skysight-inc/HackerNews huggingface dataset:
> Google has some responsibility when identifying flaws in consumer devices and software to be more clear about the actual impact, ramifications, and likelihood that your device was compromised.

https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...

"Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites."

"We estimate that these sites receive thousands of visitors per week."

"TAG was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12. This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years."

Google was responsible in identifying estimated scope. They didn't say it was widespread or impacting millions of devices. And that there are vulnerabilities of 2 years worth of iOS versions is pretty reasonable evidence that this has been a 2 year project.

Meanwhile Apple's counter-claims sound like pure damage control with no supporting evidence. They claim it was only operational for 2 months. Yet they provide no justification or evidence for that claim. They are in no position to monitor what happens on the web as they don't crawl it, and don't even attempt to explain why there would be exploits for 2 years of OS versions if this was only operational for 2 months.

But I'm not seeing any reason to believe Google was anything but responsible in its disclosure, nor that they sensationalized it in any way.
How do I do this if I’ve already deleted my Facebook profile? I know Facebook is still holding some data on me because the “that account doesn’t exist” page it shows when I type in my former account email is subtly different than the page when I type in an email I know doesn’t exist.
As someone who has spent weeks on hand-optimized kernels, I've yet to see a compiler based system that comes anywhere near my kernels. I've tried them all, because writing and optimizing assembly on multiple platforms is hard AF.

The highest performance approach (on CPU) seems to be JIT assembly (as used in Intel OpenVINO). On Intel, that beats the living Jesus out of everything else, including my work. On ARM it's a free for all, and there's no clear leader, especially in quantized inference. On GPU whatever it is NVIDIA is doing is the right thing to do.

I'm skeptical that XLA/MLIR/TVM-like approaches can come close to, let alone exceed, the performance of hand-tuned kernels, for the same reason why hand-tuned assembly beats the shit of what compiler generates most of the time. I've yet to see it happen in practice. And you just need a few of those kernels, strategically placed where most of the computation happens, as per Pareto principle. For something like TF Google has the resources to get that done. It just chooses not to, to sell you more GPU-hours.
The Curse of the Cargomaster
Hi guys, coming from the industry - this seems to be standardized pricing for data annotation with a dedicated workforce. Great tool set though. Good luck!
I think this is a good article, but ironically I think all three tribes would actually describe themselves the same way many times (whereas this article implies they'd describe themselves, or what matters to them, differently).

To use an example from the article, I think Jonathan Blow would absolutely argue that he wrote his own game engine because it was best for his user. Whether you agree with him or not, he is whole-heartedly convinced by his assertion that it could not be done in Unity trivially. Having listened to him a fair deal, and his feelings on games (vs. programming of games), I very much believe that he cares a tremendous amount about the experience of the game above quite possibly all else. So, while you can certainly argue that the way he chooses to implement that goal is misguided (I don't believe this, but an argument exists), I don't think its fair to give "The UI is more important than anything else" to the third camp and not his. I think he agrees with this statement, and feels that what gets you the best UI in a game happens to be low level work (to avoid frustrating lag, etc.).

Similarly, I think Bret Victor might take issue with this as well. Much of his work is centered on creating innovative UIs to help people think, and often against the (current) abstract ways of representing knowledge. In particular, from the maker perspective, he cares deeply about empowering people to make things -- less so I would say than some sort of mathematical purity.

All this to say, I think there may be less difference in goals than we think, and more difference in what we believe influences those shared goals.
I totally understand your philosophy and you make some great suggestions, but overall there's one big flaw with whiteboard interviews: Artificial Pressure and its impact on people's ability to think clearly on the spot. I am a very methodical thinker which is why I tend to prefer work in large scale ore high-performance systems where you consider the implications of thread contention and so forth. I've designed and built multiple large scale production systems and i've also simultaneously forgotten whether it should be += or =+ during a whiteboard interview because of a phenomenon I can't quite describe. Obviously I was laughed at for someone who's actually had 10 years experience with c++ to forget something so basic but it happens when you are on the spot.

The biggest problem with whiteboards is that they reward exactly what they say they try to weed out, rote memorization. It's no secret you could spend weeks practicing on leetcode for an interview but those skills simply don't translate to real-world programming. Algorithm design is maybe 2% of software engineering. The vast majority is knowing what pieces of technology are out there in order to avoid reinventing the wheel all the time. Whiteboards don't test that skill. It tests a marathon runner on their 100 meter dash time.
$ lynx -dump math.mit.edu/~drew | bc
42
$
That there exists useful product reasons is beside the point. The point is that people who don't want their data to be involved should not have their data be involved.
Here is a pretty comprehensive place for updates and discussion:

https://www.reddit.com/r/ISRO/comments/d01ux1/chandrayaan2_v...

