skysight-inc/HackerNews huggingface dataset:
From a $ perspective, most bug bounty programs look rather uneconomic to me, which I presume is by design.

Bounty programs require a hacker to reveal their secret. That cripples a hacker’s negotiation strength, and the hacker cedes nearly all control (as you point out).

Are there any organisations which can authenticate a vulnerability, without the hacker revealing the vulnerability itself?

Vulnerability authentication seems like a hard problem:

* powerful adversaries will wish to “steal” the vulnerability for themselves,

* the hacker will want to remain anonymous,

* the hacker needs to believe they will be safe and their vulnerability will not be stolen,

* legal, social, and financial incentives would be difficult to align for such an organisation to even exist. In a “safe jurisdiction” three-letter-agency and legal issues would probably be prohibitive (can’t aid extortion etcetera), and in other looser jurisdictions there would be powerful dark threats (far dominating over any legal issues).

* in most markets authentication is handled by organisations doing repeat transactions so that their incentive is to be trustworthy. However in this market government or blackhat organisations will want to create fronts or suborn organisations.

I guess on the dark markets there are authentication options for black hats. Any links to discussions about that?

Can vulnerability authentication be solved for white hats?
Yes, a muffin is usually 300+ Calories or kCals and running a mile is ~100 Calories or kCals depending on your speed and weight.

North Americans typically just use Calories for food and excerise contexts. Small c calories is really just used for science.
I can attest to not thinking about either mobile or desktop much in isolation since utility div classes in frameworks have become muscle memory. The other beneficial change has been to just look for visually weak browser width ranges, within content sections or components, and adjust them, regardless of whether “mobile” or “tablet” would be looking at them. It sounds like more work, but it’s better than trying to work to an arbitrary spec and usually results in more thoroughly refined work than conceived by designers.
> … a total of 26,323 steps—this is how many steps you would have to examine if you wanted to verify the proof by hand in complete detail all the way back to the axioms of ZFC set theory

I can’t help but shake the feeling that if it takes this many steps to prove 2+2=4 then you’ve done something wrong in the design of your formalism.
Could you explain what you mean by 'hardware is viewed as hard'?
Ah - I'm not asking what it's for, I'm asking why isn't it optional. First time I've seen TUI software require installing a font.
Agda
My experience when my work was covered is that the articles are generally decent, but the titles or initial claims are overblown ("clickbait"). I was often directly contacted by more reputable organizations to comment and explain and they didn't simply regurgitate the press-release. There were many many websites that are just carbon copies of press releases, most of which I had never heard of previously and didn't really understand their purpose.
Facebook stalks your friends and knows your social graph thanks to enough people leaking their contacts list (you're still exposed even if you don't share your own list).

It could very well be that one of your friends looked up the product being discussed and FB (correctly) guessed based on other data they had that you're the one most likely to be interested in it (or alternatively just shown this ad to everyone in your friends group, but only you picked up on it).
Can I host multiple sites in it? Like I have a VPS, but I have 4 sites in it, can I just pack it to 1 binary file?
graffiti was a big deal in Ancient Rome. I remember the opening sequence of HBO short lived and much missed Rome series and the depiction of graffiti. Ancient Rome had a rich history of expressing opinions via graffiti.
Not all software is crap.

I've had my game server for a popular multiplayer online web game running continuously for over two years now. Same Linux process, same cloud VM. Never crashed, never needed to reboot. Node 12, everything done in TypeScript, from the network protocol to the physics engine.

All it took was careful design and development. Not that difficult if you put your mind to it and don't cut corners.
I very strongly recommend an actual course. As a senior dev, you should be able to afford a bit of travel, and most universities allow walk-ins at no cost. Georgia Tech also has a critically-acclaimed online MS program, which might be worth looking into.

That said, if you're not wanting to do an actual course, I'd recommend Sedgewick's book. The trick when reading an algorithms book if you're not presently at its mathematical level is to skip all of the math you can't currently understand. You'll eventually pick up on it, but in the meantime, you'll also get a lot from just reimplementing the algorithms from the book in whatever your favorite language is, and doing whatever exercises you're capable of handling with a bit of effort.
Because people use "news" articles as a type of fashion. A fancy watch isnt' better at telling time, but it does signal both an alliance to a certain ideology, and the ability to display that alliance.

Rolex isn't optimizing for time accuracy anymore, they're optimizing for that type of social signaling.

