skysight-inc/HackerNews huggingface dataset:
I work on encrypting movies for distribution, so there's a spectrum of attacks we try to consider.

1. Beginner opening Firebug / Devtools - use UUIDs for all the things, don't make anything guessable. Scrypt/bcrypt passwords on a separate Oauth system for all passwords / logins, manage all sessions with access tokens that are checked on each operation, allow immediate revocation of all open sessions.

2. Novice / Amateur attacks on the API or backend - make sure as much security as possible is in global middleware on the application, on by default, opt-out explicit. Long random access tokens, use either DB checks or constant time comparison to verify, do rounds of self and third party testing to make sure there's no cross privileges or escalation.

3. Protect against ourselves going rogue / being compromised - all keys in a HSM, the HSM also has the list of certificate chains it will trust, only modifiable by N of M keycards held by top execs, assume compromise at every stage and design the systems to mitigate impact. Ideally design so catastrophic attacks are impossible without collusion among top level company execs, and all other attacks, even when successful are downgraded to inconveniences, preferably minor.
> I find it concerning that one person was able to push malicious code to 'production'.

Production line software is almost certainly handled separately from the software that runs their vehicles, and isn't "production" in the usual web sense of being customer facing. This sounds more like someone messed with their factory automation setup.
Separating immigrant families isn’t just wrong, it’s a war crime - Twilio CEO
How EPAT Can Help You as a Trader
Depends. First one was a copy of something I had seen work, but integrated with a different service. Second (higher grossing one) was just something I noticed in the marketplace that was getting bought but didn't work very well. A third app was a copy of the second, but a bit different, which also did well.

You'd think all low hanging fruit is gone, but I don't think this is the case. It doesn't need to be an original idea if the alternative isn't working very well, for example.

One thing I can tell you: there are a lot of opportunities you miss because you're not paying attention and busy with work or other random things.

I personally wish I had more industry specific knowledge so I could go disrupt things, but getting up to speed in an industry is a lot of work if it's not something you're at home in.

I also read a lot (and probably too much)
https://github.com/aseprite/aseprite/graphs/contributors

He's clearly the top contributor, but not the sole contributor.

Sadly, it's why there's more and more projects adopting CLAs. Some that say that all the code you're contributing is owned by the project and not yourself. Allows for future relicensing in some cases.
As opposed to eating today? As per the fine article, legal fishing methods net 0-6 KG of fish per day. Explosive fishing nets 15-45 KG of fish per day.
>The problem comes down to the engineers and researchers involved.

>As an INDUSTRY, we have some very important decisions to make, one of which is, "will we work on this type of system knowing full well what it will be used for?"

Its the same question engineers and researches who design bombers, and missiles, and weapons of all kinds should be asking themselves. Unfortunately there are always enough people devoid of morality and/or willing to defer to authority and facilitate the violence of authoritarian governments.
Once you understand the borrow checker and how you can do a lot of zero copy string processing after you read in a file you will see it's a bit more than being statically compiled.
Reddit discussion here (with lots of good tips / info):

https://www.reddit.com/r/node/comments/8s2y7b/til_consolelog...
> When a spaceX rocket blew up, he claimed sabotage.

That is false. All they said was that they were looking at all option, he mentioned sabotage as an offhand example of what they were investigating and he explicitly said in that very first comment that they had no evidence.

After that the press and twitter got hold of it and blew up story.

SpaceX insisted again there was no sabotage and announced that the problem was about COPV tanks.
Censorship – EU copyright reform kills free information exchange
Sandia Lends Arm a Hand with Astra Supercomputer
... is ... list of organizations ...

... are ... organizations ...
IoT devices are generally built and programmed by electronic engineers. They have no knowledge about software security and neither do they care.
How many organizations? A hundred: plural. "There are a hundred organizations.."

How many lists? One: singular. "There is a list of a hundred organizations.."
How could this possibly be true when the majority of wealth is held by a minority of individuals?

