skysight-inc/HackerNews huggingface dataset:
It would be interesting to know the interaction between the patched host and the patched guest. As a simple example, if the host aggressively flushes the TLB, the performance impact on the guest of doing the same could be lower. On the other hand, depending on how the host was patched, the loss of performance of the guest could be different when using some features.
FreeBSD Broadcom WiFi improvements
Interesting reading:

https://iot.stackexchange.com/questions/2382/is-the-amazon-e...
I comparison shop EVERY item I purchase. I used to be a hardcore shopper on Newegg, Amazon will consistently beat them. Newegg went down that messy third party route, and it's been a disaster ever since. The shipping is hit or miss, Shoprunner is rarely supported since they began offering their version of prime, whatever it's called. I have "Keepa" notifiers on everything, and catch lightning/warehouse/price drops on everything. I'm definitely not going to go digging around Walmart/Target daily for $5 BluRay titles.
At this point, what messaging app is truly OTR? Signal doesn’t allow third parties to build the source, Telegram is compromised for sure, same with WhatsApp.
God damn it, this was smooth to get working. Only got some odd error regarding the tag writer on vorbis, but not a major loss. Had it been a GTK based project i fear the number of "esoteric" sub-sub-sub-dependencies i would have had to track down...
Reasons to exercise that have nothing to do with abs
What do you mean by "game network servers tick the network"? Like data going server -> client ?
The more-fool-proof option for any distributed storage system is to not deploy multiple package upgrades across your entire fleet without any testing. This entire problem would have been avoided (for any distributed storage system) if they had first tested the upgrade on a single server before rolling it across their entire fleet. If you've got different code sitting around on disk ready for a surprise upgrade whenever something eventually someday gets restarted, you're going to be in for a bad time.

> It turned out that all three systems had been updated a few times without restarting the OSD. No OSD could start anymore. We kept the last two OSD running (this turned out to be a mistake). The file servers, running Gentoo, also had a profile update done by another administrator.

If you don't have the resources to perform safe upgrades, the fool-proof option is to pay a vendor to run your storage for you. I agree that if you want to run a reliable distributed storage system, you need a professional sysadmin who has enough time to maintain it safely. I further agree that if you don't have any professionals who are funded to dedicate at least some time to this, you'll probably have a lot less failure by just running a big dedicated node providing NFS, iSCSI, SMB, or whatever.

I can't think of any software that I'd call fool-proof under "We've upgraded multiple versions without any testing, we have no systems in a known-good state, and we don't have any way to actually revert back to a known-good state".
This reasoning is wrong to me. I see this very much as a problem with using usernames to refer to repositories in the first place, not with username reuse. For heaven's sake, let me just refer to a repo by a unique ID of its own. There's no reason for the username to be in the repository URL.
What worked for me with volunteers and paid sysops: Monitor changes in a cronjob, mail diffs to every sysop involved. Someone usually spots that only the live fw rules have changed but not the config and after a few (friendly) applications of the LART people tend to be more careful ;)
Your problem is isolated to local development servers, which can be easily excepted from blocking non-HTTPS sites. The potential privacy/security gains totally outweigh the inconvenience of seeing "Not Secure" in the URL bar of your browser on an app you are developing.

This isn't as big of a problem as you'd like to believe. IMHO.
This seems akin to a new server receiving an existing IP address. If I ssh to that IP address after the change, it tells me the server's fingerprint has changed and I have to make an explicit choice to trust the new server. It seems like this could be made to work similarly.
> Dealing with all the poorly written libraries, unpredictable bugs and shitty APIs

Those things don't bother me - to me that's the fun of it (well, ok, not the shitty APIs, but the uncertainty and the whole constant exploration and discovery aspect of this profession). What does bother me is the expectation that I ought to be able to predict down to the hour how long something should take - even by people who ought to know that I'm dealing with so many poorly written libraries, unpredictable bugs and shitty APIs as to make that impossible.
You can use tools like glide to lock in a particular revision, like package-lock.json with NPM.
I don't completely disagree with you, but software development as a job is not purely based on how talented of a coder you are. There are many, many other aspects to the job that really have nothing to do with computers/computer science.

