skysight-inc/HackerNews huggingface dataset:
Recently, I heard a smart person[0] make the argument that application-level encryption, even in the browser, is a net win. It's also worth mentioning that ProtonMail and 1Password both practice application-level encryption/decryption in the browser in their front-end web clients.

App-level crypto in the browser certainly provides no added security to data transmitted over the wire, since (a) connections to back-end servers are already TLS-encrypted, (b) a breakdown of TLS implies the code running on the endpoint can't be trusted, therefore (c) assume data exfiltration when TLS breaks down regardless of other variables. I think this line of reasoning is just a restatement of your points above.

However, depending on how the back-end is set up, a zero-knowledge end-to-end encrypted vault would be impractical and even dangerous to decrypt in the cloud prior to serving it. Hence, in an end-to-end encrypted app, the chain of trust in client connections is anchored at the static file servers, the JS code they serve, and the TLS connection itself, not application servers -- the less trust app servers have to have, the better. I posit that it's easier to secure a static file server and TLS endpoint than it is to secure application servers. Furthermore, client crypto protects servers from ever seeing (or having to store/hash/cache) the whole symmetric key.

So client-side crypto can improve the security and trust calculus for server-side systems. In that case, a back-end breach of all but TLS endpoints and static file services would not expose user data.

If anyone can explain what's wrong with or missing from this line of reasoning, I am all ears -- please do!

[0] https://qconsf.com/sf2019/presentation/security
> Oh no, thanks to democratic elections of senators, senators risk their voting decisions being scrutinized by their constituents...yikes!

More democracy more directly is not a salve that cures all problems. Election of judges is pretty crazy, for instance.

IIRC, senators were originally appointed by state legislatures, and were understood to be representatives of the sovereign state governments themselves. Sort of like how the US government sends a representative to the UN rather than having the people elect one.
How I killed 99% of the unwanted calls to my "home" number using callcentric routing rules:

#1 - Calls from the real estate broker who wouldn't take no for an answer: number is disconnected.

#2 - Calls from Anonymous / Private numbers: number is disconnected.

#3 - Calls with "high" spam probability: number is disconnected.

#4 - Ring my VOIP gateway when I'm inclined to take calls. (Currently toggled manually).

#5 - Everyone else: Voicemail.

I had previously scripted downloading my contacts and adding a routing rule that let people in my contacts ring through but disabled that rule. Just need to update my script for google's oauth changes.

Callcentric also offers a interactive voice recording (IVR) options for things like press 1 to talk to a person or even press a randomly generated digit to talk to a person. I haven't bothered with using an IVR since this system works for me.

You can reproduce this system yourself using Asterisk or other open source PBX software if you don't want to pay callcentric for a phone number. At home I use a Gigaset voip gateway and DECT handset [1]. The nice thing about doing it that way is 1) the handset doesn't need to speak tcp/ip and so is light, cheap and the battery lasts for days, 2) if I need a second handset it's trivial to add one.

[1]
https://www.amazon.com/gp/product/B014A781GS/ref=ppx_yo_dt_b...

I realize the stereotype is HN readers have no use for the PSTN any more and wonder why people ever answer the phone, but I find it convenient for some things and it lets me stay in touch with older relatives who are less inclined to text / e-mail / insta / whatever-du-jour vs use voice.
Java Microservices: The Ultimate Guide
So far we have submitted couple patches [1][2] that we felt were good opportunities to learn how contributions flow into OpenJDK, and we are now starting to experiment with JFR and other GCs like Shenandoah. As we progress, we may find other fixes and enhancements that we aim at upstreaming as well.

If you have further questions, I'd be happy to take them.

