skysight-inc/HackerNews huggingface dataset:
> Postgres needs to run under a specific os user. That alone makes it a poor MySQL replacement

Where did you get that idea? Postgres can run as any user.

In fact, I recently switched my applications to use Postgres even during unit tests (instead of SQLite), i.e. that testing instance runs under my normal login user. That change actually made the CI go faster because compiling the Go SQLite driver takes much much longer (about 30-60 seconds) than spinning up a Postgres from scratch in a temp directory (about 2 seconds) and using that instead.

@fizixer: I don't use MySQL, but I've heard it's not nearly as bad as it once was. I use PostgreSQL for everything from traditional relational data to time series to job queues and am 100% satisfied. Hasn't once let me down. The only caveat is that clustering is still easier to do with MySQL than with Postgres from what I hear, so if you have really really big setups that require that, that should be considered.
If DNA Was JavaScript (2016)
It's one of the reasons carbon tax + dividend might actually have a chance. If the dividend only goes to humans but the tax is paid by both humans and corporations, and it's revenue neutral, then the average real person is getting back more than they're paying. That's the sort of thing people like.

I don't think humans will get much back out of it. Most of what corporations are emitting is on behalf of the customers. All the cement factories that emit insane amounts of CO2 do it because that's what it takes to produce cement, which customers then buy. When carbon tax passes, the cement price will necessarily rise, which will offset some of the dividend gains. The exact amount of increase depends on the elasticity of the demand for concrete, but from what I can tell, there aren't really any substitutes for concrete that wouldn't also be hit by carbon tax (there's lumber, but most of what we currently build with concrete can already hardly be built with wood).

This is not to say that carbon tax wouldn't have intended results: it would indeed shift the consumption towards less carbon-intensive products. However, I don't expect that average carbon dividend will be significant.
Why would you have a surveiliance node in your home if you are concerned about privacy?

As for the other thing, I am running this in firefox with containers active. Google gets their own, Facebook gets theirs, twitter gets theirs and mostly everything else gets a temporary container. There will be no connection between them to use my data on, and in a few minutes my records of their cookies will disappear.
Piano Lessons Saved My Son's Life
I have a stainless steel french press. Love it, super simple to use and keep clean.
Samsung Announces Qualcomm Snapdragon 8cx Powered Laptop
I have heard the argument from my grandpa and other old people that there's a conspiracy of scientists and liberal media people to get more government funding by claiming climate change is real.

The madness behind this conspiracy theory is that the amount of money those scientists could get is minuscule in comparison to the enormous wealth generated by oil companies and oil producing nations. Wouldn't that be a much more reasonable conspiracy theory to believe in?
I don't think the JS devs drove it, at least not primarily. I think they're largely eager to exploit the enthusiasm of others (and probably they should be) and I've seen it happen. I do think it's peculiar to the web. Most other GUI app ecosystems are content not to invent their own visual vocabularies over and over or twist every mundane little program or UI element into an "experience", for instance—I think that has something to do with it. It's the set of norms and (self-imposed, to a significant extent) expectations of the web, of the fear of "falling behind" (see again: peacock feathers). I think the background of the Web in bespoke brochure-type graphic design and marketing has an absolute ton to do with it.

I think a lot of the cost has to do with the underlying tech not really being that great for what it's being made to do, in concert with everyone feeling the need to try to be special in even the tinies little looks and behaviors. It's also where a lot of the audience is so will tend to experience oddities like this more exaggeratedly than other fields.

Your manager or project owner or whoever says "we want a webapp" are you gonna stick your neck out and argue against it? "But it's what google's doing", "but Gartner", but whatever. It's cheaper! OK, sure, here's my bill. It's absolutely follow-the-leader behavior, damn the cliff. And it works well enough that it does get the job done, eventually. It's just not necessarily doing the users any favors, or your bottom line.

