skysight-inc/HackerNews huggingface dataset:
Yes, the msg!() macro is a little painful to write.
I think it can be refactored into the pattern like `impl Handler<Msg>`.
But beyond that, it supports async/await naturally. :)
Someone already figured out how to tell them apart: There's a small voltage regulator component that was originally near the edge of the board. In the new revision, it has been moved to the previously empty space above the word "micro" in "micro SD card" [1]

So now you just gotta find a reseller willing to check that they're sending you the correct version.

[1] https://www.cnx-software.com/2020/02/24/raspberry-pi-4-rev-1...
Can't speak for the industry as a whole but a lot of companies are moving away from dedicated DevOps teams and shifting the responsibility onto developers. The previous DevOps team in many cases still exists but has been rebranded to SRE.
Destiny – Prettier for File Structures
On the other hand you can't benchmark every single line of potentially problematic code and even if you could, syntetic tests are not reliable.

If by experience you know that a certain solution can be problematic and there is a different solution which has reasonable implementation costs, you should do what your experience tells you especially if fixing it after the fact would have significantly higher implementation costs.
and now its six

https://www.theguardian.com/world/live/2020/feb/24/coronavir...
> then PCI-DSS is a farce.

Take a wild guess on what you think will happen.
This doesn't surprise me. I'm currently trying to get a refund out of PayPal after what looks like a massive flaw in their refund process. I paid for something on eBay and it appears to have been a compromised account. The original auction, feedback history, etc, looked legit. The flow was this:

1) I pay for a product on eBay using PayPal, using my creditcard (direct from card, not from any existing PayPal balance).

2) Seller marks item as shipped but then 5mins later issues an e-check refund (rather than a refund on my creditcard).

3) Seller cancels and deletes the original item on eBay so i can no longer raise a dispute there.

4) The e-check refund continues to bounce as clearly the compromised paypal account can't pull those funds from the other source.

5) The refund being in limbo means my dispute with PayPal gets closed as "a refund was previously issue" (which did, and will continue to, bounce).

The important part is 2 - since I paid for this on my card the refund should have gone direct to my card. However, since I paid for this on my creditcard I've raised a chargeback with the issuing bank, which should hopefully make PayPal sit up and put a bit more effort into sorting this out.
That would be a valid complaint if their report had been closed Not Applicable on the grounds that the behavior didn't present a significant security risk. But it wasn't; it was closed Not Applicable on the grounds that it was ineligible for the program regardless of whether it was a security risk.
Regarding all these alternative ways of organizing, what's wrong with a leader taking responsibility, delegating it where feasible, and selecting for team members to whom they can delegate responsibility with confidence?

Taking direction or orders from a manager is only ever stressful if that manager doesn't take accountability for their decisions and directions. I'm not sure the solution to that is a new framework where managers can direct without responsibility or accountability. Set a bar for managers that includes ownership, and the ability to delegate responsibility while persuading staff to willingly take on their own level of ownership.

This "manager as peer," approach I have seen in a number of organizations is dishonest and seems to just mean forfeiting responsibility, while opportunistically cherry picking successes to take credit for.

Team members don't need to be "heard," or need sympathy from managers, they need confidence that their leadership understands the environment they work in, takes responsibility for decisions, and gives them direction based shared competence.

Of the problems to solve for, improving the quality and selection of managers seems smarter than contorting ourselves into new frameworks to work with ones who avoid responsibility.

If you want to be liked, just be nice. If you want to be respected, take responsibility.
get an open top aquarium, it's much more rewarding and efficient way to increase the humidity of a room
I wonder how this works for large scale engineering architectures and unified approaches. Seems like it'd lead to a lot of disjointed projects and pieces each with a different approach. That in turn adds cognitive overhead to an organization and lowers the bus factor.
Untapped Territory: YouTube Is the New Google for Search Engine Optimization
Try this:

https://codesolvent.com/config-node/
Their "In-Scope Vulnerabilities" explicitly includes XSS exploits, though, which they also closed as Not Applicable (after patching the issue).

