skysight-inc/HackerNews huggingface dataset:
Whatever will replace SSNs will be a piece of technology. Ideally, something that uses public/private key encryption.

There's a lot of things that use public/private keys however, or security tokens, or whatnot. Should it be a smartphone app? A hardware dongle? Etc. etc. If a hardware dongle, which one?

As such, its the Executive Branch's job to research the various technologies, and implement a new standard to solve the online identity problem.

----------

For example, 18f (White House's crack website team) has the following: https://login.gov/

Github code here:
https://github.com/18F/identity-idp

If single-sign on were widely deployed across US Agencies (and tied to financial services / private sector banks), we'd be in a way better place.

In any case, this is clearly the realm of the Executive Branch. Specifically 18f probably should continue to lead the effort, as they have been.
In typical PHP applications, the entire application is bootstraped, executed and teared down for every request.

RoadRunner lets you run "workers" (php processes) that perform all the bootstrapping just once, and then receive-process-reply to requests. The use case is to avoid the (possibly expensive, especially with modern frameworks) bootstrapping for every request.

Check the symfony integration example for instance [1]. Everything that's outside of the

while ($req = $psr7->acceptRequest()) {
...
}

is usually run for every request in traditional PHP, whereas here it is only run once when initializing the worker and then that while block reads/executes/replies to each specific request.

The problem with this approach is that you now need to be careful not to leave unwanted stuff behind (open files / db connections, static $properties, etc.) that may interfere with future requests, whereas this just isn't possible in "normal" PHP. I would argue that this is one of the features that makes PHP so beginner-friendly.

[1] https://github.com/spiral/roadrunner/wiki/Symfony-Framework
There is so much to comment on and digest in this report, but the lifecycle of an attack diagram[1] on page 31 (figure 164) is something every software developer should burn in to memory.

It is easy to fall in the trap of seeing the most miniscule of vulnerabilities and dismissing it as "no one could ever possibly utilize that as a vector, it's not critical."

But that miniscule vulnerability becomes a single link in a ladder to everything in the system. Every seemingly-small vulnerability matters, like this painfully shows.

[1] referenced here: https://blog.hellobloom.io/how-hard-was-the-equifax-hack-a3b...
If you start with the accounting assumptions that work on security is a cost, and storing of private data is not a liability then all the actions are rational within the narrow scope of profit optimization. (I'm not in agreement of this, but it seems to be true). Equifax holds these assumptions even more strongly because their fundamental existence is founded on monetization of private data.
ML in the hands of an individual with relevant educational credentials (e.g. statistics, science) is legit.
I totally agree. I actually find the "X has an agenda argument" misleading at best in that person stating it is implying that they don't have their own, or that their own agenda is beyond reproach.
All the Airplay tutorials I've seen are about being a receiver for Airplay signals from something like an iPhone. These boxes then plug into speakers for output.

Does anyone know if there are tutorials on making an Airplay client that instead sends audio & video to a receiver of some type (e.g. Apple TV)?
Twitter Shows Why Silicon Valley can’t be trusted to run the world
My family got a parrot 22 years ago when I was a kid. It's a bit depressing to think that if we had gotten a dog or a cat, it would have been long dead by now.
PR firms don't write articles for legit journalists and they certainly don't pay staff journalists at the reputable publications to write them (not without disclosing them as sponsored content). At most journalist publications sponsored content is handled by an entirely different group (not the editorial team). And journalists get really annoyed if they feel like a company or PR firm is trying to tell them what to write.

A PR firm will help find a story, write a pitch, and package up the details to make the reporter's life easier (studies, data, contact info, etc). They might help with things like vetting the subject or coordinating scheduling for an interview, etc. In this case, even the photos were taken by a staff photographer for the SF Chronicle.

Is the company going to pitch a story on how many ER doctors their scooters are keeping employed because customers injure themselves? Probably not. But it's not their job to and it's certainly not unethical to pitch a positive human interest story.

