skysight-inc/HackerNews huggingface dataset:
> not let your anger cause you to do something stupid

Note: I didn't say that I would do this for every company. Just ones that use HackerOne. They have decided to abdicate their responsibility for their security vunerability reporting, and I feel completely justified in dumping info on their vulnerabilities.

Releasing the details of a vulnerability is not stupid. The users of the software/service deserve to know the data/service they're using is unsafe when a vendor refuses to act on a valid security issue

>If you disclose a vulnerability, the company HAS EVERY RIGHT to sue you.

You don't need the right to file a lawsuit to file a lawsuit. You just file the lawsuit. Now, you need an actual, actionable claim to prevail a a plaintiff in a lawsuit. Whether such a thing exists in practice is something we leave to lawyers to argue about and judges/juries to decide.

If your company is in a competitive industry and I release the details of a vunerability in your software and you sue me then that vulnerability and lawsuit becomes marketing item number one for all of your competitors.

>this is why these bug bounties and established ways of notifying the company of the vulnerabilities exists

Arguably why they exist. In reality, they tend to exist to give people an incentive to not dump the vuln details on the black market, embargo bugs so customers don't leave, and attempt to maintain a good relationship with security researchers. They do not grant immunity from being sued or somehow grant the legal right for security researchers to do their work as your comment seems to indicate.

Your post reads like propaganda from a bug bounty organization. I'm not saying that you're shilling, just that you're misinformed. In the US it is generally legal to conduct security research. In the US it is legal to communicate the results of that research publicly so long as you have not agreed in some contract to not do so.

Where did you get the idea that legitimate security research is a crime?
Something I keep telling my dad, as he tries to get grandma to stop regurgitating the "forwards from grandma" type of nonsense.

She's not spouting this because it's rational.
"Elasticsearch has no concept of a user. Essentially, anyone that can send arbitrary requests to your cluster is a “super user”. "

https://www.elastic.co/de/blog/found-elasticsearch-security

This document says it twice verbatim - once as an emphasizes blurb of its own.
It is also re-emphasized it in several other ways.

(same link as also posted by the Elasticsearch employee above).
If anything, I would expect just the opposite. Keeping hardware the same, a degoogled AOSP rom handily outperforms the stock OS wrt. battery life and general performance/resource use, in a way that actually matters to average users. Of course it's harder to make such claims about Apple devices, since they're limited to running iOS.
Yes, and equally to the point, its consequences were in retrospect big and rather predictable. The butterfly effect refers (colloquially) to seemingly small causes (butterfly wings fluttering) leading to big and completely unpredictable effects. Nothing involved with what we're talking about is similar to the butterfly effect... except in that there was a cause and an effect.

I realize this is all a bit silly to go on about and there's no conceivable future where the OP sees the egregious error of his ways and ritually disembowels himself, or even, you know, starts using the term properly.
(author here)

Why:

Mostly, I think it's down to having a better understanding of where to try to break dependencies, specifically trying to abstract away from the outside world (akin to how they did it in the Moonpig billing system).

The how is still in progress. Perhaps the most notable instance I can think of it is that recently, due to work on breaking dependencies, I was able to stub out a RabbitMQ connection for an in-memory class, so that I was able to easily test how two components interacted without having to stand up an external service.

For me, looking back, I think it was the Moonpig article that's had the most influence on how I think about things.

Do you have any other questions?
There's a whole section in the repo for examples and use-cases

https://github.com/bastion-rs/bastion/tree/master/bastion/ex...
Negative probabilities interestingly are showing up in various other realms. There seems to be converging interest in the topic from a number of areas.

For example, in relating Bayesian inference to algorithmic complexity-based inference: https://arxiv.org/abs/1401.7116

I've also read some interpretations of negative probabilities in terms of erroneous values. For example, if you're sampling observations, and a machine error causes an anomalous value to appear in the data. This I don't know I completely intuit but there are interpretations of negative probabilities outside of QM.

My sense is that they will eventually be accepted akin to imaginary numbers or something but that's just a hunch and I could be wrong.
An Unexpected Career: Target’s Forensic Services Laboratory
I am not sure this is the only value, but it is generally true. And this is one of the great advantages of haskell.

By the way, now that I know some haskell, I see this edge case sloppiness all the time and it is really annoying. For example, here is something that annoyed me just recently. You go to yahoo finance and there they will show you the revenues of a company as well as the revenue growth from past year. But sometimes this revenue growth number is not available. For example, the company may not have existed past year, or perhaps it was not public past year and thus it did not publicly disclose its revenues. When they cannot compute revenue growth for these reasons, yahoo finance will helpfully show revenue growth as "N/A", i.e., not available.

