skysight-inc/HackerNews huggingface dataset:
Even before requiring your real name, OkCupid was pretty blah for some people, a friend of mine had a woman message him, before he could reply, with a few things in his profile she was able to identify him and then went full psycho. Ultimately she made multiple posts on Cheaterville.com and made claims he gave her STDs etc, which cost him an acting job when the casting people googled him and BAM it was one of the first things to pop up. The messages she sent were just nuts, I documented them here: https://www.ryanmercer.com/ryansthoughts/2012/1/20/a-troll-a...

And then more than a month later she started with more Cheaterville posts, this time posted as his full name https://www.ryanmercer.com/ryansthoughts/2012/3/15/aimeexx1-...

Now, I wonder if perhaps staff/owners of Cheaterville weren't using dating sites to attempt to find people to blackmail. IIRC the site would remove any posts about you for a hefty fee.

I was an early adopter of OkCupid, in fact long before they were acquired I was actually a volunteer moderator. It was interest in the early days because you could tag stuff "I like [[Metallica]], I read a lot of [[science fiction]], and I like to eat [[pizza]] before going to [[SCA]] fighter practice" and you could find people with similar interests that way, which was cool. I actually met some really cool women and am still friends with a couple of them. But then it started going downhill pretty quickly once they were purchased by the Match.com folks. Lots of dumb changes, removal of long-standing features, drastic increase in spam messages from people hundreds (or thousands) of miles away, requiring real names etc.

Didn't surprise me.

Every single time I'd pay for a Match.com account (over multiple years, as recently as last year), within a day of my subscription someone would message me. I'd always, like a sucker, pay again and reply and nothing... or they'd reply once or twice with very basic replies and stop. Now, I'm not saying they're scamming users to get them to pay for another month but... sure feels like it.

I anecdotally noticed a massive increase in spam/fake accounts when the same company bought Tinder too.
I don't think that's true. In places like London it's not construction costs, but land, that really determines overall costs.
Any chance this unholy mix is open sourced?
A fun story! Packet support contacted me one day last fall to ask about my business. I said I had none, I used Packet years before then for personal projects and only for a few days. Then they asked what my plans were for the 13 VMs I had running. I knew of no such VMs.

I guess my account got pwned.

They asked how I'd pay for these - $900 worth I think - since I didn't have a valid card in their system (the previous one expired since I last used Packet). I told them to stop the VMs and allow me to reset my credentials. I also asked them to investigate their logs and geolocate all the users that logged into my account. I was also curious they actually let someone log into the account from a new IP (without notifying me) and also allowed them to run instances without a valid card.

They blocked my account, which also blocked this support thread. So I started a new thread from an alternative e-mail address to resolve the issues.

I never heard from them again.
> if the NSA has the power to coerce, Apple wouldn’t repeatedly gotten into fights with the US government to unlock iPhones

The FBI is not the NSA.
So a single point of failure then?

It also means you are holding your cards on your time all the time you use your phone on the street, which is prime time for somebody to come and snag it out of your hand
Not too far from my personal experience, but it seems to me that all these mismatch scenarios arise when you are programming in the large, either directly or indirectly, i.e., by using third-party libraries, code snippets or even RESTful APIs. In a sense, programming in the large with an APL-like language reminds me of Perl in its best and worse. But things fit pretty well in the small.
In every field, work culture matters as much as knowledge. At some point, knowing the shortcuts or the dos and dont of your job becomes your most distinctive skill.
I'm trying to understand what it means - does it mean your code have to have a symbol called `_NSAKEY`? Or how does it affect compliance?
That sounds more like an application of signaling theory, I e. “They must be very smart to be allowed this behavior”.

The canonical example for OP is the “mad man” strategy Reagoj supposedly followed.
Occam's Glomar
Solving a problem in a technically competent way is easy, once you’re technically competent. What’s really hard is solving the right problem. Lots of systems are very well designed but they solve a problem the user doesn’t have.
I'm a resume writer and former recruiter. As a recruiter I was required to 'judge' candidates based on their resume, and didn't spend much time with candidates who had resumes that didn't show what I was looking for.

