skysight-inc/HackerNews huggingface dataset:
Ask HN: Should I leave this successful early stage company?
Joined this company soon after incorporation (not as a cofounder)
We had a relatively short deadline to deliver a working product for a pilot.

Worked through this and launched an MVP relatively quickly. We never considered how different our customer's workstation was from our developer machines. The product crashed quite often on their side. I would test the app on my own machine and it would work flawlessly for 5 hours straight on a Sunday. Come Monday, it would break on theirs within an hour. This is where it started going south with the boss.

The product was not perfect for a couple of months. During this time his behavior escalated with his frustrations. I was getting cussed out and berated on a daily basis over text-message, slack, and phone-calls. One day he gave me a strong cussing out over phone and said I was not competent enough for this job. I asked him if I should leave-- we agreed to talk later. He came back and apologized, asked if I wanted to leave. I said since we were in the middle of an important test in the pilot, I would stay.

I started focusing on putting in a test suite, and started getting daily harassment about my lack of attention to detail and not improving the product.When I asked if we could hire another person to deal with his requests, he acted like I was asking a favor rather than help and berated me in front of the team.

I have been close to tears multiple times a week because of his comments in direct & public slack channels. I have developed a fearful stress response to seeing slack notifications on my phone. For career growth & income stability I want to stay. It has been less than half a year since I originally joined. But I am feeling like I can no longer handle working with this boss. The rest of the team has been great to work with.

What should I do? Is my boss trying to force me out, or just push me harder?
org-mode is one of my favorite discoveries in recent years.

I'm now only using Markdown when I absolutely have to and live in org-mode for everything else. And I've only just began scratching the surface of org's features!
The Postgres docs suggest using another column. My guess is that an expression index would be too large if it held the tokenized value of all of your FTS documents. These things can and often are entire written documents. Imagine the index size for 2 Million rows of tokenized documents at 2,000 words each.

You might be able to get away with if if you were indexing a less then large amount of very small documents.

I like your expression index idea a lot.
DVHS was great, it just came too late at too high of a price for much adoption.
Show HN: Decentralized AI Summit 2018
I have folders separated by language or concept and then category. I've got sections for books and other learning stuff, my own notes and small libraries and stuff and one for bigger projects. I symlink my own libraries I use in different projects into a central lib folder in each language's folder.

It's not the most organized bur it works for me.
> You could lean on the relevancy strategies built in to ES, but in my experience you're better off understanding what relevancy means for your dataset and implementing a strategy yourself.

Ranking is hard. You SHOULD lean on the tools available in Lucene/Solr/ES. PG's ranking tools are a joke in comparison.

> The options and tools for configuring and tweaking relevancy between ES and PostgreSQL's FTS are surprisingly similar for many application use cases.

That simply isn't true.
Well-written, educational, incites action. Thank you.
Looks like everyone's forgotten about the heart bleed bug - existed for a LONG time in open source software.

Open source doesn't guarantee a big free, or backdoor free implementation. Only validation budget & intensity does
Justice+and+Consumers+|+European+Commission
Maybe it’s my inexperience. I’ve not had to define egress rules yet. I run 1 preemptible n1-standard-2 node and pay for ancillary services. It’s $35-40/month.
Game-of-thrones-season-8-coming-in-2019
Flash WebAssembly Examples
How smart speakers stole the show from smartphones
Well, you only need to cover yourself between now and whenever you can get your hands on an AMD chip. That cpu/board swap will be much more work anyway.
You shouldn't call your book 'learn X the hard way' if it isn't (also) freely available online if you ask me.
This might all very well be true, but Swarm doesn’t let you connect cloud disks directly to your containers, to my knowledge.

Also I challenge the $10 because what cloud instances plus ancillary services add up to $10? I’m talking 2 CPUs and 7.5gb RAM.
As a comparison:

- Apple was warned about this half-a-year-ago and cannot give certainty that their previously current OS is patched (High Sierra only was announced on June, about the same time they were warned about Meltdown)

- DragonflyBSD, arguably the underdog of the BSD's was not warned about the bug, like apparently all the other BSD's, and now have commited the patch to their current OS version http://lists.dragonflybsd.org/pipermail/users/2018-January/3...

