skysight-inc/HackerNews huggingface dataset:
I've done security reviews for a dozen companies. This sort of thing is startlingly common. Every single company I've reviewed is doing something that in retrospect should have been obvious.

I try to tell people: "You don't need AI security, you need a checklist."
Colonial Pipeline reused passwords, shared passwords, used the same password for all VPN users, failed to rotate it when people left. (that's 4 insanely basic violations of password security). ANY human who did a security review would have caught that. Even an intern who knew nothing and furiously googled "information security review" on the bus on the way in to kick off the review. (no disrespect to interns in over their heads, my point is they didn't prioritize security so they didn't get security)

Capital One used an admin privileged instance profile attached to a publicly accessible admin interface for a security tool (which tool, by the way, had no need of admin credentials). They were hit by an SSRF vuln and leaked their admin credentials. They also failed to alert of unexpected use of those credentials (try it, use of admin credentials is rare enough you won't have a lot of noise) failed to alert on large outbound connection (this one is subtle, but worth doing if you can figure it out)

Equifax failed to apply security updates regularly (just turn on automatic security updates. People suck at chores) Failed to deploy a SIEM, failed to conduct periodic security reviews, failed to put capable security people in place.

The above are not my clients, just public reports to illustrate that everyone can benefit from a security review to catch the obvious errors.
Why in god's name would you pick it up later? Installing it in the first place was a huge risk. Removing it is just doubling down
Good lord these comments.

The man gives perhaps one of the most important speeches in American History, and of course here comes the silicon valley brigade to tell everybody what he really meant.

He was speaking to 250,000 people after a massive civil rights march. This is what he chose to say. I don't think we need anybody to interpret it for him.
A comment as an European outsider to our fellow americans here in HN: I would say this speech is not just american but it belongs to the whole recent western culture as much as May 68, the Carnation Revolution, or the fall from Berlin's wall.
It's more of a Utica expression
There was no more "food". An loop in a script isn't malicious, as a user can terminate a script and by running an unknown script they are assuming some liability as well. What you're advocating for is that if an open source developer changes their code, even to say, prompt the user to confirm executing when before they didn't prompt and that somehow breaks automation that the user has built (not the developer) then they should be liable for harm. It sets terrible precedence, and the end result is no on will want to create open source software anymore. I can only hope you are simply playing devils advocate than being serious, cause if you are serious then I hope you reap what you sow.
It won't make any sense if you haven't watched the film.

Basically you're looking for charismatic/deeply delusional founder, money-grubbing lawyer, smartest-person-in-the-room theoretical person, old-fashioned person who complains about the new way of doing things (but who might be right), scientist who cares only about results and who has no ethics, annoying kids.

It's more a joke that I've seen play out in real life than a truely common method for analyzing dysfunction.
I was one of the Aqua haters, but I got used to it quick after installing OS X Public Beta and switching it to the graphite color scheme. Doesn’t mean I don’t miss OS 9 Platinum, though. I’d be interested to hear from anybody who spent time using the Dark Platinum/NeXT hybrid desktop of Rhapsody and OS X Server 1.0/1.2, although I have to wonder if there was ever anyone who used the server OS as a daily driver.

Fun fact: OS X Public Beta had an Easter egg setting that I can’t quite remember, defaults write com.Apple.something or other, that would set all Cocoa apps to a straight-up NeXTSTEP appearance. It completely broke usability, though, as windows would minimize into little squares in the corner of the screen a la NS rather than into the dock.
Oh I’m not opining on this or that coin being tulips. A lot of it is by volume.
Ghislaine Maxwell ends fight to keep eight 'John Does' secret
It used to have a built in tool to move nodes it has placed. All I can find scanning the docs right now is the -n flag to neato, which will honor existing pos fields.

