skysight-inc/HackerNews huggingface dataset:
"People misapply CVSS" is the crux of the post and all the criticisms (even the ones labeled as something else).

The other criticisms section starts with the "You're doing it wrong" commentary and then moves on to discuss two other groups saying what boils down to "You're doing it wrong and the metric is bad because it encourages you to do it wrong", which as a way of demonstrating diversity of opinion is entertaining at least.

CVSSv3.1 as a metric is not designed to have a uniform distribution of possible values from 0.1 -> 10.0 and it should not generally be a goal to develop a scoring system that does. It is designed solely to answer the questions of "which issue is more severe" when comparing different issues and to then help direct and prioritize fix work. It is not perfect at this but it is superior to other systems out there, especially when taking the pure severity of a given vulnerability in isolation.

I do get that people really do try to sell the idea that it's an infallible metric and that it means something substantially more than it does. It also gets confused often as "X is riskier because its score is higher", which is obviously wrong. If you have an authentication-related product, it's obviously more damaging to discover certain categories of information leakage than it may be to find cross-site scripting issues in general.

I think it is correct for a change in scope to have a much more outsized impact on the final score, something the author seems to sort of presume is wrong (referring to it as the "villain" at one point) without really explaining why they believe it is wrong. A scope change essentially means lateral movement to other systems rather than the compromise of a single piece of software.

Could a better metric be designed? Sure. I'd like to see some additional degrees of user interaction being accounted for, as just one example. The concept of vectors being Network, Adjacent, Local, or Physical could use some more fleshing out for the modern age, for another.

Does that mean alternative approaches are better? Not in my experience. All the alternatives I've experienced basically boil down to "we made our own system, don't publish the calculations, and lots more stuff is critical impact and risk" whenever you get reports. I've literally had third-party pentest teams try to sell me that an Info Exposure that was showing server IPs in a log was a High, because they used their own metric.

I'd argue that for what it is intended to do, CVSSv3.1 does a good enough job and that's why so many people have accepted it as a standard.
> Those flights would have happened without Vitalik on them, so the carbon footpring is not really attributable to him.

This is ridiculous. Taken to its logical conclusion, all flights would’ve happened without each individual passenger being on them. I guess that means nobody is responsible then?
I'm the opposite. Shift-right-clicking when I need to access the default behavior is not a big deal, and right clicking is such a natural instinct for me that I love it when web apps support it.
To some extent, yes. I got the 32gb ram model in mine, so it's got a lot of headroom. Also, architecturally, this thing can pass around data so much faster than other machines because of nicely vertically integrated it all is.
That limitation isn’t ideal, but wouldn’t you know it right away with another read, during development before production data involvement?
The abstract is completely garbled; fortunately you can click on "full text" and read this short and interesting paper.
That's a 20:9 display and an SoC that was hot garbage when it was new two years ago.
Mac Settings You Can Unlock with the Defaults Command
It's really not if you wear glasses.

I don't, wife does, it's always a production for her.
So roughly the same size but Canada's entire population is just over half of the UK's. Europe's train system works because of how crowded it is.
UBC professor says Airbnb host threatened her
> How many courses on Marxism/Communism do you see in US academia?

At least three from top tier universities [1][2][3], but probably many, many more [4].

> In the meanwhile, US colleges have entire departments dedicated to Capitalism (Business school).

The idea that communism or leftism is 'cancelled' in academia very unfounded, and one of the chief complaints by the right and points-of-pride of the left.

Business is not capitalism, and vice versa. Trade and the creation of companies happened well before capitalism was an idea. Likewise, business schools study the mechanism of business and its applications (eg. accounting, finance, HR, strategy), which can take place outside of capitalism.

[1] https://history.rutgers.edu/academics/undergraduate/course-d...
[2] https://pll.harvard.edu/course/china-part-9-communist-libera...
[3] https://polisci.berkeley.edu/course/selected-topics-comparat...
[4] https://www.google.com/search?q=communism+university+course+...
Specifically for the design. I haven't been on it in a year, so my memory is foggy, but the reason I left was the fact that it seems tailor made to amplify the most paranoid, antisocial perspectives at the expense of good faith and trust.

