skysight-inc/HackerNews huggingface dataset:
For me, the reason why I abandoned Haskell (for a couple years I was writing about half of third projects in it) is the complexity associated with laziness. FP and immutable data structures and monads are cool and mostly understandable once you grasp the concepts, but laziness is a double-edged sword. Laziness is cool, it enables a lot of nice things, but it makes me unable to easily reason about space complexity of any nontrivial algorithms, and that repeatedly bites me when I have to write such code.

In imperative code, space complexity is obvious and explicit, time complexity is intuitive for me, and correctness is shaky and needs to be tested.

In Haskell, correctness tends to be obvious (if there are no typos causing syntax to fail, it almost always gets the exact result I intended 100% correctly in the first try), but the space and time taken by the algorithm may be and often is surprising to me; If I make tiny modifications to the code, the execution may suddenly explode from 0.001 second to an hour because suddenly processing n entries involves creating and disposing n^2 thunks, taking all available memory and extreme amounts of time.

And despite trying a bunch to wrap my head about it, it keeps happening to me, it's just not intuitive to me - for me, eyeballing efficiency and exact time/space execution of a nontrivial Haskell function is just as hard as eyeballing whether random C code does everything correctly without a memory leak or overwriting being possible in an edge case. I also have trouble with Prolog for the same reason.
Back in the ice age we were called 'programmer analyst' or even 'system analyst'
So I'm a moderate libertarian and the "don't tell them what to do, society's hidden hand will decide" is an argument used by libertarians frequently and one I disagree with. One, specifically for this case, the issue at hand doesn't affect the user's. Two being a global company, quitting at Google will just open a slot that they need to fill and they have plenty of people lining up for the job. So really any sort of grass roots effort wont work because there are plenty of people who don't give a shit about the employee woes.

Another problem is that Google has contracts with the government, which belongs to us, so actually we do have a say if our taxes directly fund them. Also there are many companies they have deals with or that use services of theirs, many of which we won't know of the partnership. You are essentially asking for a globally coordinated boycott. But their service is so fundamental that you will find few people giving up the products because they can't. I've had my Gmail account since Gmail came out as invite only when you had to send those links. Too many of my accounts are linked to it and too many people know that's a for sure thing to contact me by. Samsung runs on android and there are other companies and developers that have built businesses around android or Google services. You aren't going to see these companies or individuals, sad as it is, make the pivot away for moral reasons. In some cases sure it's just tedious and annoying, like mine, to change but in other cases it's too much of a cost and risk.

I think the easiest way as I have mentioned in other posts is to break Google up, and other too big to fail/drop tech companies as well. We do it with other types of companies but I think the problem is legislators consider all tech companies as equal competitors to one another. Just because I can make a search engine doesn't mean Google has meaningful competition. I say break them up and let real competition dictate what society wants from them.
Does it have speculative execution vulnerabilities?
There's http://hackage.haskell.org/package/hledger-interest, a hledger addon.
Prior use of the word snowflake just means somebody who thinks they're uniquely special. Just like everybody else. And I'd say you can continue using it in that sense.

But the particular meaning of snowflake as someone who is too sensitive and easily triggered is newer and more inflammatory.
Even if your disk speed is infinitely fast, or your using an in-memory thing like Redis, hitting the DB is almost always going to be slow-ish due to network latency.

Redis is awesome badass rockstar tech, but I try and avoid it for any single-processe thing, instead opting for a tried-and-true global (thread-safe) hash table. Network packets aren't free, and no matter how cool your database is, I don't see you avoiding that. Not to mention that there is a cost to (de)serializing data, which you don't pay if you use something built into the language itself.

I'm not saying to go drop Redis (or any database/cache), just to keep this in mind.
You can, and you can also read source of that file to know what that "random script" does.
My point is that any security argument is a red herring when the baseline for comparison is a wet paper bag.

The thing about exploits is that it only takes one. It doesn't matter if Huawei adds another one when there are already thousands to choose from.
Do I need package-lock.json file?
This is not an ICO.
They should really clarify "feel free to hack your way in using some techniques but not others"
> By not providing 3rd parties access to email, Apple makes themselves not only the controllers of the physical devices and also over the full identity of their users.

No they're not. They're preventing third parties from accessing your data. You can communicate with your customers just fine; it's just that if you sell their data (or get hacked) the email you get is useless.
In things like business names? Yeah.
You're welcome to add non-social logins. The constraint is that if you add any social logins, you also have to support Apple Sign-In.

There is no requirement that you only support apple sign-in, you just aren't allowed to require user's to sacrifice their privacy to use your app.
You need to keep the soil on top of underground cables free from trees and deep-rooting bushes, so it’s not necessarily better looking.
Ask HN: Effective Application Security Training
I work as a senior developer at an insurance company in a small department within a fairly large company. In the past, we've done department-wide AppSec training, but I've always been less than pleased with the methodology and the results.

The training is a combination of slides and practical exercises delivered and performed in-person and discussed in real time. The instructor has always been very knowledgable, but while the content is somewhat tailored to our environment, they have limited familiarity with our applications and even less with the group's skill level.

Problems:

- Some employees come in with a good amount of app sec knowledge. Some come in with almost none. Accordingly, the content is too simple for some, while for others, it's like drinking from a firehose. Additionally, the same 2-3 people answer nearly all of the questions, leaving little time for those who need it most to wrestle with the problems themselves.

- Many don't recognize that some of the vulnerabilities demonstrated in the course were present in their own applications. I think they have trouble relating the content to their own work.

- We spend a fair amount of time on vulnerabilities that aren't as relevant in our typical stack and not enough on those to which we are more susceptible. For instance, CSRF isn't such a big concern for us. On the other hand, I know we have more than a few cases of insecure direct object references. Yet we probably spend as much or more time discussing the former.

I've brought these concerns to my manager. He wasn't here for the last training, but he's open to suggestions for improvement and has agreed to connect me with our CISO. I want to take full advantage of this opportunity. I have some ideas in my head, but I'd love to hear from others. Have you participated in a very effective app sec training regimen? What did they cover, and how did they decide what to cover? What was the format?
That is the only time I dare ask it. When else do I dare? Someone might take it the wrong way otherwise.
Meanwhile I've had one lost letter with USPS (that now-empty envelop got delivered with an "apology"), no lost packages, but have had countless problems with FedEx and UPS. My favorite UPS experience was when UPS got a package to the regional sorting center (Oakland, CA) and then express shipped it to the east coast (where it arrived that day) and then told me it would take a week to ship it back to the west coast. Because fuck you, I didn't pay for two week delivery.

Oh, how about the time the newbie driver delivered the package to the wrong house? Have you ever tried to get through to a real person at UPS? Careful what you wish for. The only human UPS will willingly let you talk to is in some overseas call center — and they will have zero power to do anything and thus say whatever they need to in order to get you to hang up the phone. After managing to escalate that incident, the supervisor at UPS's San Francisco depot called me back and explained that the package had been delivered correctly. I realize I'm not the customer in this case, but, man UPS has done a good job of ensuring I choose any other carrier.

FedEx... bless them. Aside from offering up gun fetishist discounts (yuck) and being hardcore anti-union zealots, FedEx accepted a package from a vendor with two different delivery addresses on it. Yes, the vendor fucked up. But FedEx accepted the package and got it to the regional sorting center and just sat on it because they didn't know what to do. Zero effort made over a few days to call the vendor, myself, or the other person whose contact info was also on the package.
I'd rather business be creative in what they do and how they do it, rather than functional things like their name.
If it's using an iPhone 7 chip, that also makes this the fastest iOS device with a headphone jack, right?

That should count for something.
Boggles my mind why they’d have different last mile trucks. How could that be better?
All extremists are like that and when you single out one group it just makes you look like the opposing group's extremists. Your comment looks exactly like what a right-wing extremist would write about leftists.
So I take it that you didn't watch the video or read the transcript where they state explicitly that they don't record or track that information.

Just because you believe the FB/G nonsense that the internet is only possible by gross violations of user privacy doesn't mean everyone else buys into it.
Mail Online search traffic halves after Google algorithm update
I was just pondering this very issue. I think one of the reasons some teams end up with spaghetti code is because the developers are smart enough that they always muddle through it in the end. So when it comes to talking about technical debt, there's never a "it's too complicated," there's just "you're not trying hard enough." In that sense, it would help if the developers had a lower pain tolerance, because it would drive us to actually work hard to improve the ergonomics of our architectures.
How will the mandatory implementation of this affect apps that rely on a third party as the data storage system? For example https://moo.do stores everything in Google Drive, if they have to implement Sign in with Apple the app won't function
I know people in the retail door-to-door canvassing business (home renovations), and it's very obvious to them that there is a strong racial bias towards non-white door-to-door canvassers. Fewer people answer the door, more belligerence at the door, etc. It's consistent and it's sad, but that's reality in a lot of places.
I suspect but cannot prove that iPod touches get heavily used in business settings like inventory management.
You can have UPS and FedEx hold a package at one of their customer service centers or UPS Store / FedEx Office. If it's time sensitive you can also pay for morning delivery.
Venture Bearding
Which is why Apple protects your data in a way they can't access it - in the event that they change into Google and Facebook in future they have no access to the current information.
It's not actually on Windows default installs though, it's just more easily installable. So not much help in your situation. Google will do arithmetic for you, that's often the quickest.
Forcing people to commit murder is bad, therefore the opposite -- forcing people to not commit murder -- must be equally bad, because they are both forced.

