skysight-inc/HackerNews huggingface dataset:
My read on the bug is that it'd take quite the combination of factors to be exposed, I don't think it poses a widespread or remotely likely risk.

App in question has to allow file upload that writes to local disk. Attacker would have to upload his ruby payload via this method.

App in question has to allow arbitrary, user-entered time zone select, eg allowing a user to enter "EST", and then pass that directly, raw, to TZInfo::Timezone.get(). Attacker would have to know where in the target filesystem their uploaded payload is, and submit a crafted timezone payload with escape characters to the path of their uploaded payload file relative to where the TZInfo gem is.

So, lets say I upload nasty_ruby.py, and the app puts it in /temp/myappuploads/nasty_ruby.py
And lets say the tzinfo gem is running in /myapp/gems/tzinfo-gem/
I would submit something like 'fake\n../../../temp/myappuploads/nasty_ruby.py' which would cause the impacted tzinfo-gem method to call require on '../../../temp/myappuploads/nasty_ruby.py' which would execute it.

In general, I don't think I've ever seen time zone selection available as freeform text vs, say, a dropdown, so that seems fairly rare. Assuming you do have a freeform text form submission for timezone, you have to ALSO have a file upload capability that would place files on the local disk on the same system. And then, the attacker would have to either know or traverse/explore to find the path to where those files are on the system - ostensibly possible but seemingly unlikely? And this is all predicated on you using an old version of tzinfo-gem.

That said, if your ruby app checks all these boxes and is running an outdated version of the gem then yeah, its a straightforward RCE and thus very bad (and i think why they rated the severity as they did)
If you are a discworld fan it's worth reading Strata, one of his earliest works.

This is set in a disc shaped world as well and you can see the early shape of the discworld concept (the world but also the style of the books). It's like seeing him work out his voice.

I love discworld a lot. But Good Omens is, for me, the essence of the craft of dark humourist fantasy. So many observations on humanity.
Maybe they were right? On a serious note, though, and I am diagnosed if it adds any value to my response; anecdotally, I tend to hold strong opinions only upon strict testing (usually internalised argumentation) and, therefore in such cases, maintain extreme bias when judging against alternative ideas. Furthermore, in many cases I will only speak if I have something to say. In that sense, if I understand I am wrong, it makes sense to just accept it and does not look necessary to communicate it. Similarly, in the realisation that the person I am having argument with will not be convinced, I may still not discuss further, even though I still think I am right, just because I do not see the value of convincing. Understandably, in the context of my previous statement, they might infer this as an indication of me being wrong. The last few years, I have started telling clearly that I am wrong, when I think I am, not because I think it adds any value, but because it looks like people are really passionate about proving themselves right to others, when I mostly just care about being right. Telling people you were wrong seems to make them happy and therefore more prone to accept your position in future disagreements.
Does anyone else read something like this

Jeremy Allison gave a talk titled "The UNIX Filesystem API is profoundly broken: What to do about it?".

and immediately shut down on the person saying it because he all know it's extremely hyperbolic given what is happening in reality?

It's great to not like something and point out its flaws as far as you use them and "here's the great idea to fix those issues" but to try to offend you audience and the Unix community as the first words you see in a talk is a great way to have people shut off and think "oh great another neckbeard with an overinflated sense of self"
...in the same county that had America's largest recent Measles outbreak in 30 years. Rockland county.

My good friend is a pediatrician in the area and frequently gets calls from mom's who ask if he does "evaluations for potential vaccine injury" - which is code for "I need a note from a doctor to have my child exempt from vaccination".

Unfortunately, their poor vaccination culture caused Measles to spread to neighboring New York City, and then across the country.
Craigslist killed craigslist. lack of innovation and development really let the competition get ahead.

