skysight-inc/HackerNews huggingface dataset:
What Dan Geer & co wrote about software monocultures is pretty much the last thing anyone seriously wrote about the topic, which hasn't had much predictive power in the ensuing years. The major bastions of software security on the Internet today --- Apple's iOS hardware/software platform, and Google's Chromium --- are both monocultures, and selecting yourself out of either of them will materially reduce your security (this is not a point HN commenters tend to enjoy reading, but it is nonetheless true).

Geer & co wrote their paper right after the first "Summer of Worms", in which the insecurity of Microsoft's software was such a hot topic that there were congressional hearings on it. His analysis presumed that Microsoft wouldn't commit itself, organization-wide, to correcting the problem, because no other large organization had.

But that's exactly what Microsoft did. On an edict from Bill Gates, the whole company pivoted towards security. They hired a huge number of software security people and contracted out essentially the entire software security consulting industry to assess everything from the TCP/IP drivers to Minesweeper (they now host an internal conference, "Blue Hat", to socialize the results of 3rd party audits from blue-badge vendors and internal researchers). They delayed and re-roadmapped whole projects around security, Longhorn being probably the most obvious example. They trained all their software teams on software security, and enacted company-wide controls on "safe" and "unsafe" library functions.

Essentially, Bill Gates did the same thing in reaction to the Blaster worm that Theo de Raadt did with his fork of NetBSD: a site-wide top-to-bottom audit (I was, somewhat peripherally, involved with the OpenBSD audit of the 1990s; I had some findings and wrote the advisories but was very far from the most productive person in the project). But unlike Theo, Gates had a cubic fuckload of money to throw at the project, and it showed.

The results, I think, more or less refute Geer's argument. Microsoft was able to (significantly, albeit incompletely) address its security gap because it had the resources to do so. Moreover, each major component of Microsoft's software security risk was, individually, huge: a desktop operating system, an office suite, a browser, etc. All required vast resources, and many were able to effectively share resources between each other. Diverse, (necessarily) smaller organizations could not have pulled this off, and, had they existed in 2004 when Geer wrote about them, they'd have started with approximately the same tech debt Microsoft had.

And so today, if you're looking at a desktop operating system and choosing between one secured by the former monocultural bohemoth and another run by a dedicated and passionate band of volunteers, you will in fact usually be better off with the former. If instead of desktop operating systems we look at mobile platforms, the difference is even more stark, to the point where if you're not using either Apple, or Google's flagship supported platform, you're almost surely running something with grave vulnerabilities.
2019 has been a true _annus horribilis_ for Boeing.
Funny, I got almost the same machines -- I had a Thinkpad X1 Yoga 2016 and before, I had a T420. These are amazing machines. I am writing this text on my T420 which is now 8 years old but still has 8GB RAM, 1TB SSD, with this being better then many "high end" laptops selled nowadays.

Towards the software: I'm a Linux user since 15yrs. I ended with vanilla Ubuntu, because that's a good compromise of unspectacular updates ~ every year. I enjoy Linux for having access to the developer setups I love: Plain, easy. I code C/Cpp projects with Kate and GNU make. I am frequently vowed for my artwork done with Gimp, Inkscape, Blender, Libreoffice despite I am not a designer. I frequently install "fat" non-distribution codes such as http://visit.llnl.gov at ~/bin, where also non-open-source codes such as Mathematica or Maple go. Generally, I prefer minimalistic tools over fat solutions, despite I acknowledge the power of Mathematica or a Microsoft Windows installation inside Virtualbox or KVM/libvirt/virtmanager. I even have to admit, I enjoy KDE and, as I said, I enjoy a decent graphical editor such as Kate. I work on command-line-only tools on servers very often, but I could never warm up with vim. I just never took the time to climb the learning curve of vim. But I also don't want to work on servers with VNC/X2Go, because ssh is just faster. That's why I use the tools available when in place. I'm probably a Linux opportunist: I use the Linux desktop because it is accessible, on any machine -- much more accessible then Mac OS X or Windows.
Are there any dangerous substances in an urban environment that are picked up by bees and that would end up in the honey?
Slack is better than Teams in my opinion, but Slack still suffers from things even IRC has advantages over. Teams UI is atrocious.