That seems all nice and logical, but I noticed that yahoo finance tended to show that revenue growth was not available for many established public companies for which they should have the data. I looked at it more closely and noticed with shock that if the revenue growth of a company was about 0%, yahoo finance would still show it as "N/A"! So some programmer just decided to use 0 as not available and just erased a lot of useful information from their system. Now when I see a company that has N/A as revenue growth on yahoo finance I have to go and check whether the revenue growth was zero, or it was truly unavailable. As I said -- really annoying.

This is of course a textbook case for Haskells Maybe concept. You can have a type that is a Maybe Int, and that means it have a value or it can be Nothing. Thus, you encompass the edge case of not having the value available, without using an embarrassing hack that deletes real data. But of course Haskell gives you more power than just using Maybe. You can create a type that can encompass all kinds of edge cases and information about them. For example, you can embed a reason why the revenue growth data was not available, if that is the case.
Very mixed feelings on this. I'm in favor of UBI, but the devil is in the details and this bill doesn't pass the smell test.

As noted elsewhere, $1000/month for all adult residents adds up to more than the state's current budget.

The bill doesn't appear to remove other welfare programs. UBI is usually touted as a moral-judgement free program that replaces all the targeted welfare programs (food stamps, housing allowances, etc).

So, I'm glad people are taking UBI seriously. But, bills like this feel like a footgun. People are rightly suspicious of UBI (at minimum, it's new and untested) and bills like this do nothing to assuage their fears.
For very simple programs, sure.

Type checkers do not verify behavior. Unit tests verify behavior
Adfly Notification Page Skipper- a Firefox Add-On
That won't help them. The EU is going nowhere, fast.
> That doesn't happen in human societies where most males will have a chance to breed.

We can get a precise idea about this since it shows up in the genetic record and over the long term it's under half. A lot more men than you think are cuckolds.
The NYT article really emphasized her college mentor, William Claytor.
The problem there's very little testing being done for this novel pathogen.

New tests can't just be created by hospitals and labs out of thin air, and they can't be used without undergoing a lengthy bureaucratic approval process.

For a novel pathogen like this the tests are still in the early phases of being manufactured and approved, so most people who go in with symptoms just aren't going to be tested.

There's also a manpower issue that has to be taken in to account: if everyone with flu-like symptoms came in to get tested the hospitals and labs would be overwhelmed even if they had enough tests available and those tests were already approved. Many labs and hospitals are already close to being overwhelmed from seasonal flu.

So I really wouldn't consider official data to be very reliable at this point. We really need to wait and see.

Meanwhile, though, it would be prudent to err on the side of caution.
Have you studied here?
Prop 13 essentially makes raising revenue through property taxes impossible in California.
I would like to apologise for that. You really made me think and know that I've become a mac user I have the opportunity to try your solution out. The blog post was intended in a rather light tone. My intention was to add the more in depth analysis in the book.

Now that I am a mac user I finally have the chance to take a look at your solution. I do think that I have a lot to learn and do not think that the areas of research are in conflict at all.

All the best and good luck!
> I do actually want my opinions, ideas and preferences to be heard. If I think that I am not being heard, I prefer to change the team so that I am heard.

I think this is a valid expectation. At the same time, it can lead to conflict and confusion if not itself managed effectively.

One thing we've done with our team that I think has addressed this pretty well is RFCs (Request for Comments). This is mainly for team practice stuff but also can address important technical questions.

We use a Trello board where anyone on the team can add a card and then team members can comment on cards. Team leads then review the board in a 30-min meeting every couple weeks to make sure cards get acted on or otherwise resolved to everyone's satisfaction.

Each RFC card is also assigned an owner from the team, a practical example I suppose of everyone being a leader.
It's a statement I see regularly on HN and that confuses me.
Something like Next.js gives you the power and structure of React while doing a great job of hiding any complexity under the hood. And it scales really well, whether you need a complex website or just a set of static pages.

I'm not sure why jQuery is mentioned either. It was popular when I started programming but fell out favour when its major functionalities were implemented in ECMAScript.

What am I missing?
Looks like good work! I'm curious about why I might use this instead of Erlang.
You are so right, those "build a website in 15 minutes" demos hit like a bomb back in the day!
> Again, I ask, what for?

You're paying high taxes because they can tax you that highly and you haven't moved away yet. When they increase them and you still don't move their take away will be that they can probably raise them even higher.

You're the sucker here.
Doing the same in Paris. 1-2 hours at home and then go in. Leave work later though 7-7:30 pm to available for US west coast people
Day 60 of Azure Latest (.NET Core 2.2) Unsupported
That's very interesting, your report and those in the comments mentioning warmth. I'd some years ago experienced RSI problems and rectified it with neoprene "wrist braces"; while they didn't provide a huge amount of support, just some mild compression, they were certainly warm.
Via USGS
https://viewer.nationalmap.gov/basic/
Thank you for chiming in and clarifying. I was thinking of that 2013 page specifically - good to know it is now out of date.
"California Resident" is a significant phrase. Here's an entire document that details how California determines it [0], specifically how it taxes those individuals. Sections F through I, with specific details in G, govern these specifications. How about doing a little digging before appealing to wild speculation?

