skysight-inc/HackerNews huggingface dataset:
Interesting vulnerability! It's a classic example of how seemingly small differences in implementation (REXML vs Nokogiri) can lead to significant security holes. Kudos to Peter Stöckli and ahacker1 for finding it!

I wonder how many other libraries are vulnerable to similar parser differential attacks. It's a good reminder to be extremely careful when dealing with XML and SAML, which are complex beasts at the best of times. As asmor pointed out, Github's SAML implementation has other issues too. It seems like SAML is just inherently difficult to get right.

Also, to the person who suggested not mixing personal and professional stuff in the same Github account: wise words! I've seen that cause headaches more than once.
Would I be able to store and edit this type of note on Google Drive? I like to keep documents in the cloud so I can access and edit them from anywhere, like Google Docs. But I don't think Drive can actually open html files, despite working entirely inside the browser.
If your data can live within the 192GB of the previous model, then it makes sense. 512GB is an immense amount of memory and most people won't need it. The new one is overall faster in all benchmarks, and in some it's a reasonable margin.

OTOH, the prices for recertified Macs aren't that lower than new ones. A new M3 Ultra with 256GB of RAM and 8TB of flash will be about US$1,000 more expensive than an M2 Ultra with 192GB of RAM and 8TB of flash.
Yes this is a skill issue.

But Arduino ecosystem is full of superstition and bizarre hacks. It's cargo cult electronics. They will do anything to avoid reading documentation or writing robust code.

Even the power saving recommendation here reeks of it. There is no effort to understand it. Someone on an Arduino forum recommends it, others start to echo it to try to appear like they know what they're talking about, it becomes lore in the Arduino world and you out yourself as a clueless newbie if you don't know to do esp_wifi_set_ps(WIFI_PS_NONE) without questioning anything because that's just the way it's done. It disables the radio in between AP beacons, so unless there's a bug in the implementation it should have no noticeable impact to a quiet WiFi station other than saving a lot of power.
Meditation, until the apps I guess
Hi everyone,

I'm Fatih, the maintainer of Awesome ChatGPT Prompts and https://prompts.chat.

I've put together a new collection of vibe-coding prompt ideas, mainly for newcomers, to help them explore and discover new ideas and build something with one-shot.

Would love to hear your thoughts and see what you build!
I second that. In my experience forcing a 40MHz channel on a 2.4g network leads to abysmal performance (never tried it with ESP32, however I can imagine it would be even worse...).
Props to OP for using the term 'superstitions'. Wi-fi (and radio in general) is poorly understood even by people with engineering degrees, let alone the average Joe. This often leads to trying random stuff until an improvement is perceived (or believed to be...), then spreading this experience as proven and applicable in any context with no further research and confirmation of the results (let alone filing bug reports).

The prominence and accessibility (to laymen) of wifi does not help the situation either... I mean what else CAN they do except try stuff out, how are they going to determine that it worked and why it did?...

OP, yes, poorly implemented power saving has in my experience often been a culprit behind network reliability issues. That said, please consider adding a disclaimer that just disabling power saving in client devices without pinpointing the root cause of the instability or at least reporting it is exactly why we are in a situation where it is still buggy.
Would the use case here be like a dirt simple splash page / redirect / under construction page?
I created some sensor boards based on the ESP8266, they worked well for a while but lately they've been getting flaky. I'm a mediocre hardware engineer at best, so if anyone has any tips on how to make my board more stable, they would be appreciated.

Here's the board, it's a bit of a generic light/motion/presence sensor with an IR LED:

https://gitlab.com/stavros/sensor-board
It's pretty much the peak of hysteria to think China is a reliable ally for a western democracy. It's like you're totally disregarding the fundamental issue that China is an absolute autocracy, fundamentally incompatible with western democracy. You don't like the US. Fine, fair enough. But let's not get crazy here.
> Xml parsing has been hit twice in a week, avoid it in the future, anything wrong with a policy that replaces xml with json?

OAuth 2.0 and its extension Open ID Connect have been around for over a decade. They have their own gotchas (like in badly defined ID token in OIDC and the ill-thought implicit and hybrid flows), but nothing there is nearly as dangerous as SAML.

Most applications support Open ID Connect now, but I'm still seeing organization choosing to use SAML out of inertia even when they are fully capable of using Open ID Connect.
From https://www.lexaloffle.com/picotron.php:

Picotron is a Fantasy Workstation: a self-contained creative environment built for imaginary hardware. Create cute Lua apps that can be run inside Picotron as windowed userland processes, shared as cartridge files, or exported to stand-alone HTML apps.
That’s 3.3 million estimated deaths caused by DOGE illegally shutting down a congressionally established and funded agency of the US government:

- 1.65 million deaths from AIDS

- 500,000 from lack of vaccines

- 550,000 from lack of food aid

- 290,000 from malaria

- 310,000 from TB

“are the effective altruism guys mad about this or are they still trying to figure out how buying a castle will prevent AGI robot attacks in the year 300” -@whetmoser.com
If you don't have a closet, it's even easier, everything will be outside in plain sight. So the office manager just need a minute passing by the kitchen to see what would have to be ordered.