This is not a strong argument.
Week of React: recommended data patterns, reducing 60% of app load time and more
I believe the shipper can require a signature upon delivery. Then, at least, if FedEx left it without getting a signature, they'd be on the hook for it.
What if I want to link to somebody else's blog? Or a hacker news comment?
To be perfectly cynical, I'm willing to temporarily give the benefit of the doubt to the company that's not currently selling my personal information to marketers, over the companies that are doing so flagrantly.
Interesting. That statement says FedEx is USPS' largest provider of air transportation to the USPS. But that's different from USPS being FedEx's largest customer.
I know what you're saying but I'm okay with it. In this case Apple chose users over developers. iOS developers have to do a little more work (Apple has made it very easy from what I've seen of the framework) and have a little less freedom but users signing in to apps using 3rd party auth are guaranteed the privacy protections Apple is promising. They drew a line in the sand by making their solution mandatory but I think they had to to deliver what they're promising to users (which I think is great).
The people who work at Google who wanted to stage a walkout are free to leave for another job. They are free to start their own companies. We are free to use other products or create our own. How is legislation the best solution here?

People need to stop with the excuses and the expectation that someone else will change the rules to fix their problem and be the change they want to see in the world. Google will eventually be displaced by someone else who does a better job just like every other toxic company that came before them. Anybody can do it. Google, Amazon, Facebook, Apple, Microsoft all started (and in some cases reinvented themselves) that way. And if the newcomer sticks around long enough they'll probably become toxic too. It's the way the world works.

We don't need legislation to fix this. We need someone to do a better job. They're not out killing people. Just stop using their shit.
Years ago I saw someone doing a community outreach lecture tour, for Next Generation Science Standards. On behalf of NSF I think. She was getting hostile questions, many of the too-broken-to-even-be-wrong variety. Ones where normally I'd just shake my head, perhaps think "nutter", and hope the speaker was able to move on without getting bogged down.

She addressed the questions with a grace, and insight, and empathy, that was awesome to watch. I'd not have thought it possible. I wish now I knew who she was, and had video. If anyone knows of this skill set being taught, I'd love a pointer.

So I no longer think of the quality of a question, and of a questioner, as being a worthy bound on the quality of an answer.
Not far off. Sadly, there are any number of countries in the region with similar conditions.
No idea. UPS doesn't work that way. As a small biz, I went with UPS because I didn't want to deal with separate air and ground pickups.
What's a social login, though. At what point is Instagram using facebook a social login or not (it's the same company).
I believe this kind of works is very important. Ore ML systems are biased in so many way that discovering them can provide many insights about how they work and how improve them.
Life Lessons from Improv
If you watch the video or read the transcript they explicitly state that they do not record any of the information.

They obviously have a mapping of cloak address -> real address, but there's no requirement for them to have any record of which apps got which addresses.
The presumption of innocence is a legal presumption. Anyone is free to make private judgments about someone's innocence or guilt without waiting for a criminal verdict. That said, Amazon's phrasing ("this woman was caught on camera breaking into a vehicle") does seem a bit reckless. If the person in the video is innocent, she can and should sue Amazon for defamation.
Why does ZFS reflect a lack of experience in the internet and/or distributed systems? Simply because it didn't follow a questionable tech trend of "everything is a DHT?"
I don't think anything you've linked to provides evidence of either UK or USA using each other to skirt domestic law...?
That's a nice bit of trivia! Had no idea Twitter started on Virtualmin at Joyent.
Of course. We already know that all major US corporations provide backdoor access to gov agencies through various programs(i.e PRISM)
You can still ban the underlying iOS account, you just don't get an email address to spam/sell.
Anything that expensive or irreplaceable should have been insured by the shipper and required a signature

If you don't get what you buy, it's absolutely on the seller to make it right. It's on them to get reimbursed by the shipper for a failed delivery.
They have to store the information, if for nothing else than to correctly forward emails to your real address.
The front camera has very little chance to register any finger motion on screen, though.