You went from value to wealth too fast. And this catchy sentence is only true because some statistical institution said so. Read De Soto about dead capital : http://www.thepowerofthepoor.com/concepts/c6.php

> The developed world has devised a formal property system of titles, title registries, and inclusive property law that includes real estate used for homes or businesses. We in the West take that system for granted, probably because it is invisible to us. De Soto shows that this is in a large part why some nations are rich while others remain in poverty.

then by definition wealthy individuals are disproportionately able to express value

How do you think "everyone able to fairly able to express it's own value" would work ?
Europeans now sail to Somalia to fish. They are doing terrific damage there, and the local human and animal populations there are suffering food shortages as a result.
Making a hash of it: explaining hash codes
> With that in mind - which are you more worried about? Something spoofing your Bluetooth pass code using some advanced tech, physically unscrewing the back and deconstructing the padlock, or the third option: chop open the shackle?

Are you being obtuse? I'm worried about the options that are 1) easiest to perform and 2) arouse the least suspicion.

So, obviously the first two by a mile. The tech is not advanced.
I’m having trouble finding out if the earlier Chinese death was or was not caused by autopilot. All I see are opinion pieces. Do you have a citation for that?
I don't see a pattern match anywhere in my example. And it's not in the slightest "unpredictably ordered" and has much simpler control flow.

> You still are going to have a case1/case2 decomposition in your second version. It's universally worse.

No. There is simply none. The producer makes them as two, and the two are processed independently. There is no problem if you don't make one. If you had ever tried the approach I propose out you'd know the flexibility that comes with it. (I'm currently working on language tooling, and there it is absolutely the case that it's very easy do without ASTs, and process the cases independently).

The only thing I "handwaved away" is the calls:

s1, s2 = process_data()
process_case1(s1)
process_case2(s2)

There is no pattern match there, sorry to disappoint.

Where I need to relate the individual items of s1 and s2 in a common ordering, I've had great success with this approach:

s1, s2, forks = process_data()
process_case1(s1)
process_case2(s2)
process_forks(forks)

There, "forks" does contain an ADT of pointers into s1 and s2. But it contains nothing more, so it's very minimalistic. The advantage from the first case is still there: Most code profits from the homogeneity of s1 and s2, and from the actual, physical decoupling of the cases, and so much pattern matching just goes away.

(Btw. I'm not interested in fancy FP constructs. You will not convince me that you can process ADTs without pattern matches. You might be able to avoid writing them down in the source code, but I care about what actually happens on the hardware.)

(And actually I think avoiding to write down the pattern match in the source code and only generating it magically with higher level constructs is a bad, bad idea. It has poor readability. And it encourages the mindset "let's just do the worst shit on the actual machine. We can avoid writing it in the source code, and we don't care what happens on the machine and how slow it is. And we're too lazy to think about actual solutions that actually avoid real work".)
Blockchain in Ticketing
Utterly horrifying, but ultimately irrelevant. No lock of this size is meant to be anything other than inconvenient to open. Angle grinders are cheap, and more easily wielded than HTTP request crafting.
Isolation is probably an important factor for the development of an accent
It's insecure because whoever intercepts the unencrypted HTTP request could redirect it anywhere, i.e. to their evil site instead of your secure site.

But if you set the Strict-Transport-Security header[1] that will tell the client to go directly to HTTPS in the future, without needing to be redirected, so future requests will be secure as long as the initial redirect request is not intercepted.

[1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/St...
If you feel this way you should never open source your work. Licences like the GPL as well as licences like BSD/MIT explicitly allow for forks like this.
I don't see any issue with the phrase "virtue signaling" per se. My issue is with the implicit or explicit statement that it is useless. Virtue signaling is cool. People who say it with a mocking tone of voice aren't.
Did your staging or deployment team review code?

