skysight-inc/HackerNews huggingface dataset:
> Implementation is best left to cryptographers.

You suggest we hire a cryptographer every time we need something secured?

I mean, come on, this is ridiculous. The code quoted does not implement encryption, it invokes encryption. The AES algorithm being invoked, I expect, was written by proper cryptographers.

The reason this code is insecure is that the API is a piece of shit.

Most standard crypto modules have calls of the form

encrypt(algorithmName, arg, arg)

Depending on the algorithm chosen totally different parameters need to be passed or else. Or else what? Or else the function works perfectly well, produces an encrypted byte array, but with totally broken security. The programmer will be none the wiser except if they were lucky enough to post the code somewhere on HN and someone writes a condescending comment.

This is shit design and we can blame the cryptographers. It doesn't have to be this way.

Some languages and libraries get it right, here and there. Eg PHP doesn't just expose a way to call bcrypt, but also has two functions password_hash and password_hash_verify. These implement all the best practices, with seeds, the right algorithm parameters, keeping the ability to rehash in the future, etc.

We need similar APIs for symmetric and asymmetric encryption, for common use cases, or this madness is simply going to continue. Cryptographers, please get your act together. Job safety is nice, but a secure internet is nicer. Please make it easy for morons like me to use crypto right.

I mean, I don't even know what the different considerations are so I can't design these functions right, so please consider the spirit of the following proposal and not the details.

What about a function like encrypt_symmetric_for_single_user(payload, userid, key) which takes care of picking the right algorithm, doing the right dance with keys and nonces and whatnot? Or maybe functions need to include naming like encrypt_for_sending_once and encrypt_for_storing_long? My understanding is that you want different crypto in such cases, right? I'm sure better cryptographers than me can immediately see what I'm doing wrong here, but you catch the gist right? Why can't this be made easier? Why do we at the same time, collectively, shame everyone who gets security wrong and make it so unnecessarily hard for people to get right?
How much of people being able to get out of burning buildings is due to the fire code?

Basically all of it? Is this some kind of trick question? Economic freedom doesn't cause fire-safety.

China advanced only after having less laws

Yet now, China's lawlessness is a drag on advancing. The cost of low-trust in a modern economy is huge.
Ask HN: What is the difference between Burnout/Depression/Laziness/Wrong job?
Burnout gets a fair bit of discussion here on HN, but I'm wondering what the community thinks are the differences between a few subtly different challenges:

1) Burnout

2) Depression

3) Laziness

4) Being in the wrong job

Given that they all have very similar symptoms, how would you determine which one an individual is dealing with?
It’s been there forever. In fact, Apple used to have semi-official documentation on PyObjC at one point.
I mean diagonalizable by a unitary matrix. Fixed.
I'd wager it's because the most relevant results for a search don't become less relevant just because they load more slowly. I certainly don't want that as a user.

Website performance could be a minor tie-breaker between two similarly ranked websites that have the same information (and it probably is), but I don't see how it could be anything more than a weak signal in a search system where the objective is to find the most relevant results.

I'll wait 30 seconds if it means I'm loading the result I'm looking for. That a less relevant website loads in one millisecond is frankly immaterial to me.
GoDaddy: the SourceForge of web hosting.
This is called Wittgensteins Ladder.
How+to+Turn+Hobby+Into+a+Small+Business
The US is the only country that has not signed the UN convention on childrens rights.

Even developing countries ban corporeal punishment.