Decision makers do strange stuff all the time because they think it makes them look better—and, to the extent and in the way they expect it to, they are probably right more often than not. This is just one example. Whole world's run by guesswork, personal quirks of taste or incentive, and blame-avoidance (follow the trends), more than anything else, from what I've seen. It's just people, running around doing funny people stuff, hoping no-one calls their bluff.

[EDIT] actually, look at Java Applets and, more so, Flash. Folks hated the way lots of those were used, but the worst and least-justifiable uses of them happened anyway, for a long time, because managers wanted the bling. That was, seriously, it. And developers went "oh sweet I can add Flash 5 and Actionscript to my résumé, I've been wanting to play with that". That's exactly what happened then. This is exactly the same thing, just much bigger. And in both cases sometimes the tech was used well.
Two problems with that - knowing about all of your holes, and whether or not they are plugged, is impossible. Second, many breaches don’t even involve holes in your web app stack. Low tech attacks like phishing and malicious attachments are remarkably effective to get a foothold into a network.
>Corporate IT groups typically don't treat their non-IT coworkers as customers. Instead, they treat them as adversaries and a nuisance.

One deep problem with the "internal customer" model is that you don't get a larger budget when you serve your "internal customers" better.
SME Finance Management for Europe (mostly D/A/CH), think of it as Xero/Freshbooks with very country specific features.
> Sometimes one firm called a security junk and another gave a triple-A rating deeming it supersafe.

Doesn't this suggest that the ratings are providing close to zero signal?
Not mission-critical, must-never-fail mature, no. All of these systems contain tens (if not thousands of bugs), some of these probably come from compiler issues sometimes.
Khan Academy 2018 Annual Report: 8B Minutes
I remember when you bought a fridge and it came with a schematic.
Developments like air support hulls - https://www.youtube.com/watch?v=04KnXJTRRYk - are another possible way to go if you want efficiency and a bit of speed.
I am using pixel 2 on Google Fi. My monthly bill is around 20 or $30 per month. The phone is rock solid and has no malware or bloatware and I see myself using it for several more years.

I think that could be one of the reasons for sales falling off a cliff.
Ideally the ISP does basic ingress policing and doesn't accept packets from source addresses outside its range.

Yes, I know most ISPs don't do this. But they could if they wanted to.
That's not what they're suggesting though. The suggestion is to be able to implement business / data access layers in the same style/language that people are implementing their presentation. That the two would be intermixed could certainly be an intended consequence / anti pattern, but I don't think it's inevitable.
Worse, "Google Backdoor" (a/k/a "Tag Manager") lets third parties inject Javascript into your web pages. You can't even put Google's stuff into an IFRAME to sandbox it.[1] The Evil Empire does not like to be contained.

[1] https://adsense.googleblog.com/2011/06/clarifying-our-ad-imp...
I don't know what they did at Microsoft, but this is just pants-are-shirts wrong for SFBA tech companies. I could tell you I know this from near-firsthand experience (getting offers, watching friends get offers, for both SDE and security roles, as well as doing technical recruiting work for our clients, who are almost all SFBA startups), but you're also responding to someone giving you firsthand knowledge at Netflix.

The people telling you security talent commands a premium are not lying and they're not wrong.

There is a general instinct people have to push back on "look at these high salaries" data points because, not to put too fine a point on it, they're not good negotiators and get second-tier offers. That includes a lot of people with truly extraordinary talent; negotiating skill and delivery skill are, of course, orthogonal. But even that is changing; all you have to do is keep your ear to the ground to know that the standard SFBA SDE salary is not the market clearing rate for (e.g.) software security.
It’s at least $23 a month. AMC negotiated with the production companies to book each movie seen as costing $8.99. They then give the studios between 40-70% of that. Movie theaters have always made their money on high margin concessions and more recently alcohol sells. They also make money from ads showing before the movie.

AMC is not losing money from the deal.
I don't think consumer OSes are considered highly critical.

(Unlike code running for avionics for example)
Best yet for me was 'client-side pricing' - I increased basket 'weight', and the web app neglected to correspondingly increase the price.
Well, I was going to say more on the subject, but didn't want to get flamed by JS lovers. I did say "If you can execute JS in a browser, you can do whatever you want to that page in the browser."

