skysight-inc/HackerNews huggingface dataset:
I wrote a longish post criticising Farnam Street's (and others) called the mental model fallacy.[1]

My key beef is this: I think the vast majority of people who write about mental models are making a mistake in their reasoning: yes, successful practitioners succeed in part due to their mental models. But no, you can't learn their mental models from reading.

My belief is coloured by experience: while I was reading FS, I was building up a small company in Singapore, eventually hitting $4.5 million in revenue with a team of 30 by the end of three years (I managed the engineering side of things). I was struck by how little FS touched on the mental models I had to learn, and what I found useful. And then I realised that the mental models I had were really, really difficult to articulate.

I've since concluded three things:

1. The mental models that matter are tacit in nature (as opposed to explicit). You can't communicate tacit knowledge, in the same way that you can't describe how to ride a bike — you just know. I think that successful practitioners have superior tacit mental models. A good software engineer, for instance, may try to communicate what good code looks like, and what the principles of software design are, but in practice they just feel disgust when they look at bad code, and feel awe, or happiness, when they see beautiful abstractions. https://en.wikipedia.org/wiki/Tacit_knowledge

2. Humans learn by constructing knowledge from what they already know. (See: Seymour Papert). This implies that if you are not a practitioner, you cannot possibly communicate tacit knowledge, because you do not have a base of experience to build on.

3. Written mental models are useful only as guard-rails for practice. This is why Ray Dalio's Principles was so intriguing to me — here was a top level practitioner taking the time in his retirement to codify his tacit knowledge. That's incredibly rare. And it's still really hard to use — tacit knowledge is by definition extremely difficult to codify.

Like many here, I found FS's writing to be amazing when I first subscribed three years ago. It's gone rapidly downhill since; for a long time I thought I was the only one to think that. I'm slightly encouraged to see that I'm not the only one who thinks so.

I get it, the guy has to feed his family. But I do pine for the original FS, where he went deep into a few topics and worked out the secondary or tertiary implications of each mental model he describes.

[1] https://commoncog.com/blog/the-mental-model-fallacy/
In this context, it means that content from this service is shared with other servers. This is different from decentralized - in a decentralized network, every client communicates directly with other clients, whereas in a federated network, clients communicate with central servers but the servers can interoperate . Email is a good example of a federated network - mail clients communicate with centralized mail servers, but mail servers can send messages to other mail servers. To extend that analogy, when you write an article on Write.as your browser sends that data to the Write.as server, but the server federates that data to various other servers - Mastodon instances, Pleroma instances, etc. This is what enables Mastodon et. al users to like, follow, and share content posted to Write.as.
> Universal Plug-n-Play

And, like so many other attempts to "simplify" supposedly complex configuration, in addition to being a massive security hole to attackers, it's almost useless to the home users for whom it was meant because it only works under a very narrow, mostly undocumented set of assumptions and if any of those assumptions are invalid, it fails silently.
Coming from a background of using emacs & vi, I actually feel the exact same way about Eclipse, IntelliJ, Atom, SublimeText & all the like. It's odd to me to have such painful extensibility & so few tools to let me actually automate tasks, and so many layers of complexity to get in my way.

I feel that engineers who don't try out emacs & vi really are missing out on some amazingly powerful tooling (more so emacs than vi — but vi lives within a Unix shell in much the same way that emacs's text-editing capabilities live within emacs-the-OS).
Comcast has functionality where they will email and/or text you if your connection has botnet or other nefarious activity on it and will disconnect you until it's resolved. Not a fan of them, but it's something they get right.

https://i.imgur.com/cYKXtII.png
You need to separate the R & D. The research is unknown and you can't estimate. The development is known, and if you can use prior experience to estimate.

Give estimates in DURATION never as a date. Treat it as a stop watch, anytime interruption happens, the stop watch stops. So 2 weeks can actually take 6 actual weeks. If there's no research and interruption, then you should be able to give a +/- 10% estimate.
I've freelanced successfully for a few years and never really had to explicitly network to get clients. They all came from my existing professional network (built up over a 10+ year career in traditional employment). I know that's not possible for everyone and I didn't come here to say just that.

Lately I've been focusing more on bootstrapping a startup and using freelancing as a part-time way to pay the bills, so time to go out and find jobs has been less. Fortunately, I was able to connect with another freelancer who is great at networking and often lands more jobs than he can handle. He then sends work my way. I charge my usual hourly rate and I suspect he's quoting these clients with project-based billing and in some cases making a tidy profit. I'm absolutely fine with this - he takes the risk, communication overhead, blame if stuff hits the fan, and I get some steady side-income where I essentially report to another developer who is an understanding person.

