skysight-inc/HackerNews huggingface dataset:
That's because you are glossing over a lot of packet inspection deeper than the TCP level with a glib "Read the HTTP request".

You might want to think about existing surveillance systems. Analysis of telephone traffic is often done purely on the CDR (the caller, callee, and length of call, in simple terms) without the equivalent of deep packet inspection to read the HTTP request, which would be analysis of the actual audio data themselves. The HTTPS case would likewise need just the total octets transferred over the TCP connection for fingerprinting.

There's a lot of glib handwaving in this discussion about identical sizes, not based upon actual measurements of the Debian archive. I quickly looked at the package cache in one of my Debian machines:

jdebp% ls -l|awk 'x[$5]++'
-rw-r--r-- 1 root root 3314 Feb 16 2018 nosh-run-freedesktop-system-bus_1.37_amd64.deb
-rw-r--r-- 1 root root 35190 Dec 14 2016 redo_1.3_amd64.deb
-rw-r--r-- 1 root root 1114546 Feb 25 2018 udev_232-25+deb9u2_amd64.deb
jdebp %

It turns out that in practice size alone almost does uniquely identify package in this sample. The other file that is 35190 bytes is version 1.2 of the same package, leaving just 2 possible ambiguities out of 847 packages. It seems likely that this holds after encryption as well.

So the remaining question is how much HTTP pipelining ameliorates this, which no-one here has yet actually analysed.
I can of course not assess your breathing difficulties at all but maybe it's just the non-pathological https://en.wikipedia.org/wiki/Nasal_cycle ? Although the Wikipedia article says that usually one should not notice the effects.
What sucks about being a good leader
There is a huge gulf between being able to follow a thought path and being able to find it oneself. I couldn't do the same work in the same timescale as them, I wouldn't make the same decisions or spot the same pitfalls. I am simply not as good. But I spent a bunch of pub/work time discussing it and could project an aura of authority on the projects if I wished.

Look at it this way. I was able to understand all of the maths proofs taught at my degree, but I could not have come up with them myself.
Introducing Manifold Uber’s Framework for Machine Learning Debugging
Somewhat related: A few years ago, Kiln (FogBugz) decided was supporting an online version of Mercurial and decided to support Git too. They made it in a way that you can use any repository with both system at the same time. Probably there are better tools now. I guess that in the future someone will just make a script for the transition from git to whatever.

https://www.joelonsoftware.com/2013/03/11/town-car-version-c...
I think what this quote is responding to is people disseminating some first world millennial's first uninformed guess about an issue as if were a revolution and a blessing to the world, instead of stopping to think that their precious intellectual virtues are not limited to people of their class, education, and supposed intelligence.

The idea that our enlightened attitudes set us apart from the rest of unwashed humanity is our fake news -- the stuff we consume unreflectively because it flatters us and plays nicely with our prejudices. Presented in a neutral context, the idea that the agricultural industry was throwing away significant quantities of produce because of aesthetic flaws would meet a lot of skepticism. Presented in the context of you are special because you understand how wrong this practice is and special people like us can help save the world by fixing this problem the idea gets uncritically accepted and widely shared on social media.

Calling people "classist as fuck" is designed to startle and threaten exactly the people who tend to accept these narratives uncritically, and put them in a frame of mind to consider that they might be wrong. Whatever the truth of the issue is, we won't get there unless we stop seeing ourselves as the hero of the story.
Yes, it is nice, isn't it? I remember the first time I came to Japan. From the airplane I could see three of the baggage crew -- white gloves, and all three of them did a bow to the airplane before they started working.
Oh Ubuntu is like Debian to me... in fact when I was taking about Debian this whole time I was actually talking about Ubuntu. Its latexmk is the one that's old.
A behaviour can be classist, whether there is intent or not.