Facebook marketplace - as basic as it is, does a much better job of "finding" what you're looking for. In Canada, kijiji (bought by ebay at some point) took it's lunch before marketplace ate them both.
I think they meant for the first "for" to be an "or."
This is one of the most misguided security features - in some cases in public places maybe. But anywhere else let me at least see what I’ve typed (or as the iPhone does show me at least the last character as I type it).
Guards! Guards! is great. I would also add Interesting times for more prototypical Discworld and also Truth is pure gold.
Ask HN: What's Your Favorite Tool?
I'm always amazed at the cool/useful new tools that I find out about when I talk to new people. It can be hardware or software. My current favorite, ferrule crimpers. Probably because I've been wiring a control cabinet.
GP agrees with you.
interesting, getting into an area of business just because "it makes money" doesn't make a lot of sense.

All of these streaming businesses need content. They are large money pits as well. Look at the spend on original content every year. What does it really drive in addition for MS ? Amazon did it as another benefit for Prime members. Google already has Youtube. Apple pushes hardware. Just curious what the net benefit for MS would be. Their xbox sells well alone, not sure if it makes a difference.
Does this guy have a blog? I loathe tweet storms.
I-Bonds are yielding 9% currently with a couple caveats.

https://www.treasurydirect.gov/indiv/products/prod_ibonds_gl...
But not available to the general public :(
Craigslist is still around though. And they have intentionally stayed small, so I don't see how they're "getting killed".

If CL's values as a company were different, then maybe they would have decided to become a rent-seeker like Facebook, with a six-figure employee headcount and a multi-billion dollar ad business.
"Will you take in trade?" is annoying when you have no interest in the stuff being offered. I recently bought a Canon 5D Mark III from a seller who also had another lens I wanted to buy. When we met I mentioned that I really wanted to get the other lens too but needed to sell my Sony a6400 and lens before I could justify it... turns out he wanted another a6400 and the lens would be a handy addition so we met one more time for a second transaction. I don't know if he would have accepted the offer for the trade at first had I offered it, but given the type of gear I was buying and what I knew he had for his primary gear I figured my stuff was way too down-market for what he shoots. Had I never asked I would have lost out... so I try not to get offended when people offer a trade as long as it's a reasonable trade.
Copy+pasting my comment from another thread:

For those wanting to plant milkweed: not all milkweed is a Monarch host. Of the known Monarch hosts, there is minimal documentation of which is the "best" for a Monarch. It's recommended that you pick a host native to your area. Page 93 on the following document[1] includes some species that are helpful to Monarch populations, broken down by area of the United States.

For those who would like to purchase caterpillar stock to increase the local population, please reconsider. Bred Monarchs have a lack of genetic diversity that you are releasing in the wild, which can tip over populations due to poor genetics. There is research that shows that planting evergreen milkweed (encouraging sedentary behavior by removing the need to migrate), or releasing captive or reared monarchs, can allow unhealthy monarchs to survive and harm the population when they would not otherwise have survived migrations[2] Studies on bugs or and species have shown that animals can adapt to captive conditions in as short as one or two generations. When this happens, researchers wind up seeing alleles that are harmful to the wild population. [3] There is also the case to be made that by releasing abundant numbers, you are potentially creating food shortages that will harm even more butterflies.

Plant local natives. Don't release into the wild.

[1] http://www.xerces.org/sites/default/files/2018-05/17-031_02_...

[2] https://royalsocietypublishing.org/doi/10.1098/rspb.2014.173...

[3] https://onlinelibrary.wiley.com/doi/abs/10.1111/j.1365-294X....
Understandable. My condolences to you and your family on having to go through the hell you have had to.

When a bit calmer, I would still encourage you to reach out and find constructive ways of dealing with the grief.

That may commonly be to write letters/email to those that have affected you. It seems that Dr. Lense's work has had that affect on you and it may be helpful to you to write to him. Academics don't interact much with the public and having someone write to them does help focus their work and right wrongs. You may come to new understandings of the Dr.'s efforts and of your own self.