IRC is free, has channel administration & granular permissions, a working & functional tab complete, many different clients with extremely low memory & cpu usage. The biggest problem with IRC though is not being able to read back without the use of a bouncer or something like paid IRCcloud.
Except from what everyone is saying and the drop in traffic people are observing it drove multiples of SFW traffic. The porn kept and drove users but they also viewed plenty of SFW content as well. You can monetize the SFW side of things.
I didn't realize what was going on in this thread until I double-checked the article - currently, the HuffPost story still has the title "Black Beekeepers Are Transforming Detroit’s Vacant Lots Into Bee Farms".

The reason this title has "Black" in it is it's part of a HuffPost column called Black Voices; literally stories concerning African Americans. And the beekeepers noted here are indeed black. And I don't know if many of you know this, but there aren't that many black beekeepers out there.

The fact that the beekeepers are black is germane to the column and the story. Removing that from the title is erasing an achievement of a local black community. I think another commenter on here was spot on: someone on HN removed the "Black"ness from the story because it made them uncomfortable.

Can a mod please restore the original title?
Indeed.

Most of the longer term maintenance costs of Model S's seem to be down to luxury components that aren't necessary (like air suspension, funky door handles, big touchscreen).

An EV Civic could well be bulletproof.
it's probably not economically feasible to have a privacy-respecting app that's also funded by a programmatic targeted advertising network.

even if it was, people have shown over and over that they prioritize convenience over privacy, and businesses simply aren't conscientious enough to try a different way.
Reminds me a lot of the horror show that is Amazon chime, Amazon's alternative to slack.

That said it had some half implemented good ideas, but whenever you found a bug in it, its AWS-based team pretty much told you where to shove that bug report.
Audrey Royal Eating Her Teacher’s Cock – XHamster
I was only recently diagnosed with anxiety after spending thousands and thousands on an emergency room visit and visits to a cardiologist, and I work for a healthcare company with free access to GPs!

I had a variety of symptoms and none of them immediately seemed to shout "anxiety" to my physicians. I was given dozens of blood screenings, X-Rays, CT Scans, EKGs, Echocardiograms, stress tests, sleep studies, only to be told that my heart is in wonderful shape, and that all of my symptoms were probably anxiety (and after being put on Lexapro for several months, the bulk of the issues really seem to have resolved).

I was experiencing: chest tightness, left-side chest and arm pains, random dizziness, random feelings of disorientation, massive blood pressure spikes that would last for hours (110/70 -> 190/120), headaches, pressure in my left abdomen, heart palpitations, and several more very worrying symptoms.

At the end of the day, it all seemingly boiled down to a generalized anxiety disorder.
I'm more interested in direct actions.
This is a flaw with the repository model for software distribution: it confers the authority of the OS developers to packages not scrutinized to the same degree.

Users' metal models of trustworthiness don't track very well the actual scrutiny software is subjected to. This might be a problem with any distribution system.
Yeah, Capitol Corridor is great! I wonder what it would take to convert a bunch of those folks who jam up 80 and 680 every day into riders ... I suppose it’s more complicated than just moving the right-of-way and stations into the more populated areas.
Yup, same idea, but the water-based setup likely has to deal with steam issues instead of fume issues. Personally I'd still go with the casting methods, but this is an interesting option.
In the early 00's I developed a test LMS (SCORM) for courseware the company I was working for at the time was building... only because all the LMS software was a convoluted mess.

That test LMS became the LMS for a few major airlines and a large fortune 50 company (uplifted through a few software shifts). It lasted for more than a decade before being replaced by an "Enterprise" solution, I think it was Blackboard (took 2 years to get it setup right, and people in the know still don't like it.
How difficult would be to fly one hd filming plane above, then scour the imagery with a fine comb, possibly computer vision aided?
Messages with a single emoji are displayed 4x the size, with animation that can't be turned off.