Perhaps if you're an introvert, seek out an extrovert freelancer that could use some extra bandwidth.
Facebook.com was definitely down for me for several minutes at least.
Amazon Ion Schema Kotlin (alpha) Open Sourced
This was always tough for me. Pick a couple of industry meetups in your area and suck it up and go every week. I found that just showing up was enough, once I was there I'd naturally make enough contacts to eventually get some work flowing.
Howard Chu – LMDB [The Databaseology Lectures – CMU Fall 2015]
That's a pretty arbitrary exception especially when Apple wants us to believe that iPads have made "computers" obsolete.
That was my point, I could have made it clearer.
For those interested, Ball Aerospace has a similar open source tool called COSMOS written in Ruby. It has been used for a number of missions there as well as some CubeSats:

https://cosmosrb.com/
Incredible work. And isn't it impressive how quickly progress is being made in this research area (disregarding, of course, some of the ethical issues it may present in the future)?

The most amazing results (to my eye, anyway) come from the sketch-like source styles, where various squiggles are redrawn on every frame, similar to the Plumpton style.

In the other source styles, it seems like the brush strokes are largely preserved across frames, even though they're repositioned with facial movement. But I think it would be really cool to see things repainted in a more fundamental way, possibly using varying colors, brush widths, stroke directions, etc. Basically what you would expect if each frame were repainted by hand.
Not totally related to the question, but the company I work for (Fortune 10) was going through its annual round of entertaining prospective interns and my department, relating to the biggest of Big Data, was trying to attract a few of them to apply here. Out of 50 prospects, not a single person applied. They all want to do the perceived "sexy" work, I guess.

What irks me is that our group is thin on really talented developers and yet the problems are all first class, requiring highly marketable skills and technologies. No takers for real work, though.
If I have UPnP disabled, am I safe?
Fair enough. It sounds a lot larger than I'd expected from your original post.

I wish you the best of luck.
They Were Stopped at the Texas Border. Their Nightmare Had Only Just Begun
The real problem isn't whether they are easy or hard to pass, it's that they're easy but people believe that they're hard.
To be sure though; It is still quite a superfluous software product that is a more complex version of Google forms. The key is to be able to sell to enterprises with a shiny veneer.

EDIT: And that SAP is not buying the software per se. They're buying the customers and credibility.
As of this morning, I am still unable to reliably start my docker+machine autoscaling instances. In all cases the error is "Error: The zone <my project> does not have enough resources available to fulfill the request"

An instance in us-central1-a has refused to start since last Thursday or Friday.

I created a new instance in us-west2-c, which worked briefly but began to fail midday Friday, and kept failing through the weekend.

On Saturday I created yet another clone in northamerica-northeast1-b. That worked Saturday and Sunday, but this morning, it is failing to start. Fortunately my us-west2-c instance has begun to work again, but I'm having doubts about continuing to use GCE as we scale up.

And yet, the status page says all services are available.

Is the typical of others' experiences?
Is there any easy way to check if your router is vulnerable/compromised? Or instructions for disinfecting it as well as patching it?

Like, based on actually being exploitable or compromised, not firmware versions or whatever.

I actually suspect mine is compromised, it's been behaving funny for a month or two, needing to be restarted a lot. (Which, ironically, is a signal of a _buggy_ compromise, your router of course be compromised and you'd never know it if the malware was well-behaved enough to stay out of the way of your usual use).

I can (painfully) update the firmware... but I don't trust that the vendor's most recent firmware actually solves it. Nor do I trust that once compromised a firmware update is enough to eliminate the malware.

For such a widespread compromise... we could use more user-friendly (or even relatively techy but not a network engineer user-friendly) instructions for... what to do.

I guess the reality is that most (non-techy) users will, if they notice at all (due to malware that buggily causes things not to work well for intended uses, instead of staying out of the way), will just decide their equipment is "broken", throw it out and buy new stuff... that hopefully won't get compromised again. Which I guess works for the consumer network harder vendors.
You have EU funds to help bootstrap your company, either directly or via subsiding the institution which is funding you (even if it can be harmful), cheap or even free medical services for when you're getting sick and you don't have any insurance since you've put all your money in your startup. Allowing people to come to work for you without having to handle the visa nightmare means you're not giving them insanely hight amounts of money every months. Price for incorporation is <1000$ in almost every EU country. Your employees don't have to pay taxes on stocks they haven't sold yet. There are some upsides too.
Love the "treat it as a stopwatch" idea; do you do anything specific to convey that to the customer? Even if you avoid and "end date", I assume they'll infer it from the start time and duration, and consider that internally.

