skysight-inc/HackerNews huggingface dataset:
Ask HN: How to escape my own zombie startup?
I’m the CEO/founder of a zombie startup. We’ve taken significant funding. We break even every month. Growth is flat. Scale is in the millions. I have lost passion for our business and I don’t believe in what we are doing anymore. I dislike going to work. I’ve started disliking even people I work with. We have not managed to sell for enough to return all investor money. Our team is specialized in what we do so a successful pivot is extremely unlikely. I can’t find anyone to replace me fast enough. I can’t just leave suddenly unless I want to f over all our shareholders. I do not want to do that. (I recognize staying in this state is f’ing over in a different way)

SOS. Have you been in this situation and how did you GTFO successfully? How long did it take you?
I'm impressed with the guy's honesty - he stopped after finding only a few coins and phoned the police and local archaeological society. I can imagine it would've been tempting to scoop it all up and try to find a buyer. I'm glad he was rewarded for leaving it intact, and that he split his reward with the farmer.
Consider subscribing to the weekly email newsletter of the most upvoted posts [1], or finetune an RSS feed [2] (you can filter posts with 100+ upvotes for example, or only Show HN posts, or whatever).

If you're using mastodon, you can follow my HackerNewsBot [3], or the same thing on twitter [4].

[1] https://hndigest.com/

[2] https://hnrss.org/

[3] https://mastodon.social/@HackerNewsBot

[4] https://twitter.com/newsyc100
it'll either NOT happen, or if it does it will probably be in ages.
I love this. You know I really would like to learn some coding, so I think I would like to go with number two. Yet, I agree that ultimately it goes to JFGID.
Also encryption:

> The first byte of the clear data was a flags field which, he said, was promptly ossified by a middlebox vendor, leading to packets being dropped when a new flag was set.

[...]

> The only defense against ossification of network protocols by middleboxes, he said at the conclusion of the talk, is encryption.
How to Visualise a Kubernetes Cluster
This small electric car made by GM’s Chinese joint-venture can cost just $5,600
DarkID: A PoC of an anonymous decentralized ID system based on blockchain
Well, it shows that Google can develop a new transport layer protocol over UDP.
Defined as "able to be used for a practical purpose". Yes, companies need those apps and web pages and what not. They also need data analytics and what not.
Angular Typescript Weekly Newsletter #44 – Schematics – AngularFire – Debugging
Every IV carries the risk of thrombosis. So I would avoid it, if I can.
Isn't it obvious? For which reason, if not tracking and information gathering, would such a feature even exist?

Best solution is still to block Facebook's infrastructures, as always.
>You also could stop misusing the browser as an application frontend, and write a proper frontend with a cross-platform toolkit, and distribute that.

This is pure insanity. There are tons of applications built on the web stack now that are supposed to run on local networks. There has never been a requirement that "Network == Internet".

For example, enterprise software. Dynamics CRM? Dynamics NAV? Dynamics... anything? Sage CRM? Everything runs on the browser now.

Why would anyone pass up a gigantic, proven, powerful software stack that represents >90% of all applications in the world?

The error is in the stack, not that people would want to use the easiest, most powerful tool for the job.

We might as well be advocating to go back to FoxPro.

>For the first, just tell the people to get proper devices.

It must be super nice to live in a world where you can dictate what devices the clients use, as opposed to a huge investment of pre-installed devices, or, devices users bring from home.

Whatever job you've got, I want it. Because it's completely alien to my career experience.
Awesome app!
The problem here isn’t really middleboxes - it’s that people who build middleboxes tend to break protocols. The flags field is specifically designed so that you can add stuff to it - if the middleboxes were to be built properly, they would fall back to “don’t touch anything” rather than “break the connection” when they don’t understand what’s going on.

Middlebox vendors brought this upon themselves.
There's a few reasons for that. One is that they take their existing profit margins and incorporate them as "cost" - and these margins are really very comfortable.

