skysight-inc/HackerNews huggingface dataset:
NVD – A Catalogue of Vulnerabilities
Within the infosec and SecOps community, NVD is a well-known entity, but we realised outside of it, there are few who are aware of its existence.

So what is it exactly?

NVD stands for National Vulnerability Database. It is one of the largest collection of vulnerabilities that have been reported by software vendors or security researchers all over the world. Thousands of IT-Security teams and enterprises use this data source for vulnerability management, security and compliance of their tech stack.

NVD was originally conceptualised in 2000 in the U.S with the objective of creating an access database of attack scripts, but later on, evolved to be a collection of vulnerabilities. It is maintained by a group within NIST and builds upon the work of MITRE and others. Vulnerabilities in the NVD are called Common Vulnerabilities and Exposures (CVE). All NVD data is freely available. There are no fees, licensing restrictions, or even a requirement to register. These feeds are updated approximately every two hours.

So is NVD the answer to all your vulnerability management issues?

Unfortunately No. The problem is vulnerability disclosure time latency. In this context, vulnerability disclosure time latency is the delay between a vendor disclosing a vulnerability and the NVD publishing the vulnerability. Relying on only one vulnerability news source can leave an organization more at risk if they only rely on the NVD for vulnerability information.

Another drawback is the lack of context. Information of NVD doesn’t have the local context that organizations need to move quickly and take the best action. As organizations continue to expand their IT landscape and shift toward new technologies and services, they need to customize their vulnerability and threat ‘news’ that they use to make risk decisions.

We at SecOps Solution are solving these problems by relying on more than 50+ databases to obtain vulnerability feeds. Our patent-pending context-based risk identification & patching technology helps organisation prioritise and mitigate risks that are most critical to their business.

To schedule a demo, drop us a note at hello@secopsolution.com
It wouldn't be an arms race, it would just be treating everyone equally, albeit equally poorly. Unbalanced sexism looks more like an arms race as the those who are in the victim group will try to reverse the roles, and if they succeed, the new victim group will try the same. By far the most common justification for sexism seem to be perceived unfairness and sexism by others.
Seems to work on desktop, doesn’t sync with mobile though
I really dont think the article is good at promoting that idea. And one problem (frequent with Paul Graham writing) is that it builds false dichotomy in between supposedly simple talk language and complicated written language.

Written language is not inherently more convoluted and complex. Not even on discussion forums with untrained people who dont read after themselves.

> It seems to be hard for most people to write in spoken language.

The written texts end up convoluted frequently because people do write them as they think they would speak. People speak in complex sentences, tone of voice making the difference. Then they see all the horrible warts and try to fix them - badly.

Also, the article does not contain actionable advice on how to write. It does not help you to deal with sentence structure nor help you to refactor bad sentence. It is fluff.
IMO a lot of these UI "degradations" that love to people complain about absolutely pale in comparison with the sorry state that Windows is in
You know it's bad when some of the world's most environmentally damaging companies top the scores.
How to Secure Your Notion?
Well, count me in the third group: I make use of hierarchical storage, consistent naming conventions, and other organizational tricks to give me a rough idea of where any file might be. I also fail miserably at it (apart from dev/programming stuff, which all is in `~/dev/<project name>`) and rely heavily on search to find anything again.

As search is fast enough nowadays with indexing, I'd rather have it search the whole disk every time than the directory I'm in just to realize I've put it someplace else.
Call me old fashioned. I email.
I am in Manchester, is this for people in the London "bubble" only?
Visitors to South Korea can enjoy the spectacle of Korea's most famous ginkgo tree, at Yongmun Temple (양평 용문사 은행나무) on the outskirts of Seoul, 42 meters tall, and thought to be around 1,100 years old. It has been designated a National natural treasure and was already famous in the 15th century, when the famed monarch King Sejong (r. 1418-50) designated the tree with ministerial official rank (正三品）。

http://www.heritage.go.kr/heri/cul/culSelectDetail.do;jsessi...
> Interesting story, Apple will not sell you a replacement or upgrade SSD for your 2013 Mac Pro - not for any price. They're only available for warranty replacements, and these computers haven't been under warranty for a long time.

