skysight-inc/HackerNews huggingface dataset:
> CFAA isn't going away

There's some pretty concerted efforts in play to at least have it updated and tempered, which could have legs. I don't hold much hope it'll go away but I do think some of these efforts to have it replaced could have legs.

> No. Just don’t.

Yeah, fair, I mean I'm all too aware of the consequences myself, but within this setting telling a bunch of people "thou shalt not" seems almost more harmful (IMO it's akin to saying "never roll your own crypto" which someone inevitably ends up taking as a challenge)
I think the problem was he didn't get the tax bill until the next tax year. Selling the stock at a loss that year would not offset the gain from the previous tax year.
I have no idea where you're writing this from, but in almost any western country that I have any knowledge about what you're describing is wilfully committing a crime.
(Note: The post appears to have disappeared, so I don't have the full details of what the author did/didn't do. I have a vague understanding based off the parent conversation.)

I don't want to sound purposefully ignorant here but is your advice basically that, if you find a vulnerability, the only way to remain a white hat hacker, assuming you were not hired to check for vulnerabilities, to not report the security flaw?

If not, please explain.

If so, I can certainly understand the perspective, but for me, I feel a sort of obligation to make people aware of serious problems. Whether it be them driving around with a headlight burned out, or their website processing credit card info in an insanely insecure manner. Each are dangerous, and can cause many problems not just for the operator, but for the people around them as well.

To me, it seems like it is ultimately at least as malicious as a grey or black hat, if a white hat were to find a basic (or serious) issue, and not try to inform the owner (or in this case, their boss) of the issue in some fashion.

Perhaps the law should look for some kind of "good sanitarian law" for these sorts of situations.
What if you are great at finding problems and ok at solving them?

Also, product is a completely different skillset than engineering. Being good at finding and identifying engineering problems is not the same as being good at product.
Technical Solutions Poorly Solve Social Problems
> Poking around to find out how severe a vulnerability might be is how you manage to get yourself in civil trouble even when you're testing a site that runs a bug bounty

Sueing people doing it is a fantastic way to ensure well intentioned people will never report vulnerabilities to you any more.

The same goes for your whole post chain.
>there's no reason he shouldn't be able to have a snoop around

Copyright, anti-trust, patent, civil and criminal liability beg to differ. It's just a bad idea to snoop around the technical implementation of your competitor's product. Nobody should do it without the explicit prior permission of their employer.
You can't use your GUI over 9600 bps serial port (yes this is sometimes still relevant).
Let social media companies sue parents for kids logging on.
> This is market segmentation 101

What are some good resources / blogs on the topic? Also: Am I right to assume that market segmentation is what product people call "personas"?
SEE: https://blog.logrocket.com/fetch-api-node-js/
Everyone with an education was tutored in such a way.

We don't lack 'geniuses' we have more brilliant and educated people than ever.

It just so happens there are not a lot of low-hanging fruit of easy things to be discovered by 'gentleman astronomers with a telescope in their backyard'.

The only thing we may be a bit short on, are people who have focussed extremely hard on one thing.

Eddie Van Halen was nerding out in his bedroom for 10 years learning to spread before becoming famous.

I think with Social Media, a lot of people are constantly distracted.

But even with that said, the amount of talented kids with instruments is something else. Youtube is a source of inspiration and learning.

Of course 'the greats' are going to be coached and 'at it' since a young age, there's nothing new there.
That’s a good way to narrow your legal representation to crackpots and scam artists.
Considering the author hasn't been pronounced guilty by any court I'm not sure how you can say that with any confidence.
The perception of the possibility of the perception of industrial espionage is usually enough to get a lawyer choked up in cases like this - I wasn't saying there WAS industrial espionage, just that there might have been the possibility of painful allegations thereof...
> Now C isn’t just a programming language, it’s a protocol.

But the image above that is calling conventions for functions on a particular processor. What does that have to do with C?

> So actually semantically parsing a C header is a horrible nightmare

I'm confused. It seems to me the right way to go would be to improve C such that it's more precisely specified, easier to parse, etc. Genuine question: why is that so hard? (I suspect the reasons are more institutional than technical.)

Variable declarations are syntactically weird in C, for example. And newer languages seem to have better ways (that are actually context-free). So why couldn't C be evolved toward that?

> int foo(int x, int y)

becomes

> foo(x: i32, y: i32) -> i32

and so on.

> You don’t see England trying to improve itself, do you?

I guess that's a saying I'm not familiar with. Seems to me England has improved a lot over the years.

Go easy on me, geniuses.
>a lot of problems that aren’t actual language problems but rather programmer problems

This is a really naive take.

In aerospace design we have the concept of "Design for Human Factors" or "Human Factors Engineering" which is basically an acceptance that the pilot or crewmember is a fallible, flawed "system".