Best,

Bruno Borges,

PM for Java at Microsoft

[1] https://hg.openjdk.java.net/jdk/jdk/rev/aebd72de84b0

[2] https://hg.openjdk.java.net/jdk/jdk/rev/c6e474ae266b

[3] https://mail.openjdk.java.net/pipermail/shenandoah-dev/2019-... (still under review)

[4] https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev... (ongoing discussion)
I also see this thread under Hacker News, but not the article on volument.com, which was first yesterday with "sendBeacon is broken".
If we trust the constituents enough, why not just have them vote directly on laws and get rid of the representatives entirely? Back in the 1700s there were physical limitations that required representatives, but those are no longer a major factor.
I don't make or enforce the rules, for better or worse.

https://parcelindustry.com/article-4888-The-Mailbox-Monopoly...
I only hit start when I start driving, and then I don't look at the screen much, since I'm driving.

If you hit start before, it starts talking a lot, and that's annoying.

To be fir, I've never really wanted this feature much, so I haven't tried to find it.
Airplanes and Accounting Games: The Coming Boeing Collapse?
I think what they didn't fully grasp was how partisanship directly arrives from the voting method. Sure, there was factionalism, but the forcing into two opposing (and almost always equally balanced) parties as a mathematical equilibrium sort of thing probably wasn't in their lexicon.

For instance Duverger's Law, which didn't even get a name until the 1950s or so.

https://en.wikipedia.org/wiki/Duverger%27s_law

I will check out that book, thanks.
I hope this answers your question : https://www.wsj.com/articles/how-google-interferes-with-its-...
My last two have been like that. Try unplugging your internet connection then playing something you recorded earlier. If you have an AT&T or DirectTV DVR, it won't play.
Reducing cgroup CPU throttling on Linux machines with many cores
Not sure I'm tracking your question. My lack of decisiveness in shutting down and/or drawing laser focus to the water filling the bilge of the aforementioned project was the issue. I've been in industry for 25 years, I think there's a fair expectation that I should have this shit sorted out by now and accepted my lumps. Pointing the fingers at shitty vendors or internal processes now is too late.

I'm not much of a planner to be honest. Strategy will be to communicate delivery risks to a level outside of my comfort zone and see what happens. If someone has a good way of measuring this I'm all ears.
Nuclear is simply too expensive operate and too slow to build no mater who is providing the funding.

https://www.lazard.com/perspective/lcoe2019/
So 3k people who installed neighborhood surveillance devices have suffered a loss of privacy? Can't seem to find much sympathy.
Ask HN: Why is there no social media all in one/aggregator apps?
Whoops, this is a duplicate. Thread from 3 years ago: https://news.ycombinator.com/item?id=13805754
Definitely time to run some keyword searches across no just the VS Code base but every Microsoft Project

Any word that is even slightly offensive anywhere in the world should be reported
Yikes. I'm Jewish, non-religious. This guy is absolutely crazy.

Do I personally like Christmas? No. Do I like having it shoved down my throat every time I go to get groceries? No.
Do I like it when some people seem to get offended when I tell them I don't celebrate Christmas? No.
But to compare it to swatztikas and the Holocaust is ludicrous. (And as a person with grandparents who went through the holocaust, this is deeply offensive- don't cheapen the memory of the holocaust with BS.)
Calling Hannukah "Jewish Christmas" is pretty offensive,but a little hat which has it's origins in a Coca-Cola commercial is not.
I did this years ago and it helped a lot. Most direct mailers respect the list with the exception of a few credit card companies, and insurance associated with band accounts.

Some Charities do not respect the list and send me all manner of things. (Gloves was the most egregious from a charity I haven't given too.)
I'm really sick of people taking simple technology that worked well and Rube Goldberging it up into complicated, non-serviceable garbage. I'm seriously considering buying a rebuilt automobile from the 80s or 90s to avoid this kind of crap - they are surprisingly cheap at auction for anything that's not super popular.

Also, I'm still baffled that the left-foot stomp pedal for switching between low and high beam settings on headlights went away in favor of yet another thing hanging off the steering wheel. Especially in automatics where you aren't using your clutch foot anyway.
I posted this link to an interesting paper on this particular topic about two months ago:

https://news.ycombinator.com/item?id=21324653

"Starlink has the potential to provide lower latency around the globe than terrestrial fiber because light travels faster in vacuum than in optical silica fiber.

"Delay is Not an Option: Low Latency Routing in Space"

...

