skysight-inc/HackerNews huggingface dataset:
1) Firewall it before anything else.

The rest is pretty much common sense for anyone used to run Solr and other indexers in production, but I've always been somewhat amazed at finding default setups insecure (a situation that was still largely true when I looked in-depth at the Python clients last year), which is madness considering that the security (authentication, authorization and auditing) docs are pretty good.

So making sure it's only accessible to either localhost or a restricted subnet _when you install it_ seems like the minimum sane thing every sysadmin ought to do by default.

Maybe nobody actually reads the docs...

(edit: typos)
Apparently the IRS was almost done finishing the mainframe to Java conversion of one of their modules and the programmer’s (a PRC national) contract which his visa was tied to expired
I am a Python / Django guy given the choice. Python may be a slow language, but I haven't seen many places where python is the cause of the bottleneck. Rewrite stuff so that the database is doing the heavy lifting, and add the appropriate indexes and you shouldn't have any problems.

SPA's are a pain in the arse. Usually close to twice the amount of code to avoid page refreshes. Usually the apps are way slower than a page refresh as well - with lots of JSON calls to get data that would be in one server side page load.
Thanks for your insight! If not from the seafood market, is it possible to speculate (in an informed way) of what the source may have been? When novel viruses break into human populations, is some form of animal contact generally the culprit? Is something like a bat sneezing near you (I have no idea if bats sneeze) with an airborne virus sufficient to transfer to a human?
When did the phrase “filter bubble” popularize?
While we’re at it let’s touch on how vulnerable nginx is because port 80 is open.

/s
How will that automation verify that certificate is issued to the legal owner of the web site and not a hacker? Are the challenges used by Let's Encrypt secure? For me, automating certificate issuance will lead to less and less verification, to the point where having a valid certificate will become meaningless.

EDIT: to clarify - there are two bad things about Let's Encrypt:

1. It's automated

2. It's free

The fact that it's automated results in less human intervention along the way, which on one hand lowers costs, on the other hand makes it detecting scams harder (unless they deploy some really Machine Learning that detects frauds).

The fact that it's free means that there's no credit card number or other info that would help identify actual person that requested certificate issuance.

Together those things make things less secure, not more.

EDIT 2: Both types of Let's Encrypt challenges look like pushing down the responsibility to either web server owner or DNS service. Maybe that's a good thing, since at least there's one fewer party that can screw things up.
They offer your score(s), but they don’t offer you information about your trade lines or specific information about those trade lines when changes occur.
That's because dependency management at Google is different from how the Rest of the World does it.
Thank you, that clears it up further. I recently saw the movie “the man who knew infinity” and so it got me thinking about this meta questions.
Does anyone know any open source security software that uses AI to search for a particular event? ie: "only notify me when "X" person enters the room, but not my dog"?
Time to sell.
I voted Remain, but the forecast for a post-Brexit Britain is economically positive, at least for the short term.

That's why it's not mentioned.
I understand the reasons behind wanting to shorten certificate validity periods, but CA or root certificates often have expiration periods far into the future. What’s the argument for this? Ease of use? Historical reasons?
https://foreignpolicy.com/2020/01/31/coronavirus-china-trump...

Are you confident in this administrations ability to handle national crisis in light of the funding and personnel cuts mentioned in the above article?

Also, why has the CDC testing so botched thus far?
What do you base that on? I still see a lot of Java jobs advertised (never seen a Kotlin job and not too many for Scala). It seems to be entrenched in the corporate world in a way that it isn't going away soon.
Health care professionals will tend to be vaccinated against flu, so they are less likely to get it, so you'd be looking at a very small population which is why you don't see more deaths.

