skysight-inc/HackerNews huggingface dataset:
> I imagine it would stop you from client-side warnings of password insecurity, but is there a bigger problem?

The bigger problem is that passwords aren't half the sensitive data on the web, they're just the example people are using because everybody knows they need to be protected.

If you protect the password from the script but it can still read your name and address, and your bank balance, and the private information you thought you were only sending to your spouse, have we actually solved the problem? No.
I have a keyboard shortcut for a "dangerous" mode that allows 3rd party images, 3rd party styles, but still only 1st party javascript. Works for stackoverflow.com, not that it doesn't show content without any of 3rd party stuff and any scripts. But I get what you are talking about, different, but still technically 1st party domains and separate CDN domains for some websites is the reason I have rules in my extension, it's like whitelisting adblocking.
I'm sorry who is this person and what authority do they have?

His "homepage" is a raw directory dump with a high-contrast black background (the preferred color scheme of 10x engineers).

Isn't that enough authority for you?

BTW if anyone knows of more nuanced explorations of Cloud v. DIY tradeoffs -- we all know there's a tipping point in favor of the latter, somewhere -- please do share.
If you're talking about installing apps, every installed app needs to be signed (unless you ignore Windows/macOS warnings). If you're talking about injection or modifying program files (be them executables, DLLs, or ASARs) post-install, every app is equally-vulnerable. There is no functional difference between a native app or an Electron app in that regard, so maybe you can clarify what you mean by "system app integrity protection."
Most data centers provide smart hand service.
You can ask them to do (any) physical task for you.
ralusek, I have a question for you.

But first let me say that you're offering the standard conservative explanation of why the crash happened. But at the time the real estate bubble was going on, the conservatives all said it was sound economics and there was no chance it would crash.

And then when it did crash, then almost overnight they all suddenly changed their line and talked as if they had known all along the country was on a dangerous financial path.

My question for you is, when real estate prices were skyrocketing, did you think it was good or bad?
I can tell you traffic lights are extremely insecure. Last month there was a traffic light that was turned the wrong way, such that it was impossible to tell if the light was green. So I climbed the poll and turned it to the right direction. Another fellow pedastrian thanked me.

A bad actor could do anything from a DOS (positioning it the wrong direction) to tampering with the bulbs (for example swapping out all the greens with reds).

The reason most society doesn't collapse is because we assume most people are good actors. Unfortunately once your device is hooked up to the internet you vastly increase the odds of dealing with bad actors and have to spend more time and money securing against bad actors.
You also don't even need to use RF. You can also use high-frequency audio to communicate to other devices, though I guess I'm not sure how you get it out of the building.

It has been said that covert agencies have monitored conversations through windows by measuring the acoustic vibrations with a laser. So maybe that will work, but I have no idea how well that works with higher frequencies outside of human perception.
I'm skeptical about the "more than 300,000 unfilled security jobs" stat. Are we talking about thousands of empty chairs for each of the big tech companies and hundreds for each of the remaining fortune 500?
You are correct sir. The rest of the parent comments procunciation is spot on though. I had to say it out loud a few times to confirm it was closer to "eh".
Yeah, I'd actually be happy to pay... and I do for LWN, for example.

The problem is that publishers apparently(!) cannot properly distinguish between ad-driven revenue streams and good/loyal-customer revenue streams. (I don't know why this is even an issue, but here we are.)

Do NOT serve ads to your loyal revenue stream. Even if you can't make ends meet, do NOT do it. That will piss them off to no end, and they're your most loyal readers; they'll leave and never come back.
> However, the rust/LLVM compiler pipeline is nowhere near mature enough for use in high-criticality environments.

I love Rust, but I wouldn't want it to fly a plane I'm on. For instance, here's a bug in LLVM that Rust developers happened to discover - before they disabled their use of the buggy features, Rust/LLVM was producing _numerically incorrect_ code. https://github.com/rust-lang/rust/issues/54878#issuecomment-...
I've refocused on web development in a new job after six years of being mobile dev first. To me, the answer is that design and user expectation got more complicated. Look at what was considered a state of the art web page 10 years ago, and you'll find the UX wasn't nearly as nuanced as today. Combine that with polyfills and responsive design requirements and it's just as complicated as a native app, and look how big those things are.
I built a (tiny) Real-Time Telematics application on AWS
I wouldn't go so far as the author when recommending tech stacks for startups or hobby projects. The main benefit of cloud providers is that you don't have to learn and pay attention to all the stuff he lists, and you can focus on building the software you want to build.