Another is that it's not the cost of one article, but also of every article they have had to reject instead of that one. That number is pretty high for Nature (the journal).
Heads up to the lazy folks: the article is much shorter than the scroll bar suggests.
On the contrary you are taking ambicapter too literally; I can only assume they meant they'd prefer building ice skates in the metaphorical sense -- they'd rather build for a new desire, than create a solution for a known problem.
The earlier de Havilland Comet was also incredibly beautiful and made by innovative woodworking techniques: https://en.wikipedia.org/wiki/De_Havilland_DH.88_Comet?oldfo..., one of my favorite planes ever.
Seamless REST interaction for Redux
In that case the ISP would be inducing the user to install malware. If the ISP is willing to do that, then you should probably view them as malevolent adversaries in your security model. I don't really think that an OS can protect against this in any reasonable way if that OS allows users to update certificate stores themselves. I don't really view this as a problem with the certificate model as opposed to plain old social engineering.

In any case, I don't think "an ISP could inject their own certs very easily" is a fair characterization unless you put it on the same footing as "anyone with your email can get people to install malware easily".
Peer reviewers are not usually compensated.
I do think there is a difference, but they are aspects of the same thing. One significant difference is that in the classical limit (ie taking the limit hbar -> 0) non-linear Compton scattering doesn’t produce energy loss for the electrons. The classical limit of radiation reaction (ie n photons scattering of an electrons m times) does produce energy loss (because the loss per scatter scales like hbar but the number of scatters scales like 1/hbar). The sentence you quote is about the energy of the photons produced (which determined by Compton scattering) but the energy loss of the electrons is what we call radiation reaction.
In the UK, up and down are terms used by the railways. The up line generally heads towards a big city (London for much of the UK), and down heads away. Seems like this is the case in some other countries too:

https://en.wikipedia.org/wiki/Rail_directions

To some extent the terminology has crept into general use. I grew up just north of London, but we always went up to London.
<rant>
Shocking!

Abuse of power and shady tracking techniques by Facebook? Unheard of!
</rant>

Seriously, this cannot be surprising after learning that the Messenger app listens to everything you do, all the time. That's just off the top of my head. They are doing this and much more.
Elbakyan says so herself as well: https://twitter.com/Sci_Hub/status/961829490803449856

And she'll go into more detail later: https://twitter.com/Sci_Hub/status/961836113731072003
It's not a problem if you can keep them updated, but that's not usually what happens.

Network equipment often keeps running in the closet without updates for 10+ years. That's the part that isn't working well.
SQL is a declarative language not a procedural language.
I wonder what is the real difference between QUIC vs SCTP-over-UDP?
Interestingly, note that TLS 1.3 is not going to make things better as it is jumping through hoops and hoops just trying to conform to every little quirks middleboxes can have.

I'm wondering if the IETF should have taken another route to force middleboxes to be more flexible in the future?
Reduces soldier casualties, increase civilian ones.

It's pretty disgusting when you actually thinks about it. I don't want bad newspaper headlines about soldier deaths, so I'll use a robot that kills a bunch of civilians as collateral.
Not really. I did the math in the past because I seriously considered moving to the US cuz I got an offer there. In my estimates, you would end up spending the same % of your salary in surviving, but of course the remaining let's say 30%, is simply a lot. Also a lot of things are not really that expensive (most things that are not housing, or maybe eating out.) And when you get out of the Junior level, I think the difference between SV and Europe becomes abysmal.

Also, "Europe" means many things. I am talking about Berlin here. I also know other places, like Madrid, where you just simply earn pennies in comparison so the difference becomes even higher (Madrid is more expensive than Berlin, earn less)

I still decided to stay here though (because of quality of living, work culture, music and partying, politics).
As the crypto-asset world keeps warning newcomers: Don't keep assets in exchange-hosted wallets for longer term holding. Move them to a wallet under your own control. And back it up really, really well.
I have similarly started coding at around 12, and now I work as a C++ programmer in games....and love my job. On the other hand, I get paid peanuts compared to literally any other industry. But then all of my programmer friends who work in other industries(and frequently make 150-200% of what I make with the same level of experience) hate their jobs with passion, every time we meet it's just an endless rant on how the job is shit, the managers are idiots and customers don't know what they want. While I look forward to going to work in the morning and build stuff that gives me and others joy, and my managers are also cool. Is that worth dismissing for a higher salary? I don't know, I haven't decided yet.
While I think you are correct in that IP seems more stuck by middleboxes (SCTP is unreliable), I think any protocol whether it be over UDP or TCP can be subject to ossification. QUIC seems to have some useful properties to prevent this, such as the headers being encrypted. I could imagine alternative UDP protocols not doing this and causing more ossification.
Well done!

