mediumdeviation

But you can already license your IP using a contract or a license, and that contract can be inked in paper or done digitally. You can even give exclusive license or transfer your rights. The only difference using the blockchain is, well, the blockchain.

This is an even less interesting use of the blockchain than Bitcoin - at least with Bitcoin there is no longer a central authority needed to prevent double spending. Here the blockchain is facilitating a transaction that can already be done without some authority to recognize it.

> Manderin has non-gendered pronouns referring to a person

That's only when spoken, because 他 and 她 are homophones, no? Otherwise when written it is almost exactly the same as English in how pronouns are gendered with he/she/it.

Specifically 15 seconds after the code is loaded - since this is a polyfill this means immediately after the page loads - it checks if your browser is in one of Russia's timezones, and alerts the message if it is. It then tries to use window.open to open a change.org petition (user? I'm wary of checking the link), but because this call is triggered by a timer and not user interaction, most browser's popup blocker will block it by default.

The version was released 22 days ago. npm has a list of dependents https://www.npmjs.com/browse/depended/event-source-polyfill.

Gatsby is the big one, and it doesn't use a lockfile or pin the specific version so any new installation will receive the bad version, but this package is to only be used in development environment https://github.com/gatsbyjs/gatsby/blob/441a5af8e665256c7703....

> for instance, any node with class skyscraper is considered hidden (maybe the logic is that those elements are shrouded by clouds).

Ha, you wish. Skyscraper is the name of a standard Internet advertising unit. It’s fairly common for adblockers to block it. https://www.marketingterms.com/dictionary/skyscraper_ad/

I'm surprised nobody else has called this out - implementing browser APIs in a non-browser runtime seems like a really bad idea. Take a look at https://developer.mozilla.org/en-US/docs/Web/API/Window - the submitted article seem to have demonstrated literally the only APIs that make sense to implement in a terminal. What would happen when a library tries to call window.location or window.history? Almost none of these map neatly to any possible implementation on the server or in a scripting environment.

This is somewhat misleading - the definition of M1 was changed in May 2020, so numbers before and after are not directly comparable. See https://fredblog.stlouisfed.org/2021/05/savings-are-now-more.... It’s best to link directly to the page which is interactive and describes the actual components of M1 instead of just the image https://fred.stlouisfed.org/series/M1SL

Other than the historic messiness the other comment raised, the DOM API is just... not good. I don't think it's surprising developers don't want to bother with fun stuff such as

- The only way to remove a node is node.parentNode.removeChild(node), until you get past IE11 then you can use Element.remove() https://developer.mozilla.org/en-US/docs/Web/API/Element/rem...

- Text node normalization - because there are separate representation of the exact same HTML https://developer.mozilla.org/en-US/docs/Web/API/Node/normal...

- NodeLists are almost but not quite arrays. They could also be live or static but you can't inspect it directly to tell which is which https://developer.mozilla.org/en-US/docs/Web/API/NodeList. Similar almost-array nonsense with HTMLCollection.

- Historically IE and Netscape/Firefox supported two completely different set of API and it was a horrible mess. You can still see remnants of that API war in functions that does almost but not quite the same things such as textContent vs. innerText https://developer.mozilla.org/en-US/docs/Web/API/Node/textCo...,

https://nitter.42l.fr/blocks (the main nitter.net is down, this just the first mirror instance from https://github.com/zedeus/nitter/wiki/Instances)

It only applies to purchasing a resell flat. Renters are not affected by this.

That's not the case here - Singapore is majority Chinese. The sentiments you see are more run of the mill xenophobia - Chinese mainlanders are here to take our jobs, they're loud and unhygienic, they can't speak English, their Chinese has a different accent, etc. You won't hear it being said to your face, but these are not uncommon views.

I'm surprised - China's recent foreign policy certainly has not endeared it to South East Asian countries, but even before then mainland Chinese were not exactly treated with open arms in Singapore. You probably won't find it said to your face, but xenophobia against foreigners from China and India is definitely not uncommon.

> Live in Singapore in reality is no more or less 'democratic' than live in Japan or Taiwan or SK.

You absolutely will not be arrested for holding up signs outside government buildings[1], or questioned by the police for reading a book on the train as a protest[2]. You would not be sued to bankruptcy for making what would be considered political speech in these other countries. Or just about anything on this list https://twitter.com/kixes/status/1174024357443600384?s=21.

Singapore is absolutely less democratic - there's no need for scare quotes.

