skysight-inc/HackerNews huggingface dataset:
I think the main problem is that there's usually an unfortunate trade off between usability and security, and most of the issues mentioned as dumb ideas here come from trying to make the system less frustrating for your average user at the expense of security.

For example, default allow is terrible for security, and the cause of many issues in Windows... but many users don't like the idea of having to explicitly permit every new program they install. Heck, when Microsoft added that confirmation, many considered it terrible design that made the software way more annoying to use.

'Default Permit', 'Enumerating Badness' and 'Penetrate and Patch ' are all unfortunately defaults because of this. Because people would rather make it easier/more convenient to use their computer/write software than do what would be best for security.

Personally I'd say that passwords in general are probably one of the dumbest ideas in security though. Like, the very definition of a good password likely means something that's hard to remember, hard to enter on devices without a proper keyboard, and generally inconvenient for the user in almost every way. Is it any wonder that most people pick extremely weak passwords, reuse them for most sites and apps, etc?

But there's no real alternative sadly. Sending links to email means that anyone with access to that compromises everything, though password resets usually mean the same thing anyway. Physical devices for authentication mean the user can't log in from places outside of home that they might want to login from, or they have to carry another trinket around everywhere. And virtually everything requires good opsec, which 99.9% of the population don't really give a toss about...
> Data lake
> Data warehouse

These aren't something I would like to hear if I'm still using Notion. It's very bold to publish something like this on their own website.
Gitlab Fixes Security Flaw That Lets Attackers Run Pipeline Jobs
> Except Warren buffet. A lot of people went with Berkshire Hathaway and did very well.

Buffett has been underperforming the S&P 500 for about twenty years now:

* https://www.linkedin.com/pulse/warren-buffett-has-underperfo...

* https://news.ycombinator.com/item?id=37827101
> You can't

Sounds like a good reason not to trust them. That said, it's not impossible to be reasonably assured that our data isn't being stored or used inappropriately, but that would require strong regulations which protected that data and a proven record of companies being caught and facing meaningful consequences for violating those regulations. It'd be nice if we had strong whistleblower protections as well. Maybe a massive bounty to anyone who can prove to regulators that their company is violating customer's privacy would help.

> Is there any evidence this actually happens?

Well, yeah. That's literally Google's entire business model. They collect as much data as they can about you, so that advertisers can request their ads to be show to certain segments of the population. That's what targeted advertising is. Nobody is sending Google updates on their lives, google just makes a bunch of guesses and inferences using the massive amounts of data they collect about you, and as long as they are correct most of the time it pays off for advertisers.

Google isn't alone in that either. Many many companies do it, as well as data brokers. You can be extremely specific in who you target. See for example: https://www.cbsnews.com/news/the-data-brokers-selling-your-p...

Among the worst are lists of people with mental illness, dementia, poor education/literacy, low intelligence, etc. I doubt Google lets you target people based on predatory lists like that, but they might keep them for their own uses. They have collected the test scores and grades of a lot of children through schools that force students to create google accounts and use chromebooks. It'd be pretty easy for them to sort people into buckets like "smart" or "dumb".

Lots of companies privacy polices state specifically that they collect this kind of data. For example, here a company that collects "Personal Information used to create a profile about you, which may include your preferences, reading or writing levels, abilities, aptitudes, and other data or analytics provided about you or your account by our third-party partners or data aggregators. " (https://www.captivoice.com/capti-site/public/entry/privacy_p...)
> I thought they were pro privacy

