skysight-inc/HackerNews huggingface dataset:
Its kind of annoying to explain the vulnerability in a blog post and then omit the parser differential in question.

It is like writing the introduction to a story and omitting the climax.
This is a great write-up.

He's mentioned in the article, but a major shout-out is warranted for ahacker1. He's doing really sophisticated and valuable work to secure SAML implementations. We at SSOReady are really appreciative of his work.

Earlier this week, WorkOS put together a nice write-up on their own collaboration with ahacker1: https://workos.com/blog/samlstorm
From a security perspective that's kind of useless, as your concern is not what the "good" people do, it's what the "bad" people do.
The UN disagrees
Real peer review has never been tried (2022)
I've seen this bypassed via background audio and background location.
I’m inclined to agree, but who knows… maybe he just happened to have his big insight early on, and if he’d lived longer he’d never have done anything quite as significant. Plenty of people do great things only once.
Just another prediction market. Still requires Google or Apple authentication

https://manifold.markets/ianminds/will-manifold-implement-lo...
To clarify some of the confusion in this thread, a REAL ID driver's license is completely different from an enhanced driver's license. A REAL ID meets federal security standards and is available in all states. An enhanced driver's license proves U.S. citizenship and includes RFID but is only available in five states.
Daniel Kahneman died last year by assisted suicide
copied it from someone else, can't remember who :)
Better policing, safer protests? Our writer gets up close to a 'dialogue unit.'
It appears that it was published on medium and subsequently added to the standfordmag site, hence the 2 links to it they're and the notice that new articles are published there. It probably just remains because they have no control over medium, so they can't turn the page into a permanent redirect, and they don't want to just take it down and break links.
Scientists Just Discovered a Health Benefit of Coffee
They are no more already banned from that than they have already been forced to divest chrome. None of this is final.
I agree completely something really good started in the '77. That time period is still in heavy rotation for me now even while I discover new to me music.
Due to the ongoing security incident involving the tj-actions/changed-files Action, we at StepSecurity have provided a secure, drop-in replacement: step-security/changed-files.

We strongly advise replacing all instances of tj-actions/changed-files in your workflows with our secure alternative:
https://github.com/step-security/changed-files
Is Cap'n Proto Event Loop Friendly?
Review of The Brothers Grimm: A Biography
It is sad that this is now a priority for so many only now that it's affecting affluent white people.

They didn't care before, and they only care now for self-preservation.
You mean like a dependency tree? There isn’t a comprehensive one — it would be way too big and we don’t have all mathematical knowledge written down in one place anyway.

But if you’re interested in any given classical result, if you ask I’m sure a mathematician can give you a rough idea of what the path back down to first principles is. If you’re not literally interested in starting by assuming the existence of the empty set, say, then opening any introductory book on the topic will give you an idea. Just look at the proof of the result and follow its references back. It won’t go that deep.
This is monetizable for parents (or at least, highly needed). YouTube is terrible for child behavior as there are so many pranks and people screaming etc (in kids content) but there are a select few YouTubers who are really good for kids. For example our 10yo does well with: ZebraGamer, Half Asleep Chris, Mark Rober, Brick Experiment Channel, Ants Canada, etc. We have it locked down via safe app but it would be great to have this for the full home network with channels buttoned down.
Yes, from the article:

"In Buddhism this is karma, while for the stoics it is Providence, the same concept of Providence that Christianity later borrowed, which argues that everything in the world which seems bad is actually good in a way we cannot fully understand because of our limited perspective."
Well, they won't be as effective given Google's absolute dominance in web properties and the reach of its surveillance advertising network. When Gmail or Docs mysteriously breaks in Firefox for 3 days peeling off 10M more Firefox users for Chrome, the web suffers. Meta won't be able to do nearly as much of that given their major effort is all in apps and barely on the web any more.
What can be asserted without evidence can also be dismissed without evidence.

