skysight-inc/HackerNews huggingface dataset:
One of the best signs a crash is imminent (say within a couple of months) is when your family members start bragging about their stock holdings at parties. That's the time to get liquid if you haven't already done that by then. Of course that means you're indirectly still trying to time the market but at least you'll err on the safe side.

I've earned a fair bit of money trading and would never put it down to anything but dumb luck and having enough reserves to be able to sit out the worst. If you're trading with money that you need you're doing it wrong.
Amazing stuff. I'm really into the idea of using spreadsheets as a front-end for these kinds of things as most people already know how to run them.
https://rentee.app

It's for renting apartments, houses and rooms. We failed at marketing. You can publish, search by place, monument and whatever you want.

Our idea since the beginning was to learn and be able to deliver something (with some friends). Next steps are to learn more about growing communities and publicity.
Mine failed before I could really launch it. Basically, I wanted to do a financial app to help people get out of debt, but the company I was going to use changed their fee structure just before I launched, causing transaction costs to eat all of my margin.

I may try to relaunch if I can find a good partner, but it just seems the anything related to finance is going to be a huge pain. I'm currently looking at other options.
Dreadful may be a little strong but anytime I've tried to implement something like asyncio for a non trivial piece of code it becomes pretty obtuse. (imo)
> This isn't a replacement for webpack yet as it doesn't have a full featureset.

And yet you present it as such.
This one is a shameless plug (I created the app) while it's still in early stages of development, the core features are working, I use https://github.com/rmpr/atbswp to automate demos, whenever I have to present a demo in front of people, I just record it before and replay, but the app can have many use cases beside this. You're only limited by your imagination.
StarCraft 1 had Tower Defense maps as well. Much more cobbled together than what you could do in WC3, but impressive given the limitations.

https://www.youtube.com/watch?v=aeuNWZXN6RI
This is exactly what Safari deciding to arbitrarily not trust valid certs is.

The de facto standard will be that you will need to accommodate the least tolerant user agent if you want your certs to work for all browsers.
There is ample proof of a connection to bats, including a 96% similarity of SARS-CoV-2 to a sampled bat coronavirus in Hubei province. Numerous papers, with ample evidence in that direction. Just not enough to speak definitively and categorically.

There is --zero-- evidence of a bioweapon.

So it's better in the sense that it's reflective of reality, which also happens to not inflame international relations at a crucial time.
The kickback is because the flow is uncorrelated with the market, not because the execution is worse. Robinhood would never be able to execute better than a good market maker. Ever.
If I had to rewrite something from scratch several times I would get very bored and the quality would probably go down. Better to refactor.
Ask HN: Why is there even a DNSSEC root key?
I'm wondering what's the point of the DNSSEC root key.

A) If we want to verify that the owner of a domain created a DNS record, why not go through the same process as wildcard TLS certificate issuance ?

Verify ownership of *.example.org
Why do we need a new trusted root key (moreover issued in the US) that takes precedence over the bundled (OS/browser) trusted CAs ?

B) If your computer runs a local resolver or goes through a compromised network, can the compromised network replace all the public keys in DNSKEY response (including the answer for root) and make your computer believe that the DNSSEC record is valid ?
People often confuse knowing things with being smart. It seems useful to me to ask questions that sound on the face of it like things nobody knows, but can actually be figured out based on knowledge everyone has, because it reduces the elements of chance and bias from testing arbitrary knowledge.

When someone says they hate "logic problems", it sounds as though they're talking about this:
https://www.pennydellpuzzles.com/products/logic-math/origina...

I don't like those either, but I doubt they are used in interviews.
To build on that further, if you only have $100 in your existing account to invest, you're may not think it's worth it to buy a stock if 35% of it is going to be eaten up in fees.

But if you can suddenly invest 100% of that $100, then it's far more worth doing.
A friend was trying to convince me that high frequency trading was a good thing because of the liquidity it added to the market would allow me to sell my stock in milliseconds. If I've been holding a stock for twenty years, when I go to sell it, do I really care if it takes twenty minutes instead of twenty milliseconds? From the look on his face it was obvious that in his world investing in stocks long term is completely alien. Can't be too hard on him though, he did warn me of the Great Recession months in advance, with problems he was seeing in credit default swap pricing being what he considered the Archduke Ferdinand of the financial system.
Nice resource. Thanks for the recommendation.
CAs have always been third-party services, though. Their APIs just used to involve humans talking to humans, rather than machines talking to machines. But that's no less of an operational dependency.

