skysight-inc/HackerNews huggingface dataset:
And as for how PGP gets used in practice, https://xkcd.com/1181/ did a good job of demonstrating how useless that is.

Seriously, I'm a developer. I have never once felt motivated to verify a PGP signature. Of anything.
Impressive. 3072 channels is likely sufficient to pass very reach embeddings. At a level of a long sentence or a small image.
First, thanks enormously for writing this -- and for all the other recent articles that have appeared here the vein of "PGP is as bad as it is unpleasant to use". It's a point I didn't really appreciate (at least as much as I (sh/c)ould have) and I'm sure I'm not alone.

It seems that the state of package distribution for many distributions is poor, security-wise. (OpenBSD, to nobody's surprise, is an exception.) For instance, archlinux (I'm loyal) signs packages with PGP[1] and, for source-built packages, encourages integrity checks with MD5. My recollection is that, about 5 years ago, MD5 was supposed to be replaced with SHAxxx. Am I misinterpreting this? Is this actually Perfectly Okay for what a distro is trying to accomplish with package distribution?

(I'm particularly suspicious of the source-built package system, which consists of a bunch of files saying "download this tarball and compiler. MD5 of the tarball should be xyz." I'm pretty confident that's not okay.)

Okay, now moving from package distribution to messaging, and again looking at the state of my favorite system. How am I supposed to message securely? The best nix messaging tools are all based around email. Even when I can get the PGP or S/MIME or whatever toolset to work (let's face it, that's at least 45 minutes down the drain), it's clear that I'm not in good shape security-wise.

I should use signal, apparently. Great. Just a few problems: (1) no archlinux signal package, (2) I'm guessing I can't use it from the terminal, and (3) most severely, it seems signal has incomplete desktop support. In particular, I need to first set up signal on my phone. Well, let's face facts: I have a cheap phone from a hard-to-trust hardware vendor, and I think there's a >5% chance it's running some sort of spyware. (The last phone I had genuinely did have malware: there were ads showing in the file manager, among other bizarre behaviors.) So in order to use signal on my desktop, I need to buy a new phone? That's even worse, usability-wise, than PGP.

Is... is it really this bad? I'm getting the sense that the desktop linux community has completely dropped the ball on this one. (And perhaps more generally desktop mac/windows... I wouldn't know.)

[1] Perhaps not so bad, since the keyring is distributed with the system -- but how was the original download verified? Options are: PGP, MD5, SHA1, with the choice left up to the user. That can't be right.
> it has means that there are not many that can compare in its niche

Which is? "devops"? Otherwise, offerings on the JVM and .NET are strictly superior. And now with native compilation being available for both platforms, they will also be a better fit at devops than golang. Other alternatives include Rust.
"Today, CTA announced it will allow sex tech startups to participate and compete for awards as part of the health and wellness category on a one-year trial basis."

Ummm, where is the proof that any of these sex techs are good for human health?
I thought it was something like Azure Stack.
My idea of ranting crazy person's website doesn't have facebook share buttons and a popup asking me to subscribe to a newsletter. For reference, here are my ideas of a crazy person's website:

http://timecube.2enp.com/

https://web.archive.org/web/20171002152147/http://templeos.o...

https://web.archive.org/web/20180404034756/http://nasimabc.c...
Dat/Beaker Browser and many others can do all you described.

They're just not popular because only us geeks care or understand the value of esoteric and worthless stuff like privacy and data ownership.

Also, unfortunately if someone shares a photo and then turns their computer off, the recipients then can't download the photo. If you share a photo from your phone, then accidentally drop it into the toilet, the recipients then can't download the photo. Those are inconveniences.

The popularity of facebook despite it's innate, deep-rooted and well-publicized privacy horrors makes it obvious that convenience and inertia always wins.