Adding accelerometer (tilt / shift) data could help a little bit, because it's correlated to the motion of typing hands, too.
I've never found FedEx to be as good to my door as UPS, but I lament what has happened to Amazon shipping. Where professionals used to deliver my packets, now amateurs show up in SUVs or rented box trucks. They leave the packages exposed to passers-by. They get their stupid trucks stuck in my driveway, ripping up the yard in the process. They lose packages in transit. Free one-day shipping with prime isn't worth this hassle.
Disruption Starts with Unhappy Customers, Not Technology
This is really weird to me. It seems strange for a CEO to effectively fire the COO and CMO because they want Operations and Marketing to report directly to the CEO unless the company is in serious trouble and needs a single authoritarian leader to set direction across very different departments. Does anyone else have more info on this?
> but this is actually not going to gain a lot of traction

You're forgetting the part where Apple is going to mandate that app developers must offer Sign In With Apple if the app offers any social logins like Facebook or Twitter, and that the Sign In With Apple option is strongly suggested to be the first one on the list.

It absolutely will gain traction.
That's why I didn't say what you're claiming, I said the effect on me - neither in the USA nor in China - is equivalent AFAICT.

China and USA are both doubtless spying on my country's population and accessing my PII/data as part of that.

I'm pretty sure my legal recourse against NSA is identical to that against the Chinese secret services, zilch.

Let's be realistic. Trump wants us to stop using Huawei _and_ use USA company produced comms equipment. A consideration of that is then USA can do what they're claiming China is doing. AFAICT you have a legal framework in place to enable just that.

What's most incredible to me is that GCHQ haven't endorsed the apparent false claims, which actually gives me some hope about UK (but equally could be meta-games on post-Brexit trade deals; or false flags; or whatever).
There is an alternate explanation that doesn't rely on advertiser stupidity. Most advertisers are statistically unable to estimate the profitability of their campaigns, because ads generally exert weak effects in very noisy environments. There is some high quality evidence supporting that, e.g.
https://academic.oup.com/qje/article/130/4/1941/1914592

Nota bene, weak effects does not mean ads are necessarily profitable. Profitability depends on many factors including margin, retention, ad cost, etc.
That's good then. My point was more "random sdk/library", rather than script, sorry.
Advertisers go to an ad network and configure their campaign with: "I want to show X to users who are Y or are on a site about Y, and I'm willing to pay Z for it".

X is just the content of the ad and is usually entirely advertiser-defined. Some ad networks will allow you to do some fancy stuff to help determine the best phrasing or arrangement or whatever of your ad.

Z can be in dollars per impression, per click, or per conversion. An impression is one person being shown an ad one time. A click is a person clicking an ad. And a conversion is advertiser-defined but is usually someone buying the product being advertised. Bidding per click is the most common.

Then when a user loads a page with an ad on it, the ad network finds all campaigns that are eligible - meeting the criteria defined in Y. It then runs an "auction". It has to calculate which eligible advertiser is willing to pay the most for that potential impression. But not all advertisers are bidding per impression, so some prediction comes into play. If an advertiser bid per click, then the expected amount they will pay is the probability the user will click multiplied by the price if they do click. Their probability of clicking is often called CTR which stands for "click-through-rate" so that's where the bid * CTR comes from. Usually an ML model takes what is known about the user, the ad, and the page, and predicts CTR. Similarly for conversion-based bids, it's bid * CTR * CVR, where CVR is "conversion rate". Whichever ad comes out with the highest result of this calculation is shown.
It’s a very good point.

I think you are right that it will be an issue in the long term if things stay the same. Somewhere I hope this forces the other players in the field to react, to avoid Apple getting too much power.

I don’t see anyone else right now that can force app devs to support this scheme (for instance I saw countless signup pages that reject gmail’s + syntax, companies clearly don’t want to be filtered), nor that would be trusted for now by users to not abuse the situation.

Perhaps Microsoft could ? barely, as they for instance were sticking ads in their browser.

So, in a way I see Apple doing what only them can do, and hope it creates enough precedence for other minor identity managers to step in and being a more sane solution for the long run.
I wonder if this wasn't just some drunken fuckery on the waters.

Kind of like watch this, Hahahahah, they thought I was going to run into them.

Alcohol is a huge problem in the Russian Military and is responsible for a lot of the mishaps and disasters. The Captain of the ship could have been sauced.....

Thank goodness our ships have dashcams...
My mother-in-law had this happen several times as well. But "might not turn into a human" is, in my opinion (and my mother-in-law's), insufficient reason to allow abortions for any reason, up to (and in some cases, after) the moment of birth.

You might turn out to be a murderer; you wouldn't appreciate it if we preemptively threw you in jail.
>unrestricted greed with no regard for human lives.

well that has basically always been amazon's m.o.
Somewhat less of a concern as long as you maintain coverage in your own country (in my case, US) and have the wherewithal to go home if you decide you need to. But yes, a serious accident or onset of a critical and fast-acting illness would have you questioning your choices.
Russia to make its own show about Chernobyl that implicates the US