skysight-inc/HackerNews huggingface dataset:
As a security researcher who tends to focus a bit on user interaction and phishing vectors you are 100% correct, but also representing part of the problem. Too often we discount vulnerabilities which users have to click-through to execute. Unfortunately users do ignore system security warnings. Unfortunately when given a dialog where they can choose security over doing their job, they'll do their job.

I've actually presented user interaction vulnerabilities to development teams in an interactive environment where I describe the vulnerability. I show them where it's at, I show them the dialogs they must be cautious about and even with all of this education they still fall for my attack running on their network. As an industry we've got to stop discounting vulnerabilities as not serious because they require user interaction which involves clicking through security warnings.
Then why is ישראל (Israel) displayed in my browser when I hover over the region but not فلسطين (Palestine)?
Actually, the only thing surprising about the article is how little this poor fellow is getting paid for the work.
Ahhh, life. If only everything were perfect. Keep pushing but don’t be surprised by the pushback and despondency. But keep pushing, for yourself, and others who want to care.
Good questions. I was looking at H2O and they solve this using what they call http-casper: https://h2o.examp1e.net/configure/http2_directives.html#http...

> When enabled, H2O maintains a fingerprint of the web browser cache, and cancels server-push suggested by the handlers if the client is known to be in possession of the content. The fingerprint is stored in a cookie...

That sounds interesting solution.

Actually it looks like this tool along with nginx pagespeed would work well and require no changing in build tools.

Nginx pagespeed supports parsing and optimizing the html (and linked resources), including inserting prelink headers. Which will now get pushed. It requires no change in build process.

> Won't a gzipped bundle typically produce a smaller payload?

With http2 it's better to unbundle these days as the best reason for bundling was to not create new tcp connections which require ramp up time to be useful. Now with http2 the same tcp connection is used but multiplexed. So the main reason for bundling goes away. As to it producing smaller payloads, it might be the case but not that much smaller that it's worth it since it's the same tcp connection. Better to have it in unbundled then it gets parsed and processed in chunked streams of files. The client is able to use and process the files as they come in without having to load the whole bundle and process at once. Making the site a bit more responsive.
Comparing the amount of effort that has been spent on distributed filesystems (where everything is managed under one hierarchy) to the usage of such systems, I'm going to say that it's a fundamental law of trying to organize things.

But really, I do think it's physics at play... or rather logistics.

Let's say you're trying to put together a 10PB storage system in a datacenter. If you're using 60 disk JBODs with 10TB drives, thats 600TB of raw space per 4U (or a max of 6PB per rack, or 12PB in 2 racks). Now realistically due to power, network gear, etc... instead of maxing out 2 racks, you'd probably split that into at least 4 (or more) racks. If you're Backblaze (see above), you split those 20 pods across 20 separate racks (and add more volumes, but that's another story).

But once you're at that level, for redundancy, you'd not only managing which disk data is written/replicated to, but also the JBOD/pod, and the rack (and the data center). So, at that point, you're not going to working with a "normal"/traditional file system. You could with ZFS define redundancies that would work like that, but realistically, because of the extra overhead, you're better off changing how you organize your data.

(Plus: ZFS isn't very good at expanding a filesystem with new storage. You can do it, but your pool ends up unbalanced and performance suffers. When you decide to have a 1+PB system, you normally want to have the ability to add more storage space, which means a different type of FS)
What really are the long term motivations for Google to promote and push AMP so much?
Funny how no one has any meaningful advice, just some snark about those dang young developers. Get off my lawn!

That line wasn't the important part of this post. This one was:

> You should also have a global self-development plan. If you can’t put it into practice under the scope of the project, you should spend your free time on it.

Damn straight.

If you work somewhere with tight deadlines and rubbish code quality, and you're just sucking it up and writing rubbish code, you're part of the problem.

You should always have a plan about how to become a better more effective developer where ever you end up working. Sometimes that means plan to spend 10 minutes a day talking to your project manager. Maybe review code the last 1/2 hour of the day. Maybe make some internal tools to help automate your job.

Don't just sit there and be miserable; if your job/company sucks and you can't find a way to change it, at the very least make it a stepping stone to something better.

Some idle advice from my experiences working in places which sucked:

- If you write code, it should be good code. Even if other code is bad, that's no excuse to stop caring.

- ...but, you dont need to refactor that. Just do what you have to do, and make it as good as it can be under the circumstances. Don't break other things when you make things cleaner and better; that makes PMs think that 'good code' = 'break features'. Disaster.

- If you ship rubbish to 'come back and fix later', you'll never come back and fix it.

- Don't just comment out code and replace it a quick fix. Don't [Ignore] failing tests. If code is going away, take responsibility of actually delete it.

- Don't leave 'TODOs' in your code; either do it, or don't. No one is ever going come back and do your TODO. Not even you. That's what issue trackers are for.

