skysight-inc/HackerNews huggingface dataset:
> For production I would want to run this in Docker in some sort of a portable fashion.

Do https://hub.helm.sh/charts/smallstep/step-certificates & https://hub.docker.com/r/smallstep/step-ca tick this box for you?

> Looking at the documentation it seems that you have to manually enter the password when you start up step-ca... environment... kubernetes secrets

There are a couple options here. You're only prompted for a password if your intermediate signing key (at `$(step path)/secrets/intermediate_ca_key` by default) is encrypted with a password. You can create your own signing key (e.g., with `step certificate create`) or remove the password (e.g., with `step crypto change-pass --no-password`) and you won't be prompted for one.

The `step-ca` binary also takes a `--password-file` flag. We chose to take this from file vs. environment or directly as a flag because files are the easiest thing to secure in general... and we're all about misuse resistance. If you really want to use a string or an environment variable you can use bash process substitution (e.g., `--password-file <(echo "pass")` or `--password-file <(echo $PASS)`).

We're also working on PKCS#11 HSM support and will be supporting cloud HSM/KMSs on all the popular clouds, which is probably the best and most secure option for most people.

> There's also the issue of backing up your CA secrets, e.g. if your step-ca process dies and you want to restart it somewhere else.

Yea this is super tricky. I think HSMs are probably the right answer. As it stands, the password protection on the signing keys mean it's somewhat ok (if not best practice) to backup the keys. Really though, the whole system is designed to make intermediate and even root rotation fairly easy so there's that option, too.

This is an area where we're still improving and definitely appreciate feedback from anyone who has thoughts.

> Documentation on how to set this up in a high availability fashion

Yea good call. We need that.

For anyone who's reading this you should be aware that the CA just needs a root and intermediate cert in `$(step path)/certs` and an intermediate key in `$(step path)/secrets`. You don't have to create these keys with `step ca init`. You can use the lower level `step certificate create` command group to create a second intermediate that hangs off an existing root, for example.

> I do like the relative simplicity of this compared to all the other CA solutions out there. Good luck and thanks for the work.

Thanks so much! <3.

Edit:

If you're doing k8s stuff also check out:

- https://github.com/smallstep/autocert

- https://github.com/smallstep/step-issuer

If you're using Envoy/Istio we're also iterating on this:

- https://github.com/smallstep/step-sds
For me, it's slow afternoons. I'm more productive on tech things in the morning, so I don't want to slow myself then. Around 3pm, though, I like to take off until around 6 or so. It really feels better to have a gotten a bunch of stuff done before I slow down.
"It took me years to cope with the sequels of indoctrination, but I'm happier and more serene as an atheist now." Then that is good that you are atheist now.

"In my book, religions that demand conversion are thinly-veiled attempts at brainwashing." Unfortunately, there is too much of such thing; however, it isn't 100% involved with brainwashing. And, yes it is good if you do not have such demands, like you give an example of Buddhism. So are some Christians, but too many (at least, many of the ones which they say a lot so that a lot of people hear of it) aren't that benign unfortunately. But many Christians are good, too.

Also, some atheists are religious, too.
Oil and gas companies undermining climate goals, says report
Yeah, take metals out of the equation and it probably a lot more likely.

You are still going to need things like:
Sodium, Potassium, Magnesium, Iron, etc.
I say it was a successful but unplanned landing :-)
It's even odder from the perspective of someone who actually lived through it. I'm guessing the way I feel now is similar to how people my parents' age felt with all the hippie culture appropriation my friends were doing in the 90s.
I've been developing for the web for about 15 years, and I totally can see myself googling "writing cookies". It's not a thing you do that often, and even if you do, perhaps it just doesn't stick in your mind.

There should be no shame in googling things.
> What is Apple trying to gain by publishing this article?