Don't discount your other abilities that much.
So... they allow account takeovers without any grace periods? Amazing.
I agree, or at the very minimum it seems like you'd need to fork every repo you wanted to use as a dependency that way.
You're right, them having debt like that means they're more likely to stick around (because they can't afford to quit). But it also means they could be more mercenary (seeking out the jobs that get them out of the debt, or let them keep spending themselves into debt).

Debt also puts people into compromised positions. Having worked around defense stuffs, that's an exploitable position. And people will exploit it. It's not just for government secrets either. Working on a corporate X project to make the latest and greatest self driving car? Have 6- or 7-figure debt? Someone may slide up to you in a bar and buddy up, take advantage of the desperation and get you to compromise your employer's secrets. For athletes, this means getting asked to throw games and underperform.
Isn’t this the developer’s or Go’s security issue first before it’s a GH facepalm? GH doesn’t make any representations about the provenance or the safety of the code on their site. It is the user and toolchain that’s making those potentially dangerous assumption, no? Doesn’t blocking id reuse open them up to a kind of ID squatting and DOS?
Signal isn't xmpp based?

Jabber is xmpp.

Not sure about WhatsApp.
Also worth mentioning that whatever is slow, profile it to find out why. Sometimes only the smallest tweak is necessary to get it up to speed again. (Different tweaks for different configurations, so can't be a default.)

For interactive use, profiling is as simple as M-x profiler-start, doing what causes the slowdown, and then M-x profiler-report.
My echos answer the TV all the time whenever it hears phonemes remotely similar to Alexa like "electric". Amazon doesn't allow users to set their own arbitrary wake words, which would fix the problem, and the only other two wake words they allow, "Echo" and "Computer" are much more common than Alexa so they're useless.

I also have a Google Home and it never, _ever_, answers by accident. "Hey Google" doesn't sound like other phonemes. Simple as that.
Nice. I rarely use window functions and find them a bit arcane. This was really accessible.
I agree. Surveillance in the US is by no means as bad as it is in China. However, consider that the NSA intercepts all Internet traffic, excerpts and indexes the data, and makes it available through a Google-like interface.

But they claim that there's no substantive surveillance until some human queries that data. Arguably, even AI processing would not be considered to be surveillance.

And sure, they claim that they're not looking at traffic between US citizens. However, there's the SOD program:[0]

> The unit of the DEA that distributes the information is called the Special Operations Division, or SOD. Two dozen partner agencies comprise the unit, including the FBI, CIA, NSA, Internal Revenue Service and the Department of Homeland Security. It was created in 1994 to combat Latin American drug cartels and has grown from several dozen employees to several hundred.

> Today, much of the SOD's work is classified, and officials asked that its precise location in Virginia not be revealed. The documents reviewed by Reuters are marked "Law Enforcement Sensitive," a government categorization that is meant to keep them confidential.

> "Remember that the utilization of SOD cannot be revealed or discussed in any investigative function," a document presented to agents reads. The document specifically directs agents to omit the SOD's involvement from investigative reports, affidavits, discussions with prosecutors and courtroom testimony. Agents are instructed to then use "normal investigative techniques to recreate the information provided by SOD." DEA even has a history of SOD online.[1]

That is, parallel construction. And given the secrecy about SOD-based evidence, we have no idea how widely it's used. Potentially, the full power of the NSA could be turned against anything that federal investigators consider as legitimate targets.

I could go on at length. And I won't. But consider the situation at the Mexican border. Consider surveillance around presidential conventions, WTO meetings, etc. Consider reports about Stingray units cited near USCIS offices. And those surveillance aircraft circling over areas of interest.

Sure, things aren't "as hopeless in the US as in China", but they're getting there in some ways. And all it would take is some serious crisis and drama, real or manufactured.

0) https://www.reuters.com/article/us-dea-sod/exclusive-u-s-dir...

