skysight-inc/HackerNews huggingface dataset:
But narag was talking about immigration between countries: "...had more than a third of inmigrant parents, including Russia, Iran, South America (most) and Morocco". I understood narag's point as "that's a fast demographic change, but inevitable in any modern large capital city, as capitals tend to attract immigration".

My counterpoint was that there is nothing inevitable about it, and that it is a policy choice. Tokyo is a very large, very modern city with a massive economy, yet it has a very modest foreign population and is recognizably Japanese almost everywhere you go (which results in being really safe even at night, almost completely litter-free, and certainly a great experience of Japan for a visiting tourist).
Agreed. And more importantly, (2) is waaaaaay easier to fix than the problem you outlined in your preamble.
...or "instant"(!) messaging applications taking gigabytes of memory and a full CPU core, and yet still can barely keep up with how fast a human can type.

I've often complained out loud with coworkers, while waiting for some horrible webapp to do its thing: "This computer can execute over a billion instructions every second. How many instructions does it take to render some formatted text!?!?"

Related: https://news.ycombinator.com/item?id=16001407
Poor Ortiz, she just got lawyer money for those entire six days of vacation she should have took. She didn't even take the "mandatory training" that apparently all of Seattle's thugs have gone through this year on being told when they can lie!
I mean, the issue with cameras on everyone is that they all require small batteries, meaning always recording with them isn't really practical. There is already early-stage research into long-range wireless charging https://youtu.be/gn7T599QaN8 so maybe 15+ years in the future it would be practical to have always-recording devices.
The vuln is via IonMonkey JIT parsing. It might be as old as that project, I hope we find out how far back it goes.
RE: the downvotes; while I didn't partake, I know there is history between the BLAKE/BLAKE2/BLAKE3 author, JP Aumasson, and Rurban, in particular related to differing opinions over the publication of SipHash.

Differing opinions here means that most of the cryptographic community agree that SipHash clears its claims as a PRF, while Rurban indicated he has found undisclosed vulnerabilities that he wishes not to publish.

RE: the table; a point to note is that BLAKE3's main implementation, in Rust, benefits a lot from multithreading on large files, which SHA2 cannot. The C version, which Rurban copied, does not leverage multithreading: https://github.com/BLAKE3-team/BLAKE3/blob/master/c/README.m...
Which is how you get Jerry Pournelle and Larry Niven claiming they ended the Cold War and defeated the USSR.

https://youtu.be/34T8s0D-Fxo?t=2503
FWIW, the stairs drawn are still over simplified. Top step is unusable and dangereous. As an architect I would never accept it.
That feature is a configurable option (at wildly variable strengths) that is set up by the merchant when they are setting up their payment gateway. All the CC processors I have worked with provide these varying levels of Name/Address strictness.
> When other people try to look at the "cleaner" version they have to spend more time trying to understand it and mentally untangle the abstraction.

If you have to do this, either your abstraction is "wrong" (e.g leaky) ; or perhaps your identifiers are inappropriate?

(As a rule of thumb: not being able to figure out a good name is a sign that the abstraction might be misplaced.)
> in the user's POV the role of a VCS is to CRUD changesets and branches

That would be the role of a filesystem, and Git is a perfect distributed filesystem. A VCS also allows people to merge their changes and to detect and handle conflicts gracefully.

> who cares how the system is implemented under the hood?

Pijul is not at all about the underlying implementation of commits. Patch commutation is a radically different way of thinking about cooperation, and (1) much simpler and (2) has the potential to scale to much much larger repositories.
That was informative, thanks! It matched my gut feeling about the algorithms and I knew some of these things, but not everything :)

> a safe bet is still SHA-512/256, which is safe against length extension attacks.

I would like to add here that this does not mean "SHA-512 or SHA-256" (I remembered that SHA-256 was not length-extension resistant and looked up the details). Instead, it means the version of SHA-512 that gets truncated to 256 bits. This is apparently relatively new (or at least added after I last read up on SHA-2):

> In March 2012, the standard was updated in FIPS PUB 180-4, adding the hash functions SHA-512/224 and SHA-512/256, and describing a method for generating initial values for truncated versions of SHA-512.

