skysight-inc/HackerNews huggingface dataset:
Yes, why the Slack or HR or interview etc. data would still exist while being inaccessible to the original owner is very strange. The article seems to take it as a foregone conclusion that those accounts should all be expected to still exist with all the business data, and I don't know if this is based on the author's experience, or it's just a way to make the vuln sound far more serious than it really is.

On the other hand, I don't think people normally expect that OAuth depends strictly on domain ownership like this. I think most would expect that it depends on some kind of secret being stored on the IdP account side, uniquely identifying the IdP account holder beyond the email addresses presented. With regular password-based authentication, with MFA, you would at least get an MFA prompt if someone had gotten access to your email address and was being sent a password reset code. But with this type of SSO, any MFA verification is done on the IdP side, so if the IdP recognizes anyone who controls example.com as the rightful owner of any claims, then there is nothing you can do as the former owner of example.com.
My current coworker is a complete cunt through slack, but if I get my ass to their desk, all discussions last 5 minutes max and are very productive
also, there are lots of non-technical people running small businesses that use G services because that's all they know. They can barely operate them let alone be cognizant of things like this "exploit".
This is your friendly reminder that the insurance industry does not generally make money on underwriting. In other words they are losing money on insuring you. Typically the costs of the insurance side of the business are greater than their revenue from premiums. This typically means that insurance actually is a good deal on net. They make their money on investing the float. They can only do that if they attract premium payers by having the most competitive pricing. They can only have competitive pricing by having accurate data and models.

Allstate, for example, is billions of dollars in the hole on paying out claims for the past decade. Most insurance companies are.

Edit: I'm talking about underwriting losses. Selling insurance and paying claims is a sort of loss leader for the insurance industry. Insurance companies are net losers on paying out claims, but they make enough back by investing the premiums before claims have to get paid, that it is still a net profitable business.

Essentially insurance companies are loaned money by their customers since they are selling a promise of future payment on claims. They invest this pool of money and keep the gains until it is time to pay out on claims. Many companies (like allstate) pay out more in claims than they collect in premiums. For 2022 and 2023 they paid out 5 billion more in claims than they took in in premiums. Those were pretty bad years, but over the long run, just about every insurance company loses money this way.

Look at their financial reports if you don't believe me: https://www.allstateinvestors.com/static-files/d61a8007-647a...

Additional Edit: this comment is particular to the big property and casualty insurance products (home and car insurance on the consumer side). Best Buy extended warranties, health insurance, and other products may have business models that rhyme, but that don't follow this exact fact pattern.
> The suit also cites Allstate as gathering direct car use data from Toyota, Lexus, Mazda, Chrysler, Dodge, Fiat, Jeep, Maserati, and Ram vehicles.

Seems like the bigger part of the story is at the bottom. You can uninstall GasBuddy from your phone but finding and buying a new car that doesn't track you is a bigger hassle.
Every posting needs to have an honest attempt to fill it. I don't know the exact numbers, but if there 1000 applicants per posting and you end up reposting your job 4 times, there's clearly something amiss.this overlap of 1-4000 applications and not one of them are worth a call? Even if we accept 90% is spam, that's still hundreds of candidates in a "recruiters market" being passed over.
Third parties is google as single sign on. If such an org/domain is abandoned, a malicious person could 'resurrect' the accounts on those third party sites. It's kind of like a similar situation where a user deletes an email account and then someone else creates an new one in its place, and now they have access to all the third party password reset links. Except in the case linked above, the user never had the ability to delete their accounts before off boarding, and the abstraction isn't just an email, but the account itself.
She could have spoken with UHC after the fact. Even if that meant she didn't get paid for the procedure. Even if that meant operating at a loss. Surgery is a very profitable. But she wasn't willing to do that, yet demanded UHC to do so.
US announces new controls on AI
I have worked at multiple, and it's getting really tiring to read these hyperboles spouted constantly by people with some weird grievance.
I’m talking specifically about when trees are used for lumber.
in practice i find this does not work well at all… for some reason in roundabouts is when cars most feel justified in running down a pedestrian in a crosswalk. sometimes i think they’re just afraid to slow bc of the cars behind them
Thanks for the link to the ColPali implementation - interesting! I am specifically interested in evaluation benchmarks for different image embedding models.

