skysight-inc/HackerNews huggingface dataset:
Sqreen | Java agent software engineer | Paris | Full-Time | Remote (Paris timezone) |

Sqreen | Backend engineer | Paris | Full-Time | Onsite |

Sqreen | Cross agent engineer | Paris | Full-Time | Onsite |

Sqreen (YC W18) is an application security platform made for both engineering and security teams. We use dynamic instrumentation libraries that monitor web applications internals to detect security anomalies and block triggered vulnerabilities at runtime. Pretty much what an Application Performance Management tool (like New Relic) is doing, but for security.

We are currently looking for Java agent engineers (e.g. you need to love byte code instrumentation [1]) and C/C++ [3] [4] [5] (remote anywhere in European timezone) to help us expand the capability of our agents, as well as a senior level Backend developer (knowledgeable or willing to learn Python) to build new functionality on our backend (based in our Paris HQ).

Also, we're looking to hire a Cross Agent Engineer in Paris too!

You can find more details on our careers site [5]

[1] [https://blog.sqreen.com/building-a-dynamic-instrumentation-a...

[2] [https://blog.sqreen.com/how-to-build-a-waf-at-the-applicatio...

[3] [https://blog.sqreen.com/how-we-built-v8-natively-on-arm/](ht...

[4] [https://blog.sqreen.com/building-a-native-add-on-for-node-js...

[5] [https://www.sqreen.com/company#jobs](https://www.sqreen.com/...
Whenever this comes up it makes me think of William Gibson’s Neuromancer.

There’s a flashback description of the main character’s revulsion with a smashed wasp’s nest.

That was written in 1984ish so this has been around for longer than the web anyway.
There are probably several open-source projects that you can download today that include unknown malicious code. But they will be discovered eventually. Proprietary software, on the other hand, can keep malicious code during their entire life of relevancy. And in fact, it's rare for proprietary software to not have malicious code these days, with personal data being sent to servers, ads being delivered, and installers bundling third party products and plugins.
We have the other issue in Germany on ebay kleinanzeigen (Germany's version of Gumtree / Craigslist) where sellers will expect prices on used goods comparable to buying them new.
Sundar lacks that maverick charm that founders of legendary company usually have.

He feels ... reserved and safe.

Maybe that is what Google needs at this moment
Mozilla Removes All Avast Firefox Extensions
I am curious how, without actually invoking the function, lambda knows when your application has been initialized.
Does it just run your application for a few seconds and then freeze it? Or does it not even run the application code, merely ensure the virtual machine is loaded into memory ready to be run?
It seems a periodic warmer invocation at least has the advantage of ensuring your app is fully initialized and ready to respond to requests.
Which whistle blowers did Trump go after? The term is loaded, it implies a level of neutrality that we don't know exists in the impeachment case - we could just as well cause the official an "accuser".
Speedreading is something used by delusional people who think that reading is just inputting words as fast as possible. Slowreading (taking your time to fully understand and reflect on what you read) needs to become a thing. But that isn't as ~distinguished~ as saying "I can read at X words/min" or "I read Y novels/year".

Skimming is useful, because you don't necessarily want to read an entire page if you're looking for one thing. Wikipedia pages are an example of where you might want to skim until you find the relevant section you're looking for.

In fact I skim many articles on HN to decide if they're worth reading or not. If they are, then I go back and slowread the entire thing before making a comment.
Just use the c2rust[1] tool to "extend" C.

