skysight-inc/HackerNews huggingface dataset:
There was a topic a few months ago about running JavaScript code in ring 0. People used similar arguments to claim it was safe enough. A v8 engineer chimed in to explain the reality of JavaScript engines.

https://news.ycombinator.com/item?id=17186842

JavaScriptCore has a huge surface area. It is measured in tens of megabytes, whereas Lua is measured in hundreds of kilobytes. Wikipedia chose Lua because it was small enough that they were able to audit every line of code for security. Verisign approached Lua the same way for their high-reliability servers.

Consider the complexity of JavaScriptCore. Their new-ish "FTL" optimization engine stands for "Fourth Tier LLVM", which means there are at least 4 levels of runtime optimizations JSCore performs on code, which is a lot of non-trivial complexity. And JIT means they cannot utilize no-execute bits in hardware.

Then there is the memory and power-consumption. Lua's footprint for a VM instance is tiny. It is also a very efficient language, even in interpreted form. JavaScriptCore is comparatively heavy in both regards.

Remember that Apple Watch still does not have Safari and JavaScriptCore is not available for watchOS developers. Presumably this decision is partly influenced by memory and performance constraints. Lua is trivial to get working well on watchOS.

For a core feature, it makes sense to have minimal dependencies with a minimal footprint so plenty of room is left for user applications. Remember that Apple probably has a bunch of skunkworks devices in their labs they hope to productize someday. And many of these might be tiny portable devices with minimal hardware capabilities, like Apple Watch (or remember all the different iPods?).

Lua's tiny implementation and extreme portability (written in pure ANSI C) make it well suited for this role. Apple won't have to port Lua to every new experimental CPU architecture they try, whereas JavaScriptCore has a lot of platform specific #ifdefs which have to be dealt with for every new platform.
Blindfolds just seem unnecessarily humiliating, and not all that secure. Blindfolds can come loose. If it's really that important something stay secret, put it behind a wall.
> Historically sailors were actually quite bad swimmers

It's not just historically. A lot of people who work on the water these days in developing countries are still terrible swimmers. One of my friends was a dive instructor in Indonesia for a few months, and apparently the guys skippering their dive launches couldn't swim. Since it was Indonesia, they also didn't bother with wearing life jackets.

I don't know how they managed to spend their life living on an island and not learn how to swim. Apparently Fijians are also terrible swimmers. It just doesn't make sense to me. Obviously they aren't going to swim between the islands, but it seems like a fairly essential life skill when boats are your main method of transport.
Please don't post flamebait to HN.

https://news.ycombinator.com/newsguidelines.html
San Francisco’s imposing transit center ready to roll at last
I am sorry for game and compiler developers.

or is there any other group that cares about this today?
Wu is not the least bit deranged, as a cursory reading of her FAQ and other posts will attest. Vice has beclowned itself and destroyed her living.
Please don't break the site guidelines just because someone else did. That only makes things worse.

https://news.ycombinator.com/newsguidelines.html
I just happen to ride a lot of above-ground trains. E.g. much of the New York City subway goes above ground, sometimes pretty high, in Brooklyn and Queens. Same applies to quite a few cities (e.g. London and Moscow, off the top of my head).

But okay, let's imagine out underground walkway. Since it's underground, you can't walk on and off where you want; you only walk off where there's way up to the ground. This eliminates much of the allure of the system. Now you want to plan ahead and be ready to get off when you're next to the exit. If you missed your exit, you have to move to the next exit, or maybe cross the tunnel and go to the band of the opposite direction, and walk back a bit.

Please notice how the low-speed bands then need to run the whole length of the tunnel, adding little to the carrying capacity: few people want to travel at the speed of walking when traveling at the speed of a train is a few meters across.

