skysight-inc/HackerNews huggingface dataset:
Driving at all carries risk. Are all drivers dispicable? At what level of preperation and care does it change?
A few days ago I had a rideshare driver unable to find me because Google kept telling him to take a non-existent road through the middle of a building.
Online Shopping Is Growing, but Isn’t Creating Jobs
The disaster zone that's Python packaging aside,
this has to be called out since it's a gaping security hole:

curl -L dephell.org/install | python3

* Trying 185.154.12.127:80...

* TCP_NODELAY set

* Connected to dephell.org (185.154.12.127) port 80 (#0)

> GET / HTTP/1.1

> Host: dephell.org

> User-Agent: curl/7.65.1

> Accept: /

> Referer:

>

* Mark bundle as not supporting multiuse

< HTTP/1.1 301 Moved Permanently
A new cycle-stepped 6502 CPU emulator
You must be joking. A good Rails dev will run absolute rings around any java or .NET effort no matter what tools they're using. I don't even think I'm being subjective here; I work with java (well, kotlin/scala) devs and even they wouldn't say anything like that.

Rails has disadvantages yes, concurrency and its lack of ability to support long-running tasks foremost amongst them, IMO. But dev speed, for standard "startup web app" features? There is no contest and I'm baffled as to why you would claim otherwise.
I tried that one, but it doesn't work when there is another policy that says you are only allowed one password change per day.
> the information encoded was all strangely specific academic stuff - like very fine classifications and relationships between species of tapeworms and of fungus.

Even Wikidata mostly looks like that, despite being intended quite clearly as a "general purpose" knowledge base. Mostly because this sort of information is easily extracted from existing, referenced sources. The "general purpose" character of it all comes into play wrt. linking across those specialized domains.
...which stores passwords in unencrypted plain text.

(Admittedly, the database is behind a very strong network firewall.)
There was an entertaining tale about this in Henry Marsh's Do No Harm: Stories of Life, Death and Brain Surgery (he's a very significant figure in brain surgery in the UK).

There's a lot to it, but it came down to running around the hospital getting mad with the new digital system for looking at X-ray pictures rather than having them in physical format. Given one of the admin's passwords to try (it was something quite rude like "fuckoff"), he still couldn't make it work, and was advised that they were forced to change passwords every 30 days and to try "fuckoff2". It turned out the actual password was something like "fuckoff4" due to the time that had passed since the password had been shared around the department.

Edit: Found another recollection of the tale here: https://www.theguardian.com/books/2014/mar/30/do-no-harm-sto...
How many paragraphs, but no mention of the agar on which this is all growing - the incompetents connecting all of this Swiss cheese to the Internet in the first place. It's like if there were a spate of car break ins because everyone in a neighborhood got complacent with leaving electronics on their passenger seats. But then rather than the police cautioning people to tidy up, they branded the trend "autowar" while seeking federal assistance for their novel problem.

The Internet, by its very foundation, has always been best regarded as an environment of hostile noise. Creating direct communication between people in different countries fosters mutual understanding and peace, but requires a reliance on technical laws to cross jurisdictions. The people beating these "drums" are simply looking to avoid that technical responsibility by imposing their jurisdiction onto everyone else. These are ultimately the same destructive warmongers that have traditionally plagued humanity, setting their sights on subjugating the latest frontier.
>They've had a good run.

You say that but... what is an alternative? I literally don't know where to go.

Like sports?
/r/nfl
/r/nba
/r/insertsporthere

Like vr?
/r/oculus
/r/vive
/r/insertothervrhere

And then just all the random stuff that is somewhat interesting...

I have such a love/hate relationship with reddit but I don't see any alternative.. especially if you like to actually discuss about topics.
This gets repeated ad-nasuem, but it does not, even when squinting at a distance, resemble a honda. Poetic licence at best.
Donating money is almost always more valuable than donating time, especially if you're not going to donate a lot of time. The time may feel better (or it may not -- I've had volunteer gigs where I didn't feel I could accomplish much, and that sucks), but the money is more useful.
> It records a short video of you and then transforms that raw video data into an array of 8-bit unsigned integers. Then it randomly selects an integer from that array and transforms it into its corresponding UTF-16 character. If that character is a lowercase letter, uppercase letter, digit or special character it will be used for your password.

This is an interesting idea but have you conducted any entropy tests by generating a class of passwords from a family of videos and seeing how different they really are (e.g. character freq)? Without any hard numbers I can pretty confidently assume that the colors (8 bit unsigned perhaps mean R, G, and B pixel values) in a video are not uniformly/randomly distributed in the color space and subsequent frames of the video are also highly correlated. Not to mention you specifically throw away any non ascii character so a large portion of the UTF-16 space is not even allowed). Unless by chance, those you throw away happen to also be the super common int values, I feel that it's likely the entropy of these passwords is going to be surprisingly low.

