jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
> It seems pretty well established that making secure software is impossible. Time to pivot to designing software systems that are tolerant of inevitable security breaches.

There are variations on this theme. An under studied and under used approach is extreme compartmentalization, where components are e.g. isolated in processes with only one simple input and one simple output allowed: for a codec for example, the only thing you can do if the codec code has a security bug and if you manage to control the stream and are able to inject a malicious one, is to change the output; which is not very useful given you could always change the output to whatever you want if you have arbitrary control on the input stream... Well at some point you may want to avoid CPU hogging too, and limit max memory allocation if that primitive is available, but having that kind of limits can be systematized in such an architecture.

So this variation makes the hypothesis that the codec can fail, but that the container is reliable. And there is no sound security architecture anymore if the container is not secure (or let's say not simple enough to be rated secure with high confidence). So you will always have to put some root(s) of trust in your system. Although you can get some benefits from mere mitigations, and sometimes they are more realistic esp. if you try to encapsulate legacy software, and we know a lot of SW activity is management of legacy software. But that's quite weak compared to a real security architecture, where it is reasonable to strongly trust the trusted components because they are simple enough, and where hard security properties are logically derived from those reasonable hypotheses.

Now you may want to imagine russian dolls of containers with decreasing restrictions (and then even more complex network of components), but if you dig it is likely to rely on the same techs as your extremely restricted component, and when not the case you only have very few tech-distinct layers (let's say process, then VM), so breaking out of extremely isolated ones would likely be the most problematic cases anyway. => you really can't do sound designs without some trusted components (or in a network: computers -- etc.) Of course you can add random mitigations everywhere on top of that, esp. if you are sure they won't decrease the security.

TLDR: mere mitigations are not a security architecture, and you won't necessarily be able to stack tons of them to be sure to resist in case just one fail. Some highly reliable components are still a must if you want confidence in the resulting system. Evidence: see the complex JS->browser->OS->VM escape chains in capture the flag or even real world attacks.
Not on HN. Pretty much any thread about school has people strongly claim about how covid shown that school is just babysitting and most def hellhole.

I am not encountering that sentiment outside of HN. Then again, HN is has also unusually strong sub-community of homeschoolers.
> Thats the best defense for Btc you have?

it is the most obvious use case that is superior to everything currently in use.

> The only people consistently using BTC as currency are drug dealers or drug buyers.

no. but even if true, does that make it less of a currency?
My phone may be able to handle running a thousand messaging apps at once, but my brain can handle at most one or two before it melts from the sheer ridiculousness of having to deal with the different user interfaces, privacy policies, compatibility issues, etc. of a zillion companies just for something so bizarrely simple as sending a message to a friend.
I would imagine that NASA is extremely worried about that, and has gone to great lengths to ensure it's not an outcome.

Why do you assume that nobody has worried about this, or considered this contingency?
While you are correct that "income taxes do not stop people from trying to better themselves financially", an important nuance is that it also massively incentivizes how they try to better themselves financially. This is evident globally and often has unintended consequences.

Generally speaking, you want to incentivize people to try to better themselves financially by pursuing highly productive and legal activity. If the best way to better yourself financially is rent-seeking, becoming a government bureaucrat, corruption, or participating in the gray/black market, that is what you will get.
> The fact that hedge fund managers live from the fees tells what they really think about their skills. Never gamble using your own money.

Most hedge funds don't gamble, but some do have poor risk management (e.g. Melvin Capital).

The proposition of a hedge fund is actually very compelling to institutional money: range-bound returns in any type of market environment. This proposition bodes very well for say major pension funds that want to avoid market risk while also modeling out return + pension liabilities at an assumed rate of return.
- Printing from Chromebooks

- Printing easily from Linux

- Printing from your phone

- etc.
What makes you think it's being killed because it's expensive?
But we have mortgages...
Show mercy
> No more "hmm, this looks interesting" as I'm wasting my time walking up and down aisles specifically designed to make me spend more.