1) https://www.deamuseum.org/wp-content/uploads/2015/08/042215-...
Maybe desperation? Previous generations could, depending on how far back you go, rely on a job for life, an affordable house and a pension from their employer. Take literally all of that away and add a huge student loan and maybe volatile investments start to look like the only way to get ahead.

At the very least I can image they trust older people much less then we did when I was younger. (Gen X)
All of the good Asimov books are in his first 100.
“Optimally Vague” Contracts and Their Benefits to Society
Ask HN: How did Facebook track me across device, ip, and browser?
The other day, I opened up incognito on my iphone connected to LTE, searched for a company on google, clicked on the first link. I then go to my laptop connected to a wifi network, refresh my FB newsfeed and see an ad for that company on my newsfeed.

Just to be 100% sure, I did it again with another company, refresh newsfeed, and see an ad for that company almost immediately.

How is Facebook tracking me? My thought process goes like this:

- can't tracking by IP because the devices were on different networks

- can't be cookies (or super cookies) because different devices (also incognito)

- unlikely based on location because not precise enough with LTE

which leaves:

1) browser fingerprinting on my mobile phone linking me to an identity and that data is fed into Facebook in real-time?

2) My cellular provider is funneling data to Facebook?

Am I missing something?
>I'm only a hobbyist programmer myself.

There's also a very important point to be made here. Large-scale software development and self-directed programming have very, very little overlap in terms of time allocation and mental effort. To exaggerate the difference somewhat, it is like comparing building a go-kart in your garage with designing a factory that produces commercial, road-ready cars.
Deflation decreases the velocity of currency (less incentive to spend due to rising value), which is bad for the economy (less activity, so fewer job opportunities, leading to even less activity).
> What does "critique it creatively" mean?

I assume it means to critique it using modern interpretive dance.
In the article,

> Why most of the fitness industry tries to sell you on abs is beyond me.

That's because most of fitness industry is superficial and trying to sell an image of being sexy (which 6-pack abs or flat abs is sexy by consensus).
You're right, this is a tweet about part of a conversation where not even the author knows what the other party knew.

For example, it could be the author PM'd another journalist about an event, and the 3rd party then posted it publicly. Or they just ratted her out to the feds. Who knows?
The more i read and discuss money, the more i loath the terminology of "good" and "bad" money.

This in that the supposed "good" money is money that incentivize hoarding, while "bad" money supposedly incentivize spending.

The use of good and bad is loaded to put it mildly, and plant a bias in the reader.
Hear hear! Fixing the real problem.
"The compensation is not based on how hard the job is"

Well, yeah. That's what I'm saying. And so is the original article.

"...so it doesn't matter."

This does not follow. Maybe it does matter, but the market is irrational. For example: maybe there are a lot of highly-paid, under-utilized software engineers sitting around FaceGooAmaSoft, because FaceGooAmaSoft are terrified of what those people might do, if they weren't twiddling their thumbs and enjoying complimentary massages while eating catered lunches.

"There's a limited amount of people that can do programming, but also limited amount of people that can do safety-critical engineering. Perhaps there is some overlap. But can you engineer a bridge that's used by a billion people every day? Probably not, hence the salary differences."

Prove your claim. Most programmers making big salaries are affecting maybe hundreds of thousands of people a day, at best. It's pretty rare to find gigs where you affect even millions of people a day. Even inside GooAmaFaceSoft, those are coveted positions, with lots of cookie-licking and internal politics.

It seems more plausible to me that the market is where it is because of deep pockets and a willingness to engage in defensive spending, more than any kind of individual productivity. But yeah, this isn't an argument that is going to flatter most HN readers.
> I, for one, am excited for the moment a cryptocurrency arrives that is actually usable for its supposed use.

Well, I have this feeling with Nano. Intstant, free and scalable transactions. The first 2 are definitely there. The last one looks promising, and some load tests for that are scheduled.

That the entire network should be able to handle 7000 tps with the power of a single windmill is also cool.

To me, this is potentially the internet money that was promised with bitcoin.