If we let only the faster band(s) through the length of the tunnel, and limit the slower bands to the exit areas (pretty long and wide), we'll face the problem of walls: our band is moving fast, and nothing separates it from the walls. So we sort of need inner walls on the band. But they need doors to allow people in and out in the exit areas. And the doors need to be shut when the band is in the tunnel. It starts to look like a... train? Only an endless train with a peculiar way of boarding.

This endless train also has a downside: if anything goes wrong, the whole band/train has to stop, it cannot be re-routed. What if we segment the band into individually routable parts? Only then they'll have to stop at exit areas to allow safe getting on / off them.

Well, we have reinvented the subway.
Better radio tech can deal with higher noise floors. It's not as if the military has to ground their planes whenever the bad foreign leader du jour cranks up his WiFi...

I know there would be a transition period during which people would be pissed off that FM had gone away. After we got through that transition, we would enjoy many benefits.
Thanks. I think I need to nudge him to do some more of his own research. He definitely needs anything that may help.
Getting the same result doesn’t mean a study is replicable or a result is reproduceable. If you don’t use the same methodology it’s meaningless.
It's a very new offering, the Linux App Services are still in beta, I have no idea why you would roll it into production expecting no hiccups. AWS is also new on this. Give it 6 months and let the kinks work out before migrating workloads. Seems like common sense.
"We've gone a long way towards making sexism less of a problem for everyday women."

I couldn't have asked for a better example of precisely what I was talking about. We are so primed to jump down people's throat because of SEXISM that by the time you reached the end of your post, you've already slipped into the assumption that it's the only possible explanation, and are lecturing the doctors in question about how sexist they are and how they should stop it.

It is counter to the principles of science to be so sure, though. It's not that large of an effect, even with the population size, and there's plenty of room for some other systematic error to be the problem.

But you've been programmed to assume that if I'm bringing up the possibility that a scientific paper may have a second explanation, then politically I must also be denying the existence of sexism in the universe and must therefore be downvoted and also lectured to about how important it is that we not be sexist.

But I reject your attempt to exert moral superiority, for the exact reasons I gave in the original post. What's important is not shutting down sexism and scoring moral preening points for having Right Opinions. What's important is finding the real cause, so we can address it. Science is filled unto overflowing with examples and inductive proof that when people go into something with a predetermined conclusion about the causes of some phenomenon, they are often wrong, and end up doing great harm because of it. If we have to choose between getting to yell at people because Sexism, or actually fixing the real problem, which is it going to be?

Unfortunately, as your own message demonstrates, which I have no reason to believe is particularly exceptional, I know the answer. In 2018, it's getting to yell at people Because Sexism, and to hell with whatever the real reason may be. We already know the real reason, and it's Sexism. Because in 2018, even if the real reason isn't sexism, the real reason is still sexism, you just must not be looking hard enough.
> returning cash to shareholders

Just to emphasise this point more: to first order, a buyback of $n of stock reduces Apple's market cap by $n. Apple would have hit a trillion much sooner had it not bought back so much stock.

This article is hilariously off-base.
Check the "hole in the Strava data" maps at the bottom of this article:

https://charliesavage.com/?p=1173
I would be surprised if signing up for those alerts didn't also constitute an "opt-in" for advertising sales based on your purchase information.
You say she’s lost it. In my view, she just hasn’t won it yet…
Because incarceration is penitentiary, which means criminals are made to pay for their crimes - not to be rehabilitated. There other countries where incarceration works, for example Norway [1] - primary because they focus in rehabilitation. Incarceration is not the problem, the typical opinion of the purpose of incarceration is (justice through revenge).

Incarceration is 100% effective for what America wants it to achieve: penance.

[1]: https://m.phys.org/news/2016-08-norwegian-prisons-criminal.h...
Maybe so, but "wrongthink"? That's not even close to accurate.
Are they trying to build something like Apple Pay?
I have not said that reproducing a result is pointless or impractical. If you are a computational biologist, you will surely know that there are endless bench marking papers comparing published methods for sequence alignment, variant calling, differential expression, genome reconstruction, phylogeny reconstruction, cell segmentation etc etc. You will also know that if a methodology for producing a result is obscure, it will not be repeated or cited much, and a re-implementation of the method that is accessible will easily over take it. Published data sets are also endlessly re-analysed. If someone publishes a paper that is code heavy without any code, then they get chewed out on twitter or at conferences (rightly so). Top tier journals have also started requiring publication of custom code.