Teams is just not a serious business tool...
> Automattic isn’t a large company

> Either way, even if they leave everything as is

Which is their plan for the moment. Which worries me about the sanity of Automattic. When you’ve stopped growing long ago and you start buying ventures to keep the turnover going, you end up like this big company which was buying ventures to stay afloat. What was it again?

Ah, Yahoo.
> So it's better to bet on something whose lesson is yet to be learned? :)

Async I/O isn't anything new, and it's stood the test of time. Nginx isn't some new experimental technology.

> Anyway, I don't think anyone has forgotten those lessons, but they're not very relevant to modern managed runtimes. (also mioco seems to be single-threaded)

They're still very relevant. Linux can spawn hundreds of thousands of kernel threads.

Anyway, we used to have an multithreaded M:N runtime in Rust, but it was removed because the performance was worse than 1:1 in practice. M:N was moved out of the standard library into the mioco library. Now it's unmaintained, because nobody actually wants M:N threads in Rust—an interesting outcome to be sure!
Um I mentioned Pensions - I just added the 404 the usa's poor relation to even a DC scheme for context for US readers.

We don't have IRA's we do have ISA's which are awesome in comparison (basically remove £20k pa into a tax efficient account)

I think my main DC pension is about .5 and I will be moving my small NEST (government scheme) over to my self run pension shortly.
In this case, yeah, it does. To not care either way is to be okay with ceding your right to care to others. Which is... a choice. An opinion on the worthiness or usefulness of having that choice. The only way to be apolitical is to never have had a choice... And since duress makes having a true stance impossible, there's no way to be apolitical.
>Lifts are the disruptive technology. They make energetically efficient cities possible and cheap.

Are lifts really as efficient as escalators? An escalator is constantly moving (unless it's malfunctioning), so there is no wait to continue moving. An elevator on the other hand is not. Maybe it depends on the number of floors? I can see an elevator being faster going from ground to floor 40 rather than zig zagging floors from ground to 40. Does anybody use "express" escalators that skip floors allowing for faster transit to higher floors?
Hey! We read before posting -- could you be more specific about what rule it doesn't follow?
Despite an update and partial retraction in this article. It seems that there are known issues.
https://thepointsguy.com/2018/01/norwegian-787-engine-replac...
Understand container – a book about container internal
Most malware code I've seen is terribly written and barely works. Hobbyist malware programmers use Windows and write for Windows for the simple reason that it's all they know.

Some skiddies use Kali Linux but only because they managed to follow step-by-step instructions on YouTube without which they're lost.
Where are you located? In some (US) states, it is illegal to resell electricity, so companies with EV charging networks in those states (including, for example Tesla) charge by time, rather than by the KWh. In this way, they are basically able to claim that they are charging for parking, while the electricity comes along for free.

In other states without those laws, many of the networks charge by the KWh.
They paid something closer to $3MM according to Dan Primack (but also took on the employee payroll).
https://github.com/nodesource/distributions#installation-ins... I'm sure there are plenty of others.
Been with a SF startup for a few years, just got royally screwed, need help
Looking for recommendations for a great labor lawyer that gets startups, silicon valley dynamics, labor dispute negotiations, etc. Doesn't have to be in bay area, but preferred.
serving files is literally the oldest thing in the www, it's literally what the www was born for.

weird how this guy managed to make it complex for serving just html and css (and possibly images).

I would go with aws' elastic filesystem and a bunch of auto-scaled nginx machines with caching enabled mounting efs in read only. Dns-level load balancing, cloudfront. efs is pay as you go, the nginx are auto-scalable (and you can get spot instances too).

the signup/login webservice can be served via lambda, with static content being served off S3 (and again, cloudfront).

a simple ftp or sftp-enabled ftp server with a database auth backend could let users work on their stuff (again, autoscalable)
Portage solves a few of these.
http://michael.orlitzky.com/articles/motherfuckers_need_pack...
Russian nuclear-powered cruise missile blows up, creating “mini-Chernobyl”
> Effective search in any real-time messaging platform seems difficult to deliver. Has anyone else had this problem and found a good solution to it?