When it comes to fresh produce, though, this is exactly how I shop. We've gotten accustomed to buying things in any season and then wonder why strawberries look beautiful but taste like a cucumber. It's not until I'm at the store that I remember what fruits and vegetables are in season.

So then I buy what's in season, seems tasty and what I think I can use for the week. If it turns out I over-bought, I find out during mid-week assessment of the fridge, and repackage certain things for the freezer, prioritizing what's best fresh.

And this becomes a fun time to experiment with cooking. I have A, B, C, which were all bought with the intent to be seperate dishes. Can they be combined in a novel way? Then you're no longer following recipes, you're having fun, making new things and get to enjoy the result.

For example, that's how I found out that dumping a handful of garlic cloves in chicken thighs slow-cooked in olive oil produces a nice sweatness. Another day I tried the same but pressure-cooked due to time constraints and while the chicken was ok, the garlic didn't produce that amazing sweetness.
We started a private beta for our app, posted about it on social media and submitted it to sites like betalist.com
What's wrong with tapping the wisdom of the rank and file?
Why bottleneck 10K+ smart creative people by a few power-hoarding learders?

That's usually regarded as the great "bazaar" / "free market" style of getting the best ideas out of the community.

The failure is in not well supporting the good ideas that come up.
> but they are a tiny fraction of total ads

Prove it. Factual ads are far more likely to be the largest fraction purely because they're simpler and cheaper to make.
The main reason I used Cloud Print was the ability to print remotely and securely to my home printer without having to worry much about the security implication. I don't really need it that much I guess..
Landing page?
What I find interesting is that the median scores are so low for most of the sites - none of the top ten sites has a median above 2, and there are only six sites with a median above 2 in the whole list. Not that I am sure what it says, but in the context of recent discussion about improving HN using reverse karma for submissions and similar ideas it seems to indicate the degree to which acquiring points is somewhat based on luck of the draw - i.e. there have been about 5000 crappy TechCrunch stories posted to HN which could not get more than two points even though a story gets additional points each time it is submitted.
Maybe we are talking about different things but I don't think the basic income proposal goes as far as calling for abolition of police, defence, diplomacy, regulators and consumer protection, state sponsored science ...
Perhaps: Freedom to choose preferred development platform/tools/etc.

You asked why people were downvoting. I suspect 19/20 have a lot to do with it.
To hear Brendan Eich tell it, Microsoft's mindset went beyond simply "We have a monopoly so we can do whatever we want." It was a conscious "The web isn't the future" attitude. From the JavaScript Jabber podcast:

"After IE6 they took the team down to a skeleton crew and they stopped fixing bugs. They had horrendous security bugs and page layout bugs and DOM bugs and networking bugs. And they just said, 'Ah, the web is over. We’re going to do Windows presentation foundation,' which became Silverlight. 'We're going to do .NET. The web, that was a passing fad, sort of like television.' So…"

Now whether or not Eich is the absolute authority or not on this, I can't say, but he certainly interacted with them enough to have a deeper perspective than the average, frustrated dev in 00's.

(Source: http://devchat.tv/js-jabber/124-jsj-the-origin-of-javascript...)
Cameras are the universal sensor.
It's okay, today is Opposite Day.
Perhaps they did not account for a potential Streissand Effect
The comment I was responding to wasn't about racism. It was a general claim about all issues.
Unless the question was answered in the first sentence ('Yes!' being one of the few single word sentences possible in English). In this perspective, the second sentence gives extra information instead of 'intentionally misleading'.
Awesome project, and a great README!
How does it handle NATs?
And, if I understand correctly, the receiver needs to enter `pcp receive` within 5 mins from the sender initiating the send? Seems a bit unergonomic. Anyway, why do you think that kind of "sharding" is necessary?
afd4b44db6063e8a1286f9595c42822a
NoSQL with a GUI!!!1!1!!
>I'm still confused, is it a single multiprocessor machine