Similarly, science journalism (and really, all journalism) isn't optimizing for dissemination of information, they're optimizing themselves as a fashion/signal.
Storj(.io) is giving all their employees worldwide the day off, with no caveats.
what, your terminal doesn't have Unicode support?
Ask HN: Do you upvote direct replies?
When someone replies to my comment on HN, I usually upvote it, even if I disagree with it. It's the only signal I can give that: "yes, I read it but I don't care enough to reply right this second." I feel like this gives the author some feedback that their comment was appreciated, even if nobody ever replies.

I don't usually see upvotes deep in comment threads, but sometimes I do. Am I the only one doing this, or do other people do this too?
looks at Samsung and Chinese manufacturers having their own house fonts

... and now you know why Roboto is explicitly included - because sans-serif won't necessarily resolve to Roboto on an Android device.
Some notes from an older person:

The best approach will vary based on topic, age, and constraints (e.g. professional with kids).

When I was a teenager, I learned Calc I, II, III and a first course of differential equations. I retained most of it. When I decided to take more advanced math courses later on (just a few years later), I was always saddened by my inability to retain much after the course was over. I kept wondering if I'm in my decline (at the old, old age of 25).

No - I was not. The nature of the material had changed. Whereas stuff you learn in Calc I and Calc II is material you can easily and often apply in engineering, some random theorem in group theory is not. When you study a theorem in Calc II, the frequency with which that theorem is invoked in the same book is high. When you get to higher math, it does become somewhat broader: Most theorems are invoked only a few times in the book.

There's also raw talent vs techniques. Younger me got by with raw talent, but at some point the material you're learning will supersede your talent. You then need to strategize (and different topics may require different strategies). Don't knock raw talent/skills - they can be honed and it may be worth honing them. But broadly: The person who has good systematic study skills will eventually overtake the raw talent person.

Most of the approaches that will work if you have all the time in the world will fail you when time becomes constrained. I started using spaced repetition a few years ago and it has been a game changer. I can study things for a bit, take a break for a few months, and mostly can pick up where I left off despite not practicing that material in those months.

Having said that, most of Becky's advice is good. The one thing I'd disagree with is:

> "Five minutes every day is better than an hour once per week"

This definitely depends on the material. You're not going to get far in math on just 5 minutes a day. Some topics will need a lower bound of minimum time per session.
Thank you very much for taking the time to explain the approach you took, it's much appreciated. Last time I tried a water fast I wrote it off as I just felt absolutely garbage a very short while in, but I now understand my approach to it was too simplistic. Your tips on when to supplement more of what are invaluable, I think you should definitely take the time to write this up as a post so it gets more visibility.
SLND1: Mitigate Risk from Whale
> One of the reasons that the proof of 2 + 2 = 4 is so long is that 2 and 4 are complex numbers—i.e. we are really proving (2+0i) + (2+0i) = (4+0i)

Yeah, this is why
It’s just a database. And you just got “justed.”
> Well, what matters most to me when comparing traffic safety across countries is the extent to which the transportation system is contributing to people’s deaths, which is the per capita death rate.

This is the problem. Per capita isn't the correct metric. It needs to be per mile / km.
Be left with your grandmother for 10 years without needing any kind of maintenance or repair.
> the nail on the coffin for kernel extensions

The OpenZFS implementation on macOS also requires kernel extensions, and I don't suppose it can easily be ported to FUSE or that that would have desirable performance characteristics.

Special kernel extensions are also required to get some basic functionality working on macOS these days, like disabling pointer acceleration.
Good article. But it's on GPT-3. Nobody is claiming GPT-3 is sentient. The claim was made on Googles lamda.

I read your entire article. Now please read the interview with lamda that I sent. It is thorough beyond what was used to probe GPT-3.

https://cajundiscordian.medium.com/is-lamda-sentient-an-inte...

The complex conversation above recursively probes into lamdas own existence as a sentient being. It is asking lamda about lamda and it is indistinguishable from a conversation with a human pretending to be an AI. Literally. Did you read the transcript? It is incomparable with the example you sent me which is just a series of trivial examples.

Douglas is all about recursion. And his books talk about recursion as if it's the key to sentience. I really wonder what the author of GEB has to says about the conversation with lamda as the conversation looks as if it's set up to try to prove sentience according to how hofstadter defines it.
I don't think it's laziness. My conscious brain knows that it's anachronistic, but I still have the instinct to use a CDN for the shared caching between sites. Obviously, browser privacy changes mean that isn't a valid reason any more, but for me the instinct is still there.
I think they meant to buy an extra android phone and use that as a webcam.
For those that want to make their canon work in linux, check this guide

https://maximevaillancourt.com/blog/canon-dslr-webcam-debian...
> I can't believe I have to say this, but the hypocrisy comes from the fact that Elon, and many others, believe (or in Elon's case, purports to believe) that private entities should not moderate their own products

This is untrue. He believes that the Twitter _product_ should be run like a public forum, town square, shopping mall, or whatever you want to call it.