Log chats to text files and learn `grep`. Keep chat logs organized in a daily/weekly/monthly/yearly directory hierarchy.

I think many people would be amazed at just how fast their disk can read tens or hundreds of MBs of chat logs; how fast `grep` can find what you're looking for.
Perfect Day Launches Ice Cream Made from Cow-Free Milk
It is not in fact installed with every Office 365 install. I just had Teams pushed with a separate group policy because of this.

They will overtake Slack easily since it is a free addition to most 365 plans
Most sex differentiated medical stories which pop up in my feed tend to be about drug interactions in women being misunderstood because of the overtesting of males. That mental illness is mis-characterised in men, speaks to me of two things:

1) we haven't had a large enough war to produce the volume of war psychosis outcomes which correct for this and

2) women are tragically over-represented in all forms of mental illness profiles, which may relate to their real condition but also may relate to distortions in societal views of women and mental illness.
micro.blog
> ...or at least what I imagine poetry is like to people who like poetry.

Which isn't poetry. Poetry is its own thing. We are not required to compare non-comparable things.
Slack and Teams are different. Slack has muting. Teams does not.
No, electric vehicles are the best option in nearly all cases. Natural gas makes Boston electricity one of the cleaner grids in the country. For my zip, a LR Model 3 makes 131 MPG[1] per unit of CO2, while manufacturing produces ~5 tonnes more CO2 (an SR will be ~3.5 tonnes)[2].

That's a break even period of only 15,000 miles. Unless your gas car will be tossed away in under 15,000 miles you are adding more CO2 to the air- and that's assuming you actually make 29 mpg, which is not likely on a car that is only 15k miles from EOL. Even if you don't touch the car for years, if you eventually sell the car the next owners are practically guaranteed to drive that many miles. The average American drives that far in 13 months.

Of course the money you spend on a new electric car might be better spent elsewhere, but in any state with a moderately clean grid, replacing a gas car with an electric car is a clear winning choice. Even on the very dirtiest grids in the US a Model 3 produces half as much CO2 as a gas car making 30 mpg- even slightly less than a Prius. The payback time is still only ~30k-35k miles, and in all likelihood owners will put several times that on the car.

[1]: https://www.ucsusa.org/clean-vehicles/electric-vehicles/ev-e...

[2]: https://www.ucsusa.org/sites/default/files/attach/2015/11/Cl...
You didn't submit the link to the site, which is the usual method.

You could email the mods -- hn@ycombinator.com -- and ask them to fix it.
Detroit is an interesting case of how a shrinking city becomes useful for some investors.

IIRC, I was looking up the prices of various lots, and many homes were $1000! Now, I don't live anywhere close to Detroit, but the idea of spending maybe $10,000 to $100,000 for dozens or even hundreds of houses is interesting.

Developing for humans may be a problem: Hundreds-of-thousands of people have left Detroit, leaving the city in the state that it is in today. But the houses and infrastructure (roads, water, electricity) may be useful for some niches, even in a "ghost town" situation (Or perhaps: more of a "ghost suburb" situation. Neighborhoods with shrinking populations will naturally have weaker schools, causing more people to leave, causing taxes to go up on the remaining people, causing more people to leave, etc. etc. Its a bad death-spiral effect).

I think I recall an article about how one writers group was buying up neighborhoods to station writers-circles, effectively creating a community of writers imported from around the country to one location, so that the writer-circle can leverage each other as an author support group.

I haven't heard of this Bee Farm thing, but I would have expected that sort of thing to be better in a more rural community.

