skysight-inc/HackerNews huggingface dataset:
SumUp | BERLIN, Germany | ONSITE, Full-time | VISA SPONSORSHIP | https://sumup.com/careers/

We are the leading FintTech company in Europe with major offices in Berlin, Sofia, and São Paulo comprising more than 1100+ people. We started out five years ago and created a unique device to accept card payments anywhere. Beyond our original hardware, mobile and web apps, we have gone on to develop a suite of APIs and SDKs for integrating SumUp payments into other apps and services. Today, hundreds of thousands of small businesses in 32 countries around the world rely on SumUp to get paid. Join Us!

We're hiring for:

* Senior Data Engineer (Berlin, Germany): Python, Hadoop, Redshift, Kubernetes - https://sumup.com/careers/positions/C5A075F321/

* Product Manager - Hardware (Berlin, Germany): https://sumup.com/careers/positions/881B51E1D2/

* Embedded Software Engineer (Hardware, Berlin): C, Embedded Linux, BLE, WIFI, SPI, I2C - https://sumup.com/careers/positions/F8171A79EF/

* Android Developer (Cologne, Germany): Java & Kotlin - https://sumup.com/careers/positions/225E6BC798/

* Senior Backend Engineer (Sofia, Bulgaria) : Node.js, Ruby (also on the Rails), Erlang/ Elixir, Java / Scala, Golang - https://sumup.workable.com/j/0E3151A4DD

You can apply via links or reach out to me directly at julia.matsai@sumup.com
white text on 0,0,0 black background... ugh my eyes do not thank thee
I suspect the visitor logs at most nursing homes support anon's thesis.
I'm curious what issues you had with entity framework?
You'd be surprised how much of the world has fast mobile internet.
That's not correct the QSA will validate that the device does not store PIN codes or the that the merchant does not store anything they are not allowed.

Devices that accept cards need to comply with PED/PTS security requirements including very strict physical security requirements which are validated by PCI council approved laboratories and firms.

You are not getting a device on the market or usable with any merchanet network without complying with this: https://www.pcisecuritystandards.org/documents/pos_ped_secur...
and a few other standards.
Currently a perfect diabetes, obesitas (and also cancer & alzheimer's) storm is brewing.

My gut instinct (pun intended) tells me it mainly has dietary causes which are not limited to increased portions alone.
Any TS/SCI cleared employees must deny the existence, even to their manager or even the CEO, unless they are also TS/SCI cleared.
And none of those measures would have protected against the compromise detailed in the article.
Talk to Dave at https://resumeraiders.com/ I had him help with my resume and linkedin profile and recommend his work.
Pretty cool but it'd be nice to have buttons to turn the cube rather than gestures - or at least an option in the settings for it. Love it either way.
Ah. That's interesting.

And in no way I meant to imply that you were full of yourself :)

I was just curious as I've only done some front-end dev and dealing with CORS was a minor part of it and I'm always interested in HNers with niche jobs or uncommon experience.
For sake of comparison, Norway has about 5.23 million people compared to 325 in the US.

Scaled up, it'd be like having 1,116 officers lose their jobs due to misconduct between 2005 and 2012.

Visibility to the issue in the US was substantially different in that time period than now, but I think the population helps put an absolute number into perspective.
There are said to be two types of people - pilers and filers. I've always been a filer, but have found that as my interests spread, and my work has increasingly been to create connections, I don't know where to file things.

So for my paperwork I have a single "pile". Each document gets a unique reference number, it gets filed in alphanumeric order, and I keep a file with the number and every keyword I can think of that might be relevant. When I want something I do a keyword search on the file and that pops out all the related documents references, along with the other keywords so I can decide if it's actually relevant.

I'm doing a similar thing with texts, snippets, photos, PDFs, etc. I put everything in a wiki, migrate things freely, but retain with everything a reference number, and in an index file, a list of reference numbers with their keywords. To start with it felt like an effort, but it has paid off time and time again. Things tend to migrate to meet up with their friends, but the index means things are easy to find.

