jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
In fairness, the other part of the killer reputation has to do with apparent design instabilities as a result of the V-tail on the x35 models. Both these and the x36 models really are beautiful planes.

Another airplane with the killer epithet because of its on average high power to wisdom of pilot ratio is the Piper Malibu and its later brother the Mirage. Again, a beautiful, fast, well-designed plane that gets out in front of you if you let it.

Growing up, my father flew thousands of hours in both of these planes with me in the right seat, and he was always careful to warn me about having respect for the plane's power lest it get away from you. In a way, I think he was reminding himself as much as me.
Could you explain the joke for non-Americans?
Couldn't agree more.

Anything that deviates from usual usage patterns can be relatively easily detected and negative impact mitigated.

But nowerdays botnets are the real threat with every 13 year old kid being able to get hundreds of machines infected with ease which is enough to pose a real threat to most websites when they launch absolutely valid HTTP requests.
Botnet sizes of tens of thousands of zombies are not uncommon.

It is a tough problem and the reason why DDoS attacks are so effective and therefor popular. They work.
When your site gets beyond a certain size, chances are you don't even have accesslogs for performance reasons because you get dozens of thousands of requests per second.
So finding the malicious requests and singling them out from the rest to be able to filter them is hard to say the least.
Plus every false positive could really hurt. Imagine you accidently filter some check-out requests in some online shop - that's a lost sale.

Attacks like the one outlined in the "paper" (it's really more a bunch of slides) can be easily defended against. They are not new just because someone alters the request method from GET to POST and wants to sell it as dangerous just to grab some fame.
The fact that they suggest a change in the protocol would be needed just reinforces my suspicion.
Announcing a flaw in a hugely popular protocol like HTTP gets you a sh*tload of attantion and in the end jobs.

I know a few people working for companies in the web-security field, some also member of OWASP. Exagerations are very very common. The more fear a customer has the more protections you can sell them.
Yeah, at times I like to think so but I've had so many humbling experiences that I'd wait a little longer before making that declaration.

I had once worked with a senior colleague who would run process traces on the live Oracle database and uncover bugs in Oracle's code. I am at the level where I can find bugs in open source code bases about which I've no idea but not where I can find bugs only with the binary.

Then again, I see so many comments on HN about which I've no idea and which still seem relevant to what I do.

So, you see where I am right now.
Hey Sithu, my name is Dylan. I work at Accuvant, a security firm like Matasano. We work with a lot of the top tech companies and Fortune 500.

I sent you an email, and I'd be happy to answer any of your questions or help you out (no charge). Down the line, if you decide you'd like to explore a security audit, we can help with that too.

For now, I'll answer your questions:

1. I wrote a basic checklist for startups looking to improve their security. You can find it here: http://breakingbits.net/2015/02/28/security-for-startups/. It's not comprehensive, but I tried to cover the most common issues I saw with startups. Ryan McGeehan also wrote a wonderful checklist for incident response after something does happen. They're two sides of the same coin - preparation and damage control. Check that out here: https://medium.com/@magoo/security-breach-101-b0f7897c027c. Your specific company will have more to do for each of these based on the context of your team, product and size.

2. It's difficult to give a good estimate of cost, and I'm not trying to be a salesman here. It depends on length and scope of work. Are we doing code review or just blackbox testing? Five days or 10? The entire application attach surface or just a few critical pieces of functionality? Budget about $10,000 for a white label pen test lasting a week, but it could be more or less. I'm summoning 'tptacek here in the hopes he might have more nuance to contribute to this answer.

3. How and when to begin a bug bounty program is similarly variable. I have a lot of experience working with Series A companies, and bug bounties are a personal specialty of mine (I have research directly on the subject). In my opinion, you should not have bug bounties until you have at least one full time security engineer. You don't want to pay out a bounty for someone reporting that your cookies lack an HttpOnly flag. On the other hand, server-side request forgery usually warrants a payment. If you have developers who could tell you the difference in those two in terms of both definition and severity without looking it up, you're okay to have a bug bounty. If not, don't pay people for their reports just yet. (This is personal philosophy from my experience - many people will have different opinions).

On the other hand, always have a responsible disclosure program. It is perfectly okay to not reward people for reporting security vulnerabilities. I'll repeat this: it is perfectly reasonable to not give out payments for reports. Don't let financial rewards enter the program until you have reached a certain level of internal security maturity.

And no, there is no standard way to determine severity and payments. Google and Facebook pay a lot for bugs that some companies wouldn't even accept. It totally depends. That said, as a general guideline, if a reported bug 1. is valid, 2. compromises users, it's worth something.

Like I said, I sent you an email. Let me know if you have any questions, I'd be happy to help you with anything you need to know.
I don't know about that.

Bloat bothers me, but it has benefits too.