"We conclude that a network built in this manner can provide lower latency communications than any possible terrestrial optical fiber network for communications over distances greater than about 3000 km.""
Which is why it's worth actively resisting centralization.
IMHO the fact that it's hard to get TLS 1.2 (or indeed any form of "pure" cryptography) working at all on an obscure platform says a lot about the state of commonly available crypto libraries --- as those who are against regulating it like to say, it's "just math"; and math that any computer should theoretically be able to do. OpenSSL is one of the more portable ones, yet I'm not sure how it would be able to handle the 64K segmented model. It would need at least 32KB (maximum TLS record size, multiplied by both directions) and a little bit more per TLS connection. That said, a 2048-bit RSA key is "only" 256 bytes, and ECDH ones are smaller, so I think a TLS 1.2 (or even 1.3) implementation on the platform is definitely in the area of "feasible, but not trivial". A lot of IoT stuff has similar constraints (minus the segmented addressing).
HN doesn't consider it a duplicate if it's more than a year ago, so all good.
A concrete-free “slab”-on-grade foundation
I think the core issue is that people consume/view Git commit messages in different ways depending on their needs. Realistically, most people today use Github/Gitlab/Sourcehut/whatever web git gui along with the Git CLI. So the old wisdom of "commit-as-subjects," which made sense when people viewed commits in email chains, is no longer always relevant. In many organizations and communities, git commit messages mirror PR titles, and in this specific context it makes a lot of sense for commit messages to be written as titles with a longer description attached. As an individual, I might use git to version a blog post I'm writing, and in this case I could use my own entirely individualized semantics for commit messages.

I don't even think there is a choice that is "optimal in absolute terms" as you claim. However, consistency within a project is absolutely key and is something we can hopefully all agree on.
There is no mention of uptime or SLA.
Thanks! Let me know what you think!
we didn't go ahead with it because we kept having calls with the different people in the university, and they kept putting off the decision. This was years ago and as far as I know, maybe their process is still going on.
> understanding that individual virtue does absolutely, totally, precisely nothing

One is forced to wonder why people who think this way bother to get out of bed in the morning. On a global scale you are insignificant approaching nonexistent, so by your own reasoning nothing you do matters and therefor you shouldn't bother doing anything.
> Friendly lists,
Resources,
Software safety standards,
Safety guidebooks,
Coding guidelines,
Topics,
Certification,
Formal verification,
MC/DC,
Articles,
Papers,
Reports,
Accidents,
Questions and Answers,
Books,
Videos,
Interviews,
Press,
License
this made me chuckle out loud. Great idea. Should have done exactly that.
> such as database engines, that commonly rely on safety models Rust was not designed to express.

Do you think you could expand on this?

From my experience Rust facilitates all the same operations as either C or C++, and generally without even needing to turn to unsafe. What I've found in my own (not DB, but networking) work, is that Rust generally asks you to restate the problem in a way that will allow it to be best expressed in Rust. This often differs from the down the middle of the road implementations people have grown used to in other languages, but it doesn't in any meaningful way prevent you from solving the problem, in a safe way.
Show HN: Flightlist – Find cheap, one-way flights within a departure date range
The problem is they are not actually offended.

They like the power that pretending to be offended gives them. They need that validation, or rush at making the world bend to their unreasonable demands. They is the only "joy" they have in their miserable lives
Hmm, reading your linked article makes it seem even weirder. The whole point of impeachment is to convict and imprison. The best way to do that is to get a really solid case. Even more so if the Dems really think Trump is a threat to our country, and shouldn't run again, they should build a rock solid case against Trump that ensures he ends up in jail. Trump cannot be president from a jail cell.

However, as the article says, the Dems are rushing the impeachment process, which as you say will most likely not remove Trump from office (nor imprison). So, I really don't understand what is the point of this whole thing. How does Trump's behavior present a threat to free and fair elections, and how does this impeachment stop the threat?

Trump may find out Biden's son is doing illegal activities, or that Russia wasn't as meddlesome as supposed, and while that may influence the election, it is unclear to me how learning such information is in itself a bad thing for our system of government, i.e. a threat to free and fair elections.

