skysight-inc/HackerNews huggingface dataset:
> It's already incentivized, via inspections and fines.

Well, the inspections aren't happening - since major leaks are happening. And the fines are very small, otherwise a bunch of these companies would have gone under.

More importantly - no criminal charges against the management of these companies and the engineers who signed off on the thing.
Running it on an almost-10 y/o ThinkPad, careful mate.
Good Dog | Senior Software Engineer | New York, NY | Full-time | On-site

We’re on a mission to push puppy mills and other bad actors out of the dog world by making it simple for people to get their dog from only responsible sources.

There are 9M dogs going into new homes in the US every year, but the experience of getting a dog is stuck in the past and the market is totally broken, which leads to dogs being harmed. We’re transforming the experience of getting a dog into what it should be — modern, trustworthy and hassle-free.

This is an exciting chance to improve the lives of dogs and bring joy to countless families.

Good Dog is based in NYC and is funded by Slow Ventures, Felicis and the founders of Eventbrite, Warby Parker, Harry's, Flatiron Health, Task Rabbit and more.

Our Stack
_ Front-End: React, Webpack, ES6, SCSS, Tachyons, Bootstrap Grid
- Back-End: Ruby on Rails, Go, Redis, Memcached, PostgreSQL
- Ops: AWS Fargate, Terraform, Docker

Learn more about our open Senior Engineer Role here: https://www.gooddog.com/jobs/Senior_Software_Engineer

Email us at careers@gooddog.com you're interested and we'll get back to you promptly.
Thanks! We try to be transparent by default and even when it is difficult. I think the OP is a good example of something that is hard to be transparent about because the decision isn't obvious and it takes discussion to come to the best conclusion.
In case anyone else was curious, the regular expression used is:

vulnpatterns = re.compile("(?i)(denial of service |\bXX E\b|remote code execution|\bopen redirect|OSVDB|\bvuln|\bCVE\b |\bXSS\b|\bReDoS\b|\bNVD\b|malicious|x−frame−options|attack|cross site |exploit|malicious|directory traversal |\bRCE\b|\bdos\b|\bXSRF \b|\bXSS\b|clickjack|session.fixation|hijack|\badvisory|\binsecure |security |\bcross−origin\b|unauthori[z|s]ed |infinite loop)")
Presumably the iOS Chrome is not using Apple's private APIs.
"Under the current system, France offers employed mothers 16 weeks’ paid congé maternité (three to six before the expected date of birth and 10 to 13 after). The total allowance increases to 34 weeks for twins and 46 for triplets.

Women receive 26 weeks, instead of 16, from their third child. They can choose to return to work sooner, but must take a minimum of eight weeks, including six after the birth, to receive pay.

The leave is paid at 100 per cent of salary, capped at €540 net per week. This is the equivalent of a €2,885 gross monthly salary."

2855 Euro gross is fairly normal in France for the bulk of the people who would need this assistance. The $650 is net take home, not gross. You also have to take into account that in France lots of things that are very costly in the USA are free and so you can't directly compare the compensation for paid maternity leave with the income of the median woman in America, that's apples and oranges. You should compare it with either the median pay in France or with the average paid leave compensation in the USA.

Finally, there is the duration of the leave to take into account 16 weeks is going on three months, which compared to the 6 weeks (or less) of maternity leave in the United States is pretty generous.

Is it costly for mothers? Well, that depends on the income of the mother before the maternity leave. But France has figure out - rightly - that if you earn lots of money that you need this assistance likely a lot less than if you do not. And so there is a cap.
But they had to know it was happening at some point right?
Have you considered that they're all oligarchs?
Wouldn't a more reasonable path be for Apple to talk directly to Electron and Chromium about the issue and work out a path forward before rattling a banhammer at app developers, though?

I mean, did Electron or Google just refuse to fix this? Are these private APIs things that actually get exercised in the apps being threatened?

It's not so much about culpability or Apple's right to control their app deployment environment, it's that the response seems really disproportionate to the offense and pretty badly misdirected.

A more conspiratorially minded poster might wonder if the real goal here was to dissuade developers from using cross-platform frameworks...
That's the mobile version of chrome, which as required of all browsers on iOS, is using the Safari web renderer under the hood.
I think that’s just a coincidence. This has been simmering for about 30 years, I think tech monopolies are just very visible.

Remember when Mark Zuckerberg was going to make a presidential run and went canvassing the country in 2016? The dems loved the guy.
Getting this vaccine especially for your kids is a no-brainer. HPV is everywhere and it is not benign.
These numbers are too low. I assume that this task manager might show only private pages and not account shared pages with code (and the code size in Chrome is close to 100 Mb). Anyway, the number looks a bit unrealistic. Or maybe it doesn't count swap.

I used Electron apps on Linux and typically memory usage doesn't get below 250-500 Mb.

