skysight-inc/HackerNews huggingface dataset:
If the codebase was built on the assumption that user callbacks will execute in a context where POST data is sanitized (which is evidenced by the code that was already there), then failing to sanitize $_REQUEST in addition to $_POST is certainly a security issue.

Of course, relying on such simplistic measures is still brittle and inelegant, but that's another matter. Reworking it would likely be quite invasive to that codebase and far beyond the scope of a security patch.

(also, frankly, the entire WordPress ecosystem isn't particularly known for its high quality codebase... this kind of "fix" is exactly what you'd expect there even without all that drama around)

> Security issues can be fixed WITHOUT renaming the plugin or removing links and text even if the original author has no access anymore

Not sure who you're arguing with there, but certainly not with me.

You have plenty of shitty behavior to call out there, so not sure why you decided to announce that there's no security issue being handled at all instead. It only makes your point weaker for no good reason.
Why so? Pin parts need to withstand similar loads - and if amortizing rails of Mechazilla may soften the contact, the direction of loads for pin parts is less favorable than for legs. Legs don't need to be big or too numerous - effectively legs are those pin parts moved to the engine compartment and turned for an angle.
Why group chat? Where did you think of that?
Both are examples of communication by means of frequency modulated and amplitude modulated electromagnetic waves with distortion from a moving three. Also a good example that a large change in quantity is a change in kind. Probably a legit analogy imho.
> Have you seen the GPT-4o videos? I don't know how anyone can watch those and believe that vision e2e self-driving vehicles are somehow a long way off.

Because chatting and driving a car are two entirely different problems?
I suppose design is subjective, but these were more to demonstrate that there are simple ways to make a website read good, instead of "looking good". I'd figure readers of Hacker news's web page design would sympathize.

These are no JS websites and I believe the first website is a total of 7 lines of CSS to help with margins. The second one's takeaway is to avoid pure whites and blacks (which from discussions is apparently a very controversial topic) and make a little use of typography
you can always keep jumping employers if you sense you're being underpaid

god i love our industry
I'm a feminist and I think it's harder to be a man than a woman
I'm sure GP is aware of this. This root has "shitty" connotations in many languages, Russian included.
Perhaps: from the article:

So long as LibreOffice could not handle long paragraphs there was essentially no free tool to publish Tibetan.
It's been already proven possible
https://arxiv.org/abs/2203.14465
beautiful visualizations, how did you make them?
This may be true for high energy particles, but the majority of TID damage is done by higher flux lower energy, for which shielding is often viable!
I like to use standalone tools with no dependencies, so I made this open source html editor with instant preview as a single html page:

https://github.com/no-gravity/html_editor

It has a few convenience functions already. Open for pull requests.
Just tried that example screenshot of 'postgresql query analysis' and got the same results on Kagi vs Google with uBlock. What exactly is novel here?
Pretty sure the Artemis lunar missions are going to use a different vehicle for Earth to LEO and LEO to Earth, so I don’t think anyone will be inside a Starship belly flop for quite some time
quaternions - 1843, Hamilton

projective geometry - 1420's but big in the 19th Century.

These are things I used heavily programming earth mapping systems in the mid 1980s to mid 1990s. Principal reference text was from the 1920s.
You know what a lifestyle coach is? Or a physiotherapist?

A few surgeries, treatments and lifestyle interventions can do it. Though it's not an easy task. And further, not a cheap one. Treatments tend to synergize.

There's so many specialized doctors.

The generalist is called a general practitioner, but commonly reduced to a specialist in ENT infections.
Postman is one example - imagine spending 30 bucks a month on a tool that lets you call APIs.
I remember when Chuck Forsberg died, the author of YMODEM, nearly 10 years ago now:
https://news.ycombinator.com/item?id=10593617

The XYZ Modems: https://web.cecs.pdx.edu/~rootd/catdoc/guide/TheGuide_226.ht...