The US is the outlier.
It seems that from the start the point was to share novelty domains, i.e. letting other people make subdomains off your domain is the point, and the rest of it kind of grew out from there.
I expected something like this to be the top comment. Vox seems to have become something that many people love to hate and in that case I imagine it feels good to take them down a peg. (Please note that this does not preclude the possibility that you are right.)
Vodafone did also inject custom js/html in non HTTPS pages (obviously). This was 2 years ago.
Yes. I don't think bad grades make parents violent. Alcohol does.
On the contrary I love reading this because it's all the shit (and more) I thought the teachers really thought deep down but could never admit openly.
Reactors are not bombs, bombs are not reactors.
Thanks, this is just what I needed :)
I’m pretty sure Frank (the author) had some samples of how to fish out private frameworks. Apple does frown on that a bit, but since they’re usually exposed to the sandbox as read-only, you should be able to do the same.
For weeks I've been trying to find a good, simple explanation of Wittgenstein's Ladder (I'm not the greatest at understanding philosophy). Appreciate this.
I basically use Nim for everything. Of course I am one of the core Devs and creators of many of the frameworks that are available so I'm pretty biased. If you've got some time do give Nim a try :)

You seem to have a lot of experience so I would urge you to write about what you thought of all these frameworks. I'd be interested to read your thoughts on them all.
That report's stated objective does not include diagnosis, just to describe the neurological manifestations of the people involved. Other teams used that report as evidence to make reports, they don't need more direct examination of the patients.
Glad you enjoyed the essays. On LaTeX - I sometimes cut-and-paste screenshots, but usually just write raw LaTeX or pseudo-LaTeX (i.e., something LaTeX-like that wouldn't compile, but is easier to read). It'd be much, much better to use some kind of plugin that turned it into images, but I've been too lazy to try.

This has, incidentally, made many of my matrix-based Anki cards rather ugly. I'll probably update a bunch of answers with cut-and-paste from this essay.

Not to put too fine a point on it, but it's pretty bad I'm using raw LaTeX in this way - I'm sure it hurts my understanding! On the other hand, I've written so much LaTeX over the years that reading it seems really natural.
I second this. You can easily invoke Cocoa classes and swizzle methods with it. My eldest figured out how to snapshot a WebView inside Pythonista that way.
Nice idea. Would you share the template?
A bit late to reply, but today the Norwegian Broadcasting Co. ran a story on how effective average speed cameras were; they are currently deployed 27 places, and overall, the number of deaths and severe injuries is halved compared to the situation prior to average cams being deployed on those same sections of road.

I guess it could be argued that the increased safety of highways is taken into account when the speed limit is determined - and perhaps also that the idea that safety is excel leads people who speed to exceed the posted limit by a larger margin?

Edit: also, the average speed ones perhaps unsurprisingly led more drivers to observe the limit - on average sections, 1 driver in 7000 was caught speeding; single cameras? 1 in 1680.
Sadly, I think they have their ass covered in their TOS, under "User Content Other Than User Submissions": "You hereby grant GoDaddy a worldwide, non-exclusive, royalty-free, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, combine with other works, display, and perform your User Content in connection with this Site, the Services and GoDaddy’s (and GoDaddy’s affiliates’) business(es), including without limitation for promoting and redistributing all or part of this Site in any media formats and through any media channels without restrictions of any kind and without payment or other consideration of any kind, or permission or notification, to you or any third party."

I'll admit I didn't look that closely though.
Agree.

I'm considering a 3310 class device plus a high end pad with a pen (one in the same price range as a reasonable phone) for when my current phone breaks.

(Currently I'm on a Nokia 6.1 AndroidOne and except the camera it is really good and costed literally a fraction of other new phones. Considering the fact that my job pays my phone and it tells something about what I think about current flagship phones and prices.)
I love Michael Nielsen. He's so earnest and thoughtful.

His recent forays into spaced repetition have been an interesting glimpse into his thought process. I am a bit of a spaced rep fanatic, but use it to internalize more general "Mental Models" (a la Farnam Street), useful tidbits e.g. how to horizontally align using flexbox, or surface-level concepts like product management frameworks.

I love the effort Michael puts into grappling with ideas to strengthen his intuition. This is something I'd like to do more of, but feel that few of the ideas in my day-to-day are sufficiently complex (I don't have any use for linear algebra proofs, for example).

Anyways, that's my word salad on Michael Nielsen and spaced repetition.
I found it hilarious that this includes a shower room for the stormtroopers.
You're right that there are few rewards to humility.