But I do think he's performing a useful service in highlighting just how much you're paying for not having to hire a devops or sysadmin person. 10x performance differentials have been replicated not just by him but in other benchmarks. I remember seeing a chart when I was still working at Google and GCP was being justified that showed a graph of hard disk prices vs. S3 rates - since inception (2007-2012 at this time), S3 rates had gone down by a factor of about 2-3x, but price/GB of physical hard disk space had gone down by ~100x. Amazon is hiding all of this improvement in the physical hardware behind vCPUs and opaque billing, and it becomes pure profit to them.

I'm surprised more mid-size companies - those with AWS bills in the 6-figure-per-month range - don't leave the cloud, get physical hardware, and pay some sysadmins. At that level you could easily afford them, and you probably can get old Linux greybeards cheap now that everyone thinks the job description is obsolete.
How do you know what everyone was paid?

That’s definitely not the norm though - security engineers are typically classified the same as an SDE for payroll purposes, and tend to have less negotiating leverage than high level SDEs who build and ship products, except maybe some very rare exceptions. But most companies also don’t have their security engineers actually write shipping code.

I think this article, like every security related article from bloomberg, is pretty much BS.

Also, they use the example of CISO at a large company. CISOs aren’t actually security experts in the vast majority of companies. They’re usually business people or outright frauds, disappointingly. The people who hire and interview them have no way to validate them.

The article makes a case for why CISOs are worth a lot, justifying the cost of a breach. The problem is that CISOs have virtually no impact on whether or not you get breached, and they usually bear no responsibility for it. It doesn’t matter who you pay how much - it isn’t going to affect the outcome much. Alex Stamos is one of the few that actually has any background in security at all, and look what good that did Yahoo and Facebook. Not much. The other problem is CISOs rarely get any actual authority over product, and when they try to flex, they just get pushed out. The ones who survive are simply master politicians who manage their messaging and their image.

The real reason for this article, I suspect, which appears to be primarily sourced from a security recruiting firm, is that they take a cut of every position they fill. It’s very much in their best interest to pump up the value to justify their fees.

Most security money is very poorly spent. I think part of the problem is that hackers are usually bad managers, and tend to be less interested in playing corporate politics. So the manager jobs go to someone else, who has to make decisions they don’t understand. The higher up you go, the more this gets amplified. For every breach you hear about, that company likely has a few competent security folks saying, “see, I told you...”
It is absolutely still true, most ship engines are not removable without breaking the hull above the engine.

Seems to me, especially with electric engine pods, ships can be designed to allow the replacement of the engine/generator.
Should I Use Golang or Node.js for My Next App? – Faith Chikwekwe
> many of its developers refuse to adapt technologies for the sole reason that it "stinks" of Microsoft.

I don't where did you get that idea but it is not true at all. Linux developers have a history of ignoring (and reinventing) technologies and interfaces developed in other Unix systems, too. You can listen any Bryan Cantrill rant for more details. The claim that they refuse to adapt technologies that "stink" Microsoft is a mischaracterization.
Totally depends on the industry niche. As always the low margin guys will repair/modify and the high margin guys will buy new hardware.
No. The law is not a virtual machine and legal documents are not programming.

Believing so is a common misconception amongst engineers, but depending on it as such is likely to lead to disappointment, frustration, anger, needless bickering, extended conflict, and vexatiously long, hard to read, and mostly unenforceable contracts.
Wow, I had this exact thought the other day. I loaded the page, and just sat there and watched this animation on the screen. "What is it doing" was all I could think. All I need it to do is load the subject line of the first however many emails in my inbox. It can't be that complicated.
That's the point. At no time did the engineer building the application make a poor choice. He/she made the logical rational choice to get the job done. It's the same thing for the tools developers. They each made their respective tools to solve a real concrete problem and succeeded. The problem is that everyone seems to be making incremental improvements and engineering choices that locally make sense, but when you zoom out and look at the whole picture things look absurd. We're incrementally improving ourselves to a local maximum that seems to be an uncomfortable place to be. There may be a better path that will lead to a better maximum, but we can't see it from where we are.
This is seriously cool, thanks for making it!
I personally would make a different suggestion here:
1) set up a new corp as soon as possible to be able to track business expenses right away, issue stock, etc
2) use an S-CORP instead of an LLC. All those additional “processes” people usually mention are really just “good business,” not that difficult to keep up with, and ultimately will only add security especially if you will have cofounders / investors.
3) use ONE corp for all your MVPs, track per-product costs nicely for each of them (Xero does it well), and only maybe spin them off into separate companies if/when they succeed
Yes, but AMC and Regal can (and did) negotiate ticket revenue shares with the studios. They also have additional revenue streams like advertising, private events, and especially concessions that are independent of or benefit from increased subscription attendance.

