skysight-inc/HackerNews huggingface dataset:
Thanks for your reply.

I wonder whether this next would be considered by you as merely treating the symptom of addiction:

Joe notices that most of the time he spend on the web is wasted time. So he cancels his home internet connection and relies on his connection at work to get done everything that needs to get done on the web. For example, at work he downloads movies and TV shows from the iTunes Movie Store (or whatever they're calling it now) onto his MacBook for watching at home. (or he uses youtube-dl to download Youtube and Daily Motion videos.)

Is that in your opinion uselessly treating a symptom of addiction?
What's better to hold water, a colander or a sieve?

Which is to say, when you hand out the privileges laid out in the article, it really doesn't matter what software you used to whitelist "every thing".
You don't have to be in the same zone or the same cloud, you just need be in roughly the same DC area and buy 10 Gig Direct Connect links from AWS. This is possible in places like London, Ashburn, VA, Dublin which is why many of these providers only offer their service in a subset of a cloud providers locations. The latency is is basically imperceptible ~1-2ms.
Yes, his other major gripe is that the security updates for non-official flatpaks take a while to get security releases out. I have the same problem when I run applications that have an official RPM repo, and a volunteer packages the deb and pushes it to the official Ubuntu/debian repos. The same thing with Alpine Linux packages. Its not a problem with the tech, its a lack of volunteers (or not yet enough adoption by the developers to maintain it)

In fact, it could be nicer if it catches on, as developers won't need to maintain deb files, rpm files, pacman files, etc.
It's a difference between "I know it works on my device" and "I don't know if it will play sound, answer calls, not work at all, or only work if I turn on usb storage every time"
my priority would be to get a staging area setup, having anyone push directly to production is going to cause you endless stress if something breaks in the future and you can't rollback to a stable release.

I love this story of how a junior delete the whole production database. https://www.reddit.com/r/cscareerquestions/comments/6ez8ag/a...

imagine in 2 years that happens to you when you're not the junior anymore.
Nope. Actually they're not even legally required to abide by their own TOS. It's a completely one sided agreement, where they both dictate and interpret the terms. They only time you might have a legal challenge is if you pay for service as there is contract or an implied contract. Those usually force you in to binding arbitration.

Decades of consumer protections are being cast asside.

I'm not sure there's much you can do. Having consumer protection laws catch up with the modern times would be nice, but it's doubtful that they'll be anything more than token gestures to quiet people down.
The Best Bosses Are Humble Bosses
I've wondered if people were forgetting trees in climate modeling ever since I read in 1492 about the hypothesis that the European mini ice age was caused by forests growing on abandoned Indian farms in North America.
Could someone knowledgeable enough comment on how this compares to Cannoicals Snappy https://en.wikipedia.org/wiki/Snappy_(package_manager)?
It's passive because you have to be around it to see it, and you have to look that direction, and it isn't tracking how you respond to it.

They are annoying (but that's not inherent, it's entirely possible for someone to buy a billbaord and put up a great work of art or something), but they aren't a problem in the same class as the individually targeted advertisements that incentivize massive data collection and correlation projects and privacy violations.

> Then, incredibly, the Premier of NSW (i.e. the leader of the state) forced the Opera House to back down, and show the ads. There's been widespread incredulity and outrage here about that! So, yeah, it is a problem.

I think that's (possibly) a problem, but in a way entirely divorced from the problem of advertising. It depends entirely on the reason. If it was forced because the Opera house if funded with government money, maybe that plays into whether they can/should reject certain ads. I imagine that would play into the discussion in the U.S. (where whether you accept government money affects whether you can legally exclude certain classes of people, to my knowledge).
Display for the slate looks fantastic, the idea seams right, but I just don't see a legitimate reason to drop another $1K to upgrade from my Pixelbook.

The Pixelbook at least has a keyboard, works great on the lap (hence the name LAPtop), does pretty much the same as the Slate.
"When Justin finally heard back from Sony, they didn’t apologize and promise to protect the account. Instead, they said it—an account Justin has had for more than 13 years, with a history of trophies and purchases—was gone. There was nothing he could do, no process to appeal, no way to get any of his games back."

That, should be considered completely unacceptable, especially from a company that has had huge data breaches in the past. Sony should be bending over backwards to make this guy whole, not giving up.
Cross-posting a comment from Reddit, because it nails one of the points mentioned:

---

The list on the page is

Gimp, VSCode, PyCharm, Octave, Inkscape, Steam, Audacity, VLC, ...

With the exception of Steam all of those programs are used to open random files anywhere on the system. One could implement a permission prompt for accessing a file, but that would lead to a Vista-like Situation where basically every action causes a prompt.

Now, that's not to say this is good as it is, but for most listed programs it's probably the way to go.
flatpak is still early.. most apps are still installed from package managers, and few apps are written with flatpak in mind.

