skysight-inc/HackerNews huggingface dataset:
Storytime!

In my ex-job we were developing e-commerce system, which was super-old|big|messy 0-test PHP trash. After two years of actively working on it, I still couldn't form a clear picture about the details of its subsystems in my head.

One day there is a call from a client, saying that he is missing many of his orders. The whole company is on its feet and we are searching for what went wrong. We are examining the server logs just to find out that someone is making thousands of requests to our admin section and tries to linearly increment order IDs in the URL. Definitely some kind of attack.. Our servers are managed by different company so we are opening a ticket to blacklist that IP. Quick search told me that the requests are coming from the AWS servers, and the IP leads me to an issue on GitHub for some nginx "bad bots" blocking plugin, saying that this thing is called Maui bot and we are not the first one experiencing it. Nice. Anyway, this thing is still deleting our data and we can't even turn off the servers because of SLAs and how the system was architected. So we are trying to find out how is it even possible, that unauthorized request can delete our data. We are examining our auth module, but everything looks right. If you are not logged in and visit the order detail (for example) you are correctly redirected to login screen. So how? We are reading the documentation of the web framework that the application is using. There is it. $this->redirect('login');. According to the documentation it was missing return before that statement. So without the return, everything after that point was still executed. And "everything" in our case, was the action from the URL. No one ever noticed, because there were no tests, and when you tried it in the browser, you were "correctly" presented with the login screen. Unfortunately, with side-effect..
Guy that wrote that line did it 5-6 years before this incident, and was out of the company for many years even before I joined. I don't blame him..

Fix. Push. Deploy.
No more deleted orders.

POST MORTEM:

The Maui bot went straight to the disallowed /admin paths in robots.txt and tried to increment numbers (IDs) in paths.

I remember, that because Maui bot actions were (to the system) indistinguishable from the normal user actions, someone had to manually fix the orders in the database just by using server logs and comparing them somehow.

Sorry for my English, and yeah, (obviously) don't use robots.txt as security measure of any kind...
That's not how biomass works, biomass is not a zero-sum game. The main issue with sustainable dairy farming is secondary elements and nitrogen fixing. My grandfathers both planted clover in rotation for this reason.

Eventually, the ground will become depleted of phosphorous and potassium. Other trace elements tend to take a really long time to deplete, especially in clay.
Your extreme example... isn't great:

"The court ruled the state does not violate a convicted sex offender’s voting rights by prohibiting him from voting at a polling place located in a high school, and instead requiring him to vote via one of three alternatives."

https://www.theindianalawyer.com/articles/46959-th-circuit-p...

(Plus, schools where you vote are generally owned by the state, so it's not a good example for the restrictions on private companies)
I would imagine that when articles like these are posted, that their target audience is the average healthy individual without any medical issues which directly conflict with the subject at hand. As someone with ADD, I realize that the advice and guidance from my medical providers should come first and foremost and that my experiences and treatment paths will not be typical compared to the average individual.
Nyqist frequency of 2Ghz for PCIe 2 (slightly less in practice due to line code) is still nothing to sneeze at.
I'm just saying that tether has
worked for years, and the peg
seems to be still there.

A parachute that has "seemed to be there for years" is all very well - but evidence it's fine when no-one pulls the ripcord doesn't tell us what'll happen when someone does.

And if it's a parachute, what happens when someone pulls the ripcord is kinda the most important thing :)
Whoa! And as I just notice by your comment, not for the login either. I only tested the HN search function once and it only worked with Javascript. Therefore I assumed that this is the case with all other functions. Thank you.
Which is why they're doubling down on not fixing it.
You can also use robots.txt as a honeypot. Simply add some realistic looking url's to the Disallow pattern and create rules in haproxy, nginx, or your own custom scripts to catch anyone hitting those URL's and put them in a hamster wheel. i.e. give then a static "Having problems?" page, or just outright block them. On my own personal systems, I use "silent-drop" with a stick table in haproxy.
The most important takeaway from all this for me is that Alex Jones unironically sells a nootropic called "The Real Red Pill"
MacOS as a whole forces confirmation on deeplinks.
The old solution skipped the OS confirmation dialog.
>Personalized learning, though premised on differentiating one student from another, has seemed to work best when it attends, first and foremost, to the needs of teachers as a group. If tech is, indeed, merely a tool of personalized learning, then what does that make the teacher?

It makes the teacher more of a facilitator/coach/mentor and also a proctor for administering tests.

This is a long article and headline of "personalized learning" and how it was described in the article was unfamiliar to me. That jargon of "personalized learning" seems to translate to "laptop-based learning". The laptop/Chromebook is the primary transmission of material. The teacher becomes a secondary role -- help answer extra questions/etc.

The author of the article is biased with the premise that the teachers that are physically there in the classroom are the best transmitters of the material. This is theoretically possible but reality is that you often get an ok or under-average teacher. The result is a bad teacher that confuses and frustrates the students instead of teaching them. With laptop-led learning, you could assemble the best instructors (or multiple alternative virtual teachers) instead of being restricted to the random quality of the local teacher where you happen to pay your taxes.

As a personal example... None of my math teachers from 1st grade to high school were as good as Grant Sanderson (3Blue1Brown)[0]. (I think many HN'rs might have a similar life schooling comparison.) I would have been better off with high-quality math lessons from a laptop and then consulting with the in-classroom teacher acting as a coach to supplement the videos. The alternative of watching teachers bored with their jobs did not help me learn math.

That said, I can see where some kids won't respond to laptops and need a live instructor to transmit information. This is where we can personalize the curriculum. Some kids use more laptop videos; others utlilize the live teacher.

[0] https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw/vid...
Jaguar Land Rover developing AI mood detection to reduce driver stress
I don't get why you would put Git in a beginner's course in the first place, it doesn't do anything that a beginner needs.
I’m so glad to see this work and other projects like it. The relational database doesn’t need to be abandoned to put any interface over it you like.
When meritocrats and technocrats fail to seize power, extinction ensues.

We are extinguishing the prospect of the only intelligent life we know of in the universe by not caring for the environment, although one could argue that only a small fraction are sufficiently intelligent.

The oligarchs of the world have more than enough money to fix all the climate issues, but since they derive their wealth from exploiting the climate, there is no hope for a fix from them.
I've wondered about that. Could small crawling robots, perhaps 3-inches long, be built to roam around houses and inside walls and under sinks and so on to seek out and kill cockroaches and other household pests? I doubt anything can develop resistance to being torn apart by a robot. The answer is probably that it could be done now, or fairly soon. Whether it would be economical is another question entirely. But I don't like the idea of spraying chemicals around my house. Robots would be non-toxic.

Perhaps in the future every building will have a fleet of tiny robots roaming around functioning like macrophages. Maybe iRobot could come up with something.
What room are you in? Because I'm not in any room where that is even close to be a thing.
> There are also probably too many people using the web to build applications that should be native.

I hear this a lot, but I'm personally glad I don't need to download an app to my phone/computer to order pizza or find directions.

Obviously this is a balance, but of the two extremes that could exist, having too many web-apps seems to be better than having too few. The quickest, simplest step you can take ATM to improve your device security is to install fewer apps -- particularly if you use an OS like Android.

It's not clear to me that situation would get any better if half of the web disappeared.
In this day and age, I wish Apple and other laptop manufacturers had a hardwired power switch on the camera.
You can look at the issue however you want, but at the end of the day somebody is going to have to pay for the renewable energy and carbon sequestration tech.

We can fund them with taxpayer money, which means the average Joe pays, and politicians pick winning (or losing) technologies.

Or we can make the polluters fund them, and let the invisible hand pick the best technologies.

I find the second option much more attractive. And Nobel-prize winning economists agree: https://www.nytimes.com/2018/10/08/business/economic-science...
There are quality diagramming tools out there, but none like this that I know of. Email me (beta@ilograph.com) for a beta account.
Uh, who are you talking to?
That cartoon is in the main article.
Because it's basically saying we need to shut down the economy and resort to cannibalism.
> Even for people with difficulty walking or in wheelchairs?

What part of "if we are talking about accessibility in general that a whole different problem"?

walkable means walkable, not staircaseable.

Stop bikeshedding.

Are streets or bike lanes the right solution for wheelchairs?

I seriously doubt that...
FTC hits Dlink with a security program lasting 20 years [pdf]
You can pay for transit with pretax dollars but not for biking. There used to be a $20 per month commuter benefit but it was killed as part of the Republican tax overhaul. Even before it was killed, you couldn’t use both the bicycling and transit benefit if for example you rode to a park and ride transit stop. You can take advantage of both the parking and transit benefit if you drive to a transit stop.
I followed a similar path with TEMPORARY tables and using pgcopy [1] to insert data quickly - the copy operation was extremely quick and didn't require only passing strings.

[1] https://github.com/altaurog/pgcopy
That is a great treatment. Thanks for the link.
I don't know what you mean by "still". Apparently it was software disable-able up to the 2011 mbps.
On-Topic: Anything that good hackers would find interesting. That includes more than hacking and startups. If you had to reduce it to a sentence, the answer might be: anything that gratifies one's intellectual curiosity.

It's all the superficial political and ideological campaigning and drama that I don't want to see here.

But using world-class narrative and illustration to represent hundreds of pages of a historic but dull and boring legal document? That's an interesting and new phenomenon that gratifies this hacker's intellectual curiosity.
It could very well be true that disabled people are more offended by third parties policing language, especially if the expression was used in a neutral context. Because that can be very humiliating and shifts the topic to something many people want to overcome in their lives.
Whenever I see lines like that, "the web can be a resource hog, sometimes devouring CPU and memory", I really want to respond "no one cares".

