skysight-inc/HackerNews huggingface dataset:
This reads like an Apollo ad.

I'll start off by noting that I haven't been keeping up as much with the latest developments within the GraphQL ecosystem so some of my comments may be outdated.

They ignored one of the most thorough GraphQL implementations: Sangria [0], which provides almost everything you need out of the box to implement a fairly sophisticated application. I guess that Scala isn't very cool. I'd reluctantly agree that most of the community seems to be centered around the JS ecosystem, but I don't think it's fair to so easily dismiss the dozens of GraphQL implementations out there. Perhaps I'm wrong about this, but based on the author's bio it sounds like they're most experienced with JS and Ruby, which means that they're probably heavily biased towards those two languages. I don't think they've seriously evaluated each library extensively and they should be transparent about it if that's the case. I've used GraphQL with Elixir, Node, and Ruby, but took a lot of inspiration from Sangria's docs when working on my apps.

I don't know if it was meant as a criticism, but I actually think that the declarative syntax used with Elixir and Ruby is quite nice. The examples provided for the reduced "Developer Experience" are rather weak in my view. I think the author might just be most comfortable with JS.

> Secondly, as said in the second point, a GraphQL API server needs optimisations and maintenance.

> Making the graph-oriented way of getting data fit over an SQL database can be tricky.

IMO, this is severely understating the complexity. Depending on the type of application, you should probably be prepared to have at least one engineer dedicated full-time to maintaining your GraphQL server.

It's a lot easier to write a secure REST API with good performance than it is to achieve the same thing with GraphQL. The author doesn't even mention anything about the huge headache involved with protecting against malicious queries.

I immediately fell in love with the idea of GraphQL when I first heard about it, but as I started to use it I found it wasn't some magical solution. You'll probably end up having to figure out a lot of stuff on your own since the technology is so young, so be prepared to invest a lot of time in it. It depends heavily on your use-case and your team's collective experience, but I'd probably lean towards avoiding GraphQL within a small team.

If race conditions aren't a concern, you can wrap a REST API with a small GraphQL server. The inverse is also possible.

There's no mention of file uploads. Although many GraphQL libraries include some form of file uploading capability, I'd suggest against using that and just creating separate endpoints for each upload type. Having a separate endpoint makes it way easier to place reasonable limits on input size, as well as rate-limiting those actions adequately. You can also handle streaming uploads, which I don't think most GraphQL libraries can handle; if I recall correctly the Node GraphQL server parses the whole body before executing any resolver.

[0] https://sangria-graphql.org/
I'm helping to move a big 10B per year ecommerce site to graphql. This lack of tooling support around graphql (vs REST) is a big minus currently.

Some examples:
CDN is a big one that you mention. Our vendor (the biggest in the industry) has no support for GraphQL beyond what they do for REST or html pages. We've talked about moving the query into the path or as a parameter but then we have to figure out how to determine what can be cached. With REST it is easy: cache /sku, /product, etc but never /guest, /order, etc.

Tools that do performance monitoring (AppDyn, datadog, etc) don't grok GraphQL well. Quick example is response codes. What's the http status code of a graph response that has a partial failure? If you make it 200, then those tools won't see any errors. We put the error codes in the response body and those tools aren't parsing that for message failures.
Spend time with your friends drinking a soda while they use your vouchers. Everyone wins.
Tiny magnets will escort ions out of rare material from a shipwreck
Ah. You're right, I completely got this bit wrong. Thanks.

Wait, so that means Sentry kind of has a vulnerability.
Even if they changed it so that you could select where to send the password reset, rather than having it go by default to all accounts, that still means anyone with delegate access to the email address could go and request a reset on your behalf.
Most low cost solutions are based on Asterisk or Freeswitch...
One and a half million new citizens every two weeks, globally.

We need smart solutions to a complex problem.
I'm not an Amazon shill, look at my post history.

I don't understand all of this press. If you don't like your job working at Amazon, quit. If the conditions are terrible, release proof to the public, so other people don't even start working there.