Tangentially, as a (former?) PayPal user, it's wild to see that they consider vulnerabilities involving stolen credentials as a non-issue. Why do they offer 2FA at all, then?

e: After taking another look at that massive Out-of-Scope list, I'm having a hard time imagining a bug that couldn't be closed as "Not Applicable." What a sham.
Google secretly monitors millions of schoolkids, lawsuit alleges
All the more reason to not submit bugs like this to HackerOne. If you can bypass 2FA by having only one factor then I wouldn't consider that 'stolen credentials' and more a singular stolen credential. Their system is designed to defend against this and it does so ineffectively. That is, by definiton, a security issue.

I wish I could define what is and isn't a bug in my code at work. My defect rate would be incredible.
> but disclosing bugs publically is an addition to your resume

Request disclosure on hackerone then.
Idk, breaking the law to get a job doesn't seem ok to me.
- I added a first name to my conversation contacts, but it keeps showing the phone number. In the app and in notifications.

- There is a fixed pop under at the bottom of the screen asking me to confirm my profile name, with “Get Started” or “remind me later” (which is apparently every time i come back to the app), and no “never“ option. I had already put a first name but that’s not good enough. Had to do it again to confirm i don’t want to share a last name with him / them.

- why does he care about the distinction between a “first name” (mandatory) and “Last Name” (optional)

-> Only the user should care about the name.

=> Why should the app / he / them get access to my contacts list to update a contact name? I’m perfectly willing to have duplicate contacts siloed in a “secure messaging app”.

Also, could someone explain why the app need phone numbers ? They only send some initial token over SMS, which can be spoofed.
Third link in one picture https://ibb.co/S79Tyz9
Show HN: Predicting Runescape (OSRS) Grand Exchange Prices with Python & ML
G R I T A L L I C A!
Show HN: Bubblemon, System load meter for human beings
Oh my God! Only 400,000 miles and it needs new parts? What a piece of jumk!!!

Or not, considering the performance of the typical ICE engine. Like it or not gasoline partisans: the electric car, especially Teslas, will change the world.
> What's sad, is that people like me used to be represented by a certain kind of recruiter, more akin to a literary agent. They'd beat the bush, and get a portion of the take from that.

> Apparently, this type of job no longer exists. I suspect that the big aggregator sites, like monster.com and Hired are responsible for that.

I’ve worked with Code Talent both when building out a team and when seeking a position myself and found that they work very much like this. I haven’t dealt with them recently, but they seem to still be going strong and doing what they do. I wouldn’t hesitate to reach out to them were I look to hire or find opportunities in the Denver area. Other than as a satisfied client on both sides of the table, I have no relationship with them.

https://www.code-talent.com/
It's actually quite common for water authorities to publish quite detailed analyses of the water they provide. Doing such analyses is a core competency of being a water authority and, since they are mostly publicly owned, then published for consumers, often at a fairly detailed level.
Haha, you really don't get this. I have already paid the licence fee, you have already the developed the program...you are just charging me a third time for it.

The BBC Trust isn't (wasn't) "management".

I class as bad almost everything you have said. It is self-evident. Fundamentally, I disagree with people being ripped off.
Yet paypal's policy explictly says authentication bypasses, like the 2FA bypass they showed, are in scope

>Authentication or authorization flaws, including insecure direct object references and authentication bypass

Reading with the context of the other out-of-scope issues. I think they meant that the ability to buy or steal someones credentials is not a vulnerability in and of itself.

>Vulnerabilities involving stolen credentials or physical access to a device

It is a poorly worded and confusing policy. Yet, if I found a 2FA bypass and I read that policy I would conclude that it is in scope and submit the issue.
Not OP, but all of relatives in the Twin Cities (MN USA) got a similar bad flu, and all got the flu shots. I do believe they missed one this year.
Longtermtrends
Which also means The Book of Mormon musical is also a consequence! ;)
Types of highway interchanges and their efficiency ratings
> Go community’s practice for grounding language enhancement requests not in it-would-be-nice-to-have abstractions but rather in a description of real-world problems.

jfc, the arrogance of this asshole. Seems like a decent fit for Go though, considering that language’s history of ignoring PL research..

