skysight-inc/HackerNews huggingface dataset:
Ask HN: How to collaborate on small projects?
I want to improve at collaborating with less skilled people. In school projects, I often end up "hijacking" the project writing most of the code on my own. Not optimal.

I have been thinking about delegating interfaces that we implement independently. But, in a dynamic project where interfaces get outdated, careful planning often comes off as a time sink. It gets especially difficult to motivate (and carry out) when the project is small.

Also, pair programming tends to result in me just giving instructions on what to write - line by line.
The "Publisher" stories I see on Snapchat are invariably stories about various Kardashian/Jenner family members or generic buzzfeed-esque millennial-targeted clickbait.

These seem very poorly targeted towards me. Does everyone see only this? Are there ways to get into different/better advertising buckets? Even something like "GQ" would be far better than the "People" content I'm currently seeing.

On Instagram the ads are targeted at things I would actually click through and buy -- lots of ads for shoes, bags, clothing, kickstarter-like items, etc.

I assume that's via the hashtags and people I follow on Instagram: cars, travel, architecture, etc. + perhaps via some creepy FaceBook magic.

Without hashtags, how does Snapchat figure out what "Publishers" I'd want to see?
To be fair, Rust doesn't solve the errors-in-destructors thing any better: Drop::drop can't return anything.
The outdoor community made water filtration a must for a reason
From wikipedia

> Space opera is a subgenre of science fiction that emphasizes space warfare, melodramatic adventure, interplanetary battles, chivalric romance, and risk-taking

> A science fantasy is a cross-genre within the umbrella of speculative fiction which simultaneously draws upon and/or combines tropes and elements from both science fiction and fantasy

Star Wars is 100% science fiction.
When I had an iPhone it stopped being usable after 2 years and the last 2 non-Apple phones I had lasted 3 and 4 years and both got replaced on my terms, while still usable. You can't just handwave and declare that Apple doesn't do a worse job than others when the evidence is mounting that it does.
I used this: https://github.com/Kotlin/kotlin-coroutines/blob/master/kotl...
One thing to remember is that Reason and BuckleScript are rather small projects, with not that many people employed to work on them. Their combined 'manpower' is not that much more than Elm's right now.

What they are cleverly leveraging is the twenty years of solid type theory (a sound type system), language design (more powerful pattern-matching, functions, syntax sugar), and engineering practice (the OPAM ecosystem) that has gone into OCaml.

This is why Reason/BuckleScript are able to punch above their weight class.
I think because the implication is that the way the transfer actually happens is: 1. Buy BTC in the right amount in origin country, 2. Transfer it to another BTC address, 3. Sell BTC in the right amount in the destination country. I believe most countries will consider the sale in step #3 a capital gain.
Yeah... It would honestly be cool to have a TypeScript native React(as crazy as that sounds). There are some really great projects out there killing it like Nest, MobX, TypeORM, etc.. The React typings have come a long way though.

I do quite a bit of TypeScript for the server though(less context switching and is mostly GoodEnough™) so still handy.
More specifically, as to the US category it got lumped in, Presidential alerts are the highest priority in the Wireless Emergency Alert system, followed by alerts for extreme then several imminent danger to life, followed by AMBER Alerts.

So, its not surprising that a top-priority message would show as a Presidential Alert in a US phone if the same basic technology and rough semantics are used.
> Shouldn't this be taught as a 'no no' in WebDev 101?

It kind of is, kind of isn't. Security approaches I have witnessed were always very cargo-culty. People were aware of the OWASP top 10 and the like and applied best practice recommendations they have read somewhere and were even written into internal project guidelines. But security was not applied holistically.

For example passwords are passed off to a library that used scrypt properly. But hand-rolled session management used regular string comparison for the token, which obviously is unsafe.
Similarly parameterized SQL queries were used instead string processing because that's the rule in the project documentation. But there were no rules about lucene queries and boom some devs started to do string processing on the queries again.
And every time I have to fight to get sane password policies. In one case they wanted to block copy&paste events in the login forms "for security reasons", but that would have made things more difficult for people who actually use password managers.

Of course not everyone is like that, it just that the 1-2 people who would know to spot such things are often tied up in organizational overhead and then things slip through reviews.
It depends on your audience.

If your audience is emotionally healthy people, they see an apology as you saying "That thing I just did? Yeah, that's not what I think normal, acceptable behavior is." That makes them more willing to give you a free pass for the time you messed up (because we all know that we all mess up from time to time).

If your audience is bullies, control freaks, and other such jerks, an apology is handing them a loaded gun that they can point at your head.

If your audience is mixed, I have no idea what course to suggest...
> We should not leave Lysenkoism a chance, even if it is in the subtleties of language.

