skysight-inc/HackerNews huggingface dataset:
I am a developer of a messaging app downloaded so far by 5 million users around the world. I was very concerned about this news and looked into it.

Apple is simply doing away with silent push notifications through the VoIP API. Apps can still register an extension that will process arbitrary push notifications that result in a visible notification to the user.

If the application needs to silently send something to the app, it can do so with background modes, such as sending a push notification via PushKit with content-available: 1. The OS then schedules when the download may happen. If the download doesn’t happen before the app is started, the app can simply send a request at that time and download it, just like any other content-available thing.

There is no legitimate use I can think of for silently sending data using VoIP push except when you’re on a call and you want to send WebRTC type data (eg say someone joined the call).

But here is the kicker: PushKit notifications are reputed to be delivered on a lower priority basis than VoIP notifications. And that’s the big thing. Apple can simply slow them down to make FB messages arrive slower than iMessage for example.
I don't know from within China, but from outside China, you can link it to a VoIP account.
European aviation safety agency sets strict demands for Boeing 737 MAX
I don't even think rate limiting after 3 mis-attempts makes sense. I regularly can't remember my password and might need 6 attempts. Nobody's going to guess your password after 300 attempts, so make the limit 30 and you're safe.
Orkut had that. Nothing ever happened.
Look, anyone who knows how to put together the words "terrorist watchlist," "no fly list," and "red flag laws" knows that the first two are secret, permanent (i.e. do not provide due process), and can rather deeply impact someone's life. Red flag laws are public, allow due process, and minimally invasive (you get your guns back, and life goes back to normal).

Seriously. Those are table stakes for discussing these things. Anyone who knows these things and still conflates the three together is being disingenuous. I could very well claim their position was ignorant, but then would that be also considered a "personal swipe"? This is what I meant when I said claiming these things are equivalent in any way was "prima facie absurd."

TLDR: u/exabrial was either being disingenuous in their argument or is completely ignorant of what they're talking about. You are straight up wrong.
And conveniently Facebook often lists your relatives' accounts right on your profile.
obligatory thread naming good open-source password entropy checkers. I'll start.

zxcvbn: https://github.com/dropbox/zxcvbn
What, I wonder, is the difference between social networks, and old school political machines running on non-digital social networks, or mass media networks and channels, or even conventional groundwork campaign techniques.

Does a organizing with members of key organizations count as biasing a community. How about a campaign sign placed at a strategic intersection? Or oft used last minute mudslinging postcards. For that matter what is the difference between biasing a voter, and convincing a voter to vote (maybe in the papers case on team-dynamics instead of issues, but voters often decide their votes not on direct issues...).

I fully believe though that there are techniques, accessible by money, which yield more efficient results of voter persuasions than other techniques - but those tools are not limited to social media.
Correct!

But also some authors uses PushKit to keep their app constantly running in background.
Maybe I'm wrong, but I always thought that the "classic" description of a microkernel was one that implemented not only device drivers, but filesystem drivers and possibly other key components in userspace (memory manager?) as well.
At least that is how I remember MINIX 1.0 as described in the Tanenbaum book.

I appreciate there is a lot of grey area with microkernels, and a lot of hybrid designs these days, since as was the case with Mach/XNU/Windows NT, "pure" microkernel designs have often shown less than optimal performance due to additional context switching.
Interesting idea/project, never heard of the listserve or anything similar. Site is clean and fast, nice work ;-)
A few questions if I may. How many people are registered? If someone is selected (randomly), can he/she be selected again next week? Do you plan to release/make public available all previous emails?
<tinhat>But Google wants your phone number for correlation with ... other stuff, and ... other people. So they would say it's good.</tinhat>
I'm just guessing here but, given that Box doesn't use end-to-end encryption, I bet that their "grant access" button is meant for their support agents, and that [some subset of] their backend engineers could access your data at any time.

