skysight-inc/HackerNews huggingface dataset:
I had the same thought, but doesn't a larger nonce simply decrease the chance for a duplicate nonce? Even if the chance is decreased to practically-impossible-to-duplicate levels, I could see the thought process being "if we're going to have to roll our own implementation to change the nonce size anyway, we might as well make an implementation that is provably impossible to suffer security issues from a duplicate nonce rather than one that is just immensely unlikely".

I'm not sure if that's really the right choice, but I could at least see that being their reasoning, especially if they're going for FIPS certification which maybe (correct me if I'm wrong) would care about something being provably impossible rather than just provably unlikely?

(disclaimer: my crypto knowledge is fairly surface level and I'm making this comment in a genuine attempt to learn)
Not all those named side-channel exploits are the same in terms of severity and difficulty to mitigate, nor are the chips vulnerable in the same way.

For example, Meltdown exposed severe negligence in Intel's design. For ARM Meltdown was limited to values of a single register, for which there's no reason to believe it was anything other than an unintentional bug--i.e. you don't get any substantial performance benefits from permitting speculation through that single register, though it perhaps simplified some other aspect of the chip.

Basically, if you go down the line Intel's issues were both more severe and pervasive, as-if they just didn't care about preventing speculation across privilege domains.

Notwithstanding the ARM's Meltdown mistake, both ARM and AMD very clearly had designs that attempted to prevent speculation across privilege domains. And they mostly succeed. The major issues are at syscalls where intra-privilege (not cross-privilege) speculation can indirectly be exploited by unprivileged callers. But like with SMT, it was always sort of understood that it was the operating system's responsibility here; there really are no good hardware mitigations.

Basically, the exploits for AMD and ARM (notwithstanding the lone register issue) are intrinsic to speculative execution, period. And everybody sort of understood this, especially in the cryptographic community with work on constant-time algorithms. It's just that everybody was too lazy to take it seriously more generally until Meltdown/Spectre lit a fire under everybody's pants. And once they began to pay attention, it immediately became clear that Intel's designs made patently and grossly unsafe design choices.

The details on IBM Power chips are spartan. I think their Meltdown issue was similar to ARM--a bug with a register--but I can't confirm that. My impression is that Power pushed the envelope more heavily than AMD and ARM, but not like Intel. Power went all-in on SMT, though, and though SMT is fundamentally anathema to cross-privilege confidentiality, Intel's and IBM's SMT implementations seem to leak more than AMD's.
It could be more serious than the flash crash (again, just an interpretation).

Flash crash gets resolved quickly and is transparent to non-participants because there is a lot of money willing to buy on dips. But fast trading money only buys and sells what they perceive to be highly liquid assets -- there are few things that scare them more than being stuck with an open trade.

The scenario Burry describes is akin to CDO crash. Naively, most CDO assets were not problematic and many/most of the problem ones had an underlying asset of some value guaranteeing the debt. What caused the crash was lack of liquidity that started a vicious circle.

Index fund scenario could be similar: less liquid stocks that are big components of major indices would crash with unknown systematic consequences. Even if only 10% of passive index investors heads for the exits we could see broad, long term damage. And they could: pension funds have been investing huge sums into indices and a targeted PR / a few headlines of the type "look what those financiers doing with worker's money" may nudge a lot of money out of stocks.

On the other side, it is easy to make conspiracy theories on any subject.
It’s also possible it was stolen. Though a FOI request against my hospital I was able to find the URLs where they store documents (they printed them and sent them to me, with the URLs at the top), which appear (though I obviously didn’t try) to be vulnerable to enumeration attacks. The files I was supplied with have sequential identifiers.
Artifact and DOTA Underlords?

Wow, they totally fell under my radar, which is impressive when they own the #1 game distribution platform in the world. I remember seeing mention of Artifact, but didn't notice DOTA at all.
In general I agree -- but it means your pipelines will have to support every customer you deliver to and be version-aware.