-- https://en.wikipedia.org/wiki/SHA-2#Hash_standard

I feel like that notation could have been chosen better by NIST.
To be fair, there are a lot of blood-XYZ barriers:

https://en.m.wikipedia.org/wiki/Blood%E2%80%93brain_barrier#...
This is simply incorrect. Black car services are just as unreliable as cabs in many parts of the world (and in many others, the distinction does not even exist).
Brave.

Blocks all trackers, fingerprinting and mining scripts by default, based on Chromium. Built-in IPFS, Webtorrent and Tor: https://brave.com/
> attempt to predict the future

Sounds very error prone…
Or how about instead of eroding the user experience to allow Uber to continue to take advantage of the fiction of the drivers being "independent contractors", the state does what it should and enforce minimum conditions, including a minimum wage?
> French people usually are pretty quiet

It's not just French people. American tourists have a reputation in many countries for being annoyingly loud.
> Now what?

Discard the outdated assumption that a single installed dependency version is sufficient for all packages, and then improve the packaging system to permit multiple releases of Rust, Python, etc. to coexist as dependencies so that packages can migrate gradually over time rather than forcibly whenever one crosses the line.

Homebrew does a fine job of this. Installing python@2 doesn’t necessarily mean it’ll be made “the default”, but it does make it available for dependencies without interfering with the default python 3 package.

EDIT: NixOS does this right: https://news.ycombinator.com/item?id=22023086
He didn't take a human life; he lied about a guy. Why not hang you for lying about him?
So your accusation is that Epstein blackmailed Seth Lloyd or converted him into an Israeli spy/consultant on quantum computing?

Many engineering professors consult with private companies for a fee. So it seems odd that a country would need to take a roundabout and scandalous approach like this to pick a professor's brain, when they could just work though a legitimate-seeming company as an intermediary.
Good list.

I've found the consequences of a nil type are less severe in dynamic languages, where all variables have the Any type, since nil is just one of the options one needs to account for.

Static languages where everything is nullable are reneging on the promise; you say something is a String but that just means Option<String>, and it saps a lot of the reasoning power which static typing should give.
The secondary reflector, seen floating here (https://www.futuretimeline.net/21stcentury/images/the-five-h..., right image), can be moved.

See details here: https://arxiv.org/abs/1105.3794
If you start allocating multi-kilobyte objects in your stack frames, they are not going to fit into L1.
You are right. I still think we should call "Password Hashing Algorithms". "One-way password storage" maybe. Or something. Just get rid of the word hashing.

Edit:
NIST uses "one-way key derivation function" in their requirements, which I like, but that perhaps unfairly excludes other potential functions.
I've never seen a programmer produced medical system.

Do you realize these systems are designed by respected doctors and product managers? They tell the programmers exactly what to do. When something vague comes up the product manager talks to his stakeholders and decides how to proceed. When the project is done the doctor/project manager group go over everything and make changes.

They decide things like how it looks is not as important as making sure you checkmark this section if you need to.

The priority is on reducing errors never on making the experience better for the computer operator (you).
> I like reading ignorant things like this

From the HN guidelines:

"Be kind. Don't be snarky. Comments should get more thoughtful and substantive, not less, as a topic gets more divisive. Have curious conversation; don't cross-examine."
> Ultimately I’d prefer SMS over nothing when it comes to 2FA

This isn't always a good setup. Frequently implementors use SMS, once set up for 2FA, to do password resets.

This means that it's actually 1FA - get the sim, and you're in. No password required.
Complex apps can bundle their own dependencies-- that's what the Flatpak and Snap package formats do. You can also run Firefox in a Docker or LXD container with it's dependencies. By sharing the X11 or Wayland socket with the docker, the apps can appear on your main desktop.
Just much larger actual signal collection area — means higher SNR and weaker signals can be detected. Don’t have to worry about complicated interferometry.
I get the email thing. And I've actually been moving critical accounts away from my personal Gmail for a while now.