It's an interesting exercise to imagine an elaborate multi-custody arrangement where all data is encrypted with keys that live in hardware security modules and at least three of five senior people are required to join their secrets any time the KEK needs to be handled directly... but I can tell you that that kind of scheme where 100% of customer data is completely opaque would be a major inconvenience in a fast-moving SaaS startup. Not only is implementing an engineer-proof privacy scheme a massive undertaking but it makes debugging production issues much more difficult. If indeed they were going to go all-out on such a scheme I would kind of expect them to brag about it but I don't see claims like that in https://community.box.com/t5/How-to-Guides-for-Account/Data-....

I'm curious if anyone's worked at big-name cloud services providers and can speak to the practical effectiveness of privacy measures in place. My guess is that even at Google, for example, a rogue engineer working on a particular product (or maybe the infrastructure it runs on) could theoretically bypass organizational controls and look at user data.

To be clear, I don't really view this state of affairs as a big problem. I've commented before on why (https://news.ycombinator.com/item?id=20513055). Professionalism and integrity (in combination with organizational controls and the principle of least privilege) work fine IME, plus the fact that nobody except you really cares about your personal data. But I do think that your expectations are unrealistic if you think that backend engineers generally don't have the kind of access I'm talking about. Unless a service encrypts on the client with your encryption keys, you should expect that the company's "employees, or a subset, has unfettered access."
Yes, but my understanding of the article is the city was negotiating in good faith. They were willing to pay the $400k. Still a lot of money.
>I think Facebook's goal is to make it so that you have one persona you show to everyone. To me, that seems like a cultural thing unique to Silicon Valley

Reminds me more of DC.
Would spending the time and money in say getting a mechatronics degree, in hopes of being more legitimate in the startup world, be worth the ROI?
Or is it legitimate enough to just be a tinkerer plugging away at projects/products and learning from text books at home, in reference to the startup world.
Dave Chappelle says: Now we’re up to 27% of the alphabet.
It really only still exists for legacy reasons.

The original indexed file format under MVS, ISAM, heavily relied on the physical hardware keys on (E)CKD disks. In the 1970s, IBM replaced ISAM with VSAM, which didn't use that physical key feature and handled all the keys in software – and it was actually faster. (I don't know if the reason for it being faster was due to some fundamental flaw with the underlying idea, or just due to limitations of the particular implementation.) (Despite being deprecated, IBM continued to support ISAM until the mid-2000s, when they finally removed it from the operating system.)

IIRC, the legacy PDS (partitioned data set) format also uses it, but not the newer PDSE 1.0 or PDSE 2.0. (PDSE = partitioned data set extended). (PDS is like an archive file format, for object code it functions similar to .a files on Unix, for source code it was used to make up for the fact that originally MVS didn't really have the concept of directories, so keeping all your program's source modules in a single dataset was more convenient.)

I think the mainframe filesystem (VTOC) also uses it a bit.

There's probably a few other random things in z/OS that still need it, but the newer stuff (VSAM, PDSE, HFS/zFS, etc) doesn't really use it. I think if IBM really wanted to, they could add support to z/OS for running on industry-standard FBA disks instead of ECKD. (They did the same thing to VSE all the way back in the 1980s.) I think the main reason they don't do it, is not technical, but commercial – mainframes needing special SANs helps keep their storage business alive, if mainframes could work on industry standard SANs, they'd face more competition in that area.
Microservice Developer Cloud with Example
Well inasmuch as he's talking generally about index funds and where money is going, he's going to be talking about the major ones, like those that track the S&P.
What individual SV tech workers want, and what SV CEOs and VC pursue, are two wildly different things.

Using SV as a synecdoche for "movers and shakers in the information technology / adtech worlds", the statement stands.
I’m curious what framework Apple uses for web now. Last I checked (a week ago) icloud.com is still implemented with SproutCore.
To me this doesn't look a very good guideline. It's needlessly verbose and unintuitive. Instead of writing a long sprawling list of things, just using bullet points and figures would be better.