If we widen this slightly to healthy but unvaccinated 29 year olds we do start to see deaths from flu.
makes one appreciate being a euro.
i dont even lock my car ...
My favorite Chrome extension (share your in comments)
Throwaway Code
Global, but some countries will feel it more than others.
My understanding is that Kubernetes is some of the worst Go code out there.
We moved from one big box to Kubernetes. Now we have a load of kubernetes related problems to fix.
In the JVM space there are now new web frameworks that specialize in Microservices. The advantages they offer are very low memory usage, better performance, fast startup time and finally the ability to generate a native executable via GraalVM [0].

[0] A lot of JEE Frameworks heavily rely on reflection and other dynamic features that cannot be used in a native image.
A thread from 2014: https://news.ycombinator.com/item?id=8811626

2013: https://news.ycombinator.com/item?id=5159884
Silicon Graphics developed a specialized hardware random number generator in 1997, covered under U.S. Patent 5,732,138: "Method for seeding a pseudo-random number generator with a cryptographic hash of a digitization of a chaotic system."

https://en.wikipedia.org/wiki/Lavarand

https://www.wired.com/2003/08/random/

https://patents.google.com/patent/US5732138A/en
As many public health experts and virologists are now pointing out (and as I am sure many at CDC have long realized), there's no way to know if there's community spread without actually testing for it. Current testing capacity is severely limited - which is baffling really, given that Korea is running like 6000 tests/ days now. Part of it is a logistical / technical screw-up:

https://www.politico.com/news/2020/02/20/cdc-coronavirus-116...

For example, if you're a doctor with a case of atypical pneumonia, there's no way to actually test a patient for it unless there's clear China (possibly Hubei!) travel history. And that could take 3-7 days. However, consider the Canadian ER doctor who a few days ago decided to ask for a test for a woman who had traveled back from Iran recently - turned out she had it, and it revealed to us unexpected, but very real vectors of transmission.

These technical issues have to be solved, otherwise there's no way to distinguish this from regular seasonal flu cases and pneumonias, until - like in Wuhan - the atypical cases bubble up. At that point, it's really too late to do much containment.
That and a good entropy source can be had with 2 transistors:
https://ieeexplore.ieee.org/document/7111269

(no login copy http://www.chaotic-circuits.com/wp-content/uploads/2016/06/S...)

Entropy generation isn't hard, even at boot, even on embedded systems (this circuit is cheap enough to stick on most boards if you really need it. Or there are $0.50 ICs that do this and a lot more!). And once you have the entropy, you feed it to your normal fast-key-erasure CSPRNG, and have effectively infinite quantities of random bits.
Hi, do you have real use experience running elasticsearch with 64g+ heap?

Is there any articles/benchmark/notes or anything that you would be willing to share?

We have considered trying out 64g+ heaps for our cluster but we are concerned about very long gc pauses impacting the search performance.
Oh I'm not defending YC or claiming anything about its companies (I didn't pull them into the conversation at all).

I was just arguing that providing some rules around acquisition of smaller competitors by larger companies with monopolies could push startups towards more viable business models.
in my experience, taken from projects I worked on with and without tests, even bad tests are better than no tests at all.

No tests usually good indicators that there will be a lot of repeated and overcomplicated code. Having a solid test coverage allows you to change/extract functions at any point when you see something is getting outta shape. With no tests, however, it's much easier and less scary to add rather than change.

People often make a point that writing tests takes time, but I'm pretty sure it slows you down in the beginning of work and speeds you up quite a bit when you amount some volume, and further you go, more you benefit from having a decent coverage. Also, oftentimes, especially on the server side, it's just easier to implement/verify with automated test from the start rather than by hand.

None of it is related to the OP codebase, just thoughts in the abstract.
not all old phones are created equal... some consume more power then the charger can provide (they can't run continuously in that case).