I mean, Go is awesome for containers, and it’s awesome if you have a lot of junior devs and a decent amount of churn.

But the amount of anti-intellectualism by big shots in the community is seriously depressing.
Are there other cases where PCI-DSS compliance requirements are selectively enforced?
Play AI Dungeon like it's 1980
Are you a registered member your state's engineers' association? (i.e. do you have seal?), if not please do not call yourself an engineer
HackerOne, itself, is pretty generous about reported bugs. (As in, you reported an issue in the website hackerone.com.) They have to be, because their existence depends on everyone thinking bug bounty platforms are a good idea -- it's part of their way of encouraging people to hunt for bug bounties in general.

Payouts for bugs in other products are determined by those companies, not by H1.
Can you elaborate? I'm not well-versed in WASM internals and I might be missing something.

I mean, any integer with 8+ bits can be treated like an octet, but memory layout is very different (e.g. an array of i8 and an array of i32 look very different even if they represent the same values).
Moral of story is obvious: Next time sell the exploits on the dark web and skip the blog post.
I wasn't talking about the interface, I was thinking about people over engineering code or just having poor design / architecture that makes it a lot more complex than it should be.
These are two different arguments, though. Yes, everything you listed is true, and it's largely what led to brand cynicism in the first place. However, this new Amazon problem (at least within the ecosystem of Amazon) is markedly worse. There are 1000 brands, and most of them are terrible, and the reviews are worthless, and you can't even see or hold the product in your hand. In this situation, a trusted brand has more internal consistency (despite all the issues you correctly noted) than the very inconsistent fly-by-night brands you can find on Amazon.

Of course, my argument falls apart if we can't spot counterfeits on Amazon.
We could have stopped it completely with total travel bans but the WHO advised against it because it could be damaging to the world economy.

Why is the WHO concerned about the economy? Well I have no idea. And is this virus going pandemic going to be more or less economically painful than the travel bans might have been? My guess would be we will feel significantly more pain from a pandemic.
> " I remember Rust was a cool project, JS had plenty of frameworks fighting between themselves, SPA was a thing albeit I was skeptical of it, and I was in love with Go. Big words like Data Science and Machine Learning were thrown everywhere."

From this description, it sounds like nothing has really changed in the past 3 years. This could easily describe today.

There have been some shifts in the fighting JS frameworks though; Vue is a big rising star, has overtaken Angular and is now challenging React for the top spot. Angular is still used a lot, but I think it's on the way out. React is still strong. Typescript is becoming standard.

Server-side rendering is big, though. People talk a lot about static sites (which can still be dynamic), and serverless (which still has a server, obviously).

Rust is more than a cool project; I have no experience with it, but it sounds increasingly like the low-level language of the future. On the JVM, Kotlin is on the rise, has overtaken Scala and Clojure and is second behind Java.
I'm wondering why AssemblyScript uses UCS-2 instead of UTF-8. Do browsers use UCS-2 as well?
Just look what a lack of mental healthcare has done to the country...
I like "SNOWBEGONE KENOBI" and "READY SPREADY GO."

Also the word "gritter" is really funny to me.
The vulnerabilities they found allow bypassing the two factor auth so works with only part of the credentials
Unfortunately, we don't actually have data which supports this. The only data that was collected at the time showed that if/else compress better than what wasm has without if/else. There are other ways we could have compressed control flow, but we didn't do the experiments.
Security Risks and Hacking Stories for Web Developers
hmm yes, I see your point
I set up Loki on my Kubernetes cluster last night, as I've been meaning to try it and this was a good excuse.

