skysight-inc/HackerNews huggingface dataset:
Show HN: Startup Risk Framework (Copyable Notion Template)
Without hearing his side, I am skeptical. It might be he didn't disclose because he knew that he'd be penalized for taking money from his home country. I don't know, but my skepticism when it comes to "national security" and nations they want us to think of as the enemy requires an extremely high bar.

edit: sorry got the scientist's nationality wrong.
Tiger Lake Chromebook in the Works
Red Hat vs. SUSE vs. Canonical Contributions to Mainline Linux Kernel over 10y
sebastien_b got my point -- we paid for advertisement and that resulted in reviews. Why is that hard to believe?
I'm using the Samsung Chromebook Pro, which is getting a bit old itself. While I like the stylus and the screen, I can't wholeheartedly recommend the device -- while it might come further down in price soon, with Samsung apparently prepping a new ChromeOS 2-in-1 [0], it still doesn't have Linux apps outside of Crouton. My understanding is that Crostini requires some code that's only available in the 4.x kernel, and -- unlike the ARM-based Chromebook Plus -- the Chromebook Pro uses the 3.x kernel. I'd heard rumors of backports last year, but they haven't materialized. And, in ChromeOS, I sometimes have random reboots, and UI bugginess when I switch aspect ratios or between laptop and tablet mode.

[0] https://arstechnica.com/gadgets/2020/01/samsungs-1000-galaxy...
Hey HN! I'm a 2x founder who is testing out a new way to consume content. I created a framework-driven approach to help me internalize and archive what I'm learning and reading about startups and tech. I love using frameworks, and Notion makes it really easy to make (and share) them. Let me know what you think!
Customers need invoices, A/R tracking, recurring payments, line items on an invoice, billing for multiple entities, adhoc products/add-ons - a billing system and a way to process payments are separate things.

I believe Stripe does more and more of this stuff, but it isn't cheap and in our experience Chargebee has perfected a lot of that functionality.
I tested this exploit against an unpatched OpenBSD 6.6 machine and it works with the default mbox delivery, but not with maildir delivery (as hinted by the syspatch message). So if you use maildir delivery like me, you weren't exposed to this security hole. This is the sound of the world's quietest sigh of relief. I have some questions:

Is Qualys getting paid for this excellent work, and if so, by who?

Is there a plan to do a serious audit of execle related code in OpenBSD?

As a longtime OpenBSD user, I gotta say that OpenSMTPD is the part of the system I'm least comfortable with from a security standpoint. Too many rewrites, mulligans, CVEs. Very little of the web howtos match the official documentation because there's so much churn, which by itself is a red flag. And even without a logic bug, I'm surprised execle was used at all here. It was unnecessary and naive. I'll be honest, I'm in the middle of transitioning from qmail to OpenSMTPD, and this bug is making me consider notqmail.

This RCE is trivial and super bad.
Real users made those reviews. You're twisting my words. Marketing is how you get users in the app on the first day. We did launch day advertising. It's normal.
> and then (according to the botanist on his ship Georg Forster) engaged in pedophilia, raping the children they found

Citation needed for claims Captain Cook raped kids.

> And the use of "Polynesia" again.

Polynesia is a well established area, google Polynesian triangle to learn more. Yeah, there are three main language and genetic groups in the Pacific - Micronesian, Melanesian, Polynesian, but the Polynesians are the focus of this article because they're far more widely dispersed.

> The greatest sailing vessel of all was the Drua, developed in Fiji by Melanesians

No doubt. And it was rapidly adopted by the Tongans, Polynesians that had regular contact with the Fijians. Much how the Polynesians rapidly adopted the sweet potato of South America. The fact that they built a big ocean going canoe does nothing to detract from the navigational exploits of the Polynesians.
I personally think "information wants to be free" (as in no money) is a major cause for why the Internet went so bad in so many ways. Since everything has to be free, the only possible business models are those that revolve around monetizing the user or are otherwise deceptive and indirect.