Why is C++ so successful? Because it contains a lot of features. Ask random C++ developers what their favorite feature of C++ is and you will get a very wide spectrum of answers.

I see Java libraries a bit like this: they are not liked because of the number of features they have but because I definitely need some of these features, and as long as I can use them without having to understand the rest of the library, I'm good.

Guava is a very good example of this: an assortment of convenience functions from a very wide range of domains that you can use without ever having to read or understand the entire Guava documentation.

Having small libraries is pretty much a guarantee for subtle bugs because the author went for the 80%/20% approach and then moved on to the next project. Joda is a good example of that: time libraries are extremely difficult to get right, and yet getting them right is absolutely critical. I will gladly pay the price of including the entire Joda library in my application even if I use 10% of it just for the certainty that it's battle tested, something I very much doubt the collection of libraries presented here does.
Congratulations you have re-invented slums!
That already happened a decade ago: https://www.wired.com/2010/09/google-spy/
The French ID cards are still the old format, it doesn't fit into a small wallet. So I almost never take it around.
Counterpoint: They let him use FB and Twitter for his perpetual disinformation campaigns and continue to let seditionist groups organize on their platforms. The recent bans amount to nothing after giving him platform pretty much the entire duration of his term.
The state of Rondônia is highlighted in the article. Makes sense, as it has been almost fully and industrially deforested in the last 20 years. Open up Google Earth and slide it back in time. You'll see deforestation leaving scars on an enormous scale, with obvious corruption of the state government.
Opinions from Twitter and mailinglists are not "news".

Please let people have their opinions, so don't try to overexpose them!
It's really the transliterated words that are problems. Though, I find when I read novels and multiple words might might there's a tendency to add the vowels under a single letter.

Which reminds me I need to go to Tzomet...
expenses are predictable, which may lower the stress level, which is the main part of the parent comment. However owners want to make money using the property, so rent is overall higher then the cost of owning the property including roof replacements.

The problem many home buyers face is that it has become normal to go deeply into debt to buy and maintain a house, so it is not like they pay rent into their own house ownership account which slowly accumulates reserves for costly maintenance. A house costs twice as much as its sale price and if one has to go into dept to buy it in the first place, one is not middle class.

Back in Boomer-Days a middle class worker could buy and maintain a house, provide for a family with multiple children, pay for their education and still have money left to go on vacation. Today two working parents can't do the same, instead children go into debt to finance their education and fathers live in their cars in googles parking lot.
A hope that better methods and technologies to reconstruct the past will be available, obviously.
Prism and humans' general lack of caution towards device security and privacy.
If they activated the paywall for Googlebot, they'd get no visitors from Google searches.

If they deactivated the paywall for Googlebot, but activated it for visitors, they'd get banned from Google for expertsexchange behavior.

They must figure that random Google visitors are worth more than the people who are clever enough to Google the article titles they want to read to work past the paywall.
Thinking that through, we can expect post-collision
inspections (by insurance companies or police) to
include a dump of the state of the current code(s) in
a vehicle as well as any available data from
just before a collision - speed profile, braking,
signaling, etc. - which might be used in court to argue liability claims.
Why do you think something like this needs more "features"?

When I'm somewhere other than home and need to know my public IP address for some reason, I just use "icanhazip" [0] (GitHub: [1]) which I've aliased to make it even easier/quicker, e.g.:

$ alias myip
alias myip='curl http://icanhazip.com'
$ myip
192.0.2.42

It doesn't get much simpler than that -- just spit out the IP address in plain-text and, if needed, I'll massage it however I need to.

[0]: http://icanhazip.com/

[1]: https://github.com/major/icanhaz
I like self. It's explicit.
That is a very big difference between house-buying patterns in east Asia in general and house-buying patterns in the United States, and has been for a long time. But that didn't help Japan avoid a housing bust, because if builders build on speculation, their debt drags down the economy even if house-buyers don't have comparable levels of debt. Speculative bubbles always leave someone holding debts that they can't pay off when the bubbles burst.
Why is this news? We've been getting builds of Sublime 3 costantly for way over a year now.
so what you're saying is, the media distorts and amplifies the exceptions in order to create a perception of widespread dysfunction, thereby generating revenues through public outrage?

but this only happens in the US, right? not anywhere else, like... china?
To be fair, speculation of a "new tech bubble" has been rampant since a few years after the dotcom bust, and there hasn't been a major tech-specific crash yet. At some point the guys talking about a bubble will probably eventually become correct, but that doesn't mean they're correct now.
Not sure if you read the whole post, but he's willing to put $100k on the line...
if im not mistaken, whatsapp already monetizes their users, charging $1 / year after the first year.

with 700m active users, they potentially could be generating ~ 3.6% of their sale price in annual revenue.
Maybe tie the the back end into repossession company databases. Have the user turn it on when in parking lots and they get a commission when found. A local repo service is instantly alerted with GPS coordinates whenever there is a hit. The app could even alert them to stop and observe until the repo company gets there.