Consider that for a regular movie ticket, the movie probably made more from the concessions (which cost the theater pennies and can get marked up by up to 100x) than they do from the ticket.
For anyone interested in more on this, Radiolab did a really good episode on colors which includes a bit about Homer: https://www.wnycstudios.org/story/211119-colors
I'm curious if anyone has found consistent work doing bug bounty's and things like HackerOne to a sufficient degree that it would replace a FT engineer role.

I'd love to hear/learn about someone's experiences if it exists.
The rundown on your costs assume that the site or service remains “unpopular” (as in not used by the majority of internet users). Costs scale pretty high if one finds themselves running a high-traffic site.
I agree, it depends of the code, and if you need to replace it: by what.

I'm actually more found of when I don't even have to replace it: just delete the damn obsolete shit. Not replace. Delete. Most of the time it for cases where it is just dead. Sometimes it is only quasi-dead (from an incomplete previous modification) and in a few cases deleting it actually fixes some bugs.

The best patches only have - lines :D
Reminds me of a scam in a game called Ultima Online I saw where someone would pretend to be an NPC and say 'I shall double thy gold if ye trust me' and if you gave him 5 gold pieces he would give back 10. After a bunch of transactions someone would inevitably attempt to give him 100,000 gold and then he would stop working ha
Rise in opioid use for migraine treatment
You don’t need to wait for Apple, you can use the <picture> element to show webP images and fallback to PNGs for browsers that don’t support webP.
Are theaters even breaking even on screenings? From what I understood the economics are based on the value added services AKA the food crap as well as merch for the larger box office hits.

I think the idea behind movie pass was basically the same economics as behind a gym as long as most people don’t take the full advantage of their membership and are tied to a contract they’ll make money if everyone does it’s a different ball game.

The problem with movie pass is that their model is too easy to replicate by the theater chains and cut them off, i really don’t understand why they got VC funding even if they could scale to the point of making a profit this model simply can’t be easily protected against competitors especially when the competitors are part of your service supply chain.
I've never understood people who say: "No amount of controls will stop someone truly motivated and skilled". I don't think that's true.

Correct me if I'm wrong, but If there's no holes in the application/web stack to be exploited, then there's no getting in. Right? It's not about hacker/pirate skill. It's about whether or not the target has plugged all their holes or not.
None. That's the point. Web development is not simple. You don't have to always use the very latest super framework, but even the minimal setup for developing a modern website has quite a few moving pieces. If you remove any component from the list above, your development experience will become harder.
We analyzed fluent when we built the product and found that it didn't offer much more than the international standard ICU. Our platforms have full support for ICU syntax including plurals.
My summary of this article: Don't go cloud because it will cost you heaps. Instead, spend most of your day sysadmining instead of working on business problems. Or hire a sysadmin.

Sounds like this persons job is being made redundant by clients moving to the cloud and he's not adapting to the market.
Dropbox doesn't appear to have the strongest developers on the client side, so perhaps that's true on the front end as well.

I still get messages along the lines of, "Your hard drive is full. Dropbox cannot synchronize until you free up some disk space," with 4 GB free, even though many users have complained loudly about that for years. The Dropbox client was also causing weird problems with dropdown menus in MS Office applications for a long time, which took forever to track down. That at least appears to have been fixed now, although I can't (or perhaps don't want to) imagine how it happened in the first place.

Dropbox does hard things, HN conventional wisdom notwithstanding, and they do them reasonably well. But they can be very slow to recognize when they're doing something wrong.
>Your co-lo can physically ran out of space

The number of times I've run into this at clients is ridiculous. Either there isn't enough space in the rack, or they're out of network switch ports, even down to being out of SFPs or network cables themselves. I've even seen clients run out of power... as in, they couldn't add one of our servers to the data center because the UPS and power delivery systems could not safely handle the load of one more server.

Running a datacenter is a lot harder and more costly than most people think.
This is untrue. A "backdoored" native app (i.e. an app where an executable or DLL was modified) would also be squeaky clean.
Logic in the templates... are you describing PHP or React?

To be fair the parent comment isn’t saying everything about his stack is perfectly elegant, but if you can deliver a website that works without stateful client side JS and associated build tooling, then it certainly is simpler, and most of the time simpler is better.
There was never a better time in the history of the internet where "all the IT knowledge" was more available and easy to get.

And the sysadmins are doing pretty well I am sure, they'll pitch in here once they find their way out of Terraform's documentation.
I’m failing at finding the original report about this but this is the line I keep seeing repeated in PRs:

> Nationally, there were 301,873 cybersecurity job openings in the private and public sectors during the 12-month period between April 2017 and March 2018. This included 13,610 openings in the public sector.
This was my understanding until a few weeks ago. But reading up on the subject paints a different picture. With the non-linear changes likely to be hit soon. Things are going to get serious for us too, and likely noticeably so within the next decade.
Unless you use Clojure ;)
If you manage some legacy systems, as I do, you will find that Cloud is very useful for automation, CI, and dev environments, why? Well, create scripts to build Window servers created with custom images is actually a big deal, so:

- disaster recovery is the first thing you should have in mind, where is the second.