Edit: dotty is what I was trying to remember.
Jikes, that's even worse than I thought. So then they will probably just go for another coin and store it there. Not sure how else. Or maybe they'll raise a few billion after this victory /s

Unfortunately, things like that actually happen even though everyone here would consider it a joke.
Ask HN: What's the best place to get investing advice?
Are there are any forums like HN, where you guys go to get investing advice/suggestions? I know Bogleheads is one, and I frequent it occasionally, but the advice seems to boil down to "avoid active investing, and use index funds."

Basically looking for something that offers more diverse perspectives. Surely there must be something more to personal investing than buying index funds or YOLOing random stocks.
> but there is no revenue for a digital currency

Isn't there? Ethereum kind of has revenue in that transaction fees for smart contract execution are burned (effectively a stock buyback)

It has around ~$19B in revenue extrapolated at the current rate (although it's issuing more than $20B a year for now, planning to reduce issuance some time later this year)
1,200 US flights canceled Monday as winter storm pummels East Coast
What sources are you referencing that make your argument impartial?
As far as I understand, Dagger is doing more stuff on compile time and was meant for resource constrained environments like Android. There is no feature parity between the two.
> Why aren't Apple's shows (and movies?) appealing to you?

Isn't this basically just asking why doesn't Ted Lasso appeal to you? I think the biggest problem is Apple doesn't have much of a catalog.
Yeah, once I caught gist of what was bothering them, I would've just nuked Libre from the title and all translations.

Just call it the Card Wallet and be done with it.
It didn't feel anecdotal when I was the one trying to modernize systems like these in the face of vendor apathy (or active hostility) and business resistance to change, because they had 10+ years of legacy "code" built in these things.
> No, as IEEE754 doesn't even guarantee that `a + b` == `a + b`

What? I'm pretty sure that is plain incorrect. Can you back that claim up with references?
> I'm genuinely interested in hearing from people who believe that Apple

I'm old. I like that I can generally trust installing apps on my phone because Apple vets them. It is one less thing for me to think about.

Likewise, I have young children. I also like that I can generally install an age appropriate app for them, because Apple's vetting process. Again one less thing for me to think about.

On the flip side, I banned the kids youtube app, until Google came down hard and removed ads and started moderating videos aimed at kids. Prior to that, it's algorithm was serving up highly questionable content to kids. Now, I feel more confident letting my kids watch videos on Kids Youtube (though I typically have the sound off...)
Is that a HEAT round?
It’s sad that this dream has not been realized.

Yet if you remember what the day of Nov 5, 2008 felt like.

This speech was playing in the background, and the feeling was we were living in the day he dreamed about it. A black man had been elected as the president of the United states.

Yet even in that glorious position it was not powerful enough to end the oppression of black people.

Is this dream just that? Is it a dream that cannot be achieved. If the president of the United States can’t bring it about well then who can?

Or what if it has already been achieved and yet we prefer pretending that it is not. That there is something else in this dream being fulfilled that scares us even more than it not, so we go back to the way it was.

I though when Obama was elected we would put the divisive Clinton and Bush years behind us, but instead we’ve grown worse. If anything the cancer has spread more rapidly.

Yet I still think MLK’s command is good - “Continue to work with the faith that unearned suffering is redemptive.”
Still the best version of OS X.
Imagine if they kept the monochrome design but gave every icon a different shade of red. It would get us so much closer to the colourful past !
Bidding farewell to Tigress T-15, the Queen of Pench
You mean "statistical model" is kidnapping "model" from its true meaning?
Oh man. I remember Rusty N Edie’s. I was a pre-teen just exploring the online world. The Demo scene was being born, music and was collecting MOD files and of course, the games. There were wholesome fidonet on-ramps and BBSes too.

I’ll never forget those first modem days of a teenager discovering the world.

Back then you had something in common with anyone on the BBS just by virtue of being on a BBS.

Young me would be proud of the geek I still am today.
I really struggle finding a lot of stuff on Netflix, but frankly I do on most all of them. I know that Netflix actually has a much larger catalogue than I'm seeing when I login but it's impossible to get to in order to find anything. Amazon Prime video is even worse at discoverability.