GP was dismissing the original assertion.
Even if so, that's besides the point IMO. I for one would prefer to use software that makes full use of the system's resources. Bonus points if this is a knob that we can turn.
Pin Your GitHub Actions
I wasn't sure what this was going to be from title alone, but I appreciated the tour of practical tools and libraries available in Gleam. They could totally take some notes from how Bun does their marketing by empowering & compelling fans to start new small projects in Gleam by leveraging these libraries
I recently had to implement SAML and this headline does not surprise me in the slightest.

The SAML spec itself is fairly reasonable, but is built upon XML signatures (and in turn, XML canonicalization) which are truly insane standards, if they can even be called such.

Only a committee could produce such a twisted and depraved specification, no single mind would be capable of holding and combining such contradictory ideas.

It would be so simple to just transmit signatures out-of-band and SAML would be a pleasure to implement.
You need to ask yourself one important question: are your potential customers on these platforms?

Many people see successful indie developers use social media to elevate their success, and immediately think they have to do the same until you stop and realize that most successful indie developers on social media, actually sell “the formula for success” to other indie developers.

Now, I’m over generalizing but you get the point. There are many indie developers who have little to zero presence on social media because their customers are not there.

What’s your product? Who is your customer and where do they spend their time?
sure it creates some work for someone that is invested in getting more milk for their coffee. hardly onerous and removes a lot of daily checking for the purchaser.
The article mentions Smells Like Teen Spirit and grunge.
Thanks! Today I learned:

$ git ls-remote "https://github.com/$repo.git" "refs/tags/$tag"

Even though the grep and sed are not very readable this was very useful way to avoid yet another tool!
Do you mean 100% precision?
For a start:

There's a nice indie hacking and build in public type community on X. You can find lots of people there and see what they are doing in terms of posting.

Next, just look for communities where your potential customers hang out. Participate sincerely in their communities and offer your service when it's appropriate.

Mostly just have fun, participate in other threads, and generally be active.
You have decent documentation portal https://www.merklemap.com/documentation with related articles and API examples, great work! By the way, did you use any markdown2html converter here to built developer portal or this is just a simplified Redocly version of it?
Is it me? But I thought Siri was quite a bit better a few years ago.

I thought they might have downgraded in order for the planned improvement to be that much more apparent.

You mean they put so much more extra memory into iPhone 16s for no real benefit yet, OK maybe delayed for a year or two.
Fusing Object-Level Vector Modality for Explainable Autonomous Driving
You say it's "outlandish" to consider alternatives, but new ones are starting all the time. Every advance of the post-FLOSS era has started just like this. Big players getting out of the way can only help evolution along.
Copyrights do not mean much here except that Google could license that code differently at some point, though the previous licenses are irrevocable so the "sold" Chrome would be the new main line, and Google's 90% of a browser fork under a new license could do something else. They'd certainly have to do some work to get it to be a browser again though because the 10% they cannot arbitrarily re-license is scattered around the codebase and some of it in critical parts of the system.
I can't deny the first section described that. My confusion isn't about what the claims are or what surface knowledge presents.

As a peer comment noted, an outlet for anger is part of it, a starting point, and was useful to me too. My comment is about how that album more than others invited me to stay stuck there, remain clad and "protected" from my vulnerability. Tearing down, destroying, and randomizing are always easier than solving, creating, healing, loving, and seeing things just/right. More relevant in this context, startups are hard. Being useful is work.

The beauty in the brashness of NIN is what I believe starts with feeling less alone in your heart and leads to loving yourself and spreading that into your ambient surrounds.