[1]: https://twitter.com/kixes/status/1353999081287245824?s=19

[2]: https://www.todayonline.com/singapore/police-question-one-ma...

I would not completely blame it on culture. There are practical upsides to having a large number of packages - using a dependency instead of duplicating code means the resulting code is smaller, and splitting large packages up allows you to only include specific functions you need. This is important for the web, which is a lot more size sensitive.

Nowadays tree shaking means that having a large package with lots of smaller function should work better, especially since adding an import incurs its own overhead, but a lot of older packages are stuck on the small packages model.

So that quote is actually taken out of context. The Senator knows that finstas are, and is using it to drive a different argument - that Instagram is incentivized to help teenagers bypass parental control https://www.theverge.com/2021/10/1/22704308/finsta-instagram...

> “Finstas are fake Instagram accounts. Finstas are kids’ secret second accounts. Finstas often are intended to avoid parents’ oversight. Basically, Facebook depends on teens for growth,” Blumenthal said. “Facebook also knows that nearly every teen in the United States has an Instagram account; it can only add more users as fast as there are new 13-year-olds.”

That approach unfortunately also makes keeping state updates consistent very difficult. Some pet peeves - when reviewing code, if you set up some file filters then scroll down to trigger more files to load, those newly loaded files are not affected by the previously set filters. Or occasionally the page would helpfully offer to reload to show new commits, but clicking that link loses the current white space and file filter settings.

SPA frameworks aren’t a silver bullet here, and you can definitely fix these without using one, but these bugs are definitely much harder to make since the DOM is rendered from a single source of truth instead of being patched piecemeal.

It’s not being discriminated against based on some protected class. Being vaccinated is a choice, unlike skin color.

The government will not let you serve alcohol at a restaurant unless you check the drinker’s age. The government will now also not let you serve diners indoors unless you check they have been vaccinated.

It seems no more bothersome than being required to be licensed to drive or to present a proof of age to purchase alcohol. There are perfectly viable alternatives - you can eat outdoors, get takeout, exercise outside, just like how you can ride a bike or take a taxi if you choose not to get a driving license.

And the decision to require vaccination at hospitals are also made on recommendation of doctors that are as, if not more qualified than the hypothetical doctor. The doctor in question can also open their own practice if they do not want to be employed by the hospital.

Licensing systems necessitate some surveillance in the form of identification and data storage, but it's not as if these do not exist already and somehow the driving license has not caused American to spiral into dystopia nor is it even close to being the worst surveillance mechanism that the American government could choose to use if it does turn authoritarian.

If you have an adblocker with element hiding capability (I don't think any iOS ones do), hiding the #layers element removes the modal but you still cannot scroll.

If you have a userstyles extension, this works for me

    #layers {
        display: none !important;
    }

    html {
        overflow: auto !important;
    }

A list is usually represented by an ol in HTML, not a table.

HN uses three trs for each item, not one. The table cells are also not consistent, because it's not actually a tabular data, so each cell could have nothing (used as a spacer for layout), or more than one thing squeezed inside. The intermingling of semantic and non-semantic (presentational) elements makes "understanding" the page difficult, which incidentally also makes the page less accessible since screen-readers also rely on the same mechanisms to relay information to non-sighted users.

The second result is more semantically correct, but it will not function if called on tr.athing because tr.athing contains HTML elements that will be deleted when you replace the text. It is still much safer than innerHTML which will silently corrupt attributes. It's also interesting you need to prompt Codex for security best practices (and a bit questionable if it even "knows" anything about best practices)

I guess part of it is that a one-liner is impossible. Here's what I would write given the prompt

    const makeUppercase = (id) => {
      const element = document.getElementById(id);
      if (element == null) return;
      const makeChildNodeUpper = (node) => {
        if (node.nodeType === Node.TEXT_NODE) {
          node.nodeValue = node.nodeValue.toUpperCase();
        } else {
          node.childNodes.forEach(makeChildNodeUpper);
        }
      }
      makeChildNodeUpper(element);
    }

Yup, innerHTML just returns a string, so of course you can .toUpperCase() on it even if it is unsafe.

innerHTML's history is fascinating. It was not part of the original DOM Level 1 API but was added in IE5. It is not semantically correct (you should be using Element.textContent or examining the inner text nodes), but because it was so easy and the rest of the DOM API so verbose, it caught on and became one of the primary ways used to manipulate content in JS.

FWIW Chrome recently proposed a Trusted Type mechanism for preventing XSS (which also has the side effect of blocking this sort of unsafe manipulation) - https://web.dev/trusted-types/, https://developer.mozilla.org/en-US/docs/Web/API/TrustedHTML

It's really interesting. HN's HTML is very un-semantic and is actually quite hard to work with.

