skysight-inc/HackerNews huggingface dataset:
Ask HN: How to assess security risk of running open-source API for BitWarden
Hello everyone.

I'd like to get some well-informed opinions about how to assess risk for using an open-source implementation (https://github.com/vvondra/bitwarden-serverless/) of the BitWarden API. What I like about this implementation is that it all runs in the cloud, under the free tier. It looks like it was designed to take advantage of cloud resources. I scanned it with SonarCloud, and it comes up green. I'm currently working on scanning it with OWASP Dependency-Checker. For now, I'm not able to get that scanner to work.

Thinking pessimistically, I figured there could still be a chance that there is something malicious buried in the code somewhere that the scanners wouldn't pick up, so I intended on reading through the code, line-by-line, though I am unfamiliar with NodeJS, at this time.

The code looks like it's not BitWarden's code at all, and that it's far fewer lines than it looks like Bitwarden wrote to implement its core. What I like about BitWarden is that they appear to be pretty security-minded: https://github.com/bitwarden/web/blob/master/SECURITY.md. They even have a program on HackerOne to identify and fix exploits.

I'd rather not use the infrastructure that they host in Azure. I'd rather have an unknown, private URL that is still in the cloud that I use to manage my credentials through. That's where this server-less implementation comes in.

I figure that I'm taking on the risk of using an unknown implementation. But I also figure that some of the risk is mitigated by running in AWS and by using AWS architecture. I think that all that is really left for me to do is to read through the code and make sure that no back-door calls are being made in it.

Does anyone have anything to add? I'm not interested in other options, at this time, just in assessing the risk of using this server-less implementation.
Very interesting article. One thought which still lingers in my mind is how to distinguish between visionaries (like Powell from TFA) and Malthusians in present? Both of them, after all, observe the current state of the world and make projections. Neither takes into account future technological progress.
Isn't that kind of unfair? Lots of us non-billionaires love to muse about interesting questions outside of our narrow specialties -- we do it every day here on HN. But when it's time to get some work done, we return to our specialties where our time and effort can make the most impact.
I agree that they should reimburse because the flaw was not caused by you, but how did you manage to miss the massive publicity and uproar and not update your card?
Last time I checked, which was a few months ago, Google Maps couldn’t understand a Plus Code and said it couldn’t find the place. Even at that point in time, this system was supposed to be working for quite sometime and supported by Google.
I frequently see this argument used to justify everything from ever creeping surveillance of civilians, to sanctions that primarily affect civilians, to the bombing, killing and maiming of civilians.

Surely we should aim for better than "yeah, but they'd be even more terrible than us"?
One thing I was finding weird about all those template compiling frameworks is the use of javascript for parsing the page/template instead of the lightning fast browser's native parser (DOMParser)

Can somebody shed some light on that design decision?
Little things like this add up to the whole customer experience which is, I believe, what they see as their competitive advantage. I don’t see a supported client coming any time soon.
What will happen to Win32 when Windows 7 stops being security supported in 15 months?
source please. So far I've only seen "experts" hack some old 20 US voting stations that are a joke in comparison.
My first reaction to the education and healthcare question was that growing demand must be an important factor.

The idea that a university education is a requirement for anyone wanting a career that guarantees a comfortable lifestyle is relatively new - a post WWII development.

Demand for healthcare has also risen as western populations have aged and more conditions have become treatable. Sixty years ago there were many more health problems that you couldn't spend money on if you wanted to, because they were incurably fatal. Now a significant number of those conditions have become chronic complaints that patients can spend decades paying to treat.

I don't know how much of the cost increase in education and healthcare can be attributed to increased demand, but it seems like it must be part of the answer.
Ask HN: Work Culture Difference Between West(UK, US) and East(India, China)?
I have observed the way the same product developed in these two regions are way too different possibly due to the cultural difference at work. Once can say East mostly does software services and products are churned in the west mostly but I have worked on product companies (on the same product) in both side of the world and saw some of these difference

- Punctuality - In the east people are late most of the time, be it about reaching at work or showing up in the meeting. Usually, there is nothing to be ashamed if its 30 mins late.
- Hard Stop - In the east, I don't see people hard-stopping any meeting and spilling the items to the next meeting. Usually, it goes on until the conclusion is reached. Its ok to ask "10 more minutes please" when the time is up but usually goes on and on.
- Start time - people in the east start too early I think. First meeting at 8 AM is not acceptable in India, similarly, the end time is early for US/Canada

- Coffee time - I see people in east take a lot of break and long ones either for coffee/tea or meals or just hanging out with colleagues the sense of urgency to finish work comes later in the afternoon but yet people compensate for sure by working extra hours.