John Gruber's take:

> Reading between the lines here, what Apple is pushing back on is the fact that Google’s report on this attack against the Uyghur [1] community only mentioned iOS. Coverage of Google’s report created the impression that only iOS users were hacked, when in fact, the Chinese government also exploited Windows and Android users, [2] and that these exploits may have been targeting people everywhere.

* https://daringfireball.net/linked/2019/09/06/apple-pushes-ba...

Though he does also comment:

> Conspicuously unmentioned in Apple’s response: “China”.
I think what you’re talking about is arbitrage: finding $20 bucks on the ground is an opportunity, but building a whole new currency isn’t. I’m not sure it’s that simple, but it’s certainly an interesting idea.
support for Xcode?
To me, the weird thing was that Google failed to mention that the hack was carried out by a by a nation state (China), and that it was narrowly targeted at China's often oppressed Muslim ethnic minority.

Google also failed to mention that Android and Windows had been targeted by China as well.

These omissions certainly leave me less sympathetic towards Google.
Why isn’t the NRA all over this?
This sounds like a good way to approach it. If there’s a system that is currently impossible to make decent predictions on then any partially accurate result could be beneficial. I’d be suspicious of someone claiming O(n) on QM however. They’d have to be very simple estimates, not sure how useful they’d be.

To your parents comment, it’d depend heavily on the molecules and systems under study and startup goals.

> The short of it is that literally no business will accept data that is generated this way until someone shows that every neural net model trained in this way produces solutions that are mathematically equivalent to a validated method.

This would seem to be wrong approach this early on...

> At best it might be used as a filter step in some pipeline, but that's not going to have much of an effect, and certainly not something on which to bet the success of a startup.

I don’t think a startup based on providing ‘QM simulation as a service’ would work very well and be fraught with issues. However, many industries could make significant usage of a pipeline filtering possible solutions which could be validated experimentally or with more traditional methods.

IMHO, to work with this a startup would need to be a vertically integrated company solving a specific class of problems (say batteries). Even then the current State of the Art still seems a few years off before I’d want to do a startup in the area, though it’s much closer with the recent results.
Ask HN: Those making $500/month on side projects in 2019 – Show and tell
It seems this question hasn't been asked for some time, so I'd be interested hear what new (and old) ideas have come up.
>> We always have to assume worst case for security vulnerabilities, it's kind of the whole job of being a security researcher to determine what could have happened.

Many people will be annoyed by this "assume the worst" drama.

For example, drinking too much water, if we assume the worst, can kill you.

Also, walking around can kill you, if we assume the worst.

Also, just being around can kill you, if we assume the worst, hey, you could die of a stroke.

So, how is this "assume the worst" statement useful?
I feel as though this has stopped being a good faith discussion.
The Washington Post reported earlier today that this may be caused by marijuana vaping products which use Vitamin E to achieve a higher THC concentration: https://news.ycombinator.com/item?id=20898456
I meant metals in the solid-state physics sense, with the oceans of electrons and band gaps and stuff. You can keep your monatomic ions (which are crucial for biology in many ways).
Congressional inquiry sent - thank you!
Other than the arguments about negative externalities, it seems more ethical (or fair, if you will) to have less or no tax on items that are necessary for life (food, shelter), vs items that are more of a luxury (big screen tv, party supplies). Not so much to curb certain behaviors and encourage others, but it would really suck to be taxed based on the oxygen your body consumes, for example. Or taxed on the vegetables you grow in your garden.
I am an American citizen. My co-founder is German. What do the steps look like to get him eligible to work out of the US (say, if we're accepted to YC) and how does the company need to be structured to make it as easy as possible?

Thanks in advance!
You've got it... upside down. The line is dangling from the Moon, down to ~36000Km above us. That car would have to reach geostationary orbit, jump on that tiny cable, then travel... oops, the remaining ~350,000Km to reach the Moon. To do that trip in 15 days, it'd have to run at mach 1.0.