Here is an example for Skype: 220 Mb of swap + 388 Mb of PSS (Proportional set size).
While working on a project that uses a service built in Typescript I've been using vscode. I was wondering what was wrong with my laptop's battery, it had gone from lasting around 2-3 hours unplugged doing reasonably intensive to lasting around 40 minutes. As soon as I stopped using vscode the battery life went back to what I'd normally expect. It's honestly outrageous that applications built on Electron strangle your CPU to this extent. I'm not sure if vscode is particularly resource expensive compared to other Electron apps, but compared to other editors it's just ridiculous.
Ask HN: Which PAID VPN do you trust the most and recommend?
I started searching for the private identifiers listed in the blog post and ran across this document describing Chromium's Mac compositor:

https://www.chromium.org/developers/design-documents/chromiu...

Technical details aside, it describes two methods of performing delegated rendering on Mac. One uses public APIs and causes a "reduction in performance and increase in GPU power consumption." The other uses the reverse-engineered CAContext API.
You can replace the 1TB in the cloud key with 5TB drives, which help. You can also set the compression to get more lifetime, or change always record to only record windows around movement.

Check the net for 5TB upgrade instructions.
What a shitty title, I expected a self-harm story.
What's bullshit about banning someone who has been notified that they are in violation of the rules and then tries to hide their use of private APIs rather than stop using them? That's exactly what I would do in Apple's position. Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake.
> who doesn't have EFI these days?

VM's hosted on VMware ESX with the default settings comes to mind.
There’s nothing wrong with voting against your own (direct) interest. In fact what goes against your direct interest can be more than made up for indirectly by making a fairer or generally better society.

Obvious example: green energy, generally speaking, is less economically efficient than fossil fuels (yes, it’s getting better everyday, that’s not the point). We are probably all going to be slightly worse off economically while we transition to green energy. But that doesn’t mean the transition is not worth doing to avoid all the long lasting, externalized negative side effects of fossil fuels.
Look, Shakespeare.
While I totally get wanting the option to opt-out of phone home, literally every enterprise hardware vendor has phone home and expects you to have it enabled if you want proactive support.

No, they don't. We work with some clients who are in a very similar area, on the development side. Anyone who thought this was a good idea would get bounced out of the room so fast their feet wouldn't touch the floor until they were in the corridor. It is absolutely not the norm to upload data from within the customer's network without their knowledge or consent.
I feel Apple is moving into somewhat dangerous territory. If the intent, as documented by internal messages and emails, is purely to protect the consumer by forcing people to use only public APIs, that's one thing.

But, if Apple is trying to apply anticompetitive behavior against certain technologies, if this rule is selectively enforced, if there is any bad smell or anything dirty about this process, then Apple is inviting antitrust scrutiny or new laws.

Apple had better make sure it is squeaky clean on this.
Maybe it would happen that way, but if it doesn't, it doesn't show you're safe.

Testing can only prove the presence of bugs, not their absence. Reading about other people getting hacked can warn you that you're vulnerable to the same bug, but if they didn't get hacked it doesn't prove anything.
I would argue that physicists themselves do not unlock this specific economic activity as they are rarely directly involved in crude extraction. As a field, it is too far removed. It would be like saying mathematicians are instrumental to crude extraction. Sure, they provide the scientific/theoretical basis for that work, but the actual execution is performed by engineers and various other applied experts.

Unlike what most people think, engineering is only partly based on physical/mathematical models. In fact, much of engineering is based on heuristics and empirical knowledge/know-how, and some of this knowledge isn't quantitative and it's not in the province of most physicists.

The difference between physics and engineering is actually quite vast.

I think the economic activity referred to in the article is around large-scale physics activities by organizations like CERN.
I don't know of any perfect examples, but the idea is one where once a version of a library is posted, that version can no longer be deleted or modified, only later versions added.

Legal and practical constraints would probably mean any real system would be at best an approximation of this ideal, but a big part of he leftpad problem is that NPM at the time didn't even try to approximate it (the response also underlined an NPM policy existing at the time that was useful in that context but dangerous in general, in that NPM generally allowed others to claim the name of abandoned projects.)
Does anyone use the Mac appstore?
I run my own dnsmasq server on an old laptop and force really long TTL caching regardless of what the records come back with. I even cache nxdomain. It works great, except once or twice a month I have to flush the cache because Slack seems to not handle it well.
This is probably a PR campaign by CERN, though. They're going through a rough patch after discovering little and needing new money for new experiments.

http://www.paulgraham.com/submarine.html
The market didn't always work that way. Until Google monopolized it, search engines and ad networks were independent pieces competing on an open market. For example, one of early Google's successes was getting Yahoo to license its search engine.
Judging by the history of a related issue on the Electron Github project [1], I suspect that Apple might have given the framework a two-month grace period starting in early September, and that just expired. Or the exception was supposed to be permanent, but something made it stop working.

