skysight-inc/HackerNews huggingface dataset:
From reading the article, I see three aspects:

* Koseki as a data structure: It seems to be an event-log from which you can get an official certificate (extract) relfecting the current state. This is better than a systems where you work with loose records of the events themselves. Other countries should do the same thing.

* Koseki as a rigid record of official categories: Soft cultural issues are important here. Koseki happens to force people to change their name upon marriage, but makes official gender-change easy. The Japanese shrug at both aspects.

But English-speaking polities would not shrug, because they have an expectation that legal categories reflect these personal preferences [1]. This is a cultural thing that no data structure will fix.

* Koseki as an alternative to the courts: As long as people will get upset about the categories, and as long as people are allowed to have their legal say, these things will end up in court.

[1] For example, in the UK a "civil partnership" was a marriage-by-another-name arrangment for gay couples (before full marriage was extended to them in 2013). This resulted in complaints from heterosexual couples who wanted to get civil partnerships too.
'Invisible' Solar Panels Camouflaged as Wood, Clay, Stone and Concrete
The bottom line is that whether something is "over-engineered" or not can mostly only be confirmed in hindsight.

With experience and instinct, some people are successful more often than not in predicting what level of engineering is sufficient, and they go on to become great engineers and leaders. But I am not wholly sure if this is more skill or more luck, though I am sure there is some skill.

With software, it is especially hard. Especially as you go deeper and deeper into the components. At the UI level, it might seem easy to say what is the amount of flexibility you need. When designing a common utility or infrastructure piece to be used by everyone in a large company, it is much less obvious. But I think the hardest layer is the mid-tier, which has to deal with the backend and the frontend, and support all kinds of changes and pluggability.
Is there a natural limit to this? If you built a reusable rocket to hold a million people, would it be essentially free?
More the opposite, because it's too centralized, an attack can take out the few 'authority' servers and knock off everything downstream.
Prenda lawyers’ careers are up in smoke, but sanctions keep coming
Skiplit – simple yet impossible puzzle game for iOS made using Apple's SpriteKit
It created fewer new jobs for the people who already live there, which presumably resulted in lower wages on average. Supply + demand and all.
They stayed up all day, they just blocked rendering until they loaded some twitter assets, causing it to take 20-30 seconds to load until those assets timed out.
Perhaps that's one of the advantages of using a really big ship; you can put more shielding / water tanks between the sun and the passengers.

If it's a major problem, they might just orient the ship in a direction that gives the best radiation protection to the passengers and just leave it like that for most of the trip.
In the Expanse series they solved Ceres' gravitation issue by speeding up rotation and walking on "the being" of their tunnels.
What does "CNC" stand for in this context?
Clinton health care plan of 1993
Table Pong: DIY Console Brings Atari Classic to Life in 3D
Analog recordings aren't enough to protect from a different technique: Electrical network frequency analysis

[1] http://www.bbc.com/news/science-environment-20629671

[2] https://en.wikipedia.org/wiki/Electrical_network_frequency_a...
`curl | sh` isn't used as an alternative to package managers, it's used as an alternative to "download this script and run it".
It would fail because all the male programmers are already at the almost-all-male programmer social group.
Digital Marketing Company Services
Sounds like the concept for a great sci-fi novel.
> The only thing I can think of that Rust has that Go doesn't is, like, SIMD, and I'm sure your comment wasn't just referring to SIMD.

Just to clarify, are you referring to Rust using SIMD by way of LLVM, or by way of being able to use SIMD primitives / intrinsics directly in Rust code?

The former works much better than I had anticipated. I've been surprised by the extent that my iterator code ends up vectorized without me doing much work.

The latter does not give me warm Rust feelings today. There's a SIMD crate, but it doesn't look maintained and only works with the nightly compiler releases. I didn't think there was any stable way to do inline assembly, so I think linking C is my best bet here?
Does it matter? The purpose of these guidelines IMO is to improve the standards of EdTech products and perhaps the value they create for education as a whole.
Surely Ceres would just fling itself apart?
C++ at this point can only be principally improved by drastically reducing the language, and that will never happen. Ever.
They also make lots of terrible, bog-standard, 20 EUR rubber-dome keyboards too -- but maybe those are not seen outside of Germany.
I've always wondered why there haven't been any efforts to generate artificial gravity via spinning spacecraft ala 2001.

Have there ever been any serious plans or proposals to do that?
Is there anything that the Maduro government could do that would make you say, "I wish a right wing coup like the one that happened in Chile had happened instead"?

There are, after all, a lot of communist revolutions that turned into complete bloodbaths once the ruling party consolidated its power.
> There is no need to have API documentation open in a separate browser window or wade through the source code in order to find out how to use a function.

Only true if function names and signatures tell you everything you need to know about how it behaves.
> Other countries should do the same thing.