And what stops a single member of the staging or deployment team patching the build scripts, binaries or just installing their own software to a server?
IBM’s machine argues, pretty convincingly, with humans
I would add that isolation is a fundamental factor in the theory of evolution.
Saudi National Team aircraft caught fire in mid-air but no person were injured
The footage itself was real video from a real camera, but the announcers said the footage was something different than it actually was. The YouTube _recording_ of the livestream was also edited after the fact without any mention that it no longer reflected the originally broadcast. While technically not 100% fake, I think at the very least it would be fair to call that misleading. If this is the closest you've ever come to calling someone on the internet an idiot, I applaud you for your restraint.
1.
Burn down the night
By
Craig kee strete

A fictional drug trip with Jim Morrison

2.
Budding Prospects
By
T.C. Boyle

A group of friends leave San Francisco in 1983 to start their own marijuana enterprise out in the country

3. Fear & Loathing in Las Vegas
By
Hunter S. Thompson

"when the going gets weird, the weird turn pro"
The Philippines are catholic so birth control might actually be illegal, if the Catholic Church is concerned about the environment they need to promote birth control not present it as a cardinal sin. Countries like this the pope holds a heck of a lot of sway. He talks a good game about global warming but here is where the rubber meets the road. For the sake of the common good they need to shift the focus of sin from sex to wrecking the environment and causing overpopulation.
It never was hip I believe - the perceived userbase of COBOL were "men in suits and black leather shoes", i.e. non-tech, business/MBA staff.
As far as I can remember from high school, heat transfer is proportional to temperature difference, as well as coefficient of something-o-rather. I think icy water beats cool air on both of these.
Thanks! I was afraid it was yet another tricky English rule.
however there are cases where an attacker doesn't want to arouse suspicion, and Angle grinders are kind of noticable.

This would allow for an attack where the lock appears to be operating successfully, but someone has unauthorised access.
Fully agree. In an ideal world all of this would be locked down, but you've gotta be prerty naive to assume that everything is perfectly locked down.

There are areas that I couldn't push code willy nilly, namely in the security space. But I'd be willing to bet that a majority of teams at any bigN could have a single bad actor cause some damage... That's just the maturity of the industry.
How to get reproductible benchmark results
ChaCha20 and Poly1305 for IETF Protocols
I wonder why the "message" field in the response says "API调用成功" ("API call succeeded", I think?) if this is a Canadian company. Did they just buy the locking solution from some Chinese OEM?
The GATTACA Trilogy
Being unaware does not mean you're an idiot. People who don't care or give a shit about technology or available hardware offerings are not idiots. They just stick with what they think they can rely on. I assume you know that. Now who's arguing in bad faith?
Why your tokens could be worthless
> Even with code review policies, there is still a short list of people who can push to production without going through code review.

That's completely unnecessary and should not be the case. If you need something pushed quickly, you can get a colleague with review bit and get them to ack for "urgency" reasons after a quick lookover.
Of course your authentication scheme should be secure even if someone knows how the user IDs are generated. With that said it might be a good idea to exposing something like GUIDs to the user anyways, for example if you are worried about a competitor getting an exact count of registered users / products / orders (which the competitor would get by themselves doing the action and observing the created ID).

https://tomharrisonjr.com/uuid-or-guid-as-primary-keys-be-ca...
There is no license file in kparc.com, neither a single comment about it, or even about its authorship. Nevertheless, it seems to have been developed by Arthur Whitney, so I guess you could ask him. The kx forums may also be a good place to ask.
they can happily wait until a driver who happens to have dropped someone off nearby is willing to take them for $7

... But you can't know whether that will mean a 4-minute wait, or 40 minutes ... or forever.
For this reason the scariest bit is the ability to access account information via their online systems - sounds like a map of locks that aren't locks.
Technical debt is already has similar business concept in "expensive" money - Funds that you raise from VCs while in distress on bad terms because there's no other way to do what needs to be done fast enough. Programmers paid with expensive money trying to argue that they need more time to write high quality code because 'future' will seldom win that argument.
If you're applying for jobs requiring 2 years experience and you don't have that on your CV then probably you don't make it past HR. The hiring manager never sees your CV.