I see the ColiVara-Eval repo in your link. If I understand correctly, ColQwen2 is the current leader followed closely by ColPali when applying those models for RAG with documents.

But how do those models compare to each other and to the llama3.2-vision embeddings when applied to, for example, sentiment analysis for photos? Do benchmarks like that exist?
Seriously? But... NVMe drives! I stopped testing because I only have one spare NVMe and couldn't use it with bcachefs.

If you or others can get it done I'm absolutely starting to use bcachefs the month after. I do need fast storage servers in my home office.
i mean this is on point regarding the effort needed to run a game, but also llms don't really solve any of the problems you listed, so while people want _something_ it doesn't seem like they're crying out for this. also, would love an example of the suggestible ai DM if you have one handy lol
Cool article. I feel like a lot of these 'passive income' things though are just 'X purchaces diffused over time until the market niche is saturated'; hence the need to keep making new sites/products
Air pollution and brain damage: what the science says
They don't need to engineer them, but for example BYD's vertical integration with batteries has been their superpower. Tesla once upon a time (~circa 2013) talked about building battery manufacturing "gigafactories" all over America but I don't know what the status of that is.
Business idea: I can sell you a list of people who you can then pay to tell you how to make money on the internet!
That's how it is advertised. But in reality all decisions are made by Google for Chrome and other Chrome forks just implement all of them without questions.
Google wants to add a new protocol - all forks add it. Google wants to cripple adblock support - all forks do it. Etc.
I think it's funny that the current top 2 comments on this article completely contradict each other.

I.e. the top comment is basically dismissing the article, saying that in these types of firestorms that there is essentially nothing you can do - which I strongly disagree with, and which the article points out is demonstrably not true.

And now your comment basically says "there is no new insight or information", which I find highly amusing because I see so many comments online, like the top comment, solely blaming the geography or the "wild-urban" interface, so it's clear this is information that people should be aware of: even if fire-prone Southern CA, the problem is not inevitable, and most of the destruction in these latest fires were urban fires, not in wild areas surrounded by trees.
What happens when the forests in those places burn down?
Defense Department's new tool to investigate on-orbit anomalies – SpaceNews
I find the UI atrocious and primitive. The extensions are ManifestV3 alike and worse yet, pollute /Applications (why?!). I don't particular find Safari fast, it uses just as much memory as any other browser, and all the claims about power efficiency are never backed by any numbers, just like /r/macos parroting "macOS good cus UNIX" while not understanding there have been plenty of shit UNIX distributions.

Plus the incompatibility with various sites... Just sticking with FF. I can certainly appreciate an OS-integrated browser, though. It makes life simpler for users and if you have the full Apple ecosystem, the tab sync is useful.
Sounds like the main ingredient of a Ponzi scheme to me.
Wouldn't it be cheaper just to pay for the domain registration for an extended time like 10 years vs the 1 or 2 year options?
> To resolve this issue, Google could implement two immutable identifiers within > its OpenID Connect (OIDC) claims:
> 1. A unique user ID that doesn’t change over time.
> 2. A unique workspace ID tied to the domain.

1. is the OIDC `sub` claim! I strongly suspect that in those 0.04% of accounts where the anonymous quoted engineer reports that the `sub` claim changed, what actually happened was some provisioning/onboarding/offboarding system resulted in the account being deleted and recreated.