Wash, rinse, repeat, and Amazon will either change the supposed working conditions or hopefully fail.

Why do we need so much press on both sides for such a non-issue?
Yeah they’re amazing! My wife balked at me buying sandals for $50-60 (she’s used to $10 sandals that wear out in a year), but they’re so damn comfortable after you break them in and last what seems like forever. The only reason I got rid of my last pair was because the color was fading pretty badly, but other than that they’re still totally wearable.

I also love them because they aren’t huge and bulky like Reef brand and others. They actually look somewhat “classy” as far as sandals go.
Has anyone used odata? Do you prefer odata over graphql?
What kind of disabilities are we talking about here ? Physical ? Mental ? Both ? Any way to know ?
Does anthropophobia count as a disability for instance ?

Searched on the page but I could not find anything relating this.
The Commons Clause – The End of the Open Source as We Know It?
>Though one might think that a contest between data interchange formats would be unlikely to engender death threats, Winer wrote:

>"No doubt I can write a routine to parse [JSON], but look at how deep they went to re-invent, XML itself wasn’t good enough for them, for some reason (I’d love to hear the reason). Who did this travesty? Let’s find a tree and string them up. Now."

In retrospect, he should have said: "Let's find a tree and stringify it."
> IBM suggests the drone could be equipped with technology to detect blood pressure, pupil dilation and facial expressions and judge whether people are drowsy.

Why waste the time on brewing coffee? Just have it fly around and administer routine caffeine injections.
I write here and there on my personal site [1].

The intended audience of the few things I’ve written were geared more towards practicing technical writers, but maybe it’s high time to cover the fundamentals.

There’s a mailing list at the bottom of the post I’ve linked to, where you can get a ping whenever I publish a new technical writing post.

[1] https://kayce.basqu.es/on/metrics
Not: as groundbreaking as Scribe (Brian Reid at CMU) was, I don’t think SGML was inspired by it. They had parallel dev paths...
Many drink because just surviving is not enough to live a fulfilling life.
It seems unlikely. The application has a feature to use a secret key to secure everything. The same application then prints out the secret key to anyone that asks. Your OS can't do much about that.

Maybe if you tell your OS "never let any data containing this string leave the machine" you can kind of mitigate this, but it's unlikely to work. The HTTP response is probably compressed. Someone probably base64-encoded the thing and stuck it inside some JSON, which is then base64-encoded again.

Ultimately, it's about managing complexity. Django and the extension punted: Django says it will print anything and everything it has access to, and the extension has a documentation caveat about how bad that would be. One could imagine an API that tries to be resistant to this sort of thing; when the extension is initialized, it deletes the key from the environment dictionary (only partially possible), stores it in a private attribute, and only provides public EncryptAndSignCookie and DecryptAndVerifyCookie methods. This will be better than a documentation caveat, maybe, but the truly ambitious debug mode will probably get the key and print it out.

(I would also point out that I'm not a fan of storing state in encrypted+signed cookies, if only because there is no way to revoke a stolen cookie without revoking every cookie ever. If you have the state on the server to store a revocation list, you might as well just store everything there and never have this problem.)
sounds good. until you run conferencing services or whatever. Then the pricing is pretty simple: buying wholesale SIP and operating on your own is substantially cheaper.

irl maintenance is pretty straightforward. I do it as a side thing to my main job.
My opinion of Airbnb has dropped dramatically, but I have used them in the past due to cost and added amenities over a hotel room.

With small children, staying in a hotel room for any length of time is really difficult. Setting up a potable crib, washing bottles, feeding simple meals, etc are a pain in a small, often dingy, hotel room. Having a separate sleeping space for children, so you don't have to go to bed at 7:30 also makes travel much more enjoyable. A decent hotel with a true suite and kitchenette is generally very expensive.