But I do have a bunch of security footage that I don't want to watch and I'm looking for software that can extract images from the video that contain people
What I mean by the "standard response" are actions that are just some variation of: mobilize national guard, provide emergency shelter, distribute emergency rations of food, provide mobile health care, etc, and usually to some reasonably localized geographic location. Basically the sort of responses where simply modeling your response after the previous similar disaster is sufficient. The problem with Katrina and Maria was precisely that the playbook from prior disasters was inadequate either due to the type or scale of problems faced.
> Purchasing options requires no leverage and thus bears no risk of becoming "insolvent". Of course, trading against stubbornly irrational markets via options can be quite expensive

I didn't realize it was impossible to become insolvent just by spending money.
https://archive.md/no4r5
> Everything outside of cash holds risk.

Cash holds a lot of risk. Inflation destroys savings.
CNN Doom Porn
Ask HN: Why is this page completely broken on HN?
I see 346 comments on this page in the meta information, but only two comments render out on the page.

https://news.ycombinator.com/item?id=22384356

Any idea why? Google cache shows the content, however, HN isn't rendering it out. All other pages appear to work fine.
Google and Mozilla are both major backers of LetsEncrypt which is tackling this problem from the other side (issuing short-lived certificates and putting in a system to automatically update them).
> everyone is assumed malicious and their code/actions reviewed as such.

Yes we are in agreement.

> in a more general sense, do you assume that all mistakes are done on purpose to conceal some sort of plot?

Obviously not and no one is claiming that. The extremes of never assuming malice and never assuming incompetence are ... extremes.

Always starting with a presumption of innocence is said to be a useful premise for a criminal justice system. And always starting with a presumption of malice is a useful premise for security oversight. Not just code but other things like Secret Service details and plane boarding. It's assumed that boxcutter is for hijacking, so you have to give it up. It's presumed that bottle of water is some sort of chemical to be used in making a bomb, so you have to give it up. It's presumed that baby is a secret bomb, so the baby is going to be scanned and inspected. An unrecognized wellwisher rapidly approaching the President on stage at an event is presumed to be an assassin and will be tackled. A car of lost people looking for a wedding location which is approaching a US security checkpoint in Iraq or Afghanistan without slowing down will be machine gunned. A suspicious man, under the influence, who is staggering along down the center of the road in Baltimore who does not follow orders to stop and get on the ground and who instead reaches into his pocket for his id, cell phone, or breath mints, will be shot dead. Malice is the default assumption in a wide variety of security contexts.
It's not easy to (at least this was the case until a few years ago) to ship updates to an old device (think Android 4.x or Windows XP; even worse for embedded systems). Hence to avoid the devices become useless bricks even if otherwise fully functional, root certs need to have more than a decade cert validity at minimum. (That's my personal theory, I'm not in the industry).
Java now has pausless GC.
You could have written those same words in 1999 and 2007. Which is the point. All absolute metics look great at the peak of an expansion, by definition. But the "negative records" you complain about are proxies for measuring the derivative, which is what you care about when discussion recession risk.
You mean it is wrong of Microsoft, not that the comment you replied to is wrong.
The challenges used to verify ownership and whether the task is automated or not are mostly orthogonal issues. I don't see how automating the renewal makes it less safe, if anything it removes human error from these tedious tasks.
There is plenty of data. The average tenure of a software Engineer is between 2.5 and 3.5 years.

https://www.businessinsider.com/average-employee-tenure-rete...
The investments section was flash up until very recently, I think they just got rid of flash and updated that section in the last few weeks.
This seems like an answer from someone who filters the industry through Hacker News.

Java's market share is still huge. Clojure never really had a big market share and Ruby is still very popular.
Check out Wikipedia's "Current events" section [0]. I feel it does the best job of providing the relevant factual updates about the world without all of the drama, clickbait and gossip.

[0] https://en.wikipedia.org/wiki/Portal:Current_events
srsly?
consider relocating (to a smaller town)
> Is something like a bat sneezing near you (I have no idea if bats sneeze) with an airborne virus sufficient to transfer to a human?

