skysight-inc/HackerNews huggingface dataset:
This may sound overly harsh, but if you can't find 10 potential customers to ask them about whether they want your product: How will you find your first 10 real customers?
It doesn't mean this is not a good product for someone to build, but it means this is a company YOU probably wouldn't be able to make successful.
This is just from my experience, cause I have fallen into this trap in the past. ;)
I like the haunted forest analogy more than technical debt. There also seem to be some good insights here about how to approach rewrites that don't just toss out the baby with the bathwater.
This is a dumb comparison and too many people make this argument. You couldn't use any technology without paying the Microsoft tax. There were no smartphones, no internet-of-things, and the internet was just getting started. Everything you did had to be done on the desktop.

That is no longer the case. You don't want to use Google? Type in www.bing.com. You don't want to use Facebook? Use Twitter, WhatsApp, Snapchat, or whatever. Don't like Android? Buy an iPhone.

Microsoft's monopoly isn't analogous to Facebook and Google. Being a monopoly is not a problem - being a monopoly in such a way that harms the end user is; within the United States at least. Nobody is being harmed by Google and Facebook being popular.
It looks great. Great work!!

Also, is there a reason why we can't toggle on and off dark mode to compare it to a non dark mode?
Which RDF semantic graph databases do you recommend for production?
So is there any indication yet what the virus did / is doing?
the article mentions wait for them to be disrupted. but how can that happen when they seem to acquire any threat?
You mean like the signed/sealed/delivered csp policies that browsers have supported for years?

https://developers.google.com/web/fundamentals/security/csp/

To quote the signature section:

'<hash-algorithm>-<base64-value>'

A sha256, sha384 or sha512 hash of scripts or styles. The use of this source consists of two portions separated by a dash: the encryption algorithm used to create the hash and the base64-encoded hash of the script or style. When generating the hash, don't include the <script> or <style> tags and note that capitalization and whitespace matter, including leading or trailing whitespace. See unsafe inline script for an example. In CSP 2.0 this applied only to inline scripts. CSP 3.0 allows it in the case of script-src for external scripts.
Have we ever broke up a software company?
> I cannot believe that the Commission agreed to all this.

I can. I mean, the driving forces in the EU got extremely xenophobic. Italy is ruled by the fascist Salvini, the PiS in Poland are not far behind Orban, the UK government has been xenophobic for decades, France suffers from xenophobia too (after the terror attacks, though) and our own Horst Seehofer risked collapsing the German government over (literally) 0 migrants (per https://www.focus.de/politik/deutschland/seehofers-deal-zahl...)...

What are human rights, what is democracy worth, when there is no one left to enforce them? The EU won't do shit against Hungary, Poland or Italy (as there is a 100% consensus required!), the US under Trump are going isolationist and trampling on human rights wherever they can, and the UN Security Council is powerless against the stuff that Russia, China, Saudi-Arabia etc. do because there's always a veto power that bails out their "friends".
Wow, I'm sorry... are you trolling?

This thread is about google forcing everyone to use javascript to use their services.

That's literally the topic of conversation.

EDIT: I'm not allowed to post because of downvotes, to reply to the child:

I am not forced to use google, no, but I don't think I'd get very far on todays internet without javascript.

Google are enabling that: Now people will say "Oh, well google are able to force javascript so why would we support more than google does? we don't have their resources!"

And thus, the next generation of websites have absolutely no hope of ever having a plaintext version.
> So there's no point to slowing down emissions.

> We need to adapt. To limit the damage, and fix things.

The first contributes to the second.
A cockroach’s karate kick is the trick to fend off killer zombie wasps
http://lentein.com/
How do you encode it in such a way that you can invalidate individual tokens? How do you distribute that information among your services?
I feel your pain. I produce and mix records - at an amateur level, but enough to get quite good at it. It makes me want to toss all this "objective", "measurable" bullshit from the skeptics right out the window - the subjective experience is all that matters. But it also makes me want to toss the audiophile voodoo out the same window. "Accurate" reproduction? I just want to show them how records are mixed.

My pet example is that I put high-pass filters (12db slope) at 250-300hz on almost everything that isn't a drum or a bass instrument. I'm slaughtering the bottom two octaves of guitars! And if you solo a guitar track, you can hear it. But in the context of a mix, all those bottom two octaves do is make mud and confusion, distracting from the clarity that the kick and bass (guitar || synth) needs. And I need that clarity, because I'm not mixing for $500,000 audiophile systems. I'm mixing for car stereos, boom boxes, Alexas, cheap earbuds, and worse.

So all that matters for me with audiophile systems - and I love audiophile systems - is that they sound good. That doesn't mean they sound accurate.
Man, I would love to be able to pick your brain and see how you made the moves you made. I also come from a non-standard background and have a high paying gig in a low cost of living area, but want to switch to remote at a big company...
> A speeding ticket isn't adversarial (usually, unless you make it that way). They're just routine transactions.

