skysight-inc/HackerNews huggingface dataset:
JavaScript code can be malicious, even while sandboxed (e.g. downloading a file). There are still dozens of browser security issues found and fixed every month.

A simple HTTP redirect to download a PDF file can also lead compromising the user's computer.
This is not always true.

I'm mostly deaf in one ear. But I only noticed one time when I was showering at the gym. It was caused by a slow-growing tumor in my middle ear. The surgeon said that my hearing would have been getting progressively worse over a fairly lengthy period of time.

I only noticed suddenly, because of that shower. When you have two ears, it is surprising how much the other one can compensate before you realize at all.
Hang about, UI designers didn’t ruin Gnome... and the changes made in Gnome have nothing to do with product packaging and logo changes!
HTTPS can't verify that either, to be quite honest. It can ensure modest protection against a specific class of MITM attacks. If the traffic goes through a CDN like cloudflares it's decrypted, inspected, possibly manipulated and re-encrypted mid-flight. A well funded actor can also lean on the website owner, or just hack them.
> It is surprisingly hard to extract monetary value from an intrinsically valuable solution.

This is like saying that our entire economic system is backward ...
Before asking people in developing countries not to have a proper house, we could try to forbid private planes and reduce military spending by half, for instance.

The military use of fuels is just ridiculous. If we are not able to stop "small" and superfluous things like that, then, simply there is not hope.
The author is aware of this. At the bottom of the article:

> Please don’t contact me to “well ackchyually” me and explain MITM attacks and how your terrible ISP inserts ads into your unencrypted web pages
> That's why many UK "political editors" ask such dumb limp questions of UK leaders

To be fair, politicians still feel the need to get on TV and face Paxman and Andrew Netflix and so on, who are happy to take them to pieces whatever their personal political leanings. That plus PMQs and constituency duties, and I think UK politicians get grilled sufficiently…
In terms of spam injection (the concern from up thread) I don't think DDoS is relevant. If the core project manages asking clients to process URLs, they'd just IP ban any client that returns too many results. DDoS is a concern for other reasons though.

I think in this specific case, the spammer is on poor footing. The spammer wants to inject specific content, ideally many times. With double processing of URLs and the spammer controls 50% of the clients then there's a 50% chance that a simple diff would show the injected spam. The problem is that the spammer needs to do this many times, so their injection becomes statistically apparent. If the spammer can only inject a small number of messages before they are detected, then the cost per injected spam will be quite high. Long running spam campaigns could eventually be detected by content analysis, so the spammer also needs to rotate content.

Obviously you can play with the numbers, the attacker could try to control >>50% of the clients. The project could process URLs >2x. The project could re-process N% of URLs on trusted hardware, etc. It's not easy by any means, but you can tune the knobs to increase the cost for spammers.
Pretty standard shilling here. This comment is designed to induce apathy by making the problem seem insurmountable and so convince you that it's impossible to know anything so why bother trying [to remove cancer inducing chemicals from the food supply].
It's curious watching all these derived password solutions evolve. They all end up taking on state, or requiring laborious transitions, if either a derived or master secret is compromised. Then their sync-free guarantees fall away.

SQRL went through all these things in slow motion. Or at least that's how it felt listening to the "Security Now" podcast.
Versions SHOULD be hidden from public queries. A proper assessment should identify versions anyway, by other means. If you hide them from your assessors to pass a scan, have Cyber insurance and later have an incident, coverage may be invalidated due to fraud (hiding data from assessor) or incompetence on the part of the assessor you hired.

Assessment teams have varying quality. Get the best results for your org you can out of them.
>This is a single study

How many studies will convince you?
I’d recommend CS 61a/b/c from UC Berkeley. I think it’s available online as well. The reason I like these three courses is that they cover the three key aspects of computing — programming, data structures, and machine structures. I find that the last part is often left out because we “abstract” away low level features of computers, but learning even the basics of page tables, caches, instruction sets, timing, etc. is extremely critical to a complete understanding of what’s going on.
Don't threaten me with a great time.
When i read the title, as a non-physicist, non-scientist, it sounds like the precursor to...teleportation! Over 20 miles distance. What is wrong with me for thinking that :)
You might be interested in adding Wealth of Networks to your list. At this point of time it may perhaps be more of a misunderstanding of things but it is a fascinating take on how things could have been understood before social media took over.

https://en.m.wikipedia.org/wiki/The_Wealth_of_Networks

(btw, thanks for the book tip)
Smart demand management hasn't been rolled out because there are many different people involved who would all like to pocket the profits.

Eg. a tesla plugged in at 6pm could shift it's charging time to earn quite a profit on the realtime-priced wholesale electricity markets.

* Tesla et al (the company) would like to make that money - in the lifetime of a car, it could be tens of thousands of dollars. They propose to do it with 'virtual power plants' which can make/use power and trade on the power market.