The thing is that Netflix has established itself as a staple and most no one is going to cancel it unless they are just hurting. Netflix knows that and has hiked prices to show it has market power. It's like Amazon Prime, I honestly don't order enough from Amazon to justify that expense each year but when I do use it, it's convient.
Of course such an obvious account would be attacked. It is very easily scripted. first.last@, last.first@, etc are all going to get pounded. Corp email policies are just ripe for scripting attacks like this.
Give some example of a task description and a timeframe that you've delivered it. Then we can estimate.
I think the fact that Netflix has been increasing prices faster just means they have had greater pricing power than cable cos.
…and, arguably, if Apple, Disney, and the others hadn’t come to market, Netflix would have been raising prices even faster.

If you think how much you are currently paying for the “content” component of your cable subscription, that’s no surprise Netflix is finding that pricing power.

With the likes of LG and Samsung even making their own channel offering available for free (at least on mid/premium TV sets), if Netflix, HBO, Disney, Apple keep raising prices, I suspect the first thing consumers are going to want to do is to stop paying for content from cable cos. (and keep all the premium subscriptions)
I ran into a site I was fixing that used an older css framework.

Buttons had depth and looked like candy…. I really liked them.
It's taken us something like 30 years to start seeing wide IPv6 adoption. Even then most a running dual stacks to still support IPv4. How long do you think it would take to have a secure email protocol running by most users?

It could probably happen quickly if a few big players came together and made the push. Unfortunately the only innovation in email these days is occurring in ways that help user lock-in. E.g. IMAP is stagnant, Gmail added 'dynamic emails' that only work in their ecosystem.
Yes, what Dr. King says is born out again and again. It is the code, they key, to much of what is happening today. It is one of the most revelatory, insightful documents I've read in my life.
I don't seem to have that option? https://p.mort.coffee/fLT.png

I'm in Firefox, where the feature exists but looks a bit different. Maybe the setting only exists for Chrome.

Fuck Google and their consistent clearly intentional anti-Firefox behavior. Google's websites are in general the worst when it comes to cross-browser compatibility.
Me neither, nor my girlfriend. Seems like they are vastly exaggerating the number of people that have heard of this!
> I want all my messages and history on all my devices wherever I login with the proper credentials

Is this not possible with XMPP? Genuine question. I thought there were recent XEPs for standardized handling of message history (including export/import).

edit: it’s here https://xmpp.org/extensions/xep-0313.html#intro
Google is specifically anti-support from their beginnings because they have this belief that everything can be solved algorithmically.
I mentioned this in another thread. You can have the output be a dot file. Which you can then edit and send back with a flag to not redo the layout.
People don't just believe his account should have been suspended, they feel that he should be prosecuted and charged with civil tort given the comments. I think they are ridiculous Karens who would destroy open source in a heartbeat given the opportunity.
Actually we're a bit more on the rails, on that one -- if you haven't heard, skin color was used as a way to identify others at the time, rather than self identify. Then once identified, they were subjected to horrible treatment. The world certainly isn't perfect but it has improved.
Mongo works really well for backends to test your UI against in coding bootcamps. Dead simple CRUD storage and access model. As a mock React data store, it'd be hard to find simpler.

DynamoDB is a managed service that scales far beyond Mongo and truthfully far beyond what any of us here would be seriously discussing.

With regard to complex schemas and related data, both DynamoDB and Mongo are harder to deal with once you've past a trivial size. If all you need is basic CRUD with limited or no joins, Mongo could suffice to a large deployment, but if you're mostly accessing by primary key, DynamoDB will soundly eat its lunch performance-wise and for cheaper.

If you need to join related data (or just find them convenient), relational models work famously well, and usually up the point where you have 10 million simultaneous users.

Mongo more and more is being relegated to niches where the problem just happens to exactly fit Mongo's feature list, which unfortunately for Mongo encompasses ever-narrowing gaps in the other options' offerings.