- Some developers don't like running with 'trainer wheels' or 'guard rails' as they refer to unit tests. Ignore these people. Always write tests. The worse the place you work is, the more desperately you need those tests.

- Project managers (unless utterly incompetent) don't care about deliverables per se; they care about managing expectations. Estimate. Review your estimates. Try to deliver on your estimates.

- Don't work overtime unless it'll actually make a tangible difference for a specific deadline. :)
As the parent pointed out, that increases the risk of theft.
Pennsylvania to require voting machines with paper backup
Pennsylvania to require voting machines with paper backup https://apnews.com/b33d9d5fd72642058552662c9cfbf426
I agree that a single event that causes the tipping point doesn't really matter and knowing the general direction things are going is helpful. This does not mean necessarily though that you'll have any ability to change it. Even if you had the power to change anything, it assumes you actually know the correct actions to take.
This is the version of history I believe too, but the SDK documentation was so good that people wonder(ed) if they were planning to release it after all, maybe not for the "sell on Apple Store, we get 30% cut" developer market, but for the big software companies.

It's incredible how many people became millionaires because of them, e.g. the makers of Angry Birds. Or makers of apps like Tinder or Uber.
The withdrawal is instant, however the recipient waits for a few hours to a few days.
Did you try that link when HN is the referrer? ;)
What I don't like in "commercial" code reviews is that most reported issues are there just to fill space. It's busy work. There is this formal comment system. So instead of fixing this typo in a code comment directly reviewer writes a comment. Code style issues that arise, because of absence of a tool like go-fmt also warrant a comment. That's sad.

There are meaningful comments, but usually people have to fill their review quota.

Lowest hanging fruit should be just an in-place edit that would be automatically retested and that a reviewee can easily take as a patch and check himself. Instead of the back and forth bullshit.

It's a bit funny that placing a red herring comment that anyone can safely comment on makes the workflow faster. It's like this story about an artist who would place something ridiculous so when the time comes the CEO would just say: "It's good, just remove the thing".
Try this one. Consciousness as an emergent phenomenon. All the rules and laws by which the brain operates are completely constrained by physical laws, but they create an emergent 'field' in which it is not mathematically possible to predict the behavior of the field.

In other words, causation easily flows into the brain, but not outward from it. Here's a link if you're curious: http://www.informationphilosopher.com/knowledge/emergent_det...

The brain has its own set of rules that it uses that is only partially attributable to the rest of the world around it. It can create it's own rules and operate 'under it's own steam', in the same way that North Korea manages to operate largely autonomously of the world around it. It's certainly constrained by geopolitics, but its internal behavior manages to remain free regardless.

I used to want to reach for quantum mechanics to explain the brain, now I'm happy with "plain old" electromagnetism.
I genuinely fear the future of email. Email is still the only piece of communication you can own, from top to bottom, from running the service to owning the domain[^1] it runs on. You were able to send anyone email, regardless of rank, location, social status.

Google (and recently, Outlook) is taking all of it away. It's putting mail from people not on your contact list in spam[^3]; it's by default blaclisting IPs within certain range[^2]; now it's bringing it's own format as well.

Is this embrace, extend, extinguish, Google style?

[^1]: let's not get into the problem of DNS never really being owned, only rented, for now

[^2]: https://wiki.hetzner.de/index.php/Microsoft_Blacklist/en

[^3]: only experienced it, friends did as well, but I don't have proof.
Final Cut Pro X 10.4 Crack with Keygen for Mac Free Download
Judge refuses to withdraw Julian Assange arrest warrant
Pennsylvania to require voting machines with paper backup
How about offering an opt-out for AMP before piling on more crap ?
My personnal experience with data scientist and startups is that they're hired much much too early, when the product has a lot more fundamental issues to solve, and only because it looks cool to say that you're doing AI.

In practice, they're often frustrated for years by the lack of infrastructure to work on their ideas, but live with it because life is good.

I suspect AI today is like big data ten years ago : a lot of company think they need AI, but in fact what they need is a good product and a few algorithm requiring high-school level maths.

That could explain the shortage...
Why I've Started to Move My Domains from Internet.bs to Namesilo.com
This article is atrocious. It has a clear agenda motivating its publication that is simply at odds with facts.

1. This is not a vulnerability with Telegram. The headline is deliberate clickbait, and the article’s Telegram-centric presentation doesn’t redeem it.

2. This is not a remote code exeution vulnerability, or even a “0-day” (for whatever meaning that term still has...). This vulnerability is a malicious file upload combined with a clever phishing vector.