It mentions the importance of getting a big picture of the code in question first, but the guideline itself is pretty bad at presenting its big picture.

Here's the gist of it as I understand:

- Long-term health of the code is important.

- Development should be incremental and steady.

- Beware of the contexts: style, use cases and technical complexity.

- Suggest them changes with reasons.

- Make it quick enough.
> All monitors are the same model (this might make a difference)

It does: your monitors are likely reporting identical EDIDs. Or, to put it another way, your monitor's manufacturer is incompetent. (Which is sadly quite common.)
is there a good reference you'd recommend?
Strange to see a .gov.uk site on there ( https://github.com/dumb-password-rules/dumb-password-rules#h... ) as they have excellent guidance on this https://design-system.service.gov.uk/patterns/passwords/
Looks like Ember for the most part. Look at the code, it's not minified, yet...
Coronado the main Navy base in San Diego is mostly built on top of a sand burm. If anything is under San Diego it would have to be Miramar, or Camp Pendleton.
Because spam is one of USPS's few reliable and large sources of income.
Ethiopia is at least 62.6 million now (https://ethiodailypost.com/2018/02/20/ethio-telecom-mobile-s...) -- guess is that many of these numbers are not kept up to date.
Imagine you want to run a survey to determine how many people have had an extramarital affair. There are obvious problems just asking people "Have you had an affair?" on a survey, especially a live one.

So instead, you ask the person taking the survey to secretly flip a coin and privately look at the result. Then, you word the question as "If the coin came up heads, OR if you've had an affair, check this box".

When you look at overall survey data, and you see 51% of people checked the box, then it's reasonable to infer that 2% of them had an affair. But even if I de-anonymized the survey and saw you checked the box, I don't really have good evidence that you had an affair.
There is. The `pattern` attribute lets you specify a regex for an input field - including password.

https://developer.mozilla.org/en-US/docs/Web/HTML/Element/in...
Because for engineering, the eye-glazing details make-or-break things.

To distill the information usefully requires getting into your audience’s frame of mind.

Knowing what they intend to do with that information.

And knowing how much detail can be omitted without conveying misinformation.

I imagine science journalists face the same dilemma.
Personally, as someone who paid for one during crowdfunding, I'd be fine with one of the earlier hardware revisions. (Though probably not the very first!)

I'm honestly not as worried about the state of the software as I am the hardware; the software can always be fixed later. As for the hardware... so long as it's put together well enough and runs alright, I'm pretty happy.

I've been holding out for a worthy successor to my old N900 for years, and quite honestly I'd rather have something sooner that's a bit less polished than keep waiting!
In ruby a DSL is just ruby as well, although it perhaps ends up having to _look_ more like ruby than a Lisp DSL would. (Not sure, only vaguely familiar with lisp). But at any rate it's the same thing as far as "create within your codebase", no extra work of a lexer, parser, etc. This is a thing people do in ruby and call it a "DSL", when they are using fancy techniques to make it especially concisely expressed and well-fit for the domain (but it's still really just ruby under the hood, no parsing step but parsing ruby code with your ordinary ruby interpreter).

Which has always made me think... so HOW is this different than an API anyway, why does it have a special name? Aren't all API's "domain-specific languages" of a sort? Certainly they can be good or bad APIs, in a variety of ways, including being a good or poor fit for the domain of work they are trying to enable. But if in the end the implementation is just (ruby) calling methods on instances, or (lisp) calling macros and lambdas (or however you'd describe it in lisp if i've gotten it wrong)... isn't that what every API is, what's the difference?
In fact, Slack's success was precisely because it was a very well understood type of product (group chat).

Everyone shrugged and said "Yeah I need that" and it looked/felt better than Hipchat.
They used a plasmid. The plasmid had the gene they wanted and some gene to resist antibiotics. Both got copied. No topological problems.
Seems even nytimes reporter is embarrassed by what slack actually is (chat app) calling it “business software”.
This argument would be persuasive if the NRA were literally a gun that kills people rather than an organization that lobbies for the robust protection of second amendment rights.
This is implemented using Ember which is the spiritual successor to SproutCore
What do you think is missing?