My argument is that a 'reproducibility project' of the kind described above is pointless and impractical. I do not see evidence that this project has taught us anything.
> Shutting mic, camera and sensor data off for idle/background apps is neat, though I'm shocked that wasn't an option before.

What do I do now if I want a skype or wechat voice call in the background while using the phone normally?
Given the conflation with development style and architecture style, I’m not sure which term you’re looking for. Development-wise, I think we would just call this 18th/19th century urban apartment buildings. The architecture style could be mixed. But, what would you say the differences between this and older apartment buildings in NYC? Urban development typically has a bias for ground-level storefronts these days.

There are elements in the architecture which make the original European implementations especially livable. These are details that are entirely lost on average Americans who have never lived in these buildings. It seems to be a moot effort to communicate the luxury of lifestyle that can be found in these buildings, with their cozy crooks and jagged crannys, if you will. Popular thought is that this is outdated. It really takes living in them to appreciate the lifestyle French windows afford, for example.

Gaston Bachelard’s ‘Poetics of Space’ is some reading that I think speaks directly for the psychological value in this attention to detail.
"ou have to be incredibly naive to think they will not use this information to create some kind of 'adaptive pricing' to squeeze every last penny out of you before they let you go."

No, you have to be highly conspiratorial to wrap up hospitals, Facebook, the banking system all working together to concoct an illegal, real-time price discrimination scenario.

What you described is not plausible, moreover, if you don't want your finances integrated into your social feed ... then don't integrate. I'll imagine that most won't.
More of like an empty self-serviing justification for great evil against your fellow humans, if such you can still be considered.
7 Ways to Increase Work Productivity with Asana
Ajit lies to us?

Shocking development.
Where's your numbers for that? My local muni operates about 10,000 street lights. If HPS averages 400W apiece, that's 4 megawatts, run for maybe 10 hours a day, at $0.10/kWh that's $4,000 a night...

Now if by "years" you meant "two years", then fine, I can believe it- but two years is still a fantastic payoff period.

Don't forget HPS burns out pretty regularly too. Tactic my muni is using is simply to replace burnt-out HPS with LED instead of repairing it. Lo, after a few years we're probably half LED.
I don't think I could write an editor with regular expressions from scratch in a week. Especially if you took away the internet and 99% of my CPU and RAM. Fail.
Yep, seems the compromises they have made for notches are global across all devices which to me is a UI mistake.
I don't know if it's just me, but I don't really like the text magnifier. I select text better without it.
Could they be trying to build a payment service, something similar to PayPal or ApplePay or TenPay?
I'm going to assume that it's because it really isn't all that important. The military is looking to avoid headlines like "Strava heat maps reveal military base layouts" but they don't really care if the base layouts are revealed.

Back when this controversy was first stirred up it seemed unlikely that anything sensitive was really exposed. Other comments in this thread indicate that the military is perfectly capable of restricting the use of personal electronic devices when they care about it. This seems like a case of the public demanding "something must be done" and the military responding with "okay, we did something".
In most cases the cause is on the DevOps team and not on Azure, GCS or AWS. I can attest to that in screwing up some configs early on. That being said this is a very new offering from Microsoft and is possible it has some kinks to work out.
Show HN: Rocket – a language that lets you focus on your business logic
Thank god I'm not the only one who felt this way
According to https://www.fitbit.com/compare Alta HR doesn't even borrow your phone's GPS ("Connected GPS"). Surge and Ionic are the only Fitbit trackers with their own GPS, which is turned off most of the time anyway.
No, I'm not. But continue the weird provincial mythmaking, it's very good for...something.
There are definitely growing pains with using Kubernetes on Azure. I've wondered a few times if other platforms have similar issues and have seen more than a few complaints about EKS.

