skysight-inc/HackerNews huggingface dataset:
I’m one of the creators of Serenade—thanks for mentioning us! We totally agree about the need for higher-level layers of abstraction, and we’re working on some of the code navigation functionality you mentioned right now. If you have any other ideas or feedback, we’d love to chat more, I’m matt@serenade.ai.
Nope. This link appears to be the Bill text which I’ll peruse in a moment, but here’s the Newsweek article I was reading last night.

https://www.newsweek.com/new-bill-would-give-nearly-every-ca...

And the relevant bit:

“The program would be paid for with a state value-added tax of 10 percent on goods and services, with exemptions for groceries, medicine, medical supplies, clothing, textbooks and other items. Recipients of several programs, including the state's Medicaid plan, would be ineligible.”

Not to wax too political here, but the insane part to me isn’t even the UBI bit which