[1]: https://github.com/electron/electron/issues/20027
Apple just rebuilds any popular app and makes it first party anyhow. At some point most developers will stop bothering just for that.
Or alternatively, they believe that it's in the collective best interest of the country and future generations to elect candidates who are proposing stronger regulation to address income equality, rather than candidates who propose that income equality either doesn't exist, doesn't matter, or will sort itself out without regulation.

Your phrasing suggests that you think someone like me who believes in the strong regulation approach is just "virtue signaling," but I would suggest that it's because I've looked back at the US in the last century and couldn't help but observe that there's a strong and consistent correlation between market regulation and the economic success of the lower-to-middle class. Income inequality dropped dramatically with the New Deal, the notional "American Dream" largely came about in the post-WWII economy -- and the move toward radical deregulation and trickle-down economics in the 1980s coincides with a sharp rise in income inequality, a concentration of wealth at the highest ends, and dramatic fraying of safety nets for the lowest ends. It is not unreasonable to look at all that and say, "Hey, maybe there was something to that whole 'market regulation' thing after all."
Of course the browser is capable of handling e2e encryption, I even built a chat that does that: https://safer.chat/
Wait. Does this mean Slack will be banned soon?
Or are they all using Electron 8?
People have to make decisions based on the most likely scenarios. Big companies can take advantage of the unlikely scenarios, for employees or for customers, because they average across large numbers of people. This is like a memory leak that defeats competition; it's not a flaw in the rationality of either party, but it is a real problem absent good regulation.
You are talking about trying to interpose in the passing of the fruits of one's labours over a lifetime to one's offspring. Trying to do the best for your offspring is a very deep drive and, while one can make perfectly good logical and cerebral arguments against inheritance at a societal level, you're going to run up against deep and very natural human (and animal) feelings.

You can ask people to transcend those, but don't be surprised when you find people object on an emotional level.

And the level of state ownership of the individual that such a tax implies is very uncomfortable too. I am happy to contribute to the state, but it neither owns me, nor is more important than my own family.
Cheap and powerful 'meth 2.0' is ravaging communities
How is it one sided. They are actively providing info on a third party website. Others can weigh in if they choose. That's up to them

Although they will probably choose to hack them instead
> But hey, if these garbage clientside filtering of image uploads is enough security theatre to keep governments satisfied, I say let them have it.

The thing to be wary of is that they may be intended to be useless. Their purpose is not to work, but to establish the precedent / principle that invasion of privacy is warranted / justified / accepted / needed. This then sets the stage for later saying "we now want to outlaw encryption completely because the previous methods that are already [accepted / justified / needed] are not working". So for the ultimate aims of their proponents, it's better if they don't work than if they do.

If you want to see it in action you can look to Australia where it is exactly this argument being employed: ie - police have always had surveillence capability for telephone calls, so new powers that inject interception capability into the OS layer of phones are just re-establishing something already accepted, not introducing something new.
Even that's low. Here's my result of running pmap on an open vscode process.
"total 1046516K"

Yikes.
Email may be a particularly poor example.

Any half-serious operation would likely just order a custom encryption app, anonymously, paid for by monero, or something.

What really is important is reliability. An open source app, checked by experts, buildable from scratch in a controlled environment, is much less likely to have a bug planted by a three-letter agency.

So yes, good and widespread end-to-end encryption is a large nuisance for said agencies, even if a successful ban on it does not prevent criminals from encrypted communication in principle.
> It sounds like Chromium, and hence Electron have had references to some private APIs for a while

I wonder if it has been that way in Chromium since Blink was WebKit and maintained largely by Apple with priority on performance on Apple platforms.
You can create a view with a subset of columns and grant permissions on the view.
"It is almost useless feature that is suited only for fingerprinting."

And games.
It's a great anecdote, but it's hard for me to read that and not immediately think "then explain Andrew Lloyd Webber, please."
That's easy. Trust no one.

Rent a cheap VPS and install a VPN server with e.g. Wireguard yourself. This one line installer also exist for OpenVPN:

https://github.com/l-n-s/wireguard-install

Also don't forget firewall rules and automatic security updates in your VPS.
Boilerplate for Vue with Webpack
Huh? The problem isn't that the developer itself is trying to cover his misbehavior, but the fact that the developer can get banned for something out of his control.
> then tries to hide their use of private APIs rather than stop using them [...] Resubmitting the same thing and hoping that it doesn't get caught the next time isn't an honest mistake.

This is missing the point of the post you are replying to. Say you identify five closed API dependencies and remove them. Do you resubmit? If you missed any others, you and all your apps might be banned.
"use or conceal"

"use"

If this was "don't conceal or we'll ban you for life", it would be somewhat understandable.

