skysight-inc/HackerNews huggingface dataset:
Ask HN: Is Backupify safe and/or necessary?
I am a longtime subscriber to Backupify because I have a huge amount of mission-critical data stored on a free Gmail account (I am slowly moving to a separate Google Apps Suite account on my own domain). Google sent a security message saying I should turn Backupify off because it has access to everything on the account. That's necessary for backup purposes, but Backupify seems vaguely shady. They send absolutely no monthly stats on what's backed up.

Is there a safer way to back up Google content? Is Backupify trustworthy?
"We made a decision to revisit our typical list of schools and only visit the universities that had more than 18% of female undergraduate computer science majors"

So instead of having a very wide search Feild for applicable people, they reduced it for the sake of being sexist. Great
There is a spectrum. I find that when a side-refactor is too much work to tack on a ticket, it's helpful to instead ask for some smaller improvement that can help with cleanup in the future. E.g. add a line of logging that could prove down the line that a particular piece of code is not used, or switch to using a new field to let someone else delete the deprecated one later more safely.
I would also be interesting to hear more about what impacted you on a personal level.

For instance in phone history the things that were game changing for me are in historical order email, GPS, NFC payment, a desktop class browser and a decent camera. What does the iPhone X bring to you that changed the game?
Blockchain or Bullshit?
> My wife wanted to try it and we found a person at a deli attached to this big weird flea market that was SO HAPPY to give tourists a free sample.

This really takes me back! My wife and I went to exactly this place, for the express purpose of trying the hákarl. The guy was eager to give us both a taste as well. But we both said 'no thanks' once the smell hit us.
The extra irony is that's because computer programming was considered "women's work" in those early days, as basically a form of clerical work, like being a secretary. So it was one of the few occupations that was traditionally socially acceptable for women to be in.
Do you have any recommendations for learning that sort of stuff outside of work?
Spent too much time on indulging in political correctness in long-term will hurt the productivity of the SV companies. It adds up the cost to operate. This guy is not wrong for a lot of good points.
Valuable work is often not easy. If it were so easy that you could do it with a genuine smile then a lot more people would be doing it and then those smiles would be fake.
In that case, you might have missed the text link to the supplementary materials!

https://1drv.ms/b/s!Aj4exx_cRA4ghK5-kUG-EqH7hgknUA

It's not so good at faces -- zoom into the last page if you want to have nightmares.
The top-voted response is helpful: throwing away constants as in Big-O notation is misleading, average cases aren't the case; Sedgewick Algorthms book.

https://en.wikipedia.org/wiki/Quicksort

https://rosettacode.org/wiki/Sorting_algorithms/Quicksort
With LS afaik it's not possible to run multiple profiles at the same time (say you have groups of rules for a particular app), otherwise it would be perfect.

ie., turn Apple Telemetry on or off.
QUIC also uses little-endian
It all goes back to Spacewar. It used a DEC Type 30 display, which was like a vector display except it drew individual dots.

Larry Rosenthal made the first cheap vector game system from the guts of an old TV and a custom TTL CPU, to play Spacewar: https://allincolorforaquarter.blogspot.com/2012/11/at-end-of...
Which One Doesn't Belong?
I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point.

Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates.

Further, it only takes one bad certificate authority to compromise the entire system.

If the browsers really cared they would make sure that all login mechanism use something like J-PAKE or a private Key. That way if certificate authority was compromised the attacker would also have to know either your password or private key.

Further, not everything requires an encrypted session. It just adds overhead for no good reason. If you worried about MITM injecting a zero day. It would help if the web standards did not keep getting more and more complicated increasing the attack surface. All you need there is just a simple signed hash of the page. Some things might not even need that.

--EDIT--
I went on a bit of ramble there. If we want to be Mr. Conspiracy. I would say google likes adding more and more features because it makes it harder for competing browsers to exist. Not only that let's consider HTTP 2.0. The standard does require TLS, but Firefox and Google will not talk to HTTP 2.0 web-server without TLS. The large market share of Chrome for instance makes you unable to decide to run a plain text HTTP 2.0 web-server even though TLS is optional according to the standard. Even though Chrome is not the standard as specified by the standard document. I am forced to comply with how chrome and firefox are doing things. The effectively can make their own standards since there are so few browsers. The would be my Mr. Conspiracy reason why google would want to require TLS. Becuase let's face building a secure Crypto stack the meets all the requirements for TLS is not easy. So that just increases the barrier to entry.
Okay, show me an end to end platform I can grep through.
Heartbleed was in OpenSSL for years before it was discovered. It was readily auditable with plenty of docs and specs and yet nobody noticed.
canvas/font fingerprinting
Finger printing the user is the main reason why.
I used to work with Dave Theurer post-Atari, he's still programming and a great guy.
Seems interesting that they would get a million dollars in a Series A if it was a piece of cake to bypass. Have a PoC?
Filelight works on Windows too.
WhatsApp ready to launch digital payments in India next month
I do this on my home network. It works well, so I encourage you to build this out.