In a ideal world where items could be ordered immediately individually, maybe it could have some value, but in that case you might as easily have an app or a shared excel with employees reporting what is running out.

But in a real world, things will be ordered in batch at a specific and fixed frequency time.
Every interaction I've ever had with CloudFlare has left me feeling like I needed a bath. The vertical desperately needs some competition but I don't know how that could happen at this point.
Interesting discussion! It's true that many Firefox forks focus on UX and privacy, but as some have pointed out, they still rely on Mozilla for core web standard updates. It would be cool to see a fork that really pushes the boundaries of web tech, maybe incorporating some Rust-based engine components for better performance and security. Has anyone experimented with Servo in a fork? Also, the mention of the Tor browser is spot on - it's a privacy powerhouse, but perhaps not for everyday browsing. I wonder if a fork could combine the best of both worlds?
Lil Nas X
Which citizens are being denaturalized?
That is such a great growth hack. As in, it’s both a useful feature AND a growth mechanism.
And I say that it is stupid because from my point of view, you bring a very complex and time costly solution to something that could be solved a lot more simply and efficiently.

Very sadly it is a pattern that we see very commonly in current day software world.
Like using Langchain for doing requests to openai, in llm world, and big company hiring expensive consulting firms to tell them what any low level employee in the firm could have told them.
A river 'died' overnight in Zambia after an acidic waste spill at a Chinese mine
Does this support Chrome's filesystem API?
The risk antenna extend to maximum…..
Controversial scientific topics are actively discussed in academic journals and conferences. Scientists regularly publish challenging or provocative findings, even those outside mainstream acceptance… Provided they’re backed by credible evidence. The absence of discussion here isn’t due to fear of consequences. It’s because the scientific community hasn’t found convincing evidence linking Neanderthal DNA to major behavioral differences.
Yes, surely this is a norm that cannot possibly be changed.

When the people want a king, what's written in the rule book doesn't matter anymore.
This. Using tags is acceptable only for official GitHub actions, anything else should be pinned.
Did you read the title of the thread?
Good idea, that's available on many browsers:

https://developer.mozilla.org/en-US/docs/Web/API/FileSystem
Ask HN: Comment here about whatever you're passionate about at the moment
Hello there,

I have stumbled upon many of the best internet nuggets during these open-ended questions and HN communities feels like one of those spaces where a lot has been going on but not a lot of sharing sometimes.

Every once in a while I struggle with my own passion, likes or interest and in those times I try to look outwards and thus I am here.

Anyway, I hope you are having a great weekend—from one earthling to another.
>It's a bit more manual work

after this incident, I started pinning all my github workflows with hashes, like other folks here I guess :D
But I quickly got tired of doing it manually so I put together this [0] quick and dirty script to handle it for me. It just updates all workflow files in a repo and can be also used as a pre-commit hook to catch any unpinned steps in the future. It’s nothing fancy (leveraging ls-remote), but it’s saved me some time, so I figured I’d share in case it helps someone else :)

[0] https://github.com/brokenpip3/pre-commit-hooks?tab=readme-ov...
People can learn from just seeing stuff. You watch a guy preparing food in a different way, now you know that there's a different way. He wears a funny hat, maybe you try and make a copy, etc. Chimps and some other animals do this too.
Do you know of something that could get my Android tablet to switch between two AP's in my house? When I change locations in the house, it will never change to the stronger one if it has even the weakest signal that it was connected to. I can't find any Android app that tells the device to "change to a new AP if it is stronger than the current one".
Coming from Chicago, famous for its Economics, this article, and its premise are mystifingly inadequate for even answering why their metrics are so poorly used and misunderstood. I would go through and point out most of the utter lack of understanding and rigor. Soon this article, and its lack of scholarship will sink gently into the muck. Here is something to cleanse the palette:

https://www.nytimes.com/2012/12/10/opinion/krugman-robots-an...
Warner Bros has been trying to sell off their studios. So I can see Lego succeeding if they buy TT. Otherwise I think Lego will realize what many others have: starting up a new studio is hard, and having money makes it harder.

You cannot will a studio into existence with money. Google tried this. Amazon tried this. Microsoft has tried it a bunch of times.

Games can be a good business, I know my studio is, but it is hard in was that traditional business methods cannot cope with.