The current situation is probably not much worse than installing from various third party package archives.

I suspect things will get better as adopting catches on.. it's no surprise that early stage open source software have rough edges.
Most of the issues that are expicitly mentioned are fixable bugs and not fundamental design errors. In the end it seems to come down to poor package repository maintenance, which many repositories for Linux distros suffer from. While I do not like the idea of flatpak very much myself, this criticism seems too harsh to me.
https://www.google.com/amp/s/www.dailymail.co.uk/news/articl...

Same bullshit, different context. We have no way of knowing for sure because there are no accepted network traffic monitors and no packet-sniffing capabilities with iPhones or iPads. But my iPad started developing mysterious problems the day after the warranty expired and a line of dead pixels appeared on a device that was never shocked physically in any manner, and was sitting most of the time on a table next to my couch.

I'm glad it hasn't happened to you. Lucky you.
That is a very salient observation. Of course if they did that they would lose people who would step out, start their own business and just rent Google's infrastructure, but as AWS has shown that could become a meaningful part of their annual return anyway.
"Individually targeted ads" is intrinsically more relevant to the individual and leads to better click through rate. It is in the interest of both the company who run these ads and the user who see these ads (that they're much more likely to see something relevant and useful).

If an ad intends to confuse their audience to think they're purely informational material, they probably should not be shown to anyone. That's a completely different issue, and Facebook's ad censoring step is supposed to deal with that.
Thank you and @hfourm, I will try out the redux solutions proposed.
The assumption that MBAs do not have domain experience is often incorrect. Stereotyping is supposedly frowned on in the comments here.
I remember some friends implementing something for a business in Turbo Prolog, but I thought that had some non-standard extensions.
File picker is privileged and mediates access through monitor. Ditto for drag-and-drop. Problem (largely) solved.
>it is very likely that other kind of crash tests, that are not even tested by anybody because internal combustion engine cars always did so well on those, are extremely fatal on teslas.

You assume there are such crash tests, but don't describe any specific ones. I am guessing that is because none exist, but perhaps I am mistaken.
You don't have to deal with the jvm for one thing. Java for another.

Both of those things are selling points for me.
Minor nitpick:

> it's such hypocratic BS ...

You mean hypocritical. And the oath would be spelled Hippocratic.
And many docker users run privileged containers, because then they don't need to troubleshoot permissions.. It doesn't meant the underlying system is flawed, because people take the lazy way around it.

I'm thinking of all the blogs back a few years ago for setting up things on Centos.
Step 1, disable SELinux.. That was never recommended, but the blog writers didn't want to go into details about how to manage selinux, or couldn't understand it.
Without incentives, why would Sony do anything for anyone?
Just as crazy, glass backs. They’re there mostly to facilitate wireless charging yet 50%+ of the phones that have them don’t support wireless charging...
> Even better, it lets you very easily drop into those dependencies and add minor changes or debugging lines if you need to. This can be incredibly useful if you're trying to understand how one of them works or think that that you might have found a bug and trying to verify or patch it.

You should totally check out Roger Peppe's gohack[1]
It enables you to do the same in a Go modules world

https://github.com/rogpeppe/gohack
This isn't any less "broken" than painstakingly adding third-party repositories when your package happens to not be maintained.

In other words, Linux is secure because nobody can ship software on it without going through massive hurdles and because everybody who is smart enough to install software on Linux does some diligence.
Google's had a lot of CEO's. Who are we talking about ? Larry Page, Eric Schmidt or now Sundar Pichai ?
If you are interested in helping the US Government fix this particular trashfire, consider joining the Defense Digital Service. We work on a variety of DoD projects as part of the US Digital Service "tech peace corps". https://www.dds.mil/

If you're not ready for that level of commitment (though it's amazing work), and you're interested in being involved as a security researcher, reach out to me and we can talk about joining our bug bounty program.
I haven't used Atlas but I recall in 2013 mLab being a pretty solid experience. A lot of great features for a reasonable price.

Anyone have an idea at what market share looks like for for MongoDB hosting these days?

As an aside I recall Rackspace buying ObjectRocket when it when on it's SaaS / PaaS buying spree in 2013. Did RAX ever spin it off?
Well they’re “free” if you buy them alongside hosting. Still even if cheap, that’s quite a commitment: finding a domain, paying it, writing a custom (albeit simple) website, uploading it, etc...
That does not explain why Google ignores entire words. People misspell words, yes, but who accidentally enters random other words in addition to their search terms?
If information, ideas, knowledge were shared openly we wouldnt have these kinds of ridoculous events. This kind of news is what keeps nations siloed and prevents collaboration. At the same time maybe this will also force us to abandon trust all together and move towards verifying.
> I'n not sure about the reasoning, but it's probably a combo of "not trusting user namespaces" (disagree) and user namespaces requiring privileges to use.

binctr looks like an interesting solution to tackle this issue.