[0]: https://www.ftb.ca.gov/forms/2019/2019-1031-publication.pdf
I'll take that as a yes.
Kids in high school age are especially vulnerable and need a lot of vigilance on parents' part. It is tempting to think we can take our foot off the gas a little bit but between finding the line between helicoptering and kids on autopilot, this stuff is almost a full-time job in itself.
If it's not too personal, is your wife of German extraction too?
Don’t forget that those same unions are a political powerhouse in terms of keeping California effectively a single party State, and so long as they remain a reliable means of winning elections, the legislature as it is currently composed has every incentive not to change this. Keep in mind public sector unions are ultimately paid by the taxpayer via a series of payments which originate from us, go through the State and school districts, eventually a teacher’s paycheck and then from their dues, into the unions who turnaround and support the elections and re-elections of their favored politicians.
Yeah, but in this political climate, we probably can't get regulation passed that isn't written by the companies it regulates.
I agree with you, I think if you look past the marketing all they really did was make templates with parameters that computers tried to play with.

I think their approach tended to not work better then humans picking the templates and parameters, but the bigger problem was just that they weren't as good as squarespace and their marketing hype wasn't enough for them to compete.
Over on the OMSCS subreddit there is regular discussions of competing programs as well, like ASU, Stanford, Johns Hopkins, etc. Everyone is getting into the game, it seems, though I think that OMSCS still provides the best value. I'm on class #6 myself.
Cloud Assurance/Security Needs to Be Accelerated
I'm sure if they didn't have the interviews, they'd only select from Ivy League or top X school computer science graduate pools.

I bet investment bank or hedge fund jobs are/were just as tough for anyone to apply to and get.
Personally, I'm happy building from source, especially for niche software. Just give me a working CMake or Qt .pro file and I can figure out the rest. I in fact rather dislike pre-built binaries. I don't trust them to work well and I don't trust them to work for a long time if they happen to rely on libraries that one day change (even the most statically compiled of static binaries still usually rely on libc).

And if your software ever gets popular enough, I expect one day my distribution will just package it for me. I'm happy with this arrangement. Source for niche software, apt/rpm for well-established software.

For my own Qt project, I decided to use PyQt so I could leverage fbs for distribution for Windows where they're not used to source code (Mac can rely on homebrew, as far as I'm concerned):

https://build-system.fman.io/
>>> We identified 22 credible economic models of the cost of single-payer financing in the US, from a variety of government, business consultant, and academic organizations. We found that 19 (86%) predict net savings in the first year of operations, with a range from 7% higher net cost to 15% lower net cost. Increases in cost due to improved insurance coverage and thus higher utilization were 2% to 19%. Savings from simplified payment administration at insurers and providers, drug cost reductions, and other mechanisms ranged from 3% to 27%. The largest net savings were for plans with reductions in drug costs. Net savings accumulate over time at an estimated 1.4% per year. Of note, we excluded 2 widely publicized studies [20,24], both of which found net costs, on the grounds that these studies made assumptions that included private insurance intermediaries (i.e., not a single-payer) or lacked technical detail for evaluation.

>>> These analyses suggest that single-payer can save money, even in year 1, incorporating a wide range of assumptions about potential savings. More aggressive measures to realize cost reductions are projected to yield greater net savings. This implies that concerns about health system cost growth with single-payer may be misplaced, though costs to government are likely to grow as tax-based financing replaces private insurance premiums and out-of-pocket spending.
Could you could state that the newly reported issue is both duplicate and that the original report was closed as N/A?

Not applicable typically means the reporter is free to try to argue that is in fact applicable, but by stating it's both duplicate and N/A neither the second reporter nor the company will spend further time arguing back and forth, as even if the issue was applicable the credit would go to the original reporter.
Luftdaten (citizen science air quality project)
Something tells me this guy's gonna walk for office.
10 Questions for Teasing Out Market Opportunities
The Open University is pretty good for a heck of a lot of subjects, and there is absolutely no requirement for you to be in the UK to "attend".
Sounds like amazon is also to blame for allowing this behavior on their platform. Getting $$ from someone in China might be difficult from a legal standpoint.
Google informs users about a vulnerability with their Titan Security keys
Georgia Tech has a Master's degree in Cybersecurity for less than $10K. Here is a HN thread from couple of years ago.

https://news.ycombinator.com/item?id=17770135
It's substantially more common a viewpoint on here, at least anecdotally compared to my real life experience.
While your property tax is high, property taxes in CA are generally low. See Prop 13.

Also, feet-deep pot-holes? So how many cars are bottoming out each week?

California's tax burden is ~9%, and within 1% of the median:
https://wallethub.com/edu/states-with-highest-lowest-tax-bur...
Will AutoML Replace Data Scientists?
This is not correct. The virus is not airborne.
Money + Google's name on your resume + the experience of going through grueling interviews (self-confident).
It was two phone interviews that he didn't want to do back to back after having already completed two successful phone interviews. People can often take a phone interview over their lunch break as it is typically less than an hour. That is impossible if they want you to take two phone interviews back to back. 99.999% of companies don't do four phone interviews before an all day on-site interview. He was correct that Google doesn't respect an interviewer's time and that signals that they will not respect your time when you are an employee.
I was looking that up myself and came across a reddit thread [1] with a Wasmer employee seemingly equitably laying out the general differences.

This, however, elicited a response from a Mozilla employee claiming it wasn’t telling “the whole story.”

Does anyone know what the differences in perspective are here?

[1]: https://www.reddit.com/r/rust/comments/cx4nj3/comment/eykkie...
I've studied there for an MSc in Computing. It was good. The classes are a bit business-schooly but I got some good support from tutors. Obviously it depends on the individual tutor--the one for my project module wasn't as clear and supportive--but some are really fantastic.
"Hard times create strong men. Strong men create good times. Good times create weak men. And, weak men create hard times."
Hard problems are hard because they involve humans. For some reason, the author is confused between the two. Complicated or advanced is not the same as hard.

Anyway, impact is more important than complexity, and not quite as obvious.

A hard problem is climate change, or managing energy market, or figuring new recycling chemistry. Perhaps providing specific medical care in safe manner, or reducing health problems.
Providing food or housingfor 10 billion people, that's a hard problem.
Getting everyone free education of good quality is a hard problem.
Electronic voting is a hard problem.

Hard problems are generally ignored. They do not have obviously actionable solutions.

Complicated problems tend to have many solutions or partial solutions. Additionally it's easy to create a hard problem with an unnecessary solution to a non-problem, see that Wave thing he mentions. (There are many other workable and cheap loan solutions.)

Or fool yourself that you're actually solving any real problem. That typically happens if you define goal without consulting the subjects. (This Wave thing smells of it.)
Redistribution is zero-sum by definition.
I would never dare to suggest writing a new database in a professional context, even less during an interview. Probably as a joke at the coffee machine because it's ridiculous but otherwise no.

It's so many distributed databases around there, no one is better than one good PostgreSQL for the majority of uses cases.
Presbot is a platform to build your professional chatbot identity and engage with your professional network. Drawing inspiration from Linkedin, Presbot has real people behind the chatbots who can certainly network with each other but the chatbots can't on their own free will. Also, Linkedin is for people to make meaningful professional connections that can help you land your dream job, Presbot has the same tenet.
Python3 Allows you to put underscores in numbers for legibility:

a = 100_000
b = 1_000_000
You are assuming companies "did" try different methods of recruiting.

You will see, there are companies in bay area that actually differ on how they do interview.

Some are better than others.

Also remember this: google started hiring crazy in 2008 shortly after crisis when noone else was hiring. So google didnt probably try hard to sharpen its interviewing process...
So instead of measuring number of feature delivered, measure time to delivery? Do we not have an implicit time constraint in "number of feature delivered"?
On the contrary, it travels faster than Corona and is more lethal. And that's exactly why it isn't such a huge problem, a typical Ebola outbreak burns out so fast that it doesn't spread beyond the community it starts in.

If Ebola would ever start off in a major population center that would be an entirely different problem.
Not knowing anything about Rust, I would imagine similar as those of Erlang's. Basically when you need servers than communicate with each other.
I would take it to be a transition from conditions-of-traditional-autumn directly to conditions-of-traditional-spring, skipping the winter that's usually very distinct.

Which has happened in large parts of Europe this year, as the traditional conditions for announcing the start of "meteorogical winter" (which, for my area, is the daily mean temperatures being below 0 °C (32 °F) for five consecutive days) have not happened at all; we've had weather that matches "late autumn" all through from October till now.
The Internet: Gentrified and Gerrymandered
Scientists Detect for the First Time Quakes on Mars
I'm astonished no competitor like Walmart or Wayfair has gone on the offensive yet with TV ads stating flat-out that you can't trust Amazon anymore because their counterfeit problem is out of control. They'd make a killing with defectors.
> The position that they blindly incur this expense for no benefits is hard to believe

You really find it hard to believe that giant companies like Google spend money needlessly?
> and killed around 2% (variable depending on sources) of the global population - ~40 million.

To be unemotionally pragmatic: the current World population could handle the death of 40 million, or even 400 million, without macro-disruption.
Katherine Johnson, legendary NASA Langley mathematician, dies at age of 101