As an added bonus As a service you could point the dns entries to your own web server and serve up cat pictures or motivational pictures in place of ads.
I agree, but disagree there was a hard ceiling for GoPro.

Companies may have an initial success.. but the rest of the world never stands still while they rake in money. Especially not in tech, which gets cheaper every year and can be manufactured fairly easy by competitors.

GoPro had an initial success with their camera.. and it was their duty to expand beyond that into other lines of business and diversify their revenue streams.

When I hear GoPro, I think cameras (like everyone else).. and that was their failure. There's really nothing about the name "GoPro" that is attached to cameras--it only means that because of their marketing and failure to expand. I don't think there's a reason the name GoPro couldn't be put on a variety of high end outdoor gear--surfboards, snowboards, etc. GoPro could easily stand for pro-level/quality outdoor gear.

What's surprising is that they watched other camera manufacturers fail and disappear, and yet didn't pursue other lines vigorously.
>I would hardly call it secure. There have been too many failures with certificate authorities. The whole system is dependent on that weak point.

>Also do you keep track of the certificates issued to every website you visit? Then if you visit the website notice the certificate has changed. Do you check if it's a legitmate change ect.. If you don't keep track of certificates how do you even know you are not being MITM. You trust the certificate authority to handle that. However, certificate authorities clearly have signed or given out bad certificates.

still better than anyone being able to inject scripts when you're on an untrusted network. the requirement for a compromised CA drops the interception risk for most users to 0.

>Further, not everything requires an encrypted session. It just adds overhead for no good reason.

overhead of what? maybe a few hundred milliseconds on a 3g connection?
This is the way. No need to individually configure all your devices. My DHCP will hand out a local DNS to each client that maps all the ad/malware domains to 0.0.0.0, so if you’re on my network, even as a guest, you get blocking for free.
A union is simply am government. It can be good or bad, but it's almost always better for almost everyone than the natural law of the jungle.

The fact that almost every billion dollar company with decamillionaore CEOs is dead set against unions (not even willing to form a partnership agreement with a union), should prove how good they are for everyone who isn't a multimillionaire.
I would suspect it works in a similar fashion to this[1] modification of WinDirStat, which parses the MFT to do rapid scanning, but loses the ability to selectively refresh parts of the tree.

It is, however, F/OSS.

[1] - https://github.com/ariccio/altWinDirStat
I'm getting used to Heavybit producing crappy podcasts, for example they claimed my website had 100k users when it had around half that amount:

https://twitter.com/WakaTime/status/954541663463948289
> Additionally, unions force costs to go up on many projects and revert any productivity gains that technology has provided.

Honestly, I think this is worth some honest discussion about the big picture. Many of the critiques against neoliberalism[1] is that all of the benefits of opening international trade and automation have gone to the rich. In 1930 John Keynes predicted 15 hour workweek for his grandchildren[2]. The average workweek in the U.S. is 47-49 hours[3]. This is in a world where dual incomes is common.

I'm not advocating paying people to sit around all day, but I think it would be good to look at what we're trading work/life balance, job security, income, life expectancy, age of retirement, and the other things we give up for it. Personally, I still like the current world of iPhones and Amazon delivery, so it's not a clear argument in one direction, but it's not something I hear people talk about.

[1] https://en.wikipedia.org/wiki/Neoliberalism#Focus_on_economi...

[2] http://www.businessinsider.com/john-keynes-predicted-15-hour...

[3] https://www.washingtonpost.com/news/on-leadership/wp/2014/09...
Everything that makes you is genetics. Desire to train is genetics.

There isn’t a “genetics only helps so much” argument.
I think it cuts both ways. Yes, it's definitely easier to change code while you're already there, but on the flip side, it can potentially create a huge burden for the programmer. A simple change might turn into a multi-day slog when there are more pressing things that need attention.
There will be a little blurb on the back label with vague threats like "If you copy me, I will find you..."
GoPro could turn themselves around if they supported their customer community by opening up their hardware interfaces more and allowed more robust fine-grain control over aperature, shutter, iso, white balance via usb and wifi/Bluetooth with API support so we developers can create sale-generating software that makes their fantastic hardware more useful. It won't hurt them to open these controls up. Also make streaming to devices in real-time with as low latency as possible would be nice. Also lowering the price couldn't hurt but they do have one of the better waterproof systems out there so maybe that's not feasible? All of this would open up their market to tinkering enthusiasts as well without making things more complex for their existing market.
Blackwater is sewage containing bodily waste.
Actually, you didn't pay for the software. The open source parts of Android do not cost you anything, and the commercial components are free to use as long as you have a Google account.
> However a processor with verifiable functionality has value. It's more trustworthy. It can be checked for accidental, or deliberate, security flaws.

