skysight-inc/HackerNews huggingface dataset:
My wife tells me that growing up in India, people would come door to door to collect metal and paper to be recycled -- to make money. That's not practical in the U.S. because people's time is much more valuable. If recycling really made sense, you would not need to mandate it.
the Nazi.. uh nationalists.

That's not a constructive way to look at the world. It's the left-wing equivalent of claiming Obama is a Marxist. Get some perspective.
Hi
Can you tell me something about your remote working experience? What software stack do you work on? How do you find clients? Do you cold call/email companies or something else? How do you keep track of hours? Thanks
That may have been true 10 years ago, when Matt and later Jessamyn were the only moderators, but I would argue that the quality of the discourse on the site started a long, slow decline after Josh joined the moderation team, imposing a no-dissenting-opinion-allowed moderating style.

Currently the number of paid moderators is insanely high for a site with the number of active users that Metafilter has, so the financial problems come as no surprise.
You go here: https://news.ycombinator.com/submit

Please also see the guidelines (https://news.ycombinator.com/newsguidelines.html) and the FAQ (https://news.ycombinator.com/newsfaq.html).
Two things:

1. The theory of "junk DNA" of which the authors received Nobel Price is increasingly looking like...well...junk.

2. The recent discovery of Epigenetics adds a whole other dimension for understanding traits and genetics. Lots of biological science needs to be rewritten/updated in the years to come.
Kazuo Kashio, a Founder of Casio Computer, Has Died
Ask HN: Is licensing your Software a viable business model?
I would be hesitant to trust a controversial screenshot of text because I know that can be faked so easily. A lot of people don't have that awareness, though.
Facial Recognition Cameras Do Not Belong in Schools
>You've all made my point for me. Comment removed, Kommissar.

I don't see a point having been made, but I do see a coward unable to abide criticism of their opinions. Whatever those were.
What's your evidence or reasoning for the claim that unchecked destruction of the environment will destroy us?

I understand that it _might_ and that that would be a pretty bad thing. So there is a risk, but why do you think it's so certain?
I'm not sure what code completion you're using, but if it's contextual, I'm very lost as to how typing a ridiculously long name would be faster than auto completing it. Especially since once you're used to the auto complete, you can basically use shortcuts for specific things you're using in that context a lot. "BindingOperations.EnableCollectionSynchronization()?" oh, that's "bop.ecs". There should be very few options to pick from unless everything is very similarly named...
I could be wrong, but I don't think Rand and RAND are related, despite the name.
The cloud can also be on a VPN.
quick quick replace with MSSQL 9.0 so we can screw this up too
</sarcasm>
Golang – vgo vs. Dep – Dependency Management Tools Explained
VS Code uses JSON with comments for config files. [1]

Technically, this is not JSON. You won't be able to use a standard JSON parser without stripping comments first. But you can use a simple, JSON-like language with comments for config.

[1] https://code.visualstudio.com/docs/languages/json#_json-with...
It looks like they just mis-read you as saying that there are particular sub-groups of humans that are sub-optimally intelligent, when what you charitably appear to be saying is that evidence of our intelligence as a species gets cloudy when we start working in groups as opposed to individuals.
Assume you work from home, you can deduct portion of your internet, electricity, gas bill and mortgage. If you work primarily from home and go into the office, you can deduct millage.

Best thing for you to talk to an accountant.

How is the company paying you? Are you going through an agency? If not, you might have to get an independent insurance.
There is an appeal for me for AMC's special snowflake. I have been going to AMC exclusively for the past 10 years or so because I like their ICEE flavors; I'm quite sad that White Cherry is being removed nationwide. I will go to other theatres if I need too but even before I got a movie pass I've been going to AMC. I'm a Stub's member too, so right now my question is if the points I get from my subscription vs the points from using my stubs card and movie pass debt card is better. I also tend to only go to one or two movies each weekend and max at three.