[1] https://github.com/immunant/c2rust
It's not perfect, but you can tag and track some amount of egress charges now.
Show HN: at16k - Library and trained models for automatic speech recognition
“Not coal”

Natural gas is not coal. It’s cheap and much cleaner.
How Much Do You Need to Retire at Age 30 – Based on Simulations
My favorite PL/I trick from the punch card days. It takes two cards:

DEBUG = 0; /*/ ;1 = GUBED
*/

Reverse the card to turn on the debug switch. Not invented by me, I forget who showed me that. A professor I had as an undergrad, I think.
at16k is a Python library to perform automatic speech recognition or speech to text conversion. The goal of this project is to provide the community with a production quality speech-to-text library.
Who is bean?
If you're used to launching everything from your OS's command prompt, this is a killer. But if you get used to launching a REPL and running things from there, it's much better, because you only pay the startup latency once.
I think that was the other way around.
The idea would be that the support ticket with namecheap should be enough. Though I doubt it would be, for the average person.
According to the first reply this is an investigation into Trump, not by Trump.

https://twitter.com/greekemmy/status/1201766690918408193
The worst recession in three generations saw WMF donations increase by >50% year-over-year in every single year.
The most plausible (and least palatable) path seems to be offering them trillions of dollars in subsidies for alternatives.
I get the python3-dateutil because you might think it's an updated version of the standard library.

But how does jellyfish with a different char for L work? Someone would need to copy and paste it.
But if they go to pypi, it won't have many installs.

Unless they started writing tutorials with:

"okay now just pip install X"
Saying "they fully respect their users privacy" is also blunt and not nuanced.

They are a huge company with thousands of teams pursuing their own agendas and made up of people of varying degree of scruples and viewpoints with regards to privacy.

I've worked for large companies that handle sensitive user data, and they all have at least some teams of people trying to figure out how they can respect the letter of privacy laws just enough, while ignoring the spirit of those laws, in order to profit from the personal data they hold, regardless of the potential side effects or long-term impact on the data subject.

Google is probably no different.
What's the best information source for me to follow to keep up to date on these kinds of library vulnerabilities?
I would make a feed of the homepages for all the libraries I know I use, but that won't help me with the libraries I use without knowing.
These two have been caught. How many haven't yet been caught?

Traditional Unix file permissions are pretty much a joke for the way developer computers get used (one user - does everything). Real process sandboxing is needed.
When I faced a global warming threat playing Civ2 because my neighbours were not cleaning up pollution, I just bombed them into oblivion, then moved in my settlers and cleaned up the debris.
Thanks! looks like it was a screwup by the ycombinator.com software. The original link ends with a period, and the software stripped it out -- probably because adding a period after a link that is at the end of a sentence is a common error.

I replaced it with another page on Wikipedia that redirects to the "User:Guy Macon/Yes. We are biased." page.

Full disclosure: I am the author of the Wikipedia essay "Wikipedia has cancer".

See https://news.ycombinator.com/reply?id=21700802 and https://en.wikipedia.org/wiki/User:Guy_Macon/Wikipedia_has_C...
Not you, the person in the article. It just seems comical that they'd intentionally go out of their way to torrent IP then turn it over to Google.
Debugging a memory issue in Docker – oomkiller in action
That sounds like a very poor business model - they can and do that for free already. Publicists have been caught making spin edits numerous times already.
Until fairly recently (historically), books were overwhelmingly scarce. A few datapoints:

- The total number of books -- not titles, but actual bound volumes -- in Europe as of 1500 CE, was about 50,000. By 1800, the total was just under one billion.

- The library of the University of Paris circa 1000 CE comprised about 2,000 volumes. It was among the largest in Europe.

- The Library of Constantinople in the 5th century had 120,000 volumes, the largest in Europe at the time.

- A fair-sized city public library today has on the order of 300,000 volumes. A large university library generally a millon or so. The Harvard Library contains 20 million volumes. The University of California collection, across all ten campuses, totals more than 34 million volumes.

- The total surviving corpus of Greek literature is a few hundred titles. I believe many of those were only preserved through Arabic scholars, some possibly in Arabic translation, not the original greek.

- There's an online collection of cuneiform tablets. These generally correspond to a written page (or less) of text, with the largest collections numbering in the tens of thousands of items.

- As of about 1800, the library of the British Museum (now the British Library) had 50,000 volumes. Again, among the largest of its time.