* The homeowner would like to make that money too. Through the use of manually setting timers to use power at cheaper times and having a peak/off-peak plan.

* The electricity distributor would like to make that money - by mandating that devices like cars and water heaters be remotely controllable by them, so that they can buy less of the most expensive power generation.

* Electricity generators would like to make that money too - by not doing any demand management, prices vary more widely, and they get big profits when they can spin up gas turbines to cover that peak demand.

Technically, none of the above ideas are hard to implement - but each party blocks policies and rules that move in the direction of someone else making the money.
How does HTTPS protect from any of that? PDFs can still compromise your computer, and JS is still sketchy. Anyone can encrypt their server, even the bad guys.
> It's not only about security.

That's still security, and such security is part of why HTTPS exists. TLS promises three things:

* Integrity :: that the two participants (for HTTPS this will be a web server and user agent) move data without anybody else getting to alter it successfully.

* Confidentiality :: that the two participants move data without anyone else learning what the data is [but they can learn when data is moved and a upper limit on how much data was moved]

* Authenticity :: that the participants can, at their option, reveal some proof of identity to the other tied to this TLS session. For HTTPS typically only web servers provide such identity, as a Certificate.

Injecting crap into your data is forbidden by the Integrity requirement.
Yes the Earth has been experiencing climate change forever. But it's extremely obvious that humans are changing the climate in such a way they we will create an unliveable environment across many places on earth. That will most likely lead to billions dying, world wars and maybe collapse of civilization. Of course earth itself will be fine. But that is hardly a benchmark. Even if we nuke every square kilometer of earth it's still fine. it's just a large piece of rock.
so is this legit or not?
It’s also possibly done because people train themselves to like familiar tastes. There might be a small drop in sales, but eventually as more customers buy the product they will get used to the new flavour.
Cars have become massively more efficient in recent years. Mid-size SUVs that got 15-20mpg a couple decades ago are pulling 30-40 now (with definite tradeoffs to get there!). And EVs are finally entering mainstream (and will moreso once automakers figure out how to actually get semiconductors).

Household energy consumption has gone way down too - LED lighting, efficient appliances, and better insulation drove that move and heat pumps are promising to drive that even further downwards.

Behavior change is hard - but it is happening. Just slower than is ideal.

2C is VERY doable imho. 1.5 not so much
I lived in London a couple of years in the early 2000s and me and my roommates used to watch Jeremy Paxman interview politicians and we were more or less in chock that he actually pushed them when they tried their usual non-answers.

Now, we were quite young and didn’t really know that much about British politics to get that much out of it but it was so refreshing to see a interviewer that didn’t just back down like they do back in my home country.
Mid 40s and try to hike 4.5km daily (we have a nice trail near our house) and longer on the weekends, up to about 12km is ok on the same trail system. If you can find a nearby trail you enjoy with good elevation change that’s IMO the best way to improve.

I highly suggest using Organic Maps on mobile for finding nearby trails, though I usually then switch to Apple or Google Maps satellite view for visual confirmation the area seems ok before striking out. I was shocked how many trails there were around me hidden in plain sight, hopefully that’s the same in your area.
That’s some top level conspiracy theory.

First, Who shoots someone just because of “connections”? Why not go after the church itself?

Further; this person got two shots off over a 4-5 second period. Just walked up to one of the most powerful politicians in Japan. I personally feel there’s something more to this — gross negligence or a conspiracy idk.

The communist opposition was actively calling for his overthrow by any means and calling him hitler (reminds me of the USA frankly). China has been celebrating his death.

Even if we assume this person believed this (highly speculative), then it was likely amplified by Chinese propaganda. China, USA, Russia, etc is known to support opposition parties and amplify conspiracy theories to support their aims.
Unfortunately, I don't posses any Apple device so I cannot fix it.

You're right, workers do fight in the real life. It's one of many simplifications in the simulation. Real world is much more complex
Yes, I'm one of those people and I'm not sorry. I think big corporations are evil, but I also think they exist because ordinary people buy their products, usually out of convenience.

There would be not much use for so much fossil burning if we didn't use huge cars to transport us for half a mile instead of walking, or building houses in the freakind desert, or watching TV, or illumiating whole towns and changing night time into daylight, or constantly buying new clothes when we could still wear the old ones, or stuffing ourselves with food until we explode, etc.

So yes, no one personal choice will "materially affect" the situation. But the effort has to start somewhere. Blaming others, "oligarchs" or Chinese leaders doesn't help. It's just a cheap excuse.
You do admit it is a circus, and no official explanation holds its ground. Why do you belittle the real reason, whatever it is, by negatively branding it a conspiracy theory? The real reason for this by definition falls in the category of a "conspiracy theory", since it is not included in any official explanation.
Digital repression across borders is on the rise
> Unless you actually care about receiving the true content. Which, if you intend to reach that site, you probably do.