    <tr class="athing" id="28191639">
      <td class="title" valign="top" align="right"><span class="rank">9.</span></td>
      <td class="votelinks" valign="top"><center><a id="up_28191639" onclick="return vote(event, this, &quot;up&quot;)" href="vote?id=28191639&amp;how=up&amp;auth=****&amp;goto=news"><div class="votearrow" title="upvote"></div></a></center>
      </td>
      <td class="title">
        <a href="http://be-n.com/spw/you-can-list-a-million-files-in-a-directory-but-not-with-ls.html" class="storylink">You can list a directory containing 8M files, but not with ls</a>
        <span class="sitebit comhead"> (<a href="from?site=be-n.com"><span class="sitestr">be-n.com</span></a>)</span>
      </td>
    </tr>

In the video Codex picks up tr.athing as a news item. I wonder if this is actually generalized learning, or if it just picked the selector up from eg. a userscript that appeared in its training corpus.

Another thing that's kind of scary (and makes it worrying if this is used for Copilot) is the second prompt to make the text uppercase results in code that is superficially correct, but is very semantically wrong - innerHTML.toUpperCase() is dangerous because it not only makes the content uppercase, it also modifies the attributes on the HTML elements inside. This definitely broke the vote button, which uses inline JS which is case sensitive. It also destroys any attached event handler since the elements are basically deleted then re-created.

The correct way to do this is to either use CSS text-transform: uppercase, or if it is important to update the DOM itself, recursively descend and update childNodes with nodeType == text's nodeValue to uppercase.

In that specific case at least the FBI is asking Apple to produce new firmware that will bypass existing protection on an existing device - basically asking Apple to root a locked down phone which would likely require them breaking their own encryption or finding vulnerabilities in their own firmware. This is not exactly technically trivial since anything of this sort that’s already known would be patched out.

In this case it seems only a matter of policy that Apple submits CSAM hashes to devices for scanning. No new software needs to be written, no new vulnerability found. There’s no difference between a hash database of CSAM, FBI terrorists photos, or Winnie the Pooh memes. All that’s left is Apple’s words that their policy is capable of standing up to the legal and political pressures of countries it operates in. That seems like a far lower bar.

It only worked because Google Maps loads images in 250px tiles. If Google Maps decided to update tile size tomorrow, the fix regresses. Arguably the entire map as a whole is one content, and that should be measured as the LCP, but more importantly it shows the measure is just very brittle and easily gamed, as other comments in this thread already attest to.

Create a wrapper class that takes a stringifying function that converts the key objects into a primitive and use a Map<string, [K, V]> as the backing store. fast-json-stable-stringify can be used as the default stringifier, and if the objects are large or have a natural key a custom stringifier can also be supplied. Since we are using TS we can have our custom class implement Map<K, V>.

> American Renaissance (AR or AmRen) is a white supremacist website and former monthly magazine publication founded and edited by Jared Taylor.

> The publication promotes pseudoscientific notions "that attempt to demonstrate the intellectual and cultural superiority of whites and publishes articles on the supposed decline of American society because of integrationist social policies."

https://en.wikipedia.org/wiki/American_Renaissance_(magazine...

I hope you've managed to fix this, because this is an obvious security issue. A long token is used precisely because it is long and unguessable. The shortened URL is subject to enumeration attacks which can be used to hijack accounts.

The most common vulnerability that grants RCE has the attacker exploiting poorly designed deserialization code. Those are high impact but not too common since deserialization is hopefully closely scrutinised.

There are other problems that naturally fall out of the fact that by default all objects, including those from JSON.parse, inherit the Object prototype though. For example -

- If you store user membership or permission as an object with some user controlled identifier (eg. a username) as key, then check if a user is permitted at all with `username in permissions`, a user can name themselves hasOwnProperty to bypass the check since it is part of the Object prototype

- If you deserialize some JSON then try to check membership with `o.hasOwnProperty(someKey)`, a malicious user can pass in JSON with hasOwnProperty as key. This will crash since hasOwnProperty is no longer a function on the object.

These are not necessarily common, but it’s annoying how easy it is for these to slip through. The object prototype in general is just a massive footgun

Another fun limitation - apparently for my Pixel phone to remember I prefer my temperature in Celsius, Google also needs "Web & App Activity" tracking. In other words Google wants my whole location history when using Google apps just to remember my preferred units.