful among us doesn't even seem to register. It reminds me of abusive sales techniques that victimize seniors, and the salespeople who chortle at the stupidity of those who get taken in.
What are the legal requirements for a blog run out of American servers by an American to be GDPR compliant these days?

I'm sort of wondering whether you can get away with responding to such a request these days with "I am not in a jurisdiction that is obligated to comply with that law, and if you choose to charge me with violating it I am not under obligation to defend myself in court nor render myself for judgment?"
Did I just read that correctly? WAT!

Try hosting code on gitee that mentions Winnie the Pooh, tank man, or _____________.
Sure of course I'm biased to my own anecdata. Yeah sure you can find examples like ALF and ELF and even demonstrations like the 1990 WTO protests, but it doesn't change the fact that for basically the last 100 years the american "left" has been a pretty niche political movement mostly involving very academic post-marxist debates or sectarian conflicts about ml theorists. It certainly wasn't at the scale it was in the early 20th century and certainly not at the scale it's emerging to be now

Also saying Graeber gave us occupy is giving a lot more credit to him than I think is fair. And I think Occupy introduced a lot more people to Graeber than Graeber introduced to Occupy
When a company makes the previously impossible, possible, carping about them having some kind of 'monopoly' on their newly created market is the worst kind of carping.
There is no real person behind the inquiry. This is what made it deceitful and unethical.
> shipping a huge pile of code I don’t really understand

Isn't this right for any language, though?
This.

Asking for web sites that don't have 27 trackers, enormous hero images, a full copy of framework of the week, etc. is like asking for native games under Linux: the money isn't there to justify the added hassle and support costs.
Why would anyone think that a verbose language is a good idea?

Explicit? Sure.

But verbose?

There's no good reason for that, except that when Smalltalk was designed, we thought it was a good idea.

We know better today.
Why exactly /do/ deadlines matter? My experience has shown that with white collar work things are a lot more flexible than in school, sure there are "deadlines" but in almost all cases they are negotiated in advanced and lateness is accepted with, often weak, justification. The only thing college is more accepting of is tardiness but even with that you can get a lot of leeway depending on what company you are working for.

This is of course is a bit different for retail or blue collar work. It's kind of ironic that as you get payed more, the more you can get a way with.
I wrote a very simple html5 webapp which does this
http://webcam.apps.gbraad.nl never got around to mute the audio or so, but patches welcome!

I use two capture cards and them on th bottom monitors when needed (use 4 screens). This way I can also easily stream and records the screens when on a meeting that is on another machine.
faster at stealing your IP as well
I have a similar draft for this in progress (using signed PDFs instead of GPG), where I realised that you can do a lot with a Merkle Tree (Git) alongside a convention set on the public Cert Transparency log.

Effectively using the CT log as a cheap side-chain of sorts (LetsEncrypt!).
Emote is an emoji picker for Linux
Could you post your study proposal and the IRB response? This does not seem realistic.
> I think you [are] expected random people operating websites to share your knowledge of the legal system. I know you're right, but most people who operate a website likely don't, and these emails make them spend unnecessary time, money figuring that out; not to mention mental distress.

But if you're hosting a website, you should have that knowledge. I can't run a business and expect not to be asked about taxes, either. Honestly, as an EU citizen, if I wasn't aware of the GDPR in regards to my websites, I'd have bigger problems than some research study.

That being said, I fully agree that this mail wasn't nice and I can absolutely understand why people became nervous. But things like this are expected and the issue seems exaggerated in that light. Quite a few people seem to agree to this, too ;-)
ISIS emerged because the US decided to topple the governments of Iraq in the 200s and Syria in the 2010s.
If your kill switch manages to destroy evidence, that's generally obvious and has two consequences.

First, intentionally hiding or destroying evidence of a crime is itself a crime (self-incrimination is restricted only to verbal statements) of which you can be convicted even if you're not guilty of the original accusation;

Second, destroying evidence in this manner enables the legal concept of 'adverse inference' where essentially the judge can require the jury to assume that the destroyed evidence did contain whatever prosecution wanted to find there, and convict you based on that.
You're obviously being facetious, but probably most HN users really do feel this way.
Hm yeah, it would be surprising if a VIN intact car went to auction but I suppose the US has a lot of states and systems to communicate between.
> How is asking someone questions a legal threat?

Asking questions is an implied threat often enough that a question can indeed effectively be a threat.
Asking someone questions about their compliance with a law is not the same as asking someone questions about an innocuous subject.
A Russian with questions about California...

If the first sentence didn't already raise your suspicion, the second one definitely should, and put it over the threshold for spam/scam.
Does using Rc or Arc feel morally wrong?

Having shared mutable state, or doing bare pointer arithmetics is "morally wrong" in the sense that it's a constant source of bugs in production, sometimes dangerous. Any language that reminds you about that is doing a useful thing; C++ is very much capable of that, too.
Not really. The thing that makes youtube-dl useful is that it has one large dedicated community that can find ways to circumvent the changes youtube adds to prevent scraping. Basically, every few months or so youtube-dl becomes useless, and a huge distributed team has to kick in and find a way around it. When one of them does, they commit the change to one centralized place and it gets disbursed to everyone.

Without one centralized place, propagation of patches would take a lot longer, and youtube-dl would spend a larger percentage of time not working for most people. This is something the anti-piracy folks would be quite OK with, as it would lead to attrition among users even if not total eradication.
Super Mario Land Hack
To be fair, the problem with C bitfields that causes them to be forbidden in many coding standards is that don't offer "precise control over data layout". They are underspecified, so a lot of C/C++ code bases construct bitfields explicitly and manually (and these have other advantages anyway). And of course you can do the same in Rust.

Rust has limitations as a systems language but this isn't one of them.
That's only a problem if you use code that is unsound. Well-written crates do not incorrectly mark functions safe.
Web-scraped data is worth X.

Indexed & web-scraped data is worth Y.

A searchable index of web-scraped data is worth X^Y.