Do you have any experience/advice for R&D estimates? This is something I struggle with alot. We try to bill per _project_ rather than per _hour_, but I'm thinking R&D perhaps necessitates hourly billing, which sucks.
The real story here is that the business of large corporations, from 7-11 to Uber, is to outsource all their legal, financial, and safety risk, while keeping the profits. 7-11 regulates every aspect of a franchise business, and takes a large fee, but if the franchise breaks any law, 7-11 takes no responsibility. Imagine if every company ran that way, sending rank-and-file employees to jail, while management and limited-liability owners face no criminal or civil penalties because they "didn't know" their profits came from illegal activity. Or they didn't have to pay worker's comp for employees injured on the job. Or employees had to pay for all their supplies.
I love reading the postmortems. I've read some from a few different tech sites and it's fascinating to hear just how people are doing things and how they fixed it.
I saw this work when you published it. It looks really impressive! Have you continued to work on it? Theano is no longer being developed, so I guess you'd have to switch to something else. What are the next directions to take for this approach?
That guy hit the lottery at the height of the tech boom and has done nothing since...
It's down for a lot. Seems to primarily be NE US: https://downdetector.com/status/facebook/map/
> The pie has absolutely grown, corporations have just chosen to keep more of it.

Then the pie has not grown. You're simply advocating throwing more people on an already broken system.

> Wasn't your entire point that we are just hiring immigrants to do this work instead of building robots (your Wisconsin dairy example)?

My argument is that automation should be prioritized over subjugating illegal immigrants who have no recourse. Dairy farmers cannot afford to pay a legal wage, therefore automation is their only option if ICE shows up and prevents them from hiring illegal immigrants (the fact that the dairy industry is hideously broken and needs to shrink dramatically is a topic for another thread). I am pro-immigration when properly implemented, but staunchly anti-abuse of all people.
That sounds like something out of an black mirror episode...

Where an unprivileged worker class has to go through hours and hours of video material of the upper societal levels in order to make sure that they satisfy the grotesque utopian "always happy no conflict" image of an all seeing censor, including the denial of their own existence.
AFAIK, It requires Google play services, which is a deal breaker.
Revolting against monarchy to establish democracy is not a 'democratic revolution', that is a term used to describe a revolution that occurs within a democracy. The American civil war might qualify, but none of the rest of your examples come close.
Simple Safe Sandboxed Extensible Expression Evaluator for Python
Token Security: Blend talks rapid deployment in secure environments [podcast]
I made the assumption that anyone reading this would be or know at least one IT person.

To the other questions, nobody will beat Facebook at convenience and availability. Any self-hosted solution loses out of the gate if those are the criteria. But if you see using Facebook as making a deal with the devil, maybe you're willing to put up with some downtime and inconvenience to avoid the alternative.

Giving up some convenience is pretty much the tradeoff for any security-conscious decision. TOR will always be slower than a direct connection, but you get anonymity (as long as you use it smartly).
RLE is probably fine too. Easy to do set operations on RLE data structures without "decompressing" them too. Quite a bit simpler than BSP trees for most people I think :-).
I believe only a small niche of IT projects can qualify for "accurate" estimates, and that is tasks such as install Wordpress, swap image, etc, although even in these isolated cases there might still be factors that could easily throw you off with the estimate.

For real software development, where you develop a solution to a business problem, estimates are worthless. The thing is, solutions to business problems are very specific, which means you need to think it through from scratch starting with the idea, and ending with the implementation which is a large terrain where many things can go wrong.

If you're still required to make an estimate for the sake of having one, I recommend going with a range. Think of pessimistic and optimistic scenarios. Make sure to add a generous buffer to both ends, to account for the unknown issues that are guaranteed to appear. Also, add in the disclaimer that this is a rough estimate and that the final time requirements might differ. This kind of works for hourly/open contracts.

For fixed price contracts I'd say think of an amount that YOU feel comfortable with. Better to exaggerate than feel sorry. Remember, you have the solution, the client has the money.

I go by these rules, and I'm quite happy.
I'm curious: are there any supporters of the copyright regulations around HN that can provide some thoughts on the "pro" side of this? I'm trying to get my head around both sides of the argument, and I just can't see why it might be a good idea - but I may be biased by the strong "against" views from HN posters.
Xiaomi criticised for UK smartphone £1 flash sale
Or maybe the people who run these companies could treat their workers better. Just a crazy thought!
That's a very beautiful, though ultimately sad, story. It inspired me to read Endurance which is just an amazing tale. Part of me does wonder if we over valorize these tales of suffering though. Is it worth all the death, injuries, and years separated from families?
Inside Bill Browder’s War Against Putin
Back up for me.

Facebook makes ~$105k in revenue per minute [1]. Since the outage was seemingly only US-based, and it lasted ~30 minutes, this outage probably cost them just over a million bucks.

Pretty staggering to think about.

