skysight-inc/HackerNews huggingface dataset:
Not sure why it's tagged JDK9+, but 'class' attribute is accessible on org.springframework.beans.BeanWrapperImpl.getLocalPropertyHandler() in JDK 8 also. It probably doesn't matter which JDK is being used, as long as this spring-beans dependency is used.

Whether logging JSP exploit in JDK 8 or lower can be used is another question. However, since 'class' is accessible via request parameter, it's already bad and there will probably be some ways to exploiting it. It doesn't matter whether the request is GET or POST, as long as mapped controller method uses a non-primitive request object, 'class' can be accessed. 'class.module' attribute is accessible from Java 9 and above, I tested on Java 11 and can access 'class.module'.
Sample code that I used to test this with JDK 8 is below. I just tested whether 'class' attribute can be accessed via request parameter.

curl -X POST localhost:8080/test?class.modifiers=Hello

package com.test;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Spring4ShellTestApplication {

public static void main(String[] args) {
SpringApplication.run(Spring4ShellTestApplication.class, args);
}

}
@RestController
class TestController {

@PostMapping("/test")
public String test(TestOuterRequest request) {

String message = "Inner request is null";

if (request.getInnerRequest() != null) {
message = "your message was: " + request.getInnerRequest().getMessage();
}

System.out.println(message);

return message;
}
}

class TestOuterRequest {
private TestInnerRequest innerRequest;

public TestInnerRequest getInnerRequest() {
return innerRequest;
}

public void setInnerRequest(TestInnerRequest innerRequest) {
this.innerRequest = innerRequest;
}
}

class TestInnerRequest {
private String message;

public String getMessage() {
return message;
}

public void setMessage(String message) {
this.message = message;
}
}

Finally here are the attributes that're exposed on 'class' as accessible properties in JDK 8 (JDK9+ adds 'module' on top of all these)

annotatedInterfaces
annotatedSuperclass
annotation
annotations
anonymousClass
array
canonicalName
class
classes
componentType
constructors
declaredAnnotations
declaredClasses
declaredConstructors
declaredFields
declaredMethods
declaringClass
enclosingClass
enclosingConstructor
enclosingMethod
enum
enumConstants
fields
genericInterfaces
genericSuperclass
interface
interfaces
localClass
memberClass
methods
modifiers
name
package
primitive
signers
simpleName
superclass
synthetic
typeName
typeParameters
I won't rule out a placebo effect, but phenylephrine works just fine for me. Pseudoephedrine just makes me jumpy.
Somewhat related question: Consul's deployment guide recommends against deploying a cluster across high latency networks, and suggests Federation instead. Did you had any issues caused by the high latency between servers and agents? Are all your Consul servers located in the same region?
There are businesses that are fully legal in a jurisdiction but the entire banking and credit card infrastructure refuses to touch them. If cash is eliminated then how do such businesses exist?
I dont find the cost trivial.
You've did notice the file you've linked to only has 7 non-comment/documentation lines, right?

Now, to be fair, there are 50 or so lines of code in other files, but I would still love to see a useful Go package which is that small.
The world existed just fine before online advertising. If a company and its competitors for a product disappeared as a result of not advertising it probably wasn’t that great if a product, certainly not essential
There are multiple reasons, some simple and some subtle. We don't totally have the bin-packing problem Nomad is designed to solve. We do have "users have fussy and meticulously specified ideas of how they want their apps to deploy", which is not really what Nomad is designed for; Nomad is designed to decouple your pool of compute from your applications, and to make it low-drama to deploy new applications to that pool of compute. But our users come with some level of drama built-in; it's an impedance mismatch.

I like Nomad a lot. I think it's a better fit for what we're doing than Consul is (they're both great, but I think Consul is the bigger sticking point). You'd get different opinions from different people on our team, but I think Nomad's going to be around for awhile. But there are things we very much want to ship that we can't ship on Nomad.

I would 100% use Nomad again if I had a somewhat complicated app I needed to deploy and couldn't use Fly.io for. (I'd use Consul too, for that matter.)

