thayne

They also have a lot more money than you do to spend on lawyers

And changing the commit history to change the authors goes even further than modifying a manifest file.

It depends on the license, but for many open source licenses, that probably violates attribution requirements.

> but it does make it so the applicant is more fairly compensated for accepting a more abusive work environment

How so? It increases the cost to the employer to hire an H1B employee, so they might hire less of them. But it could also mean they pay the employee less to compensate for the higher cost of bringing them in to the country.

It depends on your network speed, how big the image is, the compression rate of the image, and how fast your hardware is.

I don't think raising the fee fixes the abuse problems. Unless maybe most of the fee goes into eacrow and is paid back to the employee if the employer terminates employment (maybe without a good, documented cause?). But that could produce its own misaligned incentives. I think the best way to solve it is to remove or reduce the restrictions on staying in the country after they have worked here for some number of years.

And this is code that will (hopefully) almost never run, so you don't want it to take up much space in you your program, and especially cache lines.

IMO, if the model is too dangerous for everyone to have access to, then no one should. I do not trust a for-profit company to be good stewards of such technology. Nor do I trust the government, any government.

They just exert pressure in different ways. "You want this big juicy government contract? Then you'd better follow our gag order."

It isn't just the proof. It's everything that leads up to that, including the interchange of ideas with other mathematicians.

In math, the journey is often more important than the destination. The process of developing a proof may uncover new mathematical techniques, some of which may have practical applications in other fields. Even an attempt that ends up as a dead end towards the intended proof could produce something useful in a difderent area. But if you just get the proof directly, you miss other discoveries you could have made along the way.

Take the Navier-Stoke problem for example. Knowing that there are solutions that "blow up" probably doesn't have a lot of practical applications. Such solutions couldn't happen in a real system. But the process of finding that proof could result in increased understanding of how turbulence works, or new techniques for solving non-linear partial differential equations (which has a lot of applications in science and engineering).

But solving math problems is not the same as increasing understanding of math concepts.

Using AI to find a vulnerability is not a work of authorship. Using the AI generated text as your bug report would be, but if you use AI to find a bug, then write up a report yourself, I think that would be fine.

> The dairy ban covers whey protein, invert molasses, cane molasses and non-alcoholic beer, per notices on the White House's website.

I think the authors of this ban are a little confused about what dairy is.

I can think of several reasons why an average person might be opposed to a merger (ex. less competition and the things that go along with that like higher prices and lower quality, and fear that products and services will be discontinued after the merge). But I'm struggling to come up with a good reason why you would support a merger.

Authentication is precisely the problem DNSSEC is supposed to solve. And authentication is part of transport security.

TLS usually does provide authentication. The certificate is signed by a chain that leads up to a trusted CA, and content of the stream is authenticated using an AEAD encryption algorithm. But RFC 9539 specifically doesn't require the certificate to be signed by a CA (and recommends using a self signed cert) or the client to verify the authenticity of the certificate used by the server.

This means that an active MitM could return whatever it wanted to the recursive resolver. Pulling that off is admittedly more difficult than a MitM on a public wifi network at a coffee shop, but it's still a gap in security.

And no, you can't just use Web PKI to verify connections to authoritative DNS servers, because Web PKI relies on DNS to confirm domain ownership.

That provides privacy, but not authentication.

DoH only secures the connection between the DoH provider and the client, not the response from the authoritative DNS server. It also isn't sufficient for DANE or similar. So DoH doesn't completely solve the problems DNSSEC tried to.

But google is also a monopsony. There isn't anyone else the researcher can ethically sell it to. They just have to take whatever bounty google decides to pay.

If the scan also included a picture, that was signed with your private key, then it would be harder to spoof.

One reason could be to prevent phishers from getting names similar to your actual domain(s).

Right but when you buy it, they tell you how long it is valid for.

With video games it is often for some unknown amount of time, and of course they don't tell you that.

And if you buy a license, it should either have a fixed term that is clearly communicated, or should be forever, and transferrable, not "untile we decide we don't want you to have it anymore".

The problem is that even as a single number, unemployment just isn't a very useful metric. Unemployed + underemployed is probably closer to what people care about, but it would probably be better as two separate numbers, and even then there is difficulty in defining both unemployed and underemployed, and accurately measuring them.

It's actually more like a really, really tall pyramid.

But the complaint isn't that Google won't process the payment. It's that they won't allow them to link to an OpenCollective donation page, and presumably OpenCollective would handle anything like that.

It could also be passed down through multiple siblings and possibly generations. And possibly the creation of it was itself a pasttime.

They have an incentive to maintain a perception that it is at least as safe with them as any of their competitors. That isn't quite the same thing as having an incentive to protect your privacy.

> least if the individual isn't covered by binding arbitration

But binding arbitration is pretty standard in terms of service.

That doesn't really solve the problem. I've gotten PRs that do do an adequate job of explaining why why something should be implemented. Then I look at the code and it doesn't fully solve the problem, or it does so in a way that will obviously break something else.