As a resume writer, my job isn't to judge the candidate, but to make the candidate look as strong as possible on paper.

My work as a resume writer has led me to believe that much of the talk of worker shortages in skilled employment markets is directly related to poor resumes (and not a lack of qualified candidates).

I get a lot more personal satisfaction out of helping people write resumes and coaching them on job search strategy than I did as a recruiter. But my work has also convinced me that there are lots of people out there who are qualified for the jobs they seek, but simply aren't capable of expressing that qualification in writing.
You weren't paid in beer and pizza options that vested after four years?
Possibly add a randomized date to new UA, in range from last fixed CVE, to browser compilation date

That would avoid feature detection, but still create epochs to disallow insecure browsers

--

For exception tracking, the best I can suggest is getting screen size + other features; then storing them, ready to pass with the exception
Show HN: MonsterBreedingBattle
There are cases like IndexedDB bugs in certain versions of Safari that are very hard to feature detect...
Packet’s offering are so good and so much above competition that it’s not even funny.

I mean, why almost no one else is offering BGP ECMP, byoip, anycast routing, a sane setup system among others. It boggles my mind.

It’s a hard sell going back to geoip and shitty layer2 switching that you get everywhere else after using their services.
If you know an area well, you almost always can find at least slight improvements to the Google Maps route. When I know there's a closure or accident, I often look at Google Maps to figure out which way it's recommending and intentionally avoid that route.
NANOG.

https://www.youtube.com/watch?v=__wn9zXFiy8
Debt and credit are useful and necessary tools, I'm not against them. Tether and exchange deposits are obviously not cryptocurrency and I think lots of people understand that. They require trust, which has been breached many times already.

There's a saying: 'not your keys, not your coins'. Cryptocurrency makes it possible to actually own your money when you hold the keys, and it's impossible to take it away from you.
Not OP but former litigator turned programmer here. This gets very complicated because saying "legal work" is a giant generalization for a broad field. But talking about this with my peers (still a slice of the market) we arrived at this:

There are three types of legal work (exceptions, yada yada, but mostly):

1. Normal people shit. Parking tickets and most criminal law, etc. Flat fees fine and usually nice so your clients understand (and understand their ability to actually pay your rate). Work itself can be pretty predictable, or taken on contingency for civil stuff.

2. Line of business legal work. If you fuck this up it sucks, but rarely is it a material risk to the value of the company. This work is usually brought in-house ASAP, to control costs. Before that point, you see both hourly and flat fee work, mostly based on client sophistication to negotiate such things.

3. Bet-the-company (and white collar/wealthy criminal) work. Here clients only care about one thing: WINNING. You win M/A by closing. You win regulatory work by clearing the way for profit making activity. You win bet the company litigation by....winning. The cost of legal services, even at hourly rates, are negligible compared to the profit making ability success unlocks (or unlocks the continued existence of the company, a guy not going to prison). Clients rarely give a shit what or how you charge as long as you win. They will pay whatever "winners" charge. They will only bitch about costs if they percieve themselves to not be winning.

You cant talk about this as if legal work is the same. That's probably why you percieve a disconnect as an outsider.
You could take a look at System Theory https://en.wikipedia.org/wiki/Systems_theory and especially the works of Niklas Luhmann. It doesn't touch the topic precisely in the way you are thinking about it, but it might give you some concepts and terminology for further development of your ideas.
That's all pretty low. You could build ten storey building everywhere in London and have enough demand to sell them profitably.
If the person who kills you is caught and prosecuted, it's almost like you're not even dead.
You're ignoring the parts where they have several hardcoded byte/unicode strings.

Otherwise just convert to and from when saving and sending it to network
>20 years on, and nobody has ever found anything signed with this "NSAKEY".

