skysight-inc/HackerNews huggingface dataset:
5 yrs. So, 2,000 replacements a yr - that's alot of rockets.
They tend to be language or framework specific. e.g. for Ruby/Rails questions I haunt the GoRails slack and a couple of Ruby/Rails specific subreddits.

In quite a few cases the official dev forums for a particular vendor or technology are actually very active, and I think that's because forums just got a lot easier to implement. For example I get a lot back from the Apple Developer forums (not the public discussion community, which is hot garbage) and Vue.js's own forum.

A fair chunk of what I previously used Stack Overflow for (finding code snippets to learn from) has been replaced by the ease of browsing public repositories on Github.
Nah. It's the belief that we shouldn't venture out because we're not perfect that's kind of Inverted Manifest Destiny - the belief that universe is divine and we need to be worthy to partake in it.
As far as I understand it, if the DOJ and the Inspector General are all on board with whatever is being done, then realistically there’s no way to get it in front of a court or the court of public opinion without risking being charged for disclosing classified material all the way up to treason.
By "new Vive", you're referring to the Valve Index, correct? The Valve Index is designed and produced by Valve (creators of the Lighthouse tracking system used by the HTC Vive and the Valve Index), not HTC (which produced the Vive and Vive Pro).
I'll amend my previous comment to say that I only dispute much of the analysis, not "the whole" analysis.

A sibling comment makes the obvious point that no pre-auth endpoint should be touching this kind of data to begin with, which is another layer of "stuff you can just regex for".
> everything is a zero-sum game

This is a flagrant and dangerous misunderstanding of reality. The history books are filled to the brim with examples of developments that have brought net-positive benefits to humanity.
I'm willing to bet that the Gelllman Low equation outshines his other work in the long term.
There are real world cultures that use general-to-specific for addresses
> any command could be undone since nothing was truly destructive

As the article mentions,

git reset --hard

will blow away uncommitted changes in your working tree.
Delayed game > rushed game > game that never ships at all.

One of the key challenges is that it is so hard to distinguish the first case from the last. In practice, there are many more games that never get finished than those that do.
A few personal usage tactics I’ve been experimenting with, since I’ve been dealing with smartphone overuse since 2005:

1) No social media apps.

2) Four icons on the home screen (for iPhone, go to this site: https://david-smith.org/blank.html click share button and add to home screen. Change wallpaper to black. Each black icon you add to the home screen will take up a space where an app would have been, helping you focus on apps that you find most important)

3) Airplane mode when I’m on vacation (so I can still use the camera but won’t be tempted to reply to a text).

4) Few notifications other than calendar, phone, and text. Absolutely no email notifications. Selective and timed Slack notifications since I’m often mobile and don’t want to be the bottleneck at work.

5) No games.

6) Limited video use. Overuse hasn’t been a problem, so I don’t set hard guidelines on this.

7) Leave phone in car [clearly I don’t live in SF] or at home during scheduled time with loved ones.

8) Wear cellular Apple Watch and carry AirPods in pocket when leaving phone at home - if there may be an important call coming in while I’m intentionally preventing myself from working while mobile.

9) Keep phone charging at night in bathroom on do not disturb. No checking during middle of the night bathroom usage.

10) Limit non-essential apps to informational apps - like HN.

Smartphones are tools first or they can be toys first. That depends on the goals and discipline level of the user.
I know, but as they're easier to guess, what's the point? Might as well just go back to ints.
> I'll amend my previous comment to say that I only dispute much of the analysis, not "the whole" analysis.

That's fine, but I'd appreciate it if you just read the entire analysis next time. It shows that you respect the time people invest into constructing and presenting guidance, even if you don't necessarily respect the guidance itself.

---

Editing mine to match your edit... as if to make my point about reading the analysis in its entirety:

> A sibling comment makes the obvious point that no pre-auth endpoint should be touching this kind of data to begin with, which is another layer of "stuff you can just regex for".

Correct, something which I'd also stated:

> Checks including linting for specific privacy defects (direct object referencing using sensitive data or iterative identifiers as opposed to hashes/guids/etc) can help with catching them during development, and as you might've guessed, such checks tend to be custom for a given environment rather than out of the box.
I'll go ya one better and say maybe forget your purpose entirely. Not in a negative, nihilistic way, but in kind of a Zenny way. You think Floyd here thinks about his purpose? Well actually it seems like he has decided "my purpose is to care for these people on my route," so maybe that's a bad example for my point. Although it's worth noticing, HE decided that. Which proves, it's totally arbitrary. Meaning is wherever you ascribe it (and probably nowhere else).