What do you think? The entropy test would make a great blog post.
Either you are into it, and you know, or the need to create a VM has just arose and you want to quickly do it. In the later case from my Fedora 31 system I search for "Vir"(tual), it tells me about "Boxes", I open it... and it can't be simpler. I end up with a Virtual machine with QEmu/KVM without ever having to know what QEmu/KVM is, as far as random user knows "yesterday I had problems with VirtualBox kernel modules, so I created a VM with Boxes".
They are an abomination. Many people in the daily meetings make up issues that are non-issues that are just part of normal daily activities. And then there are the ones that whine daily about trivial matters that shouldn't even be discussed in these groups. Then there are the dead horse beaters that can never talk enough about issues that have long been solved, just to kill time. I could go on, but then it would seem like I'm in a daily stand-up.
Does anyone know if the situation with using `poetry` with `pyenv` has gotten any better? I like poetry's approach, but I had a very difficult time getting it to play nice with my system last time I tried.
On this line, shoutout to Vultr for their support. Just today I opened a ticket with a relatively simple technical issue. I got a reply in 5 minutes ... yes 5 minutes, I couldn't believe it. My business with them so far is worth about 2 dollars, they will get many more from me, for sure!
There's significant correlation between adjacent pixels in a natural image and between corresponding pixels in consecutive frames. Using the least significant bits of the raw pixel data is a reasonable source of entropy, but using entire pixels and just concatenating them is probably far less entropy than the length of the generated password would suggest.
If you like Ptacek, read this: https://latacora.micro.blog/2019/07/24/how-not-to.html

But more importantly, why do you need stateless auth tokens?
Frankly, I just went back to sessions.

Everyone thinks they're building the next Facebook, but most of us aren't gonna stress out even a single Redis instance.
They can they just have to wait.

At my previous role I added a number and kept increasing until it accepted the orginal password and I started the cycle again.
I'd like to think they're just engaging in internal sabotage as a form of activism, like the OSS field manual for disrupting organizations suggests:

https://corporate-rebels.com/cia-field-manual/

Seems to have this effect anyway, and I support the google workers trying to destroy this evil company.
My organisation has disabled built in password managers in both Firefox (semi understandable) and chrome and I assume edge. So there is that.

I can however install any Firefox extensions I chose. Enterprise architect is not security vetted. But archimate is.

Some of this is hard. A lot is theater.
I thought he was apologizing for his use of personal attacks, profanity, insults, and generally what he describes as a lack of empathy. Things like that. His hardliner attitude hasn't changed.
Nobody is in the right business. There arent exactly lines to become shuttle drivers for dismissive people who assume malice when the damn machine is a POS.
> is serviced by an army of workers that wear special uniforms, are not included in the major perks

Isn't this about government (IRS et al.) categorization of contractors vs. employees and not about GOOG specifically? IIRC there is a specific reason contractors cannot receive employee perks or even participate in team morale events.
The the following utterance, sort of looks like the triplet data structure used in graph/knowledge databases:

"Alive loves Bob"

What do you know? Nothing. Was it Alice who said she loves Bob, or was it Bob who said it is Alice who loves him, maybe Carol saw the way Alice looks at Bob and then conclude she must love him. What is love anyway? How exactly is the love Alice has for Bob quantitively different than my love of chocolate. It might register similar brain activity in a MRI scan, and yet we humans recognise them as qualitatively different.

A knowledge base is useless if you can't judge wether a fact is true or false. The response to this problem was for the semantic web community to introduce a provenance ontology, but any attempt to reason over statements about statements seem to go nowhere. IMHO you can't solve the problem of AGI without also having a way for a rational agent to embody its thoughts in the physical world.
there's a lot of evils about AWS, but even their personal/developer support account has delivered good service for me -- they've really dug in and helped me on some tough questions, and not only limited to configuration.

At the office, we have AWS business level support, which has been really excellent for troubleshooting.
If I had a good reason to memorize this, I would have it down within a couple weeks. I'm pretty certain of this, as I do have private keys committed to memory. That's not even impressive, folks who have good memory palace practices could recite that string for you a few minutes after seeing it. I wouldn't expect it of the average user, but it is totally doable for a human of average intelligence -- it's just not something people care about. For long term storage (rather than a repeatedly entered password) it's even easier if you convert[0] it to an equally random yet more humanly memorable line of text: "duck fade ink love reality possible shown screw thing win invisible realize child suffocate somehow petal army nervous"

[0]: https://brainwalletx.github.io/#converter
Climate change has made the world's deadliest lake way more dangerous
Plaintext storage of PII data should be punishable with prison. Time to stop ducking and dodging in terms of responsibility.
Ya they should spend more money and hire multiple consultants and have fight it out then implement some of their ideas.
Oh, just realized that pip-tools (being discussed favorably downthread as a pipenv alternative) is a Jazzband member project: https://github.com/jazzband/pip-tools.
No doubt, feature detection is much better. There are a few things that needs to be on the header-level, like compression standards and encoding, but the less data is attached to a request by default, the better.
Your argument was like this

We know that both airlines are bad so this implies the airplane has no fault.