Remember, Mozilla is now ad company, since last month
There is still support for CSM in the open source https://github.com/tianocore/tianocore.github.io/wiki/Compat... and even nice projects like https://github.com/coreboot/seabiosto fabricate the CSM16 binary, but many vendors have stopped validating this path, including production of legacy BIOS option roms for adapters (net, gfx, etc) https://www.phoronix.com/news/Intel-Legacy-BIOS-EOL-2020. I still believe CSP's maintain some of this support in their hypervisors' guest firmware for legacy OS binaries/ISO boot support? Also since Windows requires UEFI Secure boot enabled by default and CSM has to be disabled for the UEFI secure boot path, this is another reason legacy BIOS boot isn't exercised so much these days.
We could have added legacy oroms hashes to UEFI Secure boot implementations https://patents.google.com/patent/US8694761B2/en, too, but again folks pushed back in their zeal to remove legacy BIOS overall.
We didn't add the CSM spec https://www.intel.com/content/dam/www/public/us/en/documents... to the PI https://uefi.org/specs/PI/1.8A/ since folks were hoping UEFI would remove the need for CSM. I still remember being challenged in the early 2000's by a long-time BIOS mgr at Intel "Is removing legacy a good idea with EFI? You know, we're really at legacy."
Threat actors quick to weaponize PoC exploits; 6.8% of all internet traffic DDoS
> Supposedly these happened because Snowflake made it impossible to mandate MFA

What's crazy is that Snowflake made MFA enforcement available only 5 days ago.
Oh! I thought it was this:

https://youtu.be/CXGeOHdiHrE

TIL
The CTO at my last company was like this.

In the same breath he talked about how he wanted to build this “pristine” system with safety and fault tolerance as priority and how he wanted to use raw pointers to shared memory to communicate between processes which both use multiple threads to read/write to this block of shared memory because he didn’t like how chatty message queues are.

He also didn’t want to use a ring buffer since he saw it as a kind of lock
It’s often associated in PoE that friction is what usually drives profits. Using a recent meta example, Graveyard crafting was extremely tedious while simultaneously being extremely lucrative. I am quite interested then to see what the implications on the economy are if adopted mainstream by the masses. People nowadays would rather pay 3x the prices of the craft rather than learning how to do it themselves, but if there was a convenient calculator that could derive the optimal algorithm I suspect we will see a different behavior emerge.
Don't tell us, show us the value of your project!

Show how it would work in practice, show how it is better than normal Jira search. Show why I should use your project instead of the many, many others?
Hello, nice to find people interested in ASN1 ! But, one of the first lessons I learned in programming is to not reinvent the wheel. I just want to understand what's your motivation behind this project, is it for personal curiosity/discover the protocol or something else ? Because there is already a seemingly good ASN1 compiler in C : https://github.com/vlm/asn1c
GitHub has done a good job of getting the product into VSCode. I think this product is targeting people who already likely using a terminal editor and work well within a CLI environment, which is what all of Pico's services are trying to do already.
Maybe he's just one of those lucky people that only need 4-5 hours of sleep every night ¯ \ _ ( ツ ) _ / ¯
> The real story here is how much power individuals have over our political landscape. George Soros, for example, has injected more than $125M into the midterm race in 2022[1]. To be clear, this is not a partisan issue; the Kochs raised over $70M last year[2].

I fully agree with you that the broader problem is Citizens United and the ability for corporations and the super wealthy to pour this much money into politics. In fact, I mention this here: https://www.followthecrypto.org/about/faq#what-about.

I think projects like mine would be extremely valuable for all industries, and I'm enormously grateful to groups like OpenSecrets that do excellent work making a far broader swath of the data more legible. But I am one person without the research team, time, or funding that would be necessary to analyze the data this deeply across industries, and so I focus on crypto (the subject of much of my research and writing).

The code is all open source, and I would be delighted if other projects like this one sprung up. It seems it would be a bit more productive to actually shine a light all the kinds of spending that happen throughout industries and across individuals, rather than using that other spending as a sort of whataboutist argument to dismiss projects like this one that (necessarily) focus on a subset of spending.

> If you want to be critical of super PACs, crypto spending is literally a drop in the bucket and completely missing the forest for the trees. There is a story here, but crypto ain't it.