Mainly the idea is not to let "purpose" be a logjam that stops you. Life will happen to you regardless. Lately I've been trying to free myself from the endless quest for (please use whiny voice, knit brow earnestly, hold upturned fists close in front of you, and wiggle them slightly while saying) meeeaning. It stymied me for a long time. But it has to be seen for the ego trip it is. It's a "get over yourself" moment. Rein in that fanciful and conceited ego that's always wondering what great and high purpose your magnificent and important soul was cut out for. All that pressure! Letting go of it is a bit of a death (ego death). But jeez what a relief. It frees you to do whatever you want, which ironically is the only way you might actually end up going on to do something worthwhile. (Worthwhile according to you.)
>My 2nd ever comment on hacker news, and already someone has managed to segue from my innoncuous comment into an attack on feminism.

No. They were trying to empathize with your previous point that working and dealing with the public is an exceedingly difficult thing to do.

They could have picked a better video to do so, but they picked one that was a viral meme that was everywhere a few years ago. It went viral because of the terrible behavior of the person towards the mail carrier -- feminism is only mentioned because whoever reposted the video on YouTube for the umpteenth time decided to title the video with regards to the dialog that the person is spouting towards the mail carrier -- dialog which has to do with gender, stalking, etc.

I'm not qualified to diagnose the person in the video as a schizophrenic, so I didn't. I'm not calling her a feminist, because she didn't call herself that. Some guy who posted a YouTube video inserted that narrative about feminism, and you inserted the narrative about schizophrenia.

This could have been a video of a mail carrier receiving any kind of abuse from the public and the parents post who you replied to would have had the same message as they intended with this one -- mail carriers receive a lot of abuse from the public.

With all that said : I hope you stick around. There is good discourse here.
Maybe not "wrong", but there are some very obvious downsides to exposing sequential IDs vs a randomized token:

- It exposes the count you have of a particular item

- It exposes your growth rate of those items

- If a developer accidentally breaks your authentication (or somebody hacks it), it becomes trivially easy to download all your items very quickly

And it isn't like using a randomized token is hard. In the most common implementation, it is just one additional column that gets filled with a random string and an index on the column.
Come on, Buzzfeed. One source says 3 billion and you say 2 billion. Get your shit together.
The good news is that the broker isn't screwing them.

The bad news is that the reason for that is because the broker doesn't have to screw them; they're uninformed noise traders buying and selling in basically equal measure. The traders buy at $1.001 and sell at $0.999 as much as they want until they're blinded out by the spread, which the broker keeps.

The "savings" being passed along is just a reduction in the portion of the spread that the broker would normally use to protect itself against informed traders.
You can't really see it in my article there, I use a rolling cart with my laptops (Apple or Xiaomi depending): https://i.imgur.com/0OB23tw.jpg

Better look: https://i.imgur.com/ydgpMus.jpg

I avoid having a desk surface because it just gets overwhelmed with crap. This way I can't just set things down- they need to be put somewhere. Also I can move it out of the way for shooting YouTube videos, roll near the window when I want more daylight, roll near the printers when I am tweaking them etc.
Well, 1/0 - 0/0 = (1-0)/0 = 1/0, so the difference is 1/0. :-)
That's a disingenuous interpretation which just bakes in your desired framework. What actually changed is that abstraction increases the disconnect between making money and generating wealth. Much of that parasitic "taxman" class now claims to be in the private sector.
Show HN: Scriptlet to remove greyed out comments on HN
Hello everyone,

I frequently send the comments from an article on HN to a TTS software I use on my iPhone called Voice Dream Reader. The only problem for me was listening to a greyed out comment and its children. Although valid discussions can be had in these situations, the majority in my opinion could be eliminated, so I created a scriptlet to do just that.

I decided to share it here in case someone else finds it useful:

javascript:void%20function()%7Bvar%20e=document.getElementsByClassName(%22commtext%22),n=0,t=0,a=!1;for(i%20in%20e)n=e%5Bi%5D.parentElement.parentElement.parentElement.children%5B0%5D.children%5B0%5D.width,1==a%26%26(n%3Et%3Fe%5Bi%5D.parentElement.parentElement.parentElement.parentElement.parentElement.parentElement.parentElement.hidden=!0:a=!1),0==e%5Bi%5D.classList.contains(%22c00%22)%26%260==a%26%26(a=!0,t=n,e%5Bi%5D.parentElement.parentElement.parentElement.parentElement.parentElement.parentElement.parentElement.hidden=!0)%7D();
Excessive desire for money and power alone is generally viewed as anti-social and possibly even pathological.

Of course, figuring out what is "excessive" may be contentious, especially if one also has other good intentions that come along for the ride and help balance things out (e.g. philanthropy, strong ethical boundaries).
Yeah, no, I think you got this wrong, but more than that I was motivated to comment by the implication you made that these were "easy to miss" vulnerabilities because bullshit security tools that don't work miss them. I don't so much care whether you're right or wrong, but I do want to take every opportunity I can get to disabuse people about the effectiveness of scanners.
The author's explanation is based on how the rationals are defined explicitly but this leaves the question open whether the rationals couldn't be extended somehow, so that the inverse of 0 is suddenly defined in this extension. More generally, couldn't there be other fields where 0 has a multiplicative inverse?

Of course the answer to both questions is negative but it's the consequence of a much more general fact: In any field the additive zero element can never have a multiplicate inverse. (If it did, the field's other algebraic operations would suddenly lead to contradictions.) And in this sense, there is also no difference between the expressions 1/0 = 1 · 0⁻¹ and 0/0 = 0 · 0⁻¹ because 0⁻¹ simply doesn't exist.

I've always found this explanation much more illuminating. No matter what you do, you can never have 0⁻¹!
Maybe some ideas here: httpss://www.owasp.org/index.php/Source_Code_Analysis_Tools

At work we use a commercial tool for static analysis. From what I have seen it is rather stupid, it produces a lot of false positive security issues about things like allocating memory (potential resource exhaustion vulnerability...)

You also probably want to pin versions of all dependencies, and store them in a repository that you control access to (a good idea for reproducibility, ignoring security).
> "easy to miss" vulnerabilities because bullshit security tools that don't work miss them

> I do want to take every opportunity I can get to disabuse people about the effectiveness of scanners.

This entire exchange is frustrating because it's exactly what I said in my root comment:

> these are also some of the easiest vulnerabilities to miss even with out-of-the-box static analysis (code scanning and data analysis), automated dynamic analysis (pentests [edit to clarify for tptacek: automated pentests]), and a basic code review process.

[...]

> Checks including linting for specific privacy defects (direct object referencing using sensitive data or iterative identifiers as opposed to hashes/guids/etc) can help with catching them during development, and as you might've guessed, such checks tend to be custom for a given environment rather than out of the box.

---

I'm going to step away from my keyboard a bit; please forgive me.
I think this gets to the crux of the issue.

It's not about using hard-to-guess UUIDs[0], but restricting access to the underlying data[1].

[0] https://en.m.wikipedia.org/wiki/Security_through_obscurity

[1] https://en.m.wikipedia.org/wiki/Access_control
> We don't do that for addresses in the real world. We don't say "United Kingdom, London, Westminster, Downing Street 10."

That's not a universal rule. It completely depends on the language. For example in Farsi (Persian) that is exactly how addresses are expressed.
If u get enough customers to cover the $.5Bil annual costs to keep replenishing the 12K Sats. And the sooner Starship is operational the lower the costs - loss of Falcon upper stage is the major cost.
I wonder if it would be more intuitive to display a projection of the 4D scene in 3 dimensions (then projected onto a 2d screen), rather than a 3D cross section of the 4D scene.
Python's creator thinks it has a diversity problem
We should all just be grateful they didn't copy the file and drive conventions from TRSDOS which was the operating system for Tandy's TRS-80 line of computers.

Like MS-DOS file names were 8 characters with a 3 character extension however the extension was separated not with a period but a forward slash. Also files could have a password which was separated from the name/ext by a period. Disk drives we're referenced by numbers, 0-7, and separated from the name/ext.password by a colon. For example copying a file from one drive to another could look like "copy ascii/txt.foofum:0 ascii/txt.feefum:1". If you wanted a listing of all the txt files on the current drive the command would be "dir /txt". The file system wasn't hierarchical so there was path separator.
Pretty sure these "bizarre mental problems" are a manifestation of rivalrous narcissism. Dismissing others in order to feel better about your own intelligence is a symptom of that. It sounds like he would like to be a heavy intellectual hitter but isn't, which is all I meant by relatively stupid.

Narcissism involves a kind of fraudulent, artificial self-image. Claiming something is trivial and then not being able to follow through on that is exactly the kind of bluster I'd expect from a narcissist. The slacking off fits the profile, and the "gets mad" is also a narcissistic trait.

To return to my original point: this is not about class origins, it sound's like it is about having a chip on one's shoulder about intellectual achievement. There are many other things that can play that role in narcissism, including coming from an underprivileged background.

It's really important to develop a proper analysis of these personality problems. The typical engineer has a blind spot in this area—they can see when there's an obvious problem but they don't try to build up a deeper intuition for the dynamics behind it.
Is there any actual content in this? It seems to start from the idea that Turing considered his machines as "what could be mechanically solved" and was referring to human "computers".

It then rambles off into quantum Turing machines, and briefly (literally mentioned in passing) discusses that the halting problem was replicated, and demonstrated to hold up, on QTMs as well.
Show HN: G-Fu – a pragmatic Lisp embedded in Go
It looks like an old fashioned natural gas heater? My grandmas house had something very similar, it was like a little decorated alcove with an open natural gas flame in it. The bag at the top probably covers what used to be an old vent or something?
Dog’s are also great for this, at least in the Bay Area. When I had a pup people were striking up conversations all the time.
> All sorts of games that started as nothing more than "community" mods but ended up as their own standalone game?

Writing mods has in general nothing to do with bazaar style.
Complexity theorists do care about reductions within subexponential time classes, but it's not a great topic for P vs NP focused Complexity Theory 101. And when you do focus on P vs NP, the dichotomy is quite natural because of the https://en.wikipedia.org/wiki/Exponential_time_hypothesis, the conjecture that a broad class of NP-complete problems are exponential-time.
If you look closely enough you would see that the attainment of wealth and power definitely does not bring happiness. In order to know this an individual needs to experience both ends of the spectrum and have the ability to clearly introspect and compare both experiences.
I also don't think using UUIDs as a security (by obscurity) strategy is valid. But there are other reasons someone may choose to use UUIDs. For instance, it's convenient to generate identifiers in a decentralized manner. I want to counter your one bad experience with my (equally anecdotal) many-multiple good experiences. Databases do just fine with UUIDs. Though we may be working on different kinds of systems, and optimizing for different things. I don't frown upon using integers (well, longs) for identifiers, but I personally prefer UUIDs.
In that simple scenario. What are some ways that a hacker could break your front end API to allow it to serve requests for multiple users without having access to multiple account logins? I understand that they could possibly get access to your database but that’s a different threat.

If they could somehow change your code, all hope is already lost.

But I do agree with it does allow someone to determine rate of growth which would be valuable more from a business intelligence side than a privacy violation.

The larger issue is that a developer forgets to add the “and userid = ?”

I guess the work around for that is to have a database that ties user authentication to records in the table/object store directly like DynamoDB or S3.
NP.

This is partially because we outsource so much work, but yes, we simply do not have the budget to get anyone and everyone we'd want. The A-for-administration is becoming a more important role in shipping tax dollars to R&D and C-for-cots.
No, nothing wrong with it intrinsically. But if UUIDs were used instead, the lack of authentication or authorization checks wouldn't be as catastrophic. That would be somewhat comparable to having a reset password token which doesn't expire. Still bad, but not as bad.

The other commenter's point about leaking information is also correct. In the finance industry one of the basic tricks to obtaining alternative data is to scrape it from private APIs which expose sequential IDs corresponding to a source of revenue. For example, a publicly traded car company might have its revenue extrapolated from an open API which sequentially increments an ID every time a vehicle is sold. Research groups will reverse engineer mobile apps from companies with only one or two dimensions of revenue, find the private API endpoints (reversing request signing as needed), and then look for object IDs which can be thrown into a timeseries on a quarterly basis.

Generally speaking the risk and compliance department of a hedge fund disallows this kind of data if it's gathered from an actual security vulnerability (e.g. leaks PII). It needs to be "only" a neutral information side channel without sensitive data, so that doesn't really apply in this specific scenario. But it does apply for people considering using integer IDs for user-facing APIs.
That's awesome. I played kickball in an adult league for a bit after college (on the DC mall no less) and it was great. I'd probably drink less nowadays...

I might start this up too.
I browse HN via RSS aggregator; so I catch all the articles, the thing is designed for keeping track of what you've read, integrates with daily reading flow along with all the other RSS feeds. Bonus points, my RSS aggregator of choice has a nice mobile reading experience too so my browsing experience tracks seamlessly across my various platforms.
Who Art Thou, Shakespeare?
Don't count me in - I've already stored up 4 decades of tp.
Works without issue. Just went to the Store, downloaded Ubuntu LTS 18.4 and tried it.

Screenshot: https://1drv.ms/u/s!AqSptDJA-vctqs4OGewT6Qa-PWBvbw
I can totally see where you're coming from. But major engineering achievements require efforts of many skilled people, who often like to be paid really well for their work. And the way the world works today is that a lot of big money is in the fields that are of questionable value to the society: advertising, finance, military, etc. And even in the fields that seem at first glance to be socially valuable, like health care, most of money comes not from healing people but from playing the game of "rip off public or private coverage providers".

Therefore I think the best we can hope for is that engineering breakthroughs achieved in profit driven fields will gradually leak into other fields where they can actually be used to improve people's lives.