Apple needs to step up their game.
Somebody probably submitted it, and other people probably enjoyed it.
> !$ - I use this dozens of times a day. It repeats the last argument of the last command.

Press ESC then full stop instead. Less key presses.
"Roughly two-thirds of the United States' population lives within the 100-mile zone."* That's incredibly disturbing.

* https://www.aclu.org/other/constitution-100-mile-border-zone
Depending on when you started your instances, you may have already been patched. I've read reports of AWS performance drops as early as Dec 15th.
That's certainly a use case, it's just not compatible with Apple's restrictions.
You don't advance your career with downloads. You advance your career with publications. Even if you decide to quote your local TV Guide in your papers, you still need to meet publishing quotas to justify your present and future grants, and the only thing that counts is getting your work published in well-established publications.
The track needs more cowbell.

It’s weird to see no cellphones.
The only criterion is intellectual curiosity. This has that.

https://news.ycombinator.com/newsguidelines.html
You can also do keyword searches across all man pages like:

man -k <keyword>
US Customs and Border Protection Sets New Rules for Searching Electronic Devices
Thanks. I'll read it.
Vacuous and Naive.

Sorry, for that, but is throwing insults really how discussion is supposed to be done?
I wonder how much pen testing is done by hand and how much by automatic tools?

Anyway, I'm being pedantic. There are a lot of great points in this article.
Thanks for the explanation. So it's down to when the access check is performed. I wonder why Intel did it the way they did, performance maybe?
AFAIK on Intel it's not possible to load a microcode update over the top of one already loaded by your firmware, so if the firmware shipped an older update, the firmware really needs to be updated. (Please someone correct me if this isn't the case -- I can't even remember where I read this)
Adaptive brightness is a Windows setting you can change in the Power Options control panel. Click 'Change plan settings' next to your chosen power plan, click 'Change advanced settings', click 'Display', click 'Enable adaptive brightness' and change it to off.
I'd take the view that a rewrite in place is always better than a rewrite from scratch. With a little effort it's always possible to implement the new thing piecemeal as part of the existing thing.
In general, the multi-tenant security model does not rely on a malicious tenant being limited to any OS or patch (they can and always will be able to run whatever code they want including OS, and it's designed to still be secure). The cross-VM attacks we've seen actually go through the hypervisor, and since that is patched you should be fine if you're patched.
Could you please not take HN threads on unsubstantive tangents at all, and especially not nationalistic flamebait ones?
Yes, of course. f(g(x)) was the simplest possible example I could come up with to illustrate the point :-)
Yes, something like this would work.
Your solution is basically #1/#2 - Declaring this mostly a software problem, and giving a cooperative mechanism where software effectively marks the areas it wishes to protect. Rely on everyone to isolate everything they like, then continue speculating everything in sight and declare everyone who didn't isolate well enough to be "bad programmers" :)
Price of electricity varies greatly depending on where you are. My residential rate is about $0.13/kWh, so completely consistent with the article.
Do you believe those stupid disclaimers at the bottom of emails hold any water? Same principle here.
bash or its minimal version such as ash is critical for embedded systems where python/perl etc are too fat.
What is the most effective way to encourage our elected representatives to correct this potential for violation of our rights?
But if you're maintaining a separate ts_vector column, which you then index, you're creating the exact same amount of index data.

Unless you're saying that you would populate the field only on some rows and not all of them, and control this from the app. But you could do that with an expression index, too, assuming the rule is a simple, pure function:

CREATE INDEX index_posts_on_body
ON posts (to_tsvector(body, 'english'))
WHERE published = true;

or similar.
It dominates, but it's not the only one. (i)HDI is also used, which has improvements over GDP per capita, but still with some of the limitations described in the article.
You can't even send encrypted 7zip archives through Gmail. Well, you can, but they'll block the download claiming it's not safe.
This is why, when I recently built a credit card form, we didn't include any trackers or third-party code (beyond our vendor's). No dependencies at all—our vendor also has no dependencies in the JS we use to implement the CC form.