Hm, wouldn't Microsoft make a proof by singing something publically with a private key?
It was for crypto specifically, to enforce export controls.
It isn't - in that blogpost, Google describes:

"However, one form of phishing, known as “man in the middle” (MITM), is hard to detect when an embedded browser framework (e.g., Chromium Embedded Framework - CEF) or another automation platform is being used for authentication. MITM intercepts the communications between a user and Google in real-time to gather the user’s credentials (including the second factor in some cases) and sign in."

In other words, the OAuth sign in is intended for applications which want to access the Google APIs in some way.

qutebrowser (as an application) doesn't need access to your Google Account in any way. It doesn't care about your Google authentication data, and it doesn't use Google APIs.
Safari tried to do this but had to walk back some of their changes: https://bugs.webkit.org/show_bug.cgi?id=180365. Currently, it reports the marketing OS and version of Safari truthfully, while lying about the bundled version of WebKit. For example, my user agent is "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15", but I am running Safari 13.1, WebKit 15609.1.13.4 on macOS Catalina 10.15.3.
Us companies are also not allowed to export software with “pluggable crypto modules”.
I'd wager that there's a high probability that an arbitrary engineer tasked with implementing things like this either doesn't care or is antagonistic, thereby calling the duck a duck.

Also, the name was never supposed to be known - it was due to early releases mistakenly having debug symbols included.
Software Rot – Why and How It Goes Bad
Related to this, I almost wanted to mention the “sins” of the major platforms.

Android: not fixing fragmentation after all this time. Essentially, people with less money get less security.

Apple: not making true budget phones with the same lengthy support windows, though this might change as they emphasize services.

Microsoft: leaving the smartphone market entirely. I used to use Windows Phone and it was clearly better than Android. Android was slow and getting updates was a pipe dream. Windows Phone was like a less locked-down iPhone, and around Windows Phone 8.1 the app marketplace wasn’t half bad.

Had Microsoft put out quality flagship phones consistently on a yearly basis on all four major US carriers, they’d still be making smartphones. But people who wanted windows phones were stuck waiting for Microsoft to reorganize Nokia while they mostly crapped out budget phones and had one or two outdated flagship exclusive to a particular carrier.

Windows Phone 10 arrived too late, it wasn’t as good of an update as 8.1, and it arrived after a long drought of phones.
This does kind of imply that technology is to blame. I get what his piece is trying to say and it wraps it up quite well by the end, these are social (American) norms that must be fought with. But technology isn't the culprit. It's just also not to be expected to ultimately relieve the number of hours we work.
UW being University of Washington? I transferred into UW CSE from N Seattle Community College as did many others! We had maybe 3.7+ GPAs in community college and intro courses overall.

Private like ivy leagues didn’t make sense for me then because tuition assistance was so poor. Unless you’re super highly ranked and can get a ton of merit based scholarships that was a bad idea anyway.

However, it’s perfectly reasonable to work hard in undergrad as a researcher and student then make your way into the top tier. James Mickens is a great example of this path. This is obviously not for everyone but neither are private world acclaimed universities.
Shog9 (Josh Heyer) Has Left Stack Overflow
This is a backwards step, I get the user agent is revealing things it has no right to like os, but not all browsers are made equal I need to know what its capable of.
Because the lens of American society has moved beyond the acceptance of overt discriminatory practices in many areas, and business moves with societal expectations to capture money.

