skysight-inc/HackerNews huggingface dataset:
Is Cisco as evil as Oracle? Because ouch. Oracle is just plain evil. I have no reason to compare Cisco to Oracle yet. I usually prefer TP Link since they're usually effective and affordable to boot.
Being anti-whiteboard is a proxy for being against the "regurgitate this CS trivia on a board in front of me" style of interview, not against the use of a whiteboard.

Most problems in practice that require non-trivial application of algorithms, dynamic programming and the like have two characteristics that make them differ considerably from whiteboard style quizzes. For one, they're going to be much less contrived (pick a random leetcode question for an example of this, odds are it's contrived). Secondly, they're going to be resolved when developers talk to each other about them and there is recognition of the solution, which most of the time is an application of algorithms and data structures with library implementations.

The ability to whiteboard things like "given an array of integers and a target find the indices of the pair of integers in the array that sum to the target" and "find the first missing positive integer in an unsorted array in O(n) time and O(1) space" provides almost no useful information about a candidate's ability to solve an actual problem the company faces in most instances. There are exceptions, but interviewing everyone for the standard of that one exception is asinine.
'Crush Them’: An Oral History of the Microsoft Antitrust Suit (2018)
> But it’s also worth it to consider whether the lack of awareness/awe over Stuxnet vis a vis Russian election tampering is simply due to technology illiteracy, or whether media is not considering the notability of the means, just the effect of the ends.

No, it's because the media is ultimately subservient to power regardless of what they might think of themselves. US attacks on countries designated by power as enemies -- Iran, Venezuela, Russia, etc., are only to be discussed in clinical terms, marveling at their technological sophistication, for example, never in moral terms. Bringing up any introspection of what American reaction would be if Iran did the same thing to us is virtually career suicide for a mainstream media professional. Trying to draw parallels between Russia meddling and Stuxnet, noting that Stuxnet was an attack many times worse, is cutting it dangerously close.
Imagine a delayed killswitch in Intel's ME and AMD's PSP.
This seems like a good idea.
Nah, this is almost easy. In comparison, Flame used a previously-unknown (and still unknown AFAIK) method to compute MD5 collisions on a certificate, which was used for a signature.

https://arstechnica.com/information-technology/2012/06/flame...

This isn't stealing a cert or burning four zero-days. This is dropping a zero-day cryptographical attack, which hasn't been reverse engineered yet.
Interesting. Requires root and a Qualcomm chipset, compatible device list here: https://opensource.srlabs.de/projects/snoopsnitch/wiki/Devic...
I forgot to mention Openshift.

The deployment worked, I guess, because we had something similar to an `iso` locally to do the full install. After that, if you are not using a local registry, you get to some of the same problems I mentioned in another response.

Another problem we saw with Openshift was that it was not clear how we would be able to integrate the networking with our legacy infrastructure. If everything is working inside the cluster or, the rest of your infrastructure is kind of SOA, I guess it wouldn't be a problem, but as I mentioned... we are a bank :D
Anyone know if it is easy to block any user from the EU in AWS? It's been determined that Google Analytics has a greater value than Europe.
If you get to do an AWS trial, use Kops. It works really well.

> Not one has worked out of the box in our environment. Every single one expects to have a direct connection to the internet. Any proxy in the middle creates havoc.

Same. I had to go home and do half the setup disconnected from the VPN so I could download anything without the proxy screwing it up. Something about the google storage servers on IPv4 screws with connections. I'm still waiting for the god security team to fix it.
There's ransomware as well.
I love the incessant deification of Steve Jobs, regardless of his mistakes, juvenile behavior, and constant stories about his abuse of his staff. In this story Jobs mistakes the wrong person for John Carmack, becomes deeply offended by a silly t-shirt, screams at his staff and slams his hands the table like a 2 year old. But the author is impressed with Jobs and makes him out to be the hero. At my work we would call this a hostile and abusive work environment, but within the Jobs cult of personality it's a net positive.
also if you think this is sophisticated i feel sorry for you. Obviously have a lack of knowledge of how these things work. It was heavy state malware, yeah. Other state spons. malware does the same. Example, some in ukraine target power grids. Anyways big words for little things. Only real fame is massive left tard media coverage
Well that's terrifying...
> I hope these internal audits are now a normal part of their business.