Is this tractable for a chip with billions of transistors? I would think the people qualified for this already work at chip companies and are doing the work for a stable salary.
PCI doesn't care about what i return to the customer. It covers protecting the card number. It could be in the merchant agreement but most of those rules are never enforced. Its against card brand rules to require a person to show an ID but all merchants do it. Merchant account agreement requires you to prevent fraudulent purchases and that part is heavily enforced which is why the card brands turn a blind eye to the merchants asking for an ID.
That’s a very limited view of the world and leans more towards isolationism as opposed to internationalism. Isn’t it true that the US economy and consumers have benefited greatly from:
1. cheaper Chinese manufacturing at the expense of China polluting its rivers?
2. capital pouring in from all over the world in US financial markets (sovereign wealth funds, pension funds etc)?
3. migrants and their children coming to America and starting businesses?

The global economy is forever changing. At one time, India’s GDP as a fraction of the global GDP was at 24+%. United States, and the whole world, has benefited tremendously when smart and motivated people devoted their lives in creating businesses, advancing science and technology. The key in strengthening this status quo lies in recognizing, accepting and nourishing this talent. The price paid in return, handful of malice enterprises gaming the visa, is fraction of the overall net gain.
Maybe so, but this is by now a cliché. Please don't post unsubstantive comments to HN threads.
Sorry to hear about your mom. Ovarian cancer is one of the worst because it usually has no symptoms until it is very advanced. For any cancer, early detection is the key. That's when surgery, chemo and radiation are most likely to be most effective. So I think this is where these blood tests will have the largest impact.
That's a retronym. Earlier tests in the series were named DUFF.
This sounds like one of those just-in-time delivery systems that were all the rage in manufacturing back in the 90s, but applied to retailing. They always were brittle; there's little or no slack in the system, so if something unusual happens, the process breaks.

If the system is new, and it seems to be, it probably needs some fine-tuning. Any workable system needs a little bit of slack in it to account for the variable and the unexpected. The question is how much. And it's not free.
the problem is that if it's optional, lazy/ignorant developers will never implement it, even for sites that actually need it (pretty much any sites that handle login). requiring tls for new features is just another nudge that browser developers have put in place to encourage tls adoption.
>> It all depends on requirements.

Requirements change.
> read the accounts of the Spanish flu, a bird flu

The non-human source of the Spanish Influenza is still debatable.[1]

[1] https://en.wikipedia.org/wiki/Spanish_flu_research
Nobody, it sounds too good to be true.
I also love TripMode. Uses a kernel extension which some users may dislike but so nice to turn off Dropbox/Google Drive/Arq/iClouds backup services while tethering at Panera
Fascinating, isn't it?

Almost like people believe the same thing said very much the same way but from a completely different source. Thanks, I'm here all weekend. ;)
Wow I was just doing research on this exact topic. I’ve been trying to boot Alpine into RAM from the network, and then run my lxd containers off the storage drives. So imagine my happiness when I see this.
I think that’s an extreme position that priorities some platonic ideal over form, function and utility.

It’s certainly reasonable to expect a platform owner to be able to control access and integrity of customer data without encryption, for many use cases.
Anti-anti-vaxx is pure flameland of the most tedious sort, and therefore off topic on HN.

Although I appreciate the self-awareness in your comment, it's also a pretty uncivil thing to post; so while it's good that you phrased it that way, better still would have been not to post it at all. Moreover, the data point you're asking for would rather obviously not have the significance you're ascribing to it.

We detached this subthread from https://news.ycombinator.com/item?id=16190609 and marked it off-topic.
Primitive technology: A frame hut
I've used treemaps for many years, to reduce disk space, and have been somewhat enamored of them.

Then earlier this year, I happened to use flame graphs for visualizing profiling data.

This is when I realized I hadn't quite understood flame graphs. It became obvious that you can use flame graphs for visualizing the SPACE used by a tree hierarchy as well as TIME.

I googled and Brendan Gregg already wrote about this!

http://www.brendangregg.com/blog/2017-02-05/file-system-flam...

http://www.brendangregg.com/blog/2017-02-06/flamegraphs-vs-t...

So from now on, I believe I will use flame graphs instead of treemaps to visualize this space.

-----

Details: A common point of confusion for flame graphs is that the Y axis is "time elapsed". (Chrome dev tools has a "flame chart" where the Y axis is time elapsed, but it's not a flame graph.)

The Y axis is "cumulative time used", and the X axis is the call stack. Combining call stacks sampled at different times gives you a TREE, because a given function calls multiple functions.

So if that's clear, it should be clear why flame graphs can be used instead of treemaps. They are the same visualization! And flame graphs have the benefit that they use a one spatial dimension to represent quantity, rather than two. TreeMaps have the same problem as pie charts -- human perception isn't good at measuring areas.