As this project highlights,[1] crypto is far from a "drop in the bucket" when it comes to super PAC fundraising this cycle. The industry has dramatically ramped up its spending compared to previous election years, which is a large part of why I felt it was important to keep an eye on the spending.

[1] https://www.followthecrypto.org/committees/ranking/super
My first license of 1Password was a gift, although, this was before it was a SaaS. You can gift Neftflix and similar. There's a lot of things that can be a decent gift.
You're talking about less than 0.000000000000001% of people.
Arkenfox: Firefox privacy and anti-tracking user.js GUI view
I “idiots” is a bit harsh.

If I give someone cash [1], then they might just spend it on their power bill or rent or groceries or just let it live in a bank account. This is “fine”, but it doesn’t really feel like a “gift”.

If I buy them a gift card to Best Buy or something, they’re kind of forced to buy themselves something fun. You can’t really pay your rent with a gift card, it can’t sit in a bank account, you’re kind of forced to get yourself something you’ll enjoy.

I am not saying it’s the best gift or anything, I just think “idiots” is harsh.

[1] and assuming that the person is in an economically alright position
Show HN: Kaskade – A text user interface for Kafka
One of the questions I’ve been wondering in talks of decentralization is how do you balance freedom to move with self-government. Ot seems inevitable that if you put two states next to each other, a libertarian low tax state and a more progressive high tax state, people will live in the low tax state as long as it benefits them and move to the high tax state to retire to if they get an illness or something similar.

Do we want a United States where you need a visa for interstate travel?
I would love to see most drop-in/bolt-on authentication packages (such as DotNet’s Identity system) to adopt “bitwise complexity” as the only rule: not based on length or content, only the mathematical complexity of the bits used. KeePass uses this as an estimate of password “goodness”, and it’s altered my entire view of how appropriate any one password can be.
Show HN: Apollo Scraper – Export Unlimited Leads from Apollo.io
Apollo gives you 10k email credits per month but has export credit limits of 120 for the free plan and 3k to 12k for paid plans yearly.

So, we made this extension to bypass these limits and export up to 10k monthly emails on any plan.

Feel free to try it.
Kinda funny. I buy the occasional knick-nack from Temu, I got what will probably be the foundation of my Halloween costume this year.

The other day I saw a plushie that looked really great that was in a local warehouse and arrived about as fast as Amazon. It was a bit of a disappointment in person but that's Temu for you. Most things from Temu are smaller than you expect them to be.
GitHub's web client does not scale at all in my opinion. It is very slow to load source large patches, and the code navigation experience is not great, hence why they brought VSCode for Web to the product, but still.
Great job! Really well done. Congrats on launch!
on the other hand, to gave us the password game, so there's that.

https://neal.fun/password-game/
QuickFunctions: Code Golf but for Performance
I've seen "Penetrate and Patch" play out a lot on software development in general. When a new requirement shows up, or technical debt starts to grow, or performance issues, the first instinct of a lot of people is to try and find the smallest, easiest possible change to achieve the immediate goal, and just move to the next user story.

That's not a bad instinct by itself, but when it's your only approach, it leads to a snowball of problems. Sometimes you have to question the assumptions, to take a step back and try to redesign things, or new addition just won't fit, and the system just become wonkier and wonkier.
What is going on has been known of for centuries:

https://en.m.wikipedia.org/wiki/Maya_(religion)
The devil asks you to pay 5 times more for a use case that involves potentially hundreds of users.
Have you ever worked for a company larger than a 3 person startup? When you work at a company with hundreds of thousands of people, how can you “easily” move data into cold storage without destroying employee productivity? Don’t be hand wavy. Be specific about your solution.

Do you move all old files, emails, internal knowledge articles, code repos, chat messages, etc etc to cold storage? You can’t search for anything you’re looking for in OneDrive, Outlook or Slack if the data is in cold storage so are you going to develop custom applications to support the same search filters as each original source application, but which searches your cold storage?