The following progression of thought comes to mind: many police departments have a mandatory arrest policy for calls in response to alleged domestic violence. Despite the fact that many neighborhoods are, frankly, boring, plenty of nextdoor users are looking for a chance to interact with the app and contribute to "the greater good." It's easy enough to call the police "just in case," but often there are disastrous results[0] that at minimum include the arrest of one of the partners, regardless of guilt. This kind of mindless see-something-say-something excuse marches us daily toward a speech-chilling antisocial breakdown where all that's left to do is clutch our pearls and cower at the thought of interaction. Nextdoor directly provides a channel for the amplification and praise of this modality of thought. While (I hope) most people reject or ignore it, its continued existence is a net negative for neighborhoods and society.

[0] https://www.fox10phoenix.com/news/police-release-video-taken... -- note that Ahwatukee is a wealthy suburb of Phoenix
Pro-choice != pro-abortion.

Pro-choice means every pregnant woman should have the choice and a real chance to abort their pregnancy if they choose. It's kind of right there in the name.
I was so mad for a while, I considered taking them to small claims court to recover the price of the games, since they broke it, and have basically refused to fix it.

Right now its just in the category of "never give meta/etc money for anything because they will f$*k you and never blink" I don't do bus with google, and I won't do bus with facebook, they are just to big to notice when they squash people like me.
If you reserve tickets online ahead of time, you can almost always get the 30% discount now. Maybe what's what you mean by crumbling at the edges.
The product link not resolving doesn't improve this payout for the publisher. The cookie gets dropped _either way_ and when a purchase happen Amazon will check for a referral cookie and payout accordingly for whatever qualifies in that cart.

As long as you end up on amazon's site, then the cookie was likely dropped and your next purchase may pay out affiliate commission to whichever publisher's links you most recently clicked through.
Both products are lotteries with premiums.
> I would also like, however, to see the CVSS4 with a "cost to patch" component: in OT environments, CISO like to use the SSVC because it’s the easiest way to say "wait" instead of "patch now". But since SSVC is not really recognized by all auditors, it generates conflicts. Bringing a component in the CVSS to reflect the cost of remediation on very complex devices, where deploying a KB requires to stop a full factory, could help getting the same results (aka "don’t patch now and wait") but with a more respected scoring system.

The issue with this is that the people who are best suited to score an issue from the reporting perspective won't necessarily have any idea what the cost to patch something actually is. This is why CVSS shouldn't be used as a be-all-and-end-all metric for anything -- there are a lot of factors that don't relate to the vulnerability's relative severity that it does not account for.
Based on your replies to comments you should not.
But then you must also prepare for that he decides to leave.
Regardless - the 14 years you have managed so far is a huge achievement.
I reported `/usr/bin/CLANG` odd behavior on case-sensitive data volume due to case-insensitive system volume on Mac OS X.
Then they replied with "Work as expected; No plans to make the system volume case-sensitive".
I didn’t have any open source work from 1996-2020. What I did have was the an active network and the ability to dig deep when asked about my prior projects/accomplishments.

If I ever pivoted back to pure software development and wanted to get a comparably compensated position at a large tech company would a jump through the DS&A grind - yes. But to work for a startup that offered meh compensation and meaningless “equity” - no.
> From the description of the project it doesn't seem running from a dedicated hard-drive partition is an actual goal of the project

This "goal" would require a grand total of 2 changes.

> It works great for my use case of booting from a USB drive and I very much appreciate that it exists.

It's just like grubfm - a few files + a heuristic to use these with isos to make them bootable.
Don't try to work around it. If you found in your user studies that people wanted to use right click, you'll be inconveniencing the majority if you remove that behavior. Speaking for myself, I get mildly frustrated when a web app doesn't give me a custom right click menu, because discovering whatever they chose instead is much harder.