I'm not the only one like this, but I am a minority.
I often think of that scene in Contact where they are trying to decrypt the alien message: https://youtu.be/HgPSUer1ujM

Multiple genetic materials operating on multiple levels...
But can’t any JavaScript in the browser can call back to 127.0.0.1 (within the bounds of cross-origin policy).

So you have to check Origin/Referer at least I think.

Can you be sure Origin/Referer isn’t spoofed?

Then there’s DNS rebinding which can get around the SOP.

What about maybe strange ways that malformed requests could end up being reflected back to 127.0.0.1 through rebinding?

So it just seems to me that even binding to 127.0.0.1 you have to be ready for just about anything to come in on the socket.
Yeah, great comment. Definitely a "best of HN comments" candidate.
> Having said that, it would be in our long term interest not to continue doing this until the system collapses.

You’ve stumbled through the straw men and into the point, my dude. The way of thinking which frames humans as “best animals” is the same one which makes us incapable of averting suicide by ecological collapse.

Consciousness is not just a cool survival trick, it’s a responsibility.
Wowcup – Worldcup 2018 CLI
What’s incredible here is that we’re not at the beginning of programming, when we built temporary languages that ended up becoming forgotten. Web may be a final form of IT, Angular may be the « right », the final, the perfect way to build applications even in 50 years, just like HTML has become the final way to build websites for the last 25 years, JSON may make legacy, and my grandson might even struggle with parsers that still use JSON instead of this new tech called JSON5...
Yes! Please return the standard and the compilers to sanity.
I agree after the disaster that was the Nexus 6P. After one year the $500 phone proceeds to boot loop. Huawei says they can't do anything because they ran out of replacement parts. Soon after my spouses 6P does the same. Out $1000. Luckily my credit card warranty paid me back the full amount. I'll never buy Huawei products again.
In general, the attractive properties of fluorinated hydrocarbons is also what makes them nasty. C-F bonds are incredibly stable, so they stick around forever. So, fluorination imparts a practical toxic liability to compounds that otherwise are too short-lived to be "toxic" in the "real world."

In addition, any process energetic enough to break C-F bonds will generate incredibly reactive intermediates which then attach to whatever biology is nearby.
I tried, but won't bother with Medium subscription just to post a comment there.

Doesn't work on Edge or FF stable.
Interesting. They don't seem to have a python implementation surprisingly.
My struggle with a panic disorder
According to Platonism, JSON has no spatiotemporal or causal properties (like a datetime format) and thus has existed and will exist eternally. All hail JSON.
Ordinary people, for example I own one. It's a USB crypto device which stores private key and certificate. It handles all cryptographic operations inside, so private key can't be extracted (at least trivially). Actually most people use simple files, but it's significantly less secure, because file could be easily stolen.

As to certificates, they are required for some internet services. There's portal http://egov.kz/cms/en which provides almost all government services for citizens and to use it, you should own certificate (so you sign your request with digital signature and it's treated by law like you signed it with your hand).
As a security layperson my initial reaction was "how can cryptography help with expiring messages, once it's decrypted it's decrypted, that doesn't sound right", but I'm curious if I'm understanding correctly that this is actually two separate features: 1) clients voluntarily respecting "please delete this message at X time" and 2) forward secrecy. And Keybase has tied them together for UX reasons since people tend to not have an intuitive understanding of when they might want to use forward secrecy, but they always want it in the case of exploding messages.
If you go once a month do you save money with the moviepass? I usually get discounted tickets from Costco when I want to watch.
Thank you, yes, I think architecturally there are great advantages to splitting up an app like a client/server even when designed primarily to be accessed over localhost.

Obviously the “server” API is extremely sensitive and I think you have to assume it is effectively exposed to the outside world, even with a 127.0.0.1 binding and a firewall.

I guess if you make localhost users literally login and establish a session then you could consider yourself safe. But it’s a weird experience logging into a local application. So whatever you are doing to authenticate the request as local, it has to be unspoofable.