Mongo can't match the scale or economy of DynamoDB and can't match the flexibility of relational. That's why fewer and fewer treat it as their go-to database nowadays.
Being judge by the color of your skin and self identification have nothing to do with each other.
You have PERL REPLs like that with Task::Kensho leaving out PSH and .Net libraries on the dust.

What you could do today with PSH and iPython Perl folks did that before with far more modules thanks to CPAN and C bindings.
Wait, Die Hard isn't a Christmas movie?? We watched it with our college age kids over the break as one. Sure seemed like a perfect Christmas movie to me, even redeeming a rocky marriage at the end.
I'm not the parent you're asking, but figure you might be interested anyways since I could've likely made the same comment:

I work on displays within an OS team. Having some basic understanding of colour theory is critical for a significant number of modern display projects, particularly for the high end. For example, enabling colour accurate rendering (games, photos, etc), shipping wide-gamut displays (how do you render existing content on a WCG display?), etc. More specifically to the planckian locus, it generally comes up when deciding which white point to calibrate a given display to at the factory (e.g. iPhone is 6470K, S20 is 7020K in Vivid)[1][2] and if you're doing any sort of chromatic white point adaptation, like Apple's True Tone[1][2].

My background before joining the team was a degree in math, but I really enjoyed doing low level projects in my spare time, so ended up on an OS team. We also have colour scientists who study this full time and have a _significantly_ better understanding of it all than I do :)

[1]: https://www.displaymate.com/iPhone_13Pro_ShootOut_1M.htm#Whi...
[2]: https://www.displaymate.com/Galaxy_S20_ShootOut_1U.htm#White...
[3]: https://support.apple.com/en-gb/HT208909
[4]: http://yuhaozhu.com/blog/chromatic-adaptation.html
Possibly a lightweight Kailh Choc linear switch? They’re very soft and quiet, but they have no tactility. The tactile ones leave a bit to be desired. It’s hard to match rubber domes there.

https://mkultra.click/choc-switches
Can that (1) be done with windows/Mac clients?
Because it is excessively cautious and basically useless.

Virus particles are everywhere. There is no avoiding them.
Argos Translate Roadmap
This is why I have a catch-all and give each company a different address. I can just forward that address to junk¹ instead of bothering to unsubscribe. It isn't just when they ignore their own consent options for sending their own stuff, often mailing lists are hacked out of companies and become junk targets that way. Or they are actively sold: the amount of crap I get to the addresses I have registered with kickstarter²³, paypal, etc., seems to confirm that is very common.

[1] Or set it to bounce, but I prefer /dev/null as bouncing increases the chance I'm becoming part of a back-scatter issue.

[2] At some point soon I'll get around to cycling those addresses to something else again, I haven't for a while, then the current ones will be redirected to spam training.

[3] Including some newsletters specifically targetting people who have interacted with crowd-funding so some project's team has given my address out against my wishes⁴. I wish we could give them specific addresses when supporting, so I could tell who (I don't cycle the main address I use for such things often enough to tell).

[4] Though those have saved me money: if I think of supporting a project I search the junk file first and if it has been mentioned by “backer-update”, “grant @ t.k.p.”, “kickstartech”, etc, I'll walk away - but only one has lost my help thus far that way and doubt anyone else is doing it so this petty little victory probably means nothing in the grand scheme of things.
> not to share what exactly triggered the ban in order to protect their systems from spam and abuse

That's kind of true but I think that a company the size of Google could afford to assign someone to look into providing more information in a scenario like, "you are using geo-location without asking permission". Since the need for permission is not a secret, telling the vendor this causes less friction and makes people hate you a bit less.

Sure, you might also have a "secret" system that does something like "if failed 5 times in a row, blacklist them" but that is just security by obscurity and doesn't seem to stop that many people. Also, in the case where the vendor is an easily verifiable company selling, presumably, something that is fairly easy to view/check, it doesn't seem to be asking for much to either get a human or to get some automated messages.

