skysight-inc/HackerNews huggingface dataset:
I don’t think your solution works. It will make sure the pointer is never null (assuming these back pointers are !Sync) sure, but rust guarantees far more that that. Each ownership type (value, &, &mut) is a capability, it very important to rust guarantees that you can’t go up the chain. Each node have an owned pointer to the next means that it can mutate it at anytime, the back pointer would always alias the previous node meaning that it has to be a weakened “&” reference (allows aliasing, lifetime rules relaxed). Because all of the nodes are owned it’s possible to traverse the back pointer then move forward again and recover ownership or a &mut of the same node twice.

You can however allocate the nodes in an arena and store your forward and back pointers in Cells. You can’t move the arena, but you’ll get nice back pointers. You could also make the linked list be backed by a slab and store indexes instead of node pointers. Both of these solutions will likely be more cache and allocation efficient than a traditional link list which does allocation for every node.
Does that make them a bad example of a successful militia?

Perhaps a successful militia requires significant financial and logistical backing from nation states, in addition to being well trained.
The appeal of fiction has never changed and been around. Availability and the volume people consume has changed drastically.
Yea, I can't understand the author. He's fine with Dropbox wasting his time and forcing him to give feedback info that the user is not obligated to give, but he doesn't like the way the de-emphasized buttons make him feel?

There should be a fast way to downgrade, whose only confirmation dialogs are ones to prevent accidental mis-clicks or irreversible damage. (Buttons designed to make me feel certain ways will certainly lower my view of Dropbox's classiness, in the same way as a desperate salesman, but as long as I can clearly understand the UI, I haven't been wronged.) If Dropbox wants to try and persuade the user, they can do so after they confirm the user will be downgraded with no further action.
You've been violating this guideline, could you please stop?

> We ban accounts that use Hacker News primarily for political or ideological battle, regardless of which politics they favor.

https://news.ycombinator.com/newsguidelines.html
Yeah, you're right. Sorry I came off as condescending, I probably shouldn't have said anything.
Show HN: Deploy Expressjs to AWS Lambda with Serverless Framework
Using QBasic with the RadioHands tutorials was one of my first times programming, and also my first exposure to assembly.

http://www.petesqbsite.com/sections/tutorials/tuts/vicstuts/
The fantasy world you work in must be great. I’m jealous.

I don’t know how many times I’ve seen someone jam a gigantic pile of string into a query builders select method or done some whack string interpolation trying to make a clever search form instead of using a tool like ransack or the equivalent.

Like I said, that was a for instance using Postgres, you can do it plenty of ways. Hashi Vault has been an awesome tool for this recently.

Getting the password near your database isn’t the problem. It’s persisting it unhashed that is. I’d conjectire a fair amount of sites terminate SSL at the edge of their network (nginx, ALB) and they have a password floating through the stack in plain text until it hits a compare method. What does it matter if that method is in your app code versus pg or vault or any tool you’d use for credential storage? Are you sure your app is scrubbing all the json keys or http field names that could contain a password to make sure it’s not going into your rails/node/whatever logs or into your nginx access logs?

Having multiple schemas isn’t complication, it’s organization.

As far as people doing dumb shit with files they’ve dumped or downloaded. It happens.

When you’re designing a system for storing credentials you don’t know who will work on this system or what practices will be in place around code quality, reviews and deadlines when you’re gone. You can’t literally watch every PR or guarantee that ever code review has someone as smart as Zaarn presiding over it.

You should be designing something people can’t shoot themselves in the foot with.

An example of a totally reasonable mistake to make i saw recently in a PR in a client I work with.

They had designed a pretty solid API using the JSONAPI spec. JSONAPI if you aren’t familiar allows an API client to request what fields they need from the endpoint instead of just getting all the fields the API returns. This is nice for mobile clients.

They had the forethought to exclude allowing people to ask for “password” through the /users API. Nice. Nailed it.

A year passes.