Also, with treemaps, you have error due to the inability to represent a internal directory of zero size (you need some space for the label). Flame Graphs don't have this problem because directories are stacked on the Y axis.
What's the advantage of this forum over Stack Overflow?
Spend time with the kids and wife.. do chores.. and that is pretty much it.
> I disagree with "most", but this is absolutely often an issue. Often people take criticism of their code as criticism of themselves and their abilities, which is always counterproductive.

I think it's easy to fall into "this comment is a value judgement on my skill/person, and not my code" if code review feedback is targeted at the person and not the code.

Hence the discouraged "why did you do this" form vs the more helpful "this might be better because" format.
That was a glorious read! The development read like they were changing the tires on a moving race car.
Building Wine 3.0 for Android
That's a great thing to do as long as you don't take it to the point where you end up with products out of stock. The moment you do, you're encouraging your customers to patronize the competition instead.
Off topic, but if anyone from their marketing team reads this, one of the activities[1] on the HERO6 Black sales page[2] is a surefire way to crack your skull open.

[1] https://i.imgur.com/ZuOmIrV.jpg

[2] https://shop.gopro.com/EMEA/cameras/hero6-black/CHDHX-601-ma...
Similarly, I once wrote a triangular maze generator https://www.khanacademy.org/computer-programming/triangle-ma...
I always loved Tempest. I was terrible at it, but loved it.
You'll definitely want to read Jed Margolin's "The Secret Life of Vector Generators"

http://www.jmargolin.com/vgens/vgens.htm

And "The Secret Life of XY Monitors"

http://www.jmargolin.com/xy/xymon.htm

(Jed was an Atari engineer during the vector era and beyond)
Regarding bring lazy on the serialization... yeah packed structures make sense. But excess padding is still wasteful, and endianness is only a bswap away, which is 1-2 cycles apiece and so won't exactly break the latency budget (per Agner Fog's wonderful pdf, looking at Haswell).
>Additionally, unions force costs to go up on many projects and revert any productivity gains that technology has provided.

Perhaps at individual companies, but the overall trend is pay has not kept pace with productivity gains, so the overall trend across society is the reverse of what you're worrying about.
So what stops Americans who can’t afford, to cross the border for delivery or cheaper healthcare.
In my original example the dilemma was between denying a suspected terrorist the right to consult with a lawyer and risking a nuclear terrorist attack. I gave this as an example of when idealism and pragmatism are in conflict. When you objected that this was unrealistic, I responded by giving a real life example where idealism and pragmatism were in conflict.

The purpose of my example was to create a situation where it should be obvious the right move is to go against idealism. The reason is, if your starting point is something like "We must never deny people their rights" I'd like to show you an extreme example where, actually, we must. If you can agree on the extreme example, then the discussion becomes a matter of degree - i.e. when is it okay to deny people their rights versus when it is not. This is actually the more nuanced and realistic discussion that has applicability to the real world.
74 deaths blamed on flu (correctly or not) in California thus far:

https://www.mercurynews.com/2018/01/19/california-flu-deaths...
The EFF report specifically said they don't ask for more permissions. They just chose apps with good permissions already. Most of the scary stuff in the report is from actual Windows desktop trojans. The mobile stuff is just plain repack.
I feel that this could be recontexualized for the person who is receiving feedback.

If you don’t take things pwrsonally, and you take things one at a time, there’s no reason to let yourself feel overwhelmed or attacked in many situations where at first you might be inclined to do so.

Specifically I disagree with point #2. I absolute love it when testing/QC labels every single instance of a minor mistake. It saves me from having to go through and find each place where it happened, and it lets me check off a little Asana task as complete each time I make a minor correction.

Feedback like “it looks like you made this mistake a number of times” can be just as condescending, with the added frustration that I now need to go try to find everywhere I might have made the mistake.

When they do the work of naming each instance, they are saving me time.

So I’m wondering how much of this is about putting the burden of not feeling attacked on the reviewer, and neglecting the role of the reviewee?
That’s terrible. Did you move on to something else?
Nah, it's a tricycle!
Which one? The one with the guy skateboarding without a helmet? The guy on the edge of a rocky cliff? The guy standing at night on a rock formation on the beach? The women biking without helmets without their feet on the pedals? Or the kayakers going over a waterfall?

If I didn't know better, I would think filming yourself cracking your skull open is exactly what they're selling.
American problem is credit they spent too much of what they don't have to live beyond their means and spend the rest of the life paying it off so do not have savings. The 25% extra that indians are saving is the 25% that american are using to pay for their education, healthcare and car loans etc.
I was annoyed reading the RISC-V docs and seeing that they allow implementations to go either way. Sometimes it's better to just make a choice and tell people what it is.