- the right strategy is to preserve the business, not going to the cloud.

I always had fun building my own environments. After the fun came the work and, economically speaking, managing and maintaining those environments has always been an advantage for me. If however, I consider the time it takes to understand and fix problems in VMWare, or SQL optimization, or configure Microsoft AD, Nginx, and others..., I don't know how much I would recommend building everything from scratch by renting some servers.
> The money you save in the cloud isn’t on hardware, it’s in not having to pay a sysadmin so you can work on business problems

Maybe, but you probably have to go pretty far on the cloud maturity spectrum (using cloud native services effectively, not simple VMs like EC2 or even comparatively thin services that abstract just the machine/OS layer like non-Aurora RDS) before you are saving more in local-machine-focused ops teams than you are paying in cloud-focussed ops teams. The latter are more likely to be timeslices of time of team members that are primarily developers, but its still work with a cost.
I think there should be a new razor, we can call it the Apple razor because Apple is the most common case. Basically, when tempted to ascribe the decisions of a successful entity to stupidity, consider that you may not be considering all the facts and facets.

Yes, web development is complicated. Yes, that complexity is at times completely unwarranted. But, that does not mean that the originators of this complexity were simply being stupid. A company like Facebook has a simple requirement: keep users on the site. If that means building a completely overengineered platform or inventing a totally new front end framework, sure, go for it! As long as it keeps the experience so smooth, so seductive that people scroll for hours, absorbing ads and producing money for Facebook.

I wouldn't be surprised if someone did some user testing and the SPA with no jarring refreshes and fluid page changes scored significantly higher on user engagement.

If you look at the companies that have really fancy JS libraries, they're generally places that rely on people using their apps continuously. Netflix? They're practically the poster child for internet addiction. Twitter? Yep. Even old school media companies like the New York Times are starting to use fancy web technologies. Clicks and eyeball time is money. Stuff like React and transpiling and webpack are small prices to pay if they keep your front end developers happy and your website nice and shiny for your average user.
Fixing “Out of memory” errors for an open source Symfony app (on Reddit)
Our generation is exposed to a lot of things that no other generations have experienced over extended periods of times like food preservatives, continuous wifi exposure, sunscreen chemicals that daily gets into the bloodstream, high blue light exposure, plastic water bottles, pollution... Our generation will probably be known as The Great Guineapig.
Wirecard.com.br data breach impacts 4.3M users; SHA1 hash algo used
We have ownership of our profile and filled out the links with what we wanted initially.

In fact when we log in to manage our profile it still shows the correct link, but the link replacement is happening on a layer in between the profile management and what displays to users.

After several years Google just swapped the link to a 3rd party that claims to have an agreement with us. Which there is no documentation of, and the dispute process is not handled by Google but the 3rd party directly. Which is why fixing it has taken over a year.

And to correct my earlier comment our Google Ad budgets is now 120k+ per year. But even this doesn't give us the ability to appeal to a higher authority and swap the link.
Build Your Own Code Review Solution for Your Future Projects
No, web development overall hasn't. Web apps specifically are largely fad-chasing vanity (manager, organizational level) or that, yeah. Which is cool because there's all kinds of dumb money flying around for them now—that part's been amazing. But it's not serving users well. Peacock feathers.
People don't want to pay because most of the shit out there is shit. It's all supported by sensational headlines, controversial stories, fluff, and lies. If it all disappeared, we'd be left with things that exist because people care about it, things that are cheap to run, and things that are actually valuable enough to pay for. Can't be worse than the situation we have now, and you cut out a huge swath of parasites in the process.
I wonder what your brand new greenfield project is going to look like in five years when it's been passed through the hands of a few interns and contractors and survived a couple different ownership shuffles.

Think it will look as maintainable as it is today?

Or do you think a new consultant will roll through and easily sell the client on another rewrite-from-scratch project?
How likely do you think it is that a company that manufactures traffic lights and incidentally builds the software to control them would cough up 40+/hr to have someone independent come in and vet the software that was written for 12/hr and seems to work just fine?

Part of this is just a poor understanding and pricing for software consultancy - along with some absolutely terrible actors in the HPC realm. Ideally your HPC will come in and spend a fraction of the time vetting software that the dev team built, but occasionally you get a fraud who works 8/5 for a month at 120/hr and delivers nothing but vapor in the end.

Maybe some security consultant industry group could set up a certification program, though all the times in memory I've seen software related certification it's been

1. Absolute BS in terms of skills evaluated.

2. A money grab by the certifier.