skysight-inc/HackerNews huggingface dataset:
A possible solution for this would be for the extension blocking third party scripts to have a list of domains that are known to be associated, like stackoverflow.com and sstatic.net, and then consider the latter to be first party for the former, pre-populated for all the major sites.
Surely this is satire...right?
Just don't smile for the cameras.
not right. there are ALWAYS holes - it's the nature of software, hardware, and humans.
I am referring to a CIA (confidentiality, integrity, availability) related incident. Less so the availability. If an attack was truly motivated, the web stack / application stack is not how you compromise the system. The user is how you compromise the system. Do you have proper physical security to prevent unauthorized access? Do you have proper password and 2 factor auth configured? Do you educate your employees on how to identify phishing? There are numerous other ways to compromise a system than remotely via the web or application stack :)
For privacy reasons I have never had a smartphone and tend to use cash for real life expenses. My friends 10 years ago were joking at me, now they understand.
I would bet the vast vast majority of aws customers are not there because of the dynamic resource scaling. Rather, they're there because aws has become the default system provider. At least for the sfbay startup.

I agree, they are very expensive for what you get at any even modest scale. (Except for s3 which is absolutely amazing). However, if you want to run your own stuff, you're buying into knowing the details of how it works. eg you better understand what vacuum is for pg, and how it interacts with availability, and be willing to create backups, etc. AWS does do real work; it's just expensive.
FCA to delay online payments rules after threat to sales
Or ship it to the security team the week of DEFCON.
NASA Rejected Me 14 Times Before Making Me an Astronaut
The computing stacks for a typical modern corporation are too complex to be able to say with certainty that all the holes are plugged.
Part of npm is written in rust - https://www.rust-lang.org/static/pdfs/Rust-npm-Whitepaper.pd...
Don't people here think that if boeing ever get over the current set of investigation without collapsing they're going to create the safest plane ever designed ? With the amount of scrutiny they're encountering at the moment i have the feeling every single dark corner is going to be under the spotlight..

Or is the reason too deep, the whole corporate structure too rotten at the core, that there's no hope ?
Apparently, when they decided developing for the web was a good idea. The bigger problem is that computing is insanely complex in the modern age. Developing for the web is on the cutting edge of that computing power. We're delivering full, non-native applications to computers people are carrying around in their pockets. And because they expect their applications to run like "real" desktop applications the UI of those "web apps" require a seamless experience. So web apps are real applications that require the same complexity in tooling as any another C++ desktop applications. Web developers are real developers. It would insane to create such complex tooling if we did not need to use it to build for those insane web browsers. Blame Sir Timothy John Berners-Lee for our current predicate, not us.
As far as I’m concerned, “pivoting” is just a different way to say “making changes when what’s current in place is not working”.

There is your answer.
Trump had a point to protect US Steel and Aluminum plants and perhaps a few other industries, but Trump failed miserably with his "maximum pressure" strategy. Only in a couple of years we will be able to oversee the results of the mess of today.
I am working under the (I think reasonable assumption) that if your thing actually manages to become popular then you can either share governance and costs with a committee of interested parties or actually justify a subscriber model - possibly semi-voluntary style like patreon.
Been there, done that, SQL queries in JSP. Trust me, you don’t want your business and data access layers mixed with your presentation
I would like to have a browser extension that filters all the comments referencing the HN Dropbox meme. It stopped being funny after the 100,000th time.
> If Amazon's upgrading some service or competent

AWS almost never forcibly spins down legacy functionality, even if they stop advertising it, unless literally no one is left using it.

That's actually a selling point of AWS to enterprise: while idealistic devs may like “our cloud vendor will force us to use the latest and greatest so we don't have to have that fight”, enterprise buyers don't want “we’re going to be compelled to reengineer our working systems on someone else's timetable”.
Webflow doesn't eliminate the need for design, it eliminates the need for front-end development on static sites.
I guess the stack itself is probably so deep and wide generally that the attack surface goes on and on. More than anything though, humans. Staff can be exploited easier than anything else in a lot of cases (I'd wager, not my area of expertise).
Now there's an understatement. It's a completely fraudulent industry.

EDIT: It's also one that's ripe for a good and proper YC-unicorn style disruption. Hit me up if interested.
I told my son repeatedly that if he ever wanted a secure and high paying job it coukd be in cybersecurity. We aren't going back to less dependence on networks, and we are putting more and more valuable assets and operations on those networks, which will need to be protected. Although, I suppose ut is possible that computer security could move into the automsted sphere....
It’s crazy that ~10 years ago I tried a pirated copy of Dragon NaturallySpeaking on a 700mHz single-core machine with 384MB of RAM and it was capable of recognising my speech locally but now they want us to believe that local speech recognition is impossible despite having 10x the processing power.
I run my own mini-cloud at home (42u rack with way too much hardware). I do my best to follow best practices with regard to hardware, backups, redundancy, etc. I keep downtime to a minimum (Plex is life, yo). I've been doing it for around 20 years, so I'm fairly confident I know what I'm doing.