Would love to chat more to see if we can fix that. :) edwin@stripe.com
IRC is great, but I've never thought of it as protecting my privacy. It's definitely public and almost always logged by a myriad of bots if not the server.
Just to hopefully further contribute, one of the top-deck features of the new Rails 6.0 release is its really thoughtful engineering work around multiple database support. At least, that's how it's named or described; the actual net result is a lot of smart people exhausting themselves making n-instance DB stack reliability and performance better on every chart... including setups where the value of n is 1.

What this translates to is that things should be impressively stable when your DB nodes go down, the backhoe shows up to party, or your BGP is routed to North Korea.
Looks like a combination of Ember and web components.
Walter, I think your Zortech compiler was one of the first (if not The First) to introduce register calling convention. I don't remember much, but how did you get around varargs implementation?
Did you miss the part where I mentioned that I was involved in the hiring process (interviewing candidates both phone screens and in person) and the anecdotal statistics of postgraduate degree holders in the company over a non trivial amount of time? I am basing my claim on actual experience as opposed to "feelings" which you seem to be following.

People involved in hiring at these companies put almost no weight in if you have a post graduate degree when hiring SDEs. Most of the weight is put in the interviews, they'll interview almost anyone esp Facebook, Google and Amazon. They hire at such a high volume that they don't have the luxury of targeting post-grads.
China’s Red-Hot Face-Swapping App Provokes Privacy Concern
Maybe just limit the number of people you can have a crush on at once.
While at first I saw this announcement and applauded (it seems like something Stripe would be great at administering), the structure of these loans is almost exactly the same as a payday loan, even if the APR is dramatically less.

What is crazy, is how eerily similar Patrick's response is with the Payday Industry's response about why Payday Loans are good for consumers.

>the downside risk of credit obligations they can't meet ... substantially outweighs the theoretical "risk" of a higher effective APR.

"The $15 cost of a $100 payday loan also pales in comparison with the lost income when a car is out of commission and a job lost. Good payday lenders clearly disclose their loan terms and conditions, including the dollar amount of any fees and the APR."[1]
Payday loans are clearly bad for the consumer, even as much as the industry tries to defend it.

[1]https://www.americanbanker.com/opinion/why-payday-loans-are-...
Why? Legitimately curious.
My 16-char alphanum generated password for Chase had an equivalent of "rST" in it. I can never remember which password modification I ended up with, and "can't choose the same password as your previous 4" gets real old real fast.
CL? Is that perforce? Hopefully it works better than the real perforce. A really tough and confusing versioning tool.
Now there's a blast from the past.

https://en.wikipedia.org/wiki/Microsoft_PowerToys#Windows_95
Ember, jQuery, Moment, and RequireJS.

https://imgur.com/DioXtwe
whoa i like this, I'd totally use this! Literally asked my friend earlier this week to send me a recording of himself and listened to it on the way to work.

A friend and I started something similar, we were thinking more for intergenerational connection; basically helps you keep in touch with your family but esp your Grandma who doesn't use tech. :) you get a story from her every week about some part of her life, like a podcast. https://keeplifestories.com But we'd like to make it available for communities of any kind, including friend groups.
I've switched almost entirely to diceware passwords and the too-long thing is a major PITA.
I know we generally discourage humor and satire here but I think this comment nailed it in a very HNesque way.
Neat! Is there a reason why it says at the top it only supports Google Chrome? I haven't looked into it too deeply, but a cursory glance seems to suggest there's no Chrome-specific extension, so I assume you're just hooking into the normal pkcs-related frameworks on Linux?
I'm running Netlify, and I also get errors on that tool on another site:

No DS records found for [retracted].com in the com zone
No DNSKEY records found
[retracted].com A RR has value [retracted]
No RRSIGs found

I wonder if all Netlify sites are "suffering". I don't really understand the problem or the % of users affected by this.
I'm not sure I stated my question clearly enough. I'm not asking whether active funds would fare better than index funds in a downturn, though it's interesting to hear.