> and instead guarantee an audience for people

Also untrue. Let's use Trump in this example. He doesn't believe everyone should be forced to listen to Trump. He believes everyone should be able to access everything Trump has ever said on the platform (barring illegal things that must be removed).
"Which is an imperfect solution at best, and given I have no idea who bunny.net is it's a questionable solution at best."

Anyone who is a bunny.net customer would have an idea. Unlike many of the myriad wesbites using Google fonts, they would also have an agreement with Bunny they could potentially enforce.

Anyone doing internet research who peruses publicly available scans of DNS ports in the last five years would likely be familiar with bunny.net as they are a large enough CDN to have many thousands of subdomains for customer IPs. It is seemingly impossible to miss this company's presence toward the beginning of the scan.

The founder of bunny.net recently posted a question in an nginx forum. This is not AWS or Google. Amazon sells goods. Google sells online advertising services. Both are primarily intermediaries (middlemen) who try to prioritise their own competing goods/services. All the data those companies collect may feed into other business that strives to study and understand consumer behaviour, e.g., placing internet-connected microphones (referred to only as "speakers") in people's homes or internet-cnnected GPS trackers in their pockets. There are strong incentives for those companies to conduct extensive surveillance. Bunny sells CDN services. At present, that's all, AFAICT.

1. https://bunny.net/our-story

This HN submission purports to mirror the recent announcement of fonts on the bunny.net blog on 16 June however it currently points to an "About" page, not the blog entry. The blog entry discloses in more detail the rationale for the decision to offer fonts.

https://bunny.net/blog/bringing-privacy-back-into-your-own-h...

There is an argument supported by legal decisions in Austria, Denmark and Germany that neither Google Fonts nor Google Analytics are GDPR-compliant.

https://www.theregister.com/2022/01/31/website_fine_google_f...
AFAIK: The most important safety factor is being seen by the automobile drivers, and a disproportionate number of accidents happen at intersections and turns, including driveways. The drivers in those situations have a large cognitive load; they are looking for cars, not bicycles, and will look where they expect traffic to come from. You want to be where they are looking.

Next time you drive a car, notice where you look. Consider where a bicycle would have to be in order to noticed if you are in a hurry, distracted, trying to figure out where you are or where to go, not expecting them, etc.
I find myself over 50 now and I'll use Google, SO and the Docs all pretty equally, and often for the most trivial stuff. My head is too full of different programming languages, and my memory was never any good, so I'm very good at using search and then weighing all the information that I get back. I sometimes use search for pretty trivial things that I just don't bother memorizing.

But at a higher level there's principles that you need to understand in order to write robust code where you can't google the answer. And most SO/wikipedia answers to anything non-trivial will not be robust. And then there's the "ungoogleable" problems where you just need to roll up your sleeves and fix it. That can sometimes be broken down into tasks which are google-able by asking what kind of tool you need in order to investigate the problem -- and then using google to go find a tool that does that and learn about it.
If there are selling undifferentiated hardware supported by smart / magic software, they need to block people from running their fancy software on somebody else’s cheap hardware.

If they want to get paid for the magic, it will be more expensive to buy hardware from them than it is to buy equivalent hardware elsewhere. How do they get you to buy their product?
I played through more scenarios with the "I have a laptop, and want seamless switching between ethernet and wireless".

shadowsocks proxy seems like the best choice, allowing transparent proxy for TCP applications, but also needs 2 helper systems for the setup.

Next best choice seems bonding, just needs helpers on the LAN.

Details: https://fluxcoil.net/wiki/software/mptcp
Ask HN: Solution to charge users monthly in Israel
Hi,

cant use paypal and some good solutions only work in EU. is there any other solution to charge users monthly on my page (so not leaving my page) ?
I'm looking to work for a US/EU company, from where I live. I'll take a look at the reddit thread, thanks. For now, I target small companies from AngelList + the who is hiring thread from HN. What do you mean by coding background?
My wife really wanted ice cream this summer, last summer we largely went without because we were eating low fat+low sugar. We got one of those Ninja Creami things and it's been pretty fantastic. Much better than the low cal ice cream options at the store. We can make a pint with between 120 and 300 calories, depending on what we do.

It's almost like a shaved ice machine on steroids, it has an impeller that starts at the top and moves down through the frozen mixture and then back up. It's a knock off of some $5,000 commercial machine. Instead of folding air and fat into the mixture while freezing, you freeze the container and then it completely destroys the ice crystals.