Microsoft has some great people working on Azure, but I do feel like AKS was released to GA too soon. Without a published roadmap and scant acknowledgment of issues, I'm not sure I could recommend it to my clients or employer. It's disappointing, because I've had few issues with other Azure services.

Full disclosure: I receive a monthly credit through a Microsoft program for Azure.
Ask HN: Laptop backpacks- favorite make and model?
My complimentary backpack that I’ve used for several years finally gave up the ghost.

It’s also about time to order a mess of custom company-logoed packs. Was curious if anyone has recently placed an order and gotten good or bad results.
I had a meeting with a group that was looking into wireless game controllers. They said they really wanted <2ms latency over the wireless link because they didn't want the total latency to be more than 8-10ms.

Because tween gamers could totally tell when the lag gets above 10ms. Which is all well and good but 12 year old boys start throwing the game controller when that happens, which causes higher failure rates. Which means more warranty returns.
Ask HN: Infosec best practices
Every now and then I am intrigued by the specificity of leaked information disclosed when learning about a security breach of some company. "They got this information, and this information, and some of that". I assume that there is some worst-case logic going on here, and a lot of it probably involves trawling around in logs somewhere, however I often wonder how much more there is to the story than I am aware of.

Lots of online security stuff tends to be things like "lock down your SSHD and you'll be fine". I am curious to know if anyone has any stories or recommended reading regarding what else should be done to ensure security and allow successful investigations, etc. ie, sufficient logging, indefinite storage of logs, etc.

Is there more to this, or is it as simple as "just log everything!"?
For posterity, Buzzfeed News reported this: https://www.buzzfeednews.com/article/stevenperlberg/jared-ku...
Annual cost of small mammal ownership: $300

Source: https://xkcd.com/980/huge/#x=-1166&y=-2798&z=5

Add to that expenses for the experiment, and $1000 seems not far fetched.
5 thousand lifetimes of play versus .45 lifetimes, I think the outcome was predictable!
Very few owners of Alexa-powered devices use them for shopping
This is a very good idea.
I feel this is akin to strawman logic.

However using that as an example, there are people who work as vermin exterminators, or people who work in labs that have to euthanise lab mice. They probably don't enjoy it, but when there's a need for something you'll find someone to do it.
MEMS gyroscopes are a useful inertial navigation system that can be accurate enough. Some intelligence can be gathered with just pedometer.
Six Corporate Habits and Rituals that seem to be far-fetched
PAX, cannabis oil and moderation
Haha, but in Apple case, you can't even see the code, dude.
> Incarceration is 100% effective for what America wants it to achieve: penance.

“Punishment”, perhaps. It's far less than 100% effective for penance, which is voluntary, self-imposed, and done as an outward sign of genuine acceptance of responsibility and desire to make amends.
Why? Couldn't you just format the drives if you were that paranoid? Are they worried about some kind of hardware bugging or sub OS exploits while the owner is not looking?
I was thinking that it could be used to target the ethereum virtual machine... ie: compete with solidity.
I have done this, and also had to return a smartwatch that someone (very thoughtfully) gifted me, because I can't wear it at work. And if I can't wear it at work, it's not really going to be of enough use to justify keeping.
Why would he have posted such trollish pictures of himself if he weren't?

He got real serious suddenly when that nutter threatened his family.
Good question. Also what about personal assistive devices? I'd guess they just don't allow anyone with hearing aids to work there...
>There's a massive stigma to setting up shop in places like Morristown or Ossining.