Why, are you suggesting that if that idea is taught to this existing generation, that future generations will inherit the idea from them? ;-)
How high up did this sort of thing go, though? It seems like in more corrupt places, this sort of thing basically goes all the way to the top and the entire department is engaged in this kind of activity. Whereas here we have small groups of individuals exploiting their position in this way and hiding it from people above them. Although, if it actually is basically the same, I guess it shouldn't be particularly surprising given that the conditions many are living in are pretty "third world".
Ah, right. I guess I have seen this sort of thing in Haskell then as well. When implemented with HKTs it usually gets really messy with things like monad transformers, so I prefer to think of asynchronicity more in terms of continuations.
Do you realize how large 20 orders of magnitude would be?!
"but you're still potentially doing something worth criminalizing."

I had a bit of a think about this. We have an input field, something that invites anything that one might type into it. The input field might constrain what is typed in and the programme behind it might decide to believe the content or not.

Does the input field make it clear that it considers some sorts of input as invalid? I can't recall seeing any login related field that specified its input requirements - that is sometimes part of the "security"(through obscurity) of such things.

IT related security as it relates to logins might be unfairly compared to a front door and keys and other physical security devices. However, few of us have access to enough steel and concrete and other fancy materials for physical security to make this comparison stand. We do have access to wealth of IT security which is freely available. It is bloody complicated but freely available. You do need to be able to sift the good advice from the bad but it is available.

The final bit of the puzzle revolves around responsible disclosure. This is not something you see in the world of safes and front doors. It is an established industry practice in IT, in an industry that is very, very young but one which moves very, very quickly.

Even if the login fields specify that unauth. access is naughty I would argue that given that the tools are freely available and that any reasonably competent developer should be able to sanitise input, then you can't complain if someone types in complete crap.

IT is still discovering Engineering but it has so many more resources for instruction and guidance than bridge builders and boiler makers had in the early days and it moves so fast. Do you have any idea how dangerous steam trains were in the early days? Steam is a bloody powerful thing under pressure. Do you have any idea about resonance and concrete cancer? IT is still having its Tacoma Narrows and ... hah ... Millenium Bridge (hard found lessons can be ignored to this day) things happen.

I'm no lawyer but I suspect the world of m'learned friends will catch up eventually. Until then we will read of silliness like this.
>Still, this payload is culturally cringeworthy,

According to whose culture though? I suggest the culture of the people who built it is the most relevant one.
at the same time, it's possible for the website to do absolutely everything right and still lose a lot of information.

one reasonable solution is just to say tough luck, it's still your fault, and then every company dealing with sensitive information buys data-breach insurance, with the insurance company helping to vet and improve their systems and processes if they want. this arrangement is pretty common and i could imagine it becoming legally mandatory.

even if there's a real unavoidable zero day, still hold the company liable, make them use their insurance, and then let the insurance company sue whoever is really at fault to recover their losses.
I tend to agree - this is just the most compelling use case I've heard, despite not being all that compelling.
We want that, but we are the minority.

I do agree that PyQt has a respectable documentation page. It is, however, a terrible page for attracting new developers and selling decision makers on the idea of using it.
Is this not alike to asking me to not have the mental view of a basketball team as a coloured group of tall males? And if I had that view, then am I discriminating against short white people, or have I built a more accurate mental model of the world?
Assuming the poster is telling the truth, and they only accessed a couple other download IDs to prove their point, then they will likely be ok. But if the poster instead wrote a quick script to wget incrementally to see how high they could go, then they have gone beyond simply verifying the vulnerability.

I recall a similar case where the person who found a vulnerability in a banking site was shocked that legal recourse was threatened. They were later shown to have enumerated all possible account details.
Thanks for the tip. Also, we are working on making it easier to isolate opam packages and npm packages side by side in one development environment so that problems like this are avoided. This allows you to build a project that depends on opam packages for build time tooling inside your JS projects. That project is called esy, and it’s a young addition to the ecosystem but something I’ve been using to greatly increase my own productivity for a while now.
It will not make BuckleScript compile opam packages (that is not BuckleScript’s goal) but it will at least make the two ecosystems coexist simultaneously.
My i7-2600k, which is 7 years old by now, still does everything I need it to do (among them being gaming newly released titles) and more. I did upgrade the GPU a couple of times, but the basic system is still the same and performing like it always did.

In that regard, I really don't understand what's happening with smartphones/tablets that suddenly makes them incapable of performing the same tasks, at the same performance, they always did. It's not like I'm suddenly trying to use some performance hungry app/game I never used before, it's the same apps I always use, but they simply perform worse.