I just don’t think I trust the HTTP headers enough!
Ngrok will route all your traffic over the internet.
Sorry for your story but it’s not related in the slightest
Not everyone would agree with this statement.
I am not sure why

* Unused Variables

* Unused Imports

are being considered traps or gotchas. They are in fact very sensible design decisions for a compiled language. Having a compile-time error because of mistyping a variable is far better than having to debug a runtime failure.
It's not a root certificate in the CA sense. It can't sign new certificates and is only for the browser to communicate to the https server running on the same computer.

The key isn't even distributed anywhere. It's generated locally and then marked trusted so the browsers don't show warnings.

Checking the list of certificates from time to time is a good idea, although I wonder if anyone really does that very often without some automated help, but in this case Blizzard was doing something that was not only fine (using a self-signed cert to secure local traffic) but the absolutely correct way to do this. (As additionally explained by Let's Encrypt themselves)

edit: I guess the one thing is: If you can find the certificate's private key you can serve your own server at that domain and launch an attack using a trusted certificate without needing admin permission to add your own malicious certificate.
> Can you be sure Origin/Referer isn’t spoofed?

As far as I know, browsers forbid modifying these headers, (especially?) when making cross-origin requests.
Python has two big issues: performance and dynamic typing.

The solution of using a HLL and dropping down to C for performance strikes me as overly optimistic: the only language where one can legitimately claim that it's pleasant to use C for extra performance is Objective-C. Anything else will be different degrees of painful.

I didn't get the solution of using a dynamic lib and calling/extending that from Python. One would end up with 500kloc of Pascal and a Python one liner. All the work still happens in Pascal.
To be fair, the complicated openssl invocation is largely because OpenSSL is crap. Let's break it down:

"openssl req x509"

This is a dodge because we don't actually want to write a CSR and then sign the cert, we're going to skip all that so we're using a sub-feature of a different sub-feature. Fine.

"-out localhost.crt -keyout localhost.key"

There surely must be nicer ways to set this, but it's not so objectionable...

"-newkey rsa:2048"

This is arguably boiler-plate, the configuration file can set this default, but there's a good chance "your" config file was pasted in by an OS vendor ten years ago and says e.g. 1024-bit RSA, or worse.

"-nodes -sha256"

Now we're getting into the nonsense. We don't want DES encryption. Nobody wants DES encryption, and if we did want DES encryption we could specify the passphrase for it, which we didn't, so this needn't be here. SHA-256 has been the reasonable baseline choice here for years and so likewise we shouldn't need to specify.

"-subj '/CN=localhost'"

This is pointlessly arcane and shouldn't be needed, but it's only partly OpenSSL's fault. This abuse of X.509 Common Name was obsolete on the Internet last century, and it's annoying the people were still coming to terms with that in the last few years so that certs which lack Common Name often don't interoperate, and thus it's easier to put it in anyway.

"-extensions ...."

This part, which involves a multi-line sub-shell and other shenanigans, is completely out of hand. This is the shortest, least crazy way to ask for the certificate practically everybody running OpenSSL actually wants, and yet instead of being the default or offered with some easy to understand command line parameter, even in brand new versions of OpenSSL it's done only by this arcane hack.

All Web PKI certificates this century are supposed to use SANs (Subject Alternative Names), so you'd expect an openssl feature named say, "-san" which adds one such name, and OK, this being OpenSSL maybe you'd need to manually write "DNS:localhost" rather than it being smart enough to figure it out if you write "localhost". That'd be stupid, but par for OpenSSL. But no, you have to manually specify how SAN extensions even work in the X.509 certificate, as if it has never seen one before, even though every valid cert for the Web PKI has one. It's like if Firefox made you type not just the HTTP port default of 80 into URLs, but actually made you specify that you want to use TCP/IP in case maybe you're using Novell IPX or something.
NewSQL databases still may use consensus to point to a leader for data, its just that data is transparently partitioned and each partition can have a different leader.