Search is fast, but having things migrate and cluster creates the opportunity for coincidences and serendipity to play a role.

Embrace, adapt, enhance, and do what works for you.

And have backups. Multiple backups. And test your restore process regularly.
Other motherboard vendors (e.g. Tyan, Asrock, Gigabyte make server boards), or buying entire servers from Dell, HP, ... And hoping they don't have issues like this, despite probably all manufacturing partly in China.
Ask HN: Job / career change advice
Hi,

I am 40-year old senior developer who is looking to change jobs or even careers. I would appreciate any advice or if you would like to share your experience please do!

I am currently a senior developer in Microsoft Dynamics 365 and I hate my job most days. I feel close to a burnout even if I am very unproductive and feel I do not contribute enough. I really dislike the technology and have been thinking of switching to a front-end (JavaScript) / design role, but I don't have the energy to learn new things in the evenings / weekends.

I'm starting to think programming may have been the wrong career choice, although I'm not quite sure what else I would do- a business or management oriented role would suit me even less I think.

Would you have any suggestions how I could approach this?
Any idea how many users they had? I wonder if failure is due to execution/marketing or because, like everyone says, it's impossible to take on Facebook's network effect. Although, you'd think that last year would be the chance to get any sort of relative leg up on FB.
>> >It’s untrue that AWS knew about a supply chain compromise

Funny they didn't deny that it happened, just said AWS didn't know about it.
Your DR planning better include a necromancer.
Plain and simple, we are full of incompetence.
The image at the top says it's a Supermicro B1DRi. I wonder if this is an actual infected board or if it's just for illustration purposes.
Was that true when these systems were first made? Many of them are decades old, and the culture of large institutions is usually resistant to change, and that comes from management on down. If the system didn't start with those values in mind, what would have prompted them to change?
Curious to know what.

We run a DCOS cluster with 40+ machines and we have to deal with pretty much nothing
The title is misleading. There’s 9-ish residents that live on McNeil, and they all work for the prison. Buddy of mine used to date the wardens daughter. Had to ride the prison ferry to their dope-ass house that was on sex offender island
>I'm not a mouse...

Expanded: Animal studies are just a start. Human trials might get opposite results.

E.g. The drug Indocid or Indocin is safe for human consumption but kills rats. It's a cheap rat killer.

If rats were tested first, we'd assume they'll kill humans. The reverse applies as well.
Perhaps this an avenue towards a new type of antibiotic?
You're right on the money- it's a big problem that a lot of inertia will need to be overcome to solve.
How many new devs are willing to even touch a COBOL program. documentation or not.
That line in the article made me LOL. Douglas Adams would be proud.
“Luck is what happens when preparation meets opportunity.”

Preparation comes from persistence.
I tried a ROT-24589 algorithm on it, I think I'm really close.
>If you want to blame someone, you can always say that he didn't document his stuff enough.

This, he could have documented it perfectly well in a time when everyone knew COBOL.

But that documentation would all be useless to me today with my knowledge of Java and Kotlin, but understandable to someone else from is generation that works with COBOL.
The rule of thumb is that about two-thirds of gun-related deaths in the US are suicides, another third are murders, and a small percentage are accidental. There are still more murders than there ought to be, but the statistics that make the US look like Pablo Escobar Columbia typically are counting people offing themselves.

https://en.wikipedia.org/wiki/Gun_violence_in_the_United_Sta...
All I want is one line per email interface. I refuse to use an entire screen width for the gmail window. The classic had a "comfy" (or whatever it was called) interface that did that. If the new ux can be forced to do resizing of the columns I would be happy again with gmail.
Americans hate to pay taxes.
The "law abiding citizens" don't have to worry about these extra fines, as long as they go out of their way to avoid the police.
Then they can convince themselves that it's only the "bad guys" that are being fined, and as a result they deserve the treatment.
Cloudera and Hortonworks: Prodigal sons reunite
I found this wording interesting:

> We did not uncover any unusual vulnerabilities in the servers we purchased from Super Micro when we updated the firmware and software according to our standard procedures.