2. is sensible, and is just a versioned version of the `hd` claim.
Could you point to some functionalities removed from dbt Core? I love dbt and use it where applicable but I have not yet encountered a loss of features upon upgrade yet - it would be useful to be aware what kind of features get removed
I have never watched one, but I consume a lot of YouTube content. My teenager calls MrBeast-type channels "brain rot". He says teenagers watch YouTube when they want to make time disappear. (I guess they are uncomfortable being bored.) I find it sad because YouTube is actually a great source of educational content.
Yes: https://ibb.co/86tqnBM

Direct link: https://i.ibb.co/Hn36L27/Green-crossing.png

solid green (right turn allowed) + pedestrian green (for crossing).

car and ped both have access to ped crossing. (Car should yield to any ped in crossing.)

Also, I drew a picture before I realized that this wasn't what you were asking about. But I like the picture.

C
A
R
2
|
v

--------- --------
CAR1 ->
---------|ped -> -------
| |
| |
| |

C
A
R
2
--------- --------
C
---------| pAed -------
| R |
| 1 |
| |
@QuinnyPig... fancy meeting you here . I follow your account on twitter. Hope to see you on Bluesky soon

here is the cost csv dump in gist
https://gist.github.com/manish-2014/363482a08078e346238ef633...

I have also dumped my cloudformation stack template. I am 100% convinced it is the IPV6 egress , which is supposed to be serverless and hence a surprise as I did not do much with this VPC in December
It looks like the UI would clash with the browser's autofill recommendations.
First you have to deal with the issue of cities selling camera data to third parties and using it for license plate tracking and face ID
How is it greed when CPUC[1] sets what prices utilities can charge, sets how much revenue they can collect, and has line item veto over their spending? See the 2020 PG&E GRC for an example of how much control the California government has over utility companies.[2]

1. https://en.wikipedia.org/wiki/California_Public_Utilities_Co...

2. https://docs.cpuc.ca.gov/PublishedDocs/Published/G000/M354/K...
A car turning on a green light can be simultaneous with the pedestrian's crossing light being green. The driver is obligated to see the pedestrian and wait.

What's not simultaneous is a green turn arrow with a green ped crossing. Intersections in the US are designed so that a green arrow will mean the driver has no conflicts and can proceed.

Not everyone (both drivers and peds) understands that distinction.
No, inflation doesn't increase the present value. If anything, the proper way is to discount the future (potential) costs by say 5-10% per year, as the business may not exist forever etc. The net present value of an annuity of 360 dollars with 10% discounting rate is 360/0.1=3.6k. So for ten accounts 36k.

Sure if you discount by less, say 5% (due to e.g 5% yearly price increase) thst doubles to 72k, but it's still much much lower than your wrongly calculated 360k.

How much would you be willing to pay for that lifetime plan? Not 21k. Surely not.
I'm someone that uses shell scripts in my day to day work (I don't work in biology any more, but did for a while).

I'm saying that for the average scientist using these tools, a shell script is not an easier or more useful tool than Python plus libraries. Can you honestly say that shell scripts are more intuitive and easy to understand than Jupyter notebooks? Are they going to be more easy to transfer to other stakeholders?

This is one of those solutions that seems better in theory, but likely isn't in practice.
Yes, that too, but it might not help kids whose main perception/exposure of "society" is MrBeast et al. Kids can be quite oblivious to how "society" works in practice and what will be rewarded.
> Is someone's job to cruise around the various conferences and dev events to look for any Google mentions and report back.

Someone in Google's security team likely saw the talk, or the original blog post, and pushed internally for them to award something.
I can totally see the appeal of using LLMs to _help_ the DM. Not to replace it.

I DM a few games of The Expanse, and using LLMs to plan ahead was a godsend. No, I didn't utilise it to write the story for me - instead I used it to test my planned story and see which way my players might strafe off the road, so I can plan for those. Basically simulated a game using an LLM that acted in place of multiple characters, allowed those to run free (within certain limits, obviously you can't have the LLM players do a dozen actions without the DM having a say), and essentially mapped the potential "off branches", story pathways I didn't plan for initially. This has allowed me to be prepared for the usual dumbass things players might do, such as heading for a strip club in the middle of a total disaster where they (figuratively) have dozens of arrows pointing to the goal of the chapter.