Edit: it gets even weirder, if you consider the Moon's distance from Earth goes from 363,300Km at perigee to 405,500Km at apogee... just how long should the line be? If it's 327,300Km, we might only be able to operate it near perigee, sure if it's a bit longer it'd be more usable, but it cannot extend past 363,300Km - or it would touch down here :) - that means there's no way we might use it near apogee, since it would always be too far away.
That's fair. I sometimes do that too, especially if the question is somewhat long and complicated (though I that point I usually ask if I can just call the person). But at least that's more than a solitary greeting.
Them being a gamer or developer doesn't actually add a great deal of value to their leadership abilities. Many are the examples of management justifying bad decisions as a "one of us" move.

What EA and any company of that scale needs most at the top is people who are interested in large-scale workflows, IP management, and labor issues. Some aspects of these things are tied to the creative and intellectual parts of the work, others aren't. But the point of being that big should be to capitalize on unique opportunities to do R&D or push larger-scope experiences. It's not the nickel and diming that makes for lasting success.
My VS Code loads in like <2 seconds.

Maybe get a better computer? (not trying to be glib, seriously I wonder what are you running on). I run on a 2017 Mac Book Pro and it is very very fast for me.

Also, personal opinion: VS Code gets a big +1 from me due to it recently adding remote development capabilities (eg connect to host over SSH, do dev/compile stuff there).
Your comment is why they wrote this piece
> If you are asked to leave, it would means that you were found, doesn't it?

Not necessarily. You could be asked to leave with an announcement over the PA system.
Other birds do as well. They all pay attention to each other. I have a very active set of bird feeders in a rural area (so many species of birds and other animals use them at the same time). I am within sight to it for much of the day and it's very clear that they all cue off of each other. Some are more brave, others more timid but they all pay attention. A chipmunk or bird fight won't phase the others but a cat (or person or hawk overhead) will cause the birds to make what is, for some of them, a very clearly different call (usually loud and abrupt) and they all react at the same time.
Sane legal defaults are great and necessary, but not enough. Google has iffy GDPR compliance to begin with and has now been caught circumventing it.

Nothing will be effective short of jailtime for the execs responsible for flouting laws and public trust (not for making a mistake, but actually engineering workarounds).
I think this falls under the mathematical category of "fun things you can do with numbers", and not much else. Just cool.
What I'm suggesting is that it scares me a bit, as an Apple user, to see Apple acting in such a hostile way PUBLICLY to a party letting them know about a security issue. I understand where they're coming from -- as I said, I also found the facts in their message useful for understanding the situation. The original headlines gave me a very different impression than what the facts seem to indicate happened.

But as a PR piece, which is what this was, Apple needs to keep in mind that they want to project how much they ENCOURAGE folks reporting security issues to them. Sounding defensive is not helpful to them in that regard.

Not everybody is Google. Will the next person be scared to report their findings because they think Apple will come after them rather than be appreciative simply because they don't approve of how it was framed? I'm not suggesting this is easy, only that as a PR matter it's probably best for Apple to take the high road even when their competition is being unfair.

Correct falsehoods, yes, but the tone was off here.
Everyone person who is found becomes a seeker as well. That way at the end you have 2999 people seeking 1 person.
Employee engagement sounds like talking to people, and that would drain me much faster than programming.
It's Lazy and Unethical to Earn from What Other People Submit to You Anonymously
I like that it's helpfully titled "Listening grey squirrel" just in case there was any remaining doubt of the subject.
Yes, though Vanguard themselves have supposed stopped offering VOO internally as part of their employee 401(k) plans, and changed over to VTI.

* https://www.marketwatch.com/story/vanguard-thinks-its-own-em...

VTI has become the third ETF to pass US$ 100B in assets:

* https://www.cnbc.com/2018/09/11/most-investors-choose-sp-500...

SPY (a competitor to VOO) is the biggest though, and it follows S&P 500.
> I don't think that's Google's job at all, especially for a competitor's product.