Basically, it appears that you can do very minimal tagging of log data at ingestion time (done via promtail, requiring a restart for every config change just like fluentd), but not any after-the-fact searching. I didn't play with it at all because I've been down that road before; parsing logs is hard, and you need an interactive editor over the full history to get it right. (Some fun examples... I use zap for logging, which emits JSON structured logs. But... I also interact with the Kubernetes API, which has their own logger. When something bad happens, instead of returning an error, it just prints unstructured logs to the log file. So you'll have to handle that if you're writing a parser. nginx does this too; you can configure it for JSON, but sometimes it prints non-JSON lines. What?)

Loki is good for getting your logs off the rotated-every-10MB "kubect logs" pipeline... but it doesn't really help with after-the-fact debugging unless you really want to read all the logs, in which case you're back to grep.

I am getting more and more motivated to do something. At the very least, Loki's log storage itself seems pretty okay; put logs in, get logs back, so it saves me from having to write that part at least.
I think if you Google Paypal 2FA security issue, you'll find multiple such bugs found over the years. They've never fixed it.
Well I'd need to hear their reasons for it, but yeah. I should of phrased it better: in the event that the NSA advises people to upgrade Signal versions or something of the sort. Though this is much less likely than them advising something as much more mainstream as Windows.

Totalitarian is probably closer to the word I was trying to think of.
From reading a different article, the terminology seems to be a bone of contention here. This ’2FA' is an email message PayPal send when they detect a new login location. They do not call it 2FA and they do offer actual 2FA that cybernews have not bypassed.
Taylorism perverted since 19-something. Without the boni of course.

Bad management? Yes.
I suspect you're right, that's a shame, I've used Credit Karma tax 2 years now, it's been very easy because they haven't over-complicated the UI, it's mostly just a simpler, gently guided interface to enter the values you see on your tax forms.

I'm sure there will continue to be plenty of free ways to file my taxes - I usually owe a little bit every year so I'm not very keen on paying even more to file - but the sites I used before Credit Karma were all just more complicated and took longer to file.

One thing that's usually hard to find is the form to enter my mortgage credit certificate. Since it's not the most common thing (a program for first-time homebuyers / buyers in targeted areas administered on a state level) I've usually had to go through some wizard and answer the questions just right (e.g. lie and say I bought a house within the past year) to get it to offer me that form, rather than just picking it from a long list of options.
The screenshot in #2 does show the H1 Staff screwing up -- @cybernews requests disclosure and gets a response saying "you may request disclosure if you would like this reviewed, using the drop down menu" (which @cybernews has already done).

@cybernews' behavior in that thread isn't ideal, but they're more in the right than in the wrong on that one, judging by the screenshot.
Unfortunately that isn’t much of a factor in reality, and I have the receipts in my filing cabinet to prove it.

Insurance/“cash” can “negotiate” but at the end of the day the average hospital stay is near $4000/day.
The BBC has already been constrained and this has not had the desired outcome.

Commercial British media companies have not filled the void and have not delivered revenue from new export markets.

Instead foreign owned firms including Netflix and Amazon have cornered the UK market.
I have seen the Chrystal's "Algebra: An Elementary Textbook" as a recommendation for a guide to most of Algebra a working CS person would need. It is about 100 years old, and appears to be lacking in modern pedagogic cruft and is to the point and densely packed with useful information.
They should use Threema [1] which is based in Switzerland. Even though Switzerland is not in the EU it's not as bad as the US (from an EU standpoint) and since Switzerland is heavily dependent on the EU the likelihood of them spying on the EU is pretty small. Apart from that Threema publishes a transparency report [2] where they list all requests from governmental authorities.

[1]: https://threema.ch/en

[2]: https://threema.ch/en/transparencyreport

Edit: Formatting
From this article [1], I get the feeling that PCI-DSS has always been selectively enforced.