I've also used Airbnb to book apartments for family visiting me in the city. Again, for an extended stay I'd rather they have the space and amenities that would cost a fortune to match at a hotel in the city.
"road injuries are preventable by simply not driving after having had a drink" Alcohol impairment is a factor in 31% of auto crashes. That’s a pretty big number, but most crashes are caused by aggressive or inattentive drivers.

I thought your line initially read "road injuries are preventable by simply not driving" full stop, I was on board with that.
I agree. I'd like a nice form, but I don't really care too much about having something flashy. I want an exterior that can withstand the elements and last the lifetime of the vehicle.
> that still means anyone with delegate access to the email address could go and request a reset on your behalf.

That's how it should work. You shouldn't have to remember which email address you signed up with in order to request a password reset. But that's fine as long as the pin number only gets sent to an account that's locked down to a degree that's appropriate relative to the assets under protection.
Focus or expand a service? Need feedback please
We just launched an App, that’s kind of a revolutionary idea. The thing is people is getting crazy to join the team and start working on it, cause it’s like your are a Uber driver but instead of driving, you just download the Staff App and start helping people with simple things like recommendations, order food or even you can talk about your personal issues and you get paid to do this.
We have people from all states and all over the world writing us everyday on going there.
We are available only on 3 cities now, do we go other cities or put focus on the ones we are?
This is the product and it’s only available for iOS now: www.halisback.com
Please, really need feedback.
I think the initiative is brilliant, despite the fact that there's only one job posting right now (Aug 24th, 8am PT).

Let me share my point of view as founder/CEO of a small startup in San Francisco, hoping that this helps.

What we do: we are building a software platform to digitize real estate properties (titles) using the Blockchain. (I know, Blockchain will solve everything bla-bla-bla... the reality is that we think this is a good use case for Blockchain technology; but I digress...)

We are a team of 3 co-founders (2 fairly technical, one business oriented), 1 lawyer (the product requires a lot of legal stuff), and 2.5 software developers.

Right now we are looking for at least one more technical person, possibly a front-end.

We have raised ~650k in an angel round, after bootstrapping for ~10 months. We launched an alpha version of the product, and we have one paying customer (a company, as we are mostly b2b at the moment).

The next few hires will be absolutely crucial for us. We can't really afford experiments. What this has to do with disabilities?

I am happy to hire anyone with the right skills, no matter his skin, gender, sexual orientation, or disabilities. Heck, we even hired Italians! (I am Italian, I can make that joke :D).

We don't mind remote people, either. We have a very flexible policy in regards to work. We are not big fans of 9-to-5 and offices.

To be able to hire someone with disabilities, we would need a healthy "inventory" of candidates. The site mentioned in this post, jobenabler.org, lists job opportunities, but doesn't guarantee a good enough list of candidates.

As CEO of a small young cash-poor startup, I have to be brutal and prioritize my time, and therefore I am not sure whether this tool is good enough to find our next hire.

Please note: I am trying to share my point of view as a potential employer, hoping that this helps the discussion.

Any comment, suggestion, or ways in which we can improve the chances of hiring someone with disabilities, please share here, or email me at simone @ fabrica.city.
There's nothing to be done at the OS level, because the OS doesn't know which things are secret and which things aren't. You can sandbox the Django process (and to a certain extent Facebook were doing this at an even higher level, by having the whole server on a separate VLAN that was (supposedly) away from the important stuff) but that only does so much because the process needs to have enough access to do whatever it was intended to do.

Ultimately the only thing you can do is not run debug mode in production, not use insecure serialization formats and not leak secret keys. If you want to be a bit more pre-emptive about it, avoid language-specific serialization formats especially in dynamic languages ("serialization" that executes arbitrary code seems more common in those) and use taint checking or, better, a type system that can avoid leaking secrets (you likely need rank-2 types to be able to have values that you can use in certain contexts but never access outside them, a la http://okmij.org/ftp/Computation/resource-aware-prog/region-... ). It sounds like Django already has some level of taint-like functionality but this plugin/addon (sentry) then didn't use it properly. So, multiple failures interacting to create this vulnerability - I guess we should take that as a sign of progress compared to the days of basic buffer overflows?
Release v1.1.0 – stimulusjs/stimulus
Quantum entanglement loophole quashed by quasar light
What's the software required to compile, debug, test the Verilog code for this project or other similar projects?