Thinking about being stopped by the police for speeding as being something routine is insane. You should't be routinely doing something dangerous and illegal (speeding is illegal per se in most states.)
So you're saying you can have sane sessions as long as you have some server-side storage? :-)
Founder makes financials public
Why not just "invalidate" the client? At best, you're making your application "safe" for 900ms or whatever the expiry date is.
Wow, Flickr is still around
The Saruman Trap
Silicon Valley is responsible for most of the world's innovation, so as a consumer I'd rather we not dictate where firms wanted to set up shop.
We wanted to use Neo4j at my last job (in Mexico). However we found the commercial version was prohibitely expensive, and the free version did not work for real life problems.

So I think this is a place where open source alternatives would have been welcomed.
Which self-hosted calendar do you use? would you recommend it? I'm in the market for a new one, but the current offerings that I've seen aren't great.
Working in a school, not as a teacher, it is amazing to see how students litter their desktop with files, similar to how most of the staff save their files.

I am not a programmer by any means and I know how important it is to create a filing system with directories. It is irritating how much time is lost while waiting for colleagues to locate a file hidden among the many on their desktop.
>Sadly

*Thankfully
A semi-synthetic organism that stores, retrieves increased genetic information
With this method isn't the downside that you have to invalidate all tokens, and not just the attacker's tokens?
I'm a fan of Flickr, and for me the community is the reason I upload my photos there. If this makes Flickr sustainable and lets the team invest in improving the product and fostering the community, I think it's a great move. Plus, seeing highly curated feeds is what people want, not just a dumping ground for every frame in your roll/SD card.
"it is hard to escape it because of the simple problem of not knowing who to talk to"

I think this is why the average age of entrepreneurs skews higher...because you get more experience and connections on who to talk to and what questions to ask. And this is why serial entrepreneurs succeed.

If you think of it as a software product standpoint. Once you have a team to build out the entire stack, your next software product would be easier. But the time it takes to find your UI person, backend, mobile, etc...takes time.

My inner circle of professionals are developers. If I wanted some dev resources I could. But when I meet certain people for the first time who don't know a lot of devs, they look at me like a unicorn.

My wife runs a small business/franchise. We were hoping to use that as a stepping stone for future, bigger businesses. There are lots of small business associations around us, Chamber of Commerce, etc. They would have some resources if you want to network.
I think this is a bit unkind.

Maybe: Storage is expensive, and we'd rather collect money from you, rather than sell you to advertisers.
What do you think of Tesla as a business and car company?
Having said that, is there any other kind of witchcraft than fake witchcraft?

The same can be said about most religious practices and superstitions. It really doesn't matter what you (or I) think about other's personal practices so long as it isn't affecting others much.

(I'd argue they all affect others, but so does any set of morals a person has whether religious or secular. Most of these don't actively harm other folks).
It's actually a good idea. It forces the user to do some curating of their images, encouraging them to only put their best images online. Which in turn should result in more browsers engaging with the site and photographer.
In some ways, Google is already more powerful than the EU. I am not totally sure that the EU could ultimately force Google to do anything it didn't want to do; many of the things that have been implemented putatively to limit the Goog have had the (un?)intended consequences of raising the costs and barrier to entry for new competitors and further cementing their dominance...
Thanks. I will look into this when I get a chance. I am sort of hoping to convince people I dont need windows.
You wouldn't be able to control what people publish on their own devices, but for those people to be able to spread their (unwanted) content would be presumably harder.
Since this process is optimized for food production, I'd expect processes optimized for carbon capture to be more efficient at that.

I suspect the main environmental gains from this would be to offset beef production. Outside of reducing the ongoing emissions there, it opens the door to return pasture land to forest, tying up large amounts of carbon in trees.

Userful sidenote: The most efficient poultry producers today have about the same environmental footprint as tofu producers. If you don't feel called to eat vegetarian, simply switching beef for chicken can be almost as impactful. Just stay away from organic food, or all those gains are offset by the inefficiency of unscientific agriculture.

See the second chart here for the chicken/tofu showdown: https://www.theguardian.com/environment/2018/may/31/avoiding...
Previous discussion: https://news.ycombinator.com/item?id=11895440
Who in the world would trust Donald Trump to manage search across the entire internet?

