skysight-inc/HackerNews huggingface dataset:
I always see you comment negatively when Microsoft is mentioned. You also make comments that clearly indicate your Windows experience is not practical (meaning you maybe read about Windows minutiae far more often that you actually experience or understand them) and those comments COMPLETELY undermine your effort to bad-mouth Windows.

This article (which you clearly didn't read) makes no mention of this change happening to Windows 10, but a ChromeOS-like "Windows Lite" instead, and if you are capable of controlling Windows "tightly" then you would definitely know how updates can be managed in appliances or devices that run a version of Windows designed for those use cases.
Small Talk Is Tough for Finns. So They’re Taking Lessons. ‘I Love Your Shirt.’
Will this be good to study for a FAANG interview?
Why does it need to send your OS and browser version to check for updates? Couldn't it just look up whatever the latest versions are?
Say what you want about air travel security but the TSA has figured some stuff out. For all of the behind the scenes employees, working in what’s known as the SIDA (security identification display are), there are protocols that must be followed. Most are what seems like security common sense but to really drive the point home there are stiff financial penalties for not following them. Typically the employer will pick up the bill but ring up a couple of them and you better start looking for a new job because you’re definitely going to get fired.

I think some kind of strike system is completely reasonable and if you’re working on sensitive information or systems then phishing most definitely needs to count as a strike.
Yeah, I'm sure the policy is more or less "confront if you wish, otherwise contact security immediately."
> Nobody thought this was unreasonable.

How could you ever possibly know that?
I loved DownThemAll, but I'm not sad to see it go because I realised how rarely it was actually needed these days. The downloading interface built into Firefox really is fine 99% of the time.

On the rarer occasions that I need to download extremely large files, I send them to an HTTP download client (pyload) that runs directly on my NAS in docker.
For now, Boring company uses the $50mm to subsidize their R&D cost as they move up the “learning curve” toward the realization of an order of magnitude in cost savings.

I would guess the engineers at Boring have a list of a hundred things they think they could do differently that would lower overall cost. I imagine the biggest ROI is automation which removes humans from the vicinity and therefore the presumably huge cost of allowing humans to safely coexist with the machine while the tunnel is being dug.

Boring will surely spend a lot more than $50mm building this thing in Vegas. Investor dollars (which in this case I think is mostly checks from Elon) make up the rest. But rather than subsidizing glorified taxi rides like investors in Uber/Lyft where the learning curve is questionable, here the theory is there’s a lot of learning to be done in construction of a reusable and highly automated boring machine that isn’t just entombed in the tunnel at the end of the project.

I think the biggest cost savings initially is smaller bore tunnels using much smaller scale transport pods (e.g. reworked Model 3s).

Also, who else would be able to develop the custom small scale transport pods or the autonomous software that they will run on for just this project? Elon has access to all the Tesla IP as a starting point. They can build TM3s without the steering wheel or pedals pretty easily, and they already demo’d the software for driving in the tunnel.

Handling the pickup, drop off, and coordinating multiple vehicles I’m sure is not trivial but depending on exactly how they design the loading/unloading zones could be contained.

I’m just as interested as anyone in how they will be handling safety, and particularly what happens when a vehicle ends up stopped midway in the tunnel.
People who have different experiences or preferences than yours are not 'disingenuous'. You're hardly going to convince anyone to try FF by calling them liars.
TS 3.4 has known performance regressions. 3.5 helps, but it's still slower than 3.3.

I don't really notice it, though, because I've got `tsc --watch` running in a terminal continuously as I edit code.

When tsc sees edits, recompilation competes in tens of ms. It's really quick.
Dunno. It's a per peeve of mine when people take a non-speakerphone call in a common space. Trains, cars, meals, or living rooms.

It monopolizes the noise in the area and puts everyone else in some sort of awkward space where they have to eavesdrop and pretend they aren't. Sometimes I think about obviously watching a train commuter have a long and loud phone conversation, but I don't because it would be rude and aggressive.

I guess hired cars are a little different in most respects but people can still feel bad or awkward for listening in on something they aren't part of. Especially if the conversation is loud, personal, or confidential.

It's much better if the phone call is urgent, short, or important. But even then it's polite to be conciliatory as the phone call is made or picked up.
Thank you thank you thank you. Honestly, this whole article had the veneer to me of "Ahh, poor silly economist..." I'm not sure if there is a great word for it, but I call it the "humble-brag equivalent of obnoxiously condescending"
Companies That Crack the Code for Coders
No, I don't think that is correct. You can still stop a web request, but you can only stop it by providing chrome with a list of url patterns to block. The current method passes the url being requested to the extension, which can then decide to block it or not.

The new way has the extension give a list of patterns to block to chrome, and from there it will block any request that matches.

The stated reason is that this is for privacy, to prevent extensions from being able to gather data about every request a browser makes. Currently, a malicious extension could send every url a user visits to some central collection server. The new way prevents that.

Is the trade off worth it? I personally think no, but I do think many people don't realize that as blockers have the capability to collect every url you visit if they wanted.
Yep, this. If you the reader are using a Chrome-based browser and find Google's behavior disconcerting, you need to switch away, now.
Do you think all Mozilla employees are Engineers working on Firefox?
I've been a Firefox user throughout - never made the switch to Chrome.

But here's what worries me, what I'm wondering now: As far as I'm aware, Mozilla/Firefox tried to follow Google for extensions, deprecated their own API for Google's/Chrome's instead.

How likely is it that Mozilla will further "follow the spec" so to speak, doing a change like this for compatibility or whatever?
I only use chrome on my work computer now, and even there I use firefox for logging in to my personal gmail.

My son just got his first computer -- a windows pc. He has edge and firefox installed, but no chrome. I told him he cannot trust google :( and should avoid their software as much a possible.
Congrats on the 1.0 release! This is an impressive library and am curious on what the future roadmap looks like for FunctionScript?

Also any plans on releasing more examples that are consumable via stdlib?
Maybe with caffeine you may have problems but with most other stuff you will most likely feel better.
I felt like I gained 25 years when I got a knee injury. Now my knee clicks and hurts, preventing the activity that had kept me thin.
Perhaps the elusive Google Ultron.
Mozilla had XUL, which was basically electron a decade before electron.
Plaid has registered as an AISP ('Account Information Service Provider'), which means that they can register for and use the Open Banking APIs provided by UK banks.

These APIs use an authorisation flow similar to what you see when you 'Login with Google' or 'Login with Facebook'. At some point in that flow, you are redirected to your bank's web site to allow access, and to select the account(s) for which you are allowing access. At this point, you are on your bank's web site, you can check the URL to make sure you're not being phished.

On the face of it, it seems like any company that's building on top of bank transaction data should just register as an AISP themselves, as the integration with Open Banking APIs doesn't look that complicated. But Plaid is one of a number of third parties that insert themselves in between.

In general these services suggest some combination of (i) easier integration, i.e. less development and maintenance, (ii) additional intelligence on top of the raw data, e.g. categorisation of transactions, (iii) no need for maintenance.

There's one obvious con: the AISP's logo has to be shown in the authorisation flow. So, even if your users know you, they might not be willing to share their information with 'Plaid' or whichever third party AISP you've chosen.

I don't know how real the development/maintenance/integration issues are. I could imagine that registering with 30+ banks and testing your code against all of them might be a hassle. But if their API backends all behave in the same way, then maybe you just need configuration parameters for the endpoint and token(s). If their backends have slightly different behaviour, though, then perhaps you need to branch your code based on the bank.

One thing that's encouraging about Plaid entering this space: their free tier appears to support up to 100 bank accounts for free. This should be enough for anyone who wants to set up their own self-hosted Mint equivalent. And, if all the accounts are in the UK, then you're giving Plaid just read-only access to your accounts, which is much less of an issue than providing your login credentials to them or another party.

In case you're curious to see which other companies have registered as AISPs or PSPs (payment service providers), the full list of third party providers is available here: https://www.openbanking.org.uk/provider-categories/third-par...
HTML and the menagerie of related standards has never, as far as I'm aware, become simpler. And the old versions have never been removed from a browser.
As a layman I guessed as much, but wasn't positive. Clickbaity title.
A group of early ex-Facebook engineers/directors have recently collaborated with Software Engineering Daily to produce a podcast series about the engineering philosophy behind the core product. I think these talks are a little more raw and direct than you would find from official corporate talking points. https://softwareengineeringdaily.com/category/all-episodes/
Probably not going to go the way you're pulling for.

In case you haven't been paying attention, there's a lot of new age mysticism floating around that seems to take root in:

- hallucinogens (aka: entheogens)

- multidimensional realities

- interdimensional beings

- time travel

- psychic powers, like ESP

- out of body experiences

- paranormal reincarnation

- extra terrestrial meddling in the origin of life on earth

- CoSM artwork by Alex Grey
I'm not sure this is quite a takedown of the author's point. In fact, I'm surprised at how many people on HN seem to be misunderstanding this.

The author is saying that physics puts a fairly solid cap on the amount of power we can produce on earth. That's the basic point.

What does a finite energy-consuming, exponentially growing economy look like?

If we accept that all economic transactions consume some energy, and the economy is growing (so the number or the value of economic transactions is increasing), then once we've hit our physical constraint on power generation, how does growth continue? Only if the energy required per unit of transaction-value continually decreases. So the price of energy must continue to drop, measured by the relative to the value it provides.

The author then points out that this is a contradiction because the price of energy would have to rise, and therefore that the problem is in the assumption of continuing exponential growth.
Let's take a step back, here. Climate change is real and I'm sure it will make West Texas slightly more uninhabitable, but that's not what you originally said: you said that they should genetically modify their kids to breath less oxygen, which is almost completely useless against climate change.

I corrected you because one of the biggest weapons in the arsenal of climate change deniers is taking an incorrect but tangential argument and tearing it to shreds, and then pretending they tore the entirety of climate science to shreds. Bad arguments on our side are a massive liability.
I think there's a fundamental conflict of interest allowing corporate-backed editors to slip in photos of their logos like that. I don't think it's something that Wikipedia should endorse (and remove when they find it).

I don't have a problem with the logo itself. I have a problem with the motivations behind a corporation having the power to manipulate the information seen on such a global resource like Wikipedia that has almost nothing to do with their company.
It's all easily available online. Don't rely on anyone to give you the full truth on anything they are trying to sell you.

I am sure I had this conversation with you months ago, actually.
The PDP-6 Monitor came out in 1964 and TOPS-10 was its lineal descendant (the result of progressively modifying the codebase to support different PDP-10 models), whereas the first PDP-8 model came out in 1965. OS/8 first appeared in 1971; I haven't been able to determine when its direct ancestor PS/8 was released. I ran some PS/8 programs under OS/8 V1, but I never ran PS/8 itself.
You omitted the "If you think the issue is that clear-cut".

I don't think it's clear-cut.
The Seattle Times has a great app for this. That said, if you don’t live in Seattle, not all the news will be of interest, but they’re a great model for what a good newspaper / news site is.
For sure, it's entirely appropriate for the abstract, but it bears pointing out to an audience who might not be familiar with that usage.
I don't see why I wouldn't use Firefox itself over a closed-source fork with no visible advantages.
I always press the frowny button in grocery shops, not necesarily because there were long lines or because the shelves weren't stocked adequatly, but if I press the frowny button I assume the place will get even better.

I disagree with those buttons because you can't really find the cause of a problem in a giant macihnery with just a single output. So the feedback is probably close to useless.
My theory is that they have more people who understand and respect software design in higher management levels compared to other companies. So it’s easier to do good work without constant pressure from the “business” people to take shortcuts.
Spirit island
I'm willing to stay if we can get something mutual. Mineral rights payouts, or an end to Adsense bans.

Open source the platform behind their entire revenue.

What? They scared or something?

I know they have investors, and research into new medicine and energy depend on consumer driven revenue.

Instead of:

"In the long run, we are all dead."

I see it as:

"Until further notice, unless someone gets really really good at math, we are going to die in horrible horrible agony. Loosing all your wealth is the last of your concerns."

Burn the boats. Get that hunger back.
Well, your comment is also a pretty disparaging and reductive idea of what UX is actually like. I'm sorry you've met people in UX by title only, because what you described is nothing like the actual field. If someone claiming to be in UX isn't doing research and testing, it's not UX.
Where do you live? Can you do all these things (hunting, foraging, riding horses, karate, climbing, ice skating, etc.) without paying? Does that mean you live on a bunch of land? How far do you have to drive for these things? How did you find these meetup groups?

It sounds like a great setup, but it also seems difficult and expensive to me at first blush.
I think there is a more basic need for cravings which could be the shortage of minerals, iron deficiency causes some cravings:"Craving and chewing ice (pagophagia) is often associated with iron deficiency, with or without anemia, although the reason is unclear. At least one study indicates that ice chewing might increase alertness in people with iron deficiency anemia." https://www.mayoclinic.org/diseases-conditions/iron-deficien...
> Waterfox does not collect ANY telemetry, meaning you don't have to worry about any tracking or usage information about what you do inside YOUR browser.

This is woefully uninformed or malicious. There's a lot of tracking that is out of your hands. Such as canvas fingerprinting. Even sending back 0's (like tor does) doesn't prevent fingerprinting. In either case I lost confidence for the browser just by reading what was on their landing page.

Either they don't know that tactics like this are common, which means that they likely aren't aware of other basic security flaws. Or they are aware and lying, which begs the question of how we can trust anything else.

In either case it doesn't build trust for a tool that is so highly dependent upon trust.
Google bans apps that facilitate sale of marijuana
Yep, I'm about to ditch Chrome altogether now. I gritted my teeth and just handled a few of the more bone-headed changes the Chrome team made, but this latest change is a deal breaker.

The truth is, I actually don't need Chrome for anything. Firefox is faster now, gives me more freedom and has less corporate affiliations. I'll stick with Mozilla.
> "I'm still waiting for a way to hide the tab bar which is a privileged UI feature now"

userChrome.css to the rescue:

- Tree Style Tab's wiki offers tips to do exactly that: https://github.com/piroor/treestyletab/wiki/Code-snippets-fo... .

- Or you can combine the address and tab bar: https://github.com/rstacruz/firefox-stealthfox

If none is to your exact taste, https://www.reddit.com/r/FirefoxCSS/ may help.
And economists measure inflation by the prices of goods...
Could be instinctual knowledge too. How does a new born know a nipple has milk.
I really like your comment. As a scientist I'd say that a pragmatic solution (widely used in experimental sciences) is to calibrate your measures.

Want to use a yes/no? Fine (maybe 7 stars give better feedback, maybe not). But what should be the business decision based on the answer? How valuable is a yes? How costly a no?
There's a mountain of difference between "can" and "will", and it's called "trust".

For decades, people have been using software on their PCs which can essentially delete all their data or worse, yet what are the chances of that actually happening? Of course malware would exist, but at the same time, the unrestricted nature lead to a seamless exchange of data and creativity unhindered by any bureaucratic permission-maze.

A world of "perfect" security in which malware and cybercrime cannot exist is basically a dystopian police state.
The Mozilla Foundation's education programs and the dozens of other things they do are actually worthwhile enough to justify donations, IMO.
Having just spent several months preparing for FAANG interviews myself, I would say not - these go far beyond the data structures I'd expect an interview to cover at most tech companies.
3Blue1Brown has a great video on quaternions:

https://www.youtube.com/watch?v=d4EgbgTm0Bg
Not sure why your comment was dead, so I vouched for it and decided to include a link to back up your statement.

http://freakonomics.com/podcast/student-debt/
Isn't this the source code? https://github.com/MrAlex94/Waterfox
Yes :).
But in either case, if the browser is advocating for "no data collection" and "no telemetry" I would at least expect no referral links or Google Analytics on their homepage.
A simple and encrypted password cache in less than 100 sloc
You could just add more intrusive ads to your site. The site owner will be thrilled, and the users not thrilled at all. It would work very well for all concerned!
Abusive. Monopoly.
Coincidentally, the inflated subjective scores from game reviews tends to match the percentage of players that rate a game as "recommended" on Steam.

The median rating on Steam is about 80% positive (meaning 80% of players who rated it would recommend it). A game with a 70% Steam rating tends to be mediocre.

It's interesting that even though a rating system where you choose between "recommended" and "not recommended" is much less subjective than trying to rate a game on a scale from 0-100, in aggregate, you get similar scores.
Sslvpn on Fortigate Firewall
Are you anxiously awaiting your turn, then?
Agreed, I set up a news site recently, currently focusing on the tech industry. [1]

Very deliberately didn't include anything I personally found annoying (I'm pretty easy to annoy with bad UX)

Absolutely despise chonky sticky headers/footers.

The problem is, these kinds of measures work. As in, if I put a footer that pops up as you scroll down reminding readers to share or subscribe, I'd have more of both. (I can dig up the evidence if required. Off the top of my head there's a presentation from someone like buzzfeed or upworthy that showed double digit percentage improvements with mildly annoying practices.)

I disagree with the author's contention that using those methods mean you fail. Publishers use them because they work.

[1] e.g. https://unlikekinds.com/article/uber-code-text
My argument is that the kernel gives us namespaces, seccomp, selinux, apparmor, etc for isolation and attempting to implement all of the path resolution and permission checking from a privileged context outside of the container defeats all of that and requires reimplementing all of those guards from userspace, which feels futile. By using tar, you're left with serialized path strings and file contents rather than file descriptors, and it should be far easier to sanitize those strings than deal with the linux filesystem API.

I definitely recognize that the container process could ptrace the tar process, and with kubectl cp, it's even directly using whatever tar binary is in the container so tar could easily be malicious from the start, but what it can never do is break out of the container onto the node when the tar file is not being extracted onto the node using the docker daemon's prvileges, which is extremely important for multi-tenant environments.

If you executed your example command as root on the node, then yes, a vulnerability in the node's tar implementation could allow a malicious tar file to take over the node at extraction time, but tar does guard against this by default, as do standard posix user permissions: the tar extraction can happen in a completely unprivileged context.

I do view tar's extraction as a valid attack surface since modern tar implementations are complex, however, that would require a tar CVE and there's no reason that `docker cp`'s output target handling is any less vulnerable to the same problems. I really think the most important thing to guard against is at input time.
In practice there's often a way to escalate privilege. Defense in depth requires that one be good at each layer. Being good against phishing attacks is important even when the victim has apparently-inconsequential access.
Baseball Trajectory Calculator – 3D version (2018)
MicroLEDs: The Next Revolution in Displays?
Even if there is some limit to economic growth in the distant future, is that necessarily a bad thing? It might be that, by the time we reach this limit, society would be so prosperous that we would see no reason to exceed it.
I can't fathom how it arrived at that answer?