Again, best of luck and I hope you find peace and guidance.
How hot is too hot for the human body?
These last minute cancels have happened to me so many times on airbnb that I've stopped using it. It's just not reliable. I'd rather get a hotel that basically never cancels than having a rug pulled underneath me days before a trip.

Will wait a year or two to see if this makes airbnb reliable in any form.
> has been described as the perfect storm

The conspiracist in me thinks the French state actually finds it very convenient. Just when it needed to announce new reactors to be built it finds the perfect justification. To me it might even had had a heavy hand in setting the threshold of corrosion for these shutdowns.
Is this the main species of monarch? I have them in my yard pretty regularly, but I also plant milkweed, their host plant to try and provide them with some habitat.
This, I thought that Facebook gating would reduce spam but have gotten more simjack attempts than on Craigslist
Destruction of the food source is one of major causes of the population drop, as mentioned in the linked article. It also mentions storms being able to wipe out millions.

Even if there’s 100x as much milkweed next year as there is this year, it terrifies me that a forest fire or something could easily wipe out such a small population today and that’s the end of the line.
Just pointing out that there was a shadow edit to this comment. It used to say Russian need outlets were blocked by the West.

It isn't actually blocked in the US
For people who likes the kind of backstabbing thrilling behind the scene diplomacy wackiness that ooze from Eve, but can't really get involved in it for whatever reason (most often being time, motivation, or the fact that 99% of eve gameplay is actually more excel than malta conference), I highly recommend you give Neptune's Pride [1] a try.

It's not at all the same kind of game (it's a "turn by turn" 4x game where turn passing is tied to actual time in the real world), but it's really simple and at its core is based on the same thing: diplomacy through the simple but effective messaging system between the players.

A game last days, but will only require you to play a few minutes every dozen hours or so (sending fleets to attack, etc ... Will take literal days to happen, which seems strange at first until you realize it's to give the diplomacy center stage, giving real people with real lives the time and opportunity to exchange and plan and backstab together.

It's also extremely fun with friends, in a mario kart's blue shell kind of way. 90% of the fun is the pretenses and backstabs, don't play with friends who don't like losing, nor with people who let themselves lose on purpose if against their SO etc ... or the experience drops significantly.

[1] https://np.ironhelmet.com/#landing
> it was cancelled 8 days in.

That is a different kind of cancellation as now it could be for cause which isn't the case for a cancellation before the stay.
I usually sell stuff that has any value for 50-70% of value to friends or family not to deal with idiots.

Anything that is meh but someone from friends or family would like I give away.

Then I throw away. Even giving stuff away for free can be too much hassle if you put stuff online.
Hmm, tricky.

On one hand, I enjoy potential for anonymity on the web, and even in a social network I want there to be an option to contribute thoughts/opinions/content anonymously. FB & Twitter's veiled (not even upfront and honest!) insistence on phones is awful.

On the other hand, when it comes to marketplace, I very much don't want to have a no-name random person with burner phone and fake account showing up to my door to pick up synths or cameras or baby stuff :-/
Makes me suspect that 2k estimate was very wrong
If the project is in SCM, then surely your name is literally all over it.
You should start here: https://blogsurf.io/rankings
Saltbox raises $10.6M to help e-commerce stores store their goods
Based on my experience, Comcast would raise my rates regardless of this law.
A lot (not all) of cooling towers still require water for evaporative cooling. And the restrictions aren't just for temperatures of returned water they're also for the amount of water taken from rivers, during droughts that amount might get reduced quite a lot.
You assume an approximation of a free market.

In the US, most "markets" are largely dominated by monopoly, duopoly, or cartel conditions, and thus rent extraction. Combined with the efficacy and returns of lobbying congress for market barriers and subsidies, most companies are entrenched.

