skysight-inc/HackerNews huggingface dataset:
As far as I understand it, there are basically five organizations involved:

1. TrustCor operates "TrustCor CA" and "MsgSafe". TrustCor claims these are completely separate lines of business, but does not dispute that it owns and controls both of them.

2. MsgSafe incorporated a spyware SDK from Measurement Systems into their Android app. TrustCor claims this was done by a rogue contractor (and thus TrustCor had no control over it), and they also claim it wasn't a security breach (implying TrustCor allowed the contractor to do it). Also, MsgSafe claims to offer end-to-end encryption while demonstrably not offering end-to-end encryption.

3. Measurement Systems produced a tracking SDK that is now considered spyware. It has historically shared many high-level employees with TrustCor, including (allegedly) having the same CFO and CEO.

4. Vostrom aka Packet Forensics sells spy equipment that claims to be able to break HTTPS, like you'd be able to do if you had access to a root certificate. They have nebulous ties to both TrustCor and Measurement Systems.

5. TrustCor CA is no longer trusted because of the above, and because its VP answered questions about it by saying her lawyer advised her not to comment.
You may use xslt for this kind of operation (https://en.wikipedia.org/wiki/XSLT) but it is often overkilled. I would love a language that allows to easily write transductions of HTML documents but I think that combining simplicity and expressiveness for this kind of tasks is a bit painful. I usually end up using pandoc filters or some dedicated javascript script that transforms the DOM and output a new HTML file.
> circumstantial evidence, but nothing that was definitive

That's not how things work. The role of a Certificate Authority is to act as a trusted third party. If that third party is unable or unwilling to demonstrate that they are trustworthy then naturally they can't be expected to assume that role.
The problem with this article
is it doesn’t point out that most money is bank deposits already, so taking the cash element away wont make much of a difference to the amount of bank IOU style money.

The bigger issues will be people used to not paying tax by
using cash (usually working class) will suddenly be a lot
poorer which could be a shock. The government may need to mitigate.
And the surveillance aspect of it, where
the
bank system knows every last
cent spent by every last citizen.
The Commission and the Parliament can do whatever they want but it's the Council that de facto has the final word on everything that matters.
I got some Flash applications[0] working in the Pro version of my remote, isolated iframe-embeddable multiplayer web browser[1] using Ruffle[2].

I use CRDP (chrome remote debugging protocol)[3] to run Ruffle on pages that need it (sort of like a Chrome extension content script). Ruffle itself uses wasm and is quite fast.

It's cool seeing the audio and video work and playing those old games.

-

[0]: https://github.com/ruffle-rs/ruffle/wiki/Test-SWFs

[1]: https://github.com/crisdosyago/BrowserBox#bb-pro-vs-regular-...

[2]: https://github.com/ruffle-rs/ruffle

[3]: https://chromedevtools.github.io/devtools-protocol/tot/
Until very recently, when courts forced Apple to allow it, Apple prevent developers from event mentioning that a website exists where there's a cheaper option to sign up.

Apple has rules, and that's "fine". But they also have rules about the rules that disallow developers from explaining the rules to users. That doesn't sit right with me.
> What am I missing?

The part that I'm not telling that my choice shall be default for everyone, which I repeated numerous times in this thread.

Apple decides to add a switch to convert iOS to macOS levels of freedom? Fine. Apple enables sideloading? Fine, I'll applaud even.

The thing is I'm not pro-"Apple's current stance". I'm pro-choice, but what I get today is satisfying my needs. If we can satisfy more users' need with one device (regardless of manufacturer), we should do that, and I support that.
> Publish lists of their owners and employees and/or ban them from Google/Microsoft services

How can you ban an individual from using Google or Microsoft services? Will you require id. cards, pictures and the like in order to register your Gmail account? Well, that would be great as it would stop many other people from using those services.