This created and bootstrapped the whole surveillance capitalism and "adtech" industry. Instead of paying for information we have people paying to manipulate us via free media built to be addictive.

I'm sure some of this would have happened had the Internet possessed a payment mechanism and people willing to pay for stuff, but it would not have become the dominant model for everything nor as pervasive.
I tried this on my smtpd but I couldn't make it create a file. At what point would the command get executed?
None of those things had meaningful impact - either at scale or in newsworthy level awful for a smaller group... without that, the story wasn’t sticky and didn’t scare the masses.

E.g.: When a wave of echo users are blackmailed after their private conversations or sexcapades are snooped on, then you’d see outcry.
I remember just a few weeks ago there was a story on HN of a Russian scientist working on a government project "sharing" some research on hypersonic weapons with a NATO affiliated university somewhere in Europe. In the thread there I said a US scientist would get his ass thrown in jail in the US under the circumstances, which was downvoted.

It will be interesting to study the difference between that case and this one. So far the tone I'm seeing here is markedly different, and most people seem to be justifying the position of the DOJ.
Hype is truly a double-edged sword, and its surprising to me that companies are so cavalier about it, especially in the gaming industry where the consumers are so brutal and unforgiving.

Stadia is an amazing technology... and a fine product. Just fine. They go into marketing this thing with guns blazing, positioning it as the future to play games and the one-stop-shop, they better back that talk up hard. Stadia hasn't (yet). It very much smells like a disconnect between their business/marketing and the product development.
I've been using Pin since very early days. Dev experience is great, the API is well thought out and documented.

Your fear about Pin being bought by an Australian financial institution may be unfounded (or it's already happened depending on your perspective). Back in the early days, it was fairly well known that National Australia Bank was a part owner in Pin, but I can't find anything to support that now. NAB is listed first on their partners page (https://pinpayments.com/company/partners) and their Terms of Service (https://pinpayments.com/terms/national-australia-bank) are a 3 way agreement between NAB, Pin and yourself.

I'm sure it would be worse if Pin was fully absorbed into NAB though.
TIL no one knows why it is called a Picardy Third.
I broadly agree with this approach. Automated functional end-to-end tests may not pinpoint what line of code has an issue but they will identify there’s a problem somewhere which is better than not knowing. Your product code and tests can be setup to help isolate where the source of the issue may be. Have developers continue to write unit tests but if you’re big enough to it have one developer focused on writing end-to-end automated functional tests it will give everyone a sense of assurance at each release that nothing is fundamentally broken. If you’re not big enough, like the parent comment said, try to do the major ones eg. sign up flow, core functionality.

Someone else made the point about using data effectively and I agree with that too. I’ve been involved with automated testing and tooling for a few years now and solid test reporting and test case management is something I advocate. I’m the lead dev and founder at Tesults (http://www.tesults.com) - try it and push your results data to it and house your manual test cases. There’s a free tier and if you contact me I’m happy to expand it. Basically if you set up your CI system to run your tests regularly, or even if you schedule them to run regularly (E.g. nightly/daily) then having something like this boosts your ROI because you can track history easily, link bugs, and do things like get indications about which tests may be flaky.

We don’t know exactly how small your team is, it may be you have to rely on manual testing if there’s no one to spare but I’d try to move some of your end-to-end to be automated sooner rather later if you end up growing otherwise you’ll make testing a bottleneck to releasing, full regression testing of even a moderately complex application can end up taking days.
I question your example

While airbags functioning properly with a properly sized adult reduce trauma, that's a lot of conditionals.

Seat belts conquered ejection and death, but people still didn't wear them, so active restraint and airbags became policy to have at least their 13% chance of being effective.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4366828/#sec1-1...
I use Stripe and PayPal. PayPal accounts for about 30% of my revenue. As another data point, I get easily 10x more requests for Stripe integration on https://divjoy.com than all other payment options combined. Devs overwhelming want to use Stripe.
> It might be he didn't disclose because he knew that he'd be penalized for taking money from his home country.

?