And the very implication of the articles of impeachment, that Trump could gain something of value from Ukraine, has the implication that what Trump is seeking may actually be correct. In which case, Trump's requests certainly should be followed through by the Ukraine minister.

This whole thing makes less and less sense the more I dig into it, and I understand even more why all the news articles are so light on details.
Social media ("like") buttons are the ultimate tracking pixels, and they're not even hidden.
Not at all, just that the pure theory of falsificationism as specified by Popper both excludes valid science, and includes pseudoscience (for instance, astrology is falsifiable). Thus, falsifiablity is not both necessary and sufficient[0].

[0] https://plato.stanford.edu/entries/pseudo-science/
> If Tencent is unable to cross that bar, then the project should absolutely be rejected from the Linux foundation.

Weird how you think Tencent should perfect the project before the LF accepts it. Why can't the LF support the English documentation effort? To me, it sounds like you not only don't you want to be involved in a non-English project, but you don't want anyone else to be, and my question is "Why?"
This is not workable for an average person though. Also people just don't get how telephony works today. Here's an example: which of these is a call from out of US:

- call from a person in Canada, legally using a valid US caller id

- call from a US mobile roaming in Canada

- call originating in the US, routed via Canadian telco back to the US

- call from a US mobile in the US, using a VoIP service in Canada, legally using the same mobile's US caller id

(None of these are doing anything illegal, and are valid scenarios)
Ohio's state troopers have particularly awful ones. It's noticeable any time I drive through the state.
> modern society is so incredibly fragile

http://energyskeptic.com/2016/when-trucks-stop-running-so-do...

"When Trucks Stop Running, So Does Civilization"

and also

http://energyskeptic.com/2015/power-transformers-that-take-u...

"Large power transformers are essential critical infrastructure to the electric grid, and are huge, weighing up to 820,000 pounds. If large power transformers are destroyed by a geomagnetic disturbance (GMD) electromagnetic pulse (EMP), cyber-attack, sabotage, severe weather, floods, or simply old age, parts or all of the electric grid could be down in a region for 6 months to 2 years. "
> Word games are hard.

Yes. But playing them well is often necessary in order to be effective in today's world. This is the problem with the people complaining about "quantum supremacy". They don't even realize that they being played because they don't even realize that they are playing a game. They think they are doing the somber work of Serious People. They are wrong.
I think so too. But it was cool to see how they hired someone solely based on their professional StarCraft skills :)
We could just stop subsidizing fossil fuels and implement a carbon tax. That would make fossil fuels uncompetitive against everything and then people would turn to whichever alternatives are most suitable.

Then you'd get more nuclear for baseload and in areas with less sunlight or cold winters, more solar for loads that align with its generation curve (like air conditioning) or are easy to time shift into sunlight hours (like charging electric cars) etc.
Don't worry I added it later on to clarify.
iCloud Keychain isn't tied to password reset; you need to use the recovery code for it.
Almost everyone who gets a ring or other smart door bell is getting one to see who is knocking on their door, not to spy on their neighborhood
If there's one documentation that I hate with my gut, that is GCP documentation. Like wtf is going on there. Just to give you an example of how horrible it is, just check their Vision documentation: https://cloud.google.com/vision/docs/

They have quick starts, tutorials and how-to-guides. How are even those things conceptually different at all?. And their reference is just a list of their methods like if I knew out of the box how to use your API. Like, what the heck. Just tell me how to talk to your API in simple terms. How hard is it?

"To use the CGP vision API there are two ways to authenticate and connect. 1) REST 2) SDKS" and then just explain to me how to do it simply.

Don't ramble like if this was the fucking Iliad.
Go straight to the point and organize your information better.
I wouldn't call semweb dead; it just has found its niche(s) and is even stabilizing and gaining in those areas. I actually landed a gig for graph DBs, SPARQL, etc. in lab informatics for bio/chem. Earlier this year I attended a keynote held by Wikimedia Deutschland's Franziska Heine pushing for large publicly available RDF data sets, etc.
The rhetoric surrounding Ring has reached a fever pitch. Seems like we get a new article or two every day about Ring, and the quality varies wildly. Its hard to know what to take seriously and what is just media preying on people's fears.
These are mostly all C, C++, and Ada resources.

