Aachen

20 ms·

451.
by Aachen 8mo ago
Does this comment break HN for anyone else? I can press "next" on any other post, but not this one. And in the next post, pressing "prev" does not scroll to this one. It does nothing. Prev works fine when pressed on this
452.
by Aachen 8mo ago
Dutch does this. Idea is idee, with the e doubled to show it's a long vowel. We make plurals by adding "en". One idee, two... ideeen? Idewhat? So the dots differentiate where the sound changes (long e to short e): ideeën. App
453.
by Aachen 8mo ago
Exactly... How long until people figure out that LLMs emulate common writing patterns as their sole reason for being
454.
by Aachen 8mo ago
I wish my family knew what an em dash is . That's gotta count for something!
455.
by Aachen 8mo ago
Any idea what the incentive is for them to put in an email address they can't access? I run a few websites that accept an email address (all noncommercial, I have no interest in spamming anyone). One of them is the "contact me&quo
456.
by Aachen 8mo ago
Hence the example of how long it takes non-LLMs to pick that up, whereas LLMs seem to get it despite there being loads of old code out there See also my reply to the sibling comment with the same remark https://news.ycombinator.c
457.
by Aachen 8mo ago
Exactly, I learned coding JS before 2015 (it was my first language, picked up during what is probably called middle school in english). I haven't had to learn it again from scratch, so I need to go out of my way to find if there is may
458.
by Aachen 8mo ago
The traditional way: separating data and code document.createElement("h1").textContent = `Hello, ${username}!` If you allow <h1> in the setHTML configuration or use the default, users with the tag in their username
459.
by Aachen 8mo ago
> maybe third time could be the charm: it's for preventing XSS holes That information is in the question, so sadly no this still doesn't make sense to me because I don't understand any scenario in which this is what the de
460.
by Aachen 8mo ago
Injecting markup into someone else's website isn't what I'd call too strict a default configuration If you mean to convey that it's possible to configure it to filter properly, let me introduce you to `textContent` which
461.
by Aachen 8mo ago
This one is literally matching "innerHTML = X" and setting "setHTML(X)" instead. Not some complex data format transformation But I can see what you mean, even if then it would still be better for it to print the code tha
462.
by Aachen 8mo ago
When browsers implement a variant that lets you separate data and code perhaps. That's what I expected when reading the headline: setHtml(code, data, data, ...), just like parameterised SQL works: prepare("select rowid from %s whe
463.
by Aachen 8mo ago
Shouldn't use innerText anyway (nonstandard, worse performance, tries to parse the HTML and gives you unexpected behavior if e.g. a style is set that makes an element invisible but still has text inside, doesn't work on all DOM no
464.
by Aachen 8mo ago
> This would provide an extra layer of protection I think this might be the answer. There's no point to it by itself (either you separate data and code or you don't and let the user do anything to your page), but if you're
465.
by Aachen 8mo ago
My experience is that they somehow print quite modern code despite things like ES6 being too new to be standard knowledge even for me and I'm not even middle-aged yet Maybe the last 10 years saw so much more modern code than the last c
466.
by Aachen 8mo ago
Yeah, using a kilowatt GPU for string replacement is going to be the killer feature. I probably shouldn't even be joking, people are using it like this already
467.
by Aachen 8mo ago
> How exactly, given that setHTML sanitizes the input? The article says that the output is: <h1>Hello my name is</h1> So it keeps (non-script) html tags (and presumably also attributes) in the input. Idk how you
468.
by Aachen 8mo ago
So you can still inject <h1> or <br><br><br>... etc into your username, in the given example Preventing one bug class (script execution) is good, but this still allows arbitrary markup to the page (even <style>
469.
by Aachen 8mo ago
Hmm yeah I guess it could be that they see this sound byte (quoting one scientist's opinion, not a study's results) as having answered the question. It's not reported to be the best way though, just what "Achieving fluen
470.
by Aachen 8mo ago
I am constructing my own. Examples are drawn from books, group chats, podcasts, and other media that I consume in the target language (so I know those are either correct, or at worst, as wrong as native speakers are which is good enough for
471.
by Aachen 8mo ago
Did I miss the part where the title was answered? The article mentions some building blocks like microlearning, explains how researchers test people with, for example, fictional words and shapes to avoid that you draw on prior knowledge, st
472.
by Aachen 8mo ago
Non car person here. Why does that matter? It's not like rain means you didn't have to go to the wash, it rains often enough here that there wouldn't be car wash places left near me but there are plenty
473.
by Aachen 8mo ago
Epic level comment! Very interesting to read about in this technical detail, thanks for taking the time to write it up.
474.
by Aachen 8mo ago
Aye-aye o7 ... I saw that one already and didn't suspect slop there either
475.
by Aachen 8mo ago
It refers to your many days software is available for, with zero implying it is not yet out so you couldn't have installed a new version and that's what makes it a risky bug The term has long watered-down to mean any vulnerability
476.
by Aachen 8mo ago
I hadn't opened the article yet and was just browsing comments over my cereal when I saw this and thought "ugh, amother one?" and went to check for myself I didn't get an LLM vibe at all. Looking for it specifically, the
477.
by Aachen 8mo ago
Careful: that infosec.exchange link hijacks your back button and will just loop forever between the toot and their /explore page. For desktop OSes, protip: right click the back button to select two pages back in the history
478.
by Aachen 8mo ago
The authenticator preserves account integrity with the compromised host attack you describe. The device I have shows something like "you are authorising a transaction of 1337€ to RU07BANK012345678, y/n?". What an attacker can
479.
by Aachen 8mo ago
(I agree with you in spirit, namely that GrapheneOS' standards are clearly beyond what most vendors are willing or able to do and a compromise or support of users who want to port the OS might be fitting for the current situation, but
480.
by Aachen 8mo ago
You called it a problem coming from the manufacturers. That implies they actively thwart it (woa, another new word! It's crazy how language works). But they don't actually have a problem with it; some of them are actively publishi

More ›