skysight-inc/HackerNews huggingface dataset:
I think his point was that the Shenzhen stuff only rockets up like you say when you’re buying niche items.

For example, if you search for a good mixer, you’re going to get reputable brands at the top like KitchenAid, Cuisinart, etc. Conversely, when I went to buy a pull-up bar last year, there were only Shenzhen knockoffs because there are no big-time players in the pull-up bar industry.

There’s probably a nice parallel to be made between this subject and first-party and third-party games made for certain gaming consoles.
What should it tell me?
It’s a bit of a shame, the inability to modify requests for CORS will break a lot of frontend developer workflows.

It’s going to force the adoption of cors-proxy type solutions instead of a relatively simpler extension.
You still need to update the parent POM version in all sub-modules.
Or do you use version ranges or something like that for the parent POM?
"Overall, the potential for lead ingestion from contaminated ceramic mugs is minimal when compared to other sources, such as food. The Agency for Toxic Substances and Disease Registry (ATSDR) reported that the average daily intake of lead from food sources in the general population is approximately 56.5 μg/day (ATSDR 2007a). In comparison, the maximum daily lead intake from drinking 3.3 eight-ounce cups of coffee based on the data collected in our study resulted in a dose of 6.71 μg, over eight times less than the average daily lead intake from food. Nonetheless, exposure to lead should be minimized to the extent possible"
There are plenty of unknown numbers :) For example, the number that is 1 if the Goldbach Conjecture is true, and 0 if it is false.

(BTW, if you want to know the difference between constructive and nonconstructive mathematics, it's that constructive mathematics doesn't let you say "well, it's definitely 0 or 1" because it leaves open the possibility that there's no proof of either termination or nontermination in the current theory... which is basically the philosophical distinction under discussion).
I have done Scala for a long time, I had a chance encounter with Spring boot and reflections like no tomorrow style of programming. It was like a wake up call. I knew why I hated the complex juggernaut of the configs and magic but man do I hate to admit, how productive I was once all that was working. Sure someday it would not work and I would need to debug in my IDE but that was rare.

I have lived the life of somebody who wants to have every effect annotated, still on some level I believe maybe it can be achieved someday with ergonomics. I have done a lot of rust now and when I look back, I look differently at monads and those abstractions now. Maybe I felt smart using them.

There is some value in being able to just look at any library and being able to understand what and how. I have done this a lot in Rust. Scala has some amazing libs and I can't deny that they were immensely powerful, it wasn't easy to make sense of it all though, forget about tweaking and making changes easily.

All in all I have come to realise, there is no perfect paradigm, get work done. Use what makes sense. So stop fretting over dart/go, don't bemoan Kotlin, use Scala when you can and don't worry about making everything a kliesli. And really I would not worry about my logger having a side effect. Effect systems still sound cool though, maybe someday.

Not worrying about programming languages and code golfing has made me a much better and productive developer, I think.
user-agents are becoming increasingly frozen[0], and IP addresses are getting even more temporary with IPv6 (they already are for mobile networks). It's indeed possible to tie a browser to a user account server-side without cookies, but it's by no means reliable and providing a guarantee based on circumstances you can't control is a terrible idea.

0: https://chromestatus.com/feature/5704553745874944
From Tranco's "Methodology" page:

"We designed the standard configuration of the Tranco list to improve agreement on the popularity of domains and stability over time, using the rankings from the four studied providers as our source data."

(Alexa is one of their data sources.)
This is the one thing I cannot wrap my head around. How does anyone make any money on orders this low? Based on the screenshot the total was 12.28. UberEats takes 1.00 for a fee and I think some from the vendor. The delivery person gets 1.29.

Does UberEats pay a minimum for the delivery to the delivery person and the tip is addtional? If so, whose end does it come out of?