They add a feature for changing your password that required you to confirm by email that’s the password change was you and then it swapped the password from the “new_password” column to the “password” column. While this PR was in staging you could do /users?include=new_password and it’d return their new password (hashed, but still).

Password resetting was a feature they were adding to their registration and auth code.

The people that worked on that front end didn’t necessarily work on the user API and weren’t familiar with how it worked. But by adding this flow and this field the created a vulnerability in a tangentially related system.

Now I’m sure you could crap on JSONAPI but it serves a purpose. If they hadn’t been using that someone just as lazily could have designed the regular JSON endpoint to return all fields but password and they’d have ended up in the same boat.
Does it have an SSH terminal built right in the browser? Not clear from the screenshots or documentation.

If not you could also use Gate One[1].

[1] http://liftoffsoftware.com/Products/GateOne
From what I've read from DHH, Stimulus was extracted from real world usage in Basecamp which I think is safe to say a lot bigger than a small project.

They didn't just "invent" the library in hopes it would work for someone. It's what they run in production on one of the most long running SAAS apps on the internet.
Out of curiosity why do you think this is a backdoor and not a valid cryptographic connection via your phone?
The Rise of the Namibian Surveillance State: Part 2
This is either misguided or misleading: it appears (upon a superficial web search) that Israelis are at the heart of MDMA production, but they are mobsters, not government employees: https://www.haaretz.com/1.4723857
Commenting to offset the negativity:

I'm looking forward to flatpak, and I currently use firejail + liberal use of `chromium --user-data-dir=~/.config/chromium-<website>`.

Because web-app based software and web-services I frequently interact with (slack, gitter, discord, twitter) should absolutely be separated from my general browser, and from each other. Most methods of web tracking and phishing/XSS attacks will be neutered in this setup.

And because my browser, and all of these separated services, should not have unfettered access to my system and personal files.

I don't think I will bother with containers for general software, but web services are an attack vector and should be treated as such, even at the expense of complexity over simplicity.

Frankly, the notion of simplicity was out the window the moment we started using the web as a development platform.
Do you heat your house? Maybe not, maybe you live somewhere warm, but many people do.

Consider that bitcoin mining (or hashing for science) is a much more efficient way to make heat than simply converting energy into heat for the sake of heat.
Conversations is keeping its own TCP connection to the server. Battery usage depends on how many XMPP contacts you have, which modules your server has enables and whether you have the F-Droid or the Google Play version of the app. Come to the chat to find out what it is in your case ;-)
Plenty of places make it illegal to take a photo in the voting booth (or polling station generally), and the voting booth is visible enough to election officials (albeit with your back to them and hence the ballot not directly visible) that it'd be very hard to do without arousing suspicion.
For ORM we use GORM: http://gorm.io

For migrations we use goose: https://github.com/pressly/goose
That’s the nature of some jobs, and it can be a sound strategy. I’ve mostly managed to avoid these jobs, personally.
Age of surveillance
> When you see a "do" block, where do you look to figure out what it's actually doing?

If you need to know, you look at what consumes the result. If it's abstract (say it's a top level binding `... -> m a` where the m is abstract) you don't need to know "what it is actually doing" - it should be correct for any choice of `m`.

Whether this stuff is easy to find/follow certainly depends on the quality of the code, as well as your experience. It's not something I struggle with, working day-to-day in Haskell.
> Docker's killer feature is the packaging mechanism.

That seems to be its Achilles' heel. Instead of having packages maintained by dedicated people (as with package managers like apt), you get a program that comes together with a collection of dependencies and libraries that aren't maintained by anyone.

The average developer maintains their own program but doesn't have the resources to backport every bug fix and security update to the specific version of every library they use, and neither does anyone else when every program is using a different version of every dependency.
The solution surely if to make voting quick and easy; I rarely hear stories of long queues for voting from outside of the US.
Great value-add of reading HN comments!