Does that mean they did uncover some "usual" vulnerabilities?
It's a standard wordpress blog, so I don't know what's going on there. I always browse with Javascript whitelisted.
>> It would be whole lot harder to find these modifications if this was on the silicon itself.

Intel ME is well know to be on the chip itself. When you're really good you hide exploits in plain sight.
Some books I've read say increased portions are a symptom of something else. E.g. Inability to feel satisfied.
This might actually be the stupidest fucking thing I have ever read.
> the same thing I do with SmartOS in a far more complex way

Citation needed. Yes, Kubernetes runs on Linux kernel and until someone ports it to use something other than iptables and the linux cgroups API, that will be true. But I could say the same thing about being locked into SVR4/OpenSolaris, and I bet you a Coke that a lot more people will agree with me.

The Kubernetes slack community has over 48,000 members and nearly 1000 are online right now. Can you say that about SmartOS? There's a ton of value in that vibrant community. This is not meant to be a dig, seriously where do you go when you need SmartOS support?
Lots of crazy answers here.

As an industry insider, what you do is buy a bond from a company that specializes in these sorts of licensing bonds. It should only cost you a small fraction of the capitalization requirement each year to maintain.
Become a Business Partner and Stop Begging for Refactoring
maybe, however the parent quote was from Coolidge, and when I read it I thought - what the hell else would you expect Coolidge to say? He's not going to suggest liking people, being clever and listening, being willing to look at things in a new way etc.
You know, I would watch a movie with a plot like this.
Right, but if you read chapter one of war and peace you can't take a year off and then read chapter two. Not only would you never finish, but you would forget to much that the whole wouldn't make sense. If you are going to read the book you can take it chapter by chapter, but you should finish in a couple weeks at worst.
An app that lets you beat government censors has been launched by Alphabet
Cloture
Turning a Script into a +$110,000/Month Site
I think this comment and the parent nailed it. The reasons for the differences are that in the US:

- The law/lawmakers and the public have differing views on what should be illegal

- The police are incentivized to find crimes, and the public is aware of this
Server Side Blazor performance should be similar to Server Side generated web pages, except the framework allows for SPA-style interactions instead of full page reloads.

There is added resource utilization from tracking session state on the server, but if done properly it could be as little as 1MB or so per active client connection.

With the rise of serverless and edge computing (think cloudflare workers), I wouldn't be surprised if patterns emerge to running this at the edge.

I agree I wouldn't put any high traffic apps on Server Side Blazor from the get-go. But for Enterprise apps with high complexity and a small user base, I think it would greatly streamline development.
Poles Apart: Notes from a Pilgrimage (2011)
It is the banks who put in the perverse incentive systems. (Pay half of this year’s gross profits in End of Year bonuses)
Typically yes. This is base hardening. The usual vulnerabilities can be just default configuration options or unwanted firmware/software features.

Similarly no security team is going to say "There are no vulnerabilities in the servers we purchased." It's just not true, they're always there and expected.
> Or at least have testimonies by employees in these company

The original article directly addressed this: "The companies’ denials are countered by six current and former senior national security officials, who—in conversations that began during the Obama administration and continued under the Trump administration—detailed the discovery of the chips and the government’s investigation. One of those officials and two people inside AWS provided extensive information on how the attack played out at Elemental and Amazon; the official and one of the insiders also described Amazon’s cooperation with the government investigation. In addition to the three Apple insiders, four of the six U.S. officials confirmed that Apple was a victim. In all, 17 people confirmed the manipulation of Supermicro’s hardware and other elements of the attacks. The sources were granted anonymity because of the sensitive, and in some cases classified, nature of the information."

It is entirely likely that the companies affected were directed by the IC agencies working on this not to discuss or reveal their knowledge of the hack. Often in intelligence operations it is important and useful to not alert your adversary that you are aware of their intrusions until you are fully ready to take action against them, or have fully removed the danger.