Are the delivery services trying to make it up in volume?
> Sure, but I’m suspicious when it’s the only one cited out of a “bunch” by a clearly hostile Tech Dirt. Some quick searches on Untappd suggest there are a number of breweries using Hershey trademarks unambiguously to imply their beer has one set of flavors or another. That’s likely infringement whether Hershey makes beer or not.

Are you saying Tech Dirt shouldn’t have criticized these actions because other actions might have been legitimate? I don’t really see much sense in such an argument so feel free to clarify your point if I’m not understanding you correctly.
I don't think that's correct. Open Source as a term was created in reaction to Free Software, which is RMS's thing. See: https://www.gnu.org/philosophy/open-source-misses-the-point....
This isn't how the real world works. Symbol patching is only effective if there's a symbol for it, which is often not the case (and probably wouldn't be the case here) if the binary has been stripped[0].

> Just look at what game modders have accomplished without access to source code.

Game modding is usually done on Windows given the target market (up until recently of course) and thus usually means Windows PE's, which do not have debug symbols attached - ever. Windows debug symbol databases are emitted as PDB files and are almost always omitted from game releases.

This means modding has to do a sigscan[1] in most cases in order to find something interesting - especially in the case of ASLR[2]. Then whatever modding framework (or hack) can set itself up and hook into the game.

These techniques are NOT what we should be encouraging, and are certainly not common, even for vulnerability mitigation. Re-compilation and re-deployment should be the defacto mode of operation in production, especially for systems that have sensitive information. Relying on bin-patching is not something many security specialists would regard as a "good" mitigation.

[0] https://en.wikipedia.org/wiki/Strip_%28Unix%29

[1] https://wiki.alliedmods.net/Signature_Scanning

[2] https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
But it doesn't need to. The overall solution, I mean. See another comment in this section mentioning they follow a similar approach but NOT using the IO monad.

Also: you don't need to know category theory to use the IO monad.
BTC is its own problem. I am talking only about NFTs and chains that make them possible. Major NFT markets now exist in Ethereum, Tezos, Solana and Algorand blockchains. Ethereum is the only one that has this problem and it’s working on ending it through an upgrade.
It's not criticism, just a joke.
We received this as well except

1. We don’t use Java
2. The instances in the email are not in our accounts

We later received another email providing some vague reasons for this…

On a Friday evening I was not very happy spending time trying to hunt down the invalid instances
You think that security and prosperity is inevitable, but it's really not. World war 2 was less than 100 years ago. There are plenty of people still alive who remember being drafted for Vietnam. There is a 100% chance that there will be another major war at some point. Overall, I fail to see your point.
Does anyone know about the quality of crypto implementations in Java Cryptographic Extension (JCE), the standard crypto library in Java?

We use a product that uses JCE. The log4j vulnerabilities worry me about the security of software in Java ecosystem in general.
Yeah I've been kinda wondering about what the deal is there - given the slow public build-up of forces it seems hard to imagine Russia going forward with an old-school invasion when all those troops will just be drone fodder. Is it for internal propaganda? A way to gather intelligence on Ukraine's defensive responses? I'm sure it's hard to tell from the outside.
Not relevant since BTC has nothing to do with NFTs.
From 1990, roughly ~600 self reported cases of negative vaccine related effects per year. Now, with the COVID vaccine, we are at over 20k a year and counting. From 1990 through 2020 there were various pandemics across the globe, including a few in the US. In that time, there were several innovations with vaccines, as well. So the dismissal that we are in a pandemic seems suspect.
Yes, but that doesn't help too much if you have to pay medical bills and lose the lawsuit. Of course better than having to pay the legal fees of the lost lawsuit, too. But still not as reliable as having a publicly regulated health care or health insurance paying your medical bills in the first place.
I agree with your analysis that this is a core issue, but something that bothers me with these discussions is:

> If you are a major power with the capability to make 100K+ killer drones

"The major power" is the people that make up the country, which largely don't support this stuff, but there's a handful of decision-makers that can push for this even when the people don't want it. I feel like it's helpful to focus on how it is individual people making these decisions that are going to harm others - not just a result of a country having a certain amount of power/capability. Any one of those people could go public and say that they're not going to let their country go down that path and that they'll discourage others from doing it, but they choose not to for fear of the results.
UberEats are shockingly bad in my experience (London, UK).