That is to say in aerospace we recognize that human beings have limits. They have finite breadths of attention, and they panic in a crisis, and they make mistakes when fatigued, and they're not capable of performing repeated tasks 100% consistently.

That's why for example we make the "fuel cut off" switch a different size and color than the intercom switch. That's why we make the engine fire extinguisher handle very prominent and easy to grab, etc.

For how many decades have software folks been writing use-after-frees and off-by-ones?

When is Software as a field going to get over its collective hubris and admit that C is poorly designed from a Human Factors standpoint? A tool that requires unattainably- or unsustainably-high human performance is a shitty tool; get a better one.
Whether or not you think it should be a crime has absolutely nothing to do with whether it is. In this case, you're pretty much dead wrong. There's no "this is how the open protocol" works exception to CFAA. A case will turn on your intent, and the standard to which you'll be held is "what a normal person on a jury would think to do with their browser", not "what people on HN think is reasonable to do with a browser".
My Daughter Identifies as a Lizard
The discussion here is about an argument that says basically without tutoring you can't create Einsteins. My only point is that we can now make them easier and cheaper than ever because they can make themselves.

On this specific topic, I must admit I do believe 1:1 tutoring is overrated. I've taught myself most of what I know, and the rest I learned in a classroom. I have never had one on one tutoring. I may not be representative of the population, but I bet most people don't need near as much tutoring as a tutor would have you believe, they just need access to accurate and well organized information.
The semver spec implies this, but doesn't say it outright. And that leads to lots of overcomplicated tooling!

I'm going to try being even more clear:

"Package Foo v1.2.3" should usually be spelled "Package Foo1, v2.3"

For example, the migration from react 17.x.x to react 18.x.x is actually a change from depending on package react17 to depending on react18. React17 and react18 are two different packages which have been designed by the same team, and happen to have similar APIs in order to make migration easier.

If I designed npm today I'd make "react16", "react17" and "react18" all be essentially different packages (under a namespace). They should probably only share their lists of authorized authors.

You can see this confusion all over the place. For example, when setting up peerDependencies in a nodejs project, there are suggestions[1] to use a version like `"chai": ">= 1.5.2 < 2"`. This is because chai v1 and chai v2 are essentially different packages. You want to say "chai v1 should be a peer dependency". But its unintentionally awkward to say that clearly. And with the current nomenclature, there's no way to express a dependency on both chai1 and chai2 - despite them being different, incompatible packages.

Even though nodejs is obsessed about semver, it still makes a mess of things by pretending as if major versions and minor versions are similar. They are not.

[1] Last couple paragraphs of https://nodejs.org/es/blog/npm/peer-dependencies/
Oh, well. I didn't write this law, I just pay attention to how it's used.
Banksy's most iconic stuff is kind of ripped off.
Tesla raises prices twice this week
Great post with a lot of good advice around sponsorship + support.

Is there some sort of how to forum/guide on setting up a hosted versions of open-source projects? Googling this specific thing is quite difficult. A good alternative to setting up my own hosted service is for me to be able to ask DO to charge a $2/10 pm premium via my DO deploy buttons instead. I have sent thousands of clicks their way of which i see $0 via basic referrals. One can dream!
This has been exactly my impression of the internal situation as well. The first wave of sanctions targeted at the russian government/central bank (where the normal people were only collateral) made the normal people angry at the russian government for causing that situation. Subsequent sanctions aimed at civilians have left people demoralized/hopeless and angry at the west. Expecting superhuman levels of heroism from people that are being attacked and victimized from all sides is just lunacy. I saw people seriously contemplating suicide.
In MacPorts I do ‘port installed requested’ which shows me every package I’ve installed directly, versus as a dependency. You could alias this to something more convenient. For brew I’m not sure.
RedHat's parent IBM, has a rather interesting history when it comes to litigation assholery AIUI. The late Chuck Peddle described some of it in [0] IIRC.

Pocock has a reputation for being an antagonistic asshole, but if there's even a shred of IBM representation on RedHat's side I'm inclined to chuckle in a pot-meet-kettle fashion at this situation.

[0] https://theamphour.com/241-an-interview-with-chuck-peddle-ch...
> import 'https://cdn.jsdelivr.net/npm/marked@3.0.7/marked.min.js';

Doesn't this mean your code won't run if the website https://cdn.jsdelivr.net goes down?