I will wait until they get rid of this crazy requirement to consider using it.
What if it is simpler than a quest for meaning?

What if our pandering to rugged individualism has simply lead us to create a society where institutions, instead of providing a level playing field, reward those that have already won and punish those that have not?

Buy a million dollar house? Write off the cost of financing it. Get injured and not be able to work for a year? Huh, not sure someone with that kind of resume gap is the kind of person that we want to hire.

Then we wring our hands about why a frustrating, alienating society frustrates and alienates people.
I still don’t get why someone using a password manager would make up passwords themselves instead of randomly generating long and strong passwords...

The way they implemented this is nice, but seems a bit pointless to me.
You would typically be an excluded occupier, meaning that you could be evicted with only "reasonable notice" - typically seven days. The landlord doesn't have to give a reason, you have no right to appeal and the police can remove you if you refuse to leave.

https://england.shelter.org.uk/housing_advice/private_rentin...
How to Code in HTML5 and CSS3
Sapiens?
They've made strides, but there are still things missing (there's a list halfway down the page). Perhaps one could just use the tools that are complete and fall back to GNU for everything else, though last time I tried to do that cleanly it didn't play well with the packages. (I may just be missing options to do a partial build)
There is sadness in every corner of the world, but that only overlaps with opiate availability in certain places.

In America, like every nation, there is sadness. However in America, unlike many other nations, we have widespread opiate availability.

This combinations leads to opiate deaths on the scale we see. It's not complex.

What is the answer? China knows the evils of opiate addiction, perhaps in the future, after enough of our own society is ravaged by it we will adopt the Chinese attitude towards opiates and look back at the naive past as our future selves tend to do.
It destroys a landlord's life if their primary asset is turned unfairly into a liability.
Cockpit itself is trying to be a "platform of sorts for modules to hook into. oVirt, for example, will install a cockpit plugin during installation of a hypervisor node allowing you to manage the local host or global cluster maintenance state and see how many VM's are running on the system (I would argue this is of limited benefit since you could just login to the oVirt Admin portal to do the same thing, but hey).

So, yes, you're right - a lot of work still needs to be done, but Cockpit itself seems to be an adequate base, just need to add support for managing commonly needed services at least at a rudimentary level though (MySQL/PostgreSQL, Apache/Nginx/lighttpd, Postfix/Dovecot/exim/cyrus, etc).
So find an investment that does not amplify the housing crisis.
Show HN: AWS API Gateway Log Parser
Likewise, my jump from the HP calculators' built in language was QBasic. And then, when it wasn't able to plot a Mandelbrot set fast enough (on a 486DX-33), I tried FastBASIC which was about 10x quicker - and that's how I learned the difference between compiled and interpreted languages.
What happens when you mix what <- means :

do

a <- getData // this is a awaiting a future

b <- getMoreData a // this is looping a list

c <- getMoreData2 b // this is null checking

d <- getEvenMoreData a c // this is awaiting another future

print d

Monads' hell, isn't it ?
* Phase 1: Setup password checking site pretending to check passwords against stolen passwords. Steal all passwords inputted.

* Phase 2: ???

* Phase 3: Profit

(Downvoters, I'm only having fun, and yes I know this is a good source. But: Do be vigilant. It doesn't take a stretch of the imagination to suppose that this scenario could happen.)
Advanced Tools for Better Productivity in C++
Honestly, postal voting already scares me from a coercion point-of-view (and this isn't entirely hypothetical: almost every election cycle we hear of people being coerced by their partners into getting postal votes because then they control their vote far more easily). I would much rather do whatever is necessary to make it possible for as close to everyone as possible to vote in person.
I'm wondering if this isn't a lost opportunity by not leveraging something a little more modern like the matrix protocol (which is still decentralized)??
I don't get it. I let 1Password autogenerate long passwords based on a very complex preferences setting. Why do I need this?