Per the sibling comment: we are indeed writing a new orchestration system in Go, called `flyd`.
Sometimes the most helpful thing when I have a problem is being listened to and accepted. It is frustrating to see doctors that only pretend to listen, and I wonder to what degree such doctors are satisfied with their work. We finally have for our child a pediatrician who gives us what I hope will someday be normal care and attention.
Scary. Browser extensions are my biggest worry. Most popular extensions come from small indie developers with no track record, and without the oversight of the open source community.

It's also time consuming to inspect the source for each extension (particularly if it's minified, no comments, etc). And pointless, given they will auto-update. And depending on permissions, they may access your cookies, localStorage, browser URLs, intercept clipboard, etc.

Of course you should still be careful, only give specific permissions, read reviews, check if the code was published, etc, but it's still a massive surface area, like demonstrated by OP's proof-of-concept.
Go deep. Find something interesting and pull on that thread and keep going until you figure something out. If you do/don't get that far, start changing some things and see how it (mis)behaves, iterate.
This lecture hit the nail in the head for me why my life, career(dev) was stagnant for past five years. I know lot of things but I find hard time executing tasks not because I am lazy or I have poor work strategy or hate what I do (I am just the opposite.) When I originally posted my struggle on HN[1] someone[2] encourages me to get diagnosed for ADHD, I cannot thank that person in words how grateful I am for that advice. I am utterly grateful for that person. I was prescribed Atomoxitine last February after meeting the psychiatrist. Then I learn to find more about ADHD, then I found this shared video(I am the OP), so I decided to share it since it may help others with undiagnosed ADHD to get diagnosed and get treated.

I kind of consider people with mental illnesses as my family, since they are the only ones who can understand us, many others will do not consider struggles we face as serious issues, even the close ones have hard time understanding our struggles.

It is also sad that most companies do not care for people like us when considering for jobs. We are also humans with disabilities, but the problem is you cannot see our disability from outside, since it is a constant struggle inside which we are good at masking to the outside.

[1] https://news.ycombinator.com/item?id=30313215

[2] https://news.ycombinator.com/user?id=treeman79
At this point I suspect that the "group projects" often done in CS degrees are actually intended to give the student experience in a failed project and learning from their mistakes, and understanding that not every project is a success or failure due to their actions alone.
Having a lot of cash on hand also makes a business a big target for armed robbery.
I wonder if there is something they can add to it that is harmless to humans but makes it impractical or too expensive to use as a precursor for making meth.
It would pay a lot better if people didn't want the job so much.
> We ended up going with vector algebra, then learned that quarternions were actually better

Wait, what?

I'm still mostly familiar with assessments like "Quaternions... have been an unmixed evil to those who have touched them in any way" and "quaternions appear to exude an air of nineteenth century decay" (but not actually familiar with quaternions beyond a vague understanding of them as kind of 4d version of complex numbers).
Ok, so the latest pro-censorship talking point is to compare censorship with spam filtering. Thank you for keeping us updated on the party line.

War is peace, freedom is slavery, ignorance Is strength, and censorship is just spam filtering.
I didn't think they were especially popular until they were used for mobile payments. I'm not really sure about other countries in east Asia, they tend to grow completely different ecosystems from China.
They are, and we do have those issues; we address them somewhat towards the end of the post, with São Paolo and Tokyo --- but also with São Paolo and São Paolo: a VM that pops up in GRU has to post to Consul in IAD before other GRU nodes "see" it in Consul. We've addressed that problem by "hinting", sending service discovery updates over NATS that usually beat out Consul, and then reconciling the two event sources.

As I understand it, the reasonable-person thing to do here is to have federated Consul clusters in different regions. We run up against the problem that we're not hosting one application globally, but rather a zillion applications; every node needs to know about every instance of every application. So things like losing the global KV store are problematic for us.
Where I live in Asia it’s indispensable, but still pleasant.