As for the rest, the services I use, I use them because they work better than any of the other options I have tried.

I'll admit that that amounts to as substantial number of services.
It's not like they compromised SSG's website to get it. It was produced in response to at least two FOIA requests. So if anyone's culpable, it's arguably whoever produced it.
Because that doesn't feed into the outrage machine and drive clicks.
Cops don't have to face consequences. Who would arrest them?
He drove a man to suicide on a lie: for all reasonable intents and purposes, that's murder.
Picosecond? Each clock tick at 3GHZ is hundreds of picoseconds.
Also a botnet
On the other hand duplication is harder to review. If you have 20 lines of

x1 * y[i] + z2
x2 * y[i] + z3
...

or other dense math code, then it takes a lot of effort to spot any tiny mistake.

Duplication vs abstraction is a very context dependent subject, and with many subtleties, one often no best answers.
> I.e. the usage of SipHash for their hash table in Python 3.4, ruby, rust, systemd, OpenDNS, Haskell and OpenBSD is pure security theatre.

This seems like a noteworthy claim, and the hflounge link is unfortunately broken!

Is it possible to you to provide more information about this, that Siphash would be essentially broken?
In the UK, they have already automated it. Many cab companies allow booking by app, with a _similar_ experience to Uber (though with worse service, usually).

Importantly, they charge the full meter price as set by the licensing authority, and engage in the usual cab of tactics arguing about credit cards, taking sub-optimal routes and espousing disagreeable politics for the entire trip.
CVE-2019-19766

https://github.com/bitwarden/server/issues/589
I honestly don't get this: the reverence with which Google treats user data has only increased over time. What gives you the opposite impression?
How many 'serious computation algorithms' are written in FORTRAN 77? They may be "implemented the best way known to computer science and optimized to the hardware architecture", but they're also a full 40 years (and counting) out of date.
I think saying repetition makes code worse is like saying repetition makes prose worse. Both code and prose convey ideas. Repetition is a tool. You can overuse it, and you can underuse it. But it is a tool. Not a flaw.
Show HN: 2D Creative Graphics in Go
It's tiring to work with developers who have a very narrow focus on "correctness" and e.g. code style. It can result in a lot of extra work, extra refactoring, extra cleanup, extra rewrites, etc.

It's how you end up with a toolchain, build environment and release process that's worthy of Netflix, but you're just 5 developers, and it takes up all your time to maintain.

Always focus on how it's benefiting the business. Is my time better spent on something my customers need or want, than fixing something that's already working?
Why must the messy code win in this case?

Building a transform tool should be a pretty well understood problem. Just take a look at what photoshop's transform tool does and you will see all the possible extensions you might need to support in the future (rotate, skew, distort, perspective, warp, transform origins, a bajillion modifier hotkeys, etc).

Of course don't go ham and support all of them up front. But with those future use cases in mind, it's pretty hard to write yourself into a corner. I would say Dan's refactoring looks fine other than needing more customization for positioning and handle behavior. But it seems easy enough to just add them later.
$230 Electron IpcRenderer Bounty
I had regrets after buying my boy a Chromebook and ended up upgrading him to GalliumOS and it's been great. Everything works, performance and battery life are fine, and he can actually... do stuff.
Waterfox (with Web Extensions) or Pale Moon (with XUL/UXP extensions)
Bumped up the bounty to $230!
https://www.bountysource.com/issues/85135915-ipcrenderer-doe...
The term for this is locality sensitive hashing, and it's very useful in some contexts.
Wrong. That's slander.

You can't just make stuff up.
The same has been proposed in NixOS [1]: basically updating nss, sqlite and other common dependencies for firefox requires recompiling tons of software, which in turn requires testing, especially in the case the update was a major one. NixOS is special in this regard, because the dependencies can be updated just for a specific package, by adding ad-hoc packages for multiple versions, and it's ultimately what has been done for Firefox.

[1]: https://github.com/NixOS/nixpkgs/pull/72126
> "And if you get insulted, it is your own fault"

Yes. It's just sounds that you hear, then your brain recognizes and turns them into words with meaning. How you react to the meaning is entirely within your consciousness. This is how you might pick up words from languages you don't know if the sounds are similar, yet you wouldn't claim to be insulted by them.

> "If the person felt threatened, that is on them""

Yes, your feelings are your own, nobody else controls them. That's one of the fundamentals of free speech. There are some very limited situations (like threats) where it's overruled, not because of your feelings but because of the intentions being forecast. Even then, there's a very high bar to prove any criminal intent there.
I can't help thinking of this excerpt from re-frame's docs:

> Now, you think and design abstractly for a living, and that repetition will feel uncomfortable. It will call to you like a Siren: "refaaaaactoooor meeeee". "Maaaake it DRYYYY". So here's my tip: tie yourself to the mast and sail on. That repetition is good. It is serving a purpose. Just sail on.

https://github.com/Day8/re-frame/blob/master/docs/Subscripti...
I'm a native English speaker and found absolutely nothing unusual about the grammar in the article. Do you have any specific examples?
> You should not take issue of your work being reverted (for good reasons), like other people should not take issue of "their" code being modified. Better ask for forgiveness than permission.

Changing one developers _working code_ after they’ve invested a significant amount of time into without discussing it with the team first it is to basically heap on a number of unwritten requirements and also decide that the schedule allows for addressing them. If removing repetitive code is a requirement then the team needs to be informed that code will be reviewed for repetition, and introduced to various techniques for spotting and removing repetitive code. The schedule also needs to be adjusted to allow for this additional work.

And if the rewritten code is so superior than perhaps there needs to be a discussion about whether there should even be a team, or whether the other people should be let go and all work assigned to the developer who can do the work “properly” the first time. After all, what’s the point in having one developer’s work constantly rewritten by another?
none of those solutions apply the BSDs though
Ask HN: Any startup generalists who can share how they learn?
Anyone who could share how they came from a background where they didn't do much coding, marketing, sales, hr or accounting and learned how to pick it up to build or work at a startup?

Any resources or ways of learning they found helpful in picking up new skills beyond your past experiences.
Sadly, most normal people tend to universally believe cops when they testify in court, despite the fact that they're generally no more truthful there than when speaking to suspects.
That's right.

The authorities (don't know if this is RFS or police in this case) seem to pretty confidently attribute fires to causes for the most part. The percentage attributed to arson is lowish but disturbing (20%?).

I imagine lightning strikes and ember spread from existing fires are fairly easy to diagnose. I'm not sure how you tell "fires spread from sparks from roadway incidents" from "arson" but I'm not an expert.
It depends on context. Ideally you have an automatic code review system that would remove a lot of these discussions and create sense that everyone is involved in the code bases.

In this context however it is pretty special because it it was a single commit that that he immediately refactored. In that case the more reasonable approach in my opinion is to take a post-commit code review where you talk to the dude about your thoughts how one can improve the code. It was also a pretty significant change when it comes to coding philosophy, so if you think you know more it is also a potential opportunity to mentor your colleague (or learn something yourself)

If it would have been a bug fix or an added feature it is no problem. Or if some time passes and most code is written in style X but this was not and then you rewrite it, also fine.
When talking about passwords specifically in our reports (I work at a security company too), I tell our team to use the same language as NIST 800-63B, since its the best "standard" for passwords and authentication I can find.

The relevant bit here is this:

Verifiers SHALL store memorized secrets in a form that is resistant to offline attacks. Memorized secrets SHALL be salted and hashed using a suitable one-way key derivation function. Key derivation functions take a password, a salt, and a cost factor as inputs then generate a password hash.

They are specific about the type of KDF required: "one-way key derivation function".