I don't think you quite understand why Google Project Zero team exists in the first place. Their job is to make the world a more secure place. They seem choose whatever they want to work on to maximize their impact on the world –ranging from Intel processors to iPhones to some first party technologies like Chrome.
Even a stopped clock is right twice a day. They can simply cover more ground and brute force it.
And my parents made me go to bed at 8pm but I stayed awake until 2am. I’m not sure of the point you’re trying to make.
Data in one geographic region is not always safe, period.

Cloud aside, if you store data on Baremetal in one location (or boxes of tapes) and that location burns down, it's gone.

If you have mission-critical data to store, it should be spread between regions, if not cloud-providers.
Your first source link doesn't work.
I'm not sure HN is representative of anything, especially if you only look at what's upvoted. If I had to guess, I'd say that this sentiment is posted by people with 10 years of experience who feel like they should be talking about something else during interviews, but that it's being upvoted by college students or recent grads (no matter what you're asked to learn, a large fraction of the group will be frustrated by it)
And as such clearly fails to be relevant to the discussion.
I would rather have you whiteboard me 20x then answer these questions
But do they?

Is any government calculating the net cost between tax dollars spent because of cigarette smoking and tax dollars gathered from tobacco products and setting the tax in that manner?

Has any government put a lower or higher tax rate on any tobacco product based on risk or cost profile?

It is not that the arguments you are making aren't viable, I'm just not so sure that anyone is actually doing those things.
> That’s because there’s no amputation risk in white collar jobs.

In most white-collar jobs. My first white-collar job involved (among other things) probing live 270VDC circuits, overseeing tests in liquid-nitrogren-cooled chambers, and working in close proximity to live radiating antennas. Sure, I spent most of my time at my desk, but that was still ample opportunity for serious, permanent injury.
I mean it's not surprising, considering that the only thing you should be breathing in is air, not anything else. (not that I personally follow that rule though :\)

I wonder if it's an ingredient that's used to make it taste better - since the article posted an item of the "fun" flavored vape liquid.

I don't think we should outright ban these devices like the one doctor mentioned in the article. Find out what specifically is causing the problem with lung deterioration and ban that ingredient from the mixture (Probably vitamin E acetate according to the article). Seems fairly simple.
Seems to me that they felt they had to respond to FUD reporting such as https://www.zdnet.com/article/apple-has-let-down-every-iphon...
so it's not a contaminant, but rather an additive? seems like the title should be changed potentially
With Stallman's recent visit to Microsoft, I can't help but think that Windows Subsystem for Linux 1 would have been better named GNU / Windows.

With WSL 2, it is now GNU / Linux / Windows.
The official news announced by the ISRO chairman on the live broadcast was "the last signal received from the lander was 2.1 KM from the lunar surface. Data is being analyzed as of now".

In all probability indicates a crash landing.
This all seems like such terrible journalism. Vaping can refer to: 1. Juul and similar e-cigarette nicotine products 2. Iqos or Pax tobacco or marijuana non-combustion products 3. Legal Cannabis oil branded products 4. Illegal cannabis oil products.

All issues have come from illegal products. No brands are mentioned. Clearly, contamination is the issue.
It is irresponsible to blame "vaping" especially considering that the alternative is "smoking" -- which won't ever result in a newspaper article about sickness/death because it is so common.

About 10 people a day die in swimming pools. But 4 total deaths ever is an epidemic?
It feels like this is going to end up being very similar to the melamine milk situation in China in 2008 https://en.wikipedia.org/wiki/2008_Chinese_milk_scandal
Drone racing would be good too.
Why would they be?

This seems to me to be an obvious breach of privacy and broad overreach of investigative authority, but it isn't really a Second Amendment issue. The right to keep and bear arms doesn't extend to rifle scopes, and nothing about this threatens gun rights per se.
Haskell is actually one of the greatest text handling languages out there, and will beat Perl5 on most such tasks. (Perl6 was made similar to Haskell, so none would beat the other.)