Anyone can pitch a journalist. That's frequently how they find stories. And it helps if you include information that will make writing about it easier.
This is the first time I'd heard anything about expired certs, too.

It's absolutely ridiculous that any kind of a security team -- not to mention one that's supposedly safeguarding such an immense amount of data -- could let monitoring certificates expire at all. It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end.

I've worked in security for my whole career, and I'm firmly of the optimistic belief that someday, far fewer security-minded people will be needed to keep organizations secure. This is an excellent counterpoint to my argument, though: even the people who supposedly specialize in keeping things secure can apparently be absolutely clueless.
I'm not finding the pages I remember -- a bit ironic, and I checked DuckDuckGo to see whether that might change any... bias. But, here are a couple of starting points:

--

"6 common misconceptions when doing advanced Google Searching"

http://musingsaboutlibrarianship.blogspot.com/2015/10/6-comm...

(Blogger "Javascript era/template workaround):

https://archive.is/7t28O

I wasn't aware of some of the tips described there, but still not parity.

--

The + operator has been replaced. (google.com)

261 points by hammock on Oct 21, 2011 | hide | past | web | favorite | 167 comments

https://news.ycombinator.com/item?id=3140797
Engineer pay hasn't kept up with productivity gains, inflation and increases in cost of living expenses.

The fact is that engineers create an increasing amount of value, and their compensation hasn't increased sufficiently to reflect that.

In fact, Adobe, Apple, Google, Intel, Intuit, Pixar and eBay were found guilty of colluding to keep engineer pay artificially low through anti-poaching agreements[1].

[1] Apple, Google, Intel, Adobe will pay $415 million in anti-poach deal - http://fortune.com/2015/09/03/koh-anti-poach-order/
I use these and they're great!!

https://www.amazon.com/Rave-High-Fidelity-Ear-Plugs/dp/B078M...
>I don't think there's any reason to vilify agricultural businesses in particular for being profit-seeking capitalist corporations.

It's not about the line of business. It's about disingenuously gussying up the marketing around their own profit maximization by pretending they're being humanitarian. Sort of like "Greenwashing."

Everyone does it, but so many people depend on subsistence farming that it comes across as especially crass. Sure they're not alone, but there is plenty of scorn to go around for bottling companies taking up all the ground water, Pharma companies abusing IP law to fleece sick people, etc. There's no reason to be stingy.
My guess is that they were using private certificates to read encrypted data, without which they couldn't inspect their traffic.
ML is great if you already have scale, data quality, and problem sets that match ML approaches.

But often the bulk of the work is getting or cleaning data to make ML work in the first place. And even after that, the results need to be better or cheaper than having an employee personally look at the same data sometimes (i.e. a low tech expert system).

If you have a thousand emails and you want an emotion score assigned to the contents, it's often cheaper to use temp workers or something like Mechanical Turk.

It's also worth noting that many interesting automation tasks don't have room for 99% confidence intervals. It's fine if Google flips it's search result rankings rarely. It's not OK to only miscalculate 1% of account balances. And predicting which balances are bad might be useful, but the bulk of the work is the boring enterprise work of getting the concerns in front of a human or something.

That's why ML seems like a solution in search of a problem. Unless your problem is getting people to click on ads.
Well, they don't fit in a virtualization and containerization environment, and therefore Unix might be considered dead for networked servers. That's not the only environment Unix was used for, though...
Popular prostate cancer videos on YouTube 'inaccurate and biased'
Sure. So simply asking who their auditor is and what the custody arrangements are will tell you a lot. Hedge Funds and other asset managers use a relatively small number of accountants to do their auditing. Madoff used a small family accountancy.

https://en.wikipedia.org/wiki/David_G._Friehling

This is not to excuse the SEC or let them off the hook. The SEC proved to be ultimately grossly incompetent at best, if not negligent or actually complicit. Investors should no more rely on the SEC to protect them than the hens should rely on the fox to protect the henhouse. This has been demonstrated repeatedly.

