gene91

And this news article is enough to put her in stressful years-long proceedings to revoke her green card and citizenship, if the government wants to.

20 sq m is roughly 215 sq ft, not 400 sq ft as mentioned in the post.

215 vs 700 is a very different story from 400 vs 700.

That's a myth according to this article [1] from a well known US brand of alarms.

[1] https://support.firstalert.com/s/article/Where-to-install-CO...

It is in the public's best interest to demand timely fix because you never really know whether bad actors know about it. A demand has no teeth, therefore you have to make a threat (fix in 90 days, or we disclose publicly). A threat is only good if you have a track record of delivering on it without exceptions. Therefore, it isn't an option to not disclose it at 90 days.

That works when the subnet is /23 or larger.

Auto manufacturers are approaching Adaptive Cruise Control in a manner that intermingles the two: GM "Super Cruise", Ford's upcoming "CoPilot 360 Active", etc.

In my opinion, these two features are very related. In order to have a reasonably low false positive, the sleep detection must be reasonably lenient. In turn, this means the vehicle must be able to (most of the time) tolerate a few seconds of inattentive driving.

No. They are not in perfect correspondence. The mapping is one-to-multiple or multiple-to-one in quite a few characters, some of them commonly used. https://en.m.wikipedia.org/wiki/Ambiguities_in_Chinese_chara...

Funding criminals

Isn't that willful ignorance, and therefore on shaky ground legally.

> Apple could create their own Apple Internet List, and demand through App Store policies that all browsers implement it or else.

They do by requiring that all apps (including Chrome) to use the Safari WebKit engine provided by the OS.

They actually justifies it by pointing to parental control and safe browsing.

It's not exactly like that. For example, university official will track you down (through phone call, through help of local official or your high school official/teacher) if you didn't enroll. This is done to ensure people (especially from rural areas) don't give up their admission due to difficulties (for example, economical ones).

Obviously these doesn't help when some one takes your identity and enrolls on your behalf.

Even if there is rejection letter. It probably wouldn't make a difference to the subject of this article. A fake rejection can be easily fabricated (especially if the recipient doesn't know what a real one should look like.)

Also, the subject knows his/her score. The university has limited discretion to deny admission of people above the score threshold. At the end, it all comes down to low social economic status and corrupted officials working against the subject.

You may be looking at freight flights. There are 8 (4 until recently) pairs of commercial passenger flights between US and mainland China per week. 2 of those starts/ends Bay Area.

It's not clear to me whether you're being sarcastic here. People often complain that Chrome gives Google special treatment. Here on HN, people (incl me) will definitely be outraged if Google does what you're proposing.

The ability by websites to detect incognito cause real usability pains for users. (For example, certain news outlets refuse to show content when it detects that you're in incognito.) The mechanisms to detect incognito were/are unintended holes. Both FireFox and Chrome have been plugging them.

Exactly. Any one can offer an explanation why they didn't take this path for 256-bit numbers instead?

Nope, not nearly the same. That's not full 12amp (which parent post claims for Outlander PHEV). Per Sienna manual, the 120V outlet is limited to 100W (less than 1amp). http://www.tsienna.net/power_outlets-322.html

For this level of power, you can get a 12V DC to 120V AC adapter that works on pretty much any car.

Many US states (or locals) have laws against price gouging during a declared emergency. In the case of NYC, see https://www1.nyc.gov/site/dca/media/Face-Masks-in-Short-Supp...

Encryption-only TLS doesn't protect MITM. It prevents sniffing.

At a higher level, TLS provides integrity and privacy when the network linked is not trustworthy. As a result, I'm not sure what your proposal achieves.

Similarly, resolution by IP address does not provide privacy or integrity unless you trust the network link.

Netgear picked a terrible and clearly unacceptable approach. I I read through this discussion, trying to understand if there exists a good solution.

Using plain http isn't a good solution because it involves telling the user to ignore the "not secure" warnings by browsers. This seems like the best available solution.

Without network connectivity, the traffic can not be tunneled through a remote server with proper cert. Nor can the box request a cert in realtime at the time of setup.

Pre-provisioned cert won't work if the box is purchased more than 27 months after manufacturing (the current max validity period). For home network equipment, I suppose this isn't unusual.

I see TLS-SRP mentioned in comments. But the commenter hinted at its limited adoption in browsers.

Is this cert revoked yet?

Sure, Entrust is required to revoke it. It is bound by BRs. If it refuses, Entrust will get itself blacklisted by browsers. On the other hand, having the cert revoked will cost Netgear dearly. As a result, I wonder if Entrust might be dragging its feet on the revocation.

It's not obvious to me why the recruiter in question is in violation of this rule. The rules bans someone from extracting information with GitHub API and selling such information to recruiters. It does not seem to ban recruiters from acquiring this information themselves.

Can Chase take adverse actions against customers that opt out? For example, denying future account applications, closing existing accounts, exclusion from future promotions, etc.

But isn't this exactly what happens when a charity allows you to specify how your donation gets used, or when a government calls for vote on a new tax that will benefit only X (e.g. education)?

I don't have any proof. But I have always assumed that this is the case. I hope I'm wrong. But I don't see why a charity or a government wouldn't do this.

This sound horrifying. If I use a hacked/modified FaceTime client, does this mean I'll be able to hear and see the other end before they pick up, even after the fix?

The intersection between these two sets intersect is likely pretty small: "normal user", "people using Debian"

If both sender and receiver have US Visa/MC debit card, you can use square cash, fb messenger, etc. Square now charges a fee if you want it delivered instantly. IIRC, FB messenger still delivers instantly for free. I'm not sure though. And I understand in a situation like you described, you probably don't want to risk it.

This idea of forbidding middlebox from messing up things sounds great. I have an honest question here though.

What stops a middle box from terminating all QUIC connections (and therefore get access to decrypted content)?

Fair enough, unless you can deduct your cost against your winning. I don't know whether you can.

If you guessed that your employer may be in trouble and then sold stock, is that considered insider trading?

Let's say, you are in charge of security. The CEO is never interested in your work. One day, you got an invitation to meet with the CEO. You sold all your stock before you go to the meeting (based on a guess that something bad might have happened). Is that illegal? Is the meeting invite considered material non public information?

If you buy 40500 tickets. 750 of them will win $50. 27 of them will win $1000. As a result, you spent $40500, and gained $64500. That's a nice guanranteed 59% gain assuming you have enough cash on hand to pull this off (in less than a week's time and effort).