You'd think that after the Trump administration the nation would have a greater appreciation for federalism and a smaller administrative state.
The idea of JWT is basically you give your user a "token" that can be used against many "services" while servers don't have to persist the state of that token, just be able to read the encrypted token, and trust the information in the token. The obvious issue is the server cannot easily revoke that token without blacklisting it, therefore persisting that token somewhere on a blacklist on the server. If you are going to make a lookup for a token in a blacklist you might as well look up for a session ID to being with.
Can someone explain the Cookie vs LocalStorage thing? You can access cookies from Javascript, so how is localstorage worse? Assuming an attacker can execute arbitrary js in the browser (the model provided by the article).

edit: Thanks for the answers - httponly, makes sense.
It's not clear that he's decrying hate speech so much as decrying the amplification effect on it that the current state of the tech world enables.
Sorry, but at this point it is pretty obvious that big tech companies care about account security only as far as it impact their services. The late revelation about Facebook abusing 2FA phone numbers for marketing is a great demonstration of how that works.

Google too does some really funny things to make it nearly impossible to create and maintain an anonymous accounts not tied to a phone number. Even when those accounts are just used for browsing and bookmarking, without sending any outgoing information.

>When an account is taken over it's abused and that abuse creates more victims.

Pushing JavaScript everywhere increases the attack surface for every single user on the web. Except it doesn't happen overnight, and big companies who do it (by affecting standards, or by doing stuff like this ^) aren't affected by client-side exploits and privacy loss.

If someone hijacks my browser through some clever JS API exploit and steals my credentials, what is Google's response? "Just use our 2FA." What about smaller websites that don't have resources to maintain 2FA? "They should authenticate through us." All roads seem to conveniently lead to centralization.

BTW, it is worth noting that the impact of a compromised account isn't nearly as significant if a single account doesn't hold keys to pretty much everything you do online. Somehow this is rarely factored in during such discussions.
I don’t think anyone would argue the GFW is not visionary, the question is what kind of vision?
> "where is your data?"

> "uhhh, it's in the app, or in the cloud"

> "yes, but specifically where?"

> "i dunno"

We can keep going:

“It’s in /home/walrus01/docs”

“But specifically where? What physical drive?”

“It’s on /dev/sda2”

“What cylinder/track/sector?”

At some point it stops mattering practically. The abstractions presented to users today are often such that it doesn’t matter if the user knows what path something is stored in.
From my time browsing HN, the consensus seems to be "don't use JWTs". What is the preferred method of client authentication for simple APIs these days?
Flickr's main feature is being a service that prioritizes photography as a portfolio, rather than photos as a visual social blogfeed. Limiting free users to 1,000 photos effectively kills the ability to use it as a clunkier Instagram. As long as there's enough revenue from ads and the pro accounts, this may be the best way forward for Flickr as a long-term service.

I've been a pro user for awhile. I guess the downside of this is that I now feel locked in, having well over 1,000 photos. I think previously, had I downgraded to the free version, I'd be able to keep all my photos but no longer provide them as full-size downloads. I don't have a particular complaint with Flickr as a service, it's just I don't do a lot of photography other than casual uploading to Instagram these days. That said, that Smugmug is committed to taking a different, coherent direction provides me with a lot more confidence than the years of Yahoo doing virtually nothing.

edit: maybe I'm grandfathered in for unlimited photos, if I were to downgrade to Free? The wording in the announcement is unclear.
They don't have to be broken up, they need to stop being morally bankrupt.

Nothing about Facebook's size dictates that they needed to:

- Allow their platform to be abused by misinformation campaigns, because it pays well (thereby allowing Trump to win)

- Allow hate groups to flourish

- Allow anti-vax groups to grow and flourish

- Allow nutty conspiracy groups to flourish

- Help dictatorships with their genocide

It's simply because they are morally bankrupt by design and by culture.
And that's why you don't use (free) cloud services as your only backup. I thought about storing all my family photos on flicker a few years ago... Would have been useless now.
I actually have a big issue when the news runs stories like this to begin with. They would do the same btw if Woz said it or any other well known person. Sure the fact they can tag on 'father of the web' gives a strong pull but that is part of the problem. His thoughts on this aren't any more important than thousands of others that nobody has ever heard of. This is a total 'news as entertainment' story. And this has nothing to do with whether I agree or disagree with what he is saying. I just don't like prominence given solely based on some prior achievement which quite frankly has no bearing on what he is saying today.
> That said, I'd be willing to wager a fair bit that literally every line of code you've run on your machine (probably ever if it's been bought in the last few years) outside of the vendor installed OS and drivers came from the internet.

We explicitly decide to install software and we know where we're getting it from. We may not be careful enough, but I certainly trust `brew install` a lot more than I trust a random site I happen to visit.

> You bought that machine to run code. If you don't want to run code that sites serve you on the internet, don't visit them.

I bought my car to drive it, but that doesn't mean that every person I pass on the street gets to drive my car.

You seem to think that visiting a web site establishes a trusting relationship with that site. I think that downloading a site's HTML and running its JavaScript are quite different levels of trust. Especially when the content and the code come from very different entities - eg, the journalist writing the article vs the advertising network the publication uses.

