skysight-inc/HackerNews huggingface dataset:
Signing infrastructure does seem like a significant improvement over Javascript delivery, but does that also carry over to platforms like Windows?

Again, please correct me if I'm wrong, but Windows doesn't do anything with signing app updates, does it? Come to think of it, I'm not 100% sure my Linux version has this either, since Signal isn't being distributed as part of the official repos.

If Signal is being updated on Windows without validating any kind of signature, could a compromised server even pull off the "send a malicious payload to only one IP address" attack that people talk about with the web?
The orange dots are much darker and the green ones are much lighter.

I'd assume anyone who is colorblind can still distinguish between the two based on brightness and not color?

Is there any reason to think that's not the case?
Are there any bootcamps that filter/drop students?
Dang. This really is like a no brainier now. Keep rocking it!
Why the negativity. Mistakes happen ?
Interesting article. (Full of anecdotes though) On one hand it blames the government for not bringing jobs, on the other hand it cites youth's 'unemployability' as the driving factor for their joblessness. So which one is it? Their lack of English skills, substandard education in mid tier colleges or absence of jobs?
Yea, I've hears good things about it. My friend runs it as their load balancer + ingress for their k8s cluster.
It is great to see such initiative.

I have a very similar experience as your and can clearly relate . Somehow, I am also working on something similar with other folks, with a specific focus on Guinea (https://www.guineapromise.org/programs/mobile-lab).

One thing that we are realizing is that the scale of the work to be done is such that we have decided to shift our objective to be an inspirational one. We advocate, lobby and inspire schools, local governments to build science labs.

Is your focus mainly with computer labs, or are you interested in general purpose science labs?
I use webflow regularly. Recently they updated the UI but didn't bother addressing the hundreds of other requests for obvious missing features. If anyone here has the capacity to make a dumb webflow - you'll make a lot of money. Include all the basic building like drop-down menus, tabs, carousels etc... And make some freely available premium themes (I can help with this) and you have yourself some loyal users myself included.

Nothing is more infuriating than a UI redesign to fix what's not broken.
Austen: does your admissions process give any weight to outside referrals? I have a friend who would be an incredible fit for your program. I'm an engineer at a top company and I'm sure he could reach my level with some guidance, I just don't have time to give him that support myself.
If Firefox is chewing through all your CPU from the moment it opens you need to reset your profile.

https://support.mozilla.org/en-US/kb/profile-manager-create-...

I don't think Firefox can fix all the bugs at the same pace Chromium can.
What's the tech scene in Budapest like ?
He's implementing his own language, so it seems it would be useful for debugging his own compiler. In other words, the IR he's generating is not really for anybody else, it's for himself.
I’d have to look but I believe so yes
> Most universities primary function is research

Actually, in the US, at the vast majority of universities, the primary job of faculty involves teaching, extension/outreach, and forms of service like mentoring students. Most universities have research expectations, but that is not how faculty spend their time.

> and tuition doesn't pay for research.

This is a STEM-oriented view. In a lot of fields the primary cost of research is faculty time, and it is often paid by tuition.
> Educational institutions that do not even bother to spend such a small amount of time

I can confirm that there are theory-focused professors at a particular state university that don't understand version control or have any experience with it. It's not that they don't see any value in it, they just don't have any experience with it to pass on to students.
does this mean something bad? I will get this
And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M, your threat model is flawed and you've already lost. They might have to seek alternative options. They might not. They might just be able to issue $20M of bonds, who knows. They might have a strong economy next year and the attackerbucks-to-USD exchange rate might double. If you need to defend against an attacker with $30M in the bank, make the attack cost $30B or $30T.

And the neat thing about crypto is that's easy to do: just increase the amount of entropy involved. A mere ten more bits make a brute-force attack cost 1000x as much. If we're genuinely worried that 63 bits is too small, ditch the 64-bit requirement and make it 128-bit. (Probably phrase it as 120-bit, so people can use UUIDs and whatnot - the point is still that 120 is still clearly more than enough, not near the borderline.)
Certainly we can do smarter things if we know an access is going to result in a page. But we're not in a position to take advantage of that until green threads are in place.
Cloudflare works as a reverse proxy, it loads what's on your server. We can cache videos by using a page rule.

I guess they only ask you to upgrade if you serve a huge amount of bandwidth.
Is this because Walmart is a low-price store? I'm not American so I have no idea
There is no 17% if you’re taking a living stipend.

It’s either:

1. No stipend, 17% for 2 yrs

2. Stipend, 10% for 5 yrs

They’re mutually exclusive.

And we do have a charity arm! https://lambdapaf.org
While not a demo of Dragon's NaturallySpeaking, I think of this video when someone mentions 90/00's-level consumer dictation software. For me, the video absolutely captured what it felt like to use those products.

https://www.youtube.com/watch?v=MzJ0CytAsec
CXA nabs $25m fresh capital, welcomes new strategic partners
Well let’s say you read command line args into a Vec<String> and then you want to use each in some Foo struct, but you want to avoid clones, so you make the field a &str. Now your Foo must become Foo<‘a> everywhere.

I understand the guarantees, it’s just the syntactic overhead that annoys me.
To be fair, it was a qualified dismissal (a proof by counter example, essentially) followed by color (or off-color) commentary.

There's probably more polite ways of saying "this is the typical bias of non-stem core commentators on stem core issues". But we can't all to polish our submissions to essay or press release standards, and devaluing negative off-hand remarks will only incentivize positive off-hand remarks, i.e. sycophancy.

Take these as off-hand remarks on the concept of civil discussion. I fully acknowledge your role and experience as the relevant qualified expert.
I've had employees that I would have been happy to pay to stay home.

The NYC school system has the "rubber room", where unflushable employees are warehoused.

One of the reasons I support UBI is because it's cheaper than welfare for keeping certain people out of the way.
We use mastery based progression, so if you don’t fully grasp a unit you roll back, we assign you a new instructor/mentor, and you work on that week again.
An Information Exposure Vulnerability Exists in Jenkins Azure VM Agents Plugin
Yes, the litany of difficulties that provide a scaffold upon which people can give themselves permission to do... nothing. I wonder if sometimes a clearly vocalized moral view strikes people as judgemental, so there is a reactive need to identify inconsistencies?

Interesting point of view regarding definition of vegan.. Not trying to annoy you, but surely the society that coined the term should be the reference for describing what that term means?

Thanks for the book link - it looks quite densely written and I'm embarrassed to say I struggled to follow the 'introduction' preview on Amazon. If you did find it of value, then I'll take that as a recommendation and make an attempt at it.
Vote-by-mail solves lines, running out, etc. I’m gonna miss it when I leave Seattle.
Oh, absolutely. Doxygen is a good tool - possibly TOO good, because it allows lazy devs to produce something that looks like documentation with almost zero effort. There are plenty of other ways for them to achieve the same goal, though.

I think your "trying to tick the box" cause is most likely, especially because that often results in "get the newbie to do it" or even "outsource it to India" where the person writing the docs has no idea what to write and so they just translate the function prototype into English.

You can definitely also get it from being too close to the code (or to the problem domain) - I looked up the help for a form in my new accounting package and the help literally says "fill out the form"! Super helpful when populating columns like "Amount".
Domain Expertise Becoming Essential for Analytics
Weigh up the pros and cons. If you've got other issues holding you back like you're lacking continuous integration, builds break often, you need more tests etc. weigh up if they're worth addressing too.

Different projects have many unique requirements and characteristics. Pick the deploy process that suits your project and don't e.g. go with move fast and break things because one project says it works for them.

I'm guessing you've probably got at least a few good reasons why you're deploying once a month right now.
Before Doctor Who, There Was Nigel Kneale
Excellent! Sounds like a fair deal.

Didn't know about the charity -- that's great! Is it a 503(c)? The website doesn't seem to have too much info about where the donation goes.
Maybe think of it more as an opportunity to remember how we've let ourselves be lulled by this behemoth. Google itself is pretty much a spof for most of the world. If Google is down, so is business.

Of course, the report afterwards will be very interesting, while we pick apart the reasons on what and how it failed.
Once you need more than one machine, more than one engineer, and a desire to use existing tooling.

K8S is a platform to build things. Because of this most of the amazing features you have access to are built by the community (service mesh for example).

Docker Compose is a mess once you have 10+ services with each having different containers backing it.
That unpredictability is the reason for a demand planner. They basically act in a similar role to a project manager, except over the demand forecast for a product portfolio. SAP (the ERP system) snakes it's way through the entire company, from sales to transportation to sensors directly on factory production lines. SAP can be configured with various forecasting models that use all that data as input, and the demand planner is a steward over both that model and all the inputs in there. And accounts for fuzzy stuff like unusual spikes anticipated from marketing events, or other macro level market happenings that require manual intervention or adjustments to account for.

All of the hard stats happen within SAP, and the demand planner really just fiddles with the knobs til the output "feels right". While there's likely a team somewhere in the company that is responsible for the statistical models themselves, the demand planners rarely touch them directly or even truly understand them. They just work with whatever is configured in the system for them, and if it doesn't feel right they might fiddle with and override the output until they get to a forecast that makes all the stakeholders happy.

I started my career in this area. Specifically, working on a process improvement team in a company with a top ranked global supply chain, working on validating novel approaches towards demand and supply planning. I'm far from an expert, but got intimately familiar with the underlying systems and processes in this area. If there's anything in particular you'd like to know, feel free to reach out!
I believe the problem is the "message bus" is pretty slow, and has pretty limited throughput, especially for something like audio and video.
It's not outdated; it remains fundamentally true. But I'm uncomfortable with people calling it a "legendary rant" because it was dashed off and I never promoted it as any kind of last word on the subject. There are better arguments against browser cryptography than mine.

In particular: you'd hope that WebCrypto would have changed things a bit, but, of course, it doesn't: it leaves all the cryptographic joinery up to content-controlled code. You're probably somewhat less likely to have side-channel flaws if you use it, but in reality timing side-channels are more talked about than seen. Who would bother, when they can just deliver a script that exfiltrates secrets directly?
Consider seeking connections with the US Peace Corps. I spent theee years teaching basic computer literacy to high schoolers in Burkina Faso as a volunteer. I also helped to set up two school computer labs using donated hardware from sister schools in France. Sadly PC is no longer in BF but I may be able to help you find other connections if you are interested. Email available via website in my profile.
I wouldn't say slow learners are typically the problem. From my experience in teaching it's the students with lazy habits that tend to break down the professors' effectiveness. People that refuse to "learn how to learn" and expect everything to be googled for them can be difficult to filter for during the interview process and really cause a drag on the class as a whole.
https://github.com/NaomiProject/Naomi
Fastmail doesn’t even provide encryption in the first place, does it? There wouldn’t be anything to backdoor; you’d still be pgp’ing yourself
As a user, I really appreciate how the WebKit team approaches new features in such a measured and careful way. New shiny things to use are great but I’m more than willing to wait if it helps to prevent glaring oversights. There’s no benefit to rushing these things in.
I've been a customer of theirs for less than a month. In that time I've had several problems.

For example I rebooted a host, and it didn't come back. For 10 hours it was down. After getting in touch with their support I was told "Oh yeah, there is a problem with the hypervisor, we'll fix it". Meanwhile their status-site showed "zero problems". (The next day it came back.)

Provisioning a stock (Debian) system results in a host with no working serial console, which makes it hard to rescue.

You can't make outgoing SMTP (25/587) access without giving them copies of passports, etc. Though if you enable IPv6 you'll soon discover outgoing SMTP works ;) Only downside there is you can't set reverse DNS for your IPv6 address.

(Reverse DNS? They require the forward address to point to you before they'll let you set it, as a "security measure".)

I'm using the host for offsite monitoring, but we'll see if it stays. Cheap, but perhaps too cheap.
Another one:

1603376: B737 Captain reported the flight recorder light was inoperative, which led to the discovery that the flight data recorder was not installed.

Can anyone anyone with more experience with this say whether this is normal for a new aircraft? I get that it's easy to forget parts of the assembly process, but how do you put an aircraft into service without verifying that all the parts (especially important parts like this one) are installed?
This is an anti-collusion measure against birthday attack.
The effect is exponential.
> Why wouldn't you instead endow a scholarship for students of your favorite college?

Many people do. They also give money to improve football facilities, bring speakers to campus, and endow a chaired professor position.

> I don't donate to Wal-Mart, so why would I donate to University X?

Because a university is a nonprofit that exists only for the purpose of improving the world. (Not necessarily the employees, who work there as a job, but it's why universities exist.)

You probably don't see a lot of donations to the University of Phoenix or other for-profit universities.
And there shouldn't be, which is why efforts like this are necessary.
No empathy. The entire system is pay to play for the social connections. If they were actually interested in education the scenario would have been completely different.

I saw similar fabrications growing up as I attended one of the wealthiest high schools in the country. The top 10 of my graduating class got complete scholarships the most expensive schools in the country and the parents were willing to do anything to the school faculty to make sure their child had a higher class rank.
Ah, yes, indentured servitude, a brilliant suggestion for uplifting a population out of poverty!
Python Stdlib Gems: Collections.Counter
But again, that’s rhetoric, not casual conversation.
Yeah, assuming these true things.
Depends on what you mean exactly.
An Introduction to ZSH Utils
At most, you’d have to propagate a <‘_>; the lifetime is part of the type and showing it matters for the same reason showing any other type parameter matters.
> Make the difficulty of getting employed and earning an income as easy as possible, and the jobs and work will follow.

Why should they? Demand elasticity is empirically very low for minimum wage workers. Lowering minimum wage a small amount does not create jobs, just as raising it a small amount does not eliminate them.

See: the inverted funnel plot of Doucouliagos and Stanley

https://static01.nyt.com/images/2014/02/18/business/economy/...

https://www.ctdol.state.ct.us/lweab/Doucougliagos%20&%20Stan...
GCS might be relying on the same system as Gmail/YouTube does, so it’s not necessarily GCS itself. Spanner?
GraphQL Foundation Formed
"Brains appear different in an MRI" is several steps removed from behavioral differences.

Height is 0 steps removed from height.
Down in Singapore
> And my claim is that if your threat model depends on an attacker who can afford $20M being unable to afford $40M

But is it? I think the underlying claim is that 2X difference doesn't matter, which is patently false.
> s3 costs of docker image with nothing but the base os

An alpine container is in the middle double digit MB range and will be reused in all other images using it. The space costs are trivial. Furthermore the base image is hosted on Dockerhub and last I checked you can host up to 3 images privately on Dockerhub and unlimited in public.
This doesn't really answer your question, but I wanted to sketch out how I think about the blank slate (or something like it) since it seems like you're engaging sincerely with everyone here.

1. Since networks in general like to produce complex emergent behavior, and our understanding of brains and behavior and networks and emergence are still fairly limited, I deal with the uncertainty by looking for sane default positions (i.e., a position to hold in the absence of comprehensive evidence otherwise). I'm not sure if it's obvious from a distance, but in practice default positions are an exercise in intellectual humility.

2. I am working on a sort of razor. I don't know what to call it, yet. When it comes to animal-kingdom behavior, a good default position is to think of any observed behavior as being in the possibility space of the broader category until the evidence against this is overwhelming. If we see one crow use a tool, assume tool use is in the crow possibility space. If we see another corvid do it, assume it's part of the corvid possibility space. If we see some non-corvid avian do it, assume it's part of the avian possibility space. If we already know humans do it, assume this goes back at least to our last common ancestor with birds.

If all of the nurses anyone has ever seen are female humans, it is fair to think of the occupation as part of the female human possibility space. If anyone has seen any non-female human nurse, it is prudent to think of the occupation as part of the human possibility space. If anyone has seen a canine nurse, it is prudent to think of nursing as part of the mammalian or animal possibility spaces.

Once you know a behavior is in the possibility space, another good default position is: assume everything known to influence any other behavior in that possibility space is involved, until the evidence against is overwhelming. Why do humans choose to become a nurse or not? Assume family, society, friends, money, justice, punishment, education, teachers/mentors, status, media, profound experiences, mate-seeking, curiosity/interest, talent, chasing neurochemicals, instinct, charity, hormones, tradition, biology/neurology, etc. play a role.

While it's certainly possible that the male/female nursing delta is caused by genetic sexually-dimorphic destiny, the default position suggests it isn't prudent to give this any more weight than the other possibilities until some can be ruled out or sexual dimorphism is resoundingly demonstrated to be the primary causal factor.

3. As the evidence for human neuroplasticity continues to accumulate, it seems at least plausible that our brains are significantly more plastic than we currently realize.

Likewise, as the evidence for complex behavior like tool use and learning in non-human species accumulates (including fish, reptiles, and insects), it seems at least plausible that reasoning, problem-solving, plasticity, and flexibility are vastly older (and more basic/common) than we thought.

Given these, it seems like a decent default position to assume that complex/unique behavior is more likely (but not necessarily) plastic/flexible than hard-wired.
I am not affected by this outage but I get a bit angry when I think about how many people are. In a better world it would affect much fewer people.
The UK doesn't need a wall -- it could have an open border if it wants to (right?). It's Ireland that would have to enforce a border. Unless there is some other binding agreement at play.
Looks like another DC-10 PR disaster in the making.
Not the OP but I think you're still missing his point. The argument is that it is fundamentally wrong headed to argue that the process of realizing software on actual hardware is incidental or not part of the actual problem in the same way that it would be wrong to argue that the laws of physics are not part of the actual problem for engineering.

If you're building a road bridge you could say that the actual problem is getting vehicles from one side of the river to the other and not the engineering details required to realize a physical structure capable of doing that. Things like the tensile strength of steel would be no more important to the bridge builders than mere memory allocation is to the average programmer in a GC'd language. You could also argue that taking that approach would lead to bridges that fail as badly at their primary function as much modern software does.
Sec of Defense is an ex-Boeing man.
According to GA, on our site, FF is the most used browser, followed by Chrome desktop. 3rd is Chrome mobile and then Safari mobile, tablet, desktop. Only after those, it's IE11 and then Edge. Uniting mobile, tablet and desktop still makes FF 3rd with a 6% lead on IE+Edge.
160 comments in "Boeing 737 Max pilots complained to feds for months about suspected safety flaw" https://news.ycombinator.com/item?id=19373216
Ask HN: How can I learn how to paint?
Hiya,
Just wondering if anyone has any advice/anecdotes about learning how to paint?

I saw a thread a while ago about working with stained glass that got a lot of interest, and thought maybe the folk here might know a thing or two about this as well.

I have really gotten into looking at the works of impressionists ( https://artsandculture.google.com/entity/m03xj1 ) like Monet and Edward Hopper's early work, and would love to try my hand at it. If anything it would be to get more of an appreciation for the art, and as an emotional outlet after writing code every day.

I am pretty independent and would like to do as much as I can myself before going to a course and wasting someones time trying to understand things I could learn on my own, and have a better foundation for learning.

Any input would be greatly appreciated.