Now, go tell a realtor you want a house in a low crime, quiet neighborhood with highly rated schools and they'll know exactly what you are looking for. Or tell the hiring manager that the candidate you interviewed may not "fit well with the team" and that they should keep looking - they'll get it too.
That failure is ok. As a software developer, you are going to receive all the smoke. Whether failure means missing some arbitrary deadline, delivering something that doesn't meet requirements, has bugs, is not extensible, or not delivering at all. Obviously, none of us want any of that to happen, but it's a reality you will face at some point in your career. Your management probably does not care about the myriad of challenges that led to failure and will shift the blame to you to save face for themselves. Doing your best is all you can do. Failure means you are challenging yourself and working outside of your comfort zone, and this is where growth happens. Be honest with yourself, and honest with your team. You can take responsibility for your actions, but there are so many variables which you can't control. From poor planning/management, legacy systems, infrastructure, tooling, unrealistic deadlines/deliverables, funding, initiative, the work of others. These represent systematic issues that have their own inertia, and expecting them to be solved by a single overworked developer is simply asking too much. Learn to recognize when too much is being asked and say something. Recognize all the variables which you can't control. If you have a solution, go ahead and propose one if it is one that you can implement with reasonable confidence, otherwise, leave it to somebody else. Sometimes the hardest thing to learn, is learning what NOT to do.
In that case, why was it the backup key that was named after the NSA, and not the key that was actually used for this purpose in practice?
Exceedingly so. I used to really enjoy pg's writing back in the day, but now I find it myopic, stunted, tone-deaf, and predictable VCese, regularly oversimplifying (either out of ignorance or willful avoidance) the most important failure modes that any given controversy would raise. You see him double down on this with his handwaving regarding Away's CEO.
My user agent is "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1 Safari/605.1.15". Clearly I'm running a repackaged Firefox browser?
Sorry, no. Very proprietary medical device. (And, really, you wouldn't want it. Really. shudders)
Definitely not. Companies may lobby or argue on their behalf, but the Supreme Court justices are solely responsible for interpreting the law and ruling on the case.
I would highly recommend reading the book "Finite and Infinite Games" by James Carse
You're very right. What I was referring to was actually relative to the external world. IMHO it's easy to fall in the trap of seeing investors as "antagonists" you gotta win over, ready to spot any weakness even AFTER investing in you, but in truth, they're actually really rooting for you.
With the major exception of vested employees, there's no one else that will root for you as much as they do
> With this new standard, just ask the user agent to include all details in its Accept-CH header.

That becomes an explicit choice by the site to request more information, it's up to the client/browser how it responds to that. Fewer bits of information are exposed by default.

> JS won't have access to it anymore - TFA wants to deprecate navigator.userAgent, so only the webserver would have access to user agent details? Why?

I should have linked to the top-level repo with the explainer (https://github.com/WICG/ua-client-hints) as it's not immediately clear from the spec, but access to the hint values is provided via getUserAgent()
Nadella has just said that he would support a "don't-call-it-a-backdoor" backdoor key for the U.S. (and I assume other) government(s):

https://www.theverge.com/2020/1/13/21064267/microsoft-encryp...

Also, there are at least several other instances that make Microsoft highly suspicious in regards to this stuff, starting with:

- how they bought Skype not long after the NSA was promising billions of dollars (in government contracts most likely) to the company that would bypass Skype's encryption somehow

- changing Skype's architecture to be intercept-able

- Skype entering the PRISM program the moment Microsoft bought it

- some other suspicious "bugs" and design choices in regards to how Bitlocker works, including storing the encryption keys on its servers or defaulting to break-able OEM encryption. Plus the fact that you never do hear about law enforcement being thwarted by laptop encryption

- silently adding root certificates in Windows with no official documentation, some for some oppressive regimes, other for the U.S. government

- Not to mention that the first thought that came to my mind after hearing about all the hidden tracking stuff built into Windows 10 was that Windows 10 must have been designed based on a FBI/NSA wishlist.

If you've ever done anything "wrong" on your Windows 10 machine, the U.S. government will know about it, because Microsoft will know about it. At least Microsoft revealed to us that half of the government's orders to the company were secret and came with gag orders -- too bad they never really fought the government on it and ended-up supporting it with the Cloud Act.