In TiDB for example each region (data partition) has its own leader and only that leader can serve writes (but the leader can change via a raft-based election). By default all servers are both leaders of some partitions and followers of others [1].

Putting all your data on one master stops scaling at some point when data is large enough. However, even before that point, even without high-availability requirements, you are making trade-offs which may be good or bad (e.g. throughput is limited on a single master, but latency is low).

[1]: https://pingcap.github.io/docs/tikv/tikv-overview/
And how do you make sure the box will burn at the desired time? What if someone stomps on the fuse?
That's really awesome and very encouraging to hear.
> It's at least worth asking if the streaming future you implicitly envision here -- where one service, presumably Netflix, becomes the gatekeeper for nearly all commercial streaming content, dictating what is available to us to watch and, by virtue of their market power, effectively dictating what producers will be paid -- is really all silver lining and no cloud. (There are also downsides to advocating piracy as the solution, and whether it's convenient and easy is definitely in the eye of the beholder, but that's a different discussion.)

It would be nice if there was a universal protocol for streaming music, video, movies, and etc. It'd create something that people can build hardware gateways to spec.
In some sense this makes sense in capitalism:

If you simplify your job, everybody could do it, and the salary and job security would go down.
“While we regret that Google did not want to continue a long and fruitful tradition of collaboration between the military and technology companies, we are even more disappointed that Google apparently is more willing to support the Chinese Communist Party than the U.S. military,” they[0] wrote.

[0] The letter was signed by Republican Senators Tom Cotton and Marco Rubio, Republican Representatives Michael Conaway and Liz Cheney, and Democratic Representative Dutch Ruppersberger.
While Tesla's claims are probably largely accurate, I agree this seems like a distraction / side narrative for when they don't hit their stated goals and need to raise more money ASAP.

Worked at a startup that used the "we had saboteurs in our midst, but they were discovered and now things will improve" story on the eve of needed new financing round. The story was somewhat accurate but had very little to do with the overall arc of growth or progress.

Tesla will need something to say about why they didn't make their targets, and this is going to be one of the things said.
GitHub – Chocobozzz/PeerTube
I'm having a hard time understanding the use case here. Using a domain name for loopback IP and generating a cert will work fine for internal use. They're saying it's a security hole because you may need to distribute that private key to users. What exactly is that scenario? Shipping an app with a built-in web server? Not sure I've ever seen that done. And could you not solve it with certificate pinning?
> “While we regret that Google did not want to continue a long and fruitful tradition of collaboration between the military and technology companies, we are even more disappointed that Google apparently is more willing to support the Chinese Communist Party than the U.S. military,” they wrote.

The amount of cognitive dissonance in this quote is ridiculous. When I originally read this qoute, I was expecting to find further down that Google is doing defense research with China.

But nope. Google is contracting with a Chinese manufacturer to build cell phones, not performing weaponized AI research with the People's Liberation Army.

Apparently, it's unpatriotic and borderline traitorous to say "you know what? I'd rather focus on building some decent cellphones instead of finding new ways to kill people from afar."
There are diseases for which editing a single gene in the right set of cells would absolutely cure a disease. There might be other genes or regulatory elements involved, but their contribution is neglible.

To me, the pinnacle of human hubris is thinking you can correct the more challenging ones (like the ubergenetic phenotypes described here) without having some sort of powerful technology that helps work with the irreducible complexity of probabilistic chemical systems.
I agree. This is my biggest issue with YAML - the syntax is just so weird and unintuitive. Compare arrays in YAML to JSON. YAML makes no sense.

Then there is the significant whitespace, difficult to remember quoting rules, etc.

I think the only reason it had gained any traction is because it is relatively easy to write multi-line strings in, so it is good for shell scripts, e.g. in CI configuration.