OK, not no one. And people certainly DO care if a site is very slow, or user interactions are bogged down and choppy. But there is this somewhat weird (IMO) belief, very common among developers and tech-savvy users, that heavy use of resources is a bad thing in and of itself. I certainly understand where that belief comes from, but it's just not relevant to 98%+ of people if it doesn't get to the point of being heavily noticeable in user interactions.
> Being nitpicky, but I'd argue Erlang only falls down on speed where it's computationally bound. Where it's IO bound (e.g. a prototypical chat server) Erlang has excellent speed characteristics - where speed is measured in concurrency and latency.

At the scale where asynchronous IO becomes interesting, speed is computationally bound. Think maintaining tens of thousands of TCP connections. You can either spawn a single OS thread for each connection, which gets prohibitively expensive with regards to memory consumption, or you can use asynchronous IO and have a couple of native worker threads, approx. 1 per CPU core.

If Erlang can handle, say, tens of thousands of TCP connections with one Erlang thread/actor per connection, then only because it is using an implementation of asynchronous IO in the background.
Did AMD give away ‘keys to the kingdom’?
And yet we don't let people drive or drink alcohol until a certain, arbitrary age...
I have ADD myself, and while I agree that adderall is something of a wonder drug in this regard, adopting a regular sleep schedule has had absolutely immense benefits for me. Almost every activity where it’s possible to gauge performance has seen a benefit.

I think the parent’s point about it being the biggest relative increase in cognitive function is correct.
UPDATE no need to do this any more. Zoom actually conceded they were wrong and pushed out an update that removes the local webserver: https://imgur.com/gallery/INvYaH4 (from the discussion below in the thread).
Given the popularity of kids crashing their toy trains in YouTube videos, this propensity hasn’t abated in people’s minds yet.
I agree, but it's largely academic in the real world. People drive to work in bad conditions because they fear if they don't they'll lose their job. People drive in bad conditions because someone they know has fallen ill and they need to get to the hospital.

Most people drive to their limits, or their comfort. Some people do stupid things and drive beyond what is safe, but dependent on where you live this may or may not be in the minority.

What fascinates me is that we are not giving drivers the skills they need to be able to avoid accidents should the worst happen. Instead we say you shouldn't drive at speed X or in condition Y.

My argument is that we should be teaching drivers these skills not only so they can correct their mistakes, because at the end of the day we are all human and make mistakes, but if we also show drivers how easy it is to lose control of a vehicle they may just respect the road a little more than they do already.
Interesting bit about money since it's mentioned in there: Most economics give the same version in the notes which is that money just kind of _sprang up_ out of no where to solve this problem of trade, but it's actually very likely that Credit, and therefore also Debt, is the source of "money". That money only became more important as trade extended from tribes and to strangers we didn't trust. Also that the world goes through cycles of being currency heavy and credit heavy in their transactions of which right now we're living through a new credit heavy cycle which is hard to predict the outcomes of.

Recommend this book: https://www.amazon.com/Debt-Updated-Expanded-First-Years/dp/...
A hacker could turn the light on and off before you even knew what to do about it. All they need is a picture of your face to do something nefarious.
Please tell me more about where you buy these drugs.
I think I should probably remember to read these article thingies before commenting.
I’ve been designing offices for decades. Here’s what I got wrong
I don't think the parent comments's author was suggesting that stimulants are no more effective than sleep. Rather, I think he was suggesting that--if you aren't also struggling with ADHD or some other medical condition requiring stimulants--working on your sleep hygiene should be one of the first things you do before even considering stimulant use. Trying to patch over bad sleep with stimulants is long-term harmful.
Be careful? This advice makes no sense.

I'm going to go with the Canadian Cancer Society on red meat.
They also, as a matter of fact, say alcohol is carcinogenic and to use alcohol in moderation.
And in France outside of Paris most people drive. It would be impossible to live in the countryside without a car. Even within larger towns, the big supermarkets are outside of the city center.
Politicians are also in the pocket of the Koch brothers who spend about as much on politics as the Dema and the Republicans[0]. People’s beliefs aren’t an immutable fact that exists in isolation, they’re a product of the propaganda-soaked media environment, which is also part of the problem and has to be changed.

[0]:
https://www.nytimes.com/2015/01/27/us/politics/kochs-plan-to...
HTTP basic auth has also been broken on Firefox for iOS for a long time

https://bugzilla.mozilla.org/show_bug.cgi?id=1437817
https://news.ycombinator.com/item?id=20402082
Mainstream nootropic supplements have three primary ingredients: Marketing, placebo effect, and very mild stimulants.

The hyperbolic marketing material primes the user for maximum placebo effect. When the mildly stimulating compounds kick in, the user can actually feel something. All of the marketing material about enhancing brain function through combinations of carefully-researched ingredients feels validated. The user may only feel a mild stimulating effect, but it feels so much more significant after reading elegant marketing about supporting neurotransmission, helping healthy brain signaling, and promoting healthy cell membranes.

It's easy to see why this combination is so effective. Caffeine's stimulating effects are well-known, as are the rebound, tolerance, and dependence that come from repeated caffeine dosing. Remove caffeine from the equation and now the user's expectations are a blank slate, malleable according to whatever marketing materials the team can dream up.

The BrainGear supplemented listed in the article is a prime example; The raw ingredients in each drink cost pennies (search Amazon for bulk Acetyl L-Carnitine, Choline, Inositol, and the other ingredients if you're curious). Their largest costs are likely distribution, storage, and marketing. Many of the ingredients can be found in similar quantities in a regular, healthy diet that includes eggs, leafy greens, and a cup of green tea each day. There is nothing magic, noteworthy, or particularly valuable in this supplement, yet here we are reading a vox.com article where a journalist happily links to their product and fails a strawman attempt to debunk it by solving some Sudoku for a couple of days. This is a great marketing success story.
Given my observations of how frequently and flagrantly (and objectively) drivers (and other road users) break laws put in place to keep all the users of our public infrastructure (including themselves) safe, I'll have to go with a). If your definition of being responsible explicitly allows for breaking such laws, you may want to re-evaluate it.

I'm not interested in hearing the word "anecdotal", either. Check out DUI statistics if you want bite-size proof that vast swaths of the population are fundamentally unfit to be driving, or show me data to back up your own point that the roads are not full of irresponsible drivers.

Oh, here's another good one: "In 2017 alone, 3,166 people were killed in motor vehicle crashes involving distracted drivers." (from NHTSA: https://www.nhtsa.gov/risky-driving/distracted-driving)
You've seen socialist tyranny, you've seen fascist tyranny, but are you ready for environmentalist tyranny? A coalition of hippies, vegans, and environmental engineers will rise up and take control of the state in order to move society forward on its inevitable march towards an environmentalist future!
Sure it's moved, but the light from the galaxy arriving now is the same age as the radio burst (they travel at practically the same speed).
Indeed. A lot of very "highbrow" stuff fits into this category too (high salt,sugar,fat), not just Big Macs.
What I don't like that modern browsers tend to trade memory for performance, i.e. get slightly better numbers in benchmarks by using significantly more memory. For example, have you heard about image decoding cache? A browser can waste as much as 20 or 30 Megabytes to store uncompressed bitmaps, although a better solution would be not to store them at all. If the website uses too much images, then it is not a browser's problem.

Well, wasting 100-200 Mb for one tab is fine, but what if I have many tabs opened? Browser quickly uses up all available memory and starts swapping out other programs including a shell.

I think that browser could at least reduce memory consumption for background tabs: they don't need to run when they are in background. A browser could free everything that is not necessary, including: image decoding cache, caches to speed up DOM and CSS, canvases, compiled JS bytecode (it takes more memory than source code) and JIT'ted code, any network caches, SQlite cache. Also they could gzip text resources in memory like CSS or JS code.

Note that this approach is better than simply unloading a page like mobile browsers do. But if the user didn't input anything into a page, I think it should be fine to unload it completely after some timeout (for example, 30 minutes).

The same approach could be used with iframes. Typically they are used mostly for ads and analytics. There is no need to waste precious memory for slightly better animation of an ad banner.

I remember that many years ago Opera could handle tens of tabs with 512 Mb of memory and not get swapped out.
Fedora vs. Ubuntu: Linux Distros Compared
Data Analysis with Dr Mike Pound [video]
The Meaning of Marianne Williamson
MediaPipe: Cross-platform framework for multimodal applied ML pipelines
Definitely a bit of humour. But it can be anything. I just mean you should look after yourself, but also don't take everything all too seriously. "It's life and life only." And I think indulging that side of oneself lends to happiness. The key is not giving over to that side completely.

My "junk food" in this case is beer, whisky, pizza, chips, and bad comedy movies. I enjoy them all greatly. Food can be a visceral pleasure and I can derive as much or more from a crappy pizza as I can from a gourmet meal. So... my "junk food" really is a lot of junk food. Yours or others may not be. Also YMMV.
Real question: why isn’t some billionaire using subversive techniques to manipulate the population into doing something? If it can work for Russia to put Trump into the Whitehouse, can it not work in support of carbon reduction?
> Firing employees needs to be done: how can you build a business without this ability?

Laying off people to balance the books is a novel concept, introduced in the 80s. What leads you to think you can't build a business without it?
Congrats to you and the team Edoardo! We’ve been excited for this for a while
Where do you live in Europe that doesn't have roaches? I live in Greece and the cities are infested with them during summer.