- From roughly 1950 - 2000, roughly 300,000 titles were published annually in the United States and/or English-language editions. R.R. Bowker issues ISBNs and tracks this. From ~2005 onward, "nontraditional" books (self- / vanity-published) have been about or above 1 million annually.

- The US Library of Congress, the largest contemporary library in the world, holds 24 million books in its main collection (another 16 million in large type), and has 126 million catalogued items in total (2015).

- At about 5 MB per book, in PDF form, total storage for the 38 million volumes of the Library of Congress would be slightly under 200 TB. At about $50/TB, that's $10,000 of raw disk storage. (Actual provisioning costs would be higher.) Costs are falling at 15%/year.

- Total data in the world comprises far more than books, and has been doubling about every 2 years. Or stated inversely: half of all the recorded information of humankind was created in the past two years.

Sources:

Some of this is off the top of my head, but partial support for the facts from:

https://en.wikipedia.org/wiki/History_of_printing#/media/Fil...

https://en.wikipedia.org/wiki/History_of_libraries

http://www.bowker.com/tools-resources/Bowker-Data.html

https://www.loc.gov/item/prn-16-023/the-library-of-congress-...

https://en.wikipedia.org/wiki/Harvard_Library

https://en.wikipedia.org/wiki/University_of_California_Libra...

https://www.techpowerup.com/249972/ssds-are-cheaper-than-eve...

https://qz.com/472292/data-is-expected-to-double-every-two-y...
Here's what Wikipedia actually says about Level 5:

> under all roadway and environmental conditions that can be managed by a human driver

There is no autonomous vehicle deployed today that is true to that statement.

https://en.wikipedia.org/wiki/Self-driving_car#Classificatio...

> Equally Musk wasn't saying we would have level 5 driving capability in all situations by 2020, he was just taking about highway cruising.

Actually he specifically said that by this time the car would be able to do a cross U.S trip autonomously, which I hope you understand consists of more than just highway driving.

As far as the T-Pod driverless truck thing you linked:

> An operator, sitting miles away, can supervise and control up to 10 vehicles at once. The T-Pod has permission to make short trips - between a warehouse and a terminal - on a public road in an industrial area in Jonkoping, central Sweden, at up to 5 km/hr, documents from the transport authority show.

A remotely supervised truck permitted to travel at 3 mph in a highly controlled and scripted path - warehouse to terminal - is hardly what anyone thinks of or means when we talk about autonomous vehicles.
Actual dates instead of relative dates
Actual dates are much more useful to me than relative dates. "7 months ago" is NOT useful from some random future date. Why does anyone want this? I don't find any advantage to it whatsoever.
Nice, I see we're entering the new era of us surveillance. This guy was a public figure who associated with a party under investigation, he was not directly involved. In other words, a judge issued a gag order and a data handoff request on a private citizen to Google without probable cause. How could this be anything other than a fishing expedition?
And you can assume that no security issues have entered python no matter which version? People use the OS version for security audit reasons.
What does that have to do with sharing knowledge in the USSR and the countries in the Soviet block?

It was never in Soviet ideology to hide knowledge behind paywalls. See, for example, this [0] post about Mir publishing house and warm comments of Indians who grew up with their books. Sci-hub's ideology is just continuation of this approach.

[0] https://news.ycombinator.com/item?id=21352277
What is trusted then, the Anaconda base repo?
> The fact that the MTA became unreachable via the domain name did mean that some emails sent to it must have bounced back.

MTAs should queue undeliverable addresses for more than four days, so you may not miss much unless someone’s DNS resolver had a poor caching strategy or Shadowserver used a long TTL. At least the name still resolved (else the mail would have been dropped immediately). Some mass mail senders may go to less effort to get their messages through.

The fact that people responded so “quickly” helped here. I put “quickly” in quotes as it was quick enough to possibly cause no message to be lost — I’m sure it was super stressful and didn’t feel quick at all!