This is bullshit. Think about all the PR they have about eco-friendliness, yet they do this
the difference in how Ye comes across between the Champs, Piers Morgan and Lex Fridman interviews is stark.

Champs was way too comfortable, Morgan way too hostile, Fridman plays it as he usually does, neutral listener and Ye seems reasonable most of the time. We have individual personalities, but how they are expressed is determined as much by who we are with
There was a PR merged yesterday which should give us 5-10% improvements in compile times [0]. As long as there are people monitoring and working on compile times, one could optimistically hope that as more companies become willing to throw money at Rust, we'll see improvements over time.

Regardless of how fast one's machine is, I think having some compile caching infra like sscache should help improve time to compile.

[0] https://perf.rust-lang.org/compare.html?start=9be2f35a4c1ed1...
That's a good thing.
Forcing people to give their phone number to use an instant messaging app/protocol is a sign the company just wants your private data.

Also, by doing that and letting the account existence be publicly known, anyone with their phone number will know that they have an account on that service and lets you try to contact them. That can range from privacy violation to life-in-danger situations.
> Can also do `oflag=direct` and it'll just skip as much of the caching as it can.

Correct, and that's one more point for dd compared to head/tail (which are fine commands by themselves).

But wouldn't help much in my example, where I used an (very) old "high speed usb 2.0 stick" with 4 MByte/s write speed to demonstrate the difference between buffering and actual writing.
The Linux clipboard feels like home to me too, but let's not kid ourselves. Between primary, secondary, and clipboard, it's part of the learning cliff (cos it's steeper than a curve) that is linux. It's totally inscrutable!

ctrl-v and shift-ctrl-v and middle click and shift-middle click and tmux and vim.

The damned system makes no sense! Probably why it feels like home, once you're used to it.
“Prove me wrong.”

No. That’s the point. The burden of proof isn’t on anyone to disprove your untestable theory about market penetration (although in the case of JS vulnerabilities your premise is completely baseless anyway).

That’s like saying “you can’t get cancer from smoking if you immediately drink a herbal tea after every cigarette because of it’s mystical healing properties. Prove me wrong.”
> Lots of weird issues with Docker (might be on Docker's side though)

Thanks for the heads up on this
Just because there's something in it for them doesn't mean it's not still volunteering.

Do you also apply such a standard to modern examples of volunteering?
Because of the @ sign ? That and many things regarding Macs are quite odd. When I as a programmer has to google how to enter [ | and ~ I am about the throw the thing out of the window....
In the past 5 years, how many ARM devices has MS released, other than the Surface Pro X ?

My "anecdote" is actually the majority of MS's history so far. You just can't claim it's scaremongering when they have released so many locked down ARM devices it's hard to remember all of them, and definitely easier to just remember the few "unlocked" devices they have ever released (just the X?).

And also "obviously" we should mention that even in the so-called unlocked Surfaces you are still forced to entirely disable Secure Boot in order to run Linux or _anything else_, with the consequences that implies. For example, it is dubious you will be able to load future versions of Windows, since those will require SB to be on (W11 already officially does, even if it doesn't seem to enforce it -- yet). A properly unlocked device would allow you to load your own signatures while keeping SB enabled.
Obligatory https://m.youtube.com/watch?v=tWwCK95X6go
It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of
> The Linux kernel did not even compile on most non-GCC compilers

I believe that was a feature.

non-GCC compiler, like Clang+LLVM, are (were?) considered to be open source but not Free Software (TM)
By “biggest” I meant “giving the biggest impact”. I don't know if it's the slowest part.
> This is the dumbest idea ever.

Opening that conversation is laudable.

> But for personal? "Never talk about how much money you make, you either make more or less than them. Either way it makes for a very awkward conversation".