I only participate on heavily moderated local groups about local issues. It’s a wonderful way to communicate with people in your community and learn what’s going on.

I unfollowed everyone I know in America and don’t interact with any of them.
Is there an NFC-based debit card solution yet for the states?
For personal use I'm happy with ProtonMail and F-Droid. For a calendar I use paper because I like being able to look at the wall and see the month, and to physically write things down. Same goes for note-taking, though that's a hybrid of digital and paper, with a goal of the important-er stuff going into the text files for easier searching (though like with paper books I have a sense where in each notebook certain things are). Good luck!
I can buy "Wal-Phed D" at my Walgreens pharmacy. It's Pseudoephedrine HCl 100 mg and works very well. It's quite easy to get, they just look at my ID.
I would guess this is an attempt to quash the drug trade, which requires cash. I'm sure people will find a workaround though. It would restrict many private person-to-person sales, so it would boost retailers quite a bit. Garage sales and the like will be a lot more difficult. Farmer's markets too.

Also it makes it easier to track down people who the police are looking for. That sounds fine until you realize how many false convictions exists and how eager cops are to find, "medium height, medium build, medium skin with a red or blue shirt on."

If I trusted law enforcement / justice system to be accountable and right their wrongs, I'd be more okay with it. They can freeze your assets and make it really hard to get a lawyer and no cash to afford one. Also it would suck during hurricanes and other natural disasters.

Assume the worst before you sign over your privacy. It's just not worth it, I pay taxes, the government can continue to provide cash as a transaction method for citizens.

I'm sure the credit card companies are lobbying to push this through as well. 3% on all transactions forever ain't nothin'.

So what's the benefit of forcing this on people? Why is having a choice between cash or card on any transaction bad?
Come now. Nobody can sever my connection to the CPU with a pair of hedge clippers in the backyard.
Guaifenesin is mostly useless and only approved so that they can stick it next to your dextromethorphan as an emetic to stop you from abusing it. I was vomiting from COVID and I was incredibly pissed off when I found out it was actually just because they poisoned my cough syrup on purpose.
> The more interesting part of this is, who has cable anymore?

Old people who watch FoxNews, apparently.
I agree that the world would keep spinning without online advertising. That said, tons of products can't exist without it. This doesn't mean they arent great, but that they are obscure.

Almost nothing is essential.
Well, before Go 1.13 came out, every decent production codebase in Go had to import Dave Cheney's pkg/errors[1] unless you totally gave up the idea of having useful error traces.

Go 1.13 has incorporated most of what this package does into the standard library. It really doesn't matter much whether the code is in a de-facto standard package or folded into the standard library IMHO, but Rust could do the same.

[1]: https://github.com/pkg/errors
Touch screens are the most intuitive things. I've seen aging people who never really used computers or mobile devices try to touch things that look like buttons or labels on TVs, microwaves, ranges, etc to control them. Sometimes the devices respond and when they don't, I think maybe they should.
ProtonMail is just PGP, nothing special about it.
I like the idea of ProtonMail but FastMail is more convenient. I also tried Apple e-mail using my custom domain, and it was OK, but FM is a bit better.
That was quite fun! Reminds me of moving around squares on a Rubics cube. Great job!
I've lost track of what point you're making.

Speed and memory is orthogonal to my point, which is about the output of two methods of arriving at an answer. I'm obviously not saying GPT-3 is anything like as efficient as running a small function.

What distinction are you drawing between the output of an interpreted program and a compiled program?
Oh, sorry. I guess it's been about twenty or thirty years since I used them.

Thanks for the clarification!
It would be smart for me to neither confirm nor deny but I will say no.

The way I see it the government has its own concerns and they may not align with mine. Can’t necessarily be angry that they’d want to maximise helped people. Not telling us and locking the doors though not so good. The other side of that is events like US disaster Katrina where there is too many people and too much paperwork that people become helpless wards of the state. That’s what makes a disaster a disaster, a failure of normal expectations? How would an individual even begin to feed 100000 people you know? There’s a certain helpless at scale.