If you could find out more about why people like OP dislike overriding the default behavior, you might be able to provide those functions that they are missing. If it's devtools, you're out of luck, but someone who needs those probably already knows ways around the click hijacking.
You are being downvoted because of the obvious health implications of alcohol consumption and its potential addiction.

On a similar vein, I've been smoking for 10 years and trying (ineffectively) to quit for the last 4. But I can't count the amount of nice moments I made by borrowing (or having borrowed) a lighter.

Anyway, don't smoke.
Helium as an incentive for the LoRaWAN network is the killer app for crypto. People are building a world wide LoT network. It's all decentralized. It's all being created by people who earn helium as a reward. I think the same model can be duplicated for other needs. If we give it time we'll see more solutions being created using the same model.
Anybody can make apps. It's just that if you choose to make an app for platformX, then you have to play by platformX's rules. If you make a website, then you can make the website however the F** you want, and people on platformX can still view your content without you having to abide by their rules.

Seems pretty simple.
It's still very useful for other spices which clump easily, like paprika. Uncooked pasta works as well.
Recently I have been testing vditor, vditor is a markdown editor that have a instant rendering feature [1]. If I'm creating my own editor, how hard is it to implement it using Lexical?

[1] https://github.com/Vanessa219/vditor/blob/master/README_en_U...
The process looks okay. But your post still lack crucial details.

What has always been the most important factors for all decent engineers I know:

1. What exactly do you do (what’s the mission, the goal, the challenge)

2. The compensation

If these 2 are good - we can bear any meaningful interview process, and many even prefer home assignments to nonrealistic pressure of on-site interviews.

If not - nobody actually cares if interview process is great.
This is the strawman-iest strawman I've seen in a long time. By this logic, there's a use case for getting stabbed in a back alley. Some people need surgery, after all.

The proper question is what does cryptocurrency do better than alternatives? On the whole... I think bypassing financial controls to enable ransomware is not an improvement on the previous system.
https://caniuse.com/http3
This looks great!

Curious whether the team is looking at improving the support of having images in tables cell? I played with the playground and it seems to work, but there seems to be some (relatively minor) glitches/bugs (e.g. difficult to place an image in a cell, moving images across cells seems difficult, and cannot Ctrl-x an image and Ctrl-v to paste it).
Which 50% to block is the problem. Which one is politics which one is not is controversial. Is politics related only to what government is doing?Then what about religion? Is that not political? If all that is political is VIM vs EMACS or WINDOWS vs MACOS also considered political in IT circles? Its almost impossible to decide where a line can be drawn, but even if you want to draw a custom jagged line for yourself then its going to take you years to do so and even then it wont be perfect as human mindsets keep changing and what was apolitical a few years ago can suddenly become a very POLARIZING topic(eg.Vaccines).
Failed Autopsies, False Arrests: A Risk of Bias in Death Examinations
seems a tad late. It could have made a killing if it launched a few months ago...
My Nextdoor devolved into multiple houses on my street setting up a shared Nest/Google account and rigging up a dozen or so cameras to watch their entire stretch of the street 24/7. All this because someone thought their car was vandalised (turns out it was vandalised in the parking lot of a mall ~10km away).

For context we live in a somewhat isolated, well off suburb, that according to police data has had a grant total of 63 crimes committed in it during the last 12 months, 41 of which were just people vandalising the same abandoned building.
Found this with the concrete drainage channel by a road newly buil through a forested area. After opening it was filled with possibly kgs of pillbug corpses.
Ask HN: Do you read everything on a landing page?
He's right. I submitted a radar[0] in the Xcode toolchain with a very simple repro and it was never acted on - a compile would fail with an error when there was none. It killed our CI system.