Glad you got your name back.
Maybe they did it because Windows was backwards and used UCS-2, and later, UTF-16? If somehow, Windows managed to switch to UTF-8, I’m sure they (Microsoft) would mess it up and keep the 4 byte limit (imposed by Unicode) there even if it’s later removed (for backwards compatibility). What Microsoft really needs to do, IMO, is rewrite the Windows API to use UTF-8 or UTF-32. Make a `wwchar` type or something...
Careerist people like career progression. I think that's largely orthogonal to smarts or lack thereof.

I doubt Einstein cared very much what was on his business card. Patrick Bateman certainly did.
My go to weather app, along with Dark Sky. Can't say enough good things about it. Constantly updated with new, useful features.

There's something to be said for a software company not taking a ton of VC money, hiring hundreds of people, and shutting down in 3-4 years. From the last photo they have a ~10 person team.
I like the general idea, but the result seems just as full of garbage as C++. Remember the first time you saw a lambda declaration in C++? That sequence of familiar-seeming characters to mean something totally different probably threw you a bit. I know it did me. C-for-all's constructor/destructor syntax reminds me of that.

// bonus doc bug: "with" hasn't been introduced yet
void ^?{}( VLA & vla ) with ( vla ) { // destructor

The syntax for redefining ++ or -- (which already seems spurious) is even more opaque.

S & ?+=?( S & op, one_t )

Other features, like left-to-right declaration syntax and postfix function calls, seem to have no use except to make one programmer's code harder for another programmer to understand. Then they throw in the rest of the kitchen sink, with all of C++'s overloading and polymorphism and inheritance plus both kinds and traits. The result is even more complex and even more surprising (in a bad way) to actual C programmers than C++ or for that matter APL. If not for the absence of templates, I'd say Cforall's complexity is a strict superset of C++'s.

If I wanted a direct C replacement with minimal improvements, I'd try D or Zig. If I wanted a systems programming language that had more differences but fewer surprises, Rust or Nim. The last thing I'd want is something that's both more baroque (rococo?) and less known than any of those.
If a country funds a bunch of script kiddies to attack something somewhere does that make the attack a state action? If the state takes measures to conceal the source of that funding then is it still a state action? If a group of script kiddies takes action due to a general suggestion from a state actor? If a group of script kiddies with political aims congruent with one or more state actors takes action all on their own?

This stuff is fundamentally different than the case where a group of people end up with guns and engage in politically motivated violence. It is really a form of advanced trolling. The fact that absolutely anyone can do with with no fear for their life or freedom makes it politically meaningless.

There is no such thing as cyberwar...

So insurance is really just about insuring against security lapses. It should be priced appropriately and should come with requirements.
Anyone here not encrypting their private keys?

Also known_hosts file is a double edged sword. It's pretty sensitive in combination with a private key.
Pathways to independence: towards producing and using trustworthy evidence
It turns out that the ycombinator.com software won't accept a link that ends with a dot.

This works:

https://en.wikipedia.org/w/index.php?title=Wikipedia:YWAB
Or, not exactly unheard of, they aim at finding a buyer for themselves well before a time when it may become clear whether the product would really be viable or not. In those cases the product is the company itself and they don't need to have a finalized working and useful real product. Works especially well in "hype" topics where hope can more easily win against common sense (of the buyer).
IANAL

For a salaried employee, you have earned your pay per period by having done 1 minute of work. Some places define a period as a day or a week. Fun fact for most places in California: get fired in a Monday and you are entitled to the full week of pay.
My point is that using "a cloud" doesn't change your level of infrastructure experience/knowledge needs, it just changes what they need to know.

It very much does change what they need to know. You don’t need to know how to set up a database with multi region failover, load balancers, server maintenance, switches, routers, storage, firewalls, etc. Have you ever used managed services at any scale?

Yes I’ve done both - hosted our own servers in house.
And when they're old enough, those trees die, and does not consume co2 anymore.

I think the point is that a forest reaches an equilibrium at some point.