I would love to watch that thing boot, haha. SO many penguins!
7ae291850de6795268e019ee3e63c31a
c1b1221342788225c1b60cd5d03a01a5
> ... you can just completely ignore the security of your web service

Be weary of such absolute statements -- especially when it comes to security.
Those are good questions and I'd be happy to discuss them, but you seem to be under the impression that HN didn't use to be intensively moderated. That model is wrong. HN was always intensively moderated, curated, or whatever one calls it. That's the only reason why you are able to write something like this:

The fear that this would cause a topic to "dominate the site" has been proven false numerous times.

That didn't prove itself false, nor did the community make it false; it was PG who made it false. He poured countless hours into managing the site and countless more into writing code to help manage it.

That model hasn't changed. It's more transparent now, because users asked for it to be. Transparency has the side-effect of making it seem to some people like we've fundamentally altered HN when it doesn't work like they assumed it did.
It’s such a small, non-flashy language feature, that honestly matters much more than almost everything else.
which is highly dangerous to the general stability of society.
When economic policy results in massive finanicial instability for the common worker (thanks to hyperinflation and insane asset prices) it creates a power vacuum which can be filled by those promising to fix the problem quickly and swiftly.
Yes, Julia really lets one get wild with Unicode. There are certain classes of unicode characters that we have marked as invalid for identifiers, some which are used for infix operators, and some which count as modifiers on previously typed characters which is useful for creating new infix operators, e.g. one might define

julia> +²(x, y) = x^2 + y^2
+² (generic function with 1 method)

such that

julia> -2 +² 3
13

If someone doesn't know how to type this, they can just hit the `?` button to open help mode in the repl and then paste it:

help?> +²
"+²" can be typed by +\^2<tab>

search: +²

No documentation found.

+² is a Function.

# 1 method for generic function "+²":
[1] +²(x, y) in Main at REPL[65]:1

Note how it says

"+²" can be typed by +\^2<tab>

Generally speaking we don't have a ton of strict rules on unicode, but it's a community convention that if you have a public facing API that uses unicode, you should provide an alternative unicode-free API. This works pretty well for us, and I think can be quite useful for some mathematical code if you don't overdo it (the above example was not an example of 'responsible' use).

I know we have a code formatter, but it doesn't do any unicode normalization. We generally just accept unicode as a first class citizen in code. This tends to cause some programmers to 'clutch their pearls' and act horrified, but in practice it works well. Maybe just because we have a cohesive community though
Better find a way to add the C In "GMAFIA".
Looks like that what Tcl means by 'string', the author names 'text' ?

What does Tcl mean by 'character' ?

See for instance, the author's HTML example :

> Combining characters can create an accented version of that symbol, <̧. In text this is clearly a different symbol: it’s a distinct grapheme cluster. The HTML parser doesn’t care about that. It sees code #60 followed by #807 (combining cedilla). It thus sees the opening of an element. However, since it isn’t followed by a valid naming character most parsers just ignore this element (I’m not positive that is correct to do). This is not the case with an accented quote, like "̧. Here the parsers (at least the browsers I tested), let the quote end an attribute and then have a garbage character lying around.

https://mortoray.com/2014/03/17/strings-and-text-are-not-the...

EDIT: Ok, it looks like by 'character', Tcl means what the author (and Unicode ?) calls a 'grapheme cluster' ?

https://wiki.tcl-lang.org/page/Characters%2C+glyphs%2C+code%...

https://mortoray.com/2016/04/28/what-is-the-length-of-a-stri...
What will happen first:

A) Traditional automakers becoming good at making great EVs

or

B) Tesla matching the quality standards of traditional automakers.