As far as I can recall, it didn't have a sliding window, once protocols, like kermit, added sliding windows the speed jumped a huge amount.
I love my PiHole. I block more stuff than just ads with it. No problems with false positives in default setups. I went a bit nuts adding blocklists, personally (it's not necessary lmao; be judicious with what blocklists you add!) so sometimes run into something, but whitelisting things is really simple and I can't remember the last time I had to do it. My not-very-technical husband learned very quickly how to look in the query log to check if the PiHole is blocking something. He hasn't had to in ages. Temporarily disabling blocking is also super easy (simple, quick, effective escape hatch), and so is managing the various lists, so if my husband whitelists something from the query log and I want to refine it for some reason, I can without working hard. The configurability of blocking per configured group or client is amazing (and simple) as well; the video game consoles have separate rule sets than everything else which works super well for me.

Once again, I went stupid adding blocklists so the level of management previously required is kinda worst case-y and it is absolutely my own doing and since working through my idiocy it just works its magic without needing intervention. If you're more careful about not adding blocklists which say 'this will break things' (not hard) you'll be fine.
Lots of people love it. I don't like CWL much so I don't like it, but it's a perfectly cromulent choice.

The primary thing with all the workflow systems is to see what is abstracted and find out if it matches your needs. Airflow would never be suitable for what I want need (diverse tools in many languages, some needing conflicting library versions), Arvados would work but I prefer WDL or Snakemake or even NextFlow. Snakemake for incrementally building up a prototype pipeline or a one-off analysis. WDL when I need a production pipeline for years. NextFlow or CWL/Arvados when I need to fit into somebody else's culture or compute infrastructure.

Edit: and something I have never seen in any workflow system is a looping mechanism that allows testing for convergence or dynamic parameter sweeps, etc. only the homegrown systems, built on top of cluster management like SLURM, have been that flexible. But these homegrown systems for managing compute clusters were never quite mature and generalizable enough to release as open source, even if the company had been willing to open source them.
Friendly reminder that inline CSS is unsafe and should be avoided. https://stackoverflow.com/questions/41925390
> I don’t understand boners

Well, he literally got into a 70-ft wooden sailboat and crossed the Atlantic ocean with no certainty of landfall, basically sailing on spec, and because of that voyage, opened up a new hemisphere of the planet to development, and (with unfortunate but inevitable awful consequence) brought humanity together again after a substantial period of isolation.

We admire the Pacific Islanders for similar navigation feats as they travelled eastward, and the Vikings for traveling westward to Greenland and America, but neither of those efforts had so profound an effect as what Columbus pulled off.
> Deploying this requires running 5 different open source servers (databases, proxies, etc)

That is the nature of the beast for most feature rich products these days. The alternative is to pay for cloud service and outsource the maintenance work.

I don't mind a complex installation of such a service, as long as it is properly containerized and I can install and run it with a single docker-compose command.
His is a very American perspective.

Also, a comedian spinning his experience into material.
That has also been my experience with this model. I’ve been using it for about a month now. I originally planned on trying to use the accelerometer data over Bluetooth to build a custom control input for Frame smart glasses, but I got busy and never got around to that. But I’ve been wearing it as a health tracker and the heart rate and sleep tracking seem pretty accurate relative to my Apple Watch, and the blood oxygen measurement is generally a couple percentage lower than my Apple Watch. I have no idea what the stress thing is even supposed to measure, it’s just a random number that doesn’t seem to have any correlation with real life and there’s no units or explanation.

I get about four days of battery life with all of the sensors turned up to maximum frequency, which is every 5 minutes at least for the heart rate. Surprisingly good for such a small lightweight device. I imagine it could go a lot longer if you turned down the sensors to a lower frequency. I found a good rhythm is to charge it when I take showers, that seems to be a good balance and it never comes close to dying. My Apple Watch on the other hand regularly dies before I go to bed, and I can’t wear it for sleep tracking because it can’t last that long.