It seems it is a proof of concept, and only available to 1Password subscribers, both of which are good, because I don't like it, nor want it.
It's easy to configure the voting booth to provide privacy for the voting itself, while making it risky to photograph the vote. You don't know the vote was actually delivered, ex. he might have gotten a fresh voting paper or punched/stamped excessive options to annul the vote. There is also an electronic evidence trail of the fraud - any caught vote seller will immediately cooperate with the authorities and rat on the ringmasters.

Real world security works on "just hard enough not to be worthwhile", not absolute guarantees.
I think for post people SEO is the part that they get stuck on, but i'm pretty sure you can import posts like you mention.

Does it pull in the post with styling etc.. as well?
monk_e_boy says>"Humans bread dogs ..."

Asians sometimes bread dog for frying. Breaded dog absorbs more sauce, dog being a very lean meat. Yummmm!
Still waiting for the part where they tried to murder you.
Thank you. Unfortunately it can't so far since it depends on other AWS components like API Gateway and DynamoDB.
The HIBP password check API uses k-anonymity so it is secure-ish to use. It's shown here under "How It Works."
When the last hundred people you've seen post that data do so in order to apply a racist judgement, bayesian reasoning says that this person is likely doing the same and engaging seriously isn't going to go well.
contemporaries, really.

But, the US' political ideologies were more easy to understand. France's was always more layered and abstract. Also, fewer peopele were looking at revolutionary France with envy, because of all the violence.

.. that's my take anyway.
It's not clear to me that this really solves the same problems that Nix does.

I'd imagine this solution inherits any problems that pacman has. The Arch wiki states that "if two packages depend on the same library, upgrading only one package might also upgrade the library (as a dependency), which might then break the other package which depends on an older version of the library." (https://wiki.archlinux.org/index.php/System_maintenance) This is one of the problems Nix does not have by design; in fact Nix lets you mix and match packages painlessly.

This also doesn't seem to allow unprivileged users to install packages, which is kind of a side benefit of using Nix.

Docker-esque solutions' issues with reproducibility are well known; I look at https://godarch.com/concepts/images/, particularly how packages are installed:

#!/usr/bin/env bash
pacman -S steam --noconfirm

and I see the same issues that https://blog.wearewizards.io/why-docker-is-not-the-answer-to... warns of. Heck the author even admits this is the case in an adjacent comment: "I want a machine that can be declared and rebuilt deterministically (at least semi-deterministically, rolling distro and all)" (emphasis mine).

Also, frankly, I don't want to run my personal computer like a server, with complete immutability and the need to build fat image files every time I want to try out an additional program. That seems to me like a workflow that's better suited for servers where spending a few minutes for a deploy isn't a blocking operation, and where stateless service design is considered best practice.
It is only a PITA to debug on paper, not when using a graphical debugger.
> "And so we wait to see what amount of death will be tolerable in America as the price of retaining prohibition. Is it 100,000 deaths a year? More? At what point does a medical emergency actually provoke a government response that takes mass death seriously? Imagine a terror attack that killed over 40,000 people. Imagine a new virus that threatened to kill 52,000 Americans this year. Wouldn’t any government make it the top priority before any other?"

This is a very good point and really puts it into perspective. Overall this is an excellent essay. I also really like how he addresses the physical affects of opioids, rather than just saying it gets you "high".
Me too! I love QBasic so much - totally wouldn't be where I am today without it. I met a kid at summer camp when I was in middle school who told me he made his own games and fake computer viruses to scare his parents in Quick Basic. He mailed me a floppy disk with Quick Basic on it once we were home and I've been in love with programming ever since.

It's was the perfect first language. It's so easy to play little sounds or draw graphics, and the environment is basically non-existent so setup is easy. So much fun!
If you're doing Puppet then the plugin for IntelliJ works pretty well with Puppet code, including reference checks and all the good stuff you'd expect from a half-decent IDE.