I don't disagree with your point, but there is another perspective that the mitigations aim to stop, which is cross-tab/window data gathering (and cross process), which is most of the point of Spectre and friends anyways, which is stealing data from some other process, not the process you are running under. Stealing from your own process is easy. Stealing from another process is supposed to be hard, and stealing from the kernel is supposed to be impossible.
Yep - this is why you might try to limit pivoting based on an assumption that everything is compromised, you can require coordination from multiple geographies to unlock access to certain highly sensitive resources, you ensure that these protocols aren't published, and above all you follow the New York Times Test: don't type anything that you wouldn't want to see on the front page of the NYT. This requires pride in security at all levels of your organization, and it's something that few organizations outside of the military get right.
Part of Friendsters death spiral was the decision to move to AWS, which was a technical disaster.

On Cloud vs baremetal arguments. I respect people find cloud works and is valuable for them. This inspite of my own personal experiences, direct or indirect with cloud have been adverse. I agree with author, for me, for dollar and time effort, baremetal is just better economically and performance.

Most recent. A web service I use heavily migrated from bare metal to cloud and their performance / reliability dropped significantly with numerous outages which tied me up on the phones to my clients. I gave them 6 months to get their act together, as a loyal client then gave up and moved elsewhere. Being a reasonably big client their sales tried to retain then win me back. Conversations were always the same:

Me: Moved because you guys stopped being reliable, reliability is important to me. Ever since you moved to AWS you have been unreliable.

Sales: we had to move to scale and grow

Me: whats the point in moving if moving weakens your product. there are other ways to scale.

Sale: we had to move to scale and grow
Analysis of the First Flight of Russia's 'Hunter' Unmanned Combat Air Vehicle
How do we know that other super CAs aren't being used for MITM by other countries?
Well this sucks, I'm using this same feature for a privacy app that I'm working on. It's a useful feature to have. Like all tools it can be used for good or bad. Folks will find ways to circumvent restrictions. Apple should enforce with policy, if someone violates. Remove their app. That hurts more. It's like blackhat SEO, Google delists you, it hurts and many people just don't anymore.
Is there a market opportunity for completely automatically generated security ratings? Individuals in most developed countries are now assigned a completely computer generated "credit score" (from payment history and applications for credit); is it much more difficult to algorithmically assign an analogous score for a bond or similar instrument?

EDIT: Or is the problem a misalignment of incentives? It appears that investment rating providers are paid by the managers/sellers of the securities rather than the prospective buyer of the securities. This may create an incentive to attract more business by inflating ratings. If prospective investors paid for the ratings, perhaps there would be a different incentive alignment (and also possible opportunities for tragedy of the commons).
Has Anyone Used Zorin OS – Your Computer. Better.?
I read an interesting book about how to approach customers and friends about your startup. The main thing is: don't ask biased questions and don't ask directly about your idea.

Instead of asking "do you like the idea", "will you buy my product" ask about "do you have such problem", "which tool do you use NOW to solve this issue", "have you looked for some paid solution" and so on.
There are cheap PDF tools that do all that -- many designed specifically for making and marking exhibits.

Also, there are discovery production management tools that incorporate indexing, OCR, searches, and what not.

For more complicated stuff you can use vendors.

It sounds like your old firm liked to bill clients for all of that extra staff time -- keep the revenue up.
It is even worse with video, at least there are still plenty of websites made for love.

How many people do videos for purposes other than monetization?

Years ago I am sure that some people just wanted to share stuff with the world and get some feedback from like minded individuals.
It'll work without Javascript if you already have the image cached.
I just fell in love with cooking meat in a sous vide machine that was gifted to me. Boiling meat in plastic bags concerned me to no end so after much research, I opted to use reusable silicone bags for cooking the meat in.

Does anyone with more insight on the matter know if there are any nasty compounds I'm exposing myself to using a silicone bag in a sous vide water bath or even microwaving in a silicone bag as opposed up plastic?