Similarly, some hiring practices wind up preferring men over women or vice versa, and are thus sexist. Whether that was the intent or not, the outcome is the same.
My city just banned them from walking paths.
not OP, but my reading of the term "racial undertones" is that there is racism just under the surface, ie covert rather than overt racism.
not sure what point you are trying to make here. you single out one of the highest income states in the US and say the median household would pay less tax than the median family in the whole UK. sure, but families that made the equivalent of $66,529 in pounds (£51,699 at current exchange rate) would pay about 27% in taxes according to your calculator with the default settings. not sure what conclusion I'm supposed to draw from this.
You can download variants with open zero or no serifs on the GitHub page. Also I think the way it is spaced is above average. I can for more text on screen with it and it is still readable, due to the letter height.
> I bet if you sorted all the ".deb" packages on a mirror by size a lot of them would have a similar or the same size

Why bet when you can science? :)

$ rsync -r rsync://ftp.be.debian.org/debian/pool/main/ | grep "\.deb$"
$ wc -l debian.txt
1246733 # total number of deb packages
$ cat /tmp/debian.txt | awk '{ print $2 }' | sort | uniq -c | sort -rn | head -1
463 1044 # The most common package size has 463 occurances
$ cat /tmp/debian.txt | awk '{ print $2 }' | sort | uniq -c | sort -rn | awk '{ print $1}' | grep -c "^1$"
259300 # The number of packages with a unique size
$
Yeah... who ever suggested "AI IS a thing we program to then deliver abstract terms like social good"? Are you refuting a notion that no one holds? Of course the contest at hand is to use AI technology to solve various problems we deem to be socially good. Not to rigorously define social good and have an AI solve it.
Mark Kurlansky (of Cod and Salt fame) wrote a book "The Big Oyster: History on the Half Shell" which detailed the history of oysters and NYC [0]. Apparently at one time more than 700 million oysters a year were being harvested.

[0] https://www.amazon.com/Big-Oyster-History-Half-Shell/dp/0345...
There are two reasons you want to compromise a host:

1) You're building a botnet (or, these days, are crypto mining). In that case you're not targeting a specific machine, you just want many of them.

2) You want to exfiltrate information from a host, or sabotage it. In that case you're targeting a specific machine.

I'd argue that in both cases, the proposed attack vector of inferring installed software versions through apt downloads is inferior, or at least more involved. In case 1) you're better off scanning for known vulnerabilities or make use of shodan and the likes.
In case 2) you're probably going to probe the server anyways. It might take a little more time than if you just had a complete list of installed packages and their version (given you were somehow able to eavesdrop on the host in the first place), but you'll most likely determine at least what OS is running and what technology stack their internet-facing services are running on after some nmapping.

Or, looking at it from the other perspective, I wouldn't really feel much safer if apt were using https. I'm not against it, but I don't think it's a priority, especially if it needs a lot of coordination between different people, which always turns out to be very time consuming. Just being fast with updating packages seems a better investment of that time.
Thanks, I appreciate your feedback!

> There's no clear cut off for anything in managing a software team. It's not a science, and individual situations vary too much to create hard and fast rules.

Intuitively, I disagree. There's a lot of nuance for sure but, but there are still patterns that can be noticed.
It's nice when something is so well written that it almost literally transports you to that moment. I was agitated to know what would happen next as the narrative unfolded.

Can recommend.
Work on World's First CRISPR Babies Declared Illegal by China
Make Money by Typing $300 to $900 per Day
He was both extremely lucky and very clever and thinking quickly. The odds that he'd survive were one in a million, what an amazing story.
Breach of contract? Huh? Most tenants do not have "audit trail" requirements in their contracts and their existing physical locks don't provide one.

I always wonder if the folks making legal claims on hn actually practice law - the arguments are often nonsensical. Or maybe this type of logic is why law seems so backwards to folks
Yep.

The blind leading the blind.

But that's most blogs regarding development nowadays, most are garbage advice.
This might also help a similar thread was posted a while back

"Ask HN: How to self-learn math?"
https://news.ycombinator.com/item?id=16562173
American Way of Death
I did not intend to suggest that there is anything wrong with attempting to cut the Gordian knot with an insightful analysis, it is just that, in these cases, it does not seem to have led to anything useful. And Dennett's book 'Consciousness Explained' is certainly presumptuously titled, though he is at least looking for explanations, when he is not confronting those who claim it can't be done. Meanwhile, the state of technology has advanced to the point where we can at least imagine Searle, in his room, competing successfully in a Chinese-language game of Jeopardy.