I think the theory for SARS went something like -- lots of live animals together in a market, bat guano gets on some fruit, a civet eats guano-laced fruit, a person eats the civet later. Doesn't have to be simple transmission.
Takeoff for the Clouds with Spinnaker in Azure Kubernetes Service (AKS)
Good luck losing your ass shorting stocks! Shorting requires very accurate timing and even if the trend is your friend, it simply is not the opposite of going long. It just isn't.

I only get two posts every 4 hrs because HN thinks I'm an asshole, but since I'm a rich asshole, I'll break it down for you:

99% of the advice on this thread is garbage.
Fair point. And I'm responding to the simplistic idea that any one individual knows what is best for society. Those who "feel that I should only work on things that matter to society" are not immune to those systemic pressures either. I do think it's a good idea to not just chase money and to work for companies aligned with your own values. But that's about the best you can do. What's aligned with your own values might be someone else's idea of working on things that don't matter to society.
Can I also recommend my book for software team leads to be included?
"Elastic Leadership: Growing Self Organizing Teams" https://www.manning.com/books/elastic-leadership
Now I'm wondering about UK's tax, which is supposedly even more complex than that, considering the insane accountant per person ratio?
> There’s just too many high quality candidates and too few positions.

That can't be true simultaneously with "companies are having trouble finding good enough candidates", which is often said these days.

What can be true: There are many high quality candidates, and many positions looking for high quality candidates, but they cannot find each other and overcome matching hurdles.

So you have candidates applying to a large number of positions, and positions seeing applications from a large number of candidates, just because the matching process is so inefficient. Then both sides can legitimately complain about the large amount of work and time it takes.
Perhaps this can eventually combine with companies having to agree to a T&C or EULA type of contract to have access to your data. Such a contract can prohibit copying, at the user’s discretion, or stipulate that revoking access must result in deletion of all copies of that data, automatically.

Some other mechanism can then be put in place to detect and deal with bad actors. Perhaps there could even be some sort of verification of compliance, whereby services/companies must undergo a process that requires proving these systems/processes are in place and operational.

This does nothing for the results of what a third party does with your data—such as models trained with your data—but there are options for removal of data. Of course, it’s ultimately up to users to be cautious about sharing their data.
> Ark

Yes, thanks! I knew arc didn’t look quite correct, but my spelling is sketchy enough without being under-caffeinated.
The authors are quite explicit that this site only includes a fraction of all github repos. Thus, this is not a "bug" that needs to be corrected.

In my case, I am not talking about forks but about people who copied my files into their repositories (with proper attribution and respecting the license). I just searched for my surname and was happily surprised to see it in major projects like ffmpeg, pytorch, bytedeco, scikit and opencv.
Most people are solidly in standard deduction territory after TCJA.

If your income is entirely W2 (any stocks sales if any are in tax advantaged accounts) and you take the standard deduction, generally your taxes can be automated easily. That covers most people. Honestly, the only thing that even makes my taxes complicated are investments (made worse by CA diverging from the federal government in matters like HSAs) -- even then, until recently, most of that could be automated from 1099b filings.

Turbotax if anything makes taxes more complex than they have to. There are so many things in their "step by step" for deductions that are completely irrelevant if you are taking the standard deduction. It would be a huge improvement for them to simply pose a question:

"Is there any chance the sum of the stuff below is going to exceed $14k? YES -- itemize. No -- skip"

I suspect they don't do this though to keep convincing users of the need for complex, pricey software.
True. The Swedish military recently (a couple of years ago) raided the offices of Kockums at dawn to acquire prototypes and plans for its submarines.
I’m using YC as a stand in for “VC backed tech companies” because it’s the one that people on HN are probably the most familiar with. The same could be said about the other VCs.
How do you explain this comment, where you say you know the solo guy working on proxyman, and you say he is ambitious to be better than Charles?

https://news.ycombinator.com/item?id=19704605

Are you talking about yourself in the third person? Very confusing.
I wonder if in the past maybe the plural of kunst as in the specific mechanism was Kunsten, and the plural of the genre/knowledge was Künste, and only the latter has survived. That could explain why Stangenkunsten seems to be used in the English literature.
They don't detect the disease by going around testing people at random, they test suspected cases (typically people sick enough to make contact with the health system, with symptoms of the thing being tested for).