But it's "use or we'll ban you for life" which is just insane. Apple is at the height of their arrogance towards developers.
I'm still lurking in there from time to time!
If you can get it without too much trouble I'm sure there are a few people out there who will appreciate it!
If Apple doesn’t want third party apps calling private APIs why don’t they simply run third party apps in a sandbox that doesn’t have them exposed?
Why? It’s very clear what’s wrong. Don’t use private APIs.

Thank you Apple for keeping things clean!!
Thanks! The bigger ones can take months - add a little bit every day.
Because Electron developers might say "we fixed it" and the app developer might resubmit based on that and now they're banned due to a mistake made by an upstream dependency.

It's not like this app developer is intentionally using private APIs. "Resubmitting the same thing and hoping that it doesn't get caught" seems to be a strawman.
Good. It’s time app developers began to treat Electron like the Goliath of a dependency that it is rather than a cost-free shortcut to launching a cross-platform GUI product.

It’s no different than any other library or toolkit you would link against normally. You wouldn’t be hearing these complaints from a “native” app developer that intentionally picked any other library or runtime that (ab)used private frameworks.
The idea that the (whole economy) = (physics + retail + financials + other stuff) seems like somebody made a type error. You can't just add a research field to industries. I guess you could draw out 2 separate pies: 1 of GDP by industry and 1 by "field" but you're still comparing apples to oranges.
But directly equating Russian oligarchs to American businessmen makes for a better headline, so ¯\_(ツ)_/¯

But in all seriousness, I'm glad that someone was here in the comments section to break down the nuances of this rather contentious analogy. So TY
I think it’s a bold claim because although nobody is saying john d rockafeller broke into a bank and stole money, he has certainly been accused of corrupt (illegal) business practices.

But if we set illegal business practices aside, I still think it’s bold to say the massively wealthy industrialists didn’t do anything wrong because of the case i made in my comment (in short: the inherent immorality of large wealth accumulation).

> By and large they became wealthy because they provided an incredibly valuable new service that catalyzed vast amounts of new economic activity.

What was the new and valuable service consolidating the US oil industry provided? There were oil companies, that was already happening... what value was added by rolling it all into one ball? If you believe in capitalism you would agree that competition is good for an industry, so how is the thing that made rockafeller so rich (consolidation) good for anyone but him?

And i already believe that a lot of what has happened in the last 10-15 years of the internet age is actively bad for our society, no central planning needed - just open eyes.
How is it going to make customers unhappy if your app isn't using the features?

Apple is within their rights here, but please, let's not pretend this is about user experience.

It's about the Apple machine doing what it wants, and rolling over who it wants, because it can.

That would explain why Apple developer relations (read: humans) had previously backpedalled after the same rejection in the past:

https://github.com/electron/electron/issues/20027

Most likely these rejections were not intentionally resumed, but because the machine that is app stores these days is completely non-deterministic, this could still be a big problem.

This time the wrong developer could reach out to the wrong channel and trip some sort of trap that turns this into a "known issue: won't fix + always send automated reply", instead of someone with the right connections getting to the right person and having them go and flip a switch that fixes everything with their pinky finger.
Then you're an exceptional person among exceptional people. While it's a no-brainer that tech tools bring us utility, there is a nontrivial time, thought, and effort cost to engaging with nearly any tool. Sometimes that cost outweighs the advantage of the tool or feeds behaviors that are counterproductive. A great example of this. The younger half of my ad agency is on Slack. The older half tried it but it just wouldn't take. The young people are productive together, but their habitual Slacking becomes a distraction when they have teams with more seniors than juniors. The tool unintentionally created a divide. Every solution has costs and benefits like anything else. Iatrogenesis. I've definitely seen offices get so overtooled that they resemble what the above person was saying.
What if you just use a remote device and change it each time (eg. get a VPS)? If someone really doesn't want to get detected, they will always find ways around it. It's a never-ending race.
Presumably you can't check for violation yourself without submitting.
Why is there beside civil and military? I thought the two terms were antonyms so isn't that everything, by definition?
> Could a usb floppy drive work?

I don't have one. What kind of device interface do USB floppy drives use, and does Windows XP have drivers? I highly doubt it (edit: others have pointed out that they use USB-FDD mode and is supported by Windows XP, so yes.).

The reason I don't have one is that although I have floppy drives, but I cannot find a single working blank floppy anymore... A floppy emulator that uses an SD card and the identical floppy interface should have better compatibility (but without the convenience of Plug & Play like USB), and you don't have to find a source of working floppy.
It delayed nuclear proliferation without harming a single soldier or civilian. If that’s an act of war, then I guess I’m a war monger.
Very true, looks to be hosted out of Europe. The point about 00f.net optimizing for ease of operation vs optimizing milliseconds of performance only holds doubly true with this information though.