An example that immediately comes to mind is during my thesis, I set upon the task of creating a multivariate model to predict an observable quantity. My advisor kept insisting that my goal was NOT to build the model, but to first see that IF the variables had enough predictive power. I just never understood (at the time) what he meant. I went straight ahead and hammered out a robust model, and got a good grade (reward).

The rewards are intrinsic, not extrinsic. Sometimes the rewards can be extrinsic in the long run - if you find and invalidate a hidden assumption and are then able to build a theory/product/business around it. But in the short term, the rewards, and hence motivation, is usually intrinsic at best. Often there are no short term rewards, because you're in a perennial state of discomfiture owning to questioning everything.
> I have µMatrix in my browser, and by default it blocks the AMP CDN.

Maybe an unpopular opinion, but if you're getting a slow load/blank page because you're blocking parts of the content, yeah, "it's just you". Without the fallback mechanism that gets triggered after a few second, you'd just be stuck at the white page.

A good site will load faster than AMP, on a decent connection it may even be comparable to preloaded AMP. However, news sites have been pretty universally horrible at making good web sites. If someone stood behind their web developers and management with a whip, forcing them to build decent web sites and disallowing them from adding bloat, AMP would likely be unnecessary.

Part of the benefits of AMP is the possibility to preload, which allows for near-instant page opening from the search result page (unless you're blocking content, of course), the other part of the benefits is being that whip.

My overall experience with AMP has been positive.
Would the non compete cover supermarket checkout work? That might make up the difference.
Mid last year I also upgraded to a 5X after my trusty Nexus 5 gave up on me (nearly 5 years I used that thing!). Super happy with the 5X.

I'm simply not going to shell out $1000, or some other ridiculous amount of money, for a phone like some iPhone or Pixel thing.
Law student (non-USA) here.

The general contract law principle is: if both parties have signed a contract, it is legally valid. Whether copies are possessed by only one party or both is inconsequential.

Exceptions are if the contract contains language mandating that both parties should receive a copy, or if there are specific laws regulating the form of such contracts.
Thanks for catching that. Unfortunately it’s too late for me to edit my misattributions.
000webhost also had their database leaked with plain text passwords.
I don't agree that "Augmented reality" is the weak form for "Virtual reality". They are two different concepts.

Augmented reality is all about augmenting the real, physical world you live in.

Virtual reality is about stepping into another world that (usually) has nothing to do with your real, physical surroundings.
VPN/https
I launched a print-at-home escape room with an iOS/Android 'game master' app last year:

https://www.escape-team.com

We're at 25K downloads, 4.5 star ratings and it's growing nicely. Groupon sold over 1K mission packs in one week.

Last month, we added user-generated missions, and people use them for education, birthday parties and everything else that needs to be spiced up by a ticking bomb. ;)
$5/year or something like that.
While you’re at it, why not sue for emotional distress? Or lost income for the time reading this instead of billing clients?

I’m all for GoDaddy being held responsible but advocating this kind of copyright abuse is as ridiculous as it is scary. Are we going to start suing CDN’s for setting custom HTTP headers now?
Try PM first.

Don't start a startup unless you're really ready for it (mentally/emotionally).

VCs are typically well connected, later in their careers, and have been successful founders or have a strong background in finance with investing/deal experience.
Does Java's type erasure/wild cards count as bivariance/phantom variance?
Just started to read the included book from Kasimir Malewitsch called "Die Gegenstandslose Welt" (The Objectless World), where starts with philosophy about systems (that they're always static, and only dynamic during creation while becoming a system), normality in fine arts (pointing out that Rembrandt is considered normal and the point from which other works were judged). Just a few sites in so far, but it's already deep.

Many thanks for these books.
This is especially applicable to the scientific cadre; sometimes leads me to think that some scientists are just as close-minded as the religionists of yore. The same applies to "believing in science". If I have to believe in it, it is no longer science. Conversely, by its very nature, the scientific approach must be open to invalidating its own self.