Edit: LOS :(
I wasn't sure how much your ideas deviated from mine, which I why I said "clarifications"; but you're slightly incorrect. DevOps isn't two philosophical ideas. It's lots of things, and all those things are the methodology. There are many books, podcasts, blogs, conferences, etc that go over all of the things DevOps is. It actually has little to do with tools or software, even though that's basically what it was created around. It is a general methodology, and you pick how you implement it. You can even apply DevOps to non-software processes.

Look at it this way: The Toyota Production System isn't about cars. It was developed specifically to produce cars as well as they could be, but it doesn't address "car problems"; it addresses business problems, production problems, workflow problems. It applies methods as practices in ways that are specific to the production of cars, but you can apply the principles of TPS to things other than building cars (as we do with Lean).

DevOps is comparable to TPS (well, Lean), but for software instead of cars, and it borrows from other systems, and it has a few of its own ideas specific to software.

> Along the way, I specifically denounced the idea that DevOps is a single methodology, or that some tools are more DevOps than others, or that DevOps makes prescriptions about what you should do. Those are all things that you immediately advocated.

I advocated using containers because they help reinforce DevOps principles better than alternatives. You don't have to use them, but that doesn't make them un-applicable to DevOps. There are different levels to DevOps, and one of them is "practices": particular ways of doing things that DevOps encourages, such as Infrastructure as Code, Immutable Infrastructure, Heterogeneous Environments, Continuous Integration & Delivery, etc. Things that containers are more useful at accomplishing than, for example, VMs.

You don't have to use Kanban to run a car production line. But it's more TPS than the alternatives.
Midwestern humor isn't for everyone. It has a bit of a sour aftertaste.

Non-Midwesterners may mistake it for hostility, in the same way that non-New Yorkers might mistake an offhanded cultural observation--or anything the New Yorker says, really--for being a rude, arrogant prick.

(Edit: Not you. The author of the article is the New Yorker.)

(Edit 2: If you are a Midwesterner, then you're not a non-Midwesterner, by definition.)

(Edit 3: Let's not even go into how someone with a used Exorcist fridge is snooty for dumping on Keurigs. That's some Midwestern humor right there.)
Awesome Flask – a curated list of things related to Flask
Let's Encrypt goes down, certs can't be renewed, people can't access websites securely (or at all if HSTS was used).
More to the point, how does Apple know that was the only attack being carried out? The only known attack, perhaps.

The exploits were meant to operate on devices running as far back as iOS 10, spurring Project Zero to assume the attackers were active for 2 years. That's a bit of a guess. The bug could have been discovered 1 year ago and backported to cover the widest number of victims. Then Apple retorts that the website that was discovered had only been around for 2 months. But they can't know if there wasn't an earlier site using the same bugs. And nobody can say for sure that there aren't other sites as yet undiscovered.

You can pick your poison what level of paranoia is appropriate. But I find the turf war since this was published to be unsightly. Why does Apple feel compelled to defend anything? Why do Apple advocates keep making accusations that Google is bad? (As if Google being bad automatically translates to Apple is good.)

The measured response would be to say, "Yup, security is hard. Really hard. Look even we sometimes make mistakes." Instead I'm only reading excuses that attempt to uphold a fiction that Apple devices are devoid of security flaws.

And if you think the people who work for Google are being petty by overstating an Apple 0-day, is being equally petty really the best response?
JSol, RMS, the gerbil, Liz, and MG, at Kabuki in Cambridge.
The expression on Richard's face is saying, "I don't know, why do you wrap gerbils in duct tape?"

https://www.donhopkins.com/home/catalog/images/jsol-rms-gerb...
i've been using spectacle for many years pretty happily. maybe too basic for some but works great for my needs

https://www.spectacleapp.com/
Have to say that the binder clip is a good deal of an advancement on the paperclip....and it only has three parts, two identical.
If you had read the article, you would realize that the users of the app aren't under suspicion.

The feds want to know where the app was downloaded, because they're trying to figure out all the countries that the scope manufacturer illegally exported their scopes.

The app only works with a specific scope.

Let's let the feds do their job and investigate this company for the crime they committed.
> does anyone remember Project Zero doing such an analysis of Android bugs?

Yes, many times in fact. So besides that "question" just being a terrible "Whataboutism" fallacy, it's also just wrong.

From 2019 alone here's a handful of deep-dives into issues with Google software (well the last is linux but is done against Android specifically):
https://googleprojectzero.blogspot.com/2019/03/android-messa...
https://googleprojectzero.blogspot.com/2019/04/virtually-unl...
https://googleprojectzero.blogspot.com/2019/02/the-curious-c...
https://googleprojectzero.blogspot.com/2019/01/taking-page-f...
I hate nearly every one of those questions, with a few exceptions which are excellent.

It comes down to this:

I am not willing to be psychoanalyzed by my future coworkers.

