Recent submissions

Comment · 9 days ago
I think this part has been prettymuch fixed in recent releases. (I didn't just get used to it, because when I look back at older output, it still drives me crazy with all of these buzzword tics).
Comment · 17 days ago
Mandatory military service, too. You have to imagine that the US would have a similarly disproportionately-scaled cyber-warfare industry if it also had mandatory military service and good sorting of capable people into those units.
Comment · 19 days ago
Comment · 26 days ago
This is the one case I don't mind it. Suggested responses feel like they cheapen human interaction, but here I'm talking to a robot that really does tend to know what I want next, and also is highly unlikely to be offended by a less-than-heartfelt response.
Comment · 1 month ago
This seems like a really good example of Base CVSS scores not telling us much on their own.

For the Wordpress RCE (nominally CVSS 9.2), it looks like many standard deployments of WordPress would be affected, barring extra mitigations. But in the case of these Hugo ones (9.3), it looks like very specific circumstances (anti-mitigations, if you will) are needed. E.g. running arbitrary builds of untrusted user content without a sandbox; running it in a GitHub workflow against PRs from untrusted contributors, etc.

Comment · 1 month ago
Parler was "ripped off the Internet" because it was delisted from app stores and dropped by AWS for violating their ToS due to having (If I remember correctly) approximately zero content moderation, which is not really compatible with the mainstream distribution model they wanted. The owners were not subjected to sanctions by a foreign government.
Comment · 1 month ago
That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.
Comment · 2 months ago
Comment · 2 months ago
Being overly trained on comments in documentation could be one of the reasons why Claude models write frustrating comments (which often manifest as written justifications of how the code satisfies the prompt). A comment in a tutorial is going to be geared to explaining how the code relates back to the tutorial task or restating what the code does, rather than documenting the "why" of surprising code.
Comment · 2 months ago
> Ben-Gvir is loathed by 90% of Israeli society...Trump still has 33% approval

Maybe that 90% number is for Tel Aviv. In national polls, they both have roughly the same approval rating.

Comment · 3 months ago
I am not a lawyer, but this seems unlikely. Federal law prohibits "false advertisement" which is understood to include misleading advertisements. Regulators can and do restrict certain types of commercial speech, and this kind of restriction has survived First Amendment challenge.
Comment · 3 months ago
> So if Elon decided to sell all his shares today (and likely destroy his companies in the process), he'd shoot to the top of the list? What's the point in that

It looks like the methodology involves subtracting the founder's entire net worth, so selling the shares would leave him in the same place.

Comment · 4 months ago
There is a whole area of research on this. Prosecutors have significant discretion around charging and (suggested) sentence, and this allows bias to creep in. I've heard people debate the quality of specific research on the size of the bias, but not the mere idea that bias is possible at all.
Comment · 4 months ago
I'd love for Google to figure out something comparable for the Drive API (currently it's not possible to grant read/write access to a single folder; you need to grant access to the entire drive!): https://issuetracker.google.com/issues/36760598?pli=1

I think the fact that the above issue has been open for a very long time is one indication of how difficult and sensitive this type of access control API is. The Google Drive API could be a proving ground for getting the UX right for this (including tricky details like how to manage persistent access to a folder with clear disclosure and user controls).

Comment · 5 months ago
Well FWIW, all of my attempts to short have generated losses.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton