skysight-inc/HackerNews huggingface dataset:
Raymond Chen (at Microsoft), for example has written repeatedly about incidents he spent lots of time investigating where your first instinct is "That's not a bug" and the eventual outcome was "Yup, that's not a bug" but it was a security ticket and so Raymond doggedly chased down every aspect to make sure it isn't a problem.

He mostly invokes the Hitchiker's Guide quote "It rather involved being on the other side of this airtight hatchway" to suggest that often the problem in these bugs is that they have a step where you've legitimately got privileges, and then they use those privileges to... do something you legitimately need privileges for. That's not a bug, if you try it without the privileges it doesn't work, but Raymond has to walk through all the steps seeing whether anything surprising is going on.

Now, whether engineers at a corp actually get given the space to do this stuff is an executive policy decision. Maybe at Apple not enough of them do, I can't say. But if it doesn't get done you are sooner or later going to miss cases where it _sounds_ like it's not a bug but actually there's a serious bug if you looked closely.
> 'visual' reminder of useful properties such as associativity, and possibly others e.g. commutativity or distributivity

These are semantic properties that most binary operators do not in fact have.

E.g. C syntax:

A << B
A = B
A - B
A / B
A % B
A < B
With the news yesterday about Facebook's ambitious research project this seems entirely okay.
What Time Frame is better for trade
Well, the fact that the JS standard library is crap doesn't help much.
This makes no sense. If you have low achievers, your job as a manager is to deal with them. It is not as though you can’t PIP someone as needed. Forcing it at a certain rate is just unnecessary and creates terrible incentives.
I don't think storing credentials in the RTC memory is a good option. In that scenario, if you accidentally turn off the power to the lamp you lose the configuration (unless they add a battery/supercap backup, which might be difficult given that there is not much space and a lot of heat). I do know that by default, the ESP32 SDK stores the last used WiFi credentials on the flash memory mostly unprotected, though this can be disabled.

I am failing to see a real problem here, however. If an attacker is able to steal your light bulbs, I feel like you have bigger problems. I guess the biggest concern is that if you get burglarized you should maybe change your wifi password? More of a concern if you have some bulbs mounted outside, but that's about it.

That said, LIFX should have enabled some of the security settings of the chip. Encrypted flash and setting the read protect bits especially would make this attack much more annoying. It's cool that we could potentially flash our own firmware on these things, but it's pretty lazy from a security point of view.
Yes. All enterprise apps, internal or not, are wiped of their certs.
Your website doesn't list the overage price for the $25 plan, only the two other plans.
I've started using Vue for some projects, and while it has some fantastic upsides, I find it very hard to optimise. With native code you can easily profile and work out where you need to speed things up or leverage cacheing.

With (e.g.) Vue, because you write so little code comparatively, it leaves you very little to do if the 'magic' that's making stuff happen under the hood is very slow.

I work with a largely native Javascript SPA (main dependency is d3) and find that Javascript can be pretty damn fast if you need it to be.
A lot of companies do this - without it being known. I see nothing wrong with the practice. Some companies I know of rotate each quarter to cut the bottom people or % that just don't make it. (eg: Q1 might be operations, Q2 finance, Q3 development, etc). It is a forced method of keeping the bar high or moving it higher.
If you paid money for your trip, you're a customer.
Seeing that there are thriving competitors for every app that Apple bundles. There are existence proofs that Apple hasn’t pushed developers away.
Touch typing would be OK, if Apple's keyboards (going back into the 90's) didn't suck, because flat keys are terrible. Almost all keyboards have gone this way save for the mechanical nerds, so I might take another look at that soon. Emacs is powerful, but Stallman's love of Ctrl prefixed commands and hatred for mice make it a challenge and Vi's key combinations are obtuse as hell (compounded by Apple's hardware).