It's true, but also in large part cultural. Culture changes, though. We should discuss transparency's merits. What are the potential downsides versus benefits of having a more open salary approach?

I found that for freelancing, having an open-price policy is beneficial. For example, it filters out low-paying clients. And by providing this information to your competition, you also level up the entire field. Competition works better with a certain level of solidarity and fairness within a given field.
for me it should always consider business needs if it is for profit, otherwise user experience and developer experience.
If I was a recruiter reviewing someone's application, I would not bother to interview someone based on the number of short term roles and being terminated. This is assuming there are a few applicants. I think this stuff does matter, probably less so in the last 10+ years.
Because what is more maintainable is less buggy. The consolidation of effort means that the effort can be spent elsewhere and we will be pleased with how they prioritized.
> Apologies, but what do you expect to happen to the file in-between the cut and the paste?

I'd expect that nothing will happen, Cut will wait for paste operation. It's not delete, where content is gone immediately. If no paste will follow, then Cut is not executed. Cut marks file for move operation, if no move is executed, then nothing will be lost.

> If I cut a sentence from a document and then cut another sentence, the first sentence is effectively gone (without an additional clipboard manager).

We're talking about files here, not text. Text behaves differently. I'd argue that Cut operation as it is in text editors, is not logical but it is what it is and people are used to it. For deleting there's Delete operation, Cut should not be equal to Delete in some occasions.
Most of these sleep/suspend issues are related to deprecation of the old s3 sleep method and migration to the new s0ix sleep stuff for modern standby.
As you're already using fd for find, you may like ripgrep for replacing grep.
“I acknowledge that I’m at risk every time I go online..

I assume the author thinks the same way.”

Just from reading the article, it does not seem that the author thinks the same way at all.
Disagree completely. I’d much rather have a link to a trustworthy source than a random person writing “Tell HN: WhatsApp is down”. The post you think should be frontpage is useless imo. Take the time to link to a source instead of trying to beat everyone to the punch to get a little karma.
While I think that's equitable, you could also see how an employer might try to keep a larger share. And most employees would probably agree to getting something substantially less.
In my experience WhatsApp has around 1 hour of (noticeable?) downtime a year, although not evenly spread out. That's about 99.99% available, which I'd consider pretty damn good for a consumer application. There's almost no person or business who will have a real problem caused by that. Let's not blow things out of proportion.
The overall idea isn't that bad because tailscale basically already authes you on the network level, and in the kinds of infras this is for, this means you are already behind like 5 VPNs. I agree that automatically authing without user input is a bit much (eg worms) but tailscale has support for recieving and handling a "are you sure you want to conect to x" confirmation on the authentication source, it's just a matter of actually using it.
The Progressive Case for Crypto Privacy
This study is useless. All it can tell us is: The number of insects flying above two particular roadways in one country over the course of 2 decades has declined by about 90%.
We can wildly speculate about what this means. Is it genetically-modified crops? Is it climate change? Is it changes to our automobiles? Is it population density changes? Are the bugs increasing elsewhere to compensate? etc. Has something about roads in Denmark changed? Is this part of a larger cycle within Denmark?
A Potpourri of Emacs Tweaks
> It also benefits from p20 functionality.

What's that? p20?
I feel like iMessage is also being weird
> you could also see how an employer might try to keep a larger share

But trying to keep a larger share means you lose out on all of it, as you will get outbid.

If they can save other companies 1.2 million as well (which they will because few companies are so unique) then their price will naturally creep up towards that value as others will be willing to pay more because it's a good deal.
> The criticality is not to have the CVE in the first place.

I guess the most critical part of a Linux Kernel is being able to compile it in the first place for the architecture you're using.

Virtually every platform/architecture out there provides a C compiler.

Can't answer on the CVE part, we have no data to discuss the matter in a meaningful way.

