skysight-inc/HackerNews huggingface dataset:
Kudos for a thorough and transparent writeup, and (by the looks of things) understanding that processes fail rather than individuals.

That said, I have to admit to having at least three eye-bulge WTF moments while reading this.

I'm also surprised that there isn't a Remediation step of "firewall the development machines away from the production database".

(And isn't the change to database_cleaner to make it throw when run against remote databases by default a serious break of API compatibility? What if someone's depending on that behavior?)
there's a huge difference between anonymity when someone is looking for you and anonymity in general.

As you've mentioned, if someone wants to track you through Tor, that's still potentially possible. But that's a completely different ballgame than "My ISP wants to track every last website I visit so they can pair that with my address/billing info to sell to advertisers". I don't think my ISP is going to go through all the hoops to find my Tor exit node, just so they can sell that to advertisers. Passive onlookers can be untrustworthy too.

The shades on my windows keep people from seeing me change, but if someone really wanted to see specifically me naked, they could probably enter my house and make the shades useless.

I still consider the shades useful.
Sshd silent backdoor, attach and harvest credentials
Compiled on Windows subsystem for Linux and then ran on win10... what a strange world...
The Dark Side of Enlightenment
Right, but that means you have to have some mix of legitimate interests and consent, and makes this whole thing an expensive exercise, both in terms of code and legal time. If you have an ad supported service, this is going to be painful.
Can Big Tech Stocks Grow Without Limits?
Out of pure curiosity, what about finder is a mess to people these days? I feel like I can move around it smoothly and I use it many times daily. Adding some services like opening a file/folder in terminal has also helped me a lot.
Whups... I meant to say that I can see hand-implementing recursive-descent, but recursive-ASCENT seems to cry out for tooling. Especially since there are so many good tools out there.
Billy Beane is witnessing Moneyball’s endgame
What if I like doodling on all those iPad POS systems?
> "sharpen" should be applied to the skill, not the person? ("sharpen your daily English")

Possibly depends on the dialect. "Sharpen your skills" is probably more common, but applying it to the person (e.g. "This will sharpen you up") sounds fine to me as a British English speaker (though if specifying a specific skill in the same sentence you probably wouldn't use that form).

> But I think the most glaring issue is the way you use commas (lots of unnecessary commas, comma splices, and parallel structure violations).

Definitely true, but that can also be a trait of some native speakers, FWIW. Some of my sentences have a ton of unneeded commas and "loose" clauses when I first write them, until I refactor them to make them more correct. It's certainly not exclusive to non-native speakers.
I just use uBlock. I can't remember the last time I saw an ad on a website.
Black Block Research Interviews Nano Team: Share Your Questions
We're happy to announce that we're doing quarterly coverage on Nano as an independent third party. The Nano team has agreed to answer our questions through an interview with us.

As the first step of our coverage, we are seeking to gather as many of the community's questions as we can. All questions are good: tech, bus dev, progress on roadmap, alternatives, etc. Please fill out the survey here: https://www.surveymonkey.com/r/NANOBBR. We will consider questions submitted for the next week (April 15).
After the submissions, we'll prepare a questionnaire and put it to the Nano team.
Once our questions are answered, we will draft and publish our report and share it publicly with the Nano community (including an annex with the questions and answers we receive from the Nano team).

For those who don't know us, Black Block Research is an independent crypto research firm that provides insights on cryptocurrencies. We published a report on Nano 2 months ago which you can find here: https://www.reddit.com/r/nanocurrency/comments/7wze5e/black_block_research_issues_a_buy_rating_for_nano/

More info on us can be found on our site: https://www.blackblockresearch.com
I'm saying local governments are the best equipped to solve the problem and drive reform.

> The problem will never be solved this way unless it's pushed back to its source.

Well, the problem is that people have mental illness. That shouldn't be a federal issue, and tackling the problem state by state has the same "source of the problem" issue you're concerned about.

The sanest solution and the sanest reform starts local. The legal changes and funding models should probably be state or national. But we don't get there until we expect our local government to be responsible instead of plaintive.
MITM is generally considered to be a mode of compromise, so that's sort of like saying, well, it's not really any worse than being shot in the head. It might be true on some level, but it's hardly any consolation.
The Mice Who Evolved to Live on Cheese Fries: Prowling New York with a Biologist
The Subscription Addiction: The New, New Thing in Business
There are plenty of languages that compile to JavaScript. They don't save you from having to interface with the DOM and other JavaScript APIs, but neither does WebAssembly (which currently has no such capabilities at all, save through JavaScript FFI).
So if I make an ssh tunnel and use a remote DNS, my ISP can still log requests? How?
> Sure, you could use it as a dumb phone, but perhaps then you wouldn't even need the interface.