For testing capacity to matter, there would need to be known clusters of suspected cases...if you have known clusters of an unknown disease, "undetected spreading" isn't exactly the situation you are in.

I apologize about the rhetorical framing of my other comment, I wasn't trying to put words in their mouth, I was pointing out a predicate that they did not address.
I just wanted to point out that Elastic has made some changes in the last year or so that help with security like...

* [Making security bits available with the ("free") basic license](https://www.elastic.co/blog/security-for-elasticsearch-is-no...)
* [Releasing Kubernetes Operators with security enabled by default](https://www.elastic.co/guide/en/cloud-on-k8s/current/index.h...)

This has the effect of making most "getting started" guide setups more secure by default, which is good.

Unfortunately this is a new change and those bits are not in the Apache licensed core offering, but it's still a big improvement IMHO.
Lot of OPs points are subjective and some could always have been happening but with the hyper media we're more aware.

IMO, number one thing should be the upcoming massive retirement population. First time where working population will be smaller than retiring population.

Also, looks like the modeling done for retirement plans are based off equal or greater population for the next generation. Life expectancy longer than when these were implemented. Boomers struggling to sell their massive rural houses.

Don't believe? Walk into a McDonald's and look behind the counter. You'd expect to see all these young inexperienced workers but majority of time I now see +45 workers back there.
GitHub confirmed to me that their search is not able to find in substrings; this is annoying because if you want to find all affected code among all possibly involved repositories, before a change, you need to clone them and grep locally. In the end this means you need to clone absolutely everything you work with, because otherwise you might miss changing that one repo you didn't think of:

https://stackoverflow.com/questions/43891605/search-partial-...

I've used Sourcegraph and it was cool; will have a look at this new tool too. But, GitHub pretty please add plain food old grep abilities to your search!
I'm sorry but really none of this makes any sense to me.

How exactly did you reach the conclusion that "my actions don't really correspond to my words" based on how HN collectively treats Android? What actions are you talking about specifically? Using Android? I don't.

An how exactly does this post:

"I'm not sure how that's relevant here. Does my post say anything about what Ubuntu does being excusable in any way?"

follow this formula:

"Just because A does B, doesn't mean that C can do B."

My original reply said nothing about anything other than Windows, and my second post hinted that I think both Canonical and Microsoft are wrong in doing this. If I followed any formula, I'm pretty sure that's "neither A nor C should be doing B", which is as far removed from whataboutism as criticizing bias is removed from astroturfing.
Pandemic?
what is happening with antivirals, why should these take years in crisis/pandemic situations? Would govts rather see mass hysteria and huge hit to economies rather than trying new vaccines?
Both WalletHub and Credit Sesame are comparable.
Really, bad advice. The outlook for bonds in 2020 is changing as the impact of Corona virus puts previous projections into question.
Google faces state lawsuit alleging misuse of schoolkids’ private data [pdf]
I was surprised that the FTC actually blocked the Harry's shaving acquisition because it would be anti-competitive, and the Fitbit acquisition is still on the block as well. Not clear yet that this will be approved, though I wouldn't say TurboTax + Credit Karma have a monopoly on tax filing...
Yep. The possibility of continued contagiousness after recovery is also a point of concern: https://www.newsweek.com/coronavirus-recovered-patients-trac...
> every document you put into ES will create a segment with only that single document

That's not correct. A new segment is created (or rather, made immutable) after a commit. Creating a new segment for every document is a surefire way to kill performance.
Book Review: Consciousness Explained by Daniel Dennett
Any idea if this or another project supports rtsp streaming so it can be integrated into existing security systems?
Announcing an Official Node.js Client for the Sight API
Why Did It Take So Long to Invent X?