They constantly try to tempt us back with 40% promos, but we have sworn off ever using them again.

Last time we used them, every driver allocated to pick up the order abandoned the delivery when they got to the restaurant. I assume something was going wrong at the restaurant. This happened maybe 10-15 times, to the point that we were joking that the restaurant was murdering the drivers. The app didn't offer any ability to contact customer service, as it only seemed to unlock customer service after the order is actually delivered. None of the phone numbers online would get through to a human. We didn't want to order from elsewhere in case that order ended up getting delivered. It took 5hrs (!) before the app auto-cancelled the order.

Additional to that, the drivers rarely find my house, always turn up in different vehicles to what is claimed on the app and quite frequently a different person entirely. The order time is always longer than what it claims (much like Uber itself). The app is terribly unstable and frequency crashes, displays errors or loses my basket.

Deliveroo are so much better it's not even funny.
Tanenbaum made MINIX, ironically the OS inside every Intel chip.
I thought the reason for the bugs was that they are not getting paid to maintain this library?! /s
Yes they have done 94% of the work, only another 94% to completion.
> poor static compilation or static analysis

You're comparing it with python.
Why would I verify logging which itself is a verification instrument? And, seriously, how hard is it to emit a diagnostic message so I need a test for that to get it right?
And make it clear from the start to any potential buyers that it is a stolen bike?
> There isn't anything they can do that a human controlled weapon cannot do

Yes, there is: They don't require human operators, which are a limited ressource. You can only operate so many drones at the same time until you run out of weapon operators / "pilots".

You can't scale human operated weapons in the same way you can autonomous ones, can you? There is nothing stopping you from using hundreds of thousands of cheap, autonomous kamikaze drones at the same time, 24 / 7, if you have the money for it.

> That would be easy to evade by just staying out of the open.

How long can you stay in one building? How long could a drone (or two, with one recharging while the other is flying) circle above it?

Bombing a whole city with chemical weapons, killing countless civilians would cause a major international incident, even with countries not involved in the war / conflict. Killing single individuals with "killer drones" based on AI facial recognition will probably not :/
Attorneys general DGAF about cyclists. If they did, there would be more prosecutions for vehicular assault/murder.
> I think the objective should be preventing war

I agree and that's usually the connotation behind the words, "war is hell." Unfortunately, either the entire world agrees to never weaponize drones or we all need to start thinking about weaponizing drones. That's how arms races work.

If wars are going to happen though I think we are better off with drones rather than annihilating entire cities, civilians and soldiers together. It's important to elect leaders who are not cavalier about deploying drones needlessly.
I think people may sometimes forget thag, so far as 95% of the population goes, the internet is still a communication and commerce channels, with endpoints in meatspace. some endpoints are in liberal democracy, some in totalitarian regime. to overthrow the latter you need revolution or nationstate interference.

Policy change-politik-is a function of political will and political efficacy.

the internet is just an information conduit, end of day
They don't implement OpenGL ES2, they figure out the GPU / graphics drivers interfaces / etc, and OpenGL ES2 then works as more features are made available.

If they have coverage of the GPU, then Vulcan and so on will play for the features ES2 does. Besides you don't need support for all exotic features to run Linux with hw acceleration.
invest on what you believe. rock the boat.

You

Only

Live

Once

Make

Awesome

Moments

Over and over and over
Would you expect them to take measurements or do a double blind test if I was selling invisible pink dragons to improve audio quality and they were reporting on it? If anything, I thought the article was too tame.
Ask HN: What’s the main reason companies sponsor MIT Media Lab?
I’m fascinated by how MIT Media Lab has been and continues to be funded mainly by corporate sponsorships.