Also, what you seem to suggest (a "black list" exposing people working at X) is wrong at so many levels. Should we also expose people from the military, CIA, FBI, etc? Rest assured that those orgs cause so much more harm that companies writing exploits for your browser.
It becomes harder every time apple makes a change to something. GPU, bootloader, some secondary processor in charge or some obscure but surprisingly important thing. The whole thing is dependent on Apple deciding not to disallow it for now.
You seem to have completely missed the point. Signal doesn't know anything useful for such purposes. A mole, a court order, it doesn't matter.
Hi, Mikkel from Fermyon here.

Both Spin and the Fermyon Platform are open-source projects. Fermyon Cloud is a managed service built on top of the Fermyon Platform.

In comparison with WasmEdge, the WebAssembly runtime used in Spin is Wasmtime, which is also open sourced and built by the Bytecode Alliance.

Hope this expands upon the existing response.
Technique: Proof Types to Ensure Preconditions
It's a private company, of course the leader decides. But being a publicly accessible platform it poses a danger to the public when it promotes extremism. If the leader decides then the leader is responsible even with the penalty of prison time when people get hurt as a result of poort moderation.

Like I said in my comment, intent is important. If you say something with the intent of harming someone it is as if you actually harmed them. This is why planning to kill, steal or defraud is a serious crime. Elon himself should be banned for some of his actions on the platform. I see no proof of political moderation on twitter but even if there is it is easily fixable. Just replace people. These social media companies need a mandated moderation officer accountable to the DoJ really.

What pisses me off the most is how people don't understand how precious democracy and your country are. These companies are destroying them and like that in a day all of this will be gone for good.
Consider Disabling Browser Push Notifications on Family and Friends Devices
Isometric Pixel Art
Is there a 'rick-rolled' meme but with blockchain?
Pay your artists something meaningful on your own platform first!
Except the velvet lined iron fist called Google Play Services which gatekeeps the apps from having nice things or not.
Then make it a contact that can be opened by removing a screw behind a "non reversible loss of warranty" sticker so that only users who know what they're doing would be motivated to proceed.
I see it differently.

The person wants with wiggling words explain away technical problems to engineers, which does not work. Espcially all this "but it was a beta and never released" which is completely beside the point (which makes you wonder, did the person not understand the point at all or wants to wiggle out again).

The passive agressive tone to some E.g "Who are you? Why are you here" to some security researchers does not show good intent. The wiggling out with "thats not important that happened some years ago" is not convincing.

"But some other company that uses your CA product"

Another company that you own had an "alledged" rogue dev, but the person says "no-one can know, thats the way of life, so we should move on". It feels like a SNL police sketch where the police asks a question and the suspect answers "I don't know what happend last week, and can we really know what is going on, does anyone know? And it was last week, we should just move on, goodbye officer"

"If the integrity of the people funding the operations"

It's not about the funding but the two companies had (have?) the same officers.

The only way forward that could have been successful IMHO:

1. I bought the operation (Trustcor) 1 year ago and have no documents about prior company development or involvements because I didn't get any when I bought the company - and the people I bought the company from don't answer my emails.

2. But I did switch the auditor (has not happened) to make sure everything is ok

3. I will do my best to find out what has happened back then.
Looks to me like Trustcor’s subsidiary company MsgSafe made an app containing spyware. In addition, that spyware funneled data to a hardcoded url on a MsgSafe server which the Trustcor rep openly admits was only protected by a self-signed cert of unknown origin and was forwarded to unknown destinations as raw tcp packets.

There is a lot of doubletalk in the thread that is supposed to somehow lead us to believe that TrustCor CA and MsgSafe are totally separate companies, despite lots of circumstantial evidence that they aren’t.

It also happens to appear that MsgSafe and the company that actually created the malware (Measurement Systems) might be closely related and/or the same, owing to a lot of the same names on corporate documents (many of which names are shared with Trustcor and/or Trustcor CA), plus the extremely suspicious fact that the malware in question was only ever distributed elsewhere in obfuscated form, yet somehow MsgSafe seems to have an unobfuscated copy built into their app.