So the geeks need to produce something compelling that includes privacy and decentralization at its core, and only then will people switch. Pretty please?
Is there a specific issue other than "it's not the default" that precludes it from secure messaging? This is the thing I don't understand about your position -- you have been saying for a very long time that "it's not ready yet" but as far as I can see the default-to-unencrypted setup is the main issue you have with it? I get that asking a journalist to use it right now is a bad idea, but if E2EE was the default today what other issues do you see?

From my PoV, Matrix has many features that might actually end up increasing security over Signal's design. Just as an example, you cannot blacklist or even get alerted to new devices being added to an E2EE conversation with Signal (and if you look at things like the Assistance and Access legislation here in Australia, that is a serious concern). With Matrix you do detect it and can blacklist the other device (and with cross-signing being done very soon, you can also be sure that verification of devices will be a rare event). I also think the new emoji-based verification is a massive improvement over Signal's "safety numbers" setup.
I use it for transit times to a handful of places in the Bay Area I regularly visit, and it works well for that. One glaring search problem I have though is for a contact, it will only show the result for the first two letters of the name and then when I continue typing it shows anything that’s not the contact’s address. This is even despite getting directions to the contact several times.
Yep, the default python implementation lets you pick a code and generate a code with more than 2 words. I'm just cautious in telling people to twiddle knobs that don't need twiddling :-) But you can absolutely go up to 2^-64 or whatever if that makes you happy!
Yes, I've used DTrace extensively. Unfortunately the tracepoints are limited and I've found that the MacOS kernel functions aren't quite the same as what you can find for Darwin/BSD. I think Apple is just uncomfortable with the idea of people poking around in the kernel more than they'd like.
golang's "simplicity" (i.e. unexpressivity and weak modeling ability) translate into complexity in real world code bases. There's no way around it.
Looks like Bloomberg just posted their pre-written article on accident:

https://www.bloomberg.com/news/articles/2019-07-17/elon-musk...
What's up with the arbitrary scrutiny placed on sex?

Where's proof that every other consumer electronic is good for anything?
Let Users Login via Email
Most of these are in the article. The author mentions:

1) both http and ssh

2) source control and team work (and suggests courses built around these)

3) multiple sections on problem solving and algorithms (incl. proof techniquese, formal methods, knowledge of data structures and algorithms)

4) nothing in particular

5) nothing in particular

6) covers communication skills

7) emphasizes each student taking a lead role on a team in suggested team-based classes

8) not explicit

9) suggests writing and being graded on tests throughout educational career

10) section on graphics and simulation emphasizes this.
I completely get that it's entirely normal for people to get anxious about changing science, technology, and societal norms. And I also appreciate that, as the rate of change increases, we should expect to see greater anxiety from a larger segment of the population.

But, I have to say that I'm somewhat surprised to see even folks in the tech industry arguing against the current pace of advancement.

Obligatory SMBC: https://www.smbc-comics.com/comic/future
It's unlikely that you'd have learned in the government other than certain context specific survival skills.
Is this blog post satire? or an ad of sorts for some vaporware?

The talking alts either use PGP or a botnet. (signal uses PGP with a CA type of thing, so much for "stop using pgp") and whatsapp is owned by facebook.

tarsnap as I understand requires that I lock in to a service to secure my backups. F- that. Someone already talked about wormhole.

And how is essentially forking pgp with 'age' really going to solve things? Wow thanks another forked app! :^)

It would be easier to just make a wrapper for gnupg that sets the settings for everything the author is talking about. (well most of the things the user is talking about)

Wouldn't it be easier to just inform maintainers of the package to change the default standards of packages like gnupg? Has the author even attempted to change some of these things?

Don't get me wrong, I get where the author is coming from. Uinx philosophy should be followed... but certain systems can not be compartmentalized they have to unfortunately interact with other another.

If you for example encrypt data without signing it, how would you know that someone isn't trying to poison ciphertext to extract data leakage or worse yet, they already found a way to decrypt your data and manipulating sensitive data?

An encryption program by DESIGN should also have a method to sign data.
Is this what is considered a product page these days? One vaguely non-specific sentence and 2 embedded videos.