In a systems engineering plan (e.g. a NASA long-term project), both kinds of dependencies are considered liabilities that must be engineered for long-term reliability, fault-tolerance, etc.
Spares Outlet - selling home appliance parts salvaged from used washers/dryers/fridges/ovens. I even developed testing methods that don't require the control board to be on an actual machine. It's the hardest part to test properly, I wanted my buyers to get a fully working item that would last. Returns would've really cut into profits, too.

That and using intrepid Russian hacking/engineering to make most control boards compatible with any model (essentially a firmware reflash, but by God do the manufacturers make it hard).

Really proud of it now, it helped hundreds of people and small businesses while being as environmentally friendly as it gets - all of those broken appliances were headed for landfills in third world countries, and I feel like I actually made a difference.

Failed because of my departure from the UK and losing those suppliers. Looking at finding new ones, so far no one wants to work with me, they either sell refurbished complete units or just send all their scrap to landfills. Easier, I guess.

Not finding a partner or any employees was a huge part, I even automated replies for buyers - based on specific keywords, it would reply stating availability of parts and delivery time. Again, proud of that, but having more people working with me would've been better.
Yes but what we have now is also absurd.
One day I can visit a site just fine and the very next I can’t and the browser won’t even let me override the “invalid” certificate.
Considerations When Designing Distributed Systems (2019)
I have my own mini-CA for internal stuff, built using the xca[0] tool with certificates and private keys distributed manually. I usually make the keys valid for two years so that I don't have to renew and redistribute very often. Most of this started as a way to learn how this stuff works, but it's now turned into a "production" thing as I've started using this to issue user certificates for VPN authentication.

Is there any tool that I can use to help automate this in a reasonable manner?

Ideally, I'd love to see a web version of xca that supports ACME with some controls on how ACME certificates get issued. Bonus points for supporting OCSP as distribution of CRLs is another upcoming pain point.

[0] https://hohnstaedt.de/xca/
Seems really cool -- what's the unifying idea? It's gotta become my "go to" for some one thing. What is that one thing? My recommendations are: personal or public Journal; ability to make combination timelines with friends (photos/experiences) to "weave"; build it around location with a more tethered approach to specific zipcodes -- now you can host actual meetups via app; dive into the idea of clubs or groups. If it can become the "go to app" for some one thing, it could take off pretty quickly
I totally agree. And I'm currently building a tool to gather all of your data into one database and let developers create a way to interface with it. It solves the problem that you're describing but could also greatly simplify development. Very soon, I'll be releasing a CLI to index all of your data from platforms like Gmail, Spotify, etc. If you want to get notified when it's ready drop your email at https://www.aspen.cloud
Yep. Typing in your credit card info just to have it rejected multiple times is a pain. Click onto free wifi, not so much.
> The latest leg of their emergence times closely with October, when E-Trade, Charles Schwab and TD Ameritrade slashed commission fees to zero.

It also times closely with the most meaningful rate cut by the Fed in five+ years.
Effects of sleep restriction and deprivation (2004)
The effort is very considerate in terms of legality that you are not favoring anyone.

Programming or the fancy name of Software Development has sort of become the new blue collar job.
Holes in Bayesian Statistics
It would be more accurate to frame payment for order flow as: "We get private institutions to offer you better than public prices; so you'll routinely buy each share a few cents lower, and sell a few cents higher than you would at a broker that does not offer this feature."

The institution can do so not because it's a giant scam, but because they have confidence that a seller on RH is not about to sell a billion more of the same name, depressing the price. They know that it's going to be a small and essentially random trade, which is easier to risk manage.
> And email doesn't cut it as an alert mechanism

I wouldn't invest any time in any other alert medium before verifying this. I doubt it brings anything to the value proposition of the product (but I don't know either, so that would need to be verified)
For Apple specifically, I'm not sure which products you're referring to, but Apple does wield a lot of monopolistic power. And maybe some acquisitions there made sense, but there could have been alternative paths (for instance, maybe if some of those companies had stayed independent, they would have been integrated into Apple as well as other manufacturers via a different business model, like licensing, being part of the supply chain, etc). In general, a viable product should lead to a viable business, since the company making the product should be able to capture the value it's delivering... but yes, there are some exceptions where you need products to be really tightly integrated and acquisitions make sense. In fact, I'd argue that with _less_ M&A we'd be more likely to live in a world where (viable product) == (viable company), because the market would be more efficient.

Anyway, my argument for more regulatory oversight doesn't depend on ALL acquisitions being bad, so finding evidence that some were good for consumers doesn't necessarily negate it.