They now are, at 3 stages:

- During design,

- Before early field trial,

- Before production.

Stuff like this is bad for everyone so we're spending a lot of effort upstream to ensure these things don't happen again. And yes it's embarrassing when we find existing products that have these vulns but there's a no-blame attitude that's really helping get things addressed instead of ignoring them (which is the default in large organizations). The faster we can find and address the errors of the past, the better off everyone is.
Not quite what you are looking for:

https://blog.asrpo.com/collaborative_trades

but I've heard at least one person wanting to go in your direction (of getting a group and discuss) instead of what I wrote.
Here's a link to the original John Carmack story in case anyone missed it: https://m.facebook.com/permalink.php?story_fbid=214641282559....
Ok, makes sense. It could also be that the HSM was shipped from one office to another after keys had been loaded onto it. Dunno.
Ok here is my email: 1373f84998986cf8@tutanota.com. Identify me! Know that I wont used the email elsewhere.

> You cannot use ToU to bypass GDPR.

Just to clarify this is not buried in ToU but laid out clearly.

So the website says dont give PII. User still does. And GDPR would penalize the website ? Citation please.
A lot of companies won't hire you if you have a criminal record of any kind. Some won't even hire you if you have any record of arrest, regardless of conviction.

Which fraternity?
In this situation, I'd suggest Next.js which is kind of a framework for React applications and instead of trying to understand how React and related technologies are working, you can just start using it. Just go to https://nextjs.org/learn/ and spend half an hour, probably you'll understand how it works and how you can do basic things such as navigating a page or deploying it to somewhere.

I believe, between React, Angular and Vue and all their boilerplates Next.js is the easiest one to understand. And they have a huge example library in their GitHub repository if you want to know how a certain package/library/service works. In your case, this might help: https://github.com/zeit/next.js/tree/canary/examples/data-fe...
You're right, but it can still make it obvious to the reader that you don't actually use all of the struct in a function. I think GP meant something like this:
(Haskell syntax)

-- struct with three fields
data Bar = Bar { x :: Int
, y :: Int
, z :: String
}

-- function from Bar to Baz
foo :: Bar -> Baz
foo (Bar _ _ z) = ...

`foo` takes a whole `Bar`, but in the pattern matching bit you explicitly say you don't need x and y by using `_`.

Also, by enabling an extension[0], you can instead do:

foo :: Bar -> Baz
foo (Bar {z}) = ...

Which I guess gets pretty close to what I want.

[0] NamedFieldPuns
If we are going to have a flawed system, I’m glad when folks like this guy take the brunt of it.

What a nut job.

But yeah, accessing public information probably shouldn’t get you 41 Months in jail.
Ask HN: How to get funding to develop complex MVP?
I have a next generation product design (think robot lawnmower vs motorized lawnmower) that I require significant funding to get to a MVP as it is a complex product. Most incubators or investors I've talked to desire a team, an MVP and customer feedback, but I'm a way from that. How does one find pre-seed investors? Are there any specific (ideally European) firms that are active in this area?
Anything that doesn't require refrigeration would still work though, trucks run on diesel after all.

Which makes me concerned about the future; if the transport network becomes electric, a power outage will cripple things even more. Unless we build self-contained, internet-disconnected charging stations maybe, but that's not going to be done at any kind of significant scale.
You can buy the Simatic PLCs they targeted on ebay for a few hundred bucks.