There are so many reforms needed in the US, but breaking up monopolies, or just stopping mergers, would be task #1. Price, creativity, options, innovation, worker empowerment, amount of employment, wages, all improve with more companies, more options, and more competition.
untrue -- Blue Gum is not native.. aka eucalyptus; specialists needed here
Defeating JavaScript Obfuscation
eBay also still alive, also inundated with scammers (from what I’ve seen, mostly targeting sellers).
...To avoid discussion between English 'CUT' and French 'TUC', a form that does not place the substantive, 'T', neither before nor after the attributes - just in the middle. ("Universal Time, Coordinated [standard]"?) Nice!
I used to be a bar manager 16 years ago and would often see the Anheuser-Busch marketing rep for our region out and about, and she would never fail to use her corporate credit card to buy me some free drinks. I liked that form of marketing.
My parents started using marketplace and had mixed success with it. They immediately get messages from scammers who want to use them for phone number verification tricks, which as best I can tell are nearly benign; they just seem to want to use some service that requires a valid US number, not necessarily their number. Still, no good can come of that.

On the other hand they've had some luck actually getting rid of stuff, so that's been good.
I've successfully used hg-git on something as large as Waterfox (slight irony there because Waterfox is a Firefox fork, and Firefox's canonical repository is a Mercurial repository, though they also maintain a Git mirror).

The import of something that large unfortunately took a few hours, and it's a bit annoying that under the hood hg-git needs to store both the native Git repository as well as a copy converted to a Mercurial repository, but other than that it works quite fine in day-to-day usage.

And with smaller repo than something like Firefox's the above disadvantages are of course less to hardly noticeable.
> What I'm hearing from you is that we need to regulate companies to mandate interoperability.
Could you imagine a world where telephones couldn't make calls to each other or cars needed special gasoline that was only available from gas station chains that licensed it from your car maker?

That's nonsensical - none of your examples came about from regulation, they were market-driven.
I’ve never heard of NAC or Emoxypine - but here’s what Wikipedia says about the latter:

“In Russia, emoxypine has a wide range of applications in medical practice. It purportedly exercises anxiolytic,[4][5] anti-stress, anti-alcohol, anticonvulsant, nootropic, neuroprotective and anti-inflammatory action.[citation needed] Emoxypine presumably improves cerebral blood circulation, inhibits thrombocyte aggregation, lowers cholesterol levels, has cardioprotective and antiatherosclerotic action.”
Terrible communication by coinbase but I think coinbase are actually correct and pro-customer when they say there is a lack of good legislation around digital assets. While it remains unclear whether or not these coins are covered by existing securities legislation it also remains unclear what costumers and exchanges can do with these coins. If the SEC decides all these coins are securities it will criminalise the insider trading for sure, but it will also potentially criminalise coinbase's exchange as (They aren't licensed to deal in securities AFAIK). In my own view that might be a good thing but whether this is good for customers is debatable - I'm not sure where they could go instead.
The US is in the west so clearly "the west" hasn't blocked them. A subset of European countries have.
Even the Business Roundtable doesn't follow the "rational model". In 2019, the Business Roundtable, which consists of America's largest companies, said corporations should focus not only on making profits, but to:

- Delivering value to our customers.
- Investing in our employees.
- Dealing fairly and ethically with our suppliers.
- Supporting the communities in which we work.
- Generating long-term value for shareholders.

https://www.businessroundtable.org/business-roundtable-redef...
I think that carbonation actually helps, yes.

It has a positive affect on an irritated stomach lining, I've found. This is easy for me to explain when it's slime/phlegm doing it, as the bubbles helping enzymes and stomach acid dissolve the goo.

I'm seldom enough drunk to have a good sample, but liquor isn't good for the stomach, and I've cautiously drunk a pint of sparkling water with complete success, while knowing that still water would have come back up within five minutes.