I feel like what we would end up disagreeing on though is whether we can trust regulatory oversight to do a good job of making that decision. I don't trust regulation in general, but in this case specifically, I'd trust it more than giving large companies free reign.
I don't think certificates are a good solution for most websites. Instead have the browser store the public key first time you visit the site. Then ask the user every time it changes, like with SSH. Also browser should send their public key to the server! So that we don't have to come up with a new password for every damn site.
All of your code will be thrown away.
Is Inrupt on a big PR push right now? I just saw an article about them in the FT, and now another.

This quote from the post suggests that the timing of this personal news is externally managed:
“I joined the Inrupt team last summer as its Chief of Security Architecture, and have been in stealth mode until now.”
Any serious Go shop would have errcheck as one of the linters in CI.
That's a good point. There is plenty of seafood that when not dealt with properly will happily kill you or make you at a minimum severely ill. Mussels, shellfish, oysters are best avoided unless you are very sure about where they came from and how they were prepared.

Besides that, due to the liquid environment anything in the sea that is poisonous is usually so in a very potent fashion. Species jumping viruses are rare when it comes to regular fish but marine mammals are a risk.
Ecdsa vs. RSA
> Usually up to around 40% of heap is references.

This blows my mind. I figured it would be non-trivial, but never expected that much.
You probably know this, but one can quite successfully skip the kerosene entirely and just use peroxide as a monopropellant with a silver catalyst.

Presumably Hughes's belief system demanded that all his silver exist in coin form, hoarded and buried in the backyard, or something.
Adding a year of house ownership equates to "lock in"? That's hogwash and you know it. It's obvious that the so-called Prop 13 effects are total BS. You would expect a much more pronounced effect but the per capita number of house sales are in line with other states without Prop 13. There is zero evidence that Prop 13 is the cause of home prices skyrocketing.

Do some people have a massive advantage? Sure, just like everything else. But I prefer to have property tax stability because as I get older, if I get priced out of my house because I can't afford my property tax because Googlers and Facebook employees are raising the house prices, that would be completely unfair.
The bipolar statement is probably more apparent on televised news, but alternating between murder, crime, (fear).. Then rotating to a few feelgood stories is not a healthy cycle (now with new and improved outrage).

You could go your whole life without information like that and not be missing a thing.
Do we even parse all the variable name when reading code? I know I do at least sometimes, because I know how often I am renaming in anger, but a lot of times I just see the IDE default of (in java syntax) "Foo foo; Bar bar;" and I'm perfectly happy with it. The tokens have a certain length that helps keeping them apart visually and they are not outright deceptive. Real life class names can be long, but the IDE even helps chopping them down reasonably.

Good enough naming can be tremendously easy, sloppy even, once you've learned which names don't pass that bar. Where naming does get hard, and where inconsistencies become painful, is when you have too many things that could have the same name.
How? I once went to three different urgent care clinics and two different emergency rooms begging for an Augmentin prescription. I felt a stabbing pain in my gut hours after eating bacon for the first time in 10 years, and I had strong reason to believe Augmentin was the solution. They all refused to prescribe me Augmentin. I even tried bribing a few doctors with two thousand dollars in cash. They all said no. They all insisted I needed a CT scan before they’d do anything else. I finally obtained Augmentin by finding a discord server full of Mexicans who I paid to mail me some Augmentin they simply ordered over the counter there. After a month of extreme pain, I felt fine again 24 hours after taking the Augmentin.
As someone who has been observing the Lambda School news on Twitter for the better part of a year, I just want to state that this student has every right to be angry and frustrated. It might not be appropriate in tone to someone on the outside, but for anyone who has been watching closely, it's clear that Lambda is acted unfettered and knowingly exploiting students.

Not only that, but they are apparently pushing students to join their coding programs prior to completion of prework/entrance tests: https://twitter.com/CHERdotdev/status/1231661150619652096

For-profit education like bootcamps deserve to be scrutinized and regulated. There are real consequences to poor educational outcomes.
I recently built a webapp and tried to avoid using ES by using Postgres fulltext search and it’s working great so far
Look whos talking. Fucking wow.
I mean, in a world with more than an oligopoly of browser makers, that'd already be true given that browsers each ship with their own trusted CA store.

In the original conception of X.509, it was supposed to be an enterprise's system administrator (e.g. a university's IT department) that would define the set of root CAs that the enterprise's computers would trust. So there'd be literally no way to know whether a given user device would trust your certificate. That was supposed to be a choice that is up to them, not something you can pre-guarantee by making deals with third parties.
Thanks, I somehow thought that was at smaller sizes but makes sense of course.
I'm hoping they're talking about multiple legitimate account, held by people that legitimately and individually support what you do.