I'm more than happy with a real Mac application like BBEdit, but it's interesting to see how the other half lives.
These large dominating companies are monopolies in every sense of the word and need to be broken up. The Bell System was broken up and didn't have a tenth of the tracking and control of people's lives that Google and Facebook do. Ma Bell didn't actively harm its users and cause depression. Ma Bell didn't collude with Russia to influence a presidential election and install a puppet president.

https://en.wikipedia.org/wiki/Monopoly

https://academic.oup.com/aje/article/185/3/203/2915143
"Association of Facebook Use With Compromised Well-Being: A Longitudinal Study"
I don't understand this mindset. In my worldview people deserve investment. VC funded corporations don't deserve any of my time to "make it as a better platform".

Companies should live or die by the market and if they piss customers off and lose marketshare, that's the market working for once.
Yup, and that's a problem.

It makes perfect sense for the bootcamps to exist to fill that niche, it's just horribly unfortunate for both the companies hiring people with less skill than they think, and the new developers being led down bad paths.

Another part of the problem is that job ads only show part of the image.

If you can show that you're a good developer with a solid track record, those HR checklists largely become null and void.

Just look at how many job ads include "Must have Bachelors in CS", which most of us know is complete bull.
We expect all engineers to care and most people, who call themselves engineers take a course of ethics as part of their certification.

It’s an ongoing source of debate and confusion as to what Software ‘Engineer’ means.
By using the term "sjw" I think you significantly diminish the strength of your argument. Why did you choose that word?

Is privacy only the concern of social justice warriors? Have you met rural American preppers?
If they used the same cert for their teen social media monitoring project that they used for other apps that don’t break the rules, that seems like a tactical error. Mind the blast radius.
well, I mean, of course... Facebook is still the proverbial 500lb gorilla, bad actor or no. Apple's going to be very slow in nuking a big player that drives a huge chunk of device usage.
Of course there isn't much benefit to using React/Angular/Whatever (and other tools in those ecosystems) if your site is mostly a static thing and maybe only needs some interactive content here and there.

If you have a stateful application (or even just a single stateful part on a static site), React will simplify life a lot.

Figure out your requirements and develop based on those. That's pretty much it. There can also be external requirements (e.g. we want to be able to hire easily, so opting for a well-known framework is better) and those should be taken into account as well.
> Let’s examine the evidence. At its peak the planet’s fourth most valuable company, and arguably its most influential, is controlled almost entirely by a young man with the charisma of a geometry T.A.

Does the writer really think a more charismatic founder would have changed the outcome for the better, or that more charisma would have led Zuckerberg to make different choices?

Let's not forget that history is scarred from the manipulations of charismatic leaders.

This sounds rather like the old nerd/geek/greasy-grime bashing trope trotted out again.
Strange article. Why give Watson, who most people forgot about anyway, publicity in this way? Seems to me that this kind of articles fuels racism by introducing bigots to a great bigot they can look up to, more than it actually fights racism. The fact that it mixes emotions, ideology, and science in the same pot is also problematic.

Then comes the "Black scientists are" part. This is a ridiculous and dangerous construction. Again it fuels racism more than it fights it. What's special about black scientists? Nothing. If we don't see race. A better phrasing is to express culture/feeling/history "Black people are"
Are you thinking of the "Stagefright" bug that did RCE via SMS on Android devices? Or maybe the Chinese censorship code that crashed iOS when people sent the Taiwanese flag emoji? 🇹🇼
What if the alternative is to be shot yourself? Where do you morals stand then?

Unfortunately our morals are easily swayed when the alternative choice is death.
https://www.techbeamers.com/python-tutorial-step-by-step/
Yes? That doesn't meet my expectations. I'd expect them to paid whatever reasonable wage ($12/hr? $15/hr?) and then get the $10 on top of that.
The post shows the risk in such a move. The 3rd party integrations can be turned off without warning (such as this case). What do you tell your paying customers?
Whataboutism doesn’t help.

There are levels and degrees of bad behavior.

Facebook is rotten from the head down.
I trust them ("them" being developed-world democracies; obviously there are more concerns with, say, the Saudis) more than I trust tech to self-regulate.

You're not going to get a self-imposed GDPR.
I hope it's clear that that is effect and not cause.
Hey wait. You consider AJAX plain javascript?
I disagree with this. Every organization, and every department has a bell curve of talent. Average and low-average people hire sub-par and poor talent because everyone thinks they're rockstars, but statistically that cannot be true.
Drinking in Moderation
I hope Apple will be taking down Google's enterprise distribution certificate as well, as they are abusing it to let consumers sideload a VPN app for data gathering: https://support.google.com/audiencemeasurement/answer/757381...

And on top of that all of those from other companies doing the exact same thing for data gathering.
If my concern is losing access to my music, a hard disk failure is more likely than getting banned from Spotify.
>Not hiring idiots in the first place is IMO the proper solution to this problem,

Presumably leetcode avoids this. what is your opinion about that? Is it effective in your experience?
This. There's nothing scientific about Watson's views, and even social scientists who stress the relevance of cognitive skills in development and express concern about this relevance (such as, IIRC, economist Garett Jones) do not share or endorse a view nearly as extreme as Watson's. Even journalist and pundit Steve Sailer, who is very often ridiculed as a believer in scientific racism, has actually stated many times and with great clarity that even "raw" cognitive ability (to say nothing of things like educational attainment or productivity) is extremely likely to be highly affected by environmental factors such as severe disease, malnutrition and the lack of a range of important micronutrients-- such factors being very common in Africa and in low-income countries more generally, but also obviously amenable to change. This whole Watson kerfuffle is just a cranky old guy sharing his deeply misguided opinions-- it's not science and it's not even "scientific" in any real sense.
Performance cost of micro-outages, build a distributed system and Prometheus 2.7
I can believe the author. I have a fast internet, but I have DNS set up to resolve over DOH and over tor.

This is when an idea that having everything loaded from 7 different CDNs for a page to show anything at all falls on its head.

My uncached domain resolve times are in the range 1-10 seconds. So in an unhappy scenario, when things chain up, because a page needs one resource to decide that another resource from another domain needs to be loaded, and so on, I can easily wait 10-30s on a web page to load. Combine that with an idiotic FOUC prevention, that many website's designers fall for - and it means starring at a white space for the entire time, until some stupid web font loads, despite the actual text content having been already loaded for the most of the time.

So if the wifi is combined with a high latency DNS, it's certainly possible. Not everything is about raw throughput.
Completely? No. But when it comes to data and privacy I think it'd be better than today's wild west.

Who would have thought ten years ago so many people would be willingly give companies a live feed video stream of the inside and outside of your house, along with voice recordings of everything?
> How can I address this using tech?

If you have a hammer and can't find any nails, looking around for other things to hit is unlikely to be a productive activity.

You've identified a serious, complex issue and you care about improving the situation. That's an excellent beginning. Go to your local library and find a book on systems thinking/analysis such as Thinking in Systems by Donella Meadows. Start to understand how all the pieces fit together and what sort of changes will help and what will make the problem worse (you will be surprised!). Your tech experience will be extremely helpful here.
> Do you not think such a culture is actively detrimental? How can you ask anyone to give 110% if they might be getting sacked next year?

As much as I dislike the forced attrition mechanism, people putting in 110% are not going to be forced out. It's the people putting in 30% that are going to be the attrition targets.
To add to your post, I highly recommend this Planet Money episode: https://www.npr.org/sections/money/2018/10/05/654769859/epis...

"But Oliver Bullough says it doesn't make sense to look at the world that way. He's a British journalist and he has written a new book: Moneyland. That's what he calls a hidden economy where shell companies and offshore accounts shelter wealth from taxation and scrutiny."
And if his management doesn't support that sort of approach or developing his team or hiring well (support with resources not just verbal agreement)?
Audiogalaxy (RIP) is still superior to any currently available streaming service and had a vastly more diverse palette on content.
I would be very interested to hear where premise 2 comes from.