They have all the information and images they need available on the play store, so why are they not presenting it on their own site?

(grumble, grumble)
Tesla workers say they used electrical tape in Model 3 production
"health and wellness" is usually a way to say "there is no actual data supporting any health claims".
How Marriott is declaring war on Airbnb
https://en.m.wikipedia.org/wiki/Brain–computer_interface
Couldn't we have just had equal opportunity booth babes?
Is it not a rite of passage to design & implement your own language, distilling your two years of knowledge and arrogance into one pathetic failure of a design? And from then on appreciating some sense of the difficulty of constructing and maintaining such things?

Perhaps not always languages, but such experiences are vital to our industry!
I am looking at it from a security perspective. Any sufficiently complex software system, especially one that does not have security as prime design goal, exhibits a large attack surface. It is not a matter of if, but a matter of when.

Example scenario: a CEO of a large public corporation (which attracted a lot of short sellers). A journalist who have exposed some far-reaching shenanigans of the rich. A political opponent.

I am sure all the relevant agencies are quite busy analyzing Tesla code right now, for exactly this reason. And I know for sure that security is NOT the design goal at Tesla, at least when I talked to them. I would have designed the hardware differently from the start.

Again, I am not talking about a common use scenario for regular people, or driver turning off some safety feature. I am concerned with security of the system as the design goal.
Are you questioning whether sexual pleasure is good for human health?
Another use case I don't know a replacement for is offline team+deployment secrets. Requirements:

- you need team members to read/write the secrets

- you need the deployment service to read the secrets

Without using an online system managing the secrets via ACLs + auth, I don't know how to replace PGP here.
The CTRL-kit, which is the "real" product they have, uses electromyography, which needs muscle activation to work, so something must twitch at a minimum to send a signal. A good interface may enable controlling multiple things at once, but they would all require muscle activity.

They may have other things in R&D. At least they are closer to having a real product than Neuralink and they started their presentation on time at Re:MARS.
Ok let me tell you the criteria. There are two.

First: The monad allows for composition of functions. Returning two values does not. It breaks the flow of a function pipeline and forces you to handle every error in the same way.

Second: Extracting the value via pattern matching guarantees that the error will either be handled or used correctly. This is a way to 100% guarantee that there are No runtime errors. That's right. Using the error monad with pattern matching makes it so that there is zero room for runtime errors.

Why create a language that has runtime errors? Create a language that forces you to handle all possible runtime errors before it even compiles.

According the criteria of safety, zero runtime errors, and expressivity via composition the monad is the Best solution. There is literally no other way of error handling that I know of that can catch runtime errors at compile time.

I know you tried to flip my statement on it's head by using the term "criteria" as if there are many many different criteria for "best." And you are right, programming is an opinionated thing. However, ZERO runtime errors is a too powerful of a feature to assign to a specific criteria. Such a feature is so powerful, it should be part of EVERY criteria.

If you don't understand completely what I mean by "composition" or how pattern matching and a maybe monad can guarantee a runtime error will NEVER occur, ask me to elucidate, I'm happy to clarify.
I don't know of anything that would imply it hasn't been an option.

It hasn't happened. Or, if there exists a counter-example, it very unambiguously hasn't happened at a scale that would imply equality.

So no. Since it's clearly a sexist practice, getting rid of it is more equal than leaving it.
So they allow sex toys now but they dont want people wearing suggestive clothes because... it's sexually suggestive?
What about the fact that the reed boats on Lake Titicaca look like the reed boats Ancient Egyptians used to make? Huh? Huh?!

My favourite contentious potential sign of cultural contact is the extensive usage of sweet potato (native to South America) in the Polynesian Triangle. One of the signs that convinced Thor Heyerdahl to launch the Kontiki expedition, but he assumed (for various reasons) that contact must've gone South America -> Polynesia - things like the prevailing currents and winds being east to west.

