> You can try an Ajax request or loading a picture over SSL and then redirect with JS if it doesn't fail.
Neat idea, but wouldn't this still be exposed to ISP-level attacks? Since the user is still loading the page initially in plain HTTP, so the ISP could still inject code, remove the JS redirect, etc.
> There is no formal definition on what constitutes a "surgical stainless steel", so product manufacturers and distributors apply the term to refer to any grade of corrosion resistant steel.
A bit misleading. The maintainers have been working on large experimental features like a self-hosted "signaling server" which helps sync notes without storing any note data on it, and without relying on third-party hosting like Dropbox [1].
Also if you look at the dev branch [2], they have been making sweeping changes to the codebase; most recently it appears they have been removing "old" JavaScript libraries like Bower, presumably to move everything to an NPM setup.
Firefox Test Pilot [1] is a more recent approach to testing new UI in Firefox. It's entirely extension based. I think this is a smart approach because it lets Mozilla quickly test new UI features without building it into the core browser before it's been vetted.
However its full potential is not ready yet, since Firefox has been migrating to WebExtensions, and this has not fully stabilized yet. Long term I think the WebExtensions move also makes sense, since it gives extension authors a stable API to work with, instead of XUL which can break with each Firefox update. And the architecture makes it easier to optimize threading performance and some form of security sandboxing.
So the point is, I think more UI experimentation is on Firefox's horizon, but they have to first stabilize the technical architecture before they can go full throttle on that.
IMO the simple reality is they need to diversify their income sources to avoid putting all their eggs in one basket, and they decided Pocket makes sense. I'm still a huge Mozilla fan, the whole Pocket episode is not a big deal to me.
> by visiting one of the vulnerable sites repeatedly
I mean, how could CloudFlare, or anyone, possibly differentiate this from normal scraping/polling/ manual F5 refresh behavior? This sounds like a PhD thesis.
I guess you are asking CloudFlare to quantify the amount of distinct bytes of unauthorized data sent to any particular user agent? But then, any sophisticated attacker would rotate IPs, UA identifiers, and probably even between vulnerable websites, if they had known about this vulnerability.
I don't think it's reasonably possible to rule this out, even with a massive dedication of investigative resources. Like the other commenter said, it's wisest to assume it happened.
> 2. I agree $60,000 is a very low minimum. But how is $130,000 reasonable? Even in this industry that's a significant salary.
The current administration is businesspeople. They know $130k sounds too high, it's anchoring for negotiations. It'll go lower.
But also it's kind of the point of the reform being pushed, right? If somehow $130k is passed, it will obviously disqualify most foreign workers from acquiring these visas, and maybe the current quota of visas wouldn't be met. Then the quota may be lowered in the future, further limiting the visa program.
You're misinterpreting cjensen's comments. This is Hacker News, where people like to use an engineering mindset to find smaller faults in arguments, even when they may agree with the overall argument. I believe cjensen's purpose in commenting was to constructively criticize the author's complaints. He's saying this one specific complaint, about regional wages, is flawed because Tesla could theoretically solve that one specific complaint in a way that hurts those workers, by moving the jobs away to a cheaper cost-of-living region.
The point is that by removing the flawed argument, and keeping the legitimate arguments, the overall message becomes stronger.
Your accusation "But you don't care the workers are being abused and working in unsafe conditions." is inventing and attacking something that cjensen never said or implied.
It's a mistake to just compare Google with AWS, thinking in terms of basic storage and computing. That's boring and obviously there are tons of alternatives, including Snap Inc. building it themselves, for the amount of money cited.
When it comes to cutting edge AI and related, Google's offerings clearly stand out among other cloud services.
> There is also one sure-fire way to increase telomere length : get cancer.
This badly needs a source.
This article from 2013 [1] says the opposite, that shorter telomeres are associated with cancer:
In recent years, shorter telomeres have become associated with a broad range of aging-related diseases, including many forms of cancer, stroke, vascular dementia, cardiovascular disease, obesity, osteoporosis and diabetes.
And another [2]:
"Telomere shortening is common in cancer, but the degree of shortening varies from one cancer cell to another within each patient, and this variability may give us a better idea of how prostate cancers behave."
Echo.js (https://github.com/toddmotto/echo) is another small no-dependency library (1.89 KB minified), which detects elements appearing on screen, and goes a step further to swap the "src" attribute with a placeholder for lazy loading and unloading.
Neat idea, but wouldn't this still be exposed to ISP-level attacks? Since the user is still loading the page initially in plain HTTP, so the ISP could still inject code, remove the JS redirect, etc.