If it wasn't for this simple fact I'd probably be still on my iPhone 4s, but after a while, that became even too slow for simple stuff like using WhatsApp. It can't be that the apps become that much more demanding, WhatsApp still did what it always does: Sending and receiving messages, so I really don't understand where that extra demand for performance comes from which suddenly turns whole generations of portable hardware into fancier paper weights.
How about economists?

I know, they make mistakes. So do physicists. But if I need physics advice, I don't go to plumbers.
I kind of understand the author's point, but at the same time, there comes a time when any kind of technology becomes obsolete. I still use my 2012 Nexus 7 - awesome tablet when it was released, and it was an entry-level model even then, so to have eeked 6 years of life out of it is pretty impressive. I know the OS is no longer maintained and it's stuck on Android 5.0; this is the price you pay for embedded systems. You own the hardware, but have zero claim over the software that runs on it. I still have up-to-date Firefox, for the time being, but I know at some point I'll lose that and more, and my device will be unsafe to connect to the internet.

In much the same way you wouldn't try to play 4k video on a computer made in 1995, at some point the device's processing power maxes out. It's difficult to strike the balance between power, battery life and cost; Apple like to play the Rolls-Royce card of 'it's enough for you' in this regard, giving you a bit of room to expand in the future, but it's in no company's benefit to make your device last forever. With a device that cannot be upgraded, the best approach for them is to sell you another one.

I think the field of computing is particularly skewed by Linux, how most hacker-types will dig through their box of parts every so often, slap together enough components to build an old-generation system and install Ubuntu on it and voila, a second (third, fourth, tenth) lease on life for an old machine. And that's mostly true; Linux doesn't much care what it's running on, the OS can be adapted to run on anything. But at the same time, the applications running thereon will quickly prove why the hardware is previous-generation; sure, you might get the latest Ubuntu running, but what then? Add Chrome and a few tabs and it's going to start to creak; a few things running in the background and eventually you'll give up. Embedded devices are much the same; at some point, you will reach the limits of the hardware through no fault of your own. It's questionable how much by-design this is, with Apple admitting they silently force the CPU clock down as the battery ages, but even with fresh batteries, application developers will be taking advantage of newer hardware features that don't work efficiently or at all in previous models. Some of it may be progress for progress' sake, but try running a machine with full-disk encryption on a Core 2 Duo, without the AES engine - the new hardware makes a lot of difference.

It is a shame that the device doesn't visually age and when powered off has no indication of its age, but such is the way of the industry; it isn't Apple's way to make devices that last longer than their release cycle, and few companies have ever made much profit that way.
I thought long and hard about IoT devices and their value. For the most part, I agree that most IoT devices could exist and provide the same value as a non-IoT counterpart. Do you really need a connection to the weather service to know the canopy in your backyard needs to be rolled because of a potential storm?
A simple anemometer with a micro controller can tell it to shut off above a certain wind speed. Most IoT devices "excel" in allowing you to connect to the device via your smart phone. Which is convenient, but not groundbreaking. Where the value of IoT devices lies is in very few use-cases where the IoT device relies on data not found in its proximity. Something like Nest speaking to my electric company to find the lowest rate and optimizing A/C usage around it is quite compelling IMHO. I look forward to seeing more of that rather than the remote use case....
I speculate they needed a DRM-capable container in case the rightsholders demanded DRM when iTunes started selling lossless audio files.
Univfy raises $6 mil to better predict IVF success rates using machine learning
That's mostly what I see in the publisher section too. I wasn't under the impression that it was curated per user but I could be wrong. I don't interact with the publisher stuff a ton.
"I am surprised that people still report bugs when there isn't an official bug bounty/bug reporting program"

IT is still young as a discipline. This is an emerging example of "industry practice".
You'll see the chaotic behavior if you look around the vertical initial state at the top center of the graph. The initial states nearby evolve quite differently than each other.

"Chaotic" describes a system only locally around specific initial states. So a system can be chaotic near one initial state and stable near another.
> The fact Mozilla is even trying to get in on this madness is disheartening.

I share a lot of your reservations about IoT. But at the same time, for those things that are going to become successful, I'd really like there to be a unified and open integration for them, rather than each one being their own little walled island.

So from that point of view, I'm actually glad about Mozilla (or any other party) building an open infrastructure for IoT, rather than leaving it to others to build proprietary solutions.
Why? General opposition to motorized transport?

Opposition to non-bipedal forms of transport?

Or is it opposition to the type of urban planning that is centered around the car more than the pedestrian?
When are they going to boost it into solar orbit?
> Also, 2001: A Space Odyssey is a great movie about a great example why you do not pilot your ships with computers all the time.