I don't see any reason to take the companies' categorical denials as evidence that this did not happen or that they were not targeted. Those statements are what one would expect in a national security incident and investigation of this magnitude, with such serious implications.
I don't quite resonate with the analogy here. It's about using the right tool for the job. Most small-scale personal projects, by their very definition, don't require an orchestration framework.
Are women paid less than men for the same work? (2017)
> To achieve this, the keyboard and the display is galvanically separated for the duration of the PIN entry

Perhaps this sounds too dull to ask, but what stops the terminal from just ... not separating the keyboard and display?
But this device doesn't need a way for the user to enter the pincode. So, all the sensitive part of the terminal is probably completely isolated from the android part.

I don't know this device internal and the PED/PTS exact requirement but it seems plausible for me.

You have something like a physical compartment who include the NFC and everything needed to process it like in a classical terminal. This compartment is highly secured as requested by the specification with just a very simple interface for the android part to send the amount to bill.

I've seen a lot of each-machine running on windows. Doesn't they work like this with the windows machine just managing the display buttons to select the amount and sending this information to the secure part who handle card interaction, pincode and delivery of the money ?
Because at least half of the people wouldn't believe them and consider this another conspiracy theory. Even when Bloomberg pushed this there are still so many deniers in this thread.
They're also from Texas, making cowboys even more appropriate.
> Modern ASICs are so complex that I'm sure that sneaking a tiny backdoor into the behemoth that's a modern CPU or embedded SoC would be almost trivial.

I suspect putting in a backdoor would be difficult because they are complex. Wouldn’t it be far too easy for the backdoor to inadvertently cause reliability or performance issues? And the bug would have to be useful enough to warrant potentially destroying the semiconductor business of a nation, not just some difficult to trigger side channel.
I was doing this for years paying well over $1.5k for food alone monthly until I lost my Bitcoin "savings" which I lost with lame trading and at the same time my company started not doing so well.

It's irritating to change but after a while you start to appreciate when you can just keep yourself within your daily cycle with work and location you're accustomed to.

I take it as a lesson to know how to soften the next hit.
I'm around 150, and I don't consider myself smarter than Feynman. And I'm no savant, am socially well adjusted, and not on the autism scale. This, among many other data points, has led me to question the entire concept of IQ.

The measurement of IQ borders on pseudo-science. It measures something, but what exactly? Everyone has a different answer. Ok, sure, intelligence. Now try to define "intelligence" empirically. What isn't a particular IQ test measuring that is relevant to intelligence? Different IQ tests often yield different results. And I'm not talking about online tests, but proctored tests administered by professionals.

How do you account for that amorphous quality known as "intuition"? You can't measure it or quantify it. You can barely define it. It is a finicky, inconsistent beast. Yet it has a profound effect on one's problem solving ability.

If the factors that determine IQ are individually difficult to define, differentiate, and measure, what does that say about the score itself?

In the broadest terms, IQ matters, but not in a way that makes one's score relevant for any practical purpose. You don't need an IQ test to measure competency in a specific task or occupation.
Population doesn't change it much.

The LAPD put over 100 rounds in one incident into two innocent women's truck when they were out delivering newspapers. The truck looked nothing like the suspect's vehicle. http://www.nydailynews.com/news/national/no-charges-8-lapd-s...

> When one of the women threw a newspaper onto the pavement in the early-morning hours, an officer believing the sound was a gunshot opened fire. Officers unable to see clearly into the truck sprayed it with 103 rounds, and hit seven nearby homes and nine other vehicles with gunshots and shotgun pellets.

That's more rounds than Germany uses in most years for its entire 80M population, and more than the UK discharged in what looks like the last decade or so. In one shooting, in one city, against people who'd done nothing wrong.
So do you have anything to support these fairly fantastical claims?
People that are smart enough to answer this questions didn't.