No-one ever disproved vitalism, but its implicit threat to the progress of biology simply dropped by the wayside.
A lot of the more intense breathing practices drive energy upwards into the head (whatever you want to call "energy" the feeling can be one of congestion/headaches/stimulation, etc). It's important to draw it back down to the belly or Earth to reduce this.

Put the tongue on the roof of the mouth and move your awareness from your head down through your tongue and on down the front centre line about an inch inside the body. Someone jacked up on some of these breathing practices might also have over-stimulated their adrenals, so it's also important to concentrate on relaxing. Once you can go right down the front line, loop back under the trunk of your body and go up the spine. Just keep moving your awareness around this loop while relaxing, making sure to finish at the belly.

Failing that, try walking barefoot while allowing yourself to relax more and more. It should have a similar effect.
What Monopoly Capitalism is
Incredible, to be hiding under one of two beds in his hotel room, and having the other bed being searched and shot at by the Taliban.

> Don't concentrate only on work, stressful and bad things in your life. Concentrate instead on creating good moments and being around good people, because life is so beautiful.
As a small social enterprise with ambitions to use data to improve the work of local health/activity/wellbeing charities, the offer of help appeals to us so we're applying. I get the various arguments here but on balance, what would we achieve by denying their help.
Not only is this account suspicious but also some of those that replied to it.
Drone Racing
My point was more why staging is a special feature that even has a name. You're basically just selecting what changes you want to commit.

What is the usecase where one needs to remember that selection for more than just a few minutes?
the Eizo ev2730 is a 1920 by 1920 square screen. A little pricey ...

https://www.eizoglobal.com/products/flexscan/ev2730q/index.h...
Ask HN: Marketable dev skills for designers
So, I'm a designer focused on product (UI/UX/Business) and I'm learning code for personal reasons (some web dev and scripting). I'm wondering if there are some ways to add basic dev skills to my designer profile to be more marketable in the freelance market.
The obvious would be front-end but I'm afraid it would push me towards a performer role than someone who think about the whole product. I would also be less efficient than a proper front-end dev so I wouldn't be really effective in larger teams. Plus I don't enjoy it that much. But hey if you've seen counterexamples, let me know.

Other things I thought about would be data analysis for research or MVP building, but I'm not sure if there is a proper market for this kind of profile. Any insights on thoses or other interesting skills you've seen ?
Patio11bot
After looking into it a little more, I'm inclined to agree with you just because I couldn't get any definitive definition on the distinction between phlegm and mucus.

> Therefore isn't a thickening of phlegm (a form of mucus) an increase in quantity, therefore we can say it increases?

I don't necessarily agree with this. You can change the viscosity of water by adding gelatin, but you didn't add more water to make it thicker.

But I am most certainly not a doctor and I realize I have no idea what exactly phlegm is!
Culture Foundry Prove-It Contract
While I agree with your point, a counterpoint is that vulnerabilities in the HTTPS implementation are also possible, and by introducing HTTPS code you are increasing the surface area of possible vulnerabilities.
A: Assuming package privacy could somehow be protected (a question I leave to part B), then I agree that there is no improvement in security against capable attackers: they would have to focus on hacking the APT servers, on which the attack surface can be minimized, and monitoring and logging any deviations can be tracked and published for all to inspect.

B: if the packages are concatenated to each other and a random length noise string, we can substantially frustrate nation state / ISP level attackers to the point of forcing them to get this information from the endpoints themselves: Either end user, or the APT server must already have been compromised.

1) End user not yet compromised: in order to capture these, they must attack the APT server.

2) End user already compromised: on each update of all compromised users, information is sent to C&C, so this would produce lots of opportunity for attentive users to discover the implant.

When focussing on the APT, which would give the cleanest record of attack surfaces, the community can put man power on designing minimalist APT servers, and inspecting published deviations in communications can lead to uncovering 0days.