Well, it's still better than what Symbian provides (I also have an N8). As long as I can browse and post to HN and reddit, use it for off-line GPS, playing music, sms and phone calls, it works well enough for me. It even works for tethering with a USB cable.

I suppose once the battery goes bad, I'll have to move on to something else :)
haha that made me chuckle.
Some places have done this. E.g. Safeway/Vons/Pavilions vs. Trader Joe's, one of them has a neutral sound, the other has that error-sounding notification.

I believe the latter is the generic notification sound and vendors who customized their solutions post-chip swapped it. I just can't remember which is which right now.
They can do this, but your browser would retroactively notice that it happened and go "holy shit that was bad, you should complain to someone about it". This does not solve for all threat models, but it does avoid the "snoopy ISP".
So make it 3D/wk or something. Period ongoing maintenance is key to sustainability.
I think our practices are closer than you realize. Maybe I didn't explain myself well.

The idea that troubles me is including more strict constraints in the database than in the application itself, because that indicates the application isn't fully tested. If the application is well tested, then it doesn't matter where the logic resides, db or app, so there's no standing to the claim that application logic is never enough.

Also, there are many kinds of data. Transactions, sure, reject if it doesn't match. Telemetry data, I'd like to hang on to it regardless of how weird it seems.
Love those paywalls.
Really? Nothing?
At the very least, different credentials in the database for each environment would make sense.

I prefer thorough E2E testing to mocked large-component integration testing (i.e. spinning up a db vs mocking it out) so I can totally understand needing to run tests against a database but yeah reading this was a collar-pulling "yikes" moment for me.

Their remediation steps are good though, for a start... They might want to look into spinning up completely new databases programattically for tests rather than connecting to one...
How can I quickly open a directory in Finder? If, for example I want to go to ~/source or ~/pem what is the quickest way to do this?

I've used macOS for about 2 years now, and I never found a method to do this that is intuitive. Windows Find has a large directory bar at the top where a user can go to any directory by just typing it.
No functionality to cut and paste for one... Adding extensions (for example installing XtraFinder) has become a pain due to the new security features that need to be turned off.
I don't think anyone is arguing this is particularly worse than any other MITM performed by ISPs against their users.
> The kind of fraud prevented by a PIN enabled chip card is supposedly pretty rare.

Are lost and stolen cards not a common problem? I suppose if the card holder reports it to the credit card company fast enough, it would prevent fraudulent charges from going through, but it would be nice if the person who found/stole the card(s) wasn't able to just use it without having to enter a PIN to do so.
Put the receipt in the bag of food, you can even grab a french fry on the way out.
I stayed at Hong Kong’s first 'capsule hotel' to see what its like – a nightmare
Hit Command+Shift+G and it will pop up with a dialog box requesting the path.
Wondering why does any developer need update/delete/drop access to a prod database? Or why would ad hoc scripts have this ability?
https://trends.google.com/trends/explore?q=java,golang
What I want to know is what to do about it by way of probiotic therapy or buffering agents and such. Efficacy of probiotics in practice seems mixed, so what exactly is the takeaway here for the practically minded person who sometimes takes anti-inflammatory medications?
I don't mind the design too much, my biggest issue is all the bugs.

- Files not displaying until you navigate away from a directory and return again.

- The visibly selected file not being the actual selected file. This is most obvious if you hit spacebar to preview contents and it previews the wrong file contents (typically one file above in the list). However, it can occasionally happen with copy and paste, meaning you paste the wrong file!

- Crashes. I don't actually use Finder all that often, typically command line. Nonetheless, I do still experience the occasional Finder crash.

However, in addition to bugs, there is one design issue that I dislike:

- "Recents" being the default when you open a new window. Finder tends to come to a grinding halt unless you swap location quickly as macOS does who-knows-what trying to determine your "recents".
One, a tree view to navigate the directory structure is missing in Finder. Sadly, Gnome decided to copy this as well.

I can't explain well enough why the treeview is better, you'll have to use it. 1) less mouse travel for switching, 2) you can expand multiple branches simultaneously and switch back and forth easily.
I was surprised about a tmux session connected to production DB for days. Though it was idle there are a lot of things that can go wrong during window switching. My colleague also pointed out the subtle error of assuming the value of DATABASE_URL in the system instead of being set explicitly by the test script that could have avoided this.

That being said I am amazed at their transparency over the whole issue and a thorough write up of the whole incident. It's something we can all learn from.
On iOS at least, an app would have no way to determine that unless it was a callkit app that explained how to enable access to your sms history as well (they can’t request it - you have to go to settings and turn it on from what I’ve seen). That would be super suspicious and get extra scrutiny during app review.
cmd+space, type in folder path.
> Buying and selling houses is excruciating

Yeah, I know :'(

> thanks to the number of signatures required.