Where other countries means "US", where everybody is paranoid and doesn't want government to have any kind of database on people.

In Ukraine we have this level of crazy people who refuse to obtain personal tax number citing religious beliefs (something-something chipization, devil numbers) that for some reason are promoted by Moscow Church, but not by local one.
This thing's strategy for finding machines to take over is so simple it's embarrassing. It tries to open an unencrypted Telnet connection to random IP addresses. If it gets a response, it tries the following username/password combinations:

root xc3511
root vizxv
root admin
admin admin
root 888888
root xmhdipc
root default
root juantech
root 123456
root 54321
support support
root (none)
admin password
root root
root 12345
user user
admin (none)
root pass
admin admin1234
root 1111
admin smcadmin
admin 1111
root 666666
root password
root 1234
root klv123
Administrator admin
service service
supervisor supervisor
guest guest
guest 12345
guest 12345
admin1 password
administrator 1234
666666 666666
888888 888888
ubnt ubnt
root klv1234
root Zte521
root hi3518
root jvbzd
root anko
root zlxx.
root 7ujMko0vizxv
root 7ujMko0admin
root system
root ikwb
root dreambox
root user
root realtek
root 00000000
admin 1111111
admin 1234
admin 12345
admin 54321
admin 123456
admin 7ujMko0admin
admin 1234
admin pass
admin meinsm
tech tech
mother fucker

That's it.

Deploying millions of devices with fixed passwords that dumb is clear evidence of gross negligence on the part of IoT device manufacturers. If this gets to court, some lawyer is going to enter that list as evidence and read it to a jury.

"That's the kind of combination an idiot would have on his luggage!" - Spaceballs
I would argue that it's more skill, but not engineering skill.

It is more a social skill; being able to read the work environment the software will exist inside, and predict the likely ebb and flow of development requirements. To have enough experience with the people involved to know how much flex a given system will have to undergo, over time.
Check your Gmail from Linux desktop using this app
Would HN users have known asbestos was bad for us?
I'm curious:

I'm sure you've all read about the speculation regarding the potential carcinogeny of the radio waves emitted (and received?) by mobile phones.

I assume we're right, that mobile phones are harmless.

But suppose they are harmful, would we know?

How would we know that we would know? If, for example, we are able to say, without the benefit of hindsight, that we would have known asbestos were harmful, or any other substance that was found to have been harmful after decades of usage, then we might have a basis to argue that maybe we would know about phones.

So, would we have known about the harmful effects of asbestos? Would HN have been a pocket of protest and warning about asbestos, or would we have been oblivious about it?

If we would have been oblivious about it, how do we know we're not now similarly oblivious about mobile phones? (No, I'm not saying they are harmful. Either they aren't harmful, or I'm oblivious to the fact that they are if at all they are).

How highly do we rate our ability to be correct?
Why am I not surprised? The only way you couldn't know about the Podesta emails is if you really, really, really didn't want to know.
So this was dumped 20 days ago, and now we've got a fairly large outage taking place.

In other words, it could have been anyone?
Long life to Cherry. The world need more Mechanical Keyboards!
People who pipe it to a shell aren't going to look at it anyway. That's kind of the point. If they were, they'd download it first. There is literally no security gained by downloading it and running it, instead of just `curl|sh`. IF it's malicious, you just installed it either way. The only thing downloading does in this scenario is lets you look at the script later on when you realize it might have been malicious, but that's even assuming you kept it (I would wager that almost everybody would throw away the script after installing it if they weren't planning on reading it before installation), and assuming you know enough to understand its contents (not everybody knows bash scripting, and you can write some surprisingly complex scripts).
Yes, this is a great point! I was a bit sloppy in my wording above.
I tend to associate the term "over engineering" as a positive term..

One can't lump safety in with poor engineering.

seems to me the article is talking about something akin to "wrong engineering"
If the IP address isn't spoofed, you can block by IP at intermediate points, firewall, attack the attacker, or get the responsible ISP to turn the connection off. Random IPs are a much bigger headache.

As for the ingress/egress thing, the RFC calls it ingress filtering. Not worth arguing over.
Check and see if the Mirai code has default credentials for it, and if so, try logging in with them.
I've never heard of a "tree swing" before, or any swing named after the thing it's hanging from.