Part 11 of the FDA regulations that oversee software compliance enforce expensive re-validation processes for every major release of software. It's not something your customers are going to want to do very often. So set up a CD for each customer on version X.y.z where X is static and make sure that you don't accidentally ship a backwards-incompatible major-version change on that pipeline.

It's an interesting challenge for operations-focused teams but I agree that CD is a valuable tool to have.
White barn owls’ feathers reflect moonlight to stun prey
Administration captures the profit in education, not rank and file professors.

https://www.the-scientist.com/profession/textbook-adoption-h...

> Many professors and departments encourage such practices, which can be viewed as either bribes or legitimate marketing ploys. Richard McKenzie, a professor of economics at the University of California, Irvine, was appalled at schools' requests for inducements to adopt his textbook The New World of Economics (Homewood, Ill., Irwin Publishing Inc., 1989), written with Gordon Tullock. "A department at a Southwestern university chose our book and two others, and put them up for auction," says McKenzie. "They would adopt the book with the biggest side payment." So McKenzie began talking to publishers' sales reps and quickly learned that monetary enticement to adopt a book, although not rampant, does happen, and not just in economics. In science, these extras are encountered in large introductory biology and chemistry courses--but less so in physics and geology classes, which tend to attract fewer students.
You're missing his actual walkthrough of Svelte, that he likely did in the demo. I've seen Svelte enough times on HN that I'm vaguely familiar with it.

Svelte, to me, at a very high level, is "Angular 1, but fast" - which might be easier to develop for, but doesn't provide the same "rails" that React does (and why I prefer it).

At the end of the day, all the hang wringing about hooks and purity is about making it simple to reason about a program locally. I haven't used Svelte so I can't say for sure, but the problem Svelte (and that the Virtual DOM) solves is an issue I don't think I have.

In any case his presentation was interesting enough from a FP/Programming theory POV.
Lots of Hitchhiker's Guide to the Galaxy references:

https://en.wikipedia.org/wiki/The_Hitchhiker%27s_Guide_to_th...
Amazon Announces New Fire TV Cube with Dolby Vision, HDR10, and More
Excuse me, Dota Underlords? The absolute timeless classic? /s
A single website cannot compete with giants.

A friendly nerd cannot put the time into multimedia and SEO.

Commerce giants win. And those companies have fake social media users astroturfing.

Maybe blogs should be more accepted.
No. The Autoplay chrome flag was added but then removed/scrapped sometime in early 2019. You can only stop autoplay videos by using extensions now. The only extension that is actively maintained (and actually works) is called "AutoplayStopper" https://chrome.google.com/webstore/detail/autoplaystopper/ej...
I wonder what percentage of $170M is what Google spends on employee coffee each year. 90%? 95%?

Google has $170M in petty cash. This is not a fine. It's not even an inconvenience.
You can already run Typescript type checker separately from a type stripper today, though. Typescript has babel plugins for exactly that. Almost all webpack best practices for Typescript involve the fork-ts-type-checker plugin, running type checks in a separate thread from the transpile phase.

At this point almost all of what Typescript compiles (transpiles) that isn't just "type stripping" is some form of downleveling from current ES standards to older ES versions and is almost all entirely optional. There's also nothing stopping you from leaving it all to Babel to do it instead of having Typescript do it, if you wish.

(Though personally, I think Typescript is a lot lighter weight a solution than most Babel presets and tslib (the optional dynamic link version of the inline downlevel helper functions TS emits) is a lot smaller than Babel's equivalents in core-js.)
Human speech may have a universal transmission rate: 39 bits per second
Minor nitpick. WebKit created a debugger a couple of years before chrome existed. https://webkit.org/blog/61/introducing-drosera/
That is a fair response - the article is on European countries and I was only thinking of the US in my response.
Location: Dresden, Germany
Remote: Yes
Willing to relocate: For the right job within Germany, yes
Technologies: Linux, FreeRTOS, C, C++, Assembly, Arm, Xtensa, JTAG, Trace32, currently tinkering with Elm to broaden my view
Résumé/CV: https://cv.philipp-trommler.me
Email: cv [at] philipp-trommler [dot] me

Hi, I'm a mid-level embedded and low-level GNU/Linux software engineer with three years experience in building GNU/Linux distributions from the ground up as well as system services for RT and non-RT operating systems. This included fields like HALs, OSALs, IPC and everything time-related. Generally things that can't be seen but have to work.