Someone should really come up with a sane alternative that works well for that use case though.
Does your type system work on you? Refined types in Clojure
That's usually what "capture" means when talking about closures.
Note that this article uses a somewhat older and more specific definition of emotional labor, casting it as something done in the course of paid work. These days, it is also commonly recognized to occur in unpaid contexts. (Maybe it was in the 1960s as well, but https://en.wikipedia.org/wiki/Emotional_labor doesn't seem to cover that.)

Having a friend lean on you during a breakup, and helping them process their feelings -- that's unpaid emotional labor. Which is fine! It's just good to recognize it, especially because there's a gender imbalance. Women are commonly expected to provide unpaid emotional labor in the domestic and social spheres, and in traditional labor contexts, women are commonly expected to provide emotional labor on top of their other job duties in ways that men are not.
I never said Apple doesn't do anything for their 30%, and I make no judgements about whether it's warranted. My comment was just a thought experiment about how a law firm might approach making a case for damages, given the conversation people were having.

You may buy iTunes cards. I've never bought them, nor even looked at them. I don't know which of us is more representative, but I don't think that invalidates the broad strokes of a test like I describe.
> If the first one is a problem, you have much bigger problems.

Not necessarily. Your primary drive could have been otherwise clean of things you wanted to hide. If you have data you need to keep safe, full disk encryption isn't a panacea that allows your opsec to get sloppy in other areas.

> Most of the scenarios I can think of where this is behaviour is bad are not really the sort of thing FDE is supposed to solve.

I agree, I was responding to a comment that also said this:

>>> I don't think this is much of an issue TBH, if you're concerned about data access your root volume should be encrypted already.
Previous discussion: https://news.ycombinator.com/item?id=17350278

Connection(s):

https://www.mail-archive.com/source-changes@openbsd.org/msg9...

https://www.mail-archive.com/source-changes@openbsd.org/msg9...
"I resigned just after I had gotten a promotion, but before the date when the promo was effective"

I had interpreted that as being resignation effective before the promotion. But I was probably wrong.
Are you legit saying, "I don't know if extinct-ing most of the species on the planet will wipe us out. It might. That seems like a worthwhile hypothesis to test empirically!"?

When the dice are that loaded, you throw them at your own peril.

When they're that loaded, you keep throwing them because it's more profitable at everyone's peril.
It's interesting you use Birmingham as an example. Birmingham peaked in 1951, but lost only 10% of its population by the 1980s, and is now nearly as populous as it was before. Philadelphia, a comparably-sized city, lost a quarter of its population since 1950, and never recovered. Baltimore lost 40% of its population and never recovered. D.C. lost 30% of its population and is only gradually recovering now. Chicago lost 25% of its population. Detroit lost 2/3 of its population, even while the surrounding suburbs were booming by providing the cars that made suburbanization possible. Major European cities (Munich, Rome, Madrid, London, Paris), meanwhile, grew consistently during that time.

Where is the precedent in Western Europe for a city of 1.8 million people (bigger than Munich or Barcelona) losing 65% of its population? It doesn't exist.

And unlike Birmingham, whose decline was tied to specific economic problems, the metro areas of these U.S. cities continued to do well despite staggering population losses and ghettofication in the core cities. It's not like the suburbs of Birmingham were prospering while the core city was in decline.

Europeans really don't understand the scale of the race problem in the U.S. Many Americans don't understand it--it's hard to understand until you spend some time in Philadelphia, etc., and see a place that is majority minority and disproportionately low income, surrounded by prosperous mostly white suburbs. It's a demographic trend that happened literally because white people didn't want to live next to black people, and simply left.
"There's no additional fee to use it" then? ;)
I would argue not, but that's the point, right? Do we have a large enough well-connected graph of reproducibly buildable packages, and if not, what should be fixed first?
> I am predicting with a high degree of certainty that you will not do so over 30 years

What is the basis of this prediction ? That index fund are more diversified that individual stock picks?
phys org link https://phys.org/news/2018-06-universe-ordinary.html which has a bit better explanation.