Also, most jobs ask for a particular programaming languages and usually an architecture. i.e. Ruby on Rails.

If your CV isn't targetting the skills asked for in the job you won't get past HR.

CV --> HR --> Hiring Manager --> Interview --> Hiring Manager --> 2nd Interview --> Offer

You might be stuck at the 1st stage.

When I was starting out I got on a free course that helped with my CV and got me an unpaid intern poisition. I worked for free for around 9 months, then I progressed rapidly after that.
BTW, elsewhere I just read that the amount of forests in England has now recovered above the levels recorded in Domesday Book (William Conqueror's land survey in 1086).

Same's happening in many countries in Europe. I have a picture of my birth home, taken in 1903 from a nearby hill. The landscape is mostly bare, almost everything except the actual fields is used for cattle. Now you can't take a picture like that. Almost everything is covered by a forest, but you can't see it from the trees growing on the hill.
Badge generator online. Makebadge.com
In a different market, with a different product, this could have been a funny success story 10 years later.

Something like:

> "when we launched, our [thing] was totally insecure and we had just thrown together a bunch of spaghetti code over nights and weekends- anything that would ship. Then when we hit it big we started investing in the process and now our [thing] is the best, most secure one on the market"

Too bad in this case [thing] is a lock, where proper security is it's primary, and single reason for existing. There's no 10 years later for this one.
http://jlouisramblings.blogspot.com/2013/01/how-erlang-does-...

sorry, i should have said "reductions" not "instructions", and proc, not function. I'm an Erlang noob.
wow.check out this cool forum http://mawazo.byethost7.com/index.php
Dialects are interesting. While it's still mutually intelligible, it's an accent. I wonder whether the Liberal accent will develop into a separate language like Louisiana Creole?

I made some graphs about the status of languages in Windows/macOS/Ubuntu/Google Translate/Facebook/Wikipedia/IB, and included a section about dialects of Chinese.

https://news.ycombinator.com/item?id=17344466
> There are a ton of community-authored Chef cookbooks available. Which at first blush, sounds great.

Welcome to software development! Not as easy as it looks is it :)

EDIT you may find these articles helpful (or at the very least food for thought):

- https://blog.codinghorror.com/dependency-avoidance/

- https://www.joelonsoftware.com/2001/10/14/in-defense-of-not-...
My native tongue (Turkish) is one language without grammatical gender. Learning languages with it, it was immediately clear to me that that was a problematic thing. Luckily no revolutions are needed, as languages tend to become more analytical and lose grammatical gender progressively.

I think that what enabled women to gain many rights and at times actual equality in most societies was/is technology. Before widespread use of advanced technology, we needed actual muscle power to survive, and that was what shaped the societies since hunter gatherers through various stages of agrarian societies. As machines substituted raw muscle power in many areas of production, women could become part of the workforce too. And thus we had a virtuous cycle of more potential and more power, which affected in turn women's rights and their participation in many other areas. Since the decades following industrial revolution, they became more and more present steadily in politics, academia, culture, etc., becoming quickly co-protagonists of modern life.

Thus, I believe women should really get into technology, and become actual tech people instead of many faux-techie types we see that are promoted as symbols of how feminist a workplace/org is or as figurines to "lure" women into STEM and IT. I really want women to be the change they want. Today, there are few women in FOSS that are famous and revered for their technical skills, actually only Jessica McKellar comes to my mind (and I'm not talking the designer types here). I think they should just force their way in into the building blocks of the ecosystem.