Not always. My website is a sand castle in the beach. I take care of it and love it, but I don't mind if the wind takes it down, or if some kids destroy part of it, or if some idiot takes a photo of it and photoshops it in order to misrepresent my work. It is just a sand castle.
However, I would feel really angry, frothing at the mouth angry, if I was forced to "register" my sand castle in some stupid place so that the passerby could be assured that it is mine, or otherwise not be allowed to build a sand castle at all. This is what I feel by being forced to use https just to store some irrelevant static files.

Regarding CA and censorship, what I said is true and can be verified with a small amount of googling. I don't have the patience right now to do that for you, surely another HN reader can provide the relevant references if you are honestly interested.
Regarding UBI: do people not understand that money only makes sense in the context of a liquid market? UBI is a (non-linear) offset to a baseline wealth level. It can’t solve anything itself.
I forget the specifics, but there was no way to exercise the module remotely. I think it was actually Apache, not nginx, and the module was not even loaded. It was one of those bullshit "medium priority" line items.
I very often don't wear my hearing aids for that very reason. I have most of my hearing in one side, so I can get by. The world is a loud place, and hearing not-nice things more clearly isn't much fun. So I only use my hearing aids when I know I'll be where I need to hear conversations in a crowd or whatever.

Most people have no idea my hearing is so bad, unless they are walking on the wrong side while trying to carry a conversation.

Mine were a bit over $1500 each, so your pricing is pretty much correct. Also, to address something said earlier in the thread, modern hearing aids control more than 8 frequency bands, and the improvement is quite noticeable. Some people have fairly "wide" hearing loss, but for most people it is very specific frequencies, and variable frequency width (q) is the difference between good audio and great audio hearing.
For anyone that stumbles upon this later, I strongly recommend gitpod's openvscode-server container over coder's code-server. Linuxserver.io has docker containers for both.

openvscode-server has had 1:1 parity with a full desktop install of vscode, while coder's variant always had issues with several official plugins.

In coder's implementation several menu options will trigger caught exceptions for basic shit like opening a jupyter notebook, typescript language server frequently crashing, environment variables not being set properly in the correct order of priority, etc.

openvscode-server "just works" on the other hand.

Note that with both implementations the easiest way to get access to the microsoft plugins store is to compile it from source and modify preferences.json. Open source maintainers technically cant distribute it this way out of the box due to Microsoft's licensing requirements. Alternatively, you can always just download the extensions in your browser and drag and drop them into your vscode server window and install them that way.

When using linuxserver.io's container for openvscode-server, traefik worked fine as a reverse proxy to put it behind an https domain I own
some ISPs still to this day try to inject their ads when HTTP is used, especially on mobile. I was very angry when I noticed it first time with my mobile operator. No such luck with HTTPS.
I'm saying people haven't sufficiently engaged with the severity of the problem for optimism to be relevant.

You're trying to frame this as a rich vs poor situation, and talking about potential solutions and their likely effectiveness.

I think your post would've been better as a top level comment because it has nothing to do with what I was saying.
Sounds like a good way of filtering out executives. If they write that they changed branding, then dock them some points…
So, I would say the idea of dynamic redefinition is probably the big thing: In cl I can redefine a class and have all instances updated while the program is running.

I would also say that the error management is also beyond fantastic. Say you run a function, and deep inside the call stack there is an error. In CL you can actually update the faulty function and just continue executing at the point of the error.

For someone like me without any intellectual rigour at all, this lends itself to a kind explorative programming I really like.
Here's a search engine that I'm subscribed to: https://kagi.com

In the 20-30 searches that I do in a day, I still have to google about half of them. Either because it's stuff Google does well (currency conversion, for example), or Kagi just doesn't get what I'm trying to search.

I remember starting out with the Internet searching on Altavista and Yahoo and Lycos. The information that was present was nowhere near as now, and it was more "exploratory". Nowadays people just kind of know what they want and just wants to quickly get there.
I (don't) look forward to those desperate creative ideas in a few decades...
This article is specifically about Moonies though. I've also heard first hand accounts of that exact situation happening in the town where I went to college many years ago.
I honestly don't understand why people keep recommending CS50. Maybe I'm just a slow learner, but I really think that if I had had to learn programming with that course, I would never have learned it - the learning curve is really steep, and it crams way too many languages into a very short amount of time, making you a jack of all trades and a master of none. I also don't understand the obsession of CS curricula to have people implement things like sorting algorithms by hand. This would've really put me off as a beginner.
We tell them with loans.

Electric cars and renewable energy are cheaper in the long term than gasoline cars and fossil energy, but gasoline cars and fossil energy require less capital up front.