Another interesting aspect of using AI for TTRPGs is to create atmospherics. For Expanse based games, I've bought a number of tile packs and such, to appreciate the artists who put work into it, but I simply don't have the funds to commission a few dozen acrylic matte style scenery images (which I usually put up on my projector, combined with some Hue lights to create the visual atmosphere). With AI, I can even generate them on the fly, should my little gremlins stray off the path. Same for music - AI can incredibly easily generate an atmospheric soundtrack that fits the current scenery, with just a few words, while I can still pay attention to the players.

But fully replacing the DM? That's silly.
A lot of work to set up?

I'm quite surprised to hear that.

It's literally pip install, a single file for your DB config and that's it. 30-40 seconds.

I'm in no way affiliated with dbt but have worked with the tool since 2018.

Lighter, faster, sure, but hard to set up?

I'm not sure where you'd want to cut corners on setup.
The stronger player was handicapped when they gave their opponent a handicap, and yet they still won; they now held in their hands their prize that was the match's prize.
You failed the moment you said objective. Any such system needs to acknowledge right off the bat that these assessments are subjective, subject to human error and re-enforcing bias etc. Otherwise you're just high on your own supply.
Tote: A browser uxn emulator – primordial computation with symbols
It would be worth it to build a highly refined and moderated "free tier", with a paid option that is even better. From what I noticed during my last job hunt, all the big platforms could vet their submissions better.
If everyone is going to be on their best behavior knowing their data is being recorded, wouldn't Allstate want this to be known?
My partner slams on his breaks even though he goes below the speed limit and has plenty of time to clear the intersection. It's not just the speed.
If the government is so inept at developing space stuff how come they were able to accomplish the apollo program?
You should watch Severance.
That's extremely unfortunate, especially about the "abandoned" labelling. I've been looking to move off GitHub recently as well, it feels like it's got a bit too much control.

Codeberg looks interesting, and there are self-hosted ones like Forejo that also look great if you're okay with the maintenance.
Is the USA driven by abstract economic argumenents instead of the decisions of elected representatives?

I thougt the US had a fairly standard "town council" arrangement, with the councilors having large autonomy and being beholden primarily to voters.
Partially true, given the huge congestion that there is, pedestrian have to wait for the green light even if cars aren't moving due to traffic. However, it is situated in quite an important node of traffic going in/out of the city. in smaller roundabouts we just have zebra crossing without lights, while in more dangerous and big ones (eg more lanes or often has heavy traffic) we have traffic lights
I think we know quite a bit. Maxwell's equations have unified electromagnetism. We actively exploit nuclear for energy (and deterrence of war, but I won't go there) and armchair me thinks there shouldn't be a lot more to the strong and weak forces (~80% of it known?).

What we don't have a good grip on is gravity and time at the ends of big and small (plank and galaxy) scales. And dark matter remains a giant mystery.
I'm nearby this intersection and there are 2 scrambles- this one and one about 2 blocks down closer to the university. There is very clear signage for cars that there are no turns allowed on red. I've crossed both intersections many times and rarely have I seen cars violating that rule. Perhaps they do but in my experience, they generally respect it.
> There is no solution for those who don't want sign a contract with a US IT giant, or those who want better privacy, or those who only want to use free software.

DFRI are working towards a FOSS solution[1].

[1] https://www.dfri.se/projekt/e-legitimation/
In other words, it’s the exact same bland, generic, worthless advice parroted by every grifter selling you the dream of financial independence via passive income.

And if you fail, it’s your own fault, you just didn’t want it enough, you didn’t do the necessary sacrifices.
Exactly right. Plenty of people have in-home systems to bring their municipal water to the quality that they want (e.g. filters, softeners). Many more even have wells because there is no municipal water.