Maybe the stimulation of the bubbles promotes the lining to exude what it's supposed to, which alcohol strips away? No idea but I do think it materially helps.
Whatever decision you make, be 100% sure first he is taking all the credit and using you as a “ghost coder”. Sometimes remote working environments make us think they are not taking in consideration our work.
Try to skip a management level in an informal environment like a coffee machine and start a short pitch about “your project” with the boss of your boss.
I still run into arbitrary password limitations (no special characters, 20 character max, etc). I go through the “reset password” process just to see what arcane rules I had to follow, which is enough to help me remember my password so I can log in.
USB stick
It's a strange article to illustrate inflation. It mentions there is a drought that has made a local river dry, which was a tourist attraction driving a lot of traffic through the town. This meant a lot less customers, a lot less pay available. It Didn't seem to try to disentangle the inflation from this other pretty big effect... which seems hard to do... But then why pick this town or this headline.
Just DO NOT WATCH THE WATCH!!

It will leave scars...
Florida chef’s pink sauce videos stir up TikTok backlash
See this as an opportunity, start your own Tumblr site. Your girl can start over and be safe knowing it's your site, and she can bring her friends (network effect!)
added, thank you
I'm done with them as well. ~10 years ago, it was a novel, fun way to travel and meet new people. Now it's become a business for many hosts and it shows. I have never appreciated a hotel room as much as I do now, having gone through the AirBNB gauntlet one time too many.
Monero prevents all that. Nothing is publicly visible other than the data demonstrating that the transactions are valid.
Snapchat Stock Down by 38%
In Dutch. Google seems to do a bang-up job in translation:

https://www-n--tv-de.translate.goog/politik/Historiker-Manfr...
It tastes very bitter and you have to eat quite a lot of it for it to be dangerous. It’s a risk but mostly for sheep and the like. Properly prepared, people do eat it intentionally.
Flash drive
Exactly. This, to me, is the major downside. Anything outside the norm in subcultures, subgroups, hobby communities, is left to wither and die.
Plant milkweed. They may take a few years to establish, but it's effective. We get monarchs every year now. This is in an urban area.

Small conservation efforts really do make a difference. Don't be discouraged that you're not fixing the big issues. Pollinator gardens will improve biodiversity in your own little corner of the world, and that's worthwhile in and of itself.
Love the battle axe contest.
Putting it on my backlog.
It is so nice with having a small native language. The amount of foreign scams were non-existant until machine translations became viable for them -- but are still easy to spot.

As English speakers you are so much easier targets.
A promise is an object representing an asynchronous result. Some languages, such as Python, call them futures. A promise object will typically have methods for determining if result is available, getting the result if it is, and registering callback functions to be called with the result when it's available.
If you have a yard in the right area, plant milkweed. I have at least 10 plants in my yard. I enjoy watching the little guys munching away until they suddenly dart off to the vines to cocoon.
> You can have a single tail with an atomic add, and that's pretty much it.

That's the primary difference. In a disruptor queue, there's two tails. The first one is used for producers to allocate space in the buffer to write to, and the second one is used to commit it so that it's available to consumers.

It's true that there is a small amount of necessary synchronization across producers, because a producer can't commit its data before a concurrent producer earlier in the buffer does, and can end up spinning on an atomic compare-and-exchange. They can both independently write to their allocated parts of the buffer freely before that point, though, so in practice it's not a contention point.
Your #3 link seems to be talking about a market, not a maternity ward. Did you give a wrong link by mistake?
the vast majority of the population growth is in places that have never seen this species; overly-general advice is not going to solve this particular problem
Woodworking, sketch up, basic electronics and home renovation.

A little bit of everything and trying to put them together in different projects.
Those shoes are worth tens of thousands now. Sneaker flipping is the easiest way to make money in 2022. You missed out.
Shameless plug: https://indieblog.page allows you to discover new blogs through the power of randomness. (previously on discussed on hackernews)
But the solution is again: more native plants. Certainly wildfires will destroy any initiative there though.

We have got to have a movement of restoring native plant life.
The alternative solution is that executives don't make decisions, only coordinate between the people on the ground who have the necessary context to make decisions.
So when he says:

> The accusations that I am aware of are unsubstantiated falsehoods

Does he mean that people got mad at him for the three points you listed and started inventing stories about him as a result, or is he flat out denying those things happened at all?