[1] https://www.anitian.com/the-failure-of-the-pci-dss/
There is a difference between being an engineer and holding a license (e.g., PE) from some organization.
This is probably what many of us would do if we weren't so easily distracted by digital apparatuses.
Show HN: Introduction to GraphBLAS with Python
> I'm amazed Scotland have a real time map with also how long ago a road was gritted - much respect to them.

We've the same over in the Netherlands, even including temperature of the road surface - see https://www.rijkswaterstaatstrooit.nl/.
> FWIW, Mormons are experts at having enough for a full year for a family that might be 12 members, but they have special things they get like gallon sized cans of unground wheatberries, for making flour by grinding it.

Latter-day Saint here. This indeed was a teaching of the Church for quite some time, not so much anymore as it has shifted to general emergency preparedness [1][2][3][etc]. Some indeed still keep decent food stores though, we can order cases of #10 cans for varying things from the Church online [4] (the general public can too).

Some people keep a lot of freeze dried stuff, some can their excess that they grow, others just keep a lot of staples on hand that they rotate through. Personally I can feed myself for a few months on freeze dried stuff and 10-30 year canned staples then another 1-2 months on stuff I rotate through and eat daily (beans, oats).

[1] - https://www.churchofjesuschrist.org/study/manual/gospel-topi...

[2] - https://newsroom.churchofjesuschrist.org/article/preparednes...

[3] - https://www.churchofjesuschrist.org/church/news/church-annou...

[4] - https://store.churchofjesuschrist.org/ click all categories, food storage (direct linking to the page will often generate errors)
This. Google maps becomes quite hostile&annoying to use if you deny that data access.
Could you link that article? Because the screenshot in this article pretty clearly shows PayPal sending an SMS to the user's phone.
I see it as part of the exchange. You give them your data they give you nice products. If you decide to use it without giving, you get a lower quality product.
All these regulations are bs. Designed to keep small players out.
That might well be true but to scale this type of service to all public repos with decent latency and update ratio is a major technical challenge and likely very costly to maintain.
BTW: They are working on Hot-Code Swap.
Practice makes a master. More importantly, the true understanding only comes through practice. Also, more often than not to "understand" something comes down to simply getting used to it (which is how we learn things in the elementary school). Practice is the key.
Search for "Open University MST124" or similar on www.ebay.co.uk or www.amazon.co.uk. There seem to be plenty of copies of 124 available on both at the time of writing.
Data Breach Occurs at Agency in Charge of Secure White House Communications
I always found the notion that we have to climb upwards and always make more money to be a bit weird.

As long as I have enough to live comfortably, stash some away and not worry I'm good, I don't need more. As such, I don't really get involved in most of the things that this post is about nor do I particularly care to do so either.

Work is what I do in order to sustain myself, it's not my life. The minute I walk out the door at work I've forgotten all about it and never think about it until morning. I realise this is me being pretty lucky but I'd probably even change career completely if I couldn't do this anymore working in tech. I think a lot of people struggle to find that balance, sadly.
no shit PCI-DSS is a farce

it's just there to make people that don't know anything about technology feel better
https://www.forbes.com/sites/zakdoffman/2020/02/22/paypal-cr...

I should note that I haven't really investigated this so I don't claim to know any truth.
The staff will be using Whatsapp. Signal has its issues but it's more secure than Whatsapp.
It's all that PayPal deserves of they get a pass for PCI-DSS non-compliance.
My opinion is that the end dates are more conservative to avoid claims when food goes bad before their expiration date and maybe a little planned obsolescence. Most people, except for preppers maybe, will not chose one food item over another if it has a year or 2 more of shelf life. So why should manufacturers spend money over this if it's not a selling point to the most common denominator?

To give some perspective check out Steve1989MREInfo's Youtube channel [0], where he routinely ingests food from cans dating as far back as the world wars. Although you might argue he has a built up immumity by now giving the amount of bad food he must have eaten.

[0]https://www.youtube.com/channel/UC2I6Et1JkidnnbWgJFiMeHA