So Lego, make sure you acquire TT. That is your only clear opportunity to use money to solve this problem. Otherwise find a bunch of Lego fan gamers and hire them to make experimental games for half a decade. Don't listen to that VP who is promising you can push XXXmillion into an org chart and get an effective studio as the result.
Canada joins Portugal in weighing alternatives to the US-made F-35 fighter jet
A guy walked across Death Stranding on his treadmill with a Baby
Whataboutisim is the last thing I expect to see on HN.

Yes. Invading Panama, a peaceful democratic ally, would be insane. Let me clear that up for you.
Farmers voted in droves for tariffs. What did they think they were voting for if not trade wars? What else are they not teaching in rural schools?
So does the title of thread automagically mean there is some method to avoid being ruled by some government except living in the woods or the middle of the ocean?
What personal would there be left to express in a world reduced to a market of bespoke customers—not only their tastes, but their very spectra of conceivable interior experiences preemptively curated by adaptive recommender systems?

Pop music was always the instrument of creating such consumers; the inevitable replacement of subsistance farmers by sub-subsistence factory workers; the media industry as a core tool in the toolbox of the infinite growth death cult, robbing people of certain things previously considered essential human, by channeling their personal experiences through the designated—the Japanese have a great word for it—idols.

You can't have global power projection without an unidirectional informational channel to common working folk, you see, to make sure they know which way the wind is blowing, and to keep them unable to imagine an alternative to what they're trapped in. We're just on a new level of that, one where the expression of that reality which any of us personally experiences is left perpetually in the rear view mirror; all that remains in the here and now is "content production", and its layers upon layers upon layers of technical facilitators in cutthroat competition for the largest crumb of the donut hole.

It's the reification of post-post-post-so-far-post-that-it's-kind-of-meta-modernism: it's all about how it's about nothing at all! And yet it's massive. The kids, those ultimate judges of practicing vs preaching, have spoken: can't sell out of your "authenticity" if you were authentically in it for the money and fame in the first place. There's still room in all that for originality, even creativity, but it's explicitly just business, never anything personal because that'd be bad taste; drawing a line between the interior world and the social game—or worse, trafficking in those goods which can only be found in the former—has completed its transformation into a social taboo.

Hence, the exquisitely crude, the blatantly false, the unapologetically predatory, has won the battle for the hearts and minds, and is now officially in control of the planet. If you think anything else is going on, you just don't know it yet, and we wish the best of luck to you and yours.

https://youtu.be/0FcDXL5Aw0o?feature=shared&t=273
Eh, no?

My Code editor is NeoVim or it's IntelliJ

But there is no HTML page involved at all.

What I want to hint at: You're extrapolating the usage of VSCode.
This is my favorite metaphor today, and I read TFA which has lots.
I really like the crayon factory and the saxophone factory too
I used to say things like that, but come on: Arduino is targeted at hobbyists. More specifically, it's targeted at hobbyists who don't want to spend too much time learning hardware. If they did, they would be using a "bare" microcontroller better suited for their needs and costing one tenth the price. But they're not interested in microcontroller programming, they just want to get their art project done.

It's the same thing that happened with computers. Billions of people use them, but most just want to access Facebook or use MS Word, not learn OS internals. It's a different world from where we used to be 30-40 years ago, and that's fine. We design simpler, more intuitive products for them.

If a product meant for that group can't be used effectively by the target audience, I think the fault is with the designer, not with the user.
Perhaps to you, but anyone that’s ever worked with Ruby knows that there’s no such thing as fields/properties/members in Ruby. There are only methods. Parentheses are optional for method calls.
https://en.wikipedia.org/wiki/Farmers%27_suicides_in_the_Uni...

https://investigatemidwest.org/2024/11/13/trump-election-far...

https://www.terrainag.com/insights/examining-the-economic-cr...
https://archive.is/xa218
Yes. The proven method is to A/restrict data rates to just high ones and B/lower the transmit power of your AP so that your devices can no longer maintain high enough data rates after a given point and are forced to disconnect. I am almost certain the run of the mill stock firmware does not offer you this option. Look into installing OpenWrt.

Apart from that, OpenWrt now allows you to install and use usteer which offers a plethora of (802.11 standards-based) tools to manage client roaming from the AP side, including the APs exchanging information between themselves.
I was having multiple ESP devices from different brands running totally different firmwares all drop out randomly when I switched to a new Asus wifi router.

Came across even more 'work arounds'; No spaces in the SSID, disable IPv6 for the whole network even if the ESP ignores it. Thing is all of these settings would reboot the router and reconnect everything, so it would seemingly work until the next dropout.