That did mean no jQuery, no Google Analytics, no NPM modules and we had to build it as a standalone page outside our React setup, but it's worth it to be able to definitively inspect every line of code and provide a CSP that locks that page down tight to just our subdomain and our vendor's.
Whatever the fake stars: thank you for your great tool Mr Exodia. ;)
Metered could matter - it's very easy to disable downloading of any non-inlined JS (like with uBlock)
Are there any other libraries that aren't Unity/Unreal that are better than Three.js?
It's pretty common for FPS server game loops to read all the network packets, update player state, run one tick of game logic and physics for all users in a single game, and then send out updates to everyone.
Depends on the data right. I've seen good performance on larger tables after using GIN indexing with records that rarely needs to be updated and simple queries.
I'm not a expert in PostgreSQL by any means, but reducing cost and learning something never hurts.
Yeah, i don't disagree at all.
Something like this what i meant by "cooperation" (lfence or equivalent for code that can't be isolated but must be protected) + "weird abstractions" (IE back to segmented land we go)
Pretty much every modern online map. Mapbox GL JS is a good open source option: https://www.mapbox.com/mapbox-gl-js/api/
V7/x86 – x86 port of Unix V7
I have a small company and have found that in general 5 years is the shortest stints for our technical employees. Our dept managers have been with us for over 15 years. Our college interns also report hands down that their internships were the best of their peers.

I’ve taken this as a compliment to the environment and culture I’ve fostered. My “secret”: treat everyone the way I’d like to be treated and work the way I’d like others to work.

I’m always surprised when others are surprised at our retention. To me this seems like an easy accomplishment. Maybe this is only possible at a smaller company who’s doing interesting work?
As a fully remote employee, I bias toward avoiding employers that have a bias toward hiring local.

Why? Because it tells me that something isn't right. That the company does not fully embrace remote work to it's logical end.

The company I work for has about 40 employees.... no office, many time zones and what appears to be no geographical bias. I fucking love it and would shudder if they started concentrating more employees near each other.
https://www.youtube.com/watch?v=jiu0LPeLQPE
Show HN: Ssh browser and Rsync gui
Can someone explain why the API design is such that it takes roughly ~100 lines of code and understanding of many different concepts (buffers, vertex/fragment shaders, uniforms, attributes, etc.) to draw a monochrome triangle on a canvas?

I'm not trying to be snarky or say WebGL sucks (I have very little experience with it), I'm just wondering why the design choices have culminated into such an API?
So Microsoft, Facebook and Google are not major companies ?
Yes, you understand it correctly. The bug is really just that cache hits that are caused by speculative execution do not get invalidated. This is technically a bit of a speed-up, but it leaves information behind about the speculative execution that took place.

It is also worth understanding the differences between Spectre and Meltdown, since they are distinct. Spectre refers to reading process memory via measuring cache timing after speculative execution. Meltdown, in conjunction, refers to the fact that Intel CPUs do not verify access rights to a virtual address until after the speculative execution (and thus the cache hit) takes place. Meltdown allows bypassing page permissions so you can read any page mapped in your virtual address space. Spectre is 'limited' to only reading addresses you already have access too.
You weren't shadowbanned: https://news.ycombinator.com/item?id=12703655. That was after many violations of the site rules and several warnings.

> agree with [...] liberal politics or be banned

https://news.ycombinator.com/item?id=13110004
OpenGL is quite an abstraction.
It will be trivial to "modify" the mushroom and then put it in pill form, and it will be easy to patent it when they do it. Big pharma will happily make money selling us what we could be growing in our backyards, and there is nothing wrong with that.