I will never understand people that pay a monthly subscription to access basic local sensor information like this. Yet I see people wearing subscription-based smart rings all the time. I don’t get it.
You could potentially use document.querySelector('html').outerHTML and POST it somewhere
I’m a software developer, have been for two decades. I was suspecting it may be the case which is why I asked. Again, I’m not meaning to be rude or snide or anything, but what do you use search engines for? I almost never use them, I tend to head directly to the documentation when I need to look up the APIs for a library.

This is mainly because “free” search engines suck at it these days, and I’m curious if Kagi doesn’t.
Yes and that is a huge deal - I made this point to others that it shouldn't be considered a minor version change
> the incentive to be top ranked is just so high. What could be the solution?

To not be top ranked ? /s
I think you're onto something.

I would be ok with a watch too.
Sure, thats what they did with the JWST. But that ist complex and expensive. A custom Starship could be the cheapest way to get telescopes up to 9m mirror size into space as you can assemble everything on the ground and you don't need a separate housing.
... The guy I responded to is saying Pythagoras is good enough. Do you know what year Pythagoras died?
The point is that shielding turns a single high energy particle that would otherwise strike and probably destroy a single transistor, into a veritable spray of lower energy particles causing bit flips or worse all over the circuit. This spray of particles can be stopped... with 1.3 feet of lead shielding.
Some games have regions and you only see players in the same region. For example, a “Europe” region. If you’re in the US and you connect to the Europe region, you know that you should expect some lag.

And it seems like that would work just as well with durable objects.
FM sounds better than AM partly because frequency is more durable than amplitude, but it's not the whole story.

Frequency does not diminish with the inverse square law, as does the amplitude of a wave that is broadcast in all directions. This is because frequency is related to a count of events over time.

Frequency from a source light years away is intact; we can look at frequency bands from a radiating celestial body and know which chemical elements there are, and also tell exactly how fast it is moving away from us from the red shift in that spectral pattern.

Be all that as it may, AM should sound great when you are close to the radio tower, and have ideal reception with no multi-path reflections, and good signal/noise ratio.

It still doesn't sound good, and that simply because of the bandwidth allocated to it is low. Furthermore, AM Stereo is a retrofit and crams two channels into one via phase modulation.

AM stations are separated only by 10 kHz, as you can see on your AM tuner (which you likely have only in your car, if that).
The bandwidth is directly related to the audio bandwidth because modulation produces side bands.

For instance, if we modulate the amplitude of a 650 kHz carrier with a 1 kHz audio tone, we get side bands of 651 kHz and 649 kHz. You see where this is going? We can only go up to 5 kHz before we bump into the next station, which also needs +/- 5 kHz for its side bands.

This 5 kHz limitation is why AM radio sounds like your speakers have a heavy woolen blanket over them. It's almost as bad as the bandwidth limitation as narrow band phone calls. Listening to AM music is almost as bad as listening to on-hold music over a narrow band codec like G.711.

The kicker is that only one side band is needed to reconstruct the signal, so in theory AM stations could have 10 kHz bandwith. Unfortunately, SSB was not deployed for broadcast AM, even though it was already known at the dawn of radio.

(https://en.wikipedia.org/wiki/Single-sideband_modulation has a note about why)
Stopping power is basically correlated with mass.
But RC boats and battleships both have propellers and rudders.
Disclaimer: I’m a paying customer of Kagi.

It felt truly bizarre to subscribe to a search engine. To actually pay for access. There’s been a bit of drama with the CEO directly emailing people when they left poor reviews.

Some people are not happy with Kagi investing in browser development instead of search results quality.

I’m not surprised there’s a lot of people having thoughts and feelings about Kagi and expressing them. The fact that there’s a significant overlap between HN and Kagi’s user bases is hardly a surprise either.
China can produce most things cheaper than anyone. Economically, it's pointless to compete with them. However, if too many think the same, you get bottlenecked and compete for access to the supply, which raises prices. You bevome also politically subservient to China.
I do! Wow, what a flashback. I think it was formed from Mozilla's built in editor, and later on died quite quickly and was forked under a different name, which, in turn, died quickly.
Yeah, you are right. Compassion and empathy is truly something, which can't be replaced in 10 years by a machine. (who knows)
The nostalgia hit me, I remember before Dreamweaver, there was Netscape Composer, W3C Amaya, and similar software.
That's not the real story. The RF environment is noisy, with naturally occuring static "sparks", but also with manmade RF noise.