In any case: redeveloping all of that land and making it useful (as opposed to broken down neighborhoods with crumbling infrastructure) is a big question for Detroit... and investors / businessmen. There's probably a lot of opportunity there.
How to focus your efforts as a self-taught dev
odeke-em did a presentation about OpenCensus at GoSF just last year, I think. I remember being tremendously impressed, when there was a hiccup with his demo, he proceeded to debug it using OpenCensus! (And found the issue!) I really wish it would be possible for my current company to implement something like that. (Combination of technology and internal politics makes it impossible, so debugging with the Kibana logs is also an exercise in determining when and whether to believe the logs, as well as correlating this ID with that number, yada yada...)
Sounds like you haven't read much good code. I have worked on a lot of "reasonably good" code I didn't mind reading. Reasons for code to be good or bad vary. The Linux memory management code (linux/mm), for example, is rather hard to read, but also a big technical accomplishment. So it's still interesting (and I read it just out of interest). Code that pushes around data is nice if it's well organized and named. Etc.
Trains work fine in the suburbs, when the burbs are built around the belief trains either will, or do exist.
No they removed Z, I, & O from A-Z+0-9. They removed Z because it looks similar to 2 in some cases too I bet.
Lets talk about “roundabouts”. Near my home town they built one in the middle of nowhere because why not. Then they had to rebuild it because they hadn’t made it big enough for semis to get around. You can probably count on one hand how often each week two vehicles end up there at the same time.

Near me now there are several “roundabouts”. One is a curb in the middle of what is otherwise a normal intersection. One direction has no signs. The other has stop signs.

Another is three sawhorses with an arrow sign and a circle painted on the road around them. The arrow signs might as well just say “good luck”!

No one uses them the way they are supposed to be used because no one trusts other people to use them the way they are supposed to be used. And with the ones near me they can’t possibly even function that way.

All of these roundabouts only exist because people hear how great roundabouts are and demand them. And I’m sure they are great, but you need educated drivers, proper signage, enough space, and consistency. And they need to be used in spaces they’ll be effective. We get none of that anywhere in the states I’ve ever seen.
I would turn the question around: How would you know you were spending enough time? How would you know you were not spending enough time?
The comparison is to show that even in technologically advanced societies, there are diseases with 30% survival rates.
>The emojis are of bad quality and look like crap.

Maybe an oversite on my part, but I didn't even consider this as I was evaluating an enterprise productivity app...
Epsteins Ex-Girlfriend
That chart is based on Google Trends, which is a terrible way to measure social network activity/popularity.
You can help your own local/national issues. I'm sure there are a lot of people struggle against bad policies where you are from, too.
Wellll, an crude guess from 5 years ago made the point that 50% is in African countries, and US healthcare may drop it to 30% on its own: https://www.livescience.com/48263-ebola-mortality-us-africa....
any reasonably large brand that can afford a social media manager will use automated tools that crossposts the exact same content to Twitter, FB, IG, and Tumblr.

The original appeal of Tumblr was that it was a modern day Xanga, lots of personal, anonymous journaling, weird jokes and photos. I don't recall anybody becoming an influencer via Tumblr, probably because it didn't attract that kind of audience.
It's just that tumblr had the best porn.
I recently got into the habit of swinging Firefox's reader view (https://support.mozilla.org/en-US/kb/firefox-reader-view-clu...) on a hair trigger. A single click on any of my devices, it cuts an awesome swathe through the internet jungle. For now.
So I also lean fiscally conservative, but as I read the argument, it's not that more money should be thrown after bad projects, it's that "if you're going to do something, do it right". Hire people who know what they're doing, pay them well, and give them time horizons long enough to actually complete the projects instead of thrashing about as a new politician comes into office.

I'd actually agree with that - I think the government should do fewer things, but do them better. Infrastructure is one of those things where there's a good economic reason why the government needs to do it (privately-funded infrastructure tends to run into tragedy-of-the-commons and diffused responsibility problems), so if responsibility for infrastructure is going to rest with the government, they might as well get it right.
(i) nope, I'm not crazy; (ii) in your Ortlieb bike pannier or backpack; (iii) commandeer a cupboard in a quiet corner; (iv) if your boss isn't good humored, it's time to change jobs, or change the boss; (v) because they blow away in a strong wind.
Ah gotcha. It gave only the option between link and text, but I'll go ahead and fix that!