Now I wish I had something as fancy for my meek Linux box.
It doesn't need it. You can always just nmap your network, find its lan ip and connect straight through that over http. But that's not very user friendly, hence the dyndns.
I said it's readable, but it's just some simple translation. C still has all the issues of having to write assembly, so a C programmer should have to check if its C code is not doing anything unsafe, like an ASM developer would.

Programming is not easy, and it always has been a minefield. You cannot write good code quickly. Even learning rust will have a cost, although it's a worthy cost. Writing unsafe code is cheap and was often a good enough solution.
Apart from the personal anecdotes by people, it also allows university negotiators to take a tougher stance when negotiating prices with the traditional publishers, as their threat of cancelling subscriptions has become more credible. This has been most noticeable in Germany, where universities have come together in Projekt DEAL through which many have, this year, cancelled their Elsevier subscriptions [1]. The Dutch are likely to follow [2], and several rumours of other countries have surfaced as well.

[1] https://www.projekt-deal.de/about-deal/
[2] https://www.scienceguide.nl/2018/01/we-are-prepared-for-a-no...
> So yesterday we figured out that facebooks Facebot crawler will crawl _every_ url that was recorded by their tracking pixel.

Not surprising at all. Would be interesting to see a write up on this.
> 1. they are crawling potentially sensitive information granted by links with tokens

Don't put Facebook tracking on sensitive pages. Actually as a service to your users don't put it anywhere where it doesn't add value.

> 2. they are triggering potentially harmful and/or confusing actions in your website by repeating links

They only perform idempotent[0]* requests which should not have any negative effect if performed multiple times

0: http://restcookbook.com/HTTP%20Methods/idempotency/

* They probably only actually perform GET in reality
> they are triggering potentially harmful and/or confusing actions in your website by repeating links

Not their fault. GET requests should not modify anything.
The UI looks nice. Is there any plan for Linux version?
Let us know how a passport.js hiring filter works out long-term.
Wight Loss to Maintain Physical and Mental Fitness
Problem is, most services seem to be designed to interact in the absolute minimum. I use IFTTT myself, but just look at the integrations available! So little of them. 90% of times I have a flow idea, it can't be done with what's available.

(Come to think of it, I have a spare VPS, maybe it's time to try out Huginn.)

RE Alexa, call me a whiner, but "Alexa, ask $BrandApp to XYX" ruins the immersion a lot :(.

Ultimately, the problem is control. On-line services control both your data and how you work with it - from the flow of actions to UI[0]. An interoperable world requires vendors to give up a lot of that control.

--

[0] - They control the entire experience. As if they were a fucking Disneyland, not just a hammer, from users' point of view.
I disagree, it's not at all obvious. Pixels are used for conversion tracking (cookie pixels/cookieless pixels). Crawl isn't necessary for a pixel to function.
As for your second question: please no. Of every 200 PhD students, only one ends up becoming a professor. Science is attractive enough as it is, despite pretty much every aspect of it (pay, overtime, job security, etc.) is abysmal.
Amplemarket (YC W14) Seeks Sales Manager to Lead Lisbon Office
Amplemarket.com is a Y Combinator-backed fast-growing tech startup with headquarters in San Francisco, and Lisbon, Portugal. We are looking for a Sales Manager to join and lead our team in Lisbon.

We are looking for someone driven that is willing to take on the challenge of helping us build and expand our team in Lisbon. That person will be the founders' extension in Portugal.