Many people with depression, also would like to avoid the trip (especially people who have to work), and if Big Pharma spends millions creating a non psychoactive effective treatment regimen derived from mushrooms, that would be fantastic. And that won't be something we could ever hope to grow in our backyards without the help of the pharmaceutical industry.
Check Container-optimized OS release notes to see which version has the fix. If I am not mistaken stable-63 has the latest set of fixes.

https://cloud.google.com/container-optimized-os/docs/release...
Windows, at least for right now, does not seem to be updating CPU microcode during boot. If you run the PowerShell Get-SpeculationControl script that gives you the status of the updates it states that the CVE-2017-5715 fix requires hardware support. If you don't have it you are told to get a BIOS update from your OEM. WIthout it, the status for CVE-2017-5715 is listed as not enabled due to missing hardware support.

Of all of my computers only one has been issued a BIOS update so far. I ran the PowerShell script before and after installing the BIOS. Installing the BIOS flipped the status of the fix for CVE-2017-5715 to on.

I also ran the free HwInfo utility that will show the microcode revision before and after installing the Windows update and before and after installing the BIOS. It only ever changed with the BIOS update.

I hope this changes and Windows does start updating CPU microcode. I also have a few older motherboard's that aren't likely to ever see a BIOS update again.
Yeah, I think it's clear that some amount of risk has to be absorbed by the public. It sucks, but it's in our best interest to keep pushing computing forward. And we should keep in mind that it's also not like these attacks are obvious. They took security researchers four years to find.

I think the important thing here is precedent, rather than making customers whole. The question then is what, if anything, could Intel have done to anticipate and prevent this, and how do we incentivize them to take those measures in the future?

It's also possible that there's nothing to change here. There's always going to be some risk, and trying to force that risk closer and closer to zero will at some point not be worth the tradeoff. As bad as this is, if the caution necessary to prevent it would have resulted in processors being half as fast as they are today anyway, there wouldn't be any point.
Pretty handy. Fast. Nice.
I find it impossible to believe that there are no bots or paid marketing shills on Reddit.

If you were to hide downvotes, this would only affect “honest” users, and not bot farms using APIs or web extensions.
While a 90% efficient motor is quite good, a 90% controller and a 90% charger is not. I would expect them to be closer to 95%. But I have to back down from easy, according to [1], some Tesla owners charge their vehicles at 80% efficiency and not the ideal 92-98%. I imagined that would be a problem at those energy levels, apparently not! Anyhow, there is nothing inherently worse about fueling a central ICE to pump out electricity to EVs than directly fueling an ICE car. Larger ICEs tend to be more efficient, especially so for diesels. If you add the savings by the regenerative charging enabled by electric motors, it becomes even more favorable to electrify cars. We need a lot of batteries though!

[1] https://forums.tesla.com/forum/forums/charging-efficiency-0
If this prompts you to action, and you need a quick and efficient way to build a CSP policy for the various services you use: https://www.npmjs.com/package/csp-by-api
I'm seeing the same thing in Firefox 57.0.3 on Debian, if my viewport is more than or equal to 1320 pixels wide. It goes away for the text on screen if I force it to repaint, but comes back if I scroll or resize the viewport.
FYI, Red Hat (and CentOS) already have updated kernels with mitigation.

And that made me asking how Red Hat (and the free derivative CentOS) could have already patched their current kernel (on Jan 4th) while the patch was still being discussed on kernel ML the same day?

I don't see how they could come up with new kernel with mitigation for the three variants, excellent KB articles on the CVEs, tunables flag, preliminary performance test, etc. without having already patches implemented and tested for some time.

Do they have internal kernel devs? And so, do Redhat have another implementation?

(This is my first comment on HN, I hope I'm following adequately the guidelines)
Relativity (YC W16) is hiring a robotics engineer in LA to 3D-print rockets
Presuming the existence of E.S.P. or a time machine, that all checks out.

Otherwise you have a little bit of a problem related to when and how you know the strategy executed by your opponent.

On paper you can get around this issue by ignoring the time element, but in actual execution with humans or intelligent agents, the problem exists.
It really depends on the type of game.