Once a user finds something in cold storage, you have to load it back into the SaaS app to display it. Why? A variation of the following applies to all enterprise data: A Slack message has tons of important metadata tied to it besides the text content. For example Slack user Id of the message sender, channel ID it was in, file ids of any file attachments in the message, and so on. How do you load that back into Slack from your cold storage?

You can put any data in cold storage. In the real world, that often makes the data almost useless for employees.
It's a press release, not a white paper. Phones do transmit beacons.
Why would a collaborator have to learn your email client?
thoughts so far...

- i really liked this design, in a functional/readability sense. for example, how the images appeared in parallel to the text, so you could look at them without really having to look away from the text. another example is the footnote pop-ups (Wikipedia does that too).
honestly, i'm a bit disappointed in people in general that this isn't the rule. we've had HTML for very long now. it's not a lot of effort to learn enough of it to be able to produce webpages with functionality like that -- yeah, it's an upfront cost, but then, well, less so than learning your mother language!

- i really don't like, though, the reliance on extrapolation from examples from nature and history.
IMO, our understanding of these subjects has been shown many times to be limited and flawed... we can't rely on it that much.
also, come on, if you pick and choose from the examples you can pretty much advance any thesis you want. like yeah i bet the chimps and the ancient greeks have a beautiful society if you look at it from this specific point of view, but they also practice infanticide or something like that -- i just made this one up, but i bet it's not hard to make it real.
and i felt that the text was especially quick (did not really present justifications) to dismiss what it didn't like and advance what it did...

- finally, i really liked this take on "how many humans does it take to screw on a lightbulb?" -- i'm definitely stealing it. i don't think this is the main focus of the text but it's something that really speaks to me. the comfort of today's society is only enabled by an amount of technology so huge it takes a large amount of people cooperating to keep it running. if we don't want to go back to the wild and die of dumb diseases, we need to be able to cooperate.
See: https://www.nytimes.com/2024/07/04/technology/ray-kurzweil-s...
Obvious solution is for this person to adopt the "Zero Width Non Joiner" character as their middle name --- that would ensure that this doubled-up-space would be preserved.
Heh, well GitHub's search doesn't exactly scale well either. They _still_ only index the main branch, so if you want to find anything under active development or on an old tag version you're out of luck, clone + grep is the only way.
As a minor note, overflow checking for add & sub can be done reasonably-efficiently in software by comparing the wrapping result with a saturating one, good for i8/i16/u8/u16 on x86, should be roughly the same for signed overflow compared to repurposing hardware unsigned overflow (though of course worse than would-be-native for unsigned).

And, regardless, this would be at least one more uop in the core loop (and a somewhat-unpredictable branch at that) which you'd still want to avoid.
I think an assassination attempt on the front-running US Presidential candidate slightly transcends "political news".
Netflix, Xbox/PSN, Roblox, etc would all be valuable subscriptions to children who are dependent upon others with funds.
Hurricanes are not increasing in frequency.

And is this your same advice for California?

Everyone needs to bury their lines but it costs money.

Cali every year has to have controlled blackouts because it's so bad at managing lines, no hurricanes needed.
Supreme Court. Immunity. Chevron. Just to name a few. MAGA has been very successful with gaining real power.

Read their manifesto about their plans.
That doesn't answer the question. People microwave their phones, fine. But it's not a reason to demand microwaveable phones.
But when someone tries to attack such a password, as long as whatever the user devised isn't represented by an entry in the attack dictionary, the attack strategy falls back to brute force, at which point a repetition scheme is irrelevant to attack time. Granted, if I were creating a repetitive password to meet a length requirement without high mental load, I'd repeat a more interesting part over and over, not a single character.
Where will they find the money to pay you if they lose?
All this is true, and there are many good comments in the thread here. But this "hey dude, stock picking is for idiots and all non idiots but index funds" should be treated with caution. Index funds are an extremely clever idea but were never meant to be used on such a scale.