First of all even if the pilot crashed the plane ntentionally this does not invalidate the reality:

- MCAS was hidden and pilots were not trained because of economic reasons.

- MCAS had too much autority then the regulation allowed , so basically this is a black and white situation no shifting the blame on a third-world country company

- after the first crash and even after the second crash Boeing failed to consider the safety of people and ground the planes until the MCAS is fixed or pilots were trained.

- the MAX can enter in a state where you don't have enough power to control, the warning messages were a paid DLC and there was no training on how to handle this cases.

Even if you did not intended your comment is sounding racist, those poor country companies used the plane wrong.

Maybe you can argue that Boeing has less then 100% blame but it is a lot more then 50%. If you care that much about this topic please put a reminder in your calendar and get back to me when the investigations are over and MAX is back in the air and tell me "I told you so"
No, but hard to beat Classic ASP for simple web apps. I wrote a BASIC interpreter with built-in SQL that was very useful for scripting.
>Individual employees shouldn't have to make personal sacrifices, especially for a megacorp

You'll never get enough credit for that line.

To me, this is the biggest flaw with the computer science/programmer/IT community. They stand high and mighty against your average religious follower, of any faith. But in turn, they go to their knees and pray to the "tech gods". Both the billionaires behind them and the companies themselves. It's still religion if you think someone or something can do no wrong, in spite of what evidence shows.

I remember these discussions of the potential abuse of power and economic might of today's large tech companies was in discussion in the mid 2000s. All of them were considered, tin foil hat conspiracy theorists and curmudgeons. I think "ok boomer" would have been said about them. I think Disney was the only real surprise. The rest, well, we were all warned. Hell, I only really started believing it in the early 2010s.

But whatever, progress over people. We all must be civilized by technology, whether we like it or not. Those at Silicon Valley know best. We must always submit to the higher ups when it comes to our diets, lifestyles and where we live.
Thousands of Facebook employees had personal banking information stolen
Time to go back to the source? Something Awful?
One of our primary test suites is what we call "Common Sense Tests". They comprise a set of common-sense questions that require some leaps of reasoning to answer, and we use them as a metric of our common-sense knowledge. So for example:

Would a human dislike touching a/an incandescent bulb while the electric lamp is powered on?

Yes.

?HUMAN dislikes being a performer in the ?TOUCHING.
• Embodied agents dislike performing acts that cause them discomfort.
• ?HUMAN is an embodied perceptual agent.
• ?HUMAN is a human.
• Every human is an embodied perceptual agent.
• ?HUMAN deliberately performed ?TOUCHING.
• ?TOUCHING causes some discomfort.
• Touching something that is too hot to touch causes pain.
• The quantity range pain includes all points in some discomfort.
• ?PART is too hot to touch.
• When an incandescent bulb is on, it is too hot to touch.
• ?PART is an incandescent bulb.
• ?PART’s current state is powered on.
• When a lamp with a bulb is on, so is the bulb.
• ?PART is a physical part of ?DEVICE.
• ?PART is a physical part of ?DEVICE.
• ?PART is a physical part of ?PART.
• ?DEVICE’s current state is powered on.
• ?PART is a light bulb.
• ?PART is an incandescent bulb.
• Every incandescent bulb is a light bulb.
• ?DEVICE is an electric lamp.
• ?PART was affected during ?TOUCHING.

We have a couple thousand of these, which we've aimed to make as diverse as possible
My personal opinion is that you'll find it most rewarding to locate a non-profit near you that supports a cause that you support and to volunteer to help them with various tech/data projects as a way to improve their service delivery. They don't have to be working with a local beneficiary community -- perhaps they support something overseas. Instead of skipping off of the top of a lot of different projects, it will give you the opportunity to dig deep into the needs of one organization and potentially have very significant impact on the way they conduct their work. Just keep in mind that they're the SMEs with regards to the beneficiaries and that you're there to support their needs, perceived or real.
The Spies Who Came in to the TV Studio (2018)
The devices controlling the centrifuges would return erroneous information (that everything was fine) while causing the centrifuges to self destruct. So it would appear everything was working properly and the centrifuges were just failing for unknown reasons, which would cause the workers at the enrichment facilities to draw the wrong conclusions about the source of the problem.
Yes, lots of good HyperCard memories for me. One convention that didn't make it to the web browser was having a key (option?) you could press to highlight which elements were clickable. Lots of modern webapps could use that...
Please name it freddirated
So NYTimes started an investigative process a year prior to Buttigieg's exploratory committee? Amazing... and doubly so since the NYTimes isn't exactly a champion of progressive democrats.