I can speak only for America, but that premise does not appear anywhere in our Constitution.
Yes, and for some time: https://support.google.com/googleplaymusic/answer/1075570?hl...
Because spam calls don't occur because you gave your number out, but because the spammers either farm your number from a "partner" or iterate through numbers.
I don’t see the problem. As a corporation you sign an agreement to use an Enterprise certificate to distribute your app internally. The rules are very clear. FB broke those rules. If you don’t break the terms of the agreement you’re in the clear.
>"That it is better 100 guilty Persons should escape than that one innocent Person should suffer" is a Maxim that has been long and generally approved.

It is not fundamentally true nor universally accepted. Where does the scale tip? All criminal justice systems attempt to minimise the risk - but one some level it is simply the cost of doing business. For all that it is an admirable sentiment, it is limited.
they aren't wrong, low attrition usually means that people aren't pushing themselves out of their comfort zone... this is incredibly bad for a company (ESPECIALLY a company that uses a hierarchal structure). Loosing a little fat is a sign of good health for a company... the issue is when you stop cutting "fat" and start cutting into the meat.

Amazon is just taking advantage of all the devs that want to work for a big name, its a fair deal for both sides. They work you to death for 18 months, you get "Amazon" on your resume.
Any idea why is it not using B-trees?
Everything you said should come with the caveat for now. There's no reason that Google couldn't take the tack that Android, ChromeOS, etc. require Chrome. Chromium could also be closed off with no warning like nearly every product Google has shut down without warning. As soon as it stops being economically efficient, or Google just plain decides to move on.
>So what makes Visual Programming not have a textual representation? What makes them inherently incompatible with each other?

Nothing really, but you would need a Visual programming environment that maps one to one to your language. So that you could switch between coding in code and looking at or modifying the visual representation when it's helpful.

This would probably limit what you can do in the GUI, just as GraphViz limits control of the graph in favor of automatic layouting.

The vendor lock-in is one of the main issues I mentioned above.

If you have a good idea how to visually represent and modify C# or some other language I wouldn't mind that as an additional tool. I would think it's even very helpful for getting an overview. However the code should still be the master. And open-source is probably the only way to have such a tool that's actually good.

And if you can map one language to the GUI you could probably port this to many languages.

I was mostly concerned with what we have right now (LabView, Simulink and others).
No. But in general your gut has a significant problem with microwave food if you eat it day in, day out.
that is unrelated to the "hide the path" functionality - as you pointed out, it's because they displayed the EV name instead of the URL. That's a separate, and much more harmful, UI choice - because EV certificates are poor evidence of association.
> Even on a desktop PC with a fast connection, I spend so much time staring at progress bars and loading spinners as all the various bits and bobs of the interface get pulled down and rendered.

A lot of that is likely because of the way most REST APIs are laid out.

Suppose you're looking at a page that displays an invoice for an accounting system. With a traditional non-SPA app, you'd do a bunch of SQL queries and build a page from an HTML template.

With a REST API, you're doing one HTTP call per entity, at least, and then subsequent HTTP calls for aggregate entities.

When I've made SPAs before, I've often eschewed REST and just made a single Ajax call for "everything I need to display X to the user," not just out of efficiency, but also out of laziness -- it's easy to build. As long as you internally use your API only and don't publish keys for third parties, it's easy to maintain too.

There are some solutions to address the whole problem on a grander scale (GraphQL comes to mind), but overall, that's the cause of slow SPAs in my experience.
Time to first render isn't as important anymore. The expectation is more that people will open the app and leave it open for web applications and there is data to back this up. For informational sites the time to render is more important. That being said, there are also a lot of bad developers who basically invalidate any optimizations that the library makes due to their own ignorance.
I agree. Any attempt to talk about genes outside of a narrow band is automatically considered racist or sexist. Productive, interesting discussion is killed off before it can begin, which is such an intellectually stifling and medieval way to handle these topics.
> Because it is much more reassuring having a community back you up in case you get into the edge cases. DIY? Good luck, you are on your own. Not to mention you have to scaffold all the things that are already taken of by the framework.