- Flexible meeting hours - I have seen in India people are ready to take calls at 10 PM at night to accommodate USA counterparts but not vice-versa. In some companies in India working in the weekends is a common think without comp off.

All these are my honest observations, no wat to judge engineers of any part of the world. People in India/China are as brilliant hard working as US/UK/Canada(if not more) but I am wondering how the work culture in software development is different, maybe there are some interesting things about Nordic countries as well where a lot of good software like Linux and Nokia were written. Ultimately the output and productivity are the same. Thoughts?
Yeah but how does any of this explain the 16-month delay in BART due to the installation of the wrong network equipment?

Something is genuinely wrong when it comes to major projects in America.
Think of it as "if they respond to the challenge email it'll get in front of my eyes quicker".

Also, keep in mind when I wrote it, I was getting 20-50 spam a day (not counting unsubscribe emails). And part of the motivation was that legitimate emails were simply getting lost (I wouldn't notice them in the sea of noise). Checking once a week would mean scanning hundreds of emails for the few legitimate ones. The challenge-response is more reliable.

(Today I get almost no spam - someone fixed a broken pipe on the Internet).
Shocked he mentions Visual Studio Code but not Visual Studio itself.

The .net CLR has a lot of the features that he would want to enable the kind of interactive debugging (variable hovers, REPL) he talks about, and Visual Studio itself supports a lot of them.

Personally going from doing C# development in VS2k15 to doing golang development in VSCode feels like going back in time.
> “When all the rivers are used, when all the creeks in the ravines, when all the brooks, when all the springs are used, when all the reservoirs along the streams are used, when all the canyon waters are taken up, when all the artesian waters are taken up, when all the wells are sunk or dug that can be dug in this arid region,” he warned, “there is still not sufficient water to irrigate all the land.”

This rings very true today, save for the ability to desalinate. While it’s hard to predict what environmental impact such mass irrigation would have, we do have the technical ability now.

California should certainly invest in at least enough of desalination to supply cities and act as a safe guards against fluctuations in rainfall for agriculture.
Says the person who is writing his response on a computing device that was made by virtual slave labor.

Well, probably not slavish enough for your conscience.
Drugs are not beer. It's not about some 'taste'.

Drugs are there to get a little whack and messed up, and drugs for many are all about experimentation and finding a new buzz.

More of it will yield more experimentation.

And yes, a lot of people drink crazy high alcohol stuff unfortunately, that's why it's strictly controlled.
What does the future of software engineering hold for engineer not into ML/AI?
Is the transition from Software Engineer to ML / AI engineer necessary to sustain in the industry in the near future? Will it become mandatory for engineers to learn ML/AI for getting higher pay.
Yes, it is rational. We should live in a society where the expected human sacrifice of a construction project should be 0.

Pure utilitarianism leads to outcomes that are clearly out of step with almost everyone's moral codes. For example you could kill someone and take their organs to save the lives of 4-5 people. Is it rational that we're not allowed to do that? Why do some people get to keep 2 kidneys when there are others with none?

This is solved at least somewhat by using 'rule utilitarianism' instead of 'act utilitarianism'. Society is better off as a whole if we adhere to rules such as protection of the human body or safety regulations when constructing buildings.
Well, they have to be Optionals one way or another, because they can't get hooked up until after init[0], and Swift won't allow that. But yeah, I imagine this is on someone's todo list somewhere. IB already knows whether things are connected properly, and actually so does the source editor, since it shows the little circles in the gutter.

--

[0] Unless you could invert the order of the unarchiving...not sure what difficulties that would cause.
While back, i did a tool that uses clang sa, tidy and cppcheck to provide more information to our existing Coverity scans. For coverity scans, mostly the meaningful stuff was enabled and results compared to clang & cppcheck where not that different. Next time id just to with those and not bother with coverity unless licensing is already there and some aspects require coverity..

Anyway, more is better. Coverity is nice once you get it setup and you have recentlish version but combine it with open source offerings too!
> So is the solution for women to stop having children and for humanity to die off?

What a ridiculous false dichotomy. Earth has a huge (and increasing) number of humans on it. We are in far greater danger from unsustainable depletion of natural resources than we are "dying off" from gradually declining birthrates.
List of WLAN channels
In the 70's we used to play this game, only we called it Herbie. Any time you'd see a VW bug, you'd call out "Herbie", and gain points. At the time there was another kind of car that sort of looked like a Herbie from the rear (a Morris Minor), which - if falsely called a Herbie, resulted in detracting a point.

We can't play that game any more .. neither of those cars are on the road any more. Instead, my kids literally slug each other every time they see a red car, or a yellow car ..
The first time I saw the word coinbase was in an explanation of the bitcoin source code and how bitcoin works. I do believe it precedes Coinbase.
As someone who writes complex applications on the client side, I welcome a lot of the changes coming up for the next release and they are seriously anticipated.