Thanks!
It depends on each agency's historical performance (maybe only one is bad) and how often this discrepancy happens. Ratings are probabilities to be evaluated statistically.
Since I began studying Greek, the whole wine-dark thing has struck me as pretty silly. The actual phrase is οἶνοψ πόντος (oinops pontos) which means "wine-face sea." Pontos refers to the open sea, not the shallows or the sea near shore.

For some reason the English-speaking world thinks it has to be translated as a color word. Maybe because it was incorrectly translated as wine-dark? But it's not exclusively a color word, just like "metallic" is not exclusively a color word in English. It means exactly what it says: wine-faced, having a wine-like surface.

The Greeks didn't drink wine in glasses like we do today. They mixed wine in a giant mixing bowl called a κρατήρ (krater). It could be different colors and was sometimes cloudy, like natural wines are today. They often mixed in honey, herbs, and fruit. Wine was also seen as a god: we say that Dionysos was the god of wine, but to the Greeks, wine itself was commonly thought of as being Dionysos.

So when imagining an oinops pontos, instead of picturing of a glass of pinot noir, imagine a huge bowl sitting in a candle-lit room, filled with a dark cloudy liquid, still swirling and bubbling slightly, shapes occasionally surfacing, a sheen reflecting the flickering candle light, containing a mysterious divine power. That's what Homer's referencing when he says wine-faced. The surface of the sea is like the surface of that bowl of wine–probably with the implication of a mysterious divine power beneath.
Great article. Thank you!
Slightly further North the much shorter Horten to Moss route across the Oslofjord will be fully electric in 2021 [1]. Though with much smaller ferries.

[1] https://www.ferryshippingnews.com/enova-contributes-nok-31-m...
mp4 is for efficiency, gif is for compatibility.

if an mp4 doesn't play, a webm probably won't play either.

you can do mp4 -> webm -> gif if needed, but that's extra encoding that probably isn't needed.
Chernobyl vodka: First consumer product made in exclusion zone
I agree with this comment, I also live in Los Angeles and there is tons of transportation options ranging from bus to light rail to Uber to lyft.

We should be pushing people to get rid of their cars instead of keeping them.
Probably not in this case, but thinly traded share prices could be used to launder money.

Adam 1 buys shares with clean stake.

Adam 2 pumps share price with dirty money.

Adam 1 sells shares, getting stake back, plus clean profit.

Adam 1 short sells shares.

Adam 2 dumps shares, dropping share price.

Adam 1 cashes in on short.

Adam has laundered dirty 2 money into clean 1 money.

Needs a story to work the market a bit. This could work at a business level too.
That is THE benefit of a "framework" -

It locks you, and future developers, into a paradigm. It might not be a "best" or even "good" way of doing things, but, adopting a framework helps keep everybody writing the same 'shit software'.

Consistency, it turns out, is key. That's because (as others have pointed out) all software is ultimately shit software. If you wrote it, chances are you don't think it's shit, but everyone else does.
>German volunteers learning Dutch who’d drunk enough vodka...were rated by independent Dutch speakers as speaking the language more proficiently during a short-test

I have no horse in this race, but this is brilliant.

(Though they seem to have missed out on an opportunity to determine which alcoholic beverage works best for each language.)
That is, Swing has some mediocre Mac and Windows themes. JavaFX comes with only a custom design.
And that's why we enlist regulators to protect the consumers. This isn't new, you're right.
I am run a consulting company for Amazon suppliers[0] and honestly "felt" that FEDEX pricing was too good to be true.

Fedex was probably net-negative on the deal.

We often saw examples where multiple pallets worth of inventory was cheaper to ship through fedex ground small-parcel. That doesn't happen with UPS.

[0] https://www.andersonassociates.net
This is a pretty neat technical achievement. One of the things that has made it possible has been the ability to much better CFD simulations of the whole system. Rather than test/tail iterate cycle, they can get to a working system that can be refined in a shorter period of time.

That said, its hard to beat the SABER engine's use of liquid hydrogen to cool the air coming into the engine and just achieving better thrust. I still find that concept mind blowing.
Ah, indeed low CoL helps a ton.

I would say only 10-15% of our reports were from folks in the USA and I don't recall any being full time. The dedicated folks were mostly from eastern europe and middle east...i'm guessing that has changed a bit over the past few years.
Its the same model as People Love Us on Yelp, Who's Who in X, and your local magazine's annual local business awards
Frankly in the financial world there seems to be a market for everything, useful or not.
What's really cool is that they released all the code they used to create the attacks.

https://github.com/googleprojectzero/iOS-messaging-tools

Just went to the talk. TL;DR: iMessage uses old serialization libraries, they are terrible.
As I have heard it, the cost of recovering helium from the upper atmosphere is daunting and nowhere near reasonable prices.
Exactly.

It's like complaining about how difficult it is to get a cup of water to drink from Niagara Falls.
LLVM is still in disagreement as to whether or not infinite loops are UB [1], and others.

It is becoming more mature... But the argument about how to handle an empty infinite loop has been going on since 2015.

[1] https://bugs.llvm.org/show_bug.cgi?id=24078
Can graph machine learning identify hate speech in online social networks?
The number of wide release movies shown during a given year is barely enough to make AMC lose money - especially after you consider concession sells. I have an AMC subscription and we might see 5 or 6 movies in a good month. Most of the time it’s 3.
There are reasons why other industries are more mature, like:

they've been waaaaaaaaay longer than CS/SE

they do not change so robustly & fast in short peroids of time.

>We can't even accurately estimate the cost of a complex project given our choice of tools

Let's do not pretend as if that was limited to our industry.
I would add one word to this:

> There was nothing anymore preventing web development from becoming so complicated

The early web was much simpler because of the resource constraints of the 90s and early 2000s. Pages only started serving 10 MB of JS when browsers got to the point where they could chew through 10 MB of JS at a barely acceptable pace.

Also:

> Managers don't really feel like pointing out "the project I'm managing doesn't really deserve a team of developers, you should take them away from me."

As a techie watching corporate politics from the sideline, this was a particularly depressing insight. I used to wonder why big companies require 50 employees to do the work that small companies need 10 employees for. I do not wonder anymore.
All the traffic lights here in Australia are honking great big metal poles that you'd need some serious equipment to reposition. Swapping bulbs would be a big operation too.

What country are you in that has rotatable traffic lights?
By looking at their clients, if not sponsored, at least clearly affiliated. What junk load of nonsense press release.

My view of what happened is some clowns at the top wanted a proper, full interception of traffic. Besides the attention in international media it received, people had real issues accessing the internet properly (those who installed). So they simply could not execute their MITM properly. Putting aside privacy, etc. I expected simple operational ineptitude, which is what happened (gladly) and they dropped saying "it was a mere test".

PS, in 2011 the government tried something similar with Google's traffic and after Google started redirecting the KZ traffic they backed, saying some similar B.S. like "it was a test".
I'm very pro OSS, but I don't think this actually makes sense. Other open source, non-free software is usually a general purpose piece of software expected to be licensed out to many users and run in a variety of environments, for a variety of use cases. The flight control software on a 787, on the other hand, has one intended end user (who is also the owner), runs in one rigidly controlled environment, with a fixed set of use cases. There's no benefit to the public domain, and avionics is such a specialized discipline that the set of people capable of doing useful error or vulnerability analysis on the software probably highly overlaps with the people Boeing is paying to do said analysis in a private capacity (as they're mandated to by regulations anyway). I just don't think getting a bunch of eyes of random, generalist security researchers on it would meaningfully improve the safety and security of the planes.
https://miro.medium.com/max/2100/1*krupUwPRAO-t3CfGRTPttA.pn...
Thanks for that.

It sounds like the networks, while not air gapped, are being separated by some "high" security design or device... that happened to withstand the attack (hence the testing on Boeing's part). Fair enough?