What!? You found that the hardest part?
I do wonder if you can charge a consent price and a non-consent price, or if that would be fundamentally equivalent to not providing the service?
> Until GDPR shows everyday on the evening news for weeks it will not be well-known

I think we've crossed that point few months ago in Europe. Last year I felt I was probably the only one of my real-life friends who even knew what GDPR was. These days, I see streams of articles about it on social media, aimed at non-technical people. Hell, last week my SO told me she started receiving GDPR-related e-mails at work from companies that are in business with her place.

I feel people do know. Unfortunately, I also fear they only think of it as yet another random EU regulation thing, and not realize the benefits it'll bring.
Cmd+Shift+G to bring up a go to location sheet.
Having to press CMD+Down to enter a folder, or not being able to cut (only copy) files. It was designed to be used via mouse for only the most basic of operations.

I used Ubuntu for years and much prefer the Nautilus (not sure if they still use that) file manager.
I've had a couple instances where the MTA was so messed up either through delays or a weekend schedule change that I had to get off the subway and order an Uber to reach my destination...

SHOWTIME folks seem to be starting again. I still have a strange anxiety that some crazy person will push me into the tracks if I get too close after those string of incidents a few years back. And now I also wonder when the next train derailment will be since those seem to now be a real possibility. Some of our trains are literally past their expiration date and begging for an accident. .
Amazed at their transparency!
In Canada I have not signed for a credit card transaction in years. Everything is tap to pay and chip-and-pin for larger amounts. Extremely convenient.

When I go to the U.S. I usually have to produce ID when using my credit card. Is this because I am from out of country or do they do this with everyone paying by credit card?
only devops should have this info and they should be guarding it fiercly and only use when they know why/when... it would be easy enough to mirror all production data to a 2nd db w/ full read/write that's updated daily or weekly from source. That should give plenty of data for devs to work with.
Maybe because developers do operations for the production system?
Fair enough. My experience is I've been living in apartments for decades and never been asked for cash or cashier's checks.
I would, but there are certain institutions that don't accept any other form of payment other than check or money order. Even if they do accept a credit card payment, they add a 3% or greater convenience fee to the amount.
> The Space Shuttle

Dude, I'm working on own SpaceX's rockets hangar MOC[0] now ;-)

> Also, now I understand why it was so absurdly expensive, way beyond the financial reach of my parents.

Thanks to such open-source software as LeoCAD & LDraw everyone could design any size Lego models on own PC for free.

[0] http://i.imgur.com/dDkSXXK.png
I'm Steven Black and these are the hosts files some diligent friends and I continuously curate for you. Try the variant with the social media blocking if you really want to go cold turkey. https://github.com/StevenBlack/hosts
I think you're looking for Shift-Command-G.

Here's a list of other useful shortcuts for Finder and other contexts.

https://support.apple.com/en-us/HT201236#finder
Self-hosted analytics like Matomo tell you who visited your site for how long and from what IP address and what country, etc. But is this the only reason that people run trackers? I thought people ran trackers for the following reasons (in addition to analytics):

(1) To get targeted ads, and thereby money because you showed a targeted ad. So if the Doubleclick tracker you embedded on your site sees that your visitors are watching lots of dog videos, they can serve you ads for dog food. I suppose (in theory) you could not embed the Doubleclick tracker and instead send Doubleclick the info you collected with your own self-hosted analytics, and get Doubleclick to send you the dog food ad which you insert into your site yourself.

(2) To improve ranking on Google search. I've read that running Google Analytics improves your search ranking as opposed to letting Google simply crawl your site.

And other reasons too?

I welcome any corrections if I'm gravely misunderstanding the technology and motivations.
I thought the same thing. The production database should not even be on the same LAN segment as the development stuff, you should have to VPN or tunnel into it specifically to query it.
Nano cryptocurrency review
> there is no viable competition/users are too psychologically entwined to make the decision to detach from Facebook

People literally said the same thing about MySpace when it held the “network effect” throne. And in hindsight after it lost its users to facebook people came up with all kinds of “well, duh” reasons, such as the profile pages automatically playing music or being so customizable to the point of not having any visual consistency.

Well there’s a ton of things wrong with facebook too right now that will be so easy to point out in hindsight. Facebook is just as vulnerable as MySpace was.
I really like the happy noise the credit card machine at my Safeway makes. :)
Does Home Depot remember your email address based on your credit card number, or do you have to key your email address in every time? I never put it in because I always assume I will have to type in my full email address at every transaction on their somewhat archaic keypads.
Why would a professor from Harvard shovel his own snow? (2016)
Interesting writeup. I loath setting environment variables on long running terminal sessions exactly because it’s not obvious once they’re set.