As a Director of Technology for a real company, I have never, nor would I ever dream of even considering moving to bare metal for ANYTHING mission critical. The sheer number of possible catastrophies that can occur at the infrastructure level would have me shitting my pants 24/7. Could we hire someone (or a team) to do it? Yes. But EC2 and similar infrastructure beats the pants off those salaries any day.
Yeah, those are the three pain points, for sure. Public charging infrastructure is unevenly distributed and mostly terrible. Level 1 chargers for (14-20 mph of charging) are completely inadequate for public use and yet we keep adding more of them (every Level 1 charger is a wasted space/opportunity to install an actually useful Level 2/3 charger). But range is improving rapidly. The new Model S is up to nearly 400 miles of range. Even the long range Model 3 gets 300 miles. And prices are approaching reasonable when you factor in total cost of ownership. We're still in the early adopter part of the growth curve, but rapidly approaching the tipping point.
So a thing nobody wants or needs became extremely commonplace because JS devs (and only JS devs, I guess the Java guys have yet to discover this) realized they could invent some new frameworks and managers would gladly pay six-figures a head for them to play around with it?
Agencies have been hiring front end developers in as actual titles since the mid 00's.
I guess people aren't worried about the sun burning out or us running out of wind. I think most people know we don't create energy from nothing
Virtual disk fails as well.
because saying your business is built for and in the cloud gets you investors and street cred. further, if you are having a bad quarter, you can squeeze your infra to lower opex. If you built all onprem, you had to invest capex heavily upfront, and you can't slow down your opex very much in the bad times.
The high, medium, low is based on the bottom 25%, average, and too 25% occupancy and rates. So yes, the difference can be big. The idea is that with the personalized estimate and based on where your property falls in regards to amenities, you can get a more accurate estimate for your house by adjusting your rate and expected occupancy

Occupancy rates are based on the historical averages for that market segment. So for example if you looked at a 2 bedroom property, its providing the occupancy rate for 2 bedroom homes within that specific market
OK but that's a comparison of a $3200 machine with 7x more CPU and more than double the memory of the $100/month virtual machine. The operating costs of the metal machine (electricity, repairs) and its lifetime are unstated.
> Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right?

Right. But there's a saying. "Nothing in unhackable". There in lies the problem. If you can build an unhackable system you literally can get whatever salary you want. If you can convince someone that such a thing is possible. But I'm pretty sure that'd count as fraud.
I worry a company will bait and switch with me. I have seen products get discontinued.

But yes, this is outsourcing a problem for a cost.
With LOTS of money ;)
I really don't believe it's Twitter's fault that a small subset of users are unable to follow the rules of their service. People get reported for breaking the rules and if they do it often enough they get banned. They can't relax their enforcement because one group of people breaks the rules more often.
It seems like the author has little need for concurrency and so made a very specific project to handle a very specific use case. There is a reason go was design the way it is, and the author has either overlooked or doesn’t care about it.
I know a few folks who do full time between things like SynAck and BugCrowd. SynAck is the ideal model in my opinion for pivoting to full time vs part time as a professional bug bounty individual, although it takes a ton of skill and hardwork. I'd say it's the exception moreso than the norm.

If you are interested in learning more about SynAck and it's model shoot me an email: i@willcode.it I can try and setup some contacts from their side that are working full time on platforms like it
While this isn't something that I am particularly interested in at the moment, that is outright impressive.
The Deadly Boredom of ‘A Meaningless Life’
sorry you felt that way.unfortunately you dealt with the shit-show that is Angular + TypeScript, which is not beginner friendly AT ALL. I would ask you try using create-react-app, https://facebook.github.io/create-react-app/, and drop jQuery. JS is really awesome now and everything that was "in" jQuery can be achieved through standard library.
The reason I run in the cloud to be close to the object storage and average bandwidth between machines.

I run big batch jobs and setting up a full cluster filesystem and fast network is non-trivial.

Recently, using S3 with VMs that have 25Gbit network, I can easily make 'aws s3 cp' (after tuning) generate 10+Gbit of traffic reliably.
The Fully Remote Attack Surface of the iPhone
I have similar memories of translating the Odyssey and the Anabasis from Greek at school!

There's a lovely line in the Anabasis about seeing an enemy army approaching from afar which describes "the flash of bronze". I always found that image so powerful; you can barely see these guys in the distance, just a smudge on the horizon, and then there's this flash of light as they lower their spears and the sun glints off them, and you know you're about to have a bad day.