Certainly not a mass consumer thing, just like most people won't become Uber drivers, but some people would do it and there is potential for making decent money.
I'm pretty sure you didn't read or take seriously his post. He pointed out specific reasons why water wasn't relevant and that the suggested method didn't scale. Please reconsider and edit your post as your tone is far more problematic.
> When I get support emails, I cannot even refund a single paying user, which means I have to send $14.99 back to the user using PayPal and eat Apple's $4.50 fee for that transaction.

Send them over to https://reportaproblem.apple.com - there they can claim a refund.
Guido has been conceiving the idea gradual typing in python and wants to introduce this into python 3.5. I think this will be a great mix of both weak and strong type checking.

https://www.python.org/dev/peps/pep-0484/
http://baypiggies.net/
Who is buying this stock?! A company that burns through a TREMENDOUS amount of cash raises enough for just about a year's worth of operations, meaning that they will almost certainly dilute their stock against next year just to pay for cost of doing business. Their future consists of insisting that they aren't "just online storage", and competing on pricing that is trending towards 0.

I'm not invested in this company one way or another, but it really baffles me that people think the company is worth investing in. I'm sure I'm missing something, since I haven't dug deeply into their financials or anything.
Travelling to or through the USA has long been among the most hostile experiences faced by international travellers. Even places like China it’s a more orderly, mundane kind of formality and, despite significant language and cultural barriers, less alien-feeling than the USA border.

What strikes me as uniquely hostile about the experience going through US customs/border is the border workers themselves. There’s this weird little-man-with-power vibe that I’ve not found at other borders, where there’s usually a kind of shared understanding that we both just have to get through the process and then everyone gets to go on with their day. US border attitude is more like ‘I’m valiantly defending the greatest nation on earth against you, scum’.

I guess all of this rant is to make the point that this development is completely unsurprising, and my long-held habit of avoiding travel via the USA even if it means a much longer duration or higher cost feels further vindicated.
> That falls under corporate PR, and some corporate PR is actually interesting.

I am going to put a question mark next to this dichotomy, and here's why.

This idea that you have "authenticity" vs. "corporate PR" is no longer true.
For sure, there's still what we think of as "corporate PR" (Look at our employees volunteering! Look at the award we won!). But fundamentally, this idea that there are "corporates" and there are "workers" is fast becoming dated. You don't have to be a freelancer or an indie hacker with a SaaS side project to be a company of 1. You, and everyone else in the knowledge-work economy is a company of 1.

The lines between who's "in" (an employee) and who's "out" (unemployed) are really blurred - and will only become more so. Contractors; freelancers; side-projects; these are all manifestations of the same thing.
So when I say "my content" and you say "it's your corporate PR" I think is the wrong way to look at it:
Trust IS personal. Views ARE personal. Heck, employment IS personal.

> Your example seems to be more about you talking about potential client pain points.

No, it really isn't. Anyone who builds stuff, side-projects or otherwise, knows you CAN build all sorts of stuff, but the question is whether you SHOULD. To understand what's worth building, I was - and still am - having a lot of conversations with clients. LinkedIn made it a whole lot easier, of course. the pain points are not "potential", they're real. And because the building is done is tandem with the market, it's hardly a wonder I position the services as a solution to those pain points.

Maybe I got it all wrong but it seems to me this is what Steve Blank was talking about in the "The 4 steps to the epiphany."
Rust enums are not compatible with C, even with `#[repr(C)]`. Values not explicitly present in the enum are not allowed. Casting them to a Rust enum is UB, and it does actually cause miscompilation, because `match` can be a jump table.
I'm using Shotcut https://shotcut.org/ . No idea if it has the best UX or not. Sometimes it's great, sometimes not.

The files are saved as xml, so you can try to generate the file automatically, and let the program later handle all the nasty details of video encodings.

(I edited the xml files for very simple changes that are not possible in the UI, like changing the order of the tracks.)
crab rave.

https://m.youtube.com/watch?v=LDU_Txk06tM
They already do, is what IBM calls cloud JIT on their JVM implementation. :)

https://blog.openj9.org/2020/01/09/free-your-jvm-from-the-ji...

Also the JIT cache that Hotspot now has, the original implementation was part of J/Rockit JVM.
> I think the fact that they have been able to recover all critical data soon and will even update the event table over the next few days clearly displays their competence.

Taking a few days to restore a table indicates they only had a text dump of it. The details of how they screwed up indicate they were new to the idea of data robustness, despite it being the core of their business.

Being a competent home user and being a competent data-robustness company involve slightly different levels of expertise.
I had this idea about 2 months ago and thought quite seriously about it, for the reasons you described.