[1] https://blog.jessfraz.com/post/getting-towards-real-sandbox-...

[2] https://github.com/genuinetools/binctr

[3] https://news.ycombinator.com/item?id=18180276
That’s how macOS sandboxing works too.
The graphic on page 26 of the report is kind of cute: https://i.imgur.com/MWrM2i8.png

The inclusion of this graphic makes me realize the report is not intended to explain the situation to engineers. It's to explain the problem to well-decorated higher ups that probably don't understand modern technology all that well, yet are calling all the budget shots.
Do you open your files in PyCharm or VSCode through a file picker?
> which should be a giant "nope" for anyone reading something called hacker news…

I’m willing to bet that 80% of HN users have iPhones :)
This is especially bad for projects like Linphone (open source SIP Client) which exclusively provide Flatpak-builds for Linux [1].

[1]: http://www.linphone.org/technical-corner/linphone/downloads
An interesting proposed solution. It seems unlikely to work for all.

Somehow reminds me of this:
https://principiadiscordia.com/book/45.php
1. Yes but more important is what you personally are working on, not what company you're at. As a new grad at a bigco, you are unlikely to have a significant position, so purely as a resume builder, the "rep" isn't going to be useful. That said, bigco experience is very valuable, even if you switch back to startups.

2. Yes and Yes

3. To 4 decimals: $0.0000. That's not being snide.

4. No

5. Yes/No/Yes. All companies know what other companies are paying for typical engineers. If you are a particular standout in a particular specialization (eg AI) then you'd have an edge by getting a competing offer, but otherwise not.

You didn't state where you are and where the job is, but I take it both are bay area.

> I wasn't really planning on leaving

Then you may be putting the cart in front of the horse. If you like your job, and like the company, are learning things, why change? I hope you realize it's completely different working for a bigco than a startup.
Sony's reputation should be incentive enough.
> A bit of Hanlon's Razor[0] goes a long way to resolve problems involving human cooperation (of any kind) more smoothly.

I don't like the snarky tone of the article, but I really thing you're being naive here. Let's examine the facts:

- Flatpak's intent is clear and stated first in in their homepage [1]: "Flatpak is a next-generation technology for building and distributing desktop applications on Linux"

- Red Hat is the company other companies hire to manage their linux systems.

- In the flatpak homepage there's a huge quote stating "The Fedora Workstation team are very excited about Flatpak and the prospects it brings for making the Linux desktop easier to develop for. We plan to continue supporting this effort going forward."

- The FAQ page states "We are explicitly using many features of the linux kernel (bind mounts, namespaces, seccomp, etc) to create the sandbox that Flatpak apps are running in." ... and then it turns out that they aren't, or at least they aren't enforcing it.

I don't think this is stupidity. This is flat out lying to try and get mindshare.
Personally I find the tikz syntax to be reasonably good. It’s slightly weird in places but I think it’s much nicer than eg svg
It would not have to have more than two leads, depending on its use in the circuit. It was an example meant to illustrate how the dramatically different levels of miniaturization can make it hard to reason about attack vectors.

Consider what a state actor could do with access to modern microprocessor level fabrication.

I'd expect that we'd see features such as the following:

- sophisticated intra-chip communication

- long periods of total dormancy of the exploits

- circuitry capable of receiving a "it's safe to begin the attack" message

- surprising communications vectors for exfiltration

- technology to make malicious parts appear under x-ray to be normal

- fallback to awaiting the message to perform DoS if more sophisticated attack vectors are not possible

I agree with your suggestion about using the existing footprint, etc. There is likely some very sophisticated tech for making malicious parts x-ray and test as normal in every respect.

The network connector exploit described in the article would be easily detectable by temperature dissipation measurements. So distributed methodologies are likely in use.

I'd also estimate that a large number of mobile devices have built-in hardware compromises that are dormant and can be used if necessary. These would be the simplest attacks to carry out and would have extremely high yield. Things like:

- phones suddenly jamming the 4G and WiFi network simultaneously

- hardware implants to help detect whether a device is being used by a high value target. Such an attack could be created using a tiny bit of silicon and would be dormant in most cases.

The biggest risk to a state actor doing these kinds of attacks is being detected, so firmware based attacks are potentially more risky than hardware attacks, since we are better at detecting a checksum mismatch than we are at testing hardware across the spectrum of possible input conditions that might trigger unusual behavior.