I often wonder if the Jewish tradition of casually and constantly debating all manner of things is a good antidote to getting rigidly attached to one's own viewpoint. But on the flipside, nonstop argumentations are a nuisance too.
Perhaps these problems can't be solved by society? The amount of misalignment of (putative) intent and effect in education I've seen, especially at the policy level, at least suggests this. If that's true, the question you should be asking is what should I do when other people do not keep that commandment.
Qt itself has been LGPL for many years now, pretty sure it has been since sometime when Nokia owned it.
Have we already forgotten of the ilk that harassed and harangued Galileo and Copernicus? Even Socrates?
Knowing and the Known (1949) [pdf]
The hardest part for me is that sometimes, just sometimes, his blog has some great little nuggets of insight and usefulness, but the signal to man-with-opinions-and-noone-said-no is just ... too low. :(
It's not normally the default, but there's a world of bad advice out there telling people to chmod everything to 777 so that their PHP CMS can upload files.

Hell, Wordpress recommends against it (and still doesn't do a great job explaining): https://codex.wordpress.org/Changing_File_Permissions#The_da... -- probably because people keep suggesting it. A search for "chmod 777" brings up plenty of examples.

Even chroot will mitigate this, but e.g. reseller types quite often don't have that level of competence.
> We need something that even senior citizens can use to replace Windows XP on a system they can't afford to upgrade.

My personal experience from large scale transition from Windows 7 to Linux Mint at work indicates that people ABSOLUTELY can use Linux - the UI is (unlike Win10) stable and things do not move around, settings don't change themselves on upgrades. And, importantly, updates can be set to be silent and automatic.
Can you explain the not buy (B)? You're not worried on radiation from the device mobile network but from the bluetooth?
Of course it isn't new. Very little is truly new. It is the same old stuff repeating in different contexts, leading us to comfortably believe "yeah, but this is different".
I'm not sure what you're pointing to, but are you suggesting to ignore the cache? Coz that is basically what I currently do. Throw away the cache for the lists, and fetch a fresh one everytime. While that "works", but it also throws away lots of the supposed benefits that Apollo brings to the table, and its also rather awkward when you need to "trigger" the fetch manually when the display doesn't involve something like page navigation
> even when they know their position is wrong

Can I get a citation for this one? I've seen plenty of articles that are misleading if not wrong (and also plenty that are quite informative), but I have yet to see evidence they publish ones taking positions they actually know to be wrong.
Yeah, I was a bit disappointed to see Donald Trump dragged into this, almost arbitrarily, and almost needlessly. Then I remembered I was afterall reading the Vox.
Businesses did not make buildings safer just because someone told them to. It is naturally considered a bad idea to kill your customers. Businesses would always create an environment that generate more profit. Safer establishments are one of many ways. Businesses would _always_ stay ahead of any bureaucratic recommendations/requirements, because they have the incentives. Rather misguided/outdated laws are real problems, because gov lacks the (strong enough) incentive.

> The cost of low-trust in a modern economy is huge.

So you dont trust anyone unless gov tells you to ?
Off-topic Python question: is the use of “CapWords” / CamelCase for method names correct here? I assume this is the “prevailing style” of pyobjc or Objective C itself, and it therefore comes under the exception in PEP8.

I ask because I find the use of CamelCase like this for method names really off-putting.
I disagree, cryptography is like any programming; make sure it’s correct with tests, peer review and validation and check the warnings (this warning should be an error). The fact that a small example gets this badly wrong and the API allows this is probably down to the ecosystem, not down to only cryptographers being “allowed” to used crypto. The surgery idea is wrong; surgery is the implementation of the encryption which no one is advocating - this is more like a pharmacist giving you the wrong pills and you not reading the instructions/warnings before taking them.
You've presumably given GoDaddy a license to serve your content if you're hosting it on GoDaddy.
It's probably all covered by some user agreement.

I think the important part is:
Use a hosting provider you trust!
You millenials are utterly pathetic
From my reading of https://www.ampproject.org/docs/fundamentals/spec, it looks like you could override this behaviour in uBlock Origin with a style cosmetic filter. Something like...