Morristown isn't some haven for bumpkins, it's a major stop on the Morristown Line with a lot of wealthy people. Maybe there's a sigma for setting up a tech shop, but it's not some backwater where nobody wants to live.
> All this stuff is supposed to be in the paper

I don't agree. I think this stuff should be in supplemental notes (we call it the 'artefact' in my field, not sure if that's universal). A paper should be reasonably readable, not a huge list of processes in detail.
>"what have we learned in trying to replicate this study, that we didn't already know?"

It sounds like you think it doesn't matter if that result was published vs "Transcriptional amplification in tumor cells with depressed c-Myc".

If I misread that title replace it with whatever is the opposite result in this case. Anyway, like I said elsewhere if it isn't worth trying to replicate, then the original study should have never been funded. How many of these studies just exist as a "jobs program"?

It sounds like you think it is most of them, in which case great. We can then easily cut out 90% plus of funding current going towards jobs program stuff and devote it to the <10% that is worthwhile...
OP here - in the very early stages of language design, but would appreciate any feedback / help the community can provide
Google Drops Plan for Speck Encryption in Android
Net neutrality is the origin and the genesis of the Internet.

It's baked into TCP/IP with packet agnosticism the central and guiding principle.

You've given into partisan ignorance and I can't fault you: it's typical of people all around the world to wrap themselves in comforting ignorance lest they be forced to exercise even a small portion of their brains.

*And thanks for finally coming clean in your own regard. I realized who I replied to after I posted my own reply to your 'content.'
Let's be clear... corrupt politicans have stalled bills at the behest of their bosses.
Is the ai forced to use voice communication and chat to coordinate bots?
Thank you for the very detailed feedback. I got that advice twice, so I will definitely rethink the landing page.
Adult human eye is surprisingly uniform in size. The vast majority of adults will be fine with contacts that have BC=8.5 +/- 0.1 and DIA=14.0 +/- 0.2. Many contact lenses are made in exactly one size combination only and everyone seems to be fine with that.

> buying them in gas stations, you're risking a lot.

How? That vending machine sells exactly the same Acuvue lenses that you can buy in US.
These are all great points.

> Where did you guys get that idea that prescription should match so very precisely?

It's often much less about the prescription than the characteristics of the material used for the contact lenses and the measurements of your eye. The base curve and diameter portions of the prescription are used to capture this.

> Why do you need a specially trained person to dispense a box of contact lenses?

There are two reasons. With the wrong set of contact lenses (e.g. off-prescription color contact lenses that people wear on Halloween), you can significantly harm your eyes due to low oxygen permeability in the lenses, lack of fit, etc. Second, the contact lens/glasses prescription renewal process forces people to get an eye checkup done, which can often allow the doctor to identify other problems (e.g. infection, cataract, etc.)

It's subjective whether or not using this as a forcing function is really the "right" thing to do, but it does prevent people from living with undiagnosed issues.

> Also, what's the deal with vision insurance?

As people get older, the likelihood of an eye issue increases dramatically. This depends on your specific policy and what it covers, but there are "insurable" (i.e. low likelihood of occurrence, very high cost) events that can occur with your eyes that your VSP policy may cover. I'm not deeply familiar with this, so I can't comment extensively on it.
One of the areas paid journals could make the case for their value and relevance would be in demonstrating reproducability.
Chrome OS Can Now Install Linux Debian Packages
Not all clearances are created equal. I have heard of people being blindfolded at certain facilities, when they had vital work to do at a lower clearance level than would normally be allowed in that facility.

Also there's nothing like having different accesses than your boss, so when you go to certain meetings or do certain things, you can't tell him exactly what you're doing.
I left years ago and there were serious services using Autopilot. The name is no longer secret, see https://github.com/kubernetes/kubernetes/issues/44095 or Tim Hockin's slides from two years ago, where he revealed that 2/3 of Borg users rely on it: https://speakerdeck.com/thockin/everything-you-ever-wanted-t...
I don't own a personal Windows machine and have games on my Mac. I wouldn't be able to use this service to play games through my browser at work or when not at home
This is great to hear! We've had a peak sales day thanks to all the HN-directed customers.