Anything that positions JSX for Vue to be similar to that of React would be awesome for me.

I have some issues with relativity with deeply nested JSX templates. Unfortunately I wasn't able to get any help from the discord channel as most are opposed to JSX, couldn't understand my code and also state I'm doing it wrong and should use Vue components. (sigh)

In one SFC, I have over 500 instances of this.$set, really looking forward to proxies.

Finally, iframe support isn't as mature as in React. Sure there is [0] but libraries such as VideoJS [2] don't work correctly. Thus you need another Vue instance inside the iframe and have postMessage communicating updates between both data Objects with something like [1]. Which ulimately slows down the UX.

[0]: https://forum.vuejs.org/t/render-inside-iframe/6419/2

[1]: https://gist.github.com/pbojinov/8965299

[2]: https://forum.vuejs.org/t/videojs-not-rendering-inside-using...

I should mention, I do love Vue, it's awesome and a major step up from something like jQuery.

-------

Maybe someone from the core team comes across this or someone might know [4].

Taken from the: State of Vue by Evan: [3]

He mentions 4 release channels:

- Stable

- Beta

- Nightly

- LTS

Would really like to see if 2.6-next beta/nightly fixes these issues.

How can I get my hands on such a release?

[3]: https://youtu.be/AiF3XOu02-0?t=1845

[4]: https://i.redd.it/0soip7wqxth11.png
Tutorial WordPress
> The current in question increased from 0 to 4 amps in approximately 100 femtoseconds (10^-13 seconds). When generating fields this large, the coil's destruction is guaranteed, so to create a large maximum field magnitude, you have to ramp the current faster than the coil can vaporize/disintegrate. 40 trillion amps per second is pretty fast.

Coincidentally, it's the same technological challenge in building an EMP (plus or minus some explosives).
Don't forget that in August, Facebook's head of security, Alex Stamos, stepped down on the strength of his principles, and with that, I'd give a lot more credibility to the possibility that, as others have pointed out; that Facebook could intentionally weaken crypo at the behest of the government in exchange for plausible deniability allowing for parallel reconstruction.
Virtual DOM tends to be faster because bridging between JS and native layers can be expensive. If diffing is done in the JS layer, some potentially expensive calls can be batched or ignored if a change is unnecessary.
Impressive list. I wonder if they can maintain the lean size. If so how faster will it be ?
All I'd like to see is just better error reporting and debugging
Yes, but only up to a point. If all the rules and safety checks inflate the cost and timeline of projects exponentially then barely anything would get built.

The question, as always, is: "Where do we draw the line?".
I've addressed your points in more detail in other comments. A summary:

1. If someone can't be bothered to spend a minute in their whole life to be able to communicate with me, it's a pretty strong signal. I've had plenty of people who imply they want to communicate with me, but then are very poor responders to my emails. A hoop filters those people out.

2. No one has complained. If anyone is annoyed, they just ignore it and I'll whitelist them anyway when I see their email.

3. Marketers will not invent a way to circumvent it, because it's too much trouble for them to. I'm not that important.

4. Keep in mind the system has been working for over a year. This isn't a proof of concept or something in my imagination. Furthermore, if you read the other comments, people are paying money to have this feature.

5. Just because you don't get annoying emails doesn't mean others don't. Roughly half of them are unsolicited (I did not request to be on those lists). I think more likely is that the automated emails you do receive are ones you want. Whereas I don't want any in my Inbox.

My final point: Given where I am now, what possible reason would I have for switching to your workflow? Your stance comes from one who has a "default" position: the status quo. Look at it from my side - my system is working, and is very low maintenance.
It really is just one of those things that works so well. I was traveling recently and met some folks at a hostel. At the end of the trip we wanted to share our photos and videos with each other. Our hostel's internet connection consisted of a weak wifi access point, connected to weak satellite internet, with dozens of people vying with each other for the available bandwidth.

One of us suggested AirDrop and we sent dozens of photos and videos between us within a few minutes time. Maybe this seemed more impressive to me, after several days of suffering a terrible internet connection. It definitely stood out for me as being one of those moments where technology can make things easier and magical.

I do wonder if there are patents on this, and if that has prevented other devices from adopting this kind of protocol?
Maybe it’s just poor phrasing? Because:

> has increased by 2-3X per student per year

reads to me like it’s saying that every year, the cost is 2-3x higher than it was the year before. Which is obviously impossible.
Written in TypeScript and with TS type support in mind! That was the thing missing for me to look at Vue, looking forward to the release.
The purpose of pulse codes are explained on the very first line of the linked page. (emphasis mine)

> A plus code is like a street address for people or places that don't have one.