I would call the thing in the last panel a "tire swing." (Native English speaker, FWIW.)
From the ISP perspective, it is ingress filtering -- he's saying they should be filtering their customer's traffic as it enters their network, such as leaving customer's cable modem and entering the CMTS.
Sorry I meant the "Windows 10 is the last version of Windows" marketing. The anniversary update was a whole new version of Windows and not just part of continuous stream of updates.
But it also requires you to have some way to actually validate that the signature is valid. Apple provides this service to registered Apple developers, so you can code-sign your independently-distributed app or installer and the certificate you sign with is generated and signed by Apple. But in nearly all cases of code signing I've seen outside the Apple developer ecosystem, it's GPG signatures, which relies on you being able to independently verify that the signing key is valid and belongs to the vendor and was not compromised. Which is to say, not very many people who download stuff outside of a package system are actually going to validate that sort of thing.
Or Note 7 phones burning, obviously
Well, there's only so many people you can fit onto a rocket of a particular size. And eventually increasing rocket size gives you diminishing returns, so there's an upper limit. Once you've used a rocket a few hundred times, though, most of your costs become things like fuel and oxygen, pad maintenance, and rocket refurbishment.
Paywall alert.
https://raw.githubusercontent.com/0x27/linux.mirai/master/po...

This explains how it's used, etc.
Misdirection? Maybe that is what we are meant to think.
It would be interesting to try using App Engine to simply proxy traffic. I don't know enough about it to even know if it's technically feasible. I imagine the downsides would be many but it could be useful as a temporary measure while you're getting attacked.
Had a similar culture clash when I moved from Sweden to the US, and some part of the process required a marriage license.

Marriage license... No, we don't have those, and we don't have birth certificates either.

But what you can get is a print-out from the government registry, complete with a signature from some clerk (important!) and a stamp (super important!), except it's all hilariously rudimentary, it looks like a print-out of an ascii text file, super basic, no care for formatting or line breaks to make it pretty or official-looking. The stamp is just the really basic logo of the Swedish Tax Authority, and some bored guy who did the print-out and stamped it, scribbled his or her initials next to the stamp.

It's a perfectly legal document of course, but it just reeks of "oh god, do we really have to deal with these uncivilized barbarians that want stuff on paper?"

The second culture clash was signing up for various services and having to give out my name and address, and getting my first electric bill with my name spelled wrong.

(In Sweden, you would just give whatever company your personal identification number, and then they can pull your name and official address. There's even a push service built into the system, so if I change my official address, most companies' computer systems would get the change, and just update my address automatically)
>Sure, the federal government could set something up, but I think the tricky part is getting all the individual states to adopt the system.

It doesn't even need to be on federal level. Just think about it - koseki was designed mid-19 century and used paper records held by municipality. Churches in Europe kept paper books noting marriages, births and deaths even before that.

The downsides are obvious:

- in case of need you should go to same municipality and get extract from same book where event was recorded;
- you only can make record in book of municipality where you are resident.
Chronology: when I was at Netscape and still (apart from part-time help) the only person working on JS and the DOM and the rest of the browser embedding, we took JS to ECMA (now Ecma) in 1996. It was never brought to the W3C.

The IE stagnation came later, after IE4 which was innovative (because Microsoft wanted to embrace/extend/extinguish Netscape and the Web).

Almost everything we added to JS at Mozilla made its way into standards. Examples range from __proto__ to generators in ES6.
You can do that with curl + bash too. RVM does this: https://rvm.io/rvm/security
Exactly for the reason you say :

Market cap - what a company "owes" it's investors. Definitely on the liabilities side. The value of the company.

Cash - what a company definitely owns (and could, for instance, pay to it's investors)

So there is this measure of company's worth called "enterprise value" which is Market cap + debt - cash - assets. It sort-of is what you'd get if you acquired the company and immediately sold everything off. To put it another way : it's everything Microsoft has, other than the business it's involved in.

It can indicate that there are deals to be had. For instance if you pay $50 million for a company that has running accounts with $40 million on them, have you really paid $50 million for it ? You had control (through a company) over $50 million, and now you have control over $40 million and a company, so there is an argument to be made that you "only paid" $10 million.

So "enterprise value" is what you would really have to pay for a company, and for a lot of people considered a more useful metric than market cap.
In my experience YAGNI-abuse happens when people apply it at the wrong level.

For example, people might ignore some rule of the architecture in a rush to produce some feature. This sounds pragmatic: the feature worked, so that archtectural rule must be overengineering right?

Then you ask why this particular feature was needed now at this point the project timeline, and why we had to throw aways fripperies like error detection to get it. Then I rarely hear clear answers.
Thanks this really helped my understanding, it's more like many small payments. But for another client of mine who does manual invoicing ACH could be interesting.
Nautilus-X was pretty serious.

You really want a pretty large diameter so that you don't have a huge gravity gradient causing your astronauts discomfort. Tethers might be more practical than the classical doughnut designs for the near future.
Windows and OSX also do this and present pointless non-defeatable "omg but this is from the scary internet, are you SURE you want to run it????"
October’s Top S for Every Growth Marketer- Part 3
When you are DDOSed they will keep supplying the resources for you to consume and pay them extra. Cloud is commodity so don't expect to be treated like a special snowflake. Your distress is their opportunity to make extra money.