Others are blind to the fact that history was not only roses and fun and people justified a lot of atrocities with "progress".
None of those guys offer the same variety of form factors and features that Super Micro does. If you are an OEM that needs an Intel Xeon-D board in mini-itx form factor for example.
In the PR model, we can easily hook up a build system to automatically trigger builds on remote branches. How would that fit into this?
That being said, there are some pretty creepy or generally dislikeable people whose YouTube channels are very popular among children.

There are YouTubers whose whole bit is insulting people, having a short temper, inconviniencing people and playing it all off as jokes.
However, I have seen my younger cousins directly adopt behaviors from these YouTubers and try to solve their problems by shouting, insulting and throwing a tantrum. Ofc, throwing tantrums is something all kids do, but the manner in which they do it closely resembles these channels.

Then there are straight up creepy and unnerving channels with millions of views and that show at the top of queries searched by children.

I feel YouTube should provide parents with a more granular control over the filtering process. Preteens can be very impressionable.
Improving but Not Learning by Doing – knowledge transmission by culture
Does the supercharger charge the same taxes as gasoline? If not, I'd expect those costs to go up fairly dramatically as electric cars become more common on the road.
GKE is nice, probably the best K8s experience, but it's still a heck of a lot more complicated than Heroku.
Swarms of Super-Sized Mosquitoes Besiege North Carolina
Most popular technology related podcasts
This doesn't make sense, and it's really the opposite of what you're saying. K8s is hard, but for large scale you need something robust that's tested at that scale. A collection of shell scripts is more like a beginner tool set. Yes, it's easy to learn, but it will break when you get serious.
But I don't think it's that good to keep playing the rat-cat game.

> the credit card companies are always very worried about their brand image, so they are not interested in any negative publicity.

Letting the bad guys keep doing what they do while putting it's own customers under shadow, to me, it sounds like the credit card companies are helping the bad guys.

As a Chinese myself and a credit card user, I'm more worried than you guys do, because we are more likely to receive that kind of treatment (compromised credit card and computer chips etc). I really hope somebody can teach those bad doers a unforgettable lesson.
I'm not sure how you managed to keep a straight face while typing that.
Meanwhile in America 2-3 people are shot and killed by police per day.

https://www.washingtonpost.com/graphics/national/police-shoo...
Action Text for Rails
Project home page: https://xi-editor.github.io/xi-editor/
for work (development) macOS,
Linux on the server side,
Windows when it comes for private things (gaming, making music)
Security employees don't contact the FBI without consulting or at the very least informing the higher apps.

PR departments don't vehemently deny, on point, an article from a major newspaper without consulting the higher apps.

There is literally no chance that this happened and the response was made in ignorance.

Either Apple and Amazon are lying or Bloomberg is wrong.
That paper doesn't have anything to do with what the original poster said, which is that extremely large scale VLSI-style designs don't use FPGAs, but instead use large-scale, extremely expensive and fast simulators instead. That's basically correct, regardless of the kinds of formal methods that are in play: simulation is vastly cheaper and more feasible at large scales, so much so that people instead buy hardware accelerators for simulation to improve development time and get reasonable turnaround on complex components.

Smaller-scale embedded systems or bespoke designs can get away with full FPGA flows in order to do low-scale deployment/development (e.g. SiFive's CPU cores all run this way, and you can run them) -- and pretty much all hobbyist CPUs do so. But to say all modern CPUs use FPGAs in their development cycle is overstating it a bit. There's simply no devices that exist the kind of logic density needed to realistically model many large scale, high-volume designs you see today, not to mention the unbelievable synthesis times you'd have to endure.
Maybe he attained the skills necessary to invent GANs in one evening through years of persistent learning?
Regardless about how you feel about the hack, outsourcing the vast majority of our technology to another country just doesn't seem like the smartest idea. Why would we put our most trusted technology into someone else's hands—just because it's going to save a few bucks? Wouldn't it be worth it to just do these things ourselves?