“Charles M. Lieber (born 1959) is an American chemist and pioneer in the field of nanoscience and nanotechnology.”
Many many projects are DoD funded and have little to nothing to do with immediate military applications. China is a threat to US hegemony in its own backyard, but to state that China is a threat to actual US citizens is kind of absurd. We're over there, they're not over here!
We did not buy any users that is a misinterpretation of my point that we have reviews on day 1 because we paid for advertising.

Our app doesn't mine on their phone -- phone mining is not profitable at all.
Pedantic: Linus’s
From Gruber you get that "this thing will never flourish outside of the niche markets its found itself in"? That's far from what he was trying to say.

From his concluding paragraph: "[G]reat though it is in so many ways, overall [the iPad] has fallen so far short of the grand potential it showed on day one. To reach that potential, Apple needs to recognize they have made profound conceptual mistakes in the iPad user interface, mistakes that need to be scrapped and replaced. . . "

How you get "never flourish outside of niche markets" from that, I have no idea.
It's helpful to think about pure forms, sometimes, even if you completely understand that the real world is all shades of gray. You don't have to be wielding them as "the enemy of the good", just trying to understand the different components of what you're doing.

Explicitly mentioning that the purest form of retribution would be torture is (IMO) a way to argue that this ought to be a smaller component of what we do. Being sent to prison by definition involves a loss of some freedoms, it's not going to be pleasant. But exactly how unpleasant, this is at least partly within our control.
The conspiracy theorist in me can't help but wonder if "leaking" forged documents of this nature could be an effective way for China or another foreign government to sabotage the leaders of the American research enterprise.

Of course, my inner cynic is leaning pretty heavily towards Occam's razor for this one.
Well, they should let that (units sold) number decline on the public disclosures...

Reducing investor visibility into a publicly traded company when numbers start turning negative is a huge flaming red flag.
WireGuard operates at layer 3. The first sentence from the white paper by Jason A.: “ WireGuard is a secure network tunnel, operating at layer 3...”. [1]

Regardless of the layer, in a few words WireGuard is a simple encrypted tunnel over UDP. Since it’s UDP - there’s no guarantee all packets will be delivered, BUT - what WireGuard places emphasis on is all packets delivered from the WireGuard interface will be authenticated and encrypted. Similarity if packets are received from a particular peer, replies to that IP address will be guaranteed to go to that same peer.

The best feature of all imho is OpenSSH inspired authentication - makes configuring server/peers really straightforward.

References
[1] https://www.wireguard.com/papers/wireguard.pdf
And thanks to python... devs dont know anything about IT either... import ml, import scikit-learn, import pandas, why is my pc out ram when i try to load 4gb of text into a data frame?

[Angry sysadmin will show himself out now]
That would be very appealing to me. (Not sure what you have in mind, but it could also serve as a backdoor into freehand note capability, as it does in Xodo -- you just make your stylus input on a blank PDF page...)
Nor did I. But I bought a PoE switch for my garage and installed one near my Front door, two pointing at my driveway, and one pointing at my fence door. PoE is just cat 5 cable, it's considered "low voltage" so you can just run it where you need to. It's much easier than trying to running normal power, which you'd need to do for a wifi connected camera (unless you want to regularly replace batteries).

It's a nice clean mount, I just use the template, drill a 1/2" or so hole for the PoE cable, and then 3 screws to finish the mount. It looks nice and clean, works great, never runs out of power, and is never impacted by the random Wifi issues.

Sure it's a pain to run cat5 everywhere, but I haven't found a better solution, none of my camera locations had power.
Stripe.

Love the developer friendly aspect, and their customer service is awesome.

Due to a misunderstanding[1], they believed our service violated their TOS. Stripe offered us a week to migrate AND suggested a competitor that allows those types of Txns.

Luckily, with a message to Customer Support (via Twitter) we resolved the misunderstanding and never had to migrate.

Also worth noting, the issue was addressed on a Saturday.