Can't say anything about Chef or Salt, but with Ansible you get basically shit for help since the IDE just sees a YAML file and nothing more. This is partially the fault of Ansible though, to be honest, modules being standalone scripts that is cool - but they provide no standardized way to inspect their parameters and outputs beyond documentation.
OpenBSD and the impact of culture (2015)
It is pointless to me too. Yet, one of my co-worker told me: "Because even if not using crazy long random generated passwords, using a different one for each login is still a step in the right direction, and being able to remember 200 discreet passwords is hard for almost anyone."

Boggles my mind...
Being able to combine monads like this is part of the point.
In many countries, burner phones require registration with biometrics as well.

For example, Germany requires registration of burner phones with ID or passport before any network is allowed to activate the SIM. The ID and passport obviously are linked to your fingerprints and face.

Signal is advertised to people in oppressive regimes as a solution to avoid the government from snooping on their messages (this security from nation states is further implied due to their framing of Snowden comments).

Requiring an identifier that’s linked to a government ID is the opposite of that.
If you really work the system, the military can be an EXCELLENT opportunity. Likewise, if you need structure, they’ll certainly give it to you.

Some people go in without a plan, do 4-6 years and get out just as aimless as we went in, but by now they are grown and the responsibility for their lives is entirely their own. It’s like trade school, or coding boot camp, or college, you get out what you put in.
For sure, this is possible. But Troy Hunt is well known, and using his new v2 API, at most only 5 characters of the sha1 hash is sent across.

Alternatively, like I did, you can download the 31GB file and do it all locally, and not involve network round trips.

1p is well known in the community for being pretty good with security, so the chances of them implementing this in a different way than they say they did would be severely damaging to their reputation. Once it comes out in local 1p apps, we can verify that they did do it the way they said they did.
The "suddenly" is very disingenuous, when Gutzeit was the one that started the physical confrontation, and had provoked Vidrine just earlier.
College was the first time in my life when I feel like I truly took responsibility for myself

I often here this but I'm somewhat sceptical. I'm not saying you didn't turn into and adult, rather that you would have done that whether you went to college or not.
So the idea is that you would choose your changes in the GUI, but instead of actually changing the target, it spits out the required code to do it for you in a repeatable way?

I would definitely find that useful for Terraform and Cloudformation. Searching for it, I see that AWS has a tool targeted at that: Cloudformation Designer.

https://aws.amazon.com/blogs/aws/new-aws-cloudformation-desi...

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGui...
This is exactly what we do as well and the approach works pretty well. We also tag the associated git repo with a build id and branch name so by looking at the git repo, you can tell if and when something has been built.
More likely - app is relatively secure but it collects and stores all that private info, then they need to work in some dictatorship or paranoid country (essentially a majority of all countries) and then those governments require storing info on their own local servers with which they can either comply or be banned, and then either government misuses this info or it gets hacked and malicious 3rd party misuses this info.
Lots of people may have recently switched to a password manager, and now use it to store old passwords that they haven't regenerated. It's very likely a common use case.
But this was a roommate situation. I doubt most people sign any formal letters when hiring a roommate, as most people don’t come from a legal / business background.

He also handed a check instantly to people who were desperate for money...
Seems kinda cool - works by updating a GH issue per language and you subscribe to updates on the issue. But seems that the issues have been locked and not updated since November without explanation as to why.

Hence cool idea but not actually what it says on the tin for the moment.

[edit]: isn't true the GH UI just wasn't rendering the most recent updates for me. Viewing the issue pages themselves not so useful but subscribing to the issue is really the intended usage anyhow.
Why Does Your Startup Need MVP? – Appus Blog
I guess it's personal opinion, but I find it understandable that business want to learn and improve from cancellations, hence why I don't mind spending a minute letting them know why I'm taking an action.

You're right though, users aren't obligated to give feedback.

I don't like the de-emphasized buttons because they're essentially trying to trick me into clicking the more prominent buttons, which are actions I don't want to take at all.