I prefer to use a subshell for the command and set the environment variable each time:

$ ( export FOO=bar; my_cmd )
Now convince a place that isn't doing this to spend time and resources to put this into place.

'Ship fast and break things' is one of the best and worst cultures in the tech industry.
If your goal for learning is to just be more employable then yeah I think its a waste of time. The language is probably worth keeping an eye on though and knowing enough about it to consider it in the future if it does pick up significant traction.

And to go even more off topic. I thought the go hype was kind of dying down?
"The world's scarcest resources (highly skilled entrepreneurs, innovators and engineers) are being deployed to economize on one of the world's most abundant resources (low skill labor) because prices and availability are distorted by barriers to labor mobility".
- Lant Pritchett
Every company today that you rely on to discover products will shape what you see for their own advantage.

Google puts their own ads more prominently and bans competitors from certain ad spaces, Amazon does the same, as does even Yahoo.

And your worst fear is that maybe the government might end up just as bad as the companies that you see as alternative?
That's exactly what GDPR is for - I can be somewhat sure they'll delete it, and and if I'm wrong and they do what you described, I'll laugh hard as they bleed money when discovered.
Do you have a source on this? Seems like a major concern if true.
Rust and Go, while really similar, kind of are different in use -- the key differntiator is memory management, and memory safety. For a LOT of applications, this isn't necessary or a big deal (see: just about every program written in a language that isn't c/c++).

I see Golang replacing Java longterm and Rust replacing C/C++ (yeah, even C) due to the memory safety and preciseness + speed it offers. It may never be truly C speed, but from where I stand the tradeoff is worth it (and when it becomes NOT worth it, rust/c interop is SUPER easy).

While I like Rust a lot, I think it's definitely not the language to learn if you want a job right now. If you want a job right now, go learn Java. Unfortunately, depending on the company you go into, you can basically throw away the next X years of your life working with uninsteresting/stagnant codebases, unmotivated peers, and clueless management -- OR you'll find companies that are using Java in a progressive way.

If you want to invest in a language that will likely become a big player in the next 10 years, and is soundly written, maintained and progressed in the open, then commit to rust.

Also a sidenote, most good managers/engineers realize that syntax doesn't actually really matter. Good engineers get up to speed in languages they've never used in days/weeks -- if you know the paradigms, and how to design good programs, it's a matter of just changing what you type.

Knowing X language isn't what makes a good developer, it's knowing some sufficiently multi-paradigm langauge X well enough that you've moved past the basics and started re-discovering paradigms, design patterns, and answers to problems in a few problem domains.
I had rented out my basement suite.

My renter's for 1.5 years wrote me cheques with payee of wrong first name, and typo in last name.

No issues depositing any
The bag tax is to get you to use less bags.
Instead of cut & paste you can copy (command+c) & move (command+option+v).
I don't think that smartphones have wiped out the amateur market for DSLRs. If anything, it's increased the market.

It used to be that people would have a phone and a compact camera. Nowadays there's almost parity between phones and compact cameras (at least low-end compacts), so if you want to get a second camera you get a DSLR or a mirrorless, rather than a compact camera. To add to that, DSLRs and mirrorless cameras are now cheaper than ever.
I think the Zeiss Loxia (mirrorless) and Milvus (SLR) lines are an interesting comparison point, since they're both from the same manufacturer, both manual focus, and should both be comparable quality.

The Loxia 21mm/f2.8 is 72 mm long, and 394 g.
The Milvus 21mm/f2.8 is 95 mm long, and 735 g (Nikon mount)

Once you go to a higher focal length, keeping the lens compact requires sacrificing something, i.e. slower glass:

The Loxia 35mm/f2 is 59 mm, 340 g.
The Milvus 35mm/f1.4 is 125 mm, 1131 g.

The Loxia 85mm/f2.4 is 95 mm, 594 g.
The Milvus 85mm/f1.4 is 113 mm, 1210 g.

So, I'd sum it up as, at wider angles, the lens designer probably has a bit more flexibility because of the absence of the mirror box, but at longer focal lengths it matters much less. It's also interesting to me that Zeiss is focusing more on slower lenses that retain the compact form factor. They do have a 35mm 1.4 FE mount, which is huge, and Sigma recently released their FE versions of the Art prime lenses (which are just as big as their SLR equivalents), but the bulk of the Batis and Loxia lineups are f2 and up.

Seems to indicate that while there was indeed a lot of demand for huge, extremely sharp f1.2 or f1.4 lenses in the SLR world, mirrorless customers generally seem OK with trading some of that speed for less weight.