I'm looking for a new opportunity within a company that does not just use but also contributes back to Open Source. I want to give back and work on something meaningful. I'd really like to be a full-time contributor to Open Source, including code, docs and community work.

If you need someone who knows how to code but also has the soft skills to interact with your community, who can reach from vector tables up to graphics and who can program from Assembly up to modern C++, reach out to me!
How to reach peak meeting efficiency
> 2. Meanwhile, try downloading a book from Amazon and transforming it into epub so you can read it on a different reader. If you manage to figure out how to do that, please let me know.

Sure. Use Calibre's "DeDRM Tools" plugin, decrypting the book with your personal key, and you'll be able to convert it to any format.
We have had a lot of success using Inspec and for a while Chef compliance in validating the infrastructure elements remain compliant continually.

For instance, you can check a folder remains encrypted or certain ports remain closed in dev and test before promoting your config management to production.

Quite involved to setup but a big tick for auditors.
http://archive.is/o8EGY
Persistent Memory Programming on Conventional Hardware
I am yet to see micropayments system that is easy enough. I don't want to look for my credit card or log in to paypal just to transfer $1 to someone. In my opinion the system that Brave is trying to introduce has the greatest potential. If only I could buy Brave tokens instead of "earning" them by watching ads I would have gladly supported my favorite publishers.
Yes why should I pay taxes to support a private company that is not profitable without taxpayer support

I am in the UK so I don't mind paying to support Medical Training, and training in stem skills those jobs are a net benefit to the state.
You forget the infamus "Sen. Fritz Hollings (D -Disney)", the Democrat whose constituency was called "Disney" instead of his state of South Carolina.
I think this is a bit of a weak argument, the overwhelming majority of creative works are not sold by the creator themselves.
Well, you're wrong. You can learn stuff "truly" without it being fun. There is a lot of stuff people learn without having fun doing it.
A slight difference is that Rust really wants to be the top level compiler. More than a lot of languages, even C++, it really relies on link time optimization to get the perf you'd expect.
Thanks for the link. Since I am not an accountant, I don't think I could look at this paperwork and determine how their budget works.

Is anyone here an accountant? Or know of a summary online somewhere by an accountant? The tax paperwork for the company I work at is many hundreds of pages (if not thousands), and I know I could not determine from that paperwork how the money is spent. I'd need actual access to internal books, and even then I'd likely not be able to tell.

It seems some budget clarity is in their annual reports:

>"In addition to building products and technology, Mozilla also invests in people and organizations around the world who share its mission."

https://www.mozilla.org/en-US/foundation/annualreport/2017/

Who are they supporting?

Some real numbers from this page:

>In 2017, Mozilla spent $966,365 on its agenda-setting work.

>In 2017, Mozilla spent $2,733,016 to support our mobilization work.

>In 2017, Mozilla spent $13,256,720 to support the Mozilla Leadership Program.

This last bit is suspicious, mainly because it's the same technique used by IKEA to avoid millions in taxes and in this circumstances is a bit scam-like. (trademark royalties)

>$10.1M of this revenue came from the proceeds from Firefox, which are transferred from Mozilla Corporation to Mozilla Foundation through a trademark royalty agreement.

So here's a clear statement that $10.1 million dollars is moved away from Firefox development and put into the Mozilla Foundation.

Why this is really odd is because Mozilla Corp is owned by Mozilla Foundation. Why is the parent organization taking funding from the corporation it's supposed to be supporting?