The reporting is exceptionally bad - so much so that it is difficult for me to attribute it to simple ignorance. It is very clearly trying to hit several checkboxes for what is otherwise a non-story:

* Telegram

* Cybercrime

* Cryptocurrencies/Mining

The entire narrative is carefully constructed with keywords that have no hard relation to the vulnerability whatsoever - it feels like I’m reading a bug bounty report where someone extrapolates a minor endpoint security or phishing vulnerability to whatever they think will get the most attention to the report.

Reporting like this almost makes me wish for Gell-Mann Amnesia in my own field.
It's not just "banning users". The core issue is deeper than that.

The core issue is that Silicon Valley sold a dream: "We can build business without people in its ranks. Instead, we can staff programmers and build glue-logic around our business cases, and automate everything. This saves all the money from hiring people."

The investors bought into that idea. Because if it did work, you can have companies that are 1/10'th the size of previous high industry companies, because all the work is automated. Look no further than all the current crop of companies using software in this fashion. Some AI system "learned" that your combined inputs related a fraction higher as fraud - banned. Or someone checked a box in the wrong location and you're locked out. Or your system is deleting user content at random, and there is no-one to call.

Who ends up being tech support for these new companies? The executives. But that's only for people smart enough to realize to send them messages, or otherwise garner their attention via Twitter, Reddit, or HN and happen to be in the right place at the right time. Even the aforementioned gamification needs to be done for even HN, to get the right post at the right time.

Where do we go from here? In truth, not many places. Non-software companies with real human service will get eaten out of house and home by companies willing to make deals with machines. The VC funding is in AI businesses, not traditional. But one can still choose to be customers at respectful businesses. But the internet makes that much harder, as going online also includes 'selling out' customer service. Some AI will then tell agents "you can't do that" even , if it is what's needed.
As a professional baker, what do you do differently from traditional bakers?
Perhaps I misunderstood. Someone (was it you?) said nobody cares about trivial boards like in the blog, but they do care about complex boards. I took that as a sort of rejection of the relevance of the article. So the point I wanted to make is this: If you're hoping for a tool to do good routing on complex boards, it really should be able to do a great job on simple ones. Hence the blog is entirely relevant by eliminating a bunch of autoroutes based on his simple project.

I applaud him for pointing out how bad most of them are and asking the question why they suck when machines can play GO now.
That’s bad and good at the same time. If more PhDs work on it, the real capabilities and limitations will come to light leading to correction in salaries.
Credit and debit card acceptance could definitely be better (even though I was doing all right in Berlin), but I don't agree about opening bank accounts:

- N26: it took me literally 10 minutes. Identification via video chat.

- comdirect: as far as I remember, I mailed them one 4-page form, dropped by the post office for the PostIdent and that was it.

- Postbank (I needed an IBAN quickly while waiting for comdirect ;) : I walked in, everything was done in 15 minutes.

Now try the same thing in France. Online banks typically ask an initial wire transfer from another French bank since they cannot check your identity directly. And then you need to provide proof of address and salary payslips (or tax receipts). And in the end it easily takes 3-4 weeks to receive all documents and your payment card.
In general I agree with your points. But you seem to have some gripes with "senior" engineers. I think if you left that out your points would be better. In the end it comes down to management not understanding the work and rewarding unproductive behavior. This has nothing to do with "junior" or "senior."
Why flying cars never took off
Largest webpage on the web
Yeah, agreed, there's really no substance to the interview that I can grab a hold of. The main thing that I would be wary of is the idea that there is a single approach or method that will work for every child.

"Phonics" is mentioned a few times in the interview, ie, the connection between (English) spelling of written words and the spoken language they represent. I immediately found myself wondering how this relates to how children learn to read in other languages whose written forms are either far more phoenetically entwined with their spoken forms (eg, Portugese and Finnish, as I understand it), or far less (eg, Mandarin or Arabic). (I'm sure I'm oversimplifying complex relationships and reality in the overbroad sentence I just wrote, but I'm happy to hear how my received CW is wrong about these languages.)

Anecdatally: when my own daughter was about four, we had some friends whose son had learned to read from a Phonics book at four, and when we knew him at five, he could read pretty much anything you put in front of him (how much he understood, who knows, but he could translate the text into spoken language that we could understand). Both her mother and I were also reading at four, and so we expected our daughter would be able to do the same. We were inspired by this kid's example to get our daughter started early, and tried the same Phonics book with her.

Unfortunately, she didn't take to it so well. She seemed to understand what was happening well enough, but it never clicked or became natural, and it was ultimately a frustrating experience for us and our daughter. So we eventually stopped the lessons, and let her learn at her own pace. She happily made it through kindergarten and first grade without really showing any interest in or being able to read with any proficiency. She was clearly smart, and her teachers told us not to worry about it. Then in second grade mid-year, something just clicked, and she started voraciously consuming books, with her reading ability testing well above grade level.