No, it merely illustrates why you want your AI properly bottled up and airgapped that way the flight computer will follow your instructions after you consult with the AI (assuming an AI is ever built...).

Computers can control spacecraft just fine in the present without AI so really there does not seem to be a pressing need for this.
You're mostly right, although the killing is typically overblown and taken out of context in many circumstances. But when it does happen, you're right that it's damn near impossible to get a conviction of a police officer. And civil forfeiture is probably even worse than what media coverage would lead you to believe. Ironically Loretta Lynch, the second Attorney General under Obama, did this extensively in her career in NY. It's sad when the people who are allegedly representing the interests of the underprivileged have done so much to exploit them. (And don't get me wrong here, I'm not trying to be partisan or suggest that the GOP is better or anything like that. It's just disappointing how much of this crap runs through all layers of our government.)
It's not about the tanks. Once the cops start thinking of themselves as "warriors" and the rest of us as "civilians," the necessary lines have been drawn in their minds to justify mistreatment of the outside group.

One difference between our militarized (and unionized) police forces and the real military is that if you're in the military and you shoot someone who didn't need shooting, you are in very deep shit.

The police are demanding -- and getting -- all of the perks of the Heroic Warrior job title, accompanied by few of the responsibilities that should go with it and essentially none of the accountability.
Can't this already be accomplished via XMPP? The protocol already exists, you just need to register devices to services. I know people don't love xmpp, but it seems like this is already an open source gateway that can manage IOT. Why do we need to create a "new open standard"?

[0] https://xmpp.org/uses/internet-of-things.html
Not exactly mainframes, but the amount invested in AS/400 still today astounds me.
Wow, so much debate over the specific manner in which to solve a problem. More needed on the which problems to solve, I think.
Tough crowd. I'm rather more amazed at what did happen than at what did not.
I just worked on a pool-pump-controller IoT device. Its connected value was, you could manage it without visiting the pool pit. Your service guy could check on it without driving out to your house. And you could get push notifications when something goes wrong.

Some things, especially automation-control things, benefit greatly from being IoT.
I don't get how we're seeing the views behind the car (https://cdn.teslarati.com/wp-content/uploads/2017/12/Roadste...) -- is it a green screen? special effects? something else?
In discussions about having more gender parity in programming, I sometimes hear people ask what benefits, specifically, it would provide to the projects themselves. Here's one possible example: if we had a more equitable gender ratio in open-source, we might have have fewer dick-waving contests like that thread. I don't even know what it's about, and I don't care: all the involved participants are just peacocking Internet Tough Guys. What a waste of time.
I made a comment in a similar that if you are going to do any door knocking make sure you understand the legal ramifications.

Also before you are going to blame the company their hands might be tied the PoC for the issue was accessing personal information which likely includes financial information and identity verification of other people.
It’s quite possible that it’s their legal obligation to report this to the authorities and likely also was the CYA legal advice given to them by their legal team.

Like sure you may think you did the right thing but the person who’s info you’ve downloaded might think differently.
While Sentinel is handling this in an extremely amateurish way, the way this was handled by the person reporting the bug also was done quite poorly.

1) He should have attempted to access his own data via an alternative method. He could do this via an incognito session and a proxy, or just tell them he checked with a different machine, etc. Or, at bare minimum, stopped after the first time. Instead, after the first check, he proceeded to download at least one and potentially two sets of people's information that he knew was intended to be confidential. After already confirming that this was broken. This isn't the right way to go about it.

2) This was discussed in a public communication medium when there was little time given for Sentinel to handle it. Public disclosure to force action is a valid strategy, but almost all professional security researches provide time for the company to resolve the issue, rather than doing it within a day.

3) The CEO's report that only 21 people were affected might be totally accurate - webserver access logs would make it quite simple to determine how many people had their data viewed by users other than themselves. Thousands of people being vulnerable does not mean thousands of people were affected by someone other than themselves viewing their data.

Primarily due to how 1) was handled, he 100% should be speaking with the relevant authorities. He now has confidential information about 2-3 individuals he should not have. If that information is used for fraudulent purposes, he should be on the radar of the authorities. He shouldn't be charged with anything just for having seen it, but we cannot let reporting a vulnerability be a get-out-of-jail-free card, otherwise you could exploit something for profit, and then report it, and have nothing happen. If he had only verified this happened with his own personal data, there would be no need for this, but that isn't how he handled it.

By no means am I defending Sentinel, we need to make sure that we also inform people on how to handle security issues like this /responsibly/ and without causing even more damage.
Even shorter, works unmodified with both C and C++, and doesn't recompile unless necessary:

//usr/bin/make -s "${0%.*}"&&exec "${0%.*}" "$@";exit
The only planet that is, as far as we know, populated entirely by robots.