> Does Rust have a chance in mission-critical software? (currently Ada and proven C niches) https://www.reddit.com/r/rust/comments/5iv5j7/does_rust_have...
Thanks to Snowden, we now know it to be factually true.
It's dangerous as hell these days when it is wet or lightly raining at night. The glare is markedly worse than the old yellowy headlights were.

It doesn't help that all pedestrians wear black Northface or Canada Goose jackets.
An oldie and a goodie.
LOL... I'm so sure the US boats seem to keep 'accidentally' being around when fiber is cut. You do know US/NSA actively taps global fiber networks. I assume they cut it in one place "accidentally" while they tap it in another to avoid being detected.
> and almost always equally balanced

Doesn't that also follow from the voting method? A faction will make the political compromises it needs to reliably get past 50% in order to active power, but won't go much past that because it would be an unnecessary political sacrifice.
We managed to move our iOS CI over to this in a couple of days. Produces multiple independent builds based on branch names, signed with an enterprise profile for testing and QA. These are uploaded and shared via ms app center. It also produces our App Store releases signed and uploaded to the App Store via a regular developer account.

The process was mostly just changing out a Jenkins file to the GitHub yml and sorting a few issues that cropped up.
https://www.hacware.com/travelImpossible.html

: 404 Not Found
I can't believe Microsoft took it down. Just wow.

Apparently they will bend their will to every troll that strolls by
I've been using “Megabyte” wrong all this time
It depends on what you want. If you want to be able to see everything, then the C++ code is better. If you want to get the trees out of the way so that you can see the forest, the C++ code is better.

And, for most of us, if you want to just write it and have it work, the C++ code is better. Sure, I might have to find an example of the iterator code in order to get the syntax right, but it's a lot easier to mess up the double indirect pointer code. Worse, when I mess up the iterator code, it likely doesn't compile. If I mess up the double indirect pointer code, it it likely to silently corrupt memory somewhere.
> Burnett’s stock archive, we should note, includes coverage of the Watergate hearings in 1973, an impeachment hearing that felt, Burnett says, less “tribal.”

I won't pretend to know much about Watergate or what he meant by "tribal", but I thought it ironic that hearings about one party literally tampering on the property of another, felt less tribal.
History lessons are pertinent to the degree you represent the facts therein accurately. Perhaps this is where the confusion arises. You claim the NSA has computational superiority to crack "whatever they want". If this is true, I posit that such a invention would be available to the private sector as it would represent and contain an immense technological innovation -- and not doing so would be a greater detriment than doing so.
> Now that you have systems you can login to, their complexity is the same – except you won't have to care, or manage any hardware.

Depends upon the number of servers you have.

Back when I worked on several somewhat popular websites ( a handful with ~1-5mil daily unique users), we had about 40 servers and they mostly took care of themselves. Between me (primarily a developer) and the CTO we averaged maybe a single day thinking about hardware per month, and that was mostly to install new hardware rather than taking care of existing stuff.

If you have this number of servers, once you have something like Ansible setup (we used cfengine back in the day, ugh), both hardware and software mostly manages itself.
Sorry, stable returns are not the only consideration. You want them to be as high as you can, while maintaining stability. There is obviously a tradeoff there, and yes, 'efficient frontier' is the term of art for choosing points along this optimal curve.
He's basically the living legend of programming language design, having designed _three_ successful programming languages (TurboPascal, C# and TypeScript). If he's allowed to tweak Java to his liking, it might actually at some point catch up to what C# was 15 years ago, and maybe even get proper generics.
I did consider Java as I was writing it, but at the same time Java is actually pretty fast, but there is no doubt that it doesn't use native components most of the time (there is a gnome toolkit bindings for Java, so it is possible).

Still Java feels speedy, I think because it is compiled and doesn't need wacked workarounds like not having non-floating point numbers.