##html[amp] body,html[\26A1] body:style(animation:none!important)

(I can't test it in my current browser, unfortunately, but I think that's right.)

[edit]

Update: I got to a browser I could test it on. Unfortunately, it turns out uBO doesn't let you apply :style() rules to all pages indiscriminately, you have to specify a domain name pattern - which is pretty annoying, because the principle is evidently sound; this does work on the link in OP:

ehow.co.uk##html[amp] body,html[\26A1] body:style(animation:none!important)

Hrmph.

Alternatively, you could use a CSS injection addon (or userContent.css, in Firefox) to add the rule to all pages:

html[amp] body, html[\26A1] body {
animation: none !important;
}

Or do it with a userscript (ie via Greasemonkey or similar).

[edit 2]

It appears uBO is aware of a need for something like this - they provide an injectable "scriptlet" that adds the necessary CSS: https://github.com/gorhill/uBlock/wiki/Resources-Library#amp...

Unfortunately, scriptlet injection also can't be applied to every page indiscriminately. :/

! works on OP's link
ehow.co.uk##script:inject(ampproject.org/v0.js)
! doesn't work at all
##script:inject(ampproject.org/v0.js)

So I'm just mentioning it here for completeness' sake.
Oumuamua waited in place until the solar system ran into it
Chart unreadable for red/green color blind.
Nothing can save you if you don't trust your hosting provider, or don't use HTTPS.

However, "was caught" is important :)
The more noise they make the more likely they are to get caught.
Having literally just kondo’d my bookshelf I think there is a nuisance here that is missing, the test “Brings me joy” is a shorthand for making a personal assessment; not based on the merit to the book in the world or for someone else but specifically for you, on your bookshelf going forward. That context helps you clear book clutter that is essentially waste taking up space in your house.

I cleared around 25% of my book collection this time around including a range of much loved earlier but now out of date tech books and I won’t miss any of them.

If you want to keep lots of your books, do it, and even still her process for reviewing your collection without getting bogged down and taking days by getting sidetracked browsing your books is extremely valuable.
You could just bypass the preloader completely. It exists only to work around the Linux ASLR implementation which would otherwise tend to place DSOs randomly in the address space, potentially overlapping regions that Windows keeps reserved. If Haiku doesn't implement ASLR, or lets you easily disable it, or alternatively would accept patches to ensure its address space layout is always Win32 compatible (better!) then the preloader could be disabled.

However if mmap is more significantly broken then Haiku needs work - Wine does need the ability to map things into the address space at the requested locations and actually get it.
They are big enough that they don't care unless you offer them _a lot_ of money or you know just the right people to talk to and have the correct connections.
An excellent article that highlights the biggest issues facing SF and the Bay Area overall, and the people who do not do a lot about it.
Software Projects Fail: The Software Development Risk Landscape
For a while it was alright. I was willing to upgrade every tick of the iPhone cycle and hand down my old iPhones.

I even handed down a couple of iPads.

The last few years has been different though. The devices have been good enough. And the prices on the lastest iPhone has kept going up. Had the prices been cheaper I’d have upgraded. My parents are on 4+ year old phones (I use for 2, then they use for 2 before another hand down) and even older spares that are just used for travel and the get a local sim. The incremental improvement is worth it if I can pass down.

As it is, I think they’ll have to get new phones when they just stop being supported. I’m not upgrading.
It is possible but not reasonable to believe, let alone act on.

By analogy, there maybe such a thing as Russell's teapot. Indeed, no one can disprove it. But it is obviously unreasonable to believe in and unreasonable to send a probe looking for it. Just as it is unreasonable not to vaccinate kids.

Thus insisting that we hesitate to vaccinate but instead contemplate evidentialy unrelated autism, is advocating a dangerous policy on an unreasonable belief. Thus people have a very good reason to speak against such speculation since it is costing lives for no sensible reason.
I’m one such person. There is still a line in the middle, so it’s ok.