This one contrived example does favor Perl, and will beat Haskell by a small margin. But as soon as the user says "Oh, sorry, I was mistaken, I needed the number and the next letter" or something like that, Haskell is on top again. As Haskell is one of the greatest languages for handling "Oh, sorry, actually..." requisites, and Perl one of the worst.
Aren't sin taxes one of the textbook examples of internalizing (Pigovian) taxes?
ah yes, my slow morning where i wake up at 4:30 am and run a marathon before going to work
The basic economic angle of it is that video games are a hit-driven business. Large publishers especially during the 1990s have a diverse product portfolio that can cushion moderate failures with the income from hits (more so during the 90s than today). When a small studio is growing its games and budgets to keep up with player expectations, the relative safety of a publisher can be tempting compared to sticking it out independently and betting the company on each game.
Well-deserved naming of an era: "the hipster-programming/devops explosion of the early 2010s"
Don't forget that for the vast majority of that trip the atmosphere is essentially negligible. A better comparison would be a vacuum tube train with a(n approximately) constant 1G handicap. From the perspective of the tether, any practical payload mass is negligible in comparison with the tether itself, and -- most likely -- it's under tension anyways, so pulling the payload against gravity would actually be releasing tension below it.

Space elevators are particularly strange to think about because they combine the weirdness of orbital mechanics with some, but not all, of the intuitions we have about terrestrial behavior -- and then add in the complications of being a megastructure on top of it, which humans have basically zero experience building. They defy easy reasoning.
There was a similar story on HN a few days ago. I found this thread to be a really interesting take on the possible cause:

https://news.ycombinator.com/item?id=20855683

TLDR: Vaporizer cartridges contain fillers. The fillers are apparently very expensive. The theory is people in the industry are trying to boost profits by using cheaper (never tested on humans) fillers that are potentially damaging to health. Whether or not this is true, I don't know, but it makes for an interesting theory.
A friend works at a military contractor doing (effectively) windows GUIs for power system controls. His only access to an internet-connected computer is on his breaks, where he has to wait in line to use one of a very small number of computers in a special room to google things.

I don't think he has books, but he has an enormous amount of documentation (something like the whole MSDN library, a bunch of internal documentation and reference info, and other documentation) installed on his computer.
Paper clips have been perfected? That's hard to believe, as there are so many problems with them.
True... but that does mean they're not expecting that you can remember the algorithm. :)
I appreciate the attempt to bring another side to the debate but the point you are missing is that it is us black Africans who are being critical of Mugabe. We all experienced the oppression by the Rhodesian government. It his actions against fellow blacks after "liberation" that we are criticizing. He presided over the murder of 20 000 people[0]. A leader who presides over record inflation no matter the excuse has failed and should step down to give someone else a chance. He had to be removed through a coup as he was preparing to hand over the country to his wife.

[0]https://en.wikipedia.org/wiki/Gukurahundi
That doesn’t really address the main thesis behind LTSE - the idea that public companies are too focused on the short term due to quarterly reporting requirements.

It just seems like if you list on multiple exchanges then you’re still beholden to short term thinking created by quarterly reporting unless you choose to list exclusively on LTSE.
This is as much the CDC's fault, it seems like, digging in to the underlying sources.
I'm going to guess the Project Zero article pissed some people off at Apple in a major way, because Apple is right that the headline and the content of the article vastly overstated several aspects about the vulnerabilities. The impression most people would come away with after seeing the headline and skimming the Project Zero article is that most iPhones have been compromised for years. That is emphatically untrue, and so I think it's reasonable for Apple to take a strong tone with this message.
Hi Peter, thanks for doing another AMA! I've been on an O-1A visa for over 6 years (from the UK), I currently half way through a 2 year extension and starting work on by EB-1 now. Have you noticed a significant change in adjudication, processing times or anything else of note in the area? What parts of the petition do you find get most scrutiny / are most important?