The traditional automakers are quickly learning how to make great EVs. Tesla may get away with substandard quality for now, but they won't get away with it a decade from now when ever automaker is producing decent EVs. I hope Tesla improves fast.
> Perhaps there is not a good understanding about the differences in the legal ramifications of a vehicle failing and resulting in property damage or loss of life from the failure of something considered a 'wear' item versus something that is not classified as a wear item.

This was my first thought as well. It feels like they were trying to avoid some implication beyond mere replacement of storage modules. Perhaps they are aware of some other component that will also fail at a high rate before the useful life of the vehicle?
Attach it with legal force and money, as in allow users to sue for violations, and explicitly permit class actions with the definition of class (all people similarly situated; definition frequently abused by defendants) to be anyone with a browser.

Needs more work,, but the concept is that it needs to incentivize developers to develop track-the-tracker technologies that will catch violators, which then leads fairly directly to a profitable private suit (instead of relying on the overworked govt bureaus to do it).
The things that have seen large price increases are things that aren't scalable i.e. they still require the same amount of human input labor to produce

Childcare is constrained by the fact that each childcare worker by law (for better or worse) can only look after so many children at once. This ratio varies by state but it's usually around 4 children per childcare worker. The result is that it has to be expensive because (short of having robot caretakers) it always takes 1/4 of a person's labor.

Education is similar, but has gotten worse in the past few decades w.r.t. labor requirements. While class sizes have remained relatively constant, there are more administrators, special needs educators, counselors, etc. servicing the same group of students.

This isn't to say they shouldn't be regulated, or that there isn't room for improvement. College tuition and textbooks could certainly use some downward pressure.
Rust has an annotation to mark that an enum is non-exhaustive[1], and a mechanism for declaring an enum as being laid out in a manner compatible with C[2]. I've not tried using them together :).

In general, it _is_ possible for any C data layout to be represented in Rust -- but it's not necessarily the case that the representation has the same name. And it's also not the case that we can safely pass memory from C to Rust without validating the content, even if the representation is equivalent for all valid values.

[1] https://blog.rust-lang.org/2019/12/19/Rust-1.40.0.html#non_e...

[2] https://rust-lang.github.io/unsafe-code-guidelines/layout/en...
The way I read this, they are achieving savings by virtually mux-ing (or de-muxing depending on viewpoint) much of everything that's not the CPU. Is this optimized to make the support of virtual servers with relatively low throughput more efficient?
I think any other solution (for example, auto reconfiguring smart scripts based on html changes), would quickly become so complex that it would become far more time consuming to maintain than simply going and tweaking the individual javascript when an html change actually does occur.
Both of my parents have had cancer, but neither were the rare types seemingly caused by CHS (melanoma and kidney cancer). Certainly worth keeping an eye on, though.
Thanks, this is exactly what I was looking to confirm!
This is a fascinating topic, some of the comments are interesting too. I wonder whether some folks who knowingly or unknowingly use this technique to their advantage are the ones recently insisting the end to WFH and a return to the office? It's possible they're not given a chance to unleash their alter ego at home while the family members are around?
Crypto miners don't need to escape a sandbox
Yeah I am not a huge fan of the compiler code in SML for the ones I've looked at (though I haven't looked at them all). Often it's just one author so they often omit types on nested functions (since they're optional for the compiler) so they're nearly impossible for me to read without spending a huge amount of time on it.

Going off on a tangent, I think every language should require function parameters and return types to be explicitly typed. If that gets rid of the bulk of HM type inference that's cool. The only value to me of type inference is at the local variable level. Function type inference makes code impossible to read.
Who knows? It might be a quick-recap-so-we're-all-on-the-same-page before the appointment with St Peter and his scales for all we can determine.
This is unbelievable. Some of the sensitive information like phone numbers are censored by drawing a box on top, rather than replacing certain digits by * or something else.

Reader can get the digits by simply copying them underneath.

How can someone miss this?
It's in Allergan's filings on the FDA web site (warning: they ahve a lot of products). Figure out when it was introduced, start around then and work backwards.