As you note, I am sharing what this art is to me. I cannot say that must or should be what it is to any other person. I still hope that we can be less ashamed and equally vigorous with our caring.
My favourite NiN track, Call Me A Hole: https://www.youtube.com/watch?v=5Lm1FL7gWl4

A bit of an aside, but I love this mashup and hope some of you will enjoy it as well.
This looks cool, am I missing the Windows client, or is it only available on *nix systems?
Monetizing this would put YT-DLP in danger of having legal action taken against it, or at least being shut down.
Carney Reviews Canada's Order of F-35 Jets Amid Rift with US
It's the scale. You can do all kinds of integrations at tiny scale that are not permissible at grand scale. I can own my store and sell my own-brand products in it but if I own most of the stores and use that leverage to force other stores to sell my own-brand products, that's a concern for competition and an opportunity for anti-trust regulation to step in and attempt to fix things.
Want to ride an e-bike? No batteries needed • France 24 English [video]
I messed around with that setting on one of my Macs. I wanted to load a large LLM model and it needed more than 75% of shared memory.
I didn't submit the story.
huh, I haven't noticed this, although I wasn't actually listening for poor audio quality. What is your OS?
So on one hand, sure, Amazon isn't trustworthy.

On the other hand, the big question with Echo/Alexa has always been "is it listening to me all the time?". My understanding is that people have snooped the devices and they appeared to only send data when the wake word was used. Now... does that mean they are not recording all the time and only sending data during the wake word window? I do not know.

However the above point is different. I honestly didn't think that they were generating the text on device to this point, so this is news that they ever WEREN'T sending voice to the cloud. However, I think a lot of people are going to get these two things confused and basically nope out of the Alexa ecosystem.
I appreciate the admission. I can't deny benefitting from that too. More in my response to this comments peer.
The fact that Valli topped the charts again in 1978 with “Grease” still boggles my mind.

Not if you were living through the 1950s nostalgia revival which was going strong at the time and lingered through the early 80s. It was on TV (Happy Days and Sha Na Na), the movies (American Graffiti, Porky's) and a bunch of retro musical acts (The Stray Cats) or retro projects by established artists returning to the music they grew up with (Robert Plant's The Honeydrippers).

The sound of rock music undoubtedly changed between the beginning and middle of the 1960s. But by looking at the Billboard Hot 100, we can see if that change in sound was being made by a fleet of new groups or a bunch of older acts adapting.

This methodology leaves out a lot of bands, and not just the long tail that never cracked the top 100. There are MANY locally popular bands that never broke out nationally and therefore never made it to the Billboard Hot 100. There were also bands doing types of music that never charted particularly well yet were influential in their own way. For a sampling of this, go to the MIT/WMBR archives (https://wmbr.org/cgi-bin/arch) and listen to "Lost and Found" which highlights a lot of these types of music. Or search for things like "60s garage bands" "60s funk" etc. on YouTube.

The author also mentions the 1991 change to the Billboard methodology which really calls into doubt a some of the "hits" that came before. In a nutshell, music charts in the United States were based on a sample of self-reported sales from record store managers. You can imagine the bias and BS that went on with those numbers.

Then there was manipulation further up the funnel. Record companies weren't supposed to give outright cash payments to DJs (wink wink) but there were many other ways of exerting influence on influential media gatekeepers.

Some of the influence was obvious. Picking artists that had the "right" look. Promoting "safe" artists. Forcing hitmaker producers on new and established artists. Selective access and backroom benefits for powerful DJs and music journalists and other influencers. Ignoring, sidelining, or co-opting trends bubbling up from the underground, from proto-metal in the late 60s to punk in the 70s to rap in the 80s.

As soon as Soundscan was implemented, there was an immediate realignment, with rap and grunge and techno and country storming the pop charts.

Background on the 1991 Soundscan change is here, if anyone is interested: https://ultimateclassicrock.com/billboard-soundscan/
What is “safe app”? Too generic to be googleable.
Thank you for the correction, you are right, I am actually looking to avoid them ;-)
I'm guessing you have read this

https://news.ycombinator.com/newsguidelines.html

Maybe people might think it falls under what you might see on the news. Also for an international audience it might seem somewhat parochial. Who knows, it's the users who flag it.
I wonder what would happen if you 3D printed a dithering pattern, of either a picture or just some perlin noise, as a fuzzy skin.