It’s also extremely odd that despite all the protestations about Trustcor CA and MsgSafe being completely unrelated, the Trustcor CA director of business operations has intimate knowledge of the source control, server configurations, and VM snapshots of the server that the traffic was being proxied through at MagSafe.
This is a great idea! I have been using Vimium [1] for years now in both Chrome and FF which provides similar functionality, it's a real productivity booster for me.

Vimium calls their flavor the "vomnibar", and you can search in open tabs, history and bookmarks. The bar is my most used feature next to navigating on pages, opening links and managing tabs (Go to previous tab, pinning, muting, closing, duplicating).
It might be a nice extension to take a look at for even more inspiration!

For people wanting tab switching like this on Chrome or FF, I'd say give Vimium a shot. Even if you're not into Vim-like key bindings, knowing Vim is definitely not a requirement to getting value out of it. It allows me to be completely keyboard driven.

[1]: https://github.com/philc/vimium
> entries on the ledger are cryptographically signed, which makes ledgers less expensive to audit and also prevents certain categories of fraud. So that alone should always make the costs of lending on the blockchain lower, and therefore also reduce interest rates.

.. but this is obviously garbage. The question in lending is always about default risk, which crypto does nothing to address. Most crypto lending seems to be so-called "overcollateralised" loans, which are secured on other crypto "assets", which also tend to turn out to be garbage.

And we can see that everyone in the crypto space is offering higher interest rates for depositors. Even more than Madoff's 8%. 10%? Why not! How about 10% per month! Who's taking the other side of that trade? Well, it turns out to be bankrupt exchanges and fraudsters.
Ask HN: What industries will be disrupted by large language models?
I can already see ChatGPT competing with Google in the near future.
> FWIW - we run secret detection in our trunk check precommit action - so we make sure that secrets are never committed into local or remote branches.

Irrelevant. You're describing a failsafe. It's like claiming that you don't need to care about speed limits because a road has guardrails. The whole process is broken if it fails to address the main reason confidential info can be pushed into repositories.
SEC rules don't apply here given there's no market to manipulate given Twitter is private.
> Unfortunately google requires either their app or SMS. They dropped pure totp for some reason.

I use TOTP with my Google Account all the time. If you have a phone registered with that Google Account it will default to the push notification system first (it might even be possible to make this no longer the default, I'm not sure), but you can always click the button to switch to alternative 2FA options.
> should radically drive down the cost of borrowing money

I got my mortgage for less than 2%. I can't see how crypto is going to enable negative rates.

(Historical factoid: the world's oldest bank in the modern form is up to 550 years old https://en.wikipedia.org/wiki/Banca_Monte_dei_Paschi_di_Sien... )
I’d argue that’s actually a decent description of what Flutter is.
Sudden Motion Sensor
I do agree with your assessment of the official responses. I’ll admit I may be overly sympathetic towards Rachel, but after reading her responses, I was left wanting a more substantiated resolution. It’s hard for me to trust a “value judgement” in the middle of a riot, so to speak.
if you are on firefox you can use multi-account-containers to limit the reach of google.

I have a container for youtube which is logged in with a specific account. Its different from any work account that I have.

This improves the recommendations 100x. As it means that any videos you view for work, research or away from your main interests don't pollute your recommendations.
I don't think it is as soupy as you say.

Flask is split up into a few Pallets projects - Flask, Werkzeug, Markupsafe, Click, itsdangerous, Jinja2 - but they're all from the same stable group. This split makes them more useful as independent libraries, rather than one big framework.

Ditto two more (Alembic and SQLAlchemy) are also from a very stable group. It would be nice if Alembic used Jinja2 instead of Mako, of course, but it's a dev-time dependency and so it's lower risk in my opinion.

I agree that at the thing Django does (forms + a SQL database) it does it with fewer dependencies than Flask. But that doesn't mean Flask has loads of dependencies; it has an appropriate number for the task you're doing. I was more comparing Flask to actual dependency soup ecosystems[0].

[0] https://github.com/rizkimcitra/next-starter-blog/blob/main/p...
>Look the same on all platforms.

Provided you have Flash player installed. Doesn't the same apply to web technologies provided you have the same browser installed?
I fool around with it as such. I use desktop mode all the time, and have a wireless keyboard and everything, though the lack of [direct] docker support inhibits any real work from getting done.