Industrial automation stuff like this is a common part of the "technical high school" curricula where I live. (of course only on the "press this button and then that happens" level)
Well, an HSM that doesn't meet those requirements is essentially spoiled milk and of little value. I agree many HSMs are found vulnerable eventually.
This is a typical situation for most companies. I've been in the position of the "trusted engineer" several times where conversations with customers can very quickly change the direction of engineering. Fortunately, in all of those situations my boss wasn't an asshole. Honestly, all these recent stories about jobs really just paint him in a negative light.
Searching the Creative Internet
That they're used for those things doesn't mean they work. They're especially not good general intelligence tests.
I think it's a similar design, but I have a vivid memory of a kid in my elementary school (~1995) wearing a shirt like this: black t-shirt with a big yellow smiley face with gory bullet-wound to the forehead. It was a strong image especially for kids. The Watchmen logo is spattered on the side. I can't find the t-shirt I'm remembering but there are similar current examples: https://www.amazon.com/Smiley-Bullet-Black-Adult-T-Shirt/dp/...

> Watchmen Smiley Face: https://en.wikipedia.org/wiki/Watchmen#/media/File:Watchmen,...
> As soon as you do business abroad you will have to comply with the laws of those countries.

Serving a webpage is not doing business though.
I was referring specifically to the inevitability of observation technologies leaving outside their controllers' grasp and becoming increasingly ubiquitous.
"The best ninjas are the ones you've never seen"
Here's a pretty good example of how a proxy can be used from Node.js source code: https://github.com/nodejs/node/commit/f074612b744fecfd1f79fd...
Isn't that similar in that you join with one of the groups?

I mean, yes, the language construct is clearly often used as an exclusive, but it is a language construct where context supplies a large part is the meaning.
Congrats! I've played with this on various projects for year now.

The only thing I keep getting frustrated with is styling with Typescript. I don't like the withStyles HoC but the alternatives still feel difficult to use.

I would love to just use a decorator but I believe there's a TypeScript feature still missing in order to support it correctly. I'm curious if the recently announced TS 2.9 changes will help.
I've seen a lot of people talk about having a separate table for ids that should be removed when you restore a backup. It seems like a plan pretty viable solution, at least from what I've seen.
> My email signup forms are very clear about marketing use, and are double opt in, and subscribers can opt out with a single click. But my research suggests that this is still not GDPR compliant unless there is an explicit consent, which I believe will reduce email signup rates.

But if it required user activity to register for those lists AND you explicitly identified them as for marketing purposes, that seems like you already HAVE consent? I mean, what do you imagine consent to mean other than "an active affirmation from the user that they're ok with this". If it's indeed double opt-in AND clearly communicated, it seems you clear that bar by a mile?
too many programmers cant program and hurt their fee-fees so a company was made to accept fucking 300$ per ad. Anyone who cant whiteboard or pseudo is fucking retarded.
I agree. So long as the plaintext hashes are hashed again on the sever, then it’s more secure.
The world also became a lot more connected, so we're exposed a lot more to wars and such abroad, and we've matured morally speaking and can see that all wars are unnecessary.
Can anyone with knowledge of the "OpenGL permissions and security" issue explain the problem?
Gdprcasualties.com – the graveyard of GDPR casualties
The Equifax breach was already illegal - I assume you mean you think that websites shouldn't keep user information to prevent future data breaches.

This is a bad solution to that problem. So many people's data was stolen that preventing future data from being stolen isn't the most important thing we should be doing. Last I heard it was 150 million people - that's enough that it no longer really matters to the average person if their data is leaked in the future because there's such a high change it already has.

The real solution is to change our systems so that data leaks aren't a big deal. If people didn't ask for a 9 digit number to identify me, as if that's a reasonable thing to keep secret, then it wouldn't matter if everyone in the world knew it. That's the problem with data breaches like this. That's what we should be fixing in response to it.
What is Search Neutrality? - Hackernoon
How about "night-mode.com": developer jobs at old-school companies that interview with a blackboard and chalk.
You need to travel to the US. They are applying laws domestically.

The US is quite opposed to extrajurisdictional law enforcement which is why they don’t sign onto things like the International Criminal Court.
Whiteboard problems work great as a general intelligence test if administered correctly. A well designed whiteboard problem will filter out people of lesser intelligence. This means the people you would be working with would generally be more intelligent. This is not a bad thing.