Back when I learned about htis the boy would have been about 14 years old which was even funnier.
This is the absolutely worst way to go: they are essentially telling nature to take its course, killing what it has to kill. We might as well stop vaccinating people and stop taking any drugs - the 10 people left alive will surely have herd immunity.
> So you are saying a person trained on the use of a ventilator can only support a little over 2 patients on a ventilator?

As I mentioned in the comment you replied to, the numbers are from the SCCM. You aren't going to find a more authoritative source for accurate information.

> I would think, especially in a crisis situation, a single medical professional could probably handle a few dozen people on ventilators if they had too

If you don't believe the SCCM, California law and the California Respiratory Care Board set the requirement as "a ratio of 1:4 or fewer each shift."

Short of a Cardiopulmonary Bypass Machine (basically a mechanical heart), invasive ventilation is one of the most intensive "intensive care" treatments, requiring constant monitoring and adjustment.
PICO8 might suit your needs if it is a simple game where the focus is on teaching.
> Please consider purchasing things from other stores, where available. Even if you have to pay for the shipping cost.

You haven't given a reason for doing so.
Youtube just doesn't work for me 90% of the time. Guessing its my addons but when it does work I never see ads.
Edge is nothing compared to defender ATP telemetry. For those with it, they also know every site you go to (outside of edge),every program you open,every file you interact with and much more.

They do a lot with it froma security perspective but I reckon they have plenty other uses for it as well.
> how little value the U.S. as a society puts on future educated citizens

It is much easier to import highly educated professionals from abroad.
This being fair use or not is debatable (and hence the legality, which you find shockingly straightforward).

The big deal is that 'culture' and 'fandom' are wired in mysterious and awkward ways to 'property'. If it was a consensus between distribution companies that audiences wait for a fandom code of conduct, we wouldn't have fans of anything, and more devastatingly to the tech bubble, we wouldn't have Tumblr.
What happens if something hits the cable and it breaks? Does the whole thing drift off into space?
I want no sympathy personally, and I really don't like the "hero" talk. Nobody I ever met in the infantry was oblivious to what they were getting themselves into. Especially not in the airborne. I mean really, they throw you out of airplanes with parachutes made by the lowest bidder. Everyone laughs about dying to cover the fear.

When you sign up they are very clear that the term of your enlistment is 8 years whether or not you serve 4 or 5 active. They can call you up anytime in that 8 years. It sucks but again it's not a violation of trust. Still being stop lossed to go back is hugely terrifying for guys ready to transition back to civilian life.

Some guys out there really need help. Fallujah and the Korengal were meat grinders. I haven't met a single guy who was boots on the ground there that isn't seriously messed up from it. We owe it to them to get the care they need but the VA is an absolute crime.
The smaller the company, the easier it is to grow faster. Apple is 50x larger, if not more.
Interesting. Would you mind sharing some information regarding your hardware and performance (ghash/s)? Does your estimate include amortization of hardware cost, electricity consumption? Because the general consensus is that BTC generation is not cost-effective unless:

a) One does not pay for resources consumed.
b) Speculates about future value of BTC.

Regardless, very impressive. I would love to hear more!
Here's my 2 cents (I'm a rails developer).

The rails command exhibits 2 qualities which I value greatly, good encapsulation and a high signal to noise ratio. When I create a new project that is exactly what I'm concerned with, I have no interest in _how_ this happens. The fact that the django command is twice as long to describe the same thing to me implies redundancy and from more of a philosophical than perhaps practical point of view, waste.
MS should probably be more concerned about Android given the low price points of Android devices. Can Microsoft develop a hardware product that a tablet maker couldn't instantly turn into an Android device? Given the choice, will the average consumer want or need anything in the Windows world anymore? Can Windows match the performance and battery life of the more mobile/instant-on optimized Android OS?

It's never been so easy to imagine a world without Windows (at least on the consumer side).