Clearly if I'm using Gmail, I'm trusting Gmail and I don't mind running their JavaScript. But the blanket statement that "if you don't want to run code that sites serve you on the internet, don't visit them" seems out of touch with how pervasively nasty the internet is.

Taking a walk on a city sidewalk does not require eating whatever you find there.
Santiago Chile, gross USD/yr

2009-2010: software factory 18k

2011-2014: small startup, started at 25k, left at 40k (+ equity worth 0)

2015-2016: FAANG 75k (incl. bonuses)

2017-2018: medium-sized startup 100k
I'm glad I got grandfathered in with my UNLIMITED storage. Wondering when it's going to end ;)
Yes, of course, jwt can facilitate that. Using it as a replacement is not good, i agree.
What do you mean by "invalidate the client"?
> and expiring it when you log-out?

and how would you do that if the user doesn't actively log out of a service?
To be fair, all sides trust the government.

We're trusting the government to go in and properly split up a company. Or you're trusting the government to properly regulate a company.

The people who don't trust the government, don't want the government to take ANY action. They believe the market will solve the problem.
ww1 was horribly mechanized and amplified.

But if you want earlier horror, read wikipedia page about torture devices.

Also the recent article about maroons and slaves has its share of large scale horror. A Million caribeans killed quite rapidly.
Camera nerds are the worst. They're worse than audiophiles, if that's possible. Good photography requires nothing more than a bit of reason and observable standard practice, applied to aesthetics. You don't have to look hard to find someone with a $5000 camera/lens combo who doesn't know what the Rule of Thirds is or how to apply it.

Last weekend, I was in DC, and snapping pictures of the Washington Monument on my phone. My sister was shocked at how good they were. It's not hard, really.
i'm pretty sure solar protein is called plants.
> I fall into the "Build before talking to customers" trap constantly. Even though I know it's "wrong", it is hard to escape it because of the simple problem of not knowing who to talk to.

Then you have a different problem - you don't have a way to reach target customers.

Even if you build your product, how are you going to build a sales pipeline? Your customers won't hear about your product by themselves - you have to get it to them. Many many companies make products that are good, are actually useful, but they don't know how to build the marketing/sales pipeline that will actually make their products profitable.

And just like validating the product to build - building/validating a sales strategy is usually something you should do before building the product, both because it's harder, and because findings there may change what product you end up building.
It's worse than that. The current system was tested on 30 people with 50% base rate of lying.

Even if they bring it up to 85% accuracy with 50% base rate, by the time you are dealing with base rates that are more realistic, you're going to run into way more problems than just 1 out of every 7 people.
You had me with this: "Any change to production systems or applications goes through a rigorous review process which involves only engineers (not managers)."

I'm going to spend some time looking around the site today.
Would a bunch of small companies have invented the smartphone? I feel like you often need to have concentrations of a lot of capital at once for big things to happen.
You're talking about a service that this company provides at no charge. No one is forcing anyone to use these services.

If you don't like that, go somewhere else. No one is holding a gun to your head and going "RUN JS OR I SHOOT!".

Why do you assume that you, and the people you claim to be advocating for, are able to compel this entirely separate entity, making a decision it believes is best for the majority of it's customers, to do something that benefits you - a user of a service provided at no charge, and with absolutely no binding contract?
When you have a symbol representing a word, it represents all the defined (by convention) properties of the word. All the semantics, all the the vocalization. The defined part, that is. You don't get any undefined parts, e.g. if you had separate symbols for "read (past tense)" and "read (present tense)" they would "naturally" include relative speed but not relative pitch. If vowels are significant at one point in the language's use, but the rebus principle allows for mismatching substitutions it would be a strong indication that at some earlier point they were not, either because they had regionally differing conventions (while still mutually understood) or because they were just filled in ad-hoc based on context (e.g. how pitch is decided upon when speaking a language where it is not significant: just make it sound pleasant and/or communicate macro structure).

Of course, over time weird things do happen and you might end up with a mess like english where the relationship between phonetic encoding and actual vocalization is incredibly weak and serves only as a hint for narrowing down the actual encoding+context to semantics to vocalization lookup chain.
Or, implement a "master token" scheme: have a long-lived master token, which is used only for generating short-lived (e.g. 5 min) tokens that are actually used for authentication/authorization at the API endpoint.

User gets banned or privileges revoked? Fine, revoke the master token on the authentication server and after 5 minutes at the latest, the user is locked out as he cannot get new valid short-lived tokens.

Sessions aren't difficult - as long as you stick to one language and environment (e.g. PHP). But as soon as you throw in for example Java to communicate with a SAP backend (as an online-shop system might need to), nodejs for a "support/sales chat" system and whatever, a JWT scheme is easier to implement.
Perceived
People who use free software are not “freeloaders” and there’s no need to use such a derogatory term here.