In Node.js you download modules you need, to a local folder under you dev-folder. So you can run and develop and test your code whether you have internet connection or not.
James Webb Telescope Terrifying Discovery at the Edge of the Universe
Not necessarily true:

Interest rates and home prices both roses during the most recent period of rising rates (2016-2019):

https://fred.stlouisfed.org/series/FEDFUNDS

https://fred.stlouisfed.org/series/USSTHPI
Thanks! I just added it
I feel like just how people say always get a lawyer when you get some legal paperwork like a cease and desist - I say get a CPA when exercising options. Many times you can book them for a one time appointment, it'll probably run you somewhere between $150-$300. Totally worth it when I had to do it. (although no horror story here)
I don't know what to say. I use NVIM. And it would be hard for me to switch to any other editor.
I hate to be the bearer of bad news but cars have been running software for over 40 years now:

https://www.gmheritagecenter.com/docs/gm-heritage-archive/hi...
There is no "good samaritan" clause in the CFAA, just for what it's worth to you.

I don't know what this "white hat hacker" stuff is. There's no rule of hats in the law. I know "white hat" mostly as a term of derision, not as a technical or legal term of art.

The problem this person has run into is that they went looking for vulnerabilities in someone else's website without permission to do that. You're not allowed to do that. If you do it, a lot of times you'll run into companies that are cool about it, but a lot of times the companies you run into aren't cool about it. The law is on the side of the people who aren't cool about it.
It's a crime only in US. Most civilized countries allows people to stagger their taxes.
I hope you never grow old or become wealthy, friend. It’d be quite the shame for you to become the very thing that you hate.

You’re living in housing built by someone in the past, driving a car engineered years ago, on bridges and roads built decades ago. You enjoy technologies that people even 30 years ago could only dream of, things you did not create or contribute to.

And then you have the gall to whine about those builders, savers, investors, and innovators who created those things.

Kind of sounds like you’re the extractive cost center, to be honest.
> It seems to me the right way to go would be to improve C such that it's more precisely specified, easier to parse, etc. Genuine question: why is that so hard?

It's not hard to specify a language that is all those things compared to C, but then it is, ipso facto, not C.
I think this is a case of people being annoyed that a product that works just fine is being replaced.

I have a handful of personal sites that I've slapped Google Analytics on, and while they're mostly using Google Analytics out of the box, I'd rather not have to spin my wheels reworking some custom events.
In the US, it's not a crime as long as you file your taxes accurately. The IRS generally allows you to set up a payment plan or even settle for less than is owed if it would cause hardship to pay.
Recall that someone seized one of the nuclear plants, and technical staff are now effectively their prisoners.

https://www.ukrinform.net/rubric-ato/3431207-invaders-keep-s...
Autoclosing is a good take.
The UAE has no oil reserves, but Saudi Arabia or Iran would work as a replacement for it in your comment.
It’s Like GPT-3 but for Code–Fun, Fast, and Full of Flaws
Thanks! I just added them to the list
Second that comment on NZ. The VC system there is still in its infancy, VC treat startups like they should be grateful to even have a conversation, then offer peanuts for a large stake. No wonder the more successful startups always go offshore for funding. Net result is that the opportunities for meaningful payouts are low. Great place to bootstrap, but you need to go offshore as soon as you launch.
I don't get it. At one point C changed its syntax for function arguments (significantly, I'd say), was that new language ipso facto not C?
But the claim wasn't about incompetence, it was that these were the Navy's top pilots. Were they the top squadron commanders in the entire Navy?
Rich Harris actually disagrees with the browser vendors decision to deprecate alerts. From the article you linked:

> We can't normalise the attitude that collateral damage is the price of progress, even if we accept the premise — which I don't — that removing APIs like alert represents progress. For all its flaws, the web is generally agreed to be a stable platform, where investments made today will stand the test of time. A world in which websites are treated as inherently transient objects, where APIs we commonly rely on today could be cast aside as unwanted baggage by tomorrow's spec wranglers, is a world in which the web has already lost.
In the US, if you owe taxes, you can negotiate a payment plan with the government. Not sure of the details of the story we are commenting on so I can't say anything about what may have happened. As far as I know, there is not need to end-up on the street. On the other hand, trying to personally manage a large tax debt is a huge mistake. You have to hire an attorney with experience in the domain or you are not going to have the best possible outcome.
sad but true. The only thing that Jpow cares about is the markets. In his defence the economy is made of people and crashing the market/causing recession is going to cause more grief to the public that is already overwhelmed with covid.
I can't speak for whether the OP is in violation of any laws or not. I am, however, very curious about the identity of this competitor bank. Yeah, I get why they might be suspicious of OP given his initial access, but my god that company sounds like it's being run by a bunch of incompetent hotheads. They have seem to have absolutely no idea how to investigate a security breach let alone run a finance company.

Note to OP: if things don't go your way with the lawsuit, do the society a favor and let the world know who these guys are so we can all steer clear.
Concealing income is a crime, delaying payment is not (though you will pay penalties and interest). It's quite easy to get a payment plan where you do this and don't risk garnishment or other collection efforts as long as you follow it.
This is because there would be extra memory involved, and this could make it hard to deploy on low memory environment. Consider the historical background of C, in the late 70s' to 90s' and you'll see why.