Apparently they employ 140K people! That is a lot of people to not provide any human support.
What is a case where floating-point addition is more complicated than a string concatenation? Are you referring to some obscure architecture?
My kids couldn’t handle youtube. They would watch algorithmically created garbage (5yo) or endless game streaming (9yo) and be impossible to handle afterwards. First we did youtube time-outs, but every time we added it back into the mix we saw their behavior get worse, so eventually we banned youtube outright. Give me a curated platform like disney or netflix any day.
What is its presence like in your part of the world? Do people know about it? Do they read it? How is it perceived?
You're Running Untrusted Code
Yes, after about ten seconds, the page that otherwise appeared to load fine suddenly becomes a 500 that encourages me to read other Medium articles.
Freshpaint (YC S19) Is Hiring – Head of Marketing
It's still great library, doesn't miss any features. I just wish it was still maintained, as for some apps I own its almost impossible to migrate.
Right, "based on zat tech" and so not real zats. So they understood zats enough to come up with a facsimile, but not devise real combat zats better than those ridiculously awkward things the Goa'uld built?

Look, if you're not interested in critiquing the internal logic of this show and just want to make stupid comments like the show being make believe, then I'm not sure why you're replying because that's the whole point of this thread. We agree that SG-1 did tech progression better than most shows, but it still left some glaring holes regardless.
> Unfortunately, places with hard problems that haven’t been solved are also — inevitably — kind of dysfunctional.

This seems to conflate dysfunctional markets with dysfunctional workplaces. It seems like the author's thesis rests exactly on this logical error.
Gaming YouTubers have had their likenesses stolen and sold as NFTs
yes, my original computer was a 486/66 with 4 MB of RAM. It could not run emacs + g++ + X11 and a terminal all at the same time without swapping. Eventually, I upgraded it to 32MB and it "flew". Was a great lesson in swap performance and RAM upgrades.
Are you right handed? I am and my right hand is larger/more muscular and fatigue for the weaker hand might be occurring. Or, with a normal key layout you might have more keystrokes on the left side - have you tried a Dvorak or split keyboard. Finally, is your posture and wrist angle/support the same as for your right hand? I had wrist soreness due to the extreme thinness of a previous apple/Mac keyboard (wrists were bent upwards).
Right, that suggestion was more for folks in states with lesser public school systems.
One reason is that lots of operations automatically join on index (instead of, say, using rows’ integer indices) which makes them more convenient than manually doing the join yourself every time. You only need to set the indices correctly one and then things just work.
Would you remind a dumb-wit like myself why that's a problem, when the API of a relational db is virtually perfect for a queue or event bus? Push, pop, look-but-don't-touch, data available through the most scrutinized and battle-tested query language ever, what else do you need?
Show HN: I Built HN for Crypto
Hi All,
I build side projects occasionally, and thought that something like this was needed! Would love to know your thoughts :)
decent. I'm curious what it would be for a human tetrachromat (likely female) seeing in r4 space. Sadly, I can never know.
Kudos to Cramer for making such a useless and long lived acronym.
One time I emailed the Hawaii Department of Public Health and asked for latest PFAS measurements.

They sent me an excel sheet (fron 2013?) with information about tested sites. With the curious omission of measured levels.

It was explained as "levels are too low to be required for disclosure"

Hmmmm...
The requirements on clients are fundamentally different than on the server. On clients, you want at least:

1. Batching, to avoid network waterfalls (a consequence of network use being more expensive on clients than on the server).

3. Data dependencies, so the framework knows how to stitch queries together when batching them.

3. Consistency, so all UIs update when an update comes in (a consequence of SPAs being long-lived, as opposed to the typical stateless server request).

These all take some code/framework overhead. It’s valuable to pay that cost on clients, but is unnecessarily verbose for the server.

People have been trying to unify local and remote function calls for years, and it’s a similar problem: the two are fundamentally different.