Furthermore, whiteboards are great communication tools. I spend some time on VRChat's whiteboard room teaching people various algorithms, and other abstract things to help me learn. Someone who knows how to use a whiteboard and communicate correctly would be a better hire than someone who doesn't.

If the company you work at uses whiteboard problems to vet interviewees, just drill them. With a little practice, you'll have a better chance.
The solution is to keep a list of "things to exclude" if a backup is ever restored. This is reasonable. Rewriting old backups is not reasonable.
Yeah this would maybe only work for simple problems, that one can solve without thinking too far.
> Does being a carpenter with vast knowledge of tools give you the ability to build a rocket that can fly to mars?

Design? Probably not. Build? Absolutely! Experience with tools translates well between projects. Give an experienced carpenter the tools and blueprints for a rocket, and they would have a good shot at building it.
Well, it also gave Iran a few billion dollars, a lot of which seems to have flowed into the coffers for Hamas, Hezbollah etc, both of which are terrorist organisations.
Also: we only know about this because one of the world's best hash-collision experts, Marc Stevens, wrote a tool to detect the method of collision used when we have two different cleartext with the same hash.

He's also one of the minds behind shattered.io ; which happened because Google decided to invest some resources on his research (estimated at around ~300k). Imagine if he "simply" took a job working for an intelligence agency ?
i used to use this (in my company) to provision OTP secrets. this was before iphone. after provisioning, OTP requests could be offline. thus no worries about sending an otp over sms.

of course the secret was itself encrypted via pre-provisioned Key Encrypting Key.

or users could manually enter the wrapped otp secret on the off chance the sms didn’t work. it worked for nokia and blackberry so that covered nearly 100%.

the article talks about abuse but in my case quite a useful “backdoor”.
Actually I wouldn't be surprised if anyone else at Apple behaving like Jobs would quickly receive a warning from HR if not shown the door.
Well, the difference is that theft is a natural law. We are born with an instinct it is wrong.

Having a data processing officer in the EU for some definition of significant business is not a natural law and requires careful parsing of the legal text.
Why Isn't Your Email Marketing Paying Off?
If you already have an email marketing strategy in place, yet you are not getting the expected results, take a closer look at what you might be doing wrong.

https://www.engagebay.com/blog/email-marketing-effectiveness/
10 tips for writing a better work email
That's the point. "What you're about to hear is an actual call." ("...what you're not about to hear is that we have heavily edited it"? Or perhaps "lightly edited it?" Well nobody knows - and since Google aint' telling, it is reasonable to assume the former).
Reconfigurable Cache Architecture for Storage Systems with Online Workload
The British.
> There are several reasons for that, the major ones being: webservers only log IP addresses if you configure them to do so.

That’s not true. Apache and Nginx default logs IPs. Maybe OP should check his Nginx logs.
Uh, Did Google Fake Its Big A.I. Demo? – Vanity Fair
California hospital giant Sutter Health faces heavy backlash on prices
Adalar Cam Filmcisi
Thank you, much appreciated!
I always wondered if the decision to only have one fire button in Q3A was based off its compatibility with Mac OS, and thus a lack of a second mouse button. Other FPS at the time (e.g. Unreal Tournament, Half-Life) usually had a secondary fire button to allow for alternate weapon functions (e.g. grenade launcher on SMG, zoom on sniper rifle/crossbow, etc), which was mapped to the right mouse button.
> The fact that they pulled it of to break into not one, but two of those secrets is extremely impressive on it's own.

Did they break into them? Stuxnet had government backing, most articles I've read assume American or Israeli.

If it was the American government (on its own or on Israel's behalf), then it might have 'simply' applied its considerable influence to get the Taiwanese government to get Realtek and JMicron to hand over the HSMs.
I don’t have the expertise to understand if this article is hyperobolic but it was the first article I have read in a while start to finish. The author should try his hand at fiction.
Like automatic differentiation is it possible to use it to integrate too? Kind of like f = ma; a = f/m; velocity = integral (a) dt; position = integral (v) dt ?
Not every company announces a scripted (read: fake) conversation with something to the effect of "this is a real conversation".
Austerity! Of course! That we can all just live here for free has to be the main flaw of the system. Few here earn their keep. Yes, I'm looking at you HN reader!