The examples given later are PBKDF2 and Balloon.
I can think of several reasons:

- despite its belligerent actions in Iraq, Iran wanted to live up to Khamenei's tweet to Trump "1st. You can't do anything". [0]

- if Iranian leadership was actually fearing American reprisals after their missile strikes at Iraqi bases, they may have wanted to maintain civilian air traffic as human shields, because if only military planes were allowed to fly and an actual war broke out, American total air superiority would benefit them. Having civilian planes flying would make it easier for Iranian military operations to mingle in.

[0] https://twitter.com/khamenei_ir/status/1212301034871279616
Gmail Tracking All Links
I've noticed just recently that any link you click from a gmail message first goes to a google URL and then the redirect happens to the actual website.

Here's a ticket opened in 2019 regarding this on Android, but this also happens in the web version of gmail:

https://support.google.com/mail/thread/10786964?hl=en
The basic intuition behind symmetric cryptography is that once your input bits are "thoroughly mixed", there's no way to un-mix them besides brute-force.

On the other hand, we don't have a solid theory of computational complexity yet. Even basic questions like P = NP are still unanswered, so we have no idea what "thoroughly mixed" actually means, how to measure it, how to achieve it, or even if it exists.

Whatever it is, a single round of BLAKE certainly isn't "thoroughly mixed". Is 10 rounds enough? Nobody knows. On the other hand, we suspect that a thousand rounds are no better than a hundred - there's probably a plateau of "maximum entropy", and once you get there, extra mixing doesn't help.

So, since we don't actually know what we are doing, we pick a safety margin, like 1.4x or 2x, and just use that. It's all just guesswork until the theoretical side catches up, so your opinion is as good as mine. On the other hand, picking a safety margin of 1 seems rash. If you have practical attacks in the round before, you probably aren't anywhere near the plateau of maximum entropy!
He lied with intention, I said something I believe to be true.

By the definition of murder, my statement seems to be accurate.

https://www.merriam-webster.com/dictionary/murder
I generally find it pretty easy to reason about code structured like:

switch(object)

type1:

(bunch of code)

type2:

(bunch of code)

type3:

(bunch of code)

etc...

Even if the function is long it's pretty easy to skip over the irrelevant parts.

When you get in trouble is when you discover a bug (or have changed requirements) in something that gets duplicated several times and have to remember to hit all of them. The last one especially, it's the one that seems to be missed the most often.

Overall the tradeoff is generally worth it though, because you only need to care about one case at a time.
The general problem is power imbalance. Imagine I'm a journalist and want to report on crimes committed by a big company, or the government. Then I get a letter "you're on our radar, notice that we have a decently financed legal team and believe reporting to be a violation of <long list>". Do I continue or do I drop the case?

The only ones that can actually pull through now are media powerhouses with their own legal team (WaPo, NYT) - but small operations like local papers, small radio stations, bloggers, they rather retreat than to lose their existence.

And it's not just about the money for lawyers that the losing party ends up with - it's also a huge loss of time and in case of actual criminal accusations (e.g. libel, or fraud if I go undercover as a journalist) the risk of jail time or a criminal record.

Journalists need better financing and the legal system a reform. As long as the standards of decent journalism are adhered it should not be a crime in any way or even carry the risk of that.
FYI, for those like me whose last memory of RedHat packaging was pre-yum: https://developers.redhat.com/blog/2018/11/15/rhel8-introduc...
It is not at all about not being Git. The absolute best reason is that Pijul actually has the properties that people think Git has:

- in Pijul, patches are associative: pulling B and C together after A does the same as pulling just C after pulling A and B. Git doesn't have that property: sometimes diff3 randomly (and silently) decides to shuffle lines around.

- in Pijul, patches commute. Most Git users try to simulate that by rebasing branches, but (1) that can mean a lot of extra work for no fundamental reason and (2) Git runs the same clunky merge algorithms to decide how to do it.

- Pijul knows what a conflict is, whereas Git pretends to know, but then there's "git rerere".

- in Pijul, you can clone one subdirectory of a monorepo by just pulling the patches related to that directory. Git can do partial clones as well, but only with LFS and/or submodules, which are incredibly clunky and unnatural.