Offtopic but relevant. One of my customer moved their email to O365 without understanding the differences from being ON-Prem. Now they are struggling to adopt their business processes to then limitations MS imposes.
On a slight tangent.. but I have a set of 1920's encyclopaedias which lists all the common forms of cancer associated with asbestos we know today.

So it is clear to me people of influence who have much to gain financially are very good at burying the truth even when scientifically proven.
90% of the command line software I'm installing isn't on my local machine but on either a virtual machine or a remote server. In those cases, "download and run" means

1. Copy the link
2. Type wget, quotation marks, paste the link into the shell
3. Run it
4. Delete the installer script

Instead of the curl|sh method of

1. Copy the command
2. Paste into the shell

If you're installing GUI software then obviously it should have a GUI installer (or the macOS method of just unzipping and drag and dropping the software into the Applications folder), but I've never seen any GUI software installed this way - only command line stuff targeted at developers or system admins who are already going to have a shell open.

Of course, I'd prefer all my software come from the package manager - a separate installer should just be for software that's not quite ready for packaging yet.
I agree. The manufacturer has not only released a device that is defective for its user, but has actually been weaponized against innocent 3rd parties. That goes beyond the normal problems of providing a product to buyers. When manufacturers can actually degrade the quality of the shared space, that's where we go beyond the normal consumer-protection rules and have special regulations like the FCC in the USA or the CRTC in Canada.

While right now the stuff you provide is basically Caveat Emptor, I could see these security problems eventually being taken more seriously by regulators than simple liability.
I don't remember who it was. Might have been Michael Feathers, might have been Jeff Atwood, could have even been Slava Pestov.

One of them said words to the effect, "people over-engineer because they're so afraid of making a bad decision that they try not to make any decision at all." Make a decision. If it's wrong, own it. Develop OTHER coping mechanisms for being wrong. It's good for the ego, probably good for the soul.

The fights I have gotten into with myopic people over the years have largely come down to them putting a bunch of energy into what should have been reversible decisions, and treating irreversible decisions in a cavalier manner (eg, trying to 'get it over with').

Learn to tell the difference. Be bold with the reversible ones. Put off the irreversible ones if you actually can - but know that deciding to do nothing IS often a decision. Like deciding to add security or localization 'later'.
http://www.samsung.com/us/support/owners/product/NP940X3G-K0...
Cut their internet access. Take down their power grid.

If you're being attacked, I'm not sure what international law has to do with it. A country has the right to defend itself -- it doesn't require the UN to grant 'permission.' If you are in the midst of being attacked, waiting for the UN or some other disfunctional body to 'approve' would be like asking the teacher for permission to defend yourself while you're getting your face pounded in. Countries are sovereign. They shouldn't need permission to defend themselves when they are under an immediate threat.
Curious, is it possible that the restrictive Soviet rule (beginning with Josef and ending with the death of Brezhnev or, if you will, Gorbachev's glasnost+peretroika) caused this, or does it go much further back to Zarist times? What's the underlying explanation?
It sound exactly like the 'burgerlijke stand' (civil status) we have in the Netherlands.
(1) you can easily see and just not use it
(2) is incorrect, see https://rvm.io -- it verifies the script
(3) you can do within the script, though you'd have to handle different package managers
(4) is true for packages as well. You can put whatever you'd like in an RPM or deb including e.g. A post-install hook to sudo rm -rf --no-preserve-root /

Making packages is hard if you want to support many distros. Maybe we should adopt the Go model and just ship binaries.
I think he's asking more about how the attackers get past the simple NAT. I mean, unless you deliberately expose the device as a webserver to the public internet, a device should be by-default hidden theoretically unless it goes looking for trouble online. Of course, considering the quality of most routers, it's not like the NAT itself is terribly safe.
Not fearing change and being able to handle change is the skill required; and it can be learned from experience. An over-engineer will attempt to build a system that is too flexible and too complicated in order to mitigate all possible changes. Similarly, an under-engineered project will become of patchwork of impossible to maintain code when the changes roll in.

The skill is knowing how to evolve a project -- create new abstractions and layers -- in the face of change. To fundamentally alter the product and keep it working all at the same time.

If you under-engineer a project and you don't know how to do this eventually you'll be faced with the dreaded re-write. Throughout history how many companies and products have failed because of that. If you over-engineer you can suffer with a huge amount weight you don't need. And even then you still might get it wrong and be stuck with an architecture that doesn't work given new requirements -- which might require an even more difficult re-write.

So many engineers can't bring themselves to remove code or change their architecture; so they try and get it right the first time.
and dont forget the part where user is charged $ for violating contract.
Still, I don't think you can use it to avoid (physical) crashes due to an incorrect algorithm, simply because theorem provers work on a cognitive basis but control systems operate on continuous fields (i.e. transfer functions defined over the complex numbers).