This is a unique opportunity to work with a team of MIT-alumni that built other great projects like fermatslibrary.com.

If interested, please email team@amplemarket.com.

Requirements:
- Previous management experience
- Be driven and curious
- Responsible, organized and detail-driven
- Be a problem solver
- Fluent in English
- Flexible working hours (our working hours are from 11 am to 8 pm GMT)

Perks:
- Join a fast growing startup
- Opportunities to grow within the company
- Competitive salary
- Bonus based on performance
- Annual paid trip to headquarters in San Francisco
Let's maybe hope that they'll make an exception for the RFC1918/4193 ranges. Of course, the other side of the coin of is that even a "private" network could be anything from your private home to your workplace intranet to an airport wi-fi hotspot, and can't be assumed to be safe from snooping/injection.

As for your particular hassle, it makes sense to me for a browser to mark sites that mix http/https as insecure from the point of view that once the data is on the plain http page you can no longer be sure that it won't be handed off over an unencrypted connection some place else by some rogue javascript.

Perhaps a rather drastic change like this will lead to more user friendly ways to install self-signed certificates on home networks. Say, a method for routers to discover certificates announced by devices on the network to list them in its management interface where you can enable or disable them.
The beauty of it is that UDP is not even really a protocol, it's just a few additions (sport and dport) on top of IP. The RFC is only 3 pages long. So it's not like UDP is going to get in the way of your new protocol if you design on top of it.
They're ultimately limited to which SaaS lets them, which is usually not much. For many, deep interoperability goes against the core objective of "engagement" (i.e. trapping the user in the service for as long as possible).
I assume the crawler only does HEAD/GET-requests
Your fault if your webpage changes anything based on a GET.

Now, if the crawler doesn't honor robots.txt, then you can complain (loudly).
Up / down is not confined to Texas. Think upstate NY.

Out and over is pretty cool though.
I can imagine the effects of false positive on birds will be interesting to watch
I'm guessing QUIC integrates better with HTTP/2?
There is only one definition of the word “useful” that applies across the entire field: one whose output generates revenue for the company.
This is borderline criminal. Practically CSRF attack.
I looked for this some time ago, but IIRC there's no third party implementation that does that. e.g integrating quic-go and grpc-go
is this the same crawler they use for external links ? if yes you can exclude them, their User-agent id is "facebookexternal"
That's to bad. Last I heard of it (which admittedly has been a while) it seemed like they made useful progress.
Where did you get 443 from? AFAIK even Google aren't using that. I didn't think there was any standardized port number at all
Not native, but essentially, ここ is here, as in something close to the speaker, そこ is there, as in something close to the listener, and あそこ is there, as in something that is neither close to the speaker nor close to the listener.

Now imagine a variant of https://www.youtube.com/watch?v=9m-kbBamg_U with the 3 words.
> Twitter without replies or retweets would be considerably better.

Twitter started out without replies and retweets. Both features were initially invented by users and only added to the UI after their use was already widespread.
David Benjamin has proposed the GREASE proposal for TLS. Basically, random values of future flags are thrown around so that servers (not middleboxes) have no choice but to process them. I think it is a good idea, but there are still occasionally niggles such as certain machines processing different meanings for specific flags, causing them to not be able to speak TLS 1.3.
My take-away from the article is actually "encryption as a solution to protocol ossification". If some data (headers, etc.) is available as clear-text, there will be routers that act on it and possibly misbehave or block traffic when they encounter new patterns.

So the article suggests that making it impossible for routers to inspect any protocol-specific information (via encryption) helps with this problem. Routers can't act on fields they can't read.
[disclaimer, work for Digital Science, whose parent company owns the parent (or just merged?) company that produces Nature, my own thoughts etc.]

Nature have paid editors who also review articles before they go out for peer review, which means they have fairly obvious costs per article submitted (on top of other things like organising peer review). However, you don't pay to submit, you only pay if you're accepted. Nature accepts, I think, about 5% of the articles submitted to them. That means that for every fixed cost per submission the cost per paper published is 20x higher.
I also use Pocket, but when the list grows to be too big (around 10 items or so) then I will not consume any more articles by way of Feedly or Hacker News until the list is groomed.