Most of those questions would test my ability to come up with diplomatic answers or straight up lies about the past (or my willingness to prepare those sorts of things). Some of them I am straight up unwilling to answer; no, I'm not going to dig deep and tell you how I feel about my personal flaws and the failings of the people around me.

If you're not willing to hire someone without putting them through that and I'm not willing to work for anyone who wants that from candidates, we've both figured out something quite useful.

Some people have protectable disabilities which those kinds of questions would very well filter out. Do they have to ask for reasonable accommodation that their job interview be about things directly related to the position?
It may sound strange but the focus of my interview questions is to encourage the candidate to express an OPINION which I hope becomes a STORY. To that end I'll ask questions that at a glance seem to be objective through a lens of sound bites on "best practices" but are really subjective. What is good code? What is good data? (And bad, of course.) Skills can be learned quickly to produce A result but experience gained over time will have wrought something more interesting.
I don't know, probably because it directly contradicts the argument you're making that "princess" is a "ninja" title, or that it conveyed any kind of status (other than the empowerment status it later earned for itself through Parisa's work). I guess that's what I was trying to say? That your argument was incoherent and bad?
Slow here as well (UK) also it should be ‘7 reviews’ not ‘7 review’
They're not looking for anyone. They're looking for evidence that the scope manufacturer illegally exported to countries that they weren't allowed to, and tracking app downloads is certainly a way to do that.
I know. What Apple should do is setup a crack privacy team to expose and publish all the ways the Android platform allows Google and third parties to collect data and generally invade privacy.
Ask HN: What would a market interest rate be, in the absence of monetary policy?
Via mechanisms such as paying interest on reserves and quantitative easing, central banks effect monetary policy by setting interest rates, both short-term and long-term. In Europe, we see the unusual situation of negative interest rates. Meanwhile, in the US, Alan Greenspan is signaling that investors should expect negative rates in due course. Given that central banks set interest rates as a matter of monetary policy, it begs the question of what these rates would be were they not to do so. Have any economists attempted to answer this question? I am ignorant enough of central banking (and banking in general) not to know how to research the matter further.
I let candidates use their phone to Google or ask me to Google on their behalf. What they're Googling for never matters in the context of the interview and it's mostly to make them feel more comfortable.

It's a whiteboard, I'm looking out for far more important things than whether the method is named `size` or `length`.
ln -s actual link

Read it somewhere long time ago, never had to look for it again :)
You list the ciphersuite that got chosen for each connection, but I think this could use at least a caveat explaining that the way this works means you'd need to do a LOT more work to figure out what the servers might have agreed to do for some other client.

What I mean here is that TLS up until TLS 1.2 goes like this:

Client: "Hi, I know ciphersuites A, B, C, D, E, F and G"

Server: "OK, let's do C"

And so you can't tell whether the server actually knows A, B, D, E, F, G or even I through Z. They just decided to pick C this time for some reason.

In TLS 1.3 it's sort of better (all of the ciphersuites you shouldn't use don't exist any more) and sort of worse because now it goes:

Client: "Hi, let's do method B, I'll go first, 123456 and a goldfish and the colour yellow"

Server: "Cool, method B works for me, I pick 567890, a swan and mauve"

Probably all TLS 1.3 servers today are willing to do anything method not just method B, since all the methods are shiny and new. But perhaps not, and you can't tell except by failing the connection which takes more round trips.
Meh, I'm from the UK, this was more on the hostile side of things. Perhaps a misjudgement of how tone maps to text, but yeah.
Does the cash compensation amount matter? E.g. can I pay them $1 while keeping the equity agreement etc?
And yet, had someone just stated "Squirrels listen to bird songs and relate that to their relative safety." You might dismiss that with "Sounds plausible but you can't really know that can you? Maybe they just like birds."

"Doing the science" is something that while sometimes seems like you're testing an obviously true hypothesis does two things, one it gives you confidence in asserting something is true (hypothesis proven), two it unlocks additional structure that was unknown (hypothesis fails randomly indicating a confounding factor).
Here's what my left hand menu looks like: https://imgur.com/a/dFPibMc

I'd guess that it's a feature that's being gradually rolled out to all accounts.

I originally posted it because I was frustrated that I didn't see a link to the setting in the article, but I guess I understand why there was no link.
That's due to US sanctions.
I have a real job and do this. I don't get up at 4:30am, though. I get up at 5am.
That's right, no impact.
I've never used XCA but I've heard of it. Does it have an actual "online CA" with an API for signing certificates or is it more of a desktop app that works with local signing certificates - like a graphical version of OpenSSL?

If you ever have a reason to check out the `step` / `step-ca` toolchain I'd love to chat about the differences you see. Message me here or shoot me an email (mike at smallstep).
They are hiring a bunch of people who have a serious disdain for the way they are interviewed. A better question might be, "who are these companies putting in charge of their interview process?". I think the answer there is largely, "people who have a serious disdain for this kind of interview, but still need to interview people and don't have any better ideas for how to do it".
Do you know what was a startup at one time outside of Apple?