If it's a latency sensitive (like a twitch FPS), UDP is the way to go. Having up to date data is more important than having all the data.

If it's a synchronized game (like a turn based game or an RTS where all clients run at the same logic framerate), or not latency sensitive (an MMO like WOW), TCP is fine and probably easier.
Friendly small business loans	https://www.cityfinances.lv/kredits-uznemumiem/
Maybe for you, but I don't want any gatekeeper.

I want to decide what is "good for me", I want things fast and on any platform from my phone to laptop to car to TV.

Luckily we have choices, and I choose to use the web. You can use a browser that disabled all of this, as long as your gatekeeper allows you to.
Insane Crazy Pilots
You do not need to read in between the lines to learn that; several commentators have come right out and said it.

* http://lists.dragonflybsd.org/pipermail/users/2018-January/3... (https://news.ycombinator.com/item?id=16084641)

* https://medium.com/@frankycaron/this-week-in-words-the-langu... (https://news.ycombinator.com/item?id=16075588)

* http://www.theregister.co.uk/2018/01/04/intel_meltdown_spect...

One of them you might have expected to use the word "fuck", but actually did not. (-:

* https://lkml.org/lkml/2018/1/3/797 (https://news.ycombinator.com/item?id=16066968)

In part, this was down to the cat being let out of the bag early.

* https://news.ycombinator.com/item?id=16080918

* https://news.ycombinator.com/item?id=16068510
As someone who also has to semi-frequently modify 100+ lines bash scripts written by others, I'd suggest every serious bash scripter read the bash man page. It is much smaller than any book on Python.

For scripts written in Python, I'd use a similar argument and suggest every serious Python scripter to learn Python. As for Perl, or Ruby, or Julia, or anything really. It's just that learning bash from its man page is, IMO, much easier than learning any of those languages to the same degree.

Of course – and it goes without saying — that some things are just not suited to bash, and in those cases a suitable language/framework must be used and learned if not learned. As far as process calling, environment management, or stdio streams management are concerned, bash is better suited than (all the other languages I've tried) Python, Ruby, or Go.
> Is it because they need more stuff? Or is it because their brains are under near-constant assault from a barrage of advertising that melts their willpower and creates a link between having a free moment to themselves and consumption, a desperate instillation to keep up with the Joneses?

Generally, increasing incomes in developed countries lead to increased service consumption or at most indirect manufacturing. While some of this is "keeping up with the Joneses", I think a lot of it is just rational time valuing.

e.g. I've found that as my income has gone up considerably in the last half-decade (several hundred percent), I am spending more - but not on buying more goods. Generally it is bucketed under:

Spending more to save more time (increased value of time):

* online grocery shopping

* spending more to live close to work

* use of more expensive cab-services (lyft/uber) rather than public transit or biking

* flying direct rather than multi-stop.

* Spending more on childcare to maximize time spent on more intellectually stimulating endeavors (including work) or at times traveling

Higher quality:

* higher end food and restaurants

* more expensive travel options (distance/exotic)

* larger housing units to feel less cramped that also offer time-saving amenities (in-unit laundry, gym/pool, 24/7 package delivery)

I'm getting more leisure -- and directing a lot into the GDP numbe.
Reminds me of the Cowboy Bebop movie opening: https://youtu.be/ofSLCFxJ8Jo
I remember making something like this myself for a project involving video editor with a "premiere-pro" looking timeline in canvas. At the time I remember looking at other projects like this one but they would have jquery dependencies or a weird api. This one looks nice and would have saved time probably.
Hello,

I'm not a tech expert at all, could you give an info please?

I've run this test and it's positive : https://repl.it/repls/DeliriousGreenOxpecker

Does it mean that a website with this kind of script can access all of my browser session? For instance, if I log in to my bank account, then I logout and about 10 minutes after I visit an evil website. Could evil website retrieve the URL of my bank account + the credentials?

Also, is there a POC that can display all browser history?

Thanks.