1: Stripe mistakenly thought we were doing online prescriptions.
WireGuard is absolutely fabulous. I route all my traffic from a couple servers at home to a small GCP instance (don’t want IP to be public) and I added my laptop to this WireGuard network (although technically a peer) and I can ssh into it remotely.

I’m serving a 1,000,000+ page views a month through WireGuard and can’t say anything less about it it.
You should find something that your interested in. My first project was Mixxx because I was interested in DJing. This doesn't have to be hobby related, it can be something that satisfies an intellectual curiosity.

Contributing to OSS is a bit like working out, when you get into a routine its easy but starting is very difficult. The trick is to just start.
Five minutes (refil time) is pretty damn good for that Hyundai! And the range is also far better than I would have expected.

Fuel cell wear has also taken great leaps forward, as you've said.

And so it looks like that (5 year old???) post is now rather out of date. Tech moving faster than expected!

But the last claim, about hydrogen being hard to make and distribute with low losses? Your link has nothing to do with it. "We're reducing production costs by 60% over the next decade, says the industry hype group" is nice and all, but it doesn't address distribution and storage. And in fact the use cases they're listing largely avoid those concerns by (afaict) colocating the production with the consumers.
Good. I really hope Stadia fails. Gaming is one of the major drivers of continued demand for "real computers" at the edge. Take that away and we'll lose even more momentum there.
Thanks for the tip about needing the official CDN!

It's /etc/installurl not /etc/updateurl.
Lini?
This is really interesting. Are you using concepts from self-sovereign identity¹²? Do you think there is a relevant intersection?

¹ http://www.lifewithalacrity.com/2016/04/the-path-to-self-sov...
² https://w3c-ccg.github.io/did-primer/
Still thinking pretty loosely about the trust space, but a few conclusions on my end: LinkedIn is frustrating because people connect even though they don't know each other very well. I spend a lot of time meeting up with strangers (Craigslist, meetups, dating) and generally hoping that the world is good (though it pretty much always turns out to be). Phone number seems to be something that people only exchange when they have a fairly meaningful interaction - could that be used as a way to show you know someone/vouch for them? I feel like there's something in that space that would resonate with a lot of people.
A truly anonymous anti-social network and an anonymous but verifiable identity to go along with it.
We don't mine Bitcoin on users resources this is a witch hunt. I have nowhere mentioned mining and our app does not mine. Mining only works with huge ASIC farms mostly in China with cheap power. We are not involved in this at all.

Our app has ads, like many apps do. That's the primary way we make money. We give users loyalty points for playing the game, they can cash those out for a very small amount of Bitcoin that is it.
Google vs. Oracle: Innovation’s Delicate Balance
PPS means Packets Per Second. Here’s a press release from the FD.io project (“Fido”), take it as you will: https://fd.io/latest/singles/kubernetes/
There are lots of people who use Excel spreadsheets as databases. Just as there are lots of people who use Word for nothing more than editing (sometimes rich) text.
Little bit silly about how on one end people stand united with gamedevs about the poor work/life balance and excruciating crunch time, yet they will complain when a company doesn't release any update during the holidays.
That would be pretty straightforward to dismiss with full transparency by the alleged perpetrator. There's definitely going to be corroborating evidence.
True for any app company really but true it's a weak point of our offering at the moment. Startups tend to rely on another product early on, then de-risk as they grow which is our plan.
If you comply, then you risk losing the money (what if it was a scam?) versus the benefit of avoiding jail.

If you refuse, then you risk jail (what if it was real?) versus the benefit of keeping the money.

If you get a scam IRS call, then refusing is correct. But the risk-tolerant person considers the alternative: the potential for benefits of compliance over the risk of compliance; they might think "Could be a scam... but I'd rather not go to jail!"

If you get a real IRS letter, then complying is correct. But the risk-tolerant person considers refusing and benefit of keeping their money; they might think "Could be a scam... I'm not paying!"
Also, you may want to add that when it's patched, the response to the MAIL FROM command is:

553 5.1.0 Sender address syntax error
It's a bit lame that you're being downvoted, but no, viruses aren't much of a concern. That line is more Apple fear mongering than anything else nowadays, generally speaking.
Ask HN: Self employed owners, what are your tax saving tips and tricks?
I run and own a small DevOps consulting company operating as a single member LLC (disregarded entity for federal tax purposes). What are some federal tax saving tips and tricks (of course all kosher and legal)?

