HN user
No Apple just don't even allow you to install a non Webkit browser from the app store on their phones.
Why waste time advertising on competitor's websites when you can just stop them from using competitors altogether (or at least require them to use you at the same time)
By default, under the same origin policy, a browser won't allow requests cross origin.
But there are valid situations where you want a request from 1 domain to be made to other domains. This is where CORS comes in.
CORS is a mechanism to loosen security, not increase it. It allows a server to say, these are the domains (outside my own domain) who can make requests. CORS headers should be set carefully so that you are only allowing the domains that should be allowed through.
It will actually be tabs, which is standard for Go (as per gofmt), GitHub's default tab width is 8 spaces.
Did you just quote half of a sentence and refute it using the qualifier provided by the second half of the sentence?
This was the full sentence:
Spending credit on crypto isn't a sign of risky behavior - spending more than you can pay off and failing to pay off what is owed is.
This part:
spending more than you can pay off and failing to pay off what is owed is.
is equivalent to your statement:
It most certainly is if you cannot afford to pay it off after making the purchase.
Understood, sorry I wasn't trying to dispute any of your points about said issues/mistakes.
Just trying to clarify that he does actually talk about NPM and his regret about it.
This stuff isn't relevant at all to the talk - he never talks about npm or anything to do with package managers but instead how node does imports etc.
He does have it in his slides.
Slide titled: "Regret: package.json", last 2 points:
Ultimately I included NPM in the Node distribution, which much made it the defacto standard.
It's unfortunate that there is a centralized (privately controlled even) repository for modules.
I'm a kiwi, who lived in the US from the age of 8 to 13 (1998 - 2003).
I remember getting into a massive argument with an Elementary school teacher who tried to tell me I was wrong when I told her that my country was not in fact part of the country of Australia (not just continent, but she was adamant it was part of the Australian country).
Unless it is an Iridium handset to Iridium handset call, it will always be routed to one of Iridium's ground stations:
- Arizona - Hawaii (Military only) - Russia
and then it is routed through the fibre backbone.
With the SpaceX proposal there will be more ground egress points, so it will be able to get closer to the destination before grounding.
dep is still the officially recommended way to go for now. Russ Cox has mentioned in his blog posts on vgo that they will be working hard to ease the transition from dep to the built in versioning tools.
Apparently making the dependency-manager's code simpler is a goal
That isn't the goal at all. The goal of Minimal Version Selection is to ensure that the version selected is closest to that which was tested by the app and its dependencies.
worth removing developer's ability to be expressive and removing security updates.
And that isn't true either. It allows the developer of both the app and its dependencies to express the version they have tested against, and still allow the developer to receive security updates by explicitly increasing the version, allowing them to test that the update doesn't create problems while doing so.
It allows for version pinning without the need for a lock file.
Uhhh no, he switched away from real cheques because of bank fraud: https://www-cs-faculty.stanford.edu/~knuth/news08.html (this page seems to have certificate issues)
So an open-access network (https://en.wikipedia.org/wiki/Open-access_network).
This is done quite successfully in other countries around the world, like New Zealand where we mainly have one infrastructure provider (selected and monitored by the Government), who must offer fair and standard pricing to any ISP who wants to add value to the network.
As a result, we have many ISP options throughout the country and competition between providers is high.
I believe that is more because most cities won't want a really loud rocket launching/landing nearby.
So React is damned for including a PATENTS license
A patent grant is a good thing, you want a patent grant as a user of OSS.
The problem people have with React's patent grant is the one sided terms of the patent grant (and the fear that Facebook could hold you hostage with those terms).
Geez, wish they would just re-license under Apache 2.0.
This would be my preference.
IMO, for the React issue, even if the issue is a paper tiger (https://medium.com/@dwalsh.sdlr/react-facebook-and-the-revok...), this puts a massive hit on Facebook's OSS credibility. Even if the fear was irrational, many people are never going to understand that now and many people won't touch any Facebook OSS because of that fear.
Facebook would probably solve a lot of that credibility loss by just re-licensing under Apache 2.0.
The MIT license doesn't change anything in this case, because the MIT license doesn't have a patent grant.
This GraphQL situation is different and, arguably, somewhat worse than the ReactJS BSD+Patent license issue.
The problem here is the GraphQL specification doesn't have a patent grant (unlike ReactJS, which does, but people don't like the terms of the grant). And Facebook have filed a patent for GraphQL (https://www.google.com/patents/US9646028) that has some quite broad language.
Due to the patent, and the lack of a patent grant, most GraphQL users likely infringe on Facebook's patents.
Please read: https://medium.com/@dwalsh.sdlr/using-graphql-why-facebook-n...
Safer than level 1 autonomy.
So what this report is actually showing is that Level 2 enabled car is safer than a Level 1 enabled car.
which seems to disagree with the leading statement of the first comment in this thread:
The level-2 driving that Tesla is pushing seems like a worst case scenario to me
And CRS-7 (https://en.wikipedia.org/wiki/SpaceX_CRS-7)
I wasn't saying a CSRF token saves you here.
All I'm saying is that security is a complicated topic. People already misunderstand things like CSRF, CORS, resource protection, etc. And they already get them wrong.
CORS is designed to loosen the security protections added by a same origin policy. It is not designed to increase security.
Piling on CSRF protections is just blurring the use case for CORS. All this is going to do is confuse people more, and more people are going to get it wrong.
Yes, but then you get people that fail to understand that CSRF only applies to a browser, and CORS only affects a user agent that implements a Same Origin Policy. And they fail to protect their resources otherwise.