It seems like it could have a really nice effect.
Electric cars were driven on the moon before Elon Musk was in diapers
They have also precluded Apple and Microsoft and Mozilla from improving their browsers in critical ways by spiking good initiatives and forcing the other browsers through sheer power of numbers to add garbage to the browser.

DRM, wanna know who spearheaded that? and who fought against that-- and who won. and who all were then forced to go along with it. This isn't rocket science.
Progress for dear leader's vision. We will rain fire upon them with our superior rockets. Sympathy is for lesser people, the ubermensch shall take their rightful place in libertarian heavens.
It’s much worse than you’re making it sound: XML is literally an eXtensible Markup Language, so… of course the SAML standardisation committee invented their own extension mechanism language on top of it.

Coming up with your own protocol on top of a protocol for a tiny amount of data amounting to not much more than what’s in an authentication cookie is the special kind of stupid that only the largest and most bureaucratic committees can produce.
Isn't the simpler conclusion here that one should look for the signature where it is supposed to be? Instead of using an excessively general XPath like "//ds:Signature" that might find any signature in any unexpected location...
Nevermind was among 7 albums released within 44 days:

Metallica, Metallica
Pearl Jam, Ten
Guns N’ Roses, Use Your Illusion I
Guns N’ Roses, Use Your Illusion II
Red Hot Chili Peppers, Blood Sugar Sex Magik
Soundgarden, Badmotorfinger
Nirvana, Nevermind
Actually it does. The repo maintainer is on the user's side, so they are doing MITM on the attack vector. This makes it harder to get your malicious code in, because MITM might intercept it.

Yes now you have to trust the maintainer but that's sometimes easier.
The thing with mathematics is there are often many different ways to prove things leaving no universally agreed upon graph of true mathematical statements in terms of which helps proving which! That being said, you might want to check out ProofWiki [1], an online collaborative project featuring mathematical proofs consistently linked together.

[1] https://proofwiki.org/wiki/Main_Page
Really trailed off at the end there...only company and/or country even close to attempting a launch system of this scale and reusability. Embarrassment compared to who?
That's true. The notion of what Kanban is differs between knowledge work (stemming mostly from software development adaptations) and manufacturing.

Since my context is primarily IT I made some simplifications when describing the context.

Admittedly, the principles are the same. However, because of the differences in the nature of the work, different areas are stressed. A notable example is how differently "removing waste" is considered between IT and manufacturing.

Anyway, yes, whiteboards and sticky notes are staple artifacts of software development/knowledge work context. "Old-school" (since it started decades earlier there) manufacturing is much more creative with designing visual signals.

On the other hand, knowledge work typically handles uncertainty and variability of work way better. That stems from a different type of process (more creative, less repeatable) and unique nature of each individual task.
> "...that says more about you than about the story."

The user attempted to respond to you politely and you are attacking them?
That’s a problem big grids also share. It‘s probably easier to buffer power for a small neighborhood, than for a city.
Beach bumming is still alive and well in Australia. There's thousands and thousands of miles of beach, all of it public, and while local councils try to clamp down on people living in vans, there's only so much they can do.
Yes, I am moving there, but I do not want to open a company just yet. I might do so in the future to ensure I pay enough taxes for meeting the requirements to become a citizen, but to grow my funds and because I get nothing in return for paying taxes there for now, I would like to keep my business in a different country.

Also, I am probably going to consult a tax lawyer there, but it still does not hurt to ask others about there experience I think.
Yes! Frank Zappa is the rarest of individuals cut from the same cloth as Adams, and your comment reminded me of his amazing 3rd release of instrumental cuts, aptly titled "Return of the Son of Shut Up 'N Play Your Guitar".
I feel that this is under{rated,used}.
Why Copyright Infringement is Theft (2013)
Neither Branch Protection nor the newer Rulesets allow to protect secrets from someone with push acces to the repo. From what I understand, only environment secrets provide this feature (and have the drawback that you can't share them among multiple repos in the same org without copying them everywhere, although you can script the copying with the github api)
Is it not what "Reason" or "Thinking" features are for? Sort of...
And if nuclear became the default clean energy technology, it would have to be shared worldwide. Every country with the same issues, but varying levels of competence, political alignment, terror risks etc. do we want 100 000 nuclear power stations?