To give you some ideas:

https://www.forbes.com/sites/chriscarosa/2024/04/02/index-fu...
I realize these aren't the polls you mean, but it has already caused a 10% uptick[1] in likelihood of Trump winning on Manifold.

[1] https://manifold.markets/jack/who-will-win-the-2024-us-presi...
lol. Yes you can. It may not be right or legal but the point is to intimidate and bully. Works all the time against tech workers who are generally pandering, emasculated individuals already.
It's fairly common to create "link" objects which have both a human readable component and a URL component. Not much would be lost if the URL got less readable, we'd just have to be more diligent about associating a human readable string with the link. This could be done automatically if the content happens to provide its own "name" field. Otherwise you'd just have to give your link a name.

Links which are displaying an ad-hoc name can show up in one color. Links which display whatever the content names itself can show up in another color. We can have different fonts for whether people you trust have flagged the content as trustworthy or whether the've flagged it as malicious. Nobody needs to see the hash itself. But none of that works if a link might resolve to different content at different times.

As far as needing to see the content before you know you can trust it... There's no harm in fetching malicious data and taking a peek at it. Just don't act on it.

If we train people to not even look at the threats then they're not going to have a feel for what threats actually look like.
The prices of a lot of consuemr products are actually the same than the western Europe and usually produced in Central or Eastern Europe so this should not be an issue.

I would say it's just because they are allowed to do so and EU open market kinda enforce that.
Does Cisco AnyConnect fall into the invasive spyware root kit category?
Fantastic film, mostly ignored.
> I have worked 21 years at same shipyard and they will not buy me prescription safety glasses.

They still have to pay you a lot of money if you do get injured. Might be cheaper to just buy you the glasses no?
I think there was such a thing in Snow Crash
A bit more regarding UTM SE on the iPad
Why are you onboard with it being flagged? I think this event is very well worth discussing. I constantly see a steady stream of political news here, including Israel and Gaza.
I also took issue with this point. One does not become an author without first learning how to read. The usefulness of reading has not diminished once you publish a book.

You must learn how known exploits work to be able to discover unknown exploits. When the known exploits are patched, your knowledge of how they occurred has not diminished. You may not be able to use them anymore, but surely that was not the goal in learning them.
I disagree. I think the fact that companies like Roblox still struggle with moderating discussions and are doing research into this area proves the point that it's not as solved a problem as you are stating it is.
> Channels require a different goroutine to send values while also receiving them ...

The requirement is a limit of the current design and implementation. Channels can be enhanced to avoid the requirement.
Genetic instability among residents near mobile phone base stations in Germany
Why doesn't the expanding Universe break the speed of light?
> What would the alternative be, as you can't just edit someone else's repo?

git push directly to the repository, in a separate branch namespace. This is how e.g. Gerrit works (pushing to a special ref makes a review, which is essentially the same as a pull request).

> Besides just cloning it and making the change locally, of course.

With GitHub, you cannot do that and get a PR out in the other end. You _must_ fork the repository into your own user/organization, push to that and then send a PR from that.
The name was inspired by Transcendental Étude No. 4 [1], as correctly suggested by the other comment.

[1] https://www.youtube.com/watch?v=MYSFTtYc4P4
I’m with you: I read the link and think they are referring to BLE advertisements. The frequency of such advertisements is configurable. AIR, the advertisement interval has to be a multiple of 0.625msec. Per the spec, a random delay of 0-10msec is added in between the interval to aid in collision prevention.

I’ve mainly seen “BLE beacon” used to refer to types of devices, especially ones that primarily advertise.

There are some devices, like BLE-based remote controls, that advertise very frequently, I assume to reduce latency between a user’s action and response by the receiving device. It makes for a very noisy environment if you’re playing at home and not filtering based on MAC, etc.
Is this out of copyright?
I think it’s pretty unambiguously a verb in that case. That kind of comma is very commonly used in literary prose and essentially always is an “and” like conjunction that joins multiple actions together.
OK, thanks, when E2EE ?