The forest has new trees growning and consuming co2, it has old trees still growing and consuming co2, it has dead trees/branches that releases co2. It's mostly at a steady state when it has matured.

Still, if you planted that forest at a place where there was no forest, the co2 it has bound up in the trunks and roots is removed from the atmosphere as long as the forest stands. Which might be tens or hundreds of thousands of years.
"3 things: vocal & active supporter of WL & Assange for 10yrs, was in a twitter DM group that incl
@wikileaks, visited assange several times at the embassy"

https://twitter.com/SomersetBean/status/1201620076383940610
Public Response to Everspin's Warning Letter
The main problem small and medium businesses face is that a manual penetration testing procedure is too expensive for them to afford and it's a time-consuming procedure. Plus, new security vulnerabilities are being discovered daily and there is a need to be constantly testing your web applications to remain safe. So, manual penetration testing isn't the right solution for a constantly changing security landscape.

Automating web application security can be a huge lifesaver, saving you money and time in the long run. Our developer-friendly options make testing easy. The detailed test reports with proper mitigation techniques help you to accelerate the remediation process and stay secure from the latest security threats.
"Good news! We found out how to have far greater control of the environment. This will allow us to fix the environment we already had control of and completely ruined!"

They have a point I think.
I don't know what the solution is but it feels like this is a much bigger issue and we need some rethinking of how OSes work by default. Apple has taken some steps it seems the last 2 MacOS updates where they block access to certain folders for lots of executables until the user specifically gives that permission. Unfortunately for things like python the permission is granted to the Terminal app so once given, all programs running under the terminal inherit the permissions.

Microsoft has started adding short life VMs. No idea if that's good. Both MS and Apple offer their App stores with more locked down experiences though I'm sad they conflate app security and app markets.

Basically anytime I run any software, everytime I run "make" or "npm install" or "pip install" or download a game on Steam etc I'm having to trust 1000s of strangers they aren't downloading my keys, my photos, my docs, etc...

I think you should be in control of your machine but IMO it's time to default to locked down instead of defaulting to open.
What I find interesting here is the interplay and mix between private, public, and governmental concerns.

In the physical space, in the states you're free to walk out into the public park, put on a hat saying something atrocious like "I hate cats!" and peacefully petition your fellow citizens to destroy all cats or something silly.

When we moved to printed distribution, there was still a clear bit of guidance; as long as you weren't directing people towards violence, you were good. Most newspapers were locally owned and would even be happy to print your letter to the editor about cats.

But now? We've got a foundation doing something like a regex match on domain names, we've got a criminal element hijacking computers, we've got various government-condoned organizations for managing tlds, we've got registrars. All of these are different types of organizations working in different countries and established for vastly different reasons.

I am reminded of two things. First, Thomas Paine made the point that it was better to live under a dictator than a complex system that hurt you. Under a dictator, you had a guy to point to when things went wrong. It was them! They are responsible for this awful thing! Under a complex system? There's nobody. Bad things just happen, and when you try to ask about it, each party can explain to you that they were working for good reasons to the best of their ability. There was a problem, but no reasonable way to discuss, diagnose, or propose fixes to it.

The second thing was a story from the 80s about a U.S. official, Raymond Donovan. He served fairly well in public office but was accused of some serious crimes. He was destroyed in the media. Then they found out he was innocent. He asked a famous question "Which office do I go to to get my reputation back?"

I'm extremely happy this was resolved, but good grief, if I didn't know anything about the net, and my domain had just been set up instead of being in my control for 12 years, which office would I go to to get my domain back?

Either we own things or we don't. If every bit of our participation online is owned by somebody else, this should be a lot bigger deal than it is currently.
Have you tried BR(battle royale) games? PUBG gets my heart racing too much. I also like that it mixes you in with both pros and amateurs. Not knowing the skill level of the player you are exchanging shots with keeps everyone on their A game.
Then why bother making these strings superficially compatible with C strings? Just printf or am I missing something?