https://www.barrons.com/articles/when-chinese-stock-fraud-wa...
https://www.wsj.com/articles/SB123577641445497313

Finally there is a statute of limitations when clawing back money that people received. I believe in Madoff's case it was two years. Additionally there were a number of lawsuits against a subset of investors that allegedly new about the scheme and profited from it.

https://www.reuters.com/article/us-madoff-trustee-opinion/ju...
Quake was again a technological tour-de-force, and its moddability and multiplayer opened up a whole new world of gaming, but as a single-player game I find it strictly inferior to the original DOOM.
I suppose these guys have it figured out since their product supports the HomePod?

https://www.rogueamoeba.com/airfoil/
Every single part of the economic system is organized into industry groups, lobbying groups, industry associations and everyone thinks its perfectly natural for them to group together to promote and push their collective interest. No individualism there. Google, Facebook, Twitter and others are part of multiple such industry associations and lobbying groups.

But curiously when it comes to labor suddenly collective action becomes anathema? This is not logical. Isn't it high time anti-union propaganda and demonizing unions on the flawed logic of 'bad unions make all unions bad' ie some banks are corrupt so banking as a concept is bad is jettisoned for informed discussion.

The key word in this case is 'forced'. If you prefer company managed arbitration then you should be able to 'choose' it. Similarly those who see it as fundamentally flawed should have the freedom to choose due process in a court of law as is the right of every citizen.
> a laser with a gigawatt of power (approximately the output of a large nuclear plant) would provide only a few newtons of thrust.

wow... that's not very efficient...
I believe they're saying the interface was bad, not that the concept was hard. Friend lists are used all the time on Facebook.
Greetings, Computer Overlords
I am in full support.
"union bureaucracy" is mostly just anti-union propaganda, unions are no more bureaucratic than the corporations they live in, the difference is they are typically democratic organizations. You have little to no control over the bureaucracy of the company you work for as an ordinary worker. In a union you can.
>No it is not. I personally care about people being able to do what they want with their free time.

Just tranq them all with a guaranteed supply of opiates then. Problem solved.

People's needs and wants are socially conditioned. It's not like their "wants" just sprang out of thin air. They were created by the culture and social expectations around them. And many of those social expectations make people feel obligated to feel useful.

That means they need to be provided with avenues where they can feel useful instead of doping themselves with addictions to fill the sense of purposeless anomie that they fall into when alienated from public life. Make work programs, like urban forestry or gardening, are good ways to do this as they beautify the spaces where we live and are unlikely to be done adequately without some societal coordination.
That's a very revisionist view of their development taking into account that the Daikatana/Ion Storm debacle never would have come about if it wasn't for DooM.
Pichai's written testimony [PDF]: https://judiciary.house.gov/wp-content/uploads/2018/11/Picha...
Expo is excellent for developing in RN. The best thing is being able to send the app to other users without needing to install anything outside of the expo app. I just started digging into flutter last week so I don’t have a an opinion yet.
Have you tried looking for a job at UX agencies? They usually have a focus and are pretty small.
Spitballing here based on my experience in the field but without any specific knowledge about Equifax's situation:

Their monitoring system might have been using TLS to communicate the events to their aggregation tool, and when the cert expired, you don't really want log data with potentially confidential/critical security information traversing insecure channels, so they may have had it configured to not send any data if the cert wasn't valid.