If not, shame
How about grading the validity of the certificate on a continuous scale? P(site loads) = 1 - R*(days since issue) where browsers can choose R as they wish. This gets rid of this discontinuity.
Thanks @njharman , how does one consider between rewrite vs expand when it is known that some requirements will be true not for the current release but 2 or 3 releases down the line. Would you still prefer rewrite vs expansion? The reason I ask is I got severe pushback recently where I proposed building generic enough components and infra to go along with it that could have satisfied the requirements for the next 2 or 3 releases
Your comment is unfair.

I've been programming for more than 20 years. I've learned many languages including C, Objective C, Java, Python, Ruby, JS, and some Haskell. I've never worked at Google.

Go is my favorite language of them all and has been since I started using it almost a decade ago. I use it for personal projects, and I use it at my company.

It helps me and the teams on which I've worked write correct code quickly the first time. The code we write is incredibly reliable in production at scale. It's easy to read and debug years later. Binaries can easily be compiled and deployed on any system without messing with dependencies or cross-compiler toolchains.

The same properties of the language which helped Google have helped me and many thousands of others as well.
If a candidate is preparing for an interview, they will not perform well at work for no test replicates actual work unless the test can recognize the general skills that a person would rely on day to day basis
There's a huge difference between an HTTP server listening on a port with no obvious "map" of what's available, an ES server that can quickly be explored and its contents exfiltrated with no prior knowledge of the content.
This was posted a couple years ago, but there was no discussion. https://news.ycombinator.com/item?id=17798495

Is that article accurate? Which would you use in 2020?
At least there is a market for it among magicians. https://www.vanishingincmagic.com/close-up-magic/spark-self-...
Preface: So this is just my own opinion, and I would love some more insight to this.

Having read tons of these guides, attending classes for security, and etc... These guides always feel like they are a mile wide and an inch deep. In other words, the scope is extremely broad and the content has little depth. They are great guides for sure... for starting out. I'm not sure how useful they are once you get past the beginning stages. There are many security students in my school who think they can have a successful career in security without knowing the least bit of code. Granted I'm a student, but double majored in security and programming.

It seems that all the people I know who are actually in security actually know how to program and understand the software at a great depth than those who just run through a few of these guides or attend classes or whatever. Of course my perspective is probably more narrow than most since I don't have experience in the field.

I don't know how you can reasonably secure software without knowing how it's made. From my perspective I think that learning to program has taught me much more about software security than my security classes have. So I think the first step of becoming a security engineer ought to be learning to write software.
Shortcomings are listed quite clearly in the README.
> You pay IV on one side and get it back on the other, don't you?

No. You get less on the other side. You should look up Black-Scholes to understand how option pricing works.

A put option's value comes from integrating the underlying lognormal distribution between 0 and the strike price. A spread's value comes from integrating the underlying distribution between the two spread strikes. Both heavily depend on IV (i.e. the sigma of the log-normal distribution).

Also, always think about the guy on the other side of the trade. Why would he sell you a spread cheaply if it's obvious that the underlying is very shitty and volatile? Options are bets on the probability distribution of some asset. High IV means "anything is possible". And if anything is possible then it stands that there's little money to be made on a move like "give me insurance against it going up/down". There is some money to be made on "I can underwrite the risk of it going down/up", i.e. on selling the options, i.e. selling the IV.
That attitude is why I never bothered to learn it. Shortly after its 1.0 release, there were a bunch of "here's the good and bad about Go" posts. I remember seeing a post by Rob Pike on reddit where he said he was tired of people being on the fence about Go, and if they don't love it, they should just learn something else. That kind of "love it or leave it" attitude was prevalent everywhere, and it was a big turn off. It felt like instead of Go being designed as a tool for programmers to use, programmers were the tool, and Go was designed as a way to change them so they'd be better at what Google wants.
Higher math proficiency test for those looking for challenges
In the past browsers did not scaremonger so much about self-signed certs and search engines would index sites that were just http and this didn't effect their ranking.
Yes. Robinhood has made it so easy for teens and college students to quickly open an account and start trading. Literally just click buy, like amazon. Other online brokerages are more complicated and can be intimidating to new traders. A lot of them dont have much money in their accounts, so no fees is pretty valuable for them and the social aspect is big too.
If your prototype only has a couple of buttons (or images you can select, or whatever) - it's faster to hardcore the names and handle those cases explicitly.

A good abstraction requires knowing how you'll be expanding the code (e.g. will there be more images in the future? Hundreds or billions? Or will that feature Y need to be built out?). Building that abstraction right away can definitely slow you down, as you'll be fighting it a lot of the time.
Wait... what are you expecting here?