They add CORS support to their server resources and get the false assumption that their resources can only ever be retrieved from a web page under their origin or an origin they have trusted (via CORS). They believe that this also protects them from malicious users making requests from outside of a browser (eg. via curl).
CORS is not security, it is loosening of security (namely SOP).
The number of times that I have had someone ask "why can someone access the endpoint via curl? I thought this was protected by CORS" makes me sad.
Although, you could argue that an attacker who is targeting self-driving cars could modify the sign in a way that is unnoticeable to humans, but greatly affects how the self-driving car interprets the sign.
Eg. look at the panda images at the start of the linked post. The third image looks like a panda to humans (and most humans probably wouldn't be able to see the difference between the first and third images), but it greatly affects the machine learning interpretation.
By modifying the sign in this way, if it is possible, it would be much harder to detect and enforce against than it would be if the attacker was targeting human drivers.
No that is only the case if you don't count Michigan (which Trump is probably going to win very very slightly).
Counting Michigan, Trump has 306 electoral votes. If you take away the 29 from Florida, he has 277, which is still greater than the 270 needed.
Oh those are well up the North Island, they probably didn't even feel it there. Or if they did, it would have been very mild.
I know that Netflix was probably just an example, but for the record, Netflix is not one of these media companies.
You can directly cast Netflix when using it from a browser, you don't need to cast the tab.
Except that the longer you run the first stage, the longer you have to carry the weight of the first stage. It eventually becomes much more efficient to jettison the first stage and use a slightly less powerful but much lighter weight second stage, because you no longer need as much power to get through the atmosphere. Which is the whole point behind staging (https://en.wikipedia.org/wiki/Multistage_rocket#Optimal_stag...).
It turns out when you add 10 lbs of weight to the first stage for reuse you lose approximately 1 lbs of weight from the max payload. (http://aviationweek.com/blog/nasa-cnes-warn-spacex-challenge...)
On the second stage every 1 lb of reuse you lose 1 lb of payload, which is one of the big reasons why second stage reuse isn't really feasible on the F9.
So what?
If I work for Tech Company A (that develops products in one market area), and leave to go to Tech Company B (that develops products in a completely separate market. ie. They don't compete in any way for market share), everything I do for Company B in the 12 months after leaving Company A, actually belongs to Company A?
What Google is doing makes sense from a business stand point but totally shameful from a company that boasts itself doing "no evil".
Oh come on! I'm not a fan of everything Google does, and I can see, and in part agree with, the point you are trying to make, but this is just grasping at straws. You just lost all credibility with this comment.
Yes, I can see unmaintained code being lost here, and that is unfortunate. But Google provided this service for free, a service they started to promote open source software development. They noticed that there was a big move to other hosting platforms, that they themselves also believe are better than theirs. This has led to support for this platform to be little more than dealing with abuse cases, and they feel that the benefit to the community no longer outweighs the cost of the platform.
They have gone out of their way to provide ways to migrate code from Google Code to these other "better" platforms, and they are giving people over 18 months to migrate their code:
January 25, 2016 - The project hosting service is closed. You will be able to download a tarball of project source, issues, and wikis. These tarballs will be available throughout the rest of 2016.
They really didn't have to provide any of this.
None of this is "evil". There are plenty of acts that Google do that border on "evil", but this is really just the wrong one to choose to call them out on.
What do you really expect them to do here?
Since when does a name have to provide sufficient context to distinguish the concept from other similar, yet distinct, ideas?
For example, tree data structures. There are:
2–3 tree, 2–3–4 tree, AA tree, (a,b)-tree, AVL tree, B-tree, B+ tree, B*-tree, Bx-tree, Binary search tree, Optimal binary search tree, Dancing tree, HTree, Interval tree, Order statistic tree, Red–black tree, Scapegoat tree, Splay tree, T-tree, Treap, UB-tree
In many of those the name doesn't provide much context at all to distinguish the concept from another one.
Names of things, at least in CS, are rarely ever named in a way to provide sufficient context of their meaning, without having some level of background context.
That is what the description of the concept is for, not the name. A name is too short to provide this. Usually the name is at the discretion of the original author (aka Dijkstra in this case). If you are trying to determine the complete concept of something, or you are trying to distinguish the concept from other similar ideas, only from the name, you are doing it wrong. Go read the documentation about the concept for that.
Microsoft will pay up to $100,000 plus $50,000 bonus for defense submissions (http://technet.microsoft.com/en-us/security/dn425049)
Facebook has paid $12,500 for one (http://techcrunch.com/2013/09/02/security-researcher-discove...)
Google will pay up to $20,000 for one (http://www.google.com/about/appsecurity/reward-program/#rewa...)
Forbes even posted an article a couple years ago on the market of zero day exploits and listed prices someone could get for zero day exploits with prices in the tens/hundreds of thousands. (http://www.forbes.com/sites/andygreenberg/2012/03/23/shoppin...) It should be noted that they state in this article that the groups that will buy these exploits for these prices are generally western governments.
Do you mean ITAR (http://en.wikipedia.org/wiki/International_Traffic_in_Arms_R...)?
Any more details on why SNC got passed up?
Because they had enough money for one or two, but not all three. And they want two so that they can spread the risk.
SpaceX are almost finished and are so far ahead in development that it would be an outrage for them not to get part of the contract.
And Boeing because there would have been a lot of political backlash if they didn't get the nod, due to their political influence.
Although this may not be the official reason, I am pretty sure that this is the real reason.