(Edit: although maybe thorium might shift the calculation.)
I ejected from the craziness and slipped into a quiet little, inexpensive corner to work on things that trigger obsession.

So far, it's gone pretty great, we'll see how long it holds!
Nothing, but at least they won't have the largest web properties and the most sprawling ad surveillance network to combine with that browser in ways that are evil and anti-competetive. Silver Lake won't knowingly ship a bug in Google Search or Gmail that breaks Firefox or Safari for a month, peeling off millions more of those users to Chrome which magically works despite the other-browser breaking bug, then rinse and repeat once every 3-6 months for a decade until the competition has no users any more.
Begs the question what the founder’s intent was with the 10th amendment. I’d say it covers AI until you get federal dollars tied to it.
https://apps.apple.com/us/app/safe-vision-kids-for-youtube/i...
Someone elsewhere suggested a lockfile, which seems a pretty obvious solution in hindsight. I'm fine with commit hashes, but the UX is terrible and consists of pasting the action into into StepSecurity's thingie, when this is something that GH should have built in.
Yeah, climbing out of the water was a bad idea :)
GitHub's SAML implementation is useless. The idea is that you can bring your own account into an enterprise, and that sort of works on the site itself, but it does not prevent apps where you log in with GitHub from reading your organization membership once you have authorized an app on the organization level (and if you didn't, it hides the membership from oauth tokens, so it has this capability!).

A SAML session is only required if said app fetches data via a token obtained from that user - and in my glance around, this was almost never the case - SAST tools almost always use app instance tokens and are happy to show anyone with a GitHub account in your organization your code. Tailscale fixed this when I pointed it out, Sonarcloud told me to please don't tell anyone and GitHub took a few weeks to say this is totally expected behavior - when no vendor I told did, and their docs contradicted them.

I swear, reporting security bugs is a thankless endeavor, even if you just randomly stumble over them. I couldn't imagine doing this as a job.
Then don’t give them independence, but if Israel has administrative control of the area, it must respect the human rights of the people that live there. If I’m a foreign national in a country I can do almost everything a national can do besides voting: I can buy land wherever I want, move freely, work freely, travel abroad. Palestinians can’t. So it’s one or the other, either you consider them a nation with whom you can have a peace treaty and thus all the “they are not a country” doesn’t apply, or they are foreign nationals and you have to treat them as such. Israel chooses the awful option: apartheid, because then it can still keep an ethnic state whiteout killing or deporting millions. It is debatable if Israel needs to be an ethnic state to protect Jews, but at least its apologists should acknowledge that.
And those users can then move to a browser that isn't screwing them over, that does support Linux and open source and web standards. Google Chrome is not the only browser possible except to Google shills and sycophants.
> Green means it was sent as a normal SMS

No it doesn't, and it would mean that even less when green messages start meaning end-to-end encrypted RCS.
Are you really characterizing Nigeria's notoriously kleptocratic bureaucratic system as "relatively competent", while self-styled Singapore of Africa Rwanda is a "basket case"? Most observers would reverse those labels.
So, you’re saying they -do- have a massive hole in their geo-logic formation?
I am not a tax resident in my home country anymore, since I already migrated to a different country (UAE). I am also not trying to avoid becoming a tax resident of Thailand, but as the law seems to state currently foreign sourced income is not being taxed there necessarily.
That is an interesting observation.

The first two (and I would say key) practices of Kanban (as a method) are:
- visualize work(flow)
- limit work in progress

So I wonder, how did these Kanban teams visualize work exactly?

Now, I don't say the whiteboard (virtual or physical) is the only way to do it, yet it's almost ubiquitous.
Prob need to speak to an Egyptology expert.