TestFlight. https://en.m.wikipedia.org/wiki/TestFlight
Thank you Peter for your time.
>has neither better range

any additional gear is an additional loss of efficiency. One gear engagement results in up to 10% of loss.
The logical extreme of camp 1 would be researchers who are more interested in creating Haskell language extensions/conducting research than doing work for which UI/UX is very important.
I have uBlock Origin and Privacy Badger installed on Firefox, and I can just click anywhere outside that window to see the full article. Not sure it's to do with the browser extensions necessarily, but I don't have a particularly exotic setup.

The only other thing I have which might help is a user chrome file - https://www.userchrome.org/how-create-userchrome-css.html - which has this simple rule in it:

html, body { overflow-y: visible !important; }

That seems to help with a lot of the basic "disable scrolling" css rules that sites use.
I appreciate the good things Google does for me; they are many. But I don't think protecting my privacy, much less securing my data even from themselves, is their priority.
No, "they" don't. Some people do, sure. But some people are doing as the parent mentioned; ringing the phone. Letting you know they need to have a discussion with you, so you can reply when you're ready.
Can I work from another country under a H1B1 visa? Example: I get the visa but then I work remotely from my country, or for example I renew it but I never go back to the US.
Ha, yeah, I might say something similar, except that I would say, "mostly just arrays and maps".
python handles big int automatically:

sh-4.2$ python -c "print(-805387388120759743+804357581458175153+126021232973356313)"
42
The article is from 2014 when Stripe's valuation was $1.75b, a 44x multiple to revenue. From the article "sky-high valuations for unproven companies aren’t unheard of in the Valley."

Now in 2019 valuation is $22.5b. I think the article is no longer current.
I had to Google it because I couldn't find any definition anywhere. A "CL" is a change list - maybe, that's what I found from my Google search. It is a term used dozens of times on that site but never defined, as far as I could find.
Is this an honest question? I can't believe that it is...
The space we rented from in Chicago had an open-office first floor and then several stories of small private offices --- where the majority of the tenants worked. Everyone I've ever conf-called with who was in a WeWork, including our NY team, when they were in a WeWork in NY, was also in private offices†, or the WeWork phone booths, which are also better than what most private-office startups have.

I don't know what WeWork you're seeing, but the startup employee experience in WeWorks is generally better, from a professionalism and productivity perspective, than typical startup offices --- if only because they've found a way to scale up cost-effective small private offices.

We ultimately moved to a fairly large private office in Chicago (Chicago commercial space is cheap), and I like it more than I like WeWork, and I don't like WeWork the company at all. But the notion that WeWork isn't providing professional office space is just false; the space they provide is, by a wide margin, more professional than tech industry norms provide.

Unless WeWork outside of NY and Chicago is starkly different than WeWork everywhere else, I don't see how this is even a viable argument. I'm eager to see the counterexample you'll provide.

† (I'm not talking about the WeWork conference rooms, which are excellent and highly professional, so much so that people I knew in Chicago would borrow our WeWork conference credits to hold client meetings in even though they had their own non-WW offices)
By the reasoning behind significance, "surprising" would be a great drop-in. However, in most studies, it would be more surprising if the null hypothesis were true. Statistically significant results are pretty much a given.
I don't know if Apple care; they have enough money not to; but this is the reason I don't, and won't develop for iOS.

Responsive webapps - go for it.

Native code? You're building on someone else's land.

Like, there are endless justifications people come out with, I guess it's because they really want to develop on iOS specifically, or just want money (and there's a lot of it out there), but at the end of the day, it's all gone in a heartbeat and there's literally nothing you can do about it.

I can't even fathom how I'd feel in the author's situation, and not starting sidesteps the issue entirely.
Companies are there to make money. Governments are politics. In this case Huawei is both money and politics.
for big numbers you can use bc (infix) or dc (rpn) calculator:

echo '((-80538738812075974)^3)+(80435758145817515^3)+(12602123297335631^3)' | bc

echo '_80538738812075974 3 ^ 80435758145817515 3 ^ 12602123297335631 3 ^ + + p' | dc
> To be credible, it would be especially true for a competitors product.

At this point, I don't think it matter much to the typical consumer. Both camps have their fair share of zealots, and short of a press release stating something horrific, most people don't care to switch to the other side. iOS users claim superiority for their device features like iMessage, cameras, and UX, while Android users pretend like their device is for the technologically enlightened.

Credibility in a report like this is a non-issue for most users. It's not about responsible disclosure, facts, and the truth. It's about marketing.
To chase away homeless people, 7-Eleven stores in L.A. use classical music