But thanks to Moore's Law and the hedge by the Writh's Law, you have significantly more powerful hardware yet not so faster software, because we started to deploy languages worse than C: C++. C++ with template, is Turing Complete, and this means every template expansion is potentially undecidable, meaning it could run forever, where most compiler turned a blind eye to by putting a "recursion depth". Having templates, even without "recursion depth" alone consumes even more memory than C, and so that's why we complaint about C++ compilers are memory boggling, while C has (relatively) low memory overhead. It's just that times are different and the perception about memory use is not that apparent anymore.
Local e-bike rider finds a way to juice-up at EV charging stations for cars
There's too many lawyers, it wouldn't be a problem if law school was cheaper but the fact that so many of them have big student loan debts means they have to find reasons to sue people in order to pay of those bills.
> A generation ago, progressive cycles of deficit spending and taxation had put the top tax bracket in the US at 90%. Still, there was persistent inflation - and worse high unemployment.

AFAIK the "90%" rate is highly misleading because at the time there were a lot of deductions that bring the effective rate much closer to today's levels. We can see this in the federal tax receipts as % of GDP, which remained mostly flat despite the top bracket dropping from "90%" to 37%

https://fred.stlouisfed.org/series/FYFRGDA188S
Not a terrible story, but I was an early employee in a startup and was given a small batch of options to start (and some measure every year as bonus) -- nothing exciting. I think the strike price was like a $.05 a share or something with 20 million total shares and I had ended up with something like 20,000 shares.

As I moved up the ladder I replaced a VP and took on his shares instead as an incentive. It was 1.5 million shares. One year I landed a couple huge deals for the company and brought in bonuses worth more than the strike price on all of that and almost bought them.

While I was thinking about it, the executive in charge of marketing and sales left and I ended up meeting him in a local parking lot to pick up his laptop and some other things. He handed me and envelope and told me to give it to the CEO and that it was confidential. Being curious I looked in the envelope anyways and it was around 4 million shares in stock certificates in the company. I have no idea why they were being transferred but I'm sure it was some contractual contingency to return the shares based on some trigger in his contract.

Being honest, I turned in the stock certificates as instructed, but decided that something felt "off" and I chose not to execute on purchase of my options.

Over the next 12 months we tried to exit at a $25m valuation (which would have made me on paper at least a small time millionaire), failed to find a buyer, the CEO left, I became President of the company with the task to shut it down rendering my options worthless anyways.

In exchange for sticking it out and helping shut the company down, I left with a very nice parting bonus and a promise of strong reference from our VCs as a former corporate officer which helped me get my next position with another startup (which ended in disaster but that's a different story). All that was worth well more than my options in the end so I guess it was worth it?
The OP is an article doing literally exactly what you want. And he's going above and beyond what's required–he didn't even need to communicate all this redundantly. It's already all in the open source license–willingness to work, level of commitment, etc. Just read the license. It's included in every open source project.
aside of cookies not working anymore and the old model becoming illegal in some countries? I think it's compelling enough for people that actually need the data. For you maybe not and that's ok.
Technically nothing in science is proven.
Second that as well. Options are a 'nice, but show me the cash' deal for me too.
Likely to be deleted I think. If I was their lawyer I'd insist on taking it down immediately.
Misinformation and Disinformation aren't the same thing. OP is speaking specifically of Disinformation - the kind that is purposely meant to deceive and lead people astray.
Link: https://breakingpoints.live/
Ol' Bappyscript can just invoke open() from assembly code; no need to write a little C shim. That's usually how I end up doing system calls anyway.
Depends on how you raise it right? “I was trying to research how X built their app, to see if there was anything we could or should do in there, and I think I found a huge security vulnerability.”
It's also weird because it took awhile to realise it's about Rome the empire and not Rome the city, despite the title.
This was my exact situation circa a year ago. It wasn't a great look. It was an even worse feeling. It delayed the start of the project I refused by a year and didn't change management's view on how to get it done.

All that being said the writing was on the wall that I was facing either the nuclear option of resigning, or a second round of even more severe burnout by going along with it.

In hindsight my strategy going forward next time I'm presented with a plan that has predictably disastrous consequences is to simply let them have it their way. IDGAF if you wreck this thing further. I'll even help you do it. We'll maintain friendly relations and I'll leave the company near the end of the project but before it becomes apparent just how bad things really are.

If you can't beat em join em. Cynical as that is I have to protect my mental health and I'm willing to allow you to sacrifice the health of your company to do it.
Show HN: Payitfwd.dev – Donate to Dependencies of Dependencies
Fuchsia/zircon uses IDL to define the system API interface and it works for them :D
IIRC, they bought a company that uses wireless APs to deliver the signals within municipalities/cities. The bureaucracy and cost was too prohibitive for physical fiber. At least that was my understanding of the situation last I had checked.