However, given what we know of eastward Polynesian expansion, that it tended to occur during El Ninos when the currents and winds change in the Pacific, I find it more probable that the seafaring Polynesians who settled some of the most remote islands in the world, travelled to South America and then back again.
I see many golang users just parrot what golang authors say, without having any evidence about those claims. Things like "golang is designed for development in the large", or "golang forces you to think about errors" or that the way it handles errors is robust, all claims that have nothing to support them (on the contrary, reality is the opposite of those claims).
If all the interviewers were like that I'd be OK with using whatever they want. But one time I was doing a Python exercise on a google doc and I was missing a colon after an if statement. The guy had me for a couple of minutes trying to find my "error" without telling me it was syntax. The algorithm was correct.

The other problem I see is when you don't agree on something with the interviewer. One guy made me write some fictitious SQL queries on a doc and then asked me some questions. He was wrong about several things but we didn't have any way to test it. I was so shocked he didn't know that stuff that I had to tested after to see if I was actually wrong, but no.
I get the feeling that COBOL won't have much of a Y2K38 problem, but the elevator and HVAC are suspect.
Unbounce Brand Refresh: Let’s Make Extra Your New Normal
I mostly agree with the op. I was replying to pcwalton's comment, or more specifically those who would solve every problem with a monadic straight jacket. I don't agree that that is always the best way to handle errors. There are tradeoffs involved that are hard to define but really do make a difference. I think Go finds a sweet spot thay has been ignored by the academic community. Hence my labeling of Go's error handling as conceptually imperfect.
Ballista: Distributed Compute with Rust, Apache Arrow, and Kubernetes
Brains scale better than CPUs. So Intel is building brains
Very cool. Relevant: https://github.com/akavel/up
A sophisticated mechanical astronomical computer is no less implausible in that time period than a battery for electroplating. Neither require aliens.

The Incas did electroplating. We even have the remnant electroplated artifacts. Did the Incas invent batteries for electroplating first or was it the Greeks? We don't know yet. If Greek electroplated items are found someday then we'll be able to say they did it first.
> (signal uses PGP with a CA type of thing, so much for "stop using pgp")

I legitimately have no idea what this means.

> And how is essentially forking pgp with 'age' really going to solve things? Wow thanks another forked app! :^)

A big part of the criticism we've gotten when we tell people "PGP bad" is that we're not providing alternatives. age is one of those alternatives, for one of those use cases.

> It would be easier to just make a wrapper for gnupg that sets the settings for everything the author is talking about. (well most of the things the user is talking about)
> Wouldn't it be easier to just inform maintainers of the package to change the default standards of packages like gnupg? Has the author even attempted to change some of these things?

As we mentioned repeatedly in the blog post: no, the PGP format is fundamentally broken, it is not a matter of "just fixing it".

> If you for example encrypt data without signing it, how would you know that someone isn't trying to poison ciphertext to extract data leakage or worse yet, they already found a way to decrypt your data and manipulating sensitive data?

I think you're making an argument against unauthenticated encryption here. That's true! You should not have unauthenticated encryption, the way PGP makes it easy for you to have. age is not unauthenticated encryption, so the criticism does not apply.
https://twitter.com/selfrefer/status/3128391843 is a self referencing tweet and more impressive (since there’s no api to “cheat”).
I know what you're talking about. I've done it and seen others fall into this trap as well. If there was a list of ways in which this can happen, it would be golden.
Elon Musk’s Neuralink Says It’s Ready for Brain Surgery
> A wire attached to a USB-C port in its head transmitted its thoughts to a nearby computer

Any speculation around why USB-C was used? Or why this was a detail Neuralink wanted to message on?
>“We will painlessly laser-drill the holes into the skull, place the threads, plug the hole with the sensor, and then you go home,” he says. “It’ll basically be an experience like getting Lasik.”