There are probably others I missed myself or forgot about. Nadella must think of us all as idiots if he thinks we'll buy the idea that a specially-made encryption key for various governments doesn't equal a backdoor.
That isn't unique to Python.
Tesla isn't selling 1.3 million cars per year yet like Ford, so yes, optimistic. I wasn't speaking about strictly the EV market. Why would the big automakers need to compete in the EV market when EV adoption numbers still only amount to a rounding error in terms of the big companies' overall sales?
Copyright Notices in Open Source Software Projects
Kind of ironically, pulling out 3 anecdotal examples of well-known system failures doesn't make a very high-quality argument that most things being done sloppily most of the time doesn't usually work out fine. The real argument is, that while those 3 things were happening - and the War on Drugs goes back ~100 years - roughly 3 billion other things were also sloppily done, and most of them worked out well enough.

If it didn't work, we would all be starving and dodging lions in a jungle somewhere, instead of writing posts on an internet forum about how a few well-known things were sloppily done, yet didn't really cause that much damage in the great scheme of things.
Everyone loves a good conspiracy. It distracts us from the real world of carelessness, incompetence, laziness, and lowpriorityness.
Why do we tip the server and not the chef?
> and one's competence doesn't matter at all

This is, thankfully, not true. The truth is that you need to have some baseline level of competency to survive in corporate world. Sometimes it's quite low (for scrum masters, business analysts etc.), but still, these people know a lot more about software than say random person from the street outside the building.

The sad part is that, beyond this baseline level of competency, further competency does not help nearly as much as the being good at company politics.
The idea that if you pay for a service they won't probe for, exploit, and sell your data is a fairy story where companies leave money on the table because they decide they have enough money. The data of paying customers is worth even more than the data of deadbeats.
I don't think this explains the last decade. There is also keeping up with the Joneses, which I think social media has driven people into a rabid spending rage that turns most into debt slaves. Stone kitchen counters and floors, designer Italian faucets, brand name toilets are just the home renos. These are so far beyond a typical home in the 90's, but you wouldn't want that background in your Instagram or Pinterest.
Precisely that sort of monster! You got me ;o)

"We" clearly do.

[I'm also in UK, fwiw]
Hijack Windows Update on the infrastructure level and you're good to go, basically.

All it takes is compromising the ISP, the DNS provider or the local network admin.
I sympathise with your wife's predicament. Good or sub-par treatment, doctors still get paid.

If you're not opposed to eschewing professional recommendations to not complicate treatment, there are two things that may be worth looking into:

1). Metformin: Helps control blood glucose by significantly increasing sensitivity of insulin receptors, i.e more glucose is shuttled out of the blood stream per insulin molecule. Not scheduled and very cheap. Also trials are being done on it for cancer prevention -- exactly because of Warburg's phenomenon (cancer cells and glucose)

2). Ketosis: Hit or miss. By abstaining from carbohydrate consumption, the result should be drastically reduced blood glucose levels. However, in some people (e.g type 2 diabetics) it may elevate blood glucose due to metabolic disfunction. In any case, caloric restriction in general have the effect of both increasing insulin sensitivity and decreasing blood glucose -- regardless of macronutrient profile
I am not an economist, but I have read many times that one of the consequences of prolonged inflation in Brazil was that businesses got hooked on (and very good at) investing their money as opposed to actually making things and selling them.
This sort of fake it till you make it incorporates passing the hot potato as well. Someone will get left holding it and burn.
Don't don't.
Safari is a broken mess, I have to detect and fix it more than any other browser, makes sense they would make it even more broken.
It turned out to be un-sellable, not even one unit sold. It was smooth and pretty but everyone was already used to the choppy but crisp and fast CRT block fonts and static character arrays of the era for text apps. AutoCAD people were already used to the characteristic 'redraw and blink' stuttering behavior of other computer brands' graphic cards and high resolution displays, which typically displayed on their own additional monitor.

With its extremely high price point and crude software available Lisa was unable to win anyone over.