I used Xlinx VTPro 20, 10 + years ago, like to know the state of FPGA Software tools today.
Build a 3 mile tall launch platform that is also an EM rail. Or better yet, BORE a tunnel through a really tall mountain.

https://en.wikipedia.org/wiki/Pico_de_Orizaba
Sun's Magnetic Field Portrayed
Hola Agustin, muy interesante la propuesta de Fintual. Me gustaria preguntarte como logran realizar inversiones en ETFs fuera del mercado de Chile, ustedes hacen la conversion de pesos a USD? El portafolio es en pesos chilenos o en USD?
> I'm at least 95% European, but I have no idea from where

Try 23andme?
The advice is always going to be some variant of consuming fewer calories than you expend. Obviously the success rate is >0. Other than that I suspect you're just looking for reasons to argue instead of taking responsibility for your own choices.
If I understood the parent comment correctly, it's not that the book was lacking anything, it's just that the online courses were more accessible.
I'll observe that none of the statistics you offer covers the demographic of the article. I would be willing to wager that if you look at the same statistics split across income levels, you'll see a noticeable difference in rates.
For meltdown AMD followed what the x86 spec said. It's flabbergasting you are trying to contort this into making AMD look bad. Your "summary" was basically that AMD was too incompetent to have multiple security issues.

The facts are AMD does not have a significant per-core IPC defeceit vs. Intel (as supported by every ryzen review at this point) and AMD has, on multiple occasions now, had objectively superior security.

You're trying to twist this into a negative against AMD. It's nonsense FUD. Intel fucked up, AMD didn't. Why are you trying to run PR damage control for Intel?
Not all social security programmes are good. Some of them are unrealistic, some of them are unfair to other people, etc. Voting against a particular social programme doesn't imply the person doesn't feel solidarity in general.

Maybe they're voting against it because while they're not poor, they still don't have more than enough - you can solve that by funding it through a progressive tax, but that makes it unfair in the views of many people.
Introducing ebpf_exporter
Is IBM just a marketing company now?
> Most of the “honesty” comes from iOS and it’s just a better thought out model than Android

That's essentially what I had to say. Apple enforces these policies - and sometimes will go overboard. I still very much prefer it to what Google does where as a user I feel they are completely neglecting to "take my side". I am not their valued customer, I am just a source of personal data.
Amazing. So glad I unburdened!
Naming things is the Vietnam of computer science. I wrote a haiku for it:

A quagmire of bad
decisions made in haste, haunting us—
years later.
This matches a recent experience of mine working on a dev team at a large tech company. We joked about ADD or "Abuse-Driven Development," because we would always hear our bosses say, "X needs to be in tomorrow or I'm going to get screamed at," "Okay, which of these is going to be a bigger beating if it's missing," "I live and die by this product," "It's my ass that's on the line for this," etc. Not only that, but they would brag about how little they were being paid and how late they worked every day. We would get emails from them after 1AM regularly. I never encountered any behavior like that at any other company.
5 App Store Optimization Tools That You Need in 2018
Can this also be used for detecting text within video frames? OCR per frame?
While the technology is great, I am not sure of its use case.
People summoning for coffee is fine. But for people who look tired and distressed, I think coffee is just a 'quick fix' for that. How about drone reporting it back to the person's manager (as a feedback) to indicate if management rework needs to be done (sometimes one person in team ends up doing most of the work). Or drone sending an automated email giving suggestions to the employee to either take a break, go for a walk, drink water, or give recommendations of meeting other people who are in the same state. Maybe the drone can even take into account the project which the employee is working on and help him socialize with others who are working on other projects, which ultimately might give rise to a brand new project idea. Just my two cents!
Just different risks. Adopting GraphQL without also adopting Facebook's exotic graph datastore is the unknown-unknown sort of risk that eventually leads to intractable problems as demonstrated by Hibernate and a long history of ORM related failures, and it isn't even on the radar of 90% of GraphQL adopters, if HN comment activity is any indicator.
The car remark is implying drinking is a useful productive thing like driving. Its not the same kind of thing at all.
The need for money and/or guanxi might be worse in China, but it's certainly not China-specific.