I found limiting them to 802.11g instead of connecting with 'n' stopped the dropouts for good. Even now I wouldn't say that is a cure-all and that any of these other recommendations don't work, I'd guess that each AP's firmware might have different conflicts with different devices.
Qualified 'Yes'.

We do but the extent is limited compared to other mammals, brain mass normalised.

There's a historical overview here: https://www.ncbi.nlm.nih.gov/books/NBK55966/

I'd have to dig around for comparative mammal brain regen rates.
Typically I don’t think we need to define when it’s fairly standard terminology. Kind of like having to define something that’s in a dictionary. Though understandable if you are not from the US. This wiki which was top of google may help you though. https://en.m.wikipedia.org/wiki/Types_of_restaurant

You may be overthinking this way too hard. It’s simply the level of service being received. There are some definite shades of gray here but throwing qr codes into the mix is pedantic. You could have fast food QR code ordering, fast casual and even sit down experiences. The QR code does not really factor too much into it.
Zen Browser Review and Benchmark vs. Chrome, Brave, Firefox and Safari
> highly productive artists who, at some point, keep making records but can't make hit records anymore

Then there is Cher, who has had 52 charting singles (Billboard Hot 100) so far, from 1965 to 2023.

The Rolling Stones have charted singles from 1963 (UK) to 2023, so their hits also span 7 decades.

On the songwriting and production side, there is Max Martin, who has written or co-written 27 #1 hits (Billboard Hot 100) so far. The first one was for Britney Spears in 1998, and the most recent two (!) were for Ariana Grande in 2024.
> I realize no set of facts will change your mind. The difference between the classified documents cases has been pointed out several times

If new facts come out I might, but the these facts are fairly long in the tooth by now and they aren't persuasive. When it came out that Biden was doing the same thing an already flimsy case fell apart in in the clowny way that things do when Trump is involved. The best part is they just did a big poll over in the US and the verdict came back that they very much prefer Trump and he can do whatever he likes with classified documents.

There is a lesson here for the Dems; if they want to paint their opponent as bumbling and corrupt they shouldn't have appointed someone as bumbling and corrupt as Biden to the top job. They had a good few years and now that decision has gotten them another dose of Trump.

> If your cherry picked metric for a good president is “didn’t start a war”...

I don't know what your complaint is about that, wars are one of the most crippling mistakes that US presidents keep making, both in terms of global and domestic damage done. The resources wasted are gargantuan, the death tolls staggering, the cruelty are unbearable and the cynicism dark. The risks of something going really badly wrong are unacceptably high too. If focusing on that grim stain on America's honour is cherry picking then you should consider doing more of that. It's one of the big issues in the US and an ongoing one.

> It’s pretty clear to me the only person who Trump cares about is Trump.

Yeah we all know. You don't have to tell the right wingers that politicians suck, that is core plank of right-wing theory of governance is that they're all irredeemable scum or close to becoming that. The problem is the leftist delusion that there is a way to consistently find good politicians is what gets them caught flat-footed when someone like Biden gets the spotlight shined upon them, costing arguments credibility.
I've been to only a few concerts, relatively, 2 raves, maybe 6 concerts, and a few dozen clubs. only the "raves" were loud enough to "cease visual processing" as my sibling said. We saw Ron D Core and Omar Santana spin at a Chinese restaurant that had a dance floor in Los Angeles, and it was so loud (not distorted, just pure air movement and wattage) that the needles were jumping. with quarters on them. Omar Santana's "metal gabber" was transcendental.
The press is and has always been an important part of the balance of power between the people and the barely concealed sociopaths that we choose to govern us. Full stop . When people start suggesting that the lugenpresse is some kind of enemy class it's time to get the Nazi smashing machine going.
The obvious problem with spiral coordinates is that you lose spatial proximity. It's useful to have the coordinates for adjacent spaces to also be adjacent.
Go on, you can tell us who that one was and why you detested them.
Funny Because It's True: How The Onion Created Modern American News Satire
Author Christine Wenc is on a media tour marketing her book (available Tuesday, March 18th). Here are some excerpts and interviews.

https://soundcloud.com/wort-fm/christine-wenc-on-the-legacy-...

https://soundcloud.com/hachetteaudio/funny-because-its-true-...

https://www.nytimes.com/2025/03/12/books/new-nonfiction-book...
Hope someone from cloudflare chimes in. If even part of this is true I'll make sure to never do business with cloudflare, they sound like a massive liability.
The ideal devices for a warm place.
If a company wants to succeed in this space, they have to be killers. Cloudflare is positioning for domination.
I think the majority of contributors to that thread are being very reasonable and measured. CF should not be in a position to determine which UAs are viable on the Internet.
Amateur Radio and the likes (to include GMRS, CB, etc.) - especially digital modes. KR4AUW, WSHM613.