- I use QuickBooks Self Employed and keep track of all deductions such as travel, office space, computer equipment, software, hosting, food, internet, cell phone, car miles and lease, etc.

- Opened and fully fund (up to limits) a SEP (Simplified Employee Pension Plan) each year.

- Currently rent so can’t take advantage of any home owning deductions.

- Single, not married so none of those deductions
I dont know why you're being downvoted. It is a vpn protocol, just like IPSec, with the main difference being its much simpler, and hence "sucks" less.
An irritatingly large portion of websites don't let you put + in email addresses.
Indeed; various communities around the Pacific are working on continuing this tradition.
Jonny can't troubleshoot.
"Side-piece" as a concept has existed for a while. I don't think coining that term has any meaning; people have been compartmentalizing their dalliances since the dawn of time
> Explicitly mentioning that the purest form of retribution would be torture is (IMO) a way to argue that this ought to be a smaller component of what we do.

Why should it be any component of what we do? You don't have to be religious to recognize the need to call it unacceptable as a basic societal principle.
Rust Lang in a nutshell
I dare you to try doing a withdrawl while overseas. You may have to prove you're not where you are before they'll reinstate your account.
it could be faster with a hardware chacha20 implementation. if wireguard gets really popular, we might see that eventually. I'd wager a guess that we would get hardware wireguard first though, with fast path acceleration, similar to hardware TLS.
What kind of treatments make that 28% "unnecessary?" Regular cleanings too frequently?
I'm sorry, but 4 weeks, 2 of weeks were the holidays, is by NO means "not supporting their products". What company releases an update faster than every 4 weeks?
| All because I can't get a 3DS game to load modified videos

You were trying to load VR porn on there, huh?
I am building an encrypted file system that runs inside application (https://github.com/zboxfs/zbox). It focus on security, privacy and reliability. The interesting part is it can utilize different storage, such as memory, OS file system, RDBMS and object store. I learned a lot and enjoyed working on this project.
They're not over here - yet. Never in the history of the world has there been a surveillance state like they're building, there's no telling how effective it might end up being.
You're correct we did not buy reviews, what I meant is that we paid for very targeted marketing on day 1. We did not buy reviews EVER.
>They go into marketing this thing with guns blazing, positioning it as the future to play games and the one-stop-shop, they better back that talk up hard.

Yes they better because their advertising was at best misleading.
What exactly is the Chinese “threat” here?

Are they going to send a nuclear-powered aircraft carrier loaded with soldiers to invade the shores of Seattle and Los Angeles? And then claim the mainland United States as their own property?
This was my main concern when Stadia was launched. I knew that Google could figure out the tech but their product development and customer support would be their Achilles heel, especially when it comes to gaming. Gamers go all in with their passion and if you as a company aren't heavily* community oriented, their passion can quickly turn destructive.

* Their reputation for prematurely closing down products too but that's not something they can directly affect.
Except the 2nd most popular post on /r/Games is about how Artifact hasn't had any updates in over a year now... So 4 weeks in the middle of the holidays seems a lot more trivial.
You can actually do much better than mere embeddings. Using program translations similar to what Haskell users routinely perform when using the do-notation for monads, you can actually extend your type theory with new reasoning principles. See for instance the parametric exceptional theory [1], which adds well-behaved exceptions and allows to extend Coq with the independence of premises, i.e. (¬A → ∃n:ℕ. P n) → ∃n:ℕ. (¬A → P n).

[1] https://hal.inria.fr/hal-01840643/document
You could always use a userspace implementation of WireGuard like https://blog.cloudflare.com/boringtun-userspace-wireguard-ru... . I imagine the advantage of the kernel module is good performance for normal users who are not trying to wring every last bit of performance out of their network setup.