This static and RF noise is AM. It's impossible to filter it out from an AM signal, and so the background noise gets amplified with the signal.

Encoding the signal in a modulated frequency (FM) means we don't need to amplify the detected AM signal and it's associated background noise.
They have publicly discussed using Linux with RT kernel!
I work as a dev like many here. Specially games. So lots of documentation lookup (or tutorials on what should be in documentation. Let's be real, games don't document a lot publicly to begin with, and public documentation is really poor for the tech industry), research on tooling for project, research to understand some new technical feature that rose up, spell checking for technical terms the built in dictionaries can't check, etc. I could go on for paragraphs, there's always something to learn, re-learn, or simply fact check.

and of course: discussions among communities talking about all of the above. Be it benchmarks, landmines to look out for, bug reports, highly opinated design choices, etc. Definitely couldn't find all this restrained to a Discord server or Facebook page.

And that's just all on the business end. Sometimes you just want to search up a reaction gif for a chat, or find news of the goings on (which is down on the weekend).
You have a row key, which gets consistently hashed to a shard / node on the ring.
Are you a woman or a man?
I'm calling marketing fluff here, given that its founder seems to hold a skewed model of kagis power in regard to collecting personal information altogether: "personal information is what you can be identified with as an individual. no information you submit to kagi is personal information except if you use your real email address to register"[0]

[0]: https://d-shoot.net/img/kagi/weregood3.png
But can't we just use AI voices and LLMs for that? Context window isn't even proper as many won't remember far enough to past.
Without a schema, I’m wondering about validation. I guess your server should use Zod or an equivalent library?
There will always be jobs for nurses and doctors, but there will probably not be enough nurses and doctors for those jobs. It will keep getting worse, the shortages aren’t going to let up, and automation or shipping them to cheaper countries are literally the only viable solutions.
It was a stupid, stupid decision on WP's part.

After reading it, the first thing I did was to make sure that I and all WP sites I have access to had automatic updates disabled. This always seemed like a good policy to me, as it is such a massive attack vector. After all, some popular
plugin developed by someone in Nebraska (obligatory XKCD: https://xkcd.com/2347/) might be hijacked at some point. WP did the stupidest thing ever by hijacking ACF.

WP is the villain now because they can inject unknown, unvetted code into my site (if I had enabled automatic updates). While I find ACF's code abhorrent, at least it has a proven track record of working and not crashing my site. Someone who just took over the plugin does not enjoy the same trust from me.
a better analogy for frequency domain interference would be something like the spinning flashing lights on a fire engine or utility truck occasionally shining colored light on your detector.
This is getting embarrassing for you. Just stop :)
I'll have to add RTT to the list that includes Mary Poppins, Pooh, der Ententanz, leg warmers, etc. (RTT has antagonists, but animals [or at least snakes] fall in the pirate class?)

Ogami, having had to carry weapons in the pram, would've appreciated UvH's bei ... Fischfang müssen wir eisengepanzert sein. (oops: why did I quote the german? UvH wrote in latin)

EDIT: I can't believe the en.wikipedia for LWaC doesn't mention Hard Boiled (1992) in its trope list; the baby scene was even referenced shot for shot in a recent Fast and Furious.

EDIT: I'd guess HRV knew what he was doing (1998>>1981) but he does seem to be from the wrong generation

EDIT: https://www.technologyreview.com/2017/08/16/242148/hal-varia... Growing up, he turned to science fiction for excitement. ICE was a shout out.
Just to make sure I'm not missing anything: All of that essentially only applies to user/untrusted input, right? i.e. if I have a static website with inline CSS (or JS), there's no security concern.