And best game on deck: Remnants of the Precursors (install through desktop.)
> But at least it was a dystopia where pizza delivery was an exciting business.

It wasn't an exciting business.

Pizza delivery was an exciting job (in all the worst ways a job can be exciting, or, TBH, just stressful), but the business part of it was quite boring. The corporate takeover denouement was perhaps the most boring scene in the book, and barely justified the "Chekhov's Guns" that were required to give a baddie a single "oh shit" moment with no payoff.
> Google doesn’t even manage their own App Store for spyware.

Why do you state such things as facts given no evidence.

Google has a whole team working on analyzing app store malware. It is called Project Zero.

As a counter example you can read their very latest blog post which just happens to analyze android app store malware:

https://googleprojectzero.blogspot.com/2022/11/mind-the-gap....
Searle's Chinese room is one of those things it's obvious most people talk about without ever having bothered to actually read. Searle does not say computers will never think. Early in the paper he even says - obviously machines can think because we are precisely examples of such machines. His point is that maybe it takes a certain kind of processing to yield what we call consciousness, and that may be a subset of the processes that yield outwardly similar behaviour.
What? Is the USA going to sell their chips to China? Because when Taiwan gets invaded the Fabs will be destroyed and/or made inoperable with no way to get them functional again.
Huh? That's not the point of the article at all? He is talking about holding periods and cap rate, not SPY vs a REIT.
There should be an option for users to opt out of the walled garden.
> Why is here consistently in any Apple discussion exactly this reaction?

Because the only mobile OS provider which allows blinding tracking frameworks with a single click is Apple currently, and every software vendor will want its telemetry and ads for their "monies".

The application model evolved from "pay this to get that" to "train this AI implicitly which we gonna use against you, and ah, we also sell your every aspect of you" to see cute cat GIFs.

Some of us are seriously against this and Android doesn't provide that. Maybe it's because Google is an advertisement company which provides nice looking (free-ish) utilities which also acts as nice data funnels (incl. Android).
No, you probably wouldn't teach your kid to use GIMP as a first image editor, just like you wouldn't teach them LaTeX as their first way to produce documents. I agree, Krita is better for new users.

Google "gimp" for me. What are the top results? What's highlighted in the sidebar? I don't see an issue. You have to scroll down a ways before you get to Urban Dictionary, I can't imagine a kid doing that instead of clicking the first result with the cute dog picture.

The school thing is the first actual problem. But then, it's an easy thing to clarify. I'm of the opinion that it's a good thing that their first experience of that word is an image editor, it detracts from the offensive meaning. The hope being that the offensive meaning will be relegated to an obscure footnote, the primary definition of the word to them being GIMP. We shouldn't give offensive words more power, we should diminish their power by using them in non-offensive contexts. See the adaptation of the word "cunt" in Australia.
If we're going to see someone driving around with a nuclear bomb in their sidecar, it's more likely to happen in Russia than in the US, though.
To be fair they do say (without proof but that can be hard to provide) that the spyware was put there by a contract developer that was not authorized to add 3rd party tools but did anyway.
That being said, given how extremely evasive they were and the lack of any tangible proof, I don't think it is unreasonable to doubt this explanation (how come you think a contract dev implementing malware isn't grounds for a lawsuit, shouldn't that be an open and shut case?)
"After multiple days and multiple reminders by us, they claimed to have fixed all issues."
It sounds to me like you insist that "spyware" has a different meaning than the majority in this thread.

From https://en.wikipedia.org/wiki/Spyware#History:

> The first recorded use of the term spyware occurred on October 16, 1995 in a Usenet post that poked fun at Microsoft's business model. Spyware at first denoted software meant for espionage purposes.
I wasn’t shitting on them. I was making fun of the poster above who used that language to dismiss anyone who doesn’t want to say glowing things about a piece of software.
I think the steel man version of the argument is: "You showed that there is no effective monitoring or transparency that me as a user can get, and as such, Where is the trust come from. What fundamentally causes Mozilla (or any) to trust CAs more than randomly distributed certificates."
I don't think Europe has much of a choice. It's either sanctioning Russia and suffering ourselves, or allowing Ukraine to be taken with the horrors that come with that. If it would end there, maybe but still no, but it won't end there. Who is next on Russia's list?
I'm currently working on a multiplayer game and I really really wanted to do this, but even if it works in principal, it fails in practice.