The problem is that the third world is short of capital. So lend them the capital at really good rates (0% for example). That'll make the adoption of green solutions a no brainer for them.
> to cause your browser to silently execute malicious code and download malicious content

You are making assumptions about my user agent.

If you use insecure JS-executing browsers and problematic ISPs (I know not everyone has a choice), consider VPN or an extension that forces HTTPS.
Very cool.

At university I built a 4 bit stack based CPU out of TTL. It had store, load opcodes and could address 8K words of RAM so it had some actual utility. It was one of the most interesting things I’ve ever done. Annoyed they wouldn’t let me take it at the end of the course!
Presumably the fire department is merely offering advice, because they’ve been called out to dryer fires. And they’re the fire department, not the energy efficiency department.
Yes, there is a certain measure of trust going into parties like Let’s Encrypt, but I don’t think it’s as bad as you are saying.

• A CA can’t intercept anything based on your using them.

• A CA can refuse to issue a certificate for your site, but if this got out (which it would), it would significantly damage their reputation and I don’t think it will ever make sense for them to unless legally compelled. In that case, there are other providers, unless legal compulsion has removed them too, in which case the world wide web is dead anyway, so this is not worth worrying about.

• A CA can issue a false certificate for your site. There is, however, a non-trivial risk of them being detected in doing this (much smaller for small sites, but the system is set up in such a way that almost anyone can check and detect most instances, and I think you can be reasonably sure Let’s Encrypt specifically is being monitored for suspicious patterns by multiple parties that have vested interests in the system running smoothly), and if it did get detected, they would certainly be subjected to extreme scrutiny, so that any more instances would be very likely to be detected, and if a good explanation was not provided in short order (and even then it wouldn’t be too easy to recover), they would be dead, though it would certainly be a period of great pain for the web. In other words, not only does the potential upside of cheating go up, but also the downside.

I don’t think your conclusion that you should support HTTP is reasonable.
What do you mean "no matter what the manufacturer says"? If the manufacturer says your warranty is void - it is. If they broke a law in doing so is a separate issue that you would have to battle out in court.

When your 800$ laptop's speakers start buzzing and the service center says you need to pay 80$ for the repair because the tamper seal on the RAM was broken, are you really going to spend 30k and a year of your free time to sue them over it?
They know they’re just gonna have to max out the credit card again for that thing (one of many!) they’ve been putting off for months. The poor always have another bill lurking to wipe out a small windfall like this.

Like their cancer treatment. https://www.nbcnews.com/health/health-news/cost-cancer-drugs...
> a significant part of families die from hunger, riot violence, live in slum conditions

You seem to be under the impression that we’re going over a cliff, rather an be a slow decline/collapse. What evidence do you have to support that? I’m not saying I don’t believe you, but we’ve had a long history of predicting eco-doomsday, but we’re still here. https://cei.org/blog/wrong-again-50-years-of-failed-eco-poca...
SUVs are not in fact pulling 30 mpg.
maybe an ai can be built to replicate dangs diplomatic personality
People are generally aware that their actions contribute to climate change, unless they choose to deny it for ideological reasons. They are just unwilling to make lifestyle sacrifices because of it. Most people value their personal comfort and the comfort of their family above the (statistical) lives of strangers.

You see exactly the same phenomenon every time a professional chooses to live in comfort instead of donating most of their income to charity. That's how people work, that's what they value, and that's why collective action is the only way of dealing with large-scale problems.
All of those things are protected. If the firmware melts the board, the CPU overheats, or the replacement part shorts something out then the warranty is void. However, if the failures are unrelated, then it's fine.

I once caught a motherboard on fire, then found some unrelated mechanical issues with it. (It still worked, except for the bad connector.)

The burn marks were cosmetic, and the shop sent me a DOA replacement. (That's more a story about the shop being awesome, but they were technically legally obligated to honor the warranty.)
Adding to that: just slapping HTTPS on those connections still would prevent an observer from detecting you downloading cowsay. IIRC every package has a fairly unique size and unless you add padding that is enough metadata to figure out with reasonable certainty which package you requested. So it’s not like HTTPS would add any immediate benefit anyway.
At this time, the platform is less the issue than the fact that humans have fallen for the spell of social media. Because there is no "gatekeeper" or news editor, information can be spread by anyone regardless of how smart/stupid the idea/information is. The more idiotic the idea, the more people tend to let it take hold. TikTok is just the latest to be hit by it. People are the problem.

Having said that, the platforms have now learned to amplify the "trending" ideas to ensure more and more see it via algorithmic promotion rather than organic spreading. If one platform's algos are better at promoting crap, does that mean the platform is bad/worse that's the problem, or that people's unsatiable thirst for idiocy is to blame?