The army did eventually show up, “the government” eventually got the power and phones up again etc. the sun did eventually appear again.

A skilled individual can produce excess, that excess can be shared with others, zooming out, family then community then state then country. But as we zoom out we have to rely on abstractions and quantisations. At the level I’m talking about though it was possible to say “if you’re on this map your one of us, the rest doesn’t matter” we could then ignore the rest. Much like the government ignored us?

What I’m trying to get across is a certain inspiration from being abandoned by government, big one or little one, show a little passion and violently execute an average plan!

Marcus Aurelius says something about being self reliant so that you can help society, not so that you can show off but so that you’re not a burden but that’s beyond my pay grade.

Somebody said that it couldn’t be done so with a smile on his face he got to it.
I've had to do exactly this. I sometimes write some code then realise that anyone less familiar with the details would look at it and see an "obvious improvement" which introduces a subtle bug.

At least once I forgot to add a comment in such a case and luckily I got the question of "why not just..." in the code review.
Or just the power of the state behind them. The government can always take your money, regardless of what form it is in and where it is.
Actually that’s not quite right. We offer auto-indexing now for some languages with more on the way. If neither auto-indexing nor manual LSIF generation are an option, we fall back to our search-based code navigation, which, similar to GitHub’s implementation, trades off accuracy for zero configuration (GitHub’s approach is parser-based while we use a combo of parsing, search, and heuristics that eliminates the need for an index entirely in some cases). This is all documented here for those curious to learn more: https://docs.sourcegraph.com/code_intelligence.
The replacement cycle for taxi ie commercial vehicles is lot shorter. Taxi fleets will move to self driving cars a lot faster. 2 biggest running costs for commercial vehicle are driver and fuel. So driver being replaced by ai and ice cars being replaced by electric happening almost at the same time means the transitions will be a lot faster.
> For a single transaction, is it even possible to make a transaction with a credit card when: - The chip/card reader fails? - The network connection is down? - There's a power outage?

Imprint machines still exist, and maybe half of my cards still have raised numbers. If all else fails, the merchant may be willing to write down name, phone number, and amount and either ask the customer to come by later to make it right (and call if not) or write the card number down to run the charge later and call to confirm, etc. There's ways to get network redundancy and power redundancy, if it's of value to the merchant.

Sometimes the merchant doesn't have the right change for cash (or would prefer not to take a large bill), or may not be able to open the register if power is unavailable (usually there's a key, but it might not be onsite).

You don't need to review charges on a daily basis, monthly is sufficent to keep your rights (at least in the US)
> is there any reasonable prospect of keeping one's GPU from being able to read and write to literally anywhere in physical memory?

This is the purpose of an IOMMU.

> I.e., a practical way a kernel and driver might be able to forward to the GPU only commands and shaders that can access only your process memory, and nobody else's, and your process's pixels, and no other process's pixels, when they live in GPU RAM?

So IOMMU and the GPU's MMU.

> For all I know, this is the norm for all GPUs

What?

> but I wonder why it is hard, then, for VMs to share a GPU.

Engineering is hard.
For who was it illegal?
Not sure where you are, but at least in the US you can’t be prosecuted for things that happened before the law was passed.
I'd hate to need breaks from my work for mental sanity. Sucks to be normal.
Do any of CNN and MSNBC's audience even have cable anymore? It seems dumb catering to younger people when they've been cutting the cable coord for more than a decade now. If you want to make money on cable, you need to go after older people who are more likely to go be conservatives.

> To put it in everyone's favorite brand of analogy, Fox is driving a racecar and everyone else is on a fixed gear bicycle.

Fox is driving an El Camino from the 70s, but everyone else has moved on to something other than cars, so they still win.
fwiw, I agree that progress has been astounding in the past 10 years... but on the other hand I really do wonder what the limits of the current approach is. After all humans don't drive by analysing 1 frame at a time, we have a model of how the world works, we anticipate, we have intuition etc...