There is a line in the Odyssey where someone (Telemachus?) puts an arrow on a table for the suitors to try and shoot from Odysseus's bow. The arrow is described as "naked", which i think is a poetic way of saying it was alone and conspicuous. This is the arrow with which Odysseus will soon begin his execution of the suitors, and you know that's coming, so this is a moment of real foreboding. The line ends "... γυμνός", and the feel of those syllables in my mouth is somehow incredibly heavy, like a gavel falling in judgment, or a tomb being sealed. I read that twenty years ago and the feeling is still with me.
> I'm surprised more mid-size companies - those with AWS bills in the 6-figure-per-month range - don't leave the cloud, get physical hardware, and pay some sysadmins.

I'm not surprised at all: that's thanks to the beauty of lock-in effects. Especially all those cloud-specific managed services make it really hard to switch, and even if you are treating the cloud as a pure VM platform, it is considerable work and risk to switch to a self-managed bare metal setup.

Basically, if you don't start bare-metal (incurring having to assemble the necessary know-how to do so) you will have a hard time to get clean from the cloud drug later on, when you think you're ready to afford having the know-how. I think this aspect has been a main driver behind the linked article.
How do we even detect these bloody endocrine disruptors? I have no idea which things in my environment are leaking this stuff. Perhaps pie in the sky, but it would be awesome to have something like a geiger counter for endocrine disruptors.
Mostly security auditors, people who fill out spreadsheeets or run canned tools
You make a good point. How do you compare your idea to the one that we need to take time to smell the rose? I think that idea suggests that we need to slow down and watch the world more closely. Just wanted to know what you think of that.
And the new Norwegian ferry Color Hybrid was recently delivered. Not quite twice as large (2k pax, 0.5k cars). Similarly-sized 5-ish MWh batteries, plug-in or diesel-electric. Electric operation around ports, to minimize pollution, and hybrid or diesel elsewhere.
The premise that the other team members could be working in the documents at the same time is false. I’m a litigator, so that’s a bit different, but there’s almost never a situation where I want other people editing the document while I’m doing so, even if the technology permitted the changes to be integrated seamlessly.
There's the rub though, right. It's 'a tiny company with millions of users'. QED.
The idea that being vegetarian or vegan is more expensive than eating meat seems utterly absurd to me.

Meat, excepting processed barely-food bollocks like frozen chicken nuggets or whatever, is substantially more expensive than any food item I regularly buy.

Dried pulses are like 1-2 USD per kilogram. You're eating stuff like lettuce, cucumber etc anyway unless you're a savant, same for pasta, rice, etc.

The only place I can think of in which it's potentially more expensive is stuff like McDonalds not having a vegan option.

I'm guessing this is either an American market distortion, or one of those "but I work 80 hours a week so can't do anything other than the most convenient thing ever" weird might-as-well-end-yourself-because-you-are-a-cog things.

What gives?
Our times demonstrate that the effective social cost of "the cloud" for sure overtake the provided convenience.
Over generalization is the main problem here.

It all just depends on the context. Going to the cloud, can really make a lot of sense. For example, if you are a start up that is targeting a mass market and need to scale quickly in multiple regions... Or, if you are the CTO of a large company and don't want to spend time and focus on running your own data center and everything involved with it...

There are also many situations where running your own collocated dedicated server is the best choice. Keeping it lean and mean and removing as much as possible dependencies, complexity and layers does have benefits.

It is hyperbolic to state that something is just shit for everyone in all circumstances.
What would you recommend instead of those?
Good luck finding a Cloud Engineer for that money to manage your cloud-based infrastructure. ;) Because it’s not going to manage itself, not if you are doing anything remotely complex. And even if you are not doing complex things, DYI is only for techies, cloud or not.
wine-face = smooth surface? texture not color?
In many cases, .GIFs are quite a bit smaller than .PNGs. They're useful for putting small bits and pieces of artwork into data URIs, for instance.
I went the opposite way. Big law to programming. I make about the same (maybe slightly less but not if you account for unreimbursed business expenses like buying suits and similar hidden costs of employment) but for less work and I'm way happier. Many, possibly most, lawyers are miserable and hate their work. It's long hours and high stress, both because the stakes are usually high and you are frequently dealing with open interpersonal conflict/adversarial relationships. Plus no chance for equity, so you're an hourly worker for life.
>more nuanced explorations of Cloud v. DIY tradeoffs

100% agree. This article goes so far as to be farcical, but that doesn't mean there isn't something worthwhile to be had in the conversation... as long as that conversation was framed appropriately. Especially around cloud value-adds like managed databases and Lambda and security technologies like CloudWatch/Trail.

I'm the sole (part-time) dev-ops resource for a very small company and we (by which I mean I) DIY just about everything running on a small VPS on DigitalOcean. I run my own database and manage my own dokku and user access etc. I use S3 and have dipped my toes into Lambda but I always wonder if I'm missing out on something not using cloud technologies more heavily.