Now at 16, she's still a voracious reader, and a writer who has completed NaNoWriMo three times, reads and writes every second of the day, and has an incredibly sophisticated grasp on storytelling, analyzing the writing behind books and movies and TV shows with a clarity that I personally have never had.

So, how did she learn to read? I have no idea. It wasn't phonics. But I suspect she would have managed it no matter what instruction she received. I also doubt that she is really a meaningful example, other than to say that it's complicated, and humans vary in their learning styles, and we should focus on the goal of reading and comprehending, trying to discover all the ways that individuals can and do learn to read, and having our teachers focus on identifying and encouraging the best methods for each student and not so much on imposing specific mechanics of how the statistically typical student achieves reading proficiency.
Is it able to deal with digital certificates?
In business settings, I've seen plenty of pull requests "go stale". Usually, they come about from a) the person not updating their code based on reviews, b) the reviewers not reviewing in a timely manner, or c) the change is no longer necessary / a priority.

Usually, it is some combination of a and b. All cases are an indication of a deeper problem. None can be fixed by calling your "pull request" a "managed push" nor by giving people unrestricted access to pushing code. It's typically either a problem with communication or priorities/expectations.
It’s all relative. No amount of wealth can buy time or immortality, but having very little money means less choice in where you live, how you get from place to place, how you eat, how you dress, the medicines and treatments you receive when you are sick (if at all), and so on.

Moderate wealth certainly means more freedom than little to no wealth.

Edit: I just recalled a quora question a while back when somebody asked about the drawbacks of being a billionaire compared to a millionaire. One perspective was that while a millionaire could go for a Sunday drive in a nice car with the spouse and kids at the drop of a hat, a billionaire may have to schedule their transportation around security parameters and travel with bodyguards because their wealth can make them a target. So in some ways, too much money can make life less free.
No, no, no.

Google is trying to turn Gmail into a platform.
I remember when TCL was a scripting language.
Curious how that factor into the price of BTC?
So with AMP for email can I run timer based or mouse movement based modifying email contents??? When yes: spam mails will love it.
I had my Venmo account temporarily terminated a few weeks ago. I didn't do anything other than be the recipient of a $139.99 payment from a stranger "for laundry". My account was unfrozen, but I think it was out of sheer luck more than anything. A less savvy person would have likely taken the notification at face value and left it at that.

I searched around for what to do in this situation and came across many reports of this type of scam, where an unknown sender "accidentally" sends payment, request a payment from me for the money back, and simultaneously cancels the transaction. I did nothing and hoped the issue would resolve itself.

Two days later, I get an email saying my Venmo account has been frozen "due to recent activity that appears to be a violation of our User Agreement." After reaching out to Venmo via chat, I had a similar interaction as the article. They told me my account was frozen, that my case was being handled by an Account Specialist, and that would be in touch via email.

The next day I got an email from the Account Specialist saying my actions and activity were in violation of the ToS and that my account was permanently deactivated.

I reached out to support again and played dumb, saying I received payment from a stranger but can't send the money back because my balance didn't go up. Support again said they couldn't do anything, that my account was frozen by an Account Specialist, and that they would be in touch via email.

The Account Specialist sent me an email saying the payment was refunded and that I should reach out to the sender directly, to which I responded that I didn't know who the sender was and I assumed the payments were made in error and asking them to confirm that I had to take no further action. They responded with a form email saying my account had been unfrozen. "However, please keep in mind that the state of your account can be revised if your transaction history raises flags on our system in the future."
Evolving a Decompiler
wait hang on...

> At Google, we have found, with some investment, the monolithic model of source management can scale successfully to a codebase with more than one billion files, 35 million commits, and thousands of users around the globe.

so each commit adds on average over 28 new files?
How would start ups compete well with those salaries?
Remember the QNX 4.25 demo disk that fit on a single 3.5 floppy and included a GUI, networking, a web browser (with basic javascript), clustering, and various other applications?

What a great little OS.
With AMP for Email, Google is keeping users within Gmail when when they’re interacting with your website or service.

The strategy of Google / AMP is clear: using its monopoly to convert the open web into properties of Google.

AMP is as “open” as Adobe Flash (Flex, etc) is open. Sure, it may he open source, but it is encumbered by license keys (see: AMP Cache), special privileges (again see: Google search cache), and development totally in control by Google.
I remember my excitement using the QNX boot floppy. It was a full OS with a GUI, all from one 1.44MB disk. It had no PPP support, but fortunately it worked with Ethernet.
Love this. Totes getting bored using a gazillion tools to help onboard my users. Before you've even started a new venture, you'll find yourself hunting for the right tool for a job you didn't even expect would exist.

Which support tool. Which analytics tool. Which AB testing tool. Which wizard tool. bla bla bla.

Back to basics. I'll get my coding hat on and actually make an effort. Nice work. Will try this one myself next time I need a wizard.