The less nefarious answer is that these big investigative pieces follow a pattern. The original journalists publish a series of articles, then start writing a book. Meanwhile, other journalists pick up the thread. Sometimes this happens simultaneously because other journalists hear about the investigation and talk to the same sources.
I would think that publishing this story (although a responsibility) may make things worse. Now the thief knows what he has is valuable.
I didn't watch the whole thing (yet) but the part that you link to is spot on: If the Google top brass or the rank-and-file wanted to give the service workers a better break they could do it overnight, it just costs money, and not enough people care or notice.

The first comment on the video has some context (if you take it at face value):

> Google initially decided, for the first time in its history, to not publish this video to its Talks at Google site here on YouTube after it was recorded. This presentation was given on the second week of September, note the publishing time lag. Giridharadas contacted Google to ask why, and his contact said "I'm not on that team anymore" and was blown off. He then leaked the story to a leading tech journalist, who started calling Google for comment because she was working on a story about why, for the first time ever, a Talks at Google video was not published. They published it the same week
If it saves $24,000 a year, and your developer cost is $100/hour, 240 hours or less spent a year on this effort is your breakeven. Pretty sure that's a win.
Nothing stops them from using a unique passphrase. I am subjected to the same password requirements and use a unique passphrase every time.

I see harvested passwords as a larger threat than bruteforcing, so some kind of expiry is important. Some users might use good, unique passwords, but most will not.
Okay. From an architecture point of view, I agree with you. The context of my post related to the databus width and the speed implications of it. Sorry I wasn't clear in my meaning.
Donating technical skills with a market rate of a couple hundred bucks an hour can add up much more quickly than donating cash in many cases. And it doesn't have to be a massive investment - in a few hours you can make a much more manageable and better looking website for a lot of organizations that can't afford to pay for one.
I was using Retool and was looking for a feature.

Mentioned it in the chat window and within 60 seconds I got response, 10 minutes later the feature was pushed to production.

The velocity of startups can be really nice
Nothing like asinine password requirements, with frequent rotations. Especially if it has absurdly low login failure counts before the account is locked and requires manual intervention.

Some services it's easier to just bag their authentication and use the "forgot my password" method every time like a one-time code. Especially if it a rarely used service.
What it means to be "welcoming" is rather subjective. But there has been widespread adoption of discriminatory policies designed to make women get offers more frequently than men as I have shared in a previous comment [1]. I think this is what was being referred to when the above commenter talked about companies being more welcoming to women.

The extent to which discrimination makes tech more welcoming is debatable. It does have the immediate effect of increasing the number of women in tech roles, but it does so at the expense of putting them in an environment where they know that their male co-workers were held to a different standard and vice versa.

1. https://news.ycombinator.com/item?id=21776455
The biggest thing to worry about is a hash length extension attack. https://blog.skullsecurity.org/2012/everything-you-need-to-k...
This requires avoiding the use of a MAC hashing algorithm such as sha1 or even sha256 because it's possible to append data and generate a valid signature from a previous oracle. Alternatively, you could use SHA2 to generate a 512-bit key and then truncate the key to 256 or use an HMAC
No one at work is going to let me learn Lisp :)
There used to be an online publisher called Associated Content (bought by Yahoo for $100M in 2010) that used freelancers to write SEO-optimized content.

I realized that I could write some code that would scrape various sources of financial data and generate articles about stock tickers. Managed to make some money before the articles got flagged as too similar to each other, but if I had put a little more effort into differentiating them, I probably could have made a pretty penny.
The only explanation I can come up with is that it was so much data that it couldn't be moved over the Internet in the time span they needed it moved. But that explanation only leaves me with more questions.
You bring up a good point: it would be nice to be able to quickly see what options are different from defaults, whether in graphical or text form. I don't know of any UI (for a desktop environment) that does this, however, but I do like the idea. I do believe I have seen this kind of thing for more specialized products or programs. I will point out though that with Linux desktops, the defaults are different by distro, though still this shouldn't matter; it shouldn't be that hard to have a "master" config file and then be able to diff it, or have a UI panel that does this in a more user-friendly manner.
> But it's possible this migration process would have been easier if we had done it sooner.

What the f*? Of course it would have been easier if you had done it sooner. What you lacked was the willpower from decision-makers who had growth of dollar-signs in their eyes.

You've littered this thread with comments explaining how every move you made was based on ROI. That's the kiss of death for architecture concerns, and bizarrely it puts Node.js on the list of runtimes for data/stream processing backends.

No matter how many times you explain how you made these decisions, I can't help getting the feeling you were wearing horse blinders.

Edit: I find it impossible to imagine that nobody on the engineering team ever shouted, Hey look out! We are basically a Web farm for banking-related requests, this is insane! Surely you've heard from those people and they were let go.