Maybe I've read a bit too much cyberpunk lore in my day, but this sounds incredibly ambitious. Can't wait for the livestream to start!
The real irony in north america is that us white people aren't even "from" here. Hell, Drumpf is only second generation and his wife is first generation.
Sometimes it involves infrastructure and ceremony to grow the social skills of a group (church, school, team sports, board games, etc :)

Usually the team learns from the tools and the tools naturally stop being used when they are no longer needed.
I like this perspective. Honestly if it's not worth $16 of your pay per month, don't pay for it! There's so much more stuff out there. You don't need to see everything. There's so much more content being produced now that you don't need to pay for it all to have endless entertainment.
Typesetting Automation
Running Nightwatch E2E Tests with Headless Chrome and Vue CLI 3
It still exists apparently.
This. There's a difference between superficially appearing to be effective and actually being so. See Death by Powerpoint[0].

[0] https://www.zdnet.com/article/death-by-powerpoint/
I'm a bit young to have had any contact with COBOL, but I've worked in financial institutions implementing mission-critical code handling customer transactions in other languages. The first thing that springs to mind to ask is, what kind of features does COBOL offer to make these processes safer and less bug-prone? At least 75% of the code and associated reams of unit testing I've seen written in these applications is to deal with weird input and edge-cases. Is there anything specific about COBOL that is especially suited for dealing with this kind of task? I've never seen anything written about static analysis or formal modelling either. Is the compiler especially attuned to catching potential errors? Is there implicit run-time bounds checking and analysis like in Ada et al?
Couldn't we have just had a post about sex without making jokes or disparaging remarks about women?
And it's not like IBM hasn't spent the cash to get decent representations and accelerated hardware over the years.
Cross-Lingual Transfer Learning for Question Answering
What tool you use to create these stories?
what's wrong with an online system managing the secrets? KMS is great, and makes it easy to separate decrypt from encrypt permissions.

(KMS is not the only option! I'm just trying to eke out why you think that's valuable. For example, I think age, mentioned in the blog post, is a direct replacement?)
Hard pass from me.
> Let’s limit extraction instead

Just blocking pipelines without restricting extraction virtually guarantees these outcomes. Restricting extraction while shifting transport to pipelines looks like a better solution than just blocking pipelines.
Ask HN: Trading system design question – need ideas
Hi,

Consider this situation:

---

You are building a trade engine and you currently are limited by the number of trades and orders per second you can do because of the database write limit. To speed things up, you proceed to hold data in memory but since data in a trade engine is incredibly sensitive (real money trades) how do you handle a server going down and the data in memory getting lost? The system is running on AWS using Elasticsearch, DB is postgres, with background processing is done via sidekiq.

---

Any ideas on how to better design this?

Thank you.
Elon just said the primary purpose of the announcement tonight was to attract top talent.
The concept of a transaction predates software transactional memory. It's a database term going back to when databases were invented.
Symbiosis between man and AI sounds both exciting and incredibly frightening. Imagine on one hand the potential for improving our own intelligence, but on the other hand widening the gap between the rich who can afford this kind of augmentation and the poor who can't.

This is going to be a hell of a ride.
Yep, which you can kind-of do with : echo '' | fzf --multi --preview='bash -c {q}' --preview-window=up:70
> Curious, are there full-time (or at least Primary) Go developers that are upset by the lack of Try?

I use golang at an employer. error handling in golang is verbose, error prone, distracting, and difficult to make sense of when there is actually an error (composing). I've seen on several occasions now errors being mishandled (either dropped by accident, or by overwriting already existing error variables in the same scope). These issues don't happen with exceptions.
I can believe that autorotation landings are dangerous, but then, so are airplane engine-out landings at night over water... but how often are they necessary?

Helicopters are more dangerous than other aircraft:

The crash rate for helicopters alone is 9.84 per 100,000 hours. That means helicopters crash about 35 percent more often per hour in the air than your average aircraft

But have a lower fatality rate:

The fatality rate in helicopter crashes is 1.3 deaths per 100,000 flight hours versus 1.4 deaths for aircraft in general.

https://slate.com/news-and-politics/2009/10/why-are-helicopt...