But there are a lot of issues. How do you confirm to the customer that their booking went through? What if no-one answers? The customer experience just isn't that great.
Just to let you know, the way you worded your entire last paragraph reversed the tone of your post for me. What was informative before became ignorant and vacuous. Is it too much to ask that we keep away from the obvious logical fallacies on HN?
but wtf do you do with these?
> The fact that the govt is permitting an open discussion

We may well be on a slippery slope but I don't recall the government issuing permits for open discussions - yet. Or even a group of people needing said permit to conduct said open discussion.

Although I agree with you about the Israel thing.
https://www.path.com/about

13 listed on their about-page.
Oh yes, oh yes indeed. My quarrel is not so much with invasive searching but rather with blanket invasive searching of all citizens. If according to specific rules and specific guidelines a trained agent and her superior were to determine there was due cause for further screening then so be it.

Abuse can be weeded out and consequent repercussions meted out by simple analytics on reports gathered on every 'enhanced' screening.
I don't know if they use SSDs, but Linode's London servers are absolutely screaming fast.

Linode:
Timing buffered disk reads: 230 MB in 3.01 seconds = 76.44 MB/sec

My local X-25M:
Timing buffered disk reads: 246 MB in 3.02 seconds = 81.48 MB/sec

This would suggest they are using SSDs (or fast RAID? I'm not sure if this benchmark is sequential access). I get comparable performance for the Georgia data center, but it varies greatly there, so I'm not sure what's going on.

EDIT: Sorry, apparently I can't tell my sde from my sda. My actual SSD performance is:

Timing buffered disk reads: 564 MB in 3.01 seconds = 187.47 MB/sec

So yes, disregard everything above.
Yeah. This kind of looks mid-to-late 2000s. As long as the product continues to work, whatever.
K8s is amazing piece of tech, but still there is a big cost and complexity inherent in adopting & managing it.

I enjoy using it and playing with it, but so many use cases can be addressed with something simpler - either just Docker / Swarm / AWS ECS etc. alternatives or just going for VMs with well defined CI/CD processes that let you tear down the infrastructure and set it up again easily.

What very interests me are the concepts K8s build on that are not usually recognized - to me K8s seems a lot like a JVM, just that it operates on infrastructural (and not runtime) level.

I enjoy experimenting with these concepts when applied back in the runtime world - it is for instance interesting to run 100s of servers with JVM and let them load/execute new dependencies and code at runtime (JVM is very well suited for that).

This is area that is not yet explored and would probably deserve more attention as it allows for distributed rapid computing that is infrastructure/platform independent (the downside is that it requires (just) JVM and the isolation is not perfect).
I've never seen a crash, and personally I can attest that the new version is much snappier and more responsive. I don't like every aspect of the UI but it was a worthwhile upgrade IMO.

re: addons, a lot of people were understandably upset about this, myself included for a while. With that said, in the months after release every extension which had been disabled by the upgrade started coming back online as the extension API was slowly added back after the rewrite. I can certainly sympathize with the maintenaince headache of trying to maintain one old decrepit piece of software while simultaneously trying to get the one one out the door, since that's exactly what I've spent the last 4 years of my life doing.
She says in here that she "cared deeply about the product." Honest question, it is better to not care about the product?

As I've grown as a developer, I've become less personally attached to the products I work on. I still care that it's a quality product, and that it's stable, tested, etc. But I don't attach it to my personality or my self-worth. Ultimately what happens to it is out of your control, (assuming it's not a 100% solo project) so it's dangerous to have that attachment. I'm not sure that caring deeply about a project actually improves it in a meaningful way.

Also, this is a nice post. Sharing real stories about burnout and helping others understand it is great.
Not bad financials. Healthy margins, relatively small (in my mind) losses and revenue growing well. At this rate they should be profitable in a year? 2 maybe?
You can see them through archive.org:
https://web.archive.org/web/20200731211652/https://twitter.c...
https://web.archive.org/web/20200731235001/https://twitter.c...
https://web.archive.org/web/20200801025736/https://twitter.c...
I was actually thinking about XEP-0136: http://xmpp.org/extensions/xep-0136.html . I was completely unaware of XEP-0313, thanks for the info!
How would we as consumers reward them for such altruism?

Even Apple can't invent everything they need themselves. They would benefit from a patent-free ecosystem by being able to adopt other manufacturers' advances, just as the other manufacturers would benefit from being able to adopt Lightning.

It's impossible to prove that patents are a net win for anyone but patent lawyers.
look like a joke to me
I can see wanting to edit across multiple devices, sure, but that doesn't require an online editor, just an online location for files--something like Dropbox, or if you're concerned about keeping your data really private, a server that you control access to and can use to sync files. Then you can still use the most effective editor for each individual device, instead of being stuck inside the online editor's lowest common denominator.