I know the whole human flight is different to bird flight argument, so I guess we'll just have to wait and see how it all plays out. Exciting times :)
Product ideas with expired .com domains
That’s why I wrote this! And we have PTO. Let’s use them!
Every Monday, I write a newsletter with 3 product ideas with expired .com domains.

Most domains get taken, but here are a few favorites that are still expired and ready to get scooped up.
If they want the first case, they can bind "xkill" to a keyboard shortcut. I actually have it on Win+C (like Ctrl+C in terminal).

I'm not into the proposed "saving threads", I'm afraid they will get stuck for whatever reason without you noticing (as the window/taskbar icon already disappeared).
Yeah, a lot of game engines use some sort of HTML-based UI system. Having this thing as an easily includable library would be amazing.
> but on the other hand I really do wonder what the limits of the current approach is.

If the technology stagnates, the hardware stops improving, and the software stops getting better, then we would hit the limit pretty quickly.

> After all humans don't drive by analysing 1 frame at a time, we have a model of how the world works, we anticipate, we have intuition etc...

All self driving cars also maintain those models as well, and use frame by frame input to correct those models in real time (but they have already guessed where something is going to be 100+ frames from now).
The fact that I am here is 100% due to the medical science of the 1970s. I was born with a hole in my heart. The fact that I lived past 19 is due to the medical science of the late 1990s. That same area of my heart had a short circuit that would sporadically cause 200bpm+ heart rates and cause me to nearly pass out. It’s called Wolf-Parkinson-White syndrome. I had a cardiac ablation which 100% cured me of that. The fact that I am here now is because of modern medicine. I just completed colon cancer treatment for which I lost a foot of colon and had chemotherapy. As I write this I can’t believe that I am not even listing everything that has happened to me and considered myself generally healthy. Anyway medicine in the US is definitely responsible for my still being alive. I’m sure other health care systems would have kept me alive too but it is pure speculation and luck I suppose. I could just as easily have gotten a bad doctor and not been so lucky.
This thread feels like it was posted by GPT
Everything in SerenityOS is written from scratch, it’s a point of SerenityOS that it uses no external libraries in its default install and creates & maintains all source code for the entire OS and all built-in apps, inc. SerenityOS Browser.
Yes, I was talking about costs.

I was acknowledging that some people will suffer more, and some will suffer less.

Even good policies hurt some people. Sometimes a good policy will kill some and save others.
I put the very late 1990s as hen the Internet took off. It went from being a weird techie thing to something a good proportion of the population was using.

The main graph on the top of this page shows Internet Users as proportion of population in Developed countries went from 11% in 1997 to 31% in 2000.

https://en.wikipedia.org/wiki/Global_Internet_usage
The whole concept of race is fast becoming outmoded as more and more "mixed persons" are being born. I myself am a multigenerational mix (both parents are mixes) of 4 races -- 3 from my mother, and 2 from my father, with one overlap. I identify with 2 of these races, but acknowledge all 4; mainly due to cultural influence.

As a child (wore my hair quite long then), I've had someone pull me aside and ask, "so umm...what are you?" Wasn't offensive, but rather humorous. For a time, I grew up confused. Looking back, I know it wasn't my fault, but due to the boxes society so wants to put is all into, so they can be comfortable.

I've even had this conversation with my (I believe) majority race. If someone is 50%, we agree they are a member. But what about 40%, or 20%, or even 5%? At what point do we cut it off -- or rather should we cut it off? What if that 5% person was completely raised in said culture? When you begin to ask these kinds of questions, you begin to see the absurdity of classification. After all, the US used to have a one-drop rule...(https://en.wikipedia.org/wiki/One-drop_rule)

I'm not preaching some trans-racial ideology, but I do think we need to rethink the whole idea of race -- particularly in the US.
This test, as per the address bar in the screenshot, uses the newer Acid3 test that is 100/100 (provided you access the http not https version) in modern browsers, though, not the older one.
Coinbase does TOTP.
Sure! Humans get snowed in sometimes too.