There's certainly hope, it doesn't mean data will prove us right.
The author apparently hates the last version of MacOS, but plans to buy a new Mac soon nontheless (it's only the one after that may not be a Mac -- maybe). Why should Apple care if people keep buying their machines?
Yes it's what I do, and then I actively struggle to hold back on pushing Matrix/Element as the solution. The beauty of the federated system, it's the way the internet was intended to function, oh man I love talking about it. But, nobody unaware of Signal will ever run their own Matrix server of course.

Signal is simple, recognizable, very much like WA. A WA outage is indeed a good point in time to have a lighthearted conversation about messengers and platforms. A lot of people still don't realize Meta owns WA.

What I like is that the normy friends I have on Signal are now telling all their normy friends/colleagues about Signal and how we are still apping away while WA is down.
The best thing about dd is the argument system. I like the key=value format. It feels better to me.

I think dashed arguments, that is, getopt style, just add unnecessary noise. This is usually not so bad. But gets pretty annoying when you have an actual language exposed in the args, I'm looking at you iptables. in iptables the readability would be far improved if they had just left off the dashes.

Then there is the unholy abomination that is --key=value what is that -- prefix doing for anyone?, just drop it and use dd style key=value args and everyone(ok perhaps just me) will thank you.

So my conclusion is, ditch cat and just use dd.
The bonus is that dd works in both modes: file to pipe, and pipe to file, downside is that dd can't concatinate files. but who actually does that(joke).
It is not a matrix client. I haven't dug too deep into their system, but it looks to me like a centralized server with additional steps (ie. still a single entity owning the server infrastructure)
What’s the issue there? How is knowing the local IP a security issue?

And FWIW, the local IP does not get leaked when using a VPN. (edit: Or rather, the VPN local IP gets leaked. Same question, no idea if that’s security relevant in some way?)

edit: Thanks everyone, I completely forgot about fingerprinting.
So now it's not even just browsers everywhere, it's a binary format for browsers everywhere.
Postgres Is Eating Relational
I replaced Cmd-tab shortcut to launch https://alt-tab-macos.netlify.app/, who fix every issue with macos feature. Couldn't be happier.
Flight Simulator Focuses on the Other Side of the Cockpit Door
Blink 16.0.0
If you’re doing CI/CD, though, you should expect this kind of thing. I do appreciate that maybe there could be a throttle for major bumps.
> On urban US supermarket shelves virtually every bottle of olive oil advertises itself as "virgin" or the "even better" varieties ("extra virgin", [...]

That's interesting, I was thinking (in pure headline reaction) I don't think I've ever seen (in the UK) anything other (w.r.t. virginity anyway) than 'olive oil' and 'extra virgin olive oil'. Never 'virgin' or 'slightly more virgin' or 'supremely virgin'.
Plastic alternatives are not considered because they are more expensive for companies and less customizable, not because they would create more emissions.

Companies would do cost-cutting on product wrapping way before the emissions become a problem.
The inescapable fact is that if you do not want to fully jump into the Apple ecosystem, macOS treats you like a second class citizen.

I don’t find this to be true at all.

I also use Homebrew to install apps and casks, etc. and I’m running on Ventura.

I spend most of my time in WezTerm (was an iTerm user for many years) doing development… but I can use what Gruber calls Mac-assed Mac apps, which are the super useful indie apps which embody the original ethos of macOS apps.

That’s the beauty IMHO of the Mac today—best of breed native (NOT Electron) apps combined with all the power and flexibility of OSS GUI and terminal based apps.

It’s a different experience using apps in a fast, truecolor (16 million colors), GPU-accelerated, with full OpenType support terminal emulator.

What doesn’t get enough attention: the workflows and automations that can be created that aren’t possible on other platforms, since Apple Events are baked into the Cocoa/AppKit layer all the way down to the Unix layer.

Non-developers can use Automator or Shortcuts [1] to create workflows that combine the best features of GUI apps and the command line.

[1]: https://support.apple.com/en-in/guide/automator/welcome/mac
I do a 5K walk each morning. Takes most of an hour (I’m just getting up, now, and will be walking in a few minutes). I put on headphones, and listen to fairly mindless techno music, while I walk.