[0]: https://gist.github.com/ryjones/3e9a851e92794d67b5e37197608a...
Are there any benchmarks against OCaml?
To be fair if it was anyone else in his position they would probably be flying private.
I wish that was the case for me. Usually when deadline and overturning combine the anxiety and avoidance starts. What if thoughts etc...
There are categories where the incentives are equal enough across all the products so you can maybe possibly trust the reviews more.

If all the products are similarly priced and from the same retailer (ie amazon) then there isn't any incentive to recommend anything other than the best.
> i would like to go even wider and just block all news sites as they tend to push political agendas from their prospective which mostly is filled with speculation that often causes unnecessary stress

i would like to go even wider and just block all news sites

Fixed it
I have read that orthodox anti-trust theory in the US in more or less "modern" times holds that anti-competitive behavior by corporations is a problem only if it has a negative effect on consumers.

You could debate whether this is the correct value system, and some people certainly do; you could consider impacts on other people besides consumers, or just feel that anything inhibiting competition is wrong in principle. Go to another country, or back in time decades, and people think/thought differently.

But my point is, that I think the orthodox answer to "is anticompetitive behavior by corporations bad" is "it depends".

And therefore I would expect a conventional wisdom type answer to "is anticompetitive behavior by organizations representing workers bad" to also be "it depends".

Taking the position that it's always bad, even if you are only considering the customers, would seem odd to me and need an explanation.
my current go-to headphones [0] are also from Anker, have USB-C charging, and I think they meet your form factor requirements

0: https://amazon.com/gp/product/B08HRN4M3H/
Ask HN: Weekly newsletter summarising HN community views
HN has been a very enriching experience for me; I regret not coming across this site earlier. I am thinking of starting a newsletter summarising the different views in the comments on topics that I find interesting and going deeper into the casual mentions of complex ideas in those comments. Is it okay to start such a newsletter or would it be wrongful appropriation?

p.s. the sources will be attributed.
I agree, and I think userspace development was a good idea. I also don't think it needs to stay in userspace forever.

In particular, ideally we'll have kernel support that allows for more capable userspace stacks to run, and also allows just opening a socket.
This is the sort of situation where I would be tempted to send a photo of my genitalia, with the written code.
I’ve rarely had my Radars receive any attention unless they were coupled with a TSI. Probably makes sense based on the volume of bug reports that Apple likely receives.

The ones that were accompanied with a TSI received attention in 1-3 weeks which seems pretty quick.
> Crypto is successful at being money. If you don't believe me, then I'm happy to sell you the laptop I'm writing this on for 1,000 ETH instead of 1,000 USD.

> How about 1000 kilos of gold? Or 1000 1 Carat Diamonds? Does that make diamonds good money?

This is a good argument, but I think a better one would be that there is no way the seller is willing to sell any laptop for 1,000 ETH, given that the value of 1000 ETH as of writing is over 1.5m AUD.

If they gave me a quote for the actual value of the laptop in AUD (perhaps 1-2 ETH?) I would still say no, because the inherent volatility in even the most "stable" coins is too high. 2 ETH might be worth 3k AUD today, who knows what it will be when it arrives, let alone when I want to spend it.
What weird pricing. Why not just make them $50 each? Or $49 if they have a policy that prices end with the digit 9.
He misses the two main use cases, and the two things that crypto are used for that dwarfs everything else.

A) it's a great speculative asset. Huge volatility in value means fortunes can be made (and lost) in days not lifetimes. All those crypto ads on the radio talk about "investing" in Bitcoin - marketing it as an asset, not about using it as currency. It appears to be a zero sum game. I'll make no judgement about its actual value as an asset.

B) it makes illegal transactions safer by removing the need to be physically present to receive cash. This simplifies things like drug deals, and of course with digital goods makes things like ransomware possible.

Crypto already has two killer apps, it's just not the killer apps they wanted it to be.
I would not do homework on principle. Life is too short and the company doesn't know how to hire senior people.
I really wanted to agree but none of these claims really stand up to scrutiny in my opinion.