Wondering what the main driver is for companies to sponsor the R&D work.

Are there more examples of R&D Labs that rely on external corp. sponsorship deals?
> But a monkey?

Oh boy never test this out. They will attack violently and will not spare you. If they have enough numbers or have the pack leader(usually the one with the biggest balls) close by then they will retaliate.
I'm from south India and I have seen a lot of grown up men get roughed up by monkeys
Like prosecuting Facebook for colluding in the sale of stolen property?
I think this is what AWS GuardDuty is supposed to do?

Edit:
https://aws.amazon.com/blogs/security/using-aws-security-ser...

GuardDuty
In addition to finding the presence of this vulnerability through Inspector, the Amazon GuardDuty team has also begun adding indicators of compromise associated with exploiting the Log4j vulnerability, and will continue to do so. GuardDuty will monitor for attempts to reach known-bad IP addresses or DNS entries, and can also find post-exploit activity through anomaly-based behavioral findings. For example, if an Amazon EC2 instance starts communicating on unusual ports, GuardDuty would detect this activity and create the finding Behavior:EC2/NetworkPortUnusual. This activity is not limited to the NetworkPortUnusual finding, though. GuardDuty has a number of different findings associated with post exploit activity that might be seen in response to a compromised AWS resource. For a list of GuardDuty findings, please refer to this GuardDuty documentation.
It is pretty valuable to my debugging and general observability to log the URLs requested (including query component), which is user-provided data. I'm not saying I couldn't maintain my app operations without logging URI's including query strings... but it would definitely be more challenging.

Then there's the user-agent header, which also can be pretty valuable to debugging and other operations. Although this one is easier not to log.

In my current logs, I'm seeing attempts to compromise log4j vulnerability in both URL query string and user-agent. (Which of course I would not know about if I weren't logging them). This particular application has no Java involved, so is not vulnerable.
It's not difficult to take user-entered data and just dump it to a log file. I'm pretty positive none of these vulnerabilities exist with System.out.println.

The fundamental problem is that, pretty surprisingly, log4j was running the same parsing and logic on user-entered strings as they did format strings. That's essentially the root cause of all this - log4j shouldn't be attempting to parse this data at all.

So many severe vulnerabilities are due to the complexities of parsing potentially malicious user input - just look at all the severe iMessage bugs. While many other apps do have a fundamental requirement to parse this input, there is no reason a logging library needs to do it.
I doubt it. C++ syntax is all of: bizarre, hideous, and ambiguous and yet it never limited C++ because at the end of the day C++ was extremely practical. Smalltalk didn't take off (Im not going to say died because it's not dead) because the development tools were expensive and the runtime was frequently not fast enough and you needed a very powerful for its time computer to use it.

Also I think most super popular languages have a niche. Whether its webapps, text processing, low level, etc. Smalltalk lived in its own world and it was hard to integrate with the OS and other capabilities of the system, (try writing a wrapper for like OpenGL or other libraries for example) and I think that somewhat prevented it from finding a great niche to thrive in.
> Why should I show respect for software I hate using and that causes problems for the entire tech community?

You aren't expected to. You're expected to show respect for the medium with which you are expressing those thoughts (HN), and the other people you are communicating with on that medium, by keeping the discussion civil and doing your part to keep it from devolving I to a flame-fest.

Almost nobody cares that you have and express dislike for this software. They care that you're doing it in a way which encourages additional discourse which isn't useful and wastes everyone's time.

At extremes it's the difference between staying you think a person is immoral or untruthful with reasons and calling someone an asshole. One of those is easier to have an actual discussion over than the other.
In addition to your point, making the field(s) mandatory doesn't make it mandatory to put useful information in the fields.