So, it seems that many people are right about Mozilla being clear about where their money is going, but no one seems to be stating they truly understand where that is. This seems like three car monty with donations to Firefox.
Yes we do! :-)
Re no 2. I believe the Calibre plugin DeDRM does what you want. It's been a while since I used it, but iirc you will need to have a Kindle registered with the Amazon account you used to buy the book for it to work.
Online shop only, or brick and mortar?

Trade "print" media with an online presence. Online media that doesn't sell all their pixels to Google? Radio, depending on your audience and required reach? Forums specific to your audience that don't sell all their pixels to Google. Podcasts. Submarine articles in the trades? Open source ad networks that don't embed insanity or real-time bidding?

Mostly, I would try to target your initial audience as precisely as possible where they live, rather than with a wide net. Perhaps a Google search returns results for top websites dealing with your product - if they are not vendors, then perhaps you advertise on that site?

Disclaimer: I'm not a growth hacker, but I've thought about these things and run a couple of poor Facebook campaigns for a brick and mortar business.
Sorry if I was misunderstandable.

What I mean is that those limitations are made up. You just have to clearly state what you want to do with the money and that will fix those problems. Obviously restricted funds are nothing that is set up in 5 minutes, but I would expect that somebody really thinks about that.

And if you state that up to 10% of the restricted funds might also be used for any other projects of Mozilla, that might be okay.

Something like "your fund will be used for maintaining the infrastructure necessary to provide downloads of the latest binaries" would also be totally fine for me in terms of "buy a new server for this whenever you need it", be it a flooding or just the old server dying. But that obviously does not cover putting money into whatever shiny project is prioritized right now and might die in a year or less.

Otherwise you'll have a cash cow project that finances everything else. While that might be nice for one side, the other side would love to know that their funds are used to improve the already good product.
You would be right if this were an honest mistake, but a malicious actor can take advantage of this for all kinds of heap-based attacks.
https://en.wikipedia.org/wiki/Heap_overflow
I do not understand your analogy. Are you implying that we cannot be unbiased? I do agree with that, however, what is this diversity thing, fighting over biases or preferences (sides)? I do not understand how one side is bigotry, and the other is equality. It seems like it is just a matter of POV. When you are steering to the left, the right is in service of bigotry, and when you are steering to the right, the left is in service of bigotry. Additionally, according to your analogy, it seems like that everyone - including the people who say they prefer "equality" - is actually not steering straight, just to a different side.

It would be great if the people who preach we should not discriminate based on ethnicity, religion, and so forth would actually stop doing that, and start paying more attention to skills, which is actually more relevant to the job. It seems like that they do not wish (or at the very least do not, regardless of intent) to stop discriminating, they just steer to a different side.
Don't get your hopes up. This has nothing to do with the iPhone SE. No 4" display, no headphone jack, no aluminum unibody, no physical home button.
The most common issue is normally password managment. Lots of little regs say things like "passwords must be changes every 30 days", which might have made sense decades ago but is very anachronistic today. (I have an alert at the bottom of my screen right now saying my password expires next week.)
Show HN: Do you suck at delivering presentations or giving pitches?
> The ‘iPhone 8’-esque description suggests it would be based around Touch ID though

That's too bad if true. Having a smaller phone size / screen should warrant having an edge-to-edge display without having a button take up any screen space. Maybe they can put Touch ID on the back of the phone or integrate it into the phone screen like the Samsung Galaxy 10 does now.
> We'd spawn psql, but that needs the query, as a complete, pre-templated string — it does not support any sort of positional parameters. [...] So, really, psql needs an interface to supply those values as arguments to the CLI.

I haven't tried this before, so caveat emptor, but per psql's manpage this should be supported:

QUERY="SELECT * FROM sometable WHERE name = :'foo'"
echo $QUERY | psql -v foo=asdf # ... other args ...

Basically: you can use colon-prefixed variables in the query text (with the variable name optionally quoted to indicate how the result should be quoted, apparently?), and set them with the -v option (which is equivalent to using the \set command within the query string itself).

This also happens to work for table names, at least per the example in the manpage:

testdb=> \set foo 'my_table'
testdb=> SELECT * FROM :"foo";

Except in this case it'd be more

echo 'SELECT * FROM :"foo";' | psql -v foo=my_table # ... other args ...

Still no option there for positional parameters, but it's a start, right?
I think the flaw in this analogy is that it's impossible to know beforehand whether the cookies are tasty or not. And a cookie that was previously tasty might not be tasty any more.
Day Challenge [No Movies/TV Series, No Sugar, and Few More Not to Do's]
Surely they could have come up with a better name?

"Taycan" - whats that supposed mean?!!?

Is industry running out of suitable names?
I did a bit of digging, and I am starting to agree they are being open about where their money is going.

But I'd argue you don't know where the money is going. I just found that in 2017 income from Firefox development was syphoned off to pay from Mozilla Corporation to Mozzila Foundation to pay for various programs and re-donated to others.
Yep, it's unusable for me at work on my scaled display. It isn't just power consumption, scrolling is noticeably slower. I've been checking in on this issue every release, looks like I'll finally be able to go back to Firefox after 70 is released.
It is blocked only if the video has sound. Muted videos can be played automatically.
Or you're showing them to technical management, architects, etc, who are quite capable of understanding their importance and see how those lines benefit them, the ones on the front lines for compliance issues.
If the small cap valuations are totally wrong, shouldn’t some simple measures like P/E show it clearly?

Edit:
The P/E values on Russel 2000 seem to be almost double compared to S&P 500 [1]. Also some point out that the value is not correct as it leaves out negative earnings which are common among small caps [2].

[1] https://www.wsj.com/market-data/stocks/peyields
[2] https://goldco.com/russell-2000s-price-to-earnings-ratio-is-...
Tanning and tannins share a common root.

Acorns are high in tannins, which, among other things, make foods astringent (painfully chalky). Repeated soakings in water reduces them and you can make a flour.

But now you have a bunch of water high in tannins, which work as a preservative. I'm not sure how someone figured out you could soak leather in it. But I know that walnut colored stain can be made from walnut husks, so decoration may have lead to observation of improved durability. If it works for walnuts why not acorns?

I think this is why pottery was such an important step in human technology. After pottery, the process of boiling the shit out of things to make them palatable, safe to eat, or useful for crafts expanded our resources tremendously. There are cultures that simmered things without ceramics but it's complicated work to keep from damaging your container. Imagine doing all the detailed work to weave a water-tight basket and then your child manages to burn a hole into the damn thing.
No its not that is exactly what is happening, that's why previous UK Tory chancellors where keen on increasing the minimum wage - to reduce the £ spent on tax credits.
What Urban Sprawl Is Doing to Your Commute
That's apple to oranges though. What does it cost to rent office space at 1WTC?
> Having a smaller phone size / screen should warrant having an edge-to-edge display

Does nobody hold their phones anymore? Why would that ever be comfortable? I hated my Samsung phones with curved edges, the last thing I want is a phone that I can't hold onto without touch being triggered. That seems completely antithetical to the SE.
Even minimal CD is better than doing (or trying to do) the same thing 'by hand'. And adding automated tests is going to be easier with even the rudest CI/CD setup. Some organizations haven't even taken the first steps towards adopting good software development practices:

1. Version control
2. 'Ticket' system
3. Automated builds
4. Automated deployments
5. Automated tests
6. Code review
7. ...
Ask HN: We are planning a 6 months leave. Are there anything to look out for?
Me and my wife are planning to quit our jobs and travel for 6 months. It’s always something we want to do before we have kids. Has anyone done something similar and want to share his/her experience? And anything we should look out for?
PostGraphile is not an ORM, it’s a client-facing GraphQL API designed to be consumed directly from your frontend applications (web apps, mobile apps, etc). This is why it has such powerful customisation and extension features so you can use it to build the GraphQL API you want.
Is that planned?

Doesn't matter; this exists now: https://github.com/cdr/code-server/