EDIT: changed disagree to agree, as I (incorrectly) thought you were arguing it would not make attacks more expensive, woops!
Similar posts have been discussed in the past. For example https://news.ycombinator.com/item?id=18735903

Note that the amoeba system finds only an approximated solution, it is not guarantee to found the best solution. Also, it finds it in linear time (for some definition of linear). And the graphs are small (8 cities).

So ... this is at best a new nice heuristic. There are plenty of heuristics, it's not clear that is better than the other heuristics.

The difficult part is guarantee to find the best solution fo large graphs in non exponential time.
Implementing the next Gmail efficiently in open source
They could also improve the download client to fix this.

For example, if the download client uses the byte-range HTTP requests to download files in chunks, there is nothing stopping it from randomly requesting some additional bytes from the server. Then the attacker would have a very weak probability estimate of what was actually downloaded.
Ask HN: Any good Confluence alternatives out there?
We've been using Confluence for a while but finally got fed up with it.

Slow, uses the worst adaptation of Markdown ever without much recourse around it, awful organization tools, and I can't find anything. Ever.

Overall, there's too much going on for too little gain.

Any recommendations for an alternative?
Surprised by how bad these fonts look with languages other than JS.
I don’t miss at all those playful icons while using one of the worst windows ever. I hated that mix of Tahoma and MSSansSerif too.
i used to do place de clichy / st ouen at 7pm a long time ago, and i sometimes had to stay on the dock for 20 minutes letting train pass.
> generally achieve higher grades than male students

Because they follow rules obediently. That same tendency nets them lower salaries, with a conciliatory style during negotiations.
There are more terrible domain names on sale for hundreds of millions of dollars:
https://dofo.com/search/?extension=com&sort=price_d
Entitlement of the Keyboard Warrior
How curious. That article's (from 2014) description does not seem to be a thing any more, at least in the US-based models. I can see the brand (both BMW and Harley Davidson) wanting to maintain its characteristic appeal, though in the case of Harley's, I agree with @rumudiez's comment - a lame nod to the "loud pipes".

There was/is a fair bit of discussion to be had about making EVs a bit easier to detect by sound as they roll at slow speed, and US DOT even made it a rule [1]. So, there is that. Not sure if that rule applies to motorcycles, though.

[1]https://chargedevs.com/newswire/us-dot-finalizes-quiet-cars-...
Exactly. And that's what the comment you replied to said. For them, it was worse for their "needs and taste" but you wanted clarification. Now you're saying the clarification is obvious so I don't know what's your point.
If anybody is interested in coding in a way that is closer to requirements, generators are really helpful to switch towards a paradigm called Behavioral Programming: https://lmatteis.github.io/react-behavioral/
The point of the book isn't the fertility, it's the fascism. When you're doing something abhorrent that is, of course, supposed to save the world/species - that doesn't actually make it ok
> More likely yes if it's a lower level employee, less likely if it's a very senior executive and a larger amount, but those are more often in equity or explicitly to make up for lost options in a previous company.

The thing is, the higher level employees are the ones most likely to have brought in a lawyer to review their employment agreement and to have negotiated explicitly for getting a clause for this type of payout if they are let go. These are often referred to as a golden parachute or golden handshake...

Basically, fire someone near the top, whose mismanagement is likely responsible for problems, you have to pay out the nose; fire a low level employee, you pay next to nothing.
Why aren't there more software engineers?
> Proving equivalence between programs is not computable (by easy reduction to the halting problem), and infeasibly expensive to do manually for non-trivial programs. Barring unexpected breakthroughs in algorithms (e.g. a constructive proof that P=NP), this is likely not to change in the next decade or two.

There is an assumption implicit in your statement that the language in which the programs are written admits uncontrolled general recursion. Since you mention the Curry-Howard, you must be aware of the concept of total functional programming languages, in which every program has a normal form. The halting problem for such languages is trivial, and proving equivalence between programs in such languages is feasible.