I'm asking for a comparison of two scenariors. In the index fund scenario, we're in the world where index funds represent a large and growing chunk of the market. In the active funds scenario, index funds aren't a thing. Why is it that in the active funds scenario, what you're describing in the previous post doesn't happen? Why doesn't a 20% marketwide downturn cause chaos in these smaller stocks? Is it because there would be higher volumes if those stocks were held by active funds? Or because the active funds wouldn't hold stocks like that?

Basically, I'm asking for a comparison of the scenario you described with what happens in a no-index world, because I can't quite think through the difference myself.
I've encountered other weird bugs in mint too. On one site they wouldn't let me enter an email address as a username for a website which used your email as your username. Editing the DOM to remove that front-end validation worked, which was also disappointing, but at least it worked.
Very cool! I've loved Apple Music ever since I was able to upload my library using Match, and I feel like its recommendations are getting better and better. Nice to have this in a pinned tab.
My favorite dumb password experience involves EZPass, a system for paying tolls without cash, in New York.

I signed up for EZPass using a relatively “long” password (20 chars). I then received a letter in the mail about a toll I had to pay, even though I’d had the EZPass at the the time. But, the letter said, I could pay the toll by logging in to their site and using my EZpass credentials. Didn’t use OAuth but I figured it would be OK. I input my username and password using my password manager but it didn’t work. Pretty strange, as I was able to log in to the “main” EZpass site using those same credentials. I tried logging in on the payment site again to no avail. Finally I realized that my password was being truncated by the password input field itself.

The solution was to inspect the page and change the maxlen attribute of the password field.
But whatever attack vector was used is probably still wide open on your machine even after restoring a backup. Most people will just get infected again straight away.
$21.6M awarded to scientists for Breakthrough Prizes
I wouldn't go to meetups or co-working places for fun. I would go to meet people, or network as you put it. Lived in Bangkok for five years. Plenty of fun, and plenty of interesting and successful people to meet.
What's hell is not being told /at login/ what the unusual restrictions are.
I feel like I just saw this same landing page design, with the big cursor text at the top, for a totally different product. Weird!
Screenhero cofounder here. I’m working on a successor to Screenhero. It’s currently in private beta: https://screen.so
The stock has also bounced back already, so the headline is no longer accurate.
I think maybe the problem with the comment was that it started with "I think that’s incorrect" but it reads like a non sequitur. The comment to which yours was replying was claiming that matching ads to viewers is itself a privacy violation but your point seems to have been that it – matching ads to viewers – is unnecessary, which, altho related, is a different point and doesn't follow from you thinking that the other commenter's point is "incorrect".

I think you're right in that "site content" is a good-enough proxy for users/viewers/targets for advertising, tho I also readily understand why advertisers would always like more info with which to target their ads.
Value stock ETFs are index funds.
One of the first things that happened with the advent of k/v databases is that devs immediately re-implemented relational joins in software.

I suppose it’s only fitting that the top-rated HN comment is someone suggesting that a k/v SSD should be used to reimplement...filesystems.
In my school days I had the crazy idea that I wanted to get an MBA after my BS in engineering. To enter business school you had to at minimum take classes in accounting, micro, and macro economics. I clearly remember the macro-economics text book stating that African countries were poor because they did not contain enough rich people. I slammed the book closed and took it back to the campus book store for a refund. I completed the class without a textbook.
Verbosity stemming from a natural desire for recognition is a modern social
phenomenon not exclusive to programmers. Nothing we read, whether the New
Yorker, Stack Overflow, medium.com, or reddit, needs to be as long as it is.
I'd say verbosity is as much an existential threat as climate change.
Are you forgetting the gun owners who left the NRA not to join another organization but to join no organization? Or is the omission deliberate?