Lets set up a stock exchange for articles and with a stock exchange I mean a gambling platform. Have all the fun mechanics like hedging, shorting, double or nothing etc

That said we the association of comment manufacturers deserve better marketing and higher margins. Something for nothing is a terrible idea. Our time isn't free. Lets make opening a page cost micro points per comment posted and introduce cheap mega-downvotes.
I don't mind placebo if it works for me. A guy said 'there is no good evidence' while i witnessed it with my own eyes. So who should i trust more, random Joe from internets or my own eyes? Cheers.
What is stopping competitors from burying each other in legal work? Just start commenting names and addresses on various pages and submit complaints
> Aside, SimilarWeb, like Alexa, seems pretty useless for metrics.

Are there any other better metrics than these two?
GitBackdorizer – Is a Proof of Concept That Uses the Lack of User Attention
Summer Weather Awareness Week in Tennessee
+1 to this.

Even better, I would love a site that classifies job offers/companies by:

- Has an onboarding process for new hires
- Has quiet working conditions / open office
- Has clear requirements
- Salary range
- Allows remote working
- Type of interview and time to get a response
> Did you actually look into the GDPR before jumping to these conclusions about the effects on your business?

The fact that I have to look into the GDPR already proves my conclusion to be true. I fully expect there to be few if any issues, but I still need to verify against the regulation, which is thousands of lines of text.

I can't just refer to "salvar on hackernews" saying it's "legitimate" if it's for legal compliance.
How was this Vuln introduced? And who introduced it?
+1 for reminding me how much I used to love Oren’s while living in Palo Alto. :)
In "secure" places, HSM's are basically in a vault with armed guards.
When an EU business buys a service from an American operating in America from their website hosted in America how is this materially different than when a Saudi Arabian citizen visits New York and buys alcohol?

Why would Saudi law apply in New York?
What are the safety guarantees of the resulting program?
"Dear aunt let's set so double the killer delete select all", et al. In other words, a demo is supposed to be awesome...actually running the real thing tends to crash and burn spectacularly. What the uproar seems to be about is that Google insinuates "this is not scripted" (doesn't quite claim it, it's extremely carefully worded: "Google Assistant actually calling a real salon" - never claims it is not rehearsed, just that it's a phone call and a hair salon), while showing something that almost sounds non-fake. Almost almost.
Accidentally in Code
I'm an attorney who's spent the last year or so working on GDPR compliance for a US SaaS provider some of whose clients have EU employees. My understanding is that it's true that EU enforcement is more in the spirit of "how can we get you compliant?" before doling out fines (vs. the US where it can be more "let's make an example of this company by hitting them with a big fine" and scaring others into compliance). I also agree that the authorities aren't going to be handing out 7 figure fines like candy, both because it's not their historical approach and because they don't have the resources to fight too many of those battles. I want to say I read that the Irish authority's annual budget is around $9M. Theirs is higher than most and Ireland is where most of the US tech giants are established due to tax laws. That said, I think to say that GDPR compliance is simple because it's text is fairly readable or that EU data protection law is simply a matter of transparently respecting people's personal data and not being a bad actor as to privacy is an overstatement. For example, the ePrivacy Directive, most known for prompting all those cookie consent banners, can be incredibly complex to comply with. Each member state has implemented that Directive in different ways. Look at this example https://ico.org.uk/media/action-weve-taken/mpns/2013732/mpn-... where Honda sent out emails to its 350k database simply trying to confirm continued interest in being on their list and got a 13k euro fine for their troubles. I don't know all the facts, but from the document, it doesn't appear that Honda got the fine because they were recalcitrant or being terrible actors. And if the fine is proportionate to the offense (not to the size of the violator), then 13k euro might be levied against a small company for whom it is a significant penalty (not to mention costs, legal fees, etc. in dealing with it).