[1]: https://ycharts.com/companies/FB/revenues
Samsung’s foldable phone is real, and it launches next year
As of this morning, I am still unable to reliably start my docker+machine autoscaling instances. In all cases the error is "Error: The zone <my project> does not have enough resources available to fulfill the request"
An instance in us-central1-a has refused to start since last Thursday or Friday.

I created a new instance in us-west2-c, which worked briefly but began to fail midday Friday, and kept failing through the weekend.

On Saturday I created yet another clone in northamerica-northeast1-b. That worked Saturday and Sunday, but this morning, it is failing to start. Fortunately my us-west2-c instance has begun to work again, but I'm having doubts about continuing to use GCE as we scale up.

And yet, the status page says all services are available.
The Personalized Web
Well, yeah. But it's still a snowflake, a dev environment with build/deployment configuration and needs that are significantly different from production cloud environments. And it requires a lot of setup, and a lot of knowledge to do it well (which I actually have). Writing a bunch of automation to hide the fact that I'm working on a snowflake is not the same as not working on a snowflake.

Or, I can do my development in the cloud, in an environment explicitly more similar than my desktop environment. Other than aesthetics, I don't see why this is a Bad Thing. It's making my setup easier and more consistent, and it's making my development environment portable to whatever system I want to work from, rather than binding it to a piece of hardware.
They use it to ferret out untrustworthy people at government contractors. This catches some moles.

The real problem is when this hocus pocus enters the legal system and people get convicted based on examiner testimony or face the presumed guilt applied to anyone who refuses a polygraph.
A Xerox machine is a complicated, specialist piece of equipment but using one to duplicate the work of someone else is not and should not allow copyright on the duplicate.

What your colleagues did is literally reproduce the work of another, and assert copyright on the copy.

What if I took the image your gallery took, used state of the art JPEG compression software on it and created a new optimized file, would I know be entitled to copyright on that?
My semi-dormant website: https://www.outagereports.net/

I started compiling a bunch of outage reports from around the web. I have another bunch stored in Pocket that I need to add.
There have been plenty of successful boycotts and news exposes in the past to get companies to deal with various issues and they seem to have worked.

If you want the depressing version what will more likely happen is all those workers will be replaced by robots and they'll be forced back to their previous far worse conditions
A competing factory is using really hardcore AI to coerce people to do this kind of thing. Some people can see through worlds. I spotted this as soon as this made the front-page.
It depends?

For high-caliber projects (ie: some kind of engineering, regulated, or mission-critical software) I'll go with the ISO standard processes for software requirements gathering and estimation.

For SME-level businesses it depends on whether it's a new project or changing requirements to an existing one.

In the first case I'll do some light-weight analysis using event storming to map out the problem/process the users are facing/using. This will give me an idea of the scope of the problem domain (ie: how big is the problem?). This gives me enough information to make a Scientific Wild Ass Guess. I can only estimate at the granularity of weeks/months at this point.

Typically project estimates will be refined as the project moves along in increments.

In the latter case I have more information at the start. I can give estimates in three intervals: optimal, realistic, pessimistic. I include a confidence ratio in those interval estimates. The intervals reflect my understanding of the scope of the change and how much work it may end up being. The ratio represents my understanding of what I know to be true: if there are a lot of unknowns then my confidence in my estimate isn't high.

This lets my stakeholders estimate what they think the likely outcome will be and determine what they'd be comfortable with.

And I always make sure, regardless of which approach is used, that no estimate is a binding promise or commitment. It's a forecast of a possible outcome. My teams and I are still able to take on release deadlines and ship dates but I work those out separately from the estimate: how to ship releases and schedule them is team and industry dependent... but that's how I estimate things in general.
Exactly as 3JPLW mentioned, government agencies value the polygraph as an aid to interrogation. Naïve and gullible persons, be they applicants for government jobs, criminal suspects, or criminals released on probation or parole, will sometimes make admissions that they might not otherwise make, because the fear that the polygraph can read their mind convinces them that their best choice is to confess.

But the polygraph can only have such utility so long as the general public believes that it can detect lies. We're at the point now that applicants for public jobs who face polygraph screening are often being specifically instructed not to research polygraphy.
I disagree; hourly rates are an invitation to get bullied by the customer. I much prefer setting a project cost, and informing client we can negotiate _scope_ but not _cost_. (roughly parroting patio11 here).

This is in many ways _harder_, though. Hard to estimate time required (supply-side), hard to estimate value to customer (demand-side).

As a service provider, "overcharging the customer for hours of work that may not occur" is effectively sidestepped by project-based billing. You're providing a product of value to them, not a number of hours of labor. Hourly rates are best left as an internal estimator of cost-to-supply-the-thing, and nothing else.