And once you're reasonably familiar with a framework it would make sense to use it even for a prototype. Unless you're actually interested in trying out "VanillaJS" or an alternative framework you would just use the tools you already know and get on with the problem you're trying to solve :-)
How is that relevant here?
What harm came from that exactly? More people voted? Is voting harm? Just because you don't like the way someone voted doesn't make it harmful.

My understanding is the entire Cambridge Analytica thing is about privacy and not actual harm from the Facebook aspect.
If you try a bit harder, maybe you might be able to think of something that's wrong with this practice.
Bear in mind that, at one time, iOS devices could be jailbroken [to run arbitrary code] by simply opening a specifically-created PDF; https://www.wired.com/2011/07/jailbreakme-3-0-unlock-your-ip...
Uh, my proposed solution required getting a warrant to order a company to produce a device specific message which in turn could be provided via cable to the physical device, which they must also have access to, followed by spending time reversing a hash chain.

So yes, the police already have the power to search you for weapons if they have a warrant, and this is bringing the ability to search phones into line with that.
True. IIRC there are ways [1] to implement try lock free updates of reference counted pointers but they are a bit exotic and not cheap.

[1] at the very least you can implement a lock free n-CAS operation given a plain CAS.
Fruits That Increase Sperm Volume
...yea except every dev in the game knows thats where to study.
BoltDB vs. Badger: A Comparison of Go Key-Value Databases
It's nice they have the capacity to do that to protect their consumer ecosystem (indirectly), however, if I'm making an enterprise ecosystem decision to build out a fleet of mobile tools for my company, "Apple has and has used the capacity to shut down the ability of the hardware we purchased to run software we wrote on that hardware" gives me pause adopting that ecosystem.

Their purpose was generally-accepted as just in this case, but what if next time, it's because someone started competing with them and they didn't like it?
Thanks, I didn't realized. And yeah, I don't feel like people here care that much about karma. Usually when I submit articles it's because I want to read the discussion that it creates on HN.
Why are companies so bad at coming up with a system that keeps more competent people and eases out less competent people but that also doesn't hurt morale by being a dystopian nightmare?

Probably because they can't tell the good from the bad.
This is an important, carefully researched book, one which everyone who is working with the Internet should read. The portrait of today's reality (and our future reality) is disquieting. https://www.amazon.com/Age-Surveillance-Capitalism-Future-Fr...
SJW is a weird insult to use here, the outcry isn't anything to do with SJWs. FAANG in general are actually very pro SJW in the gender/racial sense, see Damore's firing, the twitter feed of senior devs at any of them.

They're the epitomy of the liberal elite, privacy is totally orthogonal as an issue.

You can say right now that "not everyone cares about privacy" and it seems reasonable, but in a decade or two it will sound like saying "not everyone cares about environmentalism" does now, it's ignorance that will slowly bear fruit.
So I think it depends on the organization. I have tended to work in more aggressive, competitive fields. Different versions of "rank and yank" (as you call it) or "up or out" or other types. BigCorps need to do it to keep the average talent bar from trending down (A-Players hire A-Players; B-Player hire C-Players). Startups need to do it generally because the pool of applicants tends to be either "great", "good" or "can't get a job elsewhere" and it needs to weed out. I believe it forces people to improve themselves and their game.
> How long until Facebook creates its own phone and OS?

About negative six years. They already tried and it flopped:

https://en.wikipedia.org/wiki/Facebook_Home

I can't see it going any better if they tried again, since they've been working hard in the mean time to burn all the trust and goodwill they have.
If it's consistently poor coding on behalf of react apps, perhaps the documentation or culture around react isn't explaining the pitfalls or encouraging good design.