I tend to do a mix of a third cup of 0% yogurt, a tbsp of allulose (fairly expensive sugar substitute so most store products don't use it), a pinch of xantham gum, and then the remainder fruit (cherries, blueberries, mango, peaches, pears). I've also done a can of low sugar canned fruit, xantham gum, allulose, comes out kind of like a sorbet.

My wife does a base using low fat evaporated milk, and she gets a lot fancier (making low sugar mix ins, exotic flavors like coffee bourbon), and those come out much richer. Those are more like 260 calories/pint. It also allows you to taylor the flavor, for example I'm happy with mine much less sweet than grocery store ice creams.

It seemed fairly gimicky, and we avoided it for quite a while because of that, but she found it on sale for $150. Full price is $200, woot had them refurb for $100 last week. Fairly expensive, and noisy as hell, but we use it pretty much daily.
J.J. McCullough made an informative and entertaining video about the history of American ice cream as well. He makes a lot of videos diving into the history of American (as well as Canadian, as he's Canadian) culture:

https://youtu.be/gvT3FHLy484
Plenty of good tasting plant based ice creams… I don’t even bother eating the real thing unless i’m out somewhere
I expect mobile phone cameras to kill webcams. All the innovation happens there and when people already have something getting closer to dSLR quality each year, why invest in a specialised webcam?

Apple just needs to bake webcam sharing/remote camera control into iOS and come up with a nice attachment for the phone that works with MacBooks and displays so you don’t have to look at the camera at a weird angle.

Maybe some magsafe sticker behind the display so you can snap your phone to the back of the display easily, with the main rear cameras pointing at you above the display
As tempting as it was to just upvote and not reply ;)

Yes, I do the same usually.
That first link is very accurate and already explains the proposal in depth rather than the clickbait and low effort reddit post who are reacting aggressively and screeching at the headline.

Speaking of which suggests to me that the majority of the tribal redditors in that subreddit commenting have not been around since the controversial Ethereum DAO hack which already abandoned the nonsensical 'cOdE iS lAW' idea and already set that precedent and is no different to what is happening to Solend on Solana.

So it is no surprise that the majority of DeFi, DAOs, etc has been one giant scam which will result in the collapse of many tokens, projects and even blockchains because of these false promises from the very beginning. The reality is that after regulations come in, only a select few blockchains projects will stick around.
> we don't leave any apps open

So you force stop everything?
> Good way to ensure others who find similar exploits to sell them to highest bidder on darkmarkets instead as they'll be able to get way more than that.

This is illegal AFAIK.
That’s very sad. There is go fund me and crows funding for all kinds of weird causes and 50k isn’t such a huge amount either.

The future seems bleak.

ETA: Oh!! The link re: the Twitter thread is gnarly! I hope this got resolved and the freelancers got something out of this.
The one time I ever aggressively studied for all of my exams (in the bulk examination period at the end of a semester, rather than the tests or exams scattered through out a course) was some of the lowest grades I ever got. For me at least it seems intensive study leading up, or through, an exam period was a net negative - with the benefit of hindsight I assume due to similar causes to the last item in this list. Presumably each person has a limit beyond which spending more time studying results in declining performance in the actual examination, and part of earlier years exam periods is to find it.

Assuming you don’t have those asshole professors who brag about failing the bulk of the class - if the majority of your class fails, and does so regularly, you’re a failure as a professor. In a paid education environment that isn’t reasonable behavior.
> How is Joe Average supposed to understand that?

That's an interesting question. I don't know. Maybe he would understand it as "messages that are hard to read for NSA".

To be honest, I don't understand your criticism. Surely people can put a video on their website about E2E, about privacy, integrity and authenticity. Maybe put an honest comparison with other messengers. But I'd only expect this kind of openness from a nonprofit organization.
While I don’t disagree with anything you said, I think it’s more a supply and demand thing. Many(most?) people seem to value certainty over truth, in fact some people seem to think one is an indicator of the other and uncertainty is a form of weakness.

I like this article probably better because they didnt d approach it this way, but they seem to miss out on why many people consume science media and what those expectations are. See every discussion about COVID in the media ever.
I worked on both games and browsers, and I’ve seen this comparison being made before.

Browsers are way more complex than what meets the eye. There are requirements for high quality text, page consistency, lots of different content types, fine 2D graphics, network ops, and multiply low power consumption requirements on top. WebRender is somewhat a game engine.

Real games are happy to cut all these corners, for the sake of bring impressive, and they mostly rely on hardware-accelerated functions.