Every time I see an example of police and the justice system running roughshod over somebody I think "I need to be rich and well-connected so this won't happen to me". The ability to get top medical care in America is also dependent on having good connections, insurance, and/or deep pockets.

Of course, as an introvert, I'm relatively bad at creating and holding on to a wide net of connections, so I have to make up for it with more money.
This does sound like a reasonable feature request to me: the "contact information" and "account recovery" use cases are different, and it's not obvious that an email listed for one should be automatically used for the other. They could have you choose for each email whether it's allowed to be used for account recovery.

As an analogous example, what if you did the "forgot my password" flow and they sent a recovery code over SMS to any listed phone number on your profile, sent a twitter DM to your listed twitter account, and sent postal mail to any postal address on your profile? (All at once, without waiting or confirmation.) That would expand the attack surface significantly, and it would be pretty easy to steal someone's account by stealing their postal mail. This case is similar: a secure email for account recovery and a less secure email for contact info, but Facebook forces you to use both for account recovery.

On the other hand, some people intentionally want multiple account recovery emails so they're less likely to lose access to their account. I imagine Facebook's hesitation with this feature is that it's hard to clearly communicate the distinction between the two use cases, and they want to bias toward simplicity.
Well for Google, the "meaningful parts" is to collect data. For users, it's to be able to sync bookmarks, passwords, etc.
Is saying that many of the homeless in America are mentally ill blaming them? It's our health system that can't handle them, for a plethora of reasons. It's not the homeless peoples' fault for having schizophrenia or PTSD or whatever mental illness, which many of them do.
So, they are technically incompetent, and your business depends on them? Sounds like your business is unsustainable!
Interesting. I built some VOIP systems on Asterisk about 12 or 13 years ago. It saved a few small companies a ton of money compared to an older proprietary system.
#T-Mobile data breach exposed personal information of up to 2M customers
This is kind of touched on by other comments here, but after using GraphQL heavily on a bunch of different projects for both native apps and web UI front ends, one of the biggest benefits I've seen is how it enables the individual teams (front end and back end) to work faster, more efficiently, and more independently.

Our dev process for using GraphQL:

1. Product and design come up with screen designs and workflows.

2. Importantly, the front end teams then take a first stab at writing the GraphQL type contracts, fully doc'ed (we use a Node backend, so it's easy for the front end folks, even native app devs, to know enough JS to write these type strings). They then confer with backend folks on the contract to get agreement, and front end folks write mock endpoints for these contracts. This allows the front end teams to get off to the races early with a working (albeit mocked out) backend. Since the GraphQL type contracts are optimized to closely match the front end screens, it makes the front ends much simpler. With native apps it also means there are a lot more things we can fix with just a server change, not requiring an app store release.

3. Backend folks then start implementing the GraphQL resolvers, which in our architecture is mainly orchestrating microservices. The great thing about GraphQL here is that it essentially serves as a "decoupling layer", giving the backend folks a lot more freedom to change and switch up the microservices as long as the GraphQL contract is still respected.

4. Once the GraphQL resolvers are done, we switch out the mock resolvers. Usually there are a couple of edge cases or other bugs to fix, but for the most part we've seen very little disconnect.
If I were the CEO of IBM, I'd wonder what jagoff spent 10 grand (average patent cost, with lawyers and other services) to make a coffee drone joke.
Nyet! automobile is fine!
T-Mobile says hackers stole customer data in data breach