> Few technologies have a clear start point. Did the internet start in Tim Berners-Lee in 1990? Or in 1982 with TCP/IP? Or in the 1970's with CYCLADES? Or in 1969 with ARPANET? Or in 1965 with the invention of packet switching? Or in 1950's with time-sharing?

No, the web started in 1989 with Berners-Lee’s original proposal. The internet started in 1983 with TCP/IP (the Internet Protocol) being used for ARPANET. These are common, widely cited timeframes.

> Can you distinguish the internet from computers or information theory?

Yes, the internet is a network of networks made up of computers. A computer is not the internet. Information theory is the theoretical study of information and entropy started by Claude Shannon.

> If you don't believe me, then I'm happy to sell you the laptop I'm writing this on for 1,000 ETH instead of 1,000 USD.

Great, I’ll help you move house for a pizza, but that doesn’t make pizza money. The fact of the matter is, I can’t buy hardly anything with cryptocurrency except other cryptocurrencies. This is made more difficult even for companies that want to offer goods for crypto by the fact there is no stable exchange rate to USD.

> Right now, you can take out a loan without involving a bank from one of the many crypto lending protocols.

Lol, was this written before or after the collapse of Luna, Three Arrow Capital, and Celsius? Not to mention the numerous bridge hacks. I guess technically, sure, this is a valid (ie possible) use case of crypto, but not a strong one.

> You may point to hacks

I would argue a malfunctioning lending protocol is as good as no lending protocol, but again, this is a matter of opinion.

> Filecoin

Interesting use case for sure, but unfortunately it seems difficult to participate (and I initially had interest in doing so). IPFS is much further along development-wise. You may say “oh well this is still a use case of crypto” but… not really. I mean sure I can get paid in $FIL but if $FIL is useless in the real world (basically my earlier critique that it is not money) then why would I want to get paid in it?

Overall, I want to agree and perhaps it’s just a couple years too early, but as of now, this is too strong of a claim to make, or at least too weak of an argument to support it.
Is it possible to leverage a septic system to generate power?
If the U.S. had co-determination, as in Germany, where unions reps have board seats, but point is taken.

https://www.nytimes.com/2019/01/06/opinion/warren-workers-bo...

Still, having a union would provide a stronger bargaining position than individuals voicing concerns during all-hands.
Is there something wrong with desalination?

I mean, just like inventing power generation a magnitude of order better than before advances civilization, couldn't cheap and clean desalination let us utilize water more liberally?
Calling KYC a set of standards is a bit if a misnomer. KYC checks are a legal requirement in the banking industry.
I still agree with your high school inner child. I never made a single apple purchase in my life and I'm glad I never fell for the marketing.
Dave Chapelle’s latest stuff is funnier if you realize that, as always, he’s mocking white people. In this case the sensitivities of white liberals and the intersectional hierarchy they’ve constructed regarding who can make fun of whom.
It could be put to the test if more industries, such as tech, experimented with unions, or otherwise empowering employees to share in decision-making.

It is rather strange that in a field where there are all sorts of autonomous movements such as open source projects or hacker collectives, there is still the hierarchical belief that the managers knows best. Ah, well FOSS always do have their share of Benevolent Dictator for Life positions.
Referrals mean very little at large tech companies. They basically just guarantee you an initial screen. I’m bombarded with enough recruiter BigTech spam for jobs, I’m sure getting an interview at another one wouldn’t be a problem.

I’m also much older and darker than your stereotypical “tech bro” and they actually put me in front of customers. Imagine that!
Sure, if you define subjective experience as "all sensory information." I'm not denying that we have sensory input; I'm denying that its abstractions are any more than illusory constructs of the mind. The computer in my example knew things and had thoughts, despite not having access to actual qualia.

Do you disagree that the computer in my hypothetical example would have the intuitions it does about its own senses? Given that it does, how can you trust your own intuitions about your sensory qualia, no matter how strong?
Great intro story of Skype vs. WhatsApp!