As males, what can we do? Well, a Linus-y mailing list turns me as a male (from Turkey where both men and women enjoy casual swearing). So we get rid of it, not only to include more women, but also more men from among the sensible, mature demographic. We also do away with the caricaturising stereotypes. Many people think a programmer is an asocial and overweight nerd living in a cubicle in the morning and isolated in a badly-lit room in the evening/night. So we can just not spread misinformation about us. We also maintain our decency around females, because many weird shit guys do that I read in similar threads here in the past is just straight-out psychopatical and very cringy. Other than that, it's on women to make the decision and pursue the careers.

I dream of a world where one's sex is just a biological detail that matters in their amorous affairs and private life. And, futhermore, I know that it's totally possible ATM. It's only a matter of time.
Some of this just came up on StackExchange, by coincidence.

* https://unix.stackexchange.com/questions/450223/
> Could that be a more efficient model

No, because what the CPUs have is the advantage of being able to have specialized circuits with the new answers in each clock, every instruction in every pipelne stage and so fast adaptation to the use in run time.
I have reported Apple Maps issue in the past. It’s been 3 months and the issue is still there. And the problematic place is 7 minutes driving distance from their Apple Park. I don’t think I’m reporting any other issue - waste of my time.
Sure will see you in your horse carriage soon.
Residual Plots for Regression Analysis
This paper covers all the mainstream languages but I feel an "alternatives considered" section is missing. I would love to know what's the author's input on Swift server side, Elixir and Crystal.
“Invincible to the people who do not have a screwdriver”

https://boingboing.net/2018/06/15/high-tech-lock-is-invincib...

Which incidentally is also maybe and issue for tapplock

https://www.theregister.co.uk/2018/06/15/taplock_broken_scre...
Any competitor around?
While your honesty is intriguing, suggesting people do this is pretty immoral. Why don't we spend our time online talking about ways to do things fairly, that'd probably do humanity a favor instead of instilling behaviors to the detriment of most of us.
I use Facebook for a large part for the events, and it seems to suggest mostly appropriate events for me. Occasionally, it will keep suggesting a sponsored event, but I can hide it if it becomes too annoying.
Nobody should sign up for a job they don't want to do.

Either its never too late to opt out of any cause.
While this is clearly true (and is exactly what was being described when "technical debt" was coined), the unfortunate reality is that we often take on huge amounts of technical debt in order to fund the equivalent of pizza parties. Having eaten all the pizzas, we then have to pay back the debt and frequently the company can't afford it.

This is one of the reasons why you must not fear the refactor. Sometimes you need to get that code out the door because the business requires it. Then you need to pay back the debt -- by refactoring that mess every time you touch it in the future.

There is no such thing as "technical inflation" to magically wipe away our debt. It's important to have good lines of communication so that the business doesn't get used to squeezing development in order to eat pizza (because, why not? It's free!)
Do you have a brief example, or is it the normal "I am a str".to_string()? I still have a long way to go with learning how Rust works.

I've heard about zero-copy in C and C++, but don't have an idea of how it's implemented in practise.
I'm glad to see evidence that security theater fantasies are alive and well!
I purchased Aseprite because it's nice. I'm curious if the author has ultimately benefited from changing the license, though. I'm not sure what it does practically aside from that Linux distributions can no longer package it.
Somalis dont eat fish.
So yes, here it is a tradition that prefers starvation to using "poor mans" food.

https://www.somalispot.com/threads/why-do-somalis-hate-fish-...
I've got the same experience in Lisbon. When Uber showed up drivers were great, they could follow directions, they always asked about the radio and the AC, they never complained about the pick-up/drop-off places and didn't have inappropriate conversation, they spoke perfect Portuguese and/or English.

4 years later, we have drivers that can't follow basic directions, that don't speak either English or Portuguese, that leave the turn-by-turn voice on, default to the terrible EDM stations (they used to default to neutral, low-key radio stations) and worst of all, drive very dangerously.
So futhark is designed to be small and specific to a single class of problems. Has the author considered implementing it in another language as a DSL?