It's better if people put nothing than if they put Lorem Ipsum.
Those last few percent are a huge amount of work, they were at 93% in July.

https://twitter.com/alyssarzg/status/1414354306157875204
The phrases "compiled language" and "interpreted language", despite their widespread use, are not particularly sound concepts. There are plenty of languages that have both compilers and interpreters.
My Fortune 500 company has to pay a third party to pay for Google Maps, because we can't pay a supplier with a credit card.

If we can't find a way to pay Google, there is no hope for some random developer in Nebraska.
uBlock Origin includes a dummy script that emulates the real Google Analytics script: https://github.com/gorhill/uBlock/blob/master/src/web_access...
Ask HN: Automated test case generator for openapi sepc
Does anyone use or know of a tool that will auto generate test cases based on openapi specs and execute those?
If their TV app is anything like their "My Spectrum" app for managing your internet service, my god, I don't have high expectations for these types of apps but having the gall to ship something that low-quality is legitimately impressive.
Even if you remove personal merit from the idea of college admissions, which most people do not, then you've still got a system that's selecting for the cultural knowledge and position of parents instead of the benefit received from educating a particular person. This seems to be working well enough so far, but it isn't optimal.

I never said that someone's income quantile was dispositive. If my parents never took the SAT and have no idea what it is, I'm at a huge disadvantage to do well on the test by any measure. Regardless of their income. Again, the SAT isn't testing for academic aptitude but for the cultural knowledge of parents and peers.

As a wealthy parent I know exactly how to throw money at prepping for one test: hire expensive tutors and purchase practice tests. Gaming years of GPA or coming up with a compelling story is more complicated and difficult to solve with the application of financial resources.

A system with vague and subjective criteria is subject to bias, for sure. They are also more difficult to manipulate directly with wealth (other than bribes). We have to decide what our priorities are there as a society.
1. The old testament

2. Liar's Poker by Michael Lewis
GP did a good job making his point. Human beings need to prove certain things somehow. Seemingly wasteful things like printing colored paper to trade satisfy this need.
I once worked on a reasonably complex e-commerce system with millions of products, add-to-cart, taxes, promo codes, etc. Every so often, an order total changed between the time that the user saw the total on the confirmation screen and when they actually hit the button to place the order (which seems to be what happened here). This happened because of promo applicability changes, product price changes, products being de-listed, etc.

But it was relatively easy to prevent problems with this. When the user clicked the button to place the order, we sent along the expected order total, the expected item IDs to purchase, the expected tax, etc. In the backend, one of the last validation step before the order was finalized was just to compare the final order details against those expected values. If there were any differences, the order was rejected with an error message to try again. There were then monitors on these types of errors which would go off if there was a higher-than-normal frequency of these sorts of errors, so we could track down any bugs causing price discrepancies.

I'm kind of surprised that UberEats doesn't seem to have a similar validation step.
There's an episode of Grand Designs (season 10 or 11 IIRC) where the couple building the home chose Japanese larch for the cladding for their home in Wales. The specialist lumberyard used some sort of handheld tool to measure the density of the trees (harvested in Wales) and it was extremely strong ... but the show also noted the strength could vary widely from batch to batch, depending on variables such as age, soils, etc.

Some details: http://www.cilfiegansawmill.com/forestry-wales/
Might want to read this thread:

https://issues.apache.org/jira/browse/LOG4J2-3230

It's pretty interesting technically, and it's not really affecting 2.16.0 much except in weird edge-cases.
After it therefore because of it.
Ther's nothing wrong with logging user-provided data. What's wrong is creating a mechanism where user-provided data can be interpreted as a program.
Number in Top Level Domain
Outer Wilds became one of my all-time favorites. It feels so lovingly crafted in a way that so few games do now.

For a completely integrated puzzle solving Zen experience, The Witness is also excellent.
You're doing it wrong. You enable visibility for recruiters and wait for them to approach you. I never got a listed job on LinkedIn, and it's the minority of the opportunities.