As for warnings about the cert, it's possible they (stupidly) configured it to not send warnings, or maybe it was sending warnings but nobody was paying attention. I've seen situations before where such warnings were set to go to XYZ person's mailbox, but XYZ person leaves the company and nobody remembered to update the destination address for the alerts.
(speculation) It could be that the expired certs were on the ingestion side. The monitoring agents tried to report something to the central place, but failed due to expired cert on the TLS connection. No other monitoring picked up that new data is not incoming.
Another famous example:

https://en.wikipedia.org/wiki/Siege_of_Masada#Roman_siege

The Romans seemed to have been particularly fond of this technique.
What are Chinese mobile transaction costs/rates like?
Google CEO Pichai's Remarks to Congress
I don't think the leap to visual programming is necessary considering we have tools like make that work essentially identically and remain text based. All this is really doing is moving the dependency declaration to lines instead of words and this would get very messy very quickly.

An example in make (if I'm reading in the right direction) format which I'd argue is more readable and could scale much better would be:

doA: doC doE
doB: doD doE
doC: doE
doD:
doE
Yes, we have this problem. Why would it be better by adding other lobbyists into the mix?
I think the definition of viable depends a lot on how you started the business. For a bootstrapper the definition is totally different than if you have taken millions (or tens or hundreds of millions) in VC money. In general, VCs not only aren't interested in small-but-steady earners, they will be happy to destroy one if they think it gets them a chance at a big payout.
Reading this, I was unaware that nanovms.com is a website trying to sell me cloud services and not simply some blogging service.

As a spoiler to any who came here first: the post ends with an advertisement for what the author wants to sell you.
I am impressed that these employees are able to talk about this stuff and not get managed out of the company.

Me too. I expect some people to be fired, but in some subtle way. "One out, all out". (Few today know what that means. Find out.)

If you want to see an effective union of creative and technical employees, see The Animation Guild, IATSE Local 839.[1] They represent the major studio animators and some CGI people in Hollywood. They have about 2500 members.

A big advantage of being represented by IATSE is "crunch time = big overtime pay". Films do have scheduling crunches, and they come out of the production budget and the producer's cut. This is why film scheduling is a real thing and software scheduling is a joke.

[1] https://animationguild.org/
The majority party of the Virginia House of Delegates was decided not by one vote but by a coin flip because the vote was tied.

This happened last year. It was all over the news: https://www.washingtonpost.com/local/virginia-politics/court...
The exfiltration attempt would have likely been triggered on volume alone. Possibly it was simply a service that could not longer connect due to a lapsed cert trying to raise the alarm.
Do we actually know where they end up? Is it possible to make a reliable calculation on their trajectory in let's say 50.000 years? Do they get locked in a next solar system or will they continuesly be catapulted between systems?
They are not solar powered right? So they won't be powered up again when reaching a next star (assuming all electronics are still alive)
Exactly. All that is on Amazon, not those fighting for a living wage.
Detecting data exfiltration has always seemed like an impossible problem to me. The implication is that "infiltration" has already occurred, and now the attacker just has to read/send the sensitive data somewhere. But if they have enough control to tell some system to dump its contents somewhere, how could they not have enough control to obfuscate the data itself?

It seems like these systems could only work by either using some heuristic like data volume to decide when something is being "exfiltrated", which isn't nearly as useful, or by whitelisting allowed communications, which seems absurd.

What am I missing?
Many unions in the US are not multi-organization groups. A lot of folks unionize their co-workers without collaborating with, or joining, a trade or national union.

I like it this way better because it gives you the ability to have more control over the organization as a normal worker. All that scary "union dues going to big bad bosses" rhetoric goes out the window when you know the union leadership as your co-workers.
The point is that Wolfenstein 3D did not have "angled walls and halls that darken in the distance". Ultima Underworld did, although it did not have level geometry as complex as DOOM did.
The legislative solution would be to mandate a national ID with a cryptographic token, and then leave it up to the executive to define the implementation.

Right now, even if they wanted to, the executive can't force a national ID.
And let’s not forget one of my “favorites”: ads before the content. Sure, for now it’s mostly just promos for their other shows, and it’s generally skippable, but that’s how it starts. They ease you into it, like boiling a frog.