So I think we'd see state actors dipping their toe in slowly to these kinds of attacks, first establishing the supply chain hacks without anything malicious going on, and then gradually phasing in actual malicious hardware once the relevant parameters for the attack are better understood.
hu.ma.ne: The best human experience, ever.
Going edge to edge is extremely difficult, and requires folding the screen past the edge. Even Samsung haven't managed to do this, only Apple.
Can't say I'm exactly over the moon about this. Although Atlas does seem to be quite a bit cheaper and probably offers a better implementation of the product, mLab's key offering was always the incredibly good support they provide as standard. I haven't needed it often, but I know I can rely on it.

Atlas does not include this - it's something you pay (a lot) extra for and I'm pretty apprehensive about whether it's actually going to be great support or not. At this point my primary worry is that it's going to be more AWS-style support, i.e. expensive and total crap.

The fact that there's no mention of support in the email or blog post does not fill me with hope.

Any Atlas customers who can chime in with their anecdata?
This highlights a conceptual dilemma with access rights in file systems: if an image manipulation software wants to open .bashrc, this is potentially suspicious. But for a text editor this is probably ok. Likewise, a text editor that reads a binary executable is probably a little bit fishy. But a unzip program might so that for a valid reason (e.g. ZIP archive appended at end of program, a common thing for installers). How can we distinguish between those cases?
Could you elaborate? That would be very helpful, the article doesn't quite detail ...
Machine learning for price optimization
It’s sad that internet is all free but an average American is OK with spending $105/month on a cable package and STILL be targeted with ads.

What a world we live in. The problem is not that average person doesn’t have money, the problem is that these advertising giants have gotten people to expect that online services should be free (but in exchange for privacy).
Well xsl does not include interactivity, and it’s functions are not much fun. So I’m not really sure anyone of sound mind would want to implement a nonlinear constraint optimiser in xslt.
> Well they’re “free” if you buy them alongside hosting.

Depends on hosting company. I've "bought" domains for free many times, without hosting, just to run joke sites for few months.
The more I hear about issues with USB-C the sadder I get. It feels like we had an opportunity for 'one connector to rule them all' but the standards are so loose that what we got was something that looks like one connector but could be one of many, and it may or may not work for a particular use.
Though not pertinent to my original comment, that newyorker article does have a portion where experts argue that the misconfigured bulk emailer explanation which you bring-up does not hold water:

https://www.newyorker.com/magazine/2018/10/15/was-there-a-co...

I'm saying 9to5mac as an apple enthusiast site has a reason to run the post it did and that since technical people like to talk about technical things of course there's someone connected to the story making those arguments then largely non-technical reporters have trouble making sense of it all.
The obvious solution would be to transfer the account to a different username, that has no attraction for the scammers, but even that is still virtually impossible.

If you ever thought Microsoft is an incoherent mess, Sony is even more so, just without any clue when it comes to modern software, UX or security concepts. The PSN experience it pretty much the state of ten years ago with security features tacked on to fix the hacks, but little more.
7b has both LSBs set. That makes it multicast and locally administered. ergo, unlikely to be a mac address.
Messenger Lite launches on iOS, but only in Turkey
Does anyone have any insight into why Paul Romer is a Julia skeptic?

In the blog post

https://paulromer.net/jupyter-mathematica-and-the-future-of-...

he says:

"Which reminds me. If you are a Julia enthusiast, how do you suppose the investors in this new language plan to make their big score?"

Also there's this:

https://twitter.com/paulmromer/status/985507319114096640

It doesn't seem like he's followed up on his threat/promise to write a blog post about why he's not a Julia enthusiast, however.
The sandboxing platform could offer an API so a sandboxed program can spawn a privileged file-open dialog, and then the sandboxed program is only allowed to modify the file/directory that the user picked.

With the current situation, calling the programs sandboxed is completely misleading.
This is pretty much the whole point of SELinux (and probably AppArmour)
Website video header with real-time cat face detection and tracking.Desktop only
So a secure implementation will be written, breaking everyone's code and workflow. The resulting rage of the users will then be used to silence the security concerned, and a great checkbox will be painted under the door-mat [Informed consent is given by foot stomp] and the world rotates on.
You need a system, not a tool. Once you have a system, you can find the tool (or more likely, small set of tools) that help you best implement it.

My system is loosely based on Getting Things Done (GTD). At different times over the last 15 years I’ve implemented it using pen and paper; dedicated apps; simple to do list apps; a word processor; etc.

Find a couple systems and try them out. Then adopt the principles of each that you find most useful.
> Dieting may be the most helpful analogy here. In the US, many of us have poor diets either on occasion or frequently. Few of us have the discipline to eat well for long periods of time to optimize our health. When we gain too much weight, we pay for a personal trainer or a diet program or a book or an app to get us back on track.

I agree that food could a useful analogy, but I thought the consensus was that diets don't (in general) work. Paying for a personal trainer isn't scalable, and I don't see creating a job as a Personal Anti-Technologist as a salable solution.