On step 3, this exchange does not happen exactly at the same time. If I'm playing with someone and we reach step 3, I could intentionaly hold myself from sending my data over, wait for the other player to send their data, and if their data wins against my (unsent) data, then I can simply choose not to send my data over (abort), forcing a tie.

This is easy enough to detect and you could just ban people that do this repetidly, but these people would just create new accounts whenever they get banned.

Hence, a cheater can either force a tie or win.

If you go down the rabbit whole on how you could theoricaly do this exchange fairly, you'll discover that this is provably impossible if you do not control the computational power of all parties (if you did, you could employ a time-locked puzzle with proof of work, for example).

This is known as a fair exchange with a fail-stop or secure-with-abort model.

See:
http://www.cs.utexas.edu/~shmat/courses/cs395t_fall04/pagnia...

https://crypto.stackexchange.com/a/25458

https://crypto.stackexchange.com/a/26624

https://crypto.stackexchange.com/questions/8333/is-there-a-w...

http://www.iacr.org/archive/eurocrypt2010/66320221/66320221....
1 MB after compression. And only if you turn off physics and limit yourself to 2D
I got a loan against my BTC as collateral in the regulated Blockfi company and put it into highly regulated storage at Gemini.

The part I missed is that the contract contained a hidden part where Blockfi can take out the money from the regulated storage and do whatever they want with it without notifying me.

I was paying regular loan repayments and had no idea that they put it in a casino.

When people don't go for known thiefs and mix them with other people, it just gives me more confidence in the important of decentralization.
Twitter's chaos could make political violence worse outside of the U.S.
Remember, these are the same brilliant moral "leaders" who murdered their own base en masse just to own the libs, by telling them not to listen to what medical professionals were telling them to do, not to wear masks, not to get vaccinated, not to self isolate, but instead to inject disinfectant into their veins, shove ultraviolet flashlights up their wazoos, eat horse dewormer pills, then mount a violent insurrection by storming the US Capitol. Leaders who don't believe in evolution or science or medicine or empathy, but are actively reducing the gene pool of people stupid enough to follow them. Not to mention stealing classified documents and dining with white supremacists. So yes, a lot of blame rests on the political side.

More Republicans Died Than Democrats after COVID-19 Vaccines Came Out:

https://www.nextgov.com/ideas/2022/11/more-republicans-died-...
I hate this shit so much. It's like the kids that enjoyed homework all became executives and are imposing their will.
Thank you!! I use vimium and love it! I have not used its tab navigation though. I just use it because Vim life haha!

There is also https://github.com/televator-apps/vimari the Safari port thought it is not full featured as vimium.
I want to as well, but annoyingly there are many sites that insist on a "special" character because their strength measure says "low" for the 20 character alphanumeric string I generated %-}
Gun owners don't need more guns, they need therapy!
itch.io is massive for games if you want a new Newgrounds. The tech stack has moved on from Flash to use Unity or GameMaker or Godot or Construct. It's feasible for someone not knowing how to code to use most game engines to create something - not uncommon in Game Jams to see teams like that.
I will settle for just cutting this stuff out.
Wiki says that some companies agree[1] that "123456" and "qwerty" are the most popular. "password" seems to generally be in the top 10.

What's interesting on these lists is the presence of Dragon and Monkey - am I mistaken or is it due to CJK users entering a Chinese character that got translated somehow? Wouldn't that mean some of the most popular passwords out there are single unicode characters? Surely not...

[1] https://en.wikipedia.org/wiki/List_of_the_most_common_passwo...
How do you draw a circle using Glimpse?
Hacking contest for teens in Europe gives 4.096€ reward