HBO and AMC, I’m looking at you. You have, like, two or three shows worth watching at any given time of the year. I don’t need to be reminded about them every damn time I watch an episode.

And, FYI, when I’m binging some dark-ass drama series, nothing kills the feeling of immersion like a loud-ass promo for some upbeat sitcom between episodes.
Absolutely UK unions are like lawyers in this regard you represent the member even if you know they will be found guilty, to make sure their rights are protected and more importantly to "keep the company honest" as one senior manager said to me once.

I suspect that Mr Danmore (x googler) did not get fired fairly as google did not I suspect follow its internal procedures to the letter.
Looking for feedback on a server-less GraphQL strategy
Ask HN: What things can you teach to a 3 year old?
Kubernetes (and other orchestration platforms, though my money is strongly on k8s) is the new unix. We're missing some bits - A shared filesystem is not there yet - But most of the layers look very similar.
I'm...pretty sure unions would end up being heavily anti open source.

"I'm sorry, the union is opposed to postgres. You can either roll your own DB or use Oracle. Oh, and you're not allowed to store more than half a million rows without a Union Approved database administrator."
> It's almost inconceivable that they could let seventy nine certificates that are required for security monitoring expire for months on-end.

Even worse, the "seventy nine" figure was just the certs that were associated with "critical" systems. The total number of expired certs was at least 324.

> At the time of the breach, however, Equifax had allowed at least 324 of its SSL certificates to
expire. Seventy-nine of the expired certificates were for devices monitoring highly business
critical domains.

(from pg 70 of the report)
Then you could change your employer. Outside of right-to-work states, you may have to change your entire field of employment in order to work in a non-unionized job.
This was my thought. The article is cloud-focused, but the headline implies a broader (and obviously false) assertion. I wouldn't even say Unix is dead for networked servers -- that's still too broad.

Perhaps Unix in a hyperscaled environment is "dead", but Unix generally? Not even close.
Although this article highlights soldiers as building barriers, the majority of base construction on the modern battlefield is done by contractors.

This article from 2013 is, well, "interesting" to put it lightly: https://www.motherjones.com/politics/2013/05/contractors-385...

A company controlled by Dick Cheney made the most money in the Iraq & Afghanistan wars. It's probable that those wars would have been logistically impossible otherwise, considering how many contracts they held and how vital a role they played.

Someone said that control of a superior supply chain wins wars [or at least, delays their resolution]. But private contractors, not the US Military, control the supply chain. They supply virtually every aspect of the temporary-cities that are U.S. wartime bases. Without them, we can't have these wars. And the people who run them work in the highest levels of government. It's less conspiracy theory than blatant war profiteering.

I think this brings up two interesting points. (1) If you control the corporations that profit, and you influence the government's war policy as well as budget, you can create wars for profit. Would we even have these wars if contractors weren't involved? And (2), if the contracting companies "went away" tomorrow, would we still have the military might we imagine we have?
A small suggestion.

Since Jupyter Notebook can be used for both programming and documentation, why don't you use Jupyter Notebook itself as the source of your document?

It is actually very easy to setup a Jupyter Notebook driven .ipynb -> .html publishing pipeline with github + a local Jupyter instance

Here is a toy example (for my own github page)

https://ontouchstart.github.io/

https://github.com/ontouchstart/ontouchstart.github.io

The convert script is here (also a Jupyter Notebook)

https://github.com/ontouchstart/ontouchstart.github.io/blob/...

You got the ideas.
Waymo tests AI driving system that learns from labeled data
Basically efficiency isn't the chief concern. If you really have a bunch of people with nothing better to do with their time (e.g. Fortnite), then we don't really need to care about allocating labor as efficiently as possible to maximize yield.

We can use labor in a very inefficient (where yield is concerned) way if we think it will confer ecological, aesthetic, or sociological side-benefits, as would having lots of private gardens.

Fortnite is just an example of something people fall into doing when they don't have any other productive opportunities available to them.