Many people research safety ratings before purchasing a car as a proxy for how reliable a given manufacturer is at ensuring good outcomes in a crash.
Regarding make, Noweb gets this right. When you edit the web source, the tangle step only writes new modification times to output files that actually changed.
Yes. I don't know how you can buy something and hold it for decades without calling that "speculation."
I have 4 Microsoft accounts I use regularly for work. I also do some consulting and often end up with credentials provisioned at a client (don't get me started on this).

It is so convenient to have container tabs. All my extensions are available in new containers, unlike multiple Chromium profiles (or Firefox profiles).

Container tabs also pair very well with Simple Tab Groups, which allow you to pin a container to a group, so that everything for one account ends up in one place.
How iPhone notifications work. These are relied upon by humans and they started displaying incorrect facts for news apps
the issue is the prevailing wage requirement (3x+ minimum wage). it would be easy to complete this cheaply with just minimum wage labor
> Basically if Sally, the CTO of DankStartup, signed up for Taskrabbit or whatnot, it's possible for you as the owner of the domain to impersonate Sally in the context of that relationship.

I don't think this is the issue, unless someone went to some pretty extreme lengths. Configuring OAuth such that the company Google Workspaces account is recognized by Taskrabbit as a valid SSO option is not as simple as signing up to Taskrabbit with your company email instead of personal email.
> it's crucial to have an objective (as objective as possible) system for measuring performance both to reward your high performers and to understand your low performers whether to provide support or to document reasons for firing them.

This isn't how it ever, ever plays out.

Also, most companies implementing this clearly are doing so out of some sort of compliance, whether it be SOC or otherwise. So yea, lots of times it actually is total performative bullshit. Congrats on finding the .000000000001% of cases where it isn't, if you are being serious here.
> It seems like as soon as it latches on 3-4 interests of mine,

Its worse than that. I thought that Youtube worked as you described, trying to find videos suited to your interests but it actually works the other way around.

Youtube has a series of rabbit holes that it knows maximise engagement, so its trying to filter you the human down one of those rabbit holes. Do you fit the mr beast ssniperwolf hole, or the jordan peterson joe rogan rabbit hole? Howabout 3 hour video essay rabbit hole, is that one your shape?

Its designing paths for engagment and filtering humans down not filtering videos for humans, its perverse and awful and it explains why the algorithm simply does not work for humans, because you are not the target audience, you are the data being sorted.
how much more confirmation do we need that we are in a recession?
Yeah, it really is obvious. Here's one excellent example: the dominant right wing media apparatus knowingly engaging in a conspiratorial lie that fetched them a $787 million punishment.

https://apnews.com/article/fox-news-dominion-lawsuit-trial-t...
I was homeschooled from 2nd - 8th grade. My elementary school was trying to put my brother on adderall and my class had sorted me into the "blue" group of readers (colors of the rainbow for reading ability). I apparently came home talking about how I was slow and it was okay because we all learn at our own pace.

Definitely not a great school! both my brother and I ended up going to college and getting engineering degrees, and had zero issues with academics in high school. My mom did a pretty okay job but it was absolute hell on her, I entered high school ahead on mathematics/history but pretty behind on writing and science. The science I dont blame my mom for, all the curriculum at the time was insanely religious, so the ones we could find were very dry.
At least GasBuddy still works well if you only share while using app and you can generally do without precise location.

In terms of its benefits, at least in Canada, it saves me a bunch of dough on gas. Highly recommended.

Though I like the French approach where gas prices are all on a government website without needing to depend on crowd-sourcing: https://www.prix-carburants.gouv.fr/

I’m more worried about a navigation app spying on me.
I was able to take over an Instagram account because I received a password reset email to a domain catch all address that I'd set up years ago. Turns out it was a whole brand, but they refuse to change the email address and don't understand that I'm going to shut it all down. It totally makes my site look bad (it was an adultish brand and I was working on a community project) and I now have the power (and ability to do whatever with the account and any other that I happen upon with an email at that domain.
scrollbar-gutter: stable; to those unfamiliar.
https://developer.mozilla.org/en-US/docs/Web/CSS/scrollbar-g...