I find this to work well for me as I have an incentive to keep my Pocket empty or at the very least not overwhelmingly filled.
What's the issue with people making their own space look like Geocities if it's what makes them happy and is how they want to express themselves.

Would also like to point out that customisation on MySpace is probably responsible for a whole generation of not only developers but non-tech focused people learning how to code. Met a lot of artists and designers who now work on the internet who MySpace was the starting point.
The Black Panther’s scientist role models
Native French here too, except I use "à" more often than "sur".
Even if that's what they're "supposed to do" (and I do agree to some extent that that holds for Elsevier), that doesn't make them a Good thing. Doesn't make them evil, either, but when any alternative is likely to be better, I won't shed a tear if they go away.
Seems like a very expensive solution to a very cheap enemy.
Hence why I said de facto. Especially in the case of ride-sharing.
Global Mobility Index
If security of sensitive information depends on tokens in the URL, don't just give those URLs to a third party, how would that ever be a reasonable thing to do? (especially since the third party apparently hasn't given you any guarantees on how they treat that, otherwise we wouldn't be having this conversation?)

Do your users, your broken software and yourself a favor and don't put Facebook tracking crap everywhere.
Measurement problem is a problem of our understanding of the quantum world, but otherwise a feature of the entire universe, not a human limitation - and definitely not a license for magic under the hood.
https://whoneedsaccess.org/

Also consider that of every 200 PhD students, only one ends up with tenure. That means there are a lot of former academics out there.
There are UK treasure trove laws that requires a split I believe.
Slightly OT, isn't that Monty Python movie ageless?

In fact, like good wine, it only gets better with time. I gave The Life of Brian another view earlier this week (it's on Youtube!) and was awed by its prescience.
So basically people who don't know how to search or use forums?
I know a database that's using InnoDB tables but also has no foreign keys and, indeed, JOINs are forbidden.

(And yes, the workflow does include actions that involve multiple tables in one go.)
Top 10+ ICO Marketing Agencies
I don't mind Facebook crawling pages as long as it respects robots.txt, but for the last few weeks we've been hammered by requests from Facebook-owned IP addresses (millions of hits daily, 50+ for the same URL at times). They don't even set the User-Agent header.

There's a bug report regarding the missing header here: https://developers.facebook.com/bugs/1654459311255613/

Unfortunately it seems impossible to get in touch with Facebook devs directly.
Then use a provider that makes it easy. My point wasn't that it's easy everywhere, just that for simple static sites you can just use a provider that makes it easy for you.
https://downloadidm99.blogspot.com/
Download IDM Full Version

Thanks!
Thanks, that's really interesting, including the Criticisms section. I think that there must be a mix of psychological and physiological factors at play.

Not sure how directly relevant this is but I used to get dead-tired if I had any less than eight hours of sleep. I had spent most of my life hearing about how I "needed" at least eight hours. Then I had a period of insomnia where I would regularly get three hours a night which challenged this deeply-held belief. My functioning was impaired, of course, but it was comparable to how I functioned on 7 hours of sleep prior. Now I can sleep six hours a night without problems, having broken through some psychological barrier.
Indeed. It seems header encryption would be a good start. David Benjamin has proposed the GREASE protocol, but I think that is only for servers, not middleboxes.
TCP and UDP are "IP protocols" in that their packets are nested directly inside an IP packet and they have associated protocol numbers [1] to distinguish them from other things that might be inside an IP packet. QUIC theoretically deserves to be one of these too but for pragmatic reasons it has to be nested inside UDP. GP is asserting that `-p quic` will not be implemented, because it would be a layering violation.

[1] https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
Classical radiation reaction was predicted in the early 20th century. I think that quantum theories for radiation reaction in with non-relativistic particles in weak fields has been around since the 1960s. The “hard” bit, that is currently an active research area, is the interaction of relativistic particles with very strong fields.