In that case, I'm not sure I'd consider inline CSS "unsafe." But it's interesting to see how CSS can be exploited in the same way that JS can be.
> The distance between two uniform random points on an n-sphere clusters around the equator.

This sentence makes no sense to me.
out of 1.5 million most of the students are from tier 2 and tier 3 colleges. The education and opportunities in Tier 2 colleges makes most of the student employable while students from tier 3 colleges are barely employable.

out of 1.5 million only 10% are employable i.e 150k grads [1]
Out of that 150k, 50% will be employed by mass recruiters (Infosys, TCS, Cognizant, HCL, Wipro)

You can see more accurate salary points here
https://www.levels.fyi/t/software-engineer/levels/entry-leve...

[1] https://www.business-standard.com/finance/personal-finance/o...
Just wait until you see the actual dimensions of a 2x4!
> Spain wasn't, but for some savages, empty land for the muslim armies to take.

I think you're missing the point.

OP's point was that "Spain did not exist as a nation anytime prior to that." The truth of the matter is that it didn't, and to make matters worse even today Spain itself is comprised of regions with distinct national identities which reject the idea of being a part of the castilian-based nation.
I don't care about creating such folders.

But I care about Ctrl+C working.

Your obscure requirements are meaningless.
Because of the new ui? Seriously it's terrible, but the classic ui is still benevolently available as a plugin. Don't know for how long.
Is there any good way to plot multiple asteroids while maintaining their relative size ie. handling scaling correctly?

The problem with plotting asteroids is that the "pixel" representing an asteroid is a hugely larger chunk of space relative to the actual size of the asteroid itself.

This gives a false feel of density that the asteroid belts simply don't have.
I don’t believe I’ve ever used shopping search. I remember seeing it a decade ago or something, but I never understood the point.

What is it for?
Much of the user experience of the Lisp Machine was just the console. Users would seldom interact directly with the actual hardware which would be in some lab or hall.

You had special key sequences so you could even hard reboot the machine if it got stuck. Both the CADR and Lambda have simulators that work very well and are Free Software.

You won’t be missing out much by using a simulator. :-)
I think the most likely threat in this case is with ex-employees. If Bob has access to bob@example.com and creates an Apple account with it, then subsequently gets fired from example.com, they might delete his email address but his Apple account will still allow him to login to services using Sign in with Apple. (Because Apple only checks ownership of the email address when the Apple account is being created.)

Google accounts have the exact same issue so I don't understand the distinction made by the OP though.
I just made my browser window narrower.
Not saying can’t. Arguably, there isn’t anything anyone can’t do. At least until they go broke.

I’m saying that different societies have different priorities/expectations/motivations, and there is clearly a reason they don’t do it, or it wouldn’t be so consistent eh?

It’s not like white space isn’t the default on a writing surface.

Do you have any alternative theories?

I could also imagine scrolls being expensive, so ‘fluff’ like white space is discouraged, and not easily re-used or overwritten based on the inks, so re-editing or the like doesn’t actually work.

But I’m just speculating here.

Edit: the scripta continua link above had a good reference to Greek/roman examples where they were transcriptions by slaves of spoken monologues. They didn’t have paragraphs or the like because people don’t speak in paragraphs.

They also don’t edit their words when they speak, and rarely do ‘chapters’.

Footnotes, bibliographic references, etc. also don’t really make sense in the way we might think if it’s ’a record of spoken words’ vs ‘words representing ideas on their own’.

So writing used more like transcriptions of famous speeches or lectures, less as standalone and independent works.

And I assume every culture has the equivalent of 2 hour long speeches that could have been a one page email.

“Before and after the advent of the codex, Latin and Greek script was written on scrolls by slave scribes. The role of the scribes was to simply record everything they heard to create documentation. Because speech is continuous, there was no need to add spaces.”
Well being technology oriented, this community has disproportionate number of technology enthusiasts. Remember when everyone and their dog was cryptobro? There were multiple such spikes, coinciding with hype cycles of coins, nfts, etc.

These days the most vocal are GPTmaxxing, tomorrow there will be a new shiny thing.