Of course, no mainstream programming language is total. However, such languages are not one or two decades away. For example, the Coq proof assistant implements a dependently typed total functional programming language, and is turning 30 this year.

To my mind, the interesting question is whether we can productively use such languages for solving practical problems. This is an active research area. Turner [1] teaches us how to write total programs that run indefinitely by making use of codata. Idris [2] is a dependently typed language that supports codata and is explicitly aimed at practical programming.

[1] D. Turner (2004) “Total functional programming”, https://github.com/mietek/total-functional-programming/blob/...

[2] https://www.idris-lang.org
I wonder if his ability to focus on analysis and solutions made the whole experience less traumatic.
Just FYI, Taliban was the creation of Pakistani military intelligence to fight Soviet invasion of Afghanistan in the 80's and funded by the CIA.
This is alluded to in the article, they want wild oysters to join the population. Most likely to increase genetic diversity.

I would imagine this is a good start, people can identify with oysters and they can then start to use funding to diversify the biosphere down the line.
I think the experience with Confluence depends entirely on how it's run but I agree. Still not as bad as SharePoint.

I've recently discovered Nuclino (https://www.nuclino.com/) and rolled it out in our team in place of Confluence.

It's a pretty neat markdown wiki built on top of ProseMirror. There are some trade-offs (such as the lack of a self-hosted solution) but so far it made my life a lot easier: the UI is better, the search works as it should, the setup and maintenance are minimal.

If you're looking for a self-hosted solution, MediaWiki or DokuWiki might be better options.
Huh? All you would do is configure the web server running your apt mirror site to serve the same content on both HTTP and HTTPS ports. If the client want to use TLS, they connect to HTTPS. If they want to use plain HTTP, they connect to HTTP. Both sites serve the same content, which is just a series of flat files. AFAIK, the client is responsible for determining the correct versions for the installed distro based on the indices.

This is what many mirrors already do:

http://mirrors.lug.mtu.edu/debian/

https://mirrors.lug.mtu.edu/debian/
Free range chickens in Asia are similar - the ones you would see wandering the local village. Freshly killed and the taste is amazing like you somehow marinated the meat in chicken stock to get a strong, almost gamey taste.

Nothing like your standard supermarket frozen chook.
Three images that explain why tiny steps work best
It's.. not really that. The step-out-of-line thing, I mean. But the pressure on young people is extremely hard, it's literally passing an exam to enter every step of your education (exam when finishing a step, a new one to enter) from kindergarden and up (and even earlier, for really obsessed/concerned parents). Extremely long hours (and a lot of that comes from culture, so yes that's also a part) for students and workers alike. The moment you feel unable to handle the pressure things will fall apart quickly.
I actually did a quick hack a few weeks ago to build an "elimination" style tool for making decisions. The code is here [0] and the tool is here [1]. Might be able to adapt it to something like this.

[0]: https://github.com/weaversam8/bracket-based-decision-making

[1]: https://bracket-based-decision-making.firebaseapp.com/
> Note: It makes no sense just to look at my code, nor just to read this article with a cup of tea in hand.

It's a good thing I have coffee then. As someone who is not very familiar with computer graphics programming, I did enjoy reading through this.
There is an old joke on the Internet about measuring arrogance in nanoDijkstra, but I don't know how much of it is about real arrogance and how much is about he telling things as they are.
Confluence is an over-engineered nightmare. I managed to get our company to use a private Discourse install instead.
Most important problems aren't that hard to solve
There's sexual selection to account for too.
Somewhat relevant: William Lawvere, Some Thoughts on the Future of Category Theory (1991). (The main points of the paper are summarized at https://ncatlab.org/nlab/show/Some+Thoughts+on+the+Future+of... )
> One huge problem with the start menu is that every company put a folder with their company name in there and you had to go inside to launch your program. Adobe->Photoshop, Microsoft->stuff.

It was even worse than that. The app name usually was a subfolder too. It went like: 'Start -> Programs -> Adobe -> Photoshop -> Launch Photoshop' (Plus 'Open Readme' and 'Uninstall' and whatnot)