I use it to “triage” the day’s tasks.

I often figure out solutions to blockers, during this time.
I objected to how often I had to upgrade the version and pay for very minor fixes.
Updated my MacBook Pro, worked well (as expected), then proceeded to upgrade my M1 Mini headless "server". Update in itself went OK, though it doesn't respect that i have user accounts on an external SSD, so i had to ssh in as my "admin account", delete the /Volumes/Homes mount and reboot.

Now, my mini mirrors our cloud data locally for backups, and as such every user is signed in, and one way of doing that is simply a remote desktop and "switch user". It's cumbersome, and i wish it would just "magically" synchronize data once the user had registered on it, but it only needs to be done every time it restarts, which is when i new patch/version is released.

Anyway, i clicked "switch user" and poof lost connection. Following tries gave an "invalid desktop size 0x0" error, or it simply produced noise on the remote desktop window.

Logging in the user directly through remote desktop worked, but just be aware there may be dragons.
A step-by-step PhantomJS web data collection guide
Wings, obviously.
A useful example of how anyone can use PhantomJS to retrieve the HTML content from a given URL.
You mean the business people working for Slack/Discord, right? I don't get why a company would rely on Slack/Discord, given that those have access to their internal communications.
Like for most nutrients, both too much and too little are bad.

The olive oil and the other vegetable oils with high content of oleic acid, e.g. high oleic sunflower oil, avocado oil and others, also include adequate amounts of linoleic acid, which is an essential nutrient (e.g. when the daily intake is too small, various skin problems appear).

The cheaper vegetable oils, e.g. classic sunflower oil, corn oil, soy oil and others, contain far too much linoleic acid (which can cause liver problems). The use of such vegetable oils in human food has begun very recently, only in the 19th century, after their industrial production has been developed.

For example, I choose carefully the sources of fat in my food and in a typical day the fat comes from 54 g (60 mL) of olive oil + 33 g of almonds + 9 g (10 mL) of cod liver oil. (That started after being diagnosed with some incipient heart problems, which seem to have been corrected after a year of more careful food choices.)

Both olive oil and almonds contain fat where oleic acid is the most abundant fatty acid. Their quantities are computed so that they also provide adequate daily intakes of linoleic acid and vitamin E. The fish oil adds an adequate amount of omega-3 fatty acids.
I wonder if Intel's software-defined CPU feature could get banned under this type of law, if not this specific law.
yes, by all means, add additional components, complexity and digital logic to detect the overheating of an underspecced component, that sound much more reasonable than using a connector that can carry the required current without heating up.
You probably want to use

docker compose

not

docker-compose

The latter was the name of the compose v1 binary, so using it may cause your command to be handled with a v1-to-v2 compatibility mode. Depends on how your installation is setup. Compose v2 is implemented as a Docker CLI plugin.
Solving the max power problem by duplicating every EV battery so there is one stationary one and one in the car is vastly cheaper and actually physically possible. The net average power required in any given week is well under 600GW even assuming average efficiency is around 750Wh/km (1/4th of a tesla).

But that said, fewer and smaller cars is a much better solution. Most car trips are unnecessary if you have reasonable infrastructure and don't make cornerstores illegal. 25mph LEVs and NEVs can serve most of the rest and can be powered purely on the sunlight that lands directly on them where 90% of people live.

Trucking is a major issue if you don't want to spend those trillions on functioning rail instead, but no trucking company is going to pay $1/kWh just so there can be terawatts of idling nuclear capacity. They'd just build their own renewable+battery depots at $0.2/kWh.
>"I had two roommates who were warehouse managers"

Try packaging workers instead and see what happens
I read several times 2 stories in the past 5 years: the exported quantity of olive oil in Italy is bigger than the entire country's production and the global sales of Motul engine oils is 3 to 5 times bigger than their production capacity. I am not 100% of these stories, but at the time I read these they were from multiple reputable sources.