I would absolutely love an analysis of what cloud technology companies SHOULD be using and at which point they become or are no longer worthwhile in favor of an alternative.
"Simplicity is complexity resolved"
That's definitely something to consider : i don't want beginners to start coding in old school php with sql statement inside html templates because they read on HN to "not use modern frameworks".

BUT, i don't think this "crude design" trend will ever have the same attractiveness to junior developers no matter how much hype it gets here. Being attracted to "new shiny things" is very intrinsic to human behavior, and tech companies will keep spending ads to sell their new tech to the market.
I think at 10$, it was way to cheap to even survive on the gym-economics. I think the plan was to build a huge userbase, and then use that as leverage to:

1. get better prices from theaters to send users there

2. make deals with studios to send users to their movie

3. make deals with nearby stores to send users there

it backfired when all the theaters called the bluff and just started their own membership program, and held out until Moviepass bled out all their VC money.
Things are out of date because things that are working don’t get money and time allotted to them to update them.

People still run Windows XP because there’s a piece of software that never got updated to run on Windows 7, much less Windows 10.

There’s those Java apps that are stuck on Java 6. Websites that still need IE6. Things that use the unsafe versions of stuff like HTTPS...because Visual Basic 6 doesn’t support them out of the box.

But it still works. So it keeps going.
The idea that scheduling recall repeatedly is a poor and inefficient approach to learning is directly contradicted by all available research on learning and memory.

See [0] for a review of the research on spaced repetition.

[0] https://www.gwern.net/Spaced-repetition
Why Zomato’s stand against bigotry matters
I think you may be imagining a comprehensive numbered list of exploits. Some products are sold that indicate things like this.

It may be possible to write a software component that is not vulnerable to exploits, but any non-trivial system built of many components will almost certainly be exploitable.

As much as people say they value security, they also value delivery of working software.

Additionally, as others have said, no system is invulnerable from the CIA, NSA, KGB, etc. Someone knows the passwords (or where the passwords are stored) for your system. They may be vulnerable to bribery, blackmail, torture, etc.
If the list is domain based then you run into a "Who is paying to maintain the list" problem, and if it's self-registered (i.e. stackoverflow tells you sstatic.net is legit) then who verifies it was actually stackoverflow that told you that - and if you manager to verify that it came from someone within the domain or the registered owner... then how can you verify that sstatic isn't a domain serving malicious scripts and the owner isn't selling out users to the site to make a quick extra buck from some third party ad provider - or that it isn't the former owner who is acting maliciously - or that it isn't the current owner who is trying to undo the former owner who acted maliciously.

I think you could quite sanely track a few sites, maybe the top 200 or 300... after that it'd get unwieldy.

And, for fun, on the other side I believe a few years ago google's in house public hosting of jQuery received a bad push and was serving a tainted package for a while... even the good actors can mess this up.

A peer vetting system might work well (like DNS) but it'd need a lot of careful thought.
Imagine unironically thinking that people spending money stupidly is a new thing that just started happening this decade.
A couple of things:

1. You are not interpreting the use of the modifier 'pretty' correctly. It is used for emphasis or to add or increase some property; to imply that something is more than usual. To say that 'it is pretty hot today' means that it hotter than if you merely said 'it is hot today'. Thus, when I say 'pretty modern', I am indicating a degree of modernity that is more modern than simply 'modern'. As far as I can tell, you are interpreting 'pretty' to mean that something is lacking in a quality or falls slightly short of possessing a quality. But that is the opposite meaning of the word. If I were trying to detract from their modernity, I would have said that they are 'kind of modern' or 'somewhat modern'.

2. The bigger picture, though, is that you're focusing on a single word choice instead of literally everything else I've written, including the crucial point that I have to agree with you for the point that I was actually making to hold true.
Nice to read an article that's covered in 20 billion ads, great experience.
> No. The law is not a virtual machine and legal documents are not programming.

This is true, but I'd think the opposite point is more important.

Much of the grunge work I see the lawyers around me do really is about parsing out and semantically evaluating some clear-cut-but-complicated bit of text. As a result lawyers genuinely value producing (and succeed at) producing logically coherent, unambiguous text.

By contrast, most programmers are as sloppy as their compiler will allow them to be. This is bad enough in code, but it is much worse when we talk to each-other in English. Not only documentation, but internal design discussions etc, are usually some combination vague, meaningless and wrong.
I'd never heard about that site but it certainly looks interesting. It is different though,it seems to be a peer to peer booking platform (without the Airbnb/VRBO fees) and not an analytics site (although they do have some marketing analytics)
But, can the marketing intern update it?
LibCST: A Concrete Syntax Tree Parser and Serializer Library for Python
It is certainly new, but I have a really hard time thinking of a single time I wished my phone could fold out. Better battery? Check. Better handling of notifications? Check. Better one-handed use? Check.

Fold out? I appreciate the newnes, but no.