Not everybody has a stable living situation at a building with a fixed address. Yet it's extremely important for people to be able to receive mail or packages, especially for people attempting to lift themselves out of poverty.

This system doesn't look like a replacement to the existing address system, they can both be used. But as you point out, it won't matter much until people start to adopt this as a standard.
For your use, may I suggest cheaper and better options from the privacy angle? Here are some email providers that check both these boxes:

Posteo.de

Mailfence

Runbox

Mailbox.org
Thank you for the excellent analysis.

Just one nitpick for the benefit of any non-hams who are reading this thread and may wonder: it's usually spelled "ham", not "HAM", as it is just an ordinary word, not an acronym.

https://en.wikipedia.org/wiki/Etymology_of_ham_radio
All an address really does is act as a set of instructions for a postal worker. It is not an explicit definition of location and can change over time. And mail companies will not necessarily maintain a database of the actual location of the letter box or door. It is enough to just follow the instructions. You need these kind of geocodes where a short instruction is not possible. A lot of Africa is like this. And maybe it could work for drone deliverys where you want to target an exact location.
Show HN: Comparison of 3 major ESLint style guides Google, Airbnb and Standard
Mirillis Action 3.5.0 Crack License Key Free Download
"Master" is a strong word - feeling more like a perpetual student than approaching mastery.

Before I became a developer, learning to play music. There is almost nothing more rewarding than the ability to speak a non-verbal, near-universal language in order to express yourself.

Private pilot's license.

Podcasting.

Understanding more about cognitive bias. Rhetoric and logic.

Philosophy.

(Not sure you can master these last two within a lifetime.)

Fatherhood and being a good husband to my wife. These are easily the most rewarding experiences of my life.
Nice clickbait headline
Hacking Celery to Write a Code Formatting API
Given that it was written in 2003, and here we are 15 years later with CR working, I don't see much value to the post. The author there is hypothesizing, whereas in reality we have functioning CR systems.

Now I'll grant there is a critical mass beyond which CR won't work. Looking at the comments here, the likelihood of hitting that critical mass is almost zero. Most people don't like the idea. So CR will continue to work.
It's nice that they're at least bringing WinForms and WPF to .NET Core.

I'm looking forward to using UWP components in WPF apps, though I imagine that'll only work on Windows 10.
The main reason is "because Google is behind it so it actually has a chance to become a thing".

Otherwise, they're designed to be unlikely to generate offensive terms, and the + makes it feasible to use a shortened code together with a given or implied city name. Most of the improvements in this space are small details, because turning coordinates into a string is a really simple problem (which also attracts a lot of "let's reinvent this"...)
Air drop is fast for sure.

Feature request: make it work the same when you share videos and photos via messages or photos app.
This was the only thing stopping me from using it in larger projects. Can't wait to see how it plays. Hopefully the class-based interface has no weird object notation (methods, props, computed) and uses decorators like Angular.
Read Deep Work and find a schedule that works best for you. If it doesn’t work for your employer find a company that it will. You’ll be happier and more productive.

I have clients for whom I averaged 5-6 hours a day. They saw me come and go and were happy to pay me 40 hours. I have other clients who act like they cannot survive without me there 8+ hours a day. For them I get there at 7am and work till 5. Many days I leave still feeling like I didn’t get to accomplish everything I’d hoped.

There’s quite a bit of variety in expectations out there. You have to cross this river by feeling the stones.
Where is Serverless Going
How does Jane St. use FPGAs to make money trading? My impression was that unless the application demands real speed (i.e., microseconds), write it as software that run in a general purpose processor, not in an FPGA. x86s always get the latest semiconductor processes, while FPGAs always lag.
Show HN: Words on experienced vs. novice resumes, an analysis
Yes this was and remains my thoughts since the fund was first announced - this whole thing very much echoes the previous strategy in certain respects.

Two key differences:

1. Stage of investment

Last go round Son was writing a vast number of (relatively) small checks in early stage companies before stumbling into late stage investments like Webvan. Standard VC stuff - playing the averages and buying a lot of lottery tickets. Alibaba was only $20MM investment as I recall

This time around he seems to be making massive investments in much later stage companies. What is the rosiest possible outcome for his $7BB Uber investment? and how does this compare to the alternatives for an investment of this size?

2. Makeup of the fund

This article touches on it but important to note that this is not a $100BB pile of equity from the partners. The fund is structured with a substantial debt component - ie the fund needs to pay out a coupon every year so very different structure than typical VC funds. I understand the reasoning behind this but things could get difficult in a hurry should the market take a big turn at the wrong time in the funds cycle.

Will be fascinating to follow
Easy. Once I have to do pretrain 30min before training in the gym. Nothing except exceptional routine change (a short trip) or emergencies would get in the middle of that.