I noticed sometimes these posts get downvoted, so here is an interview with the main developer. Decide for yourself: https://youtu.be/hAy4GDV7tvQ
Exactly. I was living in the UK at the time and it remains the only time I've ever made any money playing forex.

It was obvious to increasingly.. everyone .. that the Bank was playing chicken with the markets.

Soros was on the winning side.
To be fair, the author says right at the beginning:

"Please remember that we are all unpaid volunteers who have our own studies and/or day jobs, and no one has had more experience with Ceph than what you get from reading the manual."

So while you might have a valid point, it's hard to develop those skills if you are not a proper sysadmin. If you are just an unpaid volunteer, it means that most likely the environment you work in can't afford (or won't pay) for actual sysadmins whose paid job is to know these things.

Maybe the discussion should be, why were there unpaid volunteers doing sysadmin work instead of an actual sysadmin, but I guess that is a normal occurrence in universities all over the world?
Ask HN: How do you assess teamwork skills during interview?
The standard technical interview process: 4 technical interviews that cover data structures, algorithms, system design, etc., with perhaps a conversation over food, is not enough to assess how well a candidate would fit into a team.

Do you disagree with this premise? If so, why?

How do you gauge team skills during your interview process? What do you look for? How has it worked for you?
Do you think Chinese residents have an expectation that snail mail is private from the government?
> That's what I've done. Hardware RAID + XFS + NFS + backups, done. It wasn't HA, but at least I understood how to get it back up.

Looks like in this case you never actually needed what Ceph brings to the table - for a tremendous cost in complexity (and fragility, from personal anecdotal evidence) you can allow your dataset and -load to grow beyond the physical capabilities of a single node.

The HA argument in less demanding settings ends up being a cargo cult mostly. Your setup will probably produce higher reliability figures than running Ceph, assuming the lack of some serious engineering capabilities.
This reminds me about the whole `left-pad` fiasco and npm allowing same-name packages to be re-published. For a while I thought that the packages were hijacked [1].

GitHub should definitely not allow username reuse, but most prominently it's a Go issue, where they use GitHub as a package manager.

1 : http://www.drinchev.com/blog/alert-npm-modules-hijacked/
Hygen – The scalable code generator that saves you time
> but a GitHub URL is not a secure package identifier, it was never designed this way, and it's an unfortunate hack that it's become a defacto standard.

Thank you. GitHub shouldn't be the only line of defense between a malicious coder and your software.
I don't buy the argument that rich black kids commit crimes at higher rates. White and black people smoke weed at roughly the same rates, yet black people are far, far, far more likely to be prosecuted for it.
Nobody said that Google expected to win the case.
Another reason to always vendor [1] your dependencies...

[1] - https://github.com/golang/dep
I believe it is the over prescription of anti depresents and other medications that lower libido.
I had one earlier this week call my phone repeatedly before 6 AM (breaking through the "do not disturb) to complain he couldn't find one of my packages in his car.
here's one reason:

`git clone some-user/some-repo`
I've been in Seattle for around a month and can completely agree with this. One time half of an order went to a wrong apartment, and the other half came the next day. UPS and related have access codes to get into the building where Amazon doesn't. Having free same day delivery is a life-changer, but Amazon needs to improve a lot.
Paradise OS
I was curious about market cap to twitter followers or posts in https://bitcointalk.org.
There's probably someone who posts this comment every time this article comes up, but:

#![feature(test)]

extern crate regex;
extern crate test;

use regex::Regex;

pub fn check(pattern: &Regex, input: &str) -> bool {
pattern.is_match(input)
}

#[cfg(test)]
mod tests {
use super::*;
use test::Bencher;

#[bench]
fn bench_check(b: &mut Bencher) {
let n = 29;
let pattern = Regex::new(&format!("{}{}", "a?".repeat(n), "a".repeat(n))).unwrap();
let input = "a".repeat(n);
b.iter(|| check(&pattern, &input));
}
}

And then:

$ cat rust-toolchain
nightly-2018-02-09
$ cargo bench
Compiling void v1.0.2
Compiling lazy_static v1.0.0
Compiling regex-syntax v0.4.2
Compiling libc v0.2.36
Compiling utf8-ranges v1.0.0
Compiling unreachable v1.0.0
Compiling thread_local v0.3.5
Compiling memchr v2.0.1
Compiling aho-corasick v0.6.4
Compiling regex v0.2.6
Compiling regexps v0.1.0 (file:///home/twic/Code/Regexps)
Finished release [optimized] target(s) in 20.11 secs
Running target/release/deps/regexps-9c084e63d7d31ac3

running 1 test
test tests::bench_check ... bench: 212 ns/iter (+/- 8)

test result: ok. 0 passed; 0 failed; 0 ignored; 1 measured; 0 filtered out

Rust's standard regex library isn't the fastest in the world, and the lack of backtracking can be limiting, but it is highly optimised for Rust's main use case of posting showoff comments on Hacker News.

I also tried this in Java (OpenJDK 1.8.0_161-b14), and it took about 24 seconds per iteration at 29 characters.
> Please put a global header on your blog that says "X is a Y that does Z."

Product blog operators, please label your spam as spam. I presume this was posted by Godfrey Chan (http://www.tilde.io/about-us/), an employee of wycats's company.
The usual traditional backwards compatibility story of Java, if I remember correctly.

When it was introduced they didn't want to break the L&F of AWT applications, then they also added multiple ways of enabling it.

So a good application should respect the system wide or user specific settings if available, instead of just blindly use whatever L&F it feels like.

Also although many complain about how Swing looks like, the API is actually quite powerfull and skinnable, even if it requires some graphic programming skills to achieve it, for example see JGoodies or UltraMixer DJ.
What syscall rates do different databases sustain at maximum load? Transparent huge pages negating most of the overhead is very good news-- but probably helps less with mmap'd IO which so many databases use.
That doesn’t really work; it would be like a human trying to acquire resistance to being riddled with bullets. Strong UV is more or less a sort of machinegun if you’re a microorganism. You can produce more of your existing defenses, but it will be so far from what’s required to gain a reproductive advantage that you won’t evolve.

Maybe you could induce resistance to very brief exposure, but that’s it.
Thinking on this further, the storage one makes sense for secure contexts, because allowing that for insecure contexts would mean that by spoofing the DNS of a site, I could steal its information. I'm not certain how secure the data that you store would be, but if it were, say, camera footage or something, it would be possible for it to be extracted from the user's phone by a malicious website out of your control.

I don't know if this problem is soluble -- at least a self-signed certificate would mean that the certificate would have to be exfiltrated in order to do this, assuming the browsers key the indexedDB to the certificate fingerprint, which would indicate a degree of compromise that most likely means that the data could be stolen directly from the device.

If you don't mind being more specific, what kind of data would you be storing on the phone? Is it just for caching purposes? It seems like it might be better for the data to be fetched from the device on demand rather than stored on the phone, even if this causes a performance hit, to avoid the possibility of leaking the data to untrusted parties.
It’s been speculated by researchers that the therapeutic effects we are seeing may in fact be due to a physical change - specifically potent anti-inflammatory effects of 5ht-2a agonists, though this has been confirmed more for other psychedelic drugs such as DOI, at non-psychoactive dosages (and in rats) [1].

Hence the psychological narrative may be backed by an actual psychiatric, physiochemical change. An actual change, in “reality” - in other words, assuming some form of inflammation is involved in most depressive states...

[1] DOI: 10.1371/journal.pone.0075426
https://www.reddit.com/r/NeutralPolitics/
This is package specific. pgAdmin is a separate project. There are other tools out there (there is a recent Show HN thread for a macOS client and the comments include other tools), though to be honest I use psql almost exclusively, so I'm not one to ask for recommendations.
How do we know what she says is false?

How do we know that she is a person?

How do we know that China is a country?

How do we know what a tweet is?

You're right. There are many assumptions we can make here. Can you say why you chose that particular point of abstraction?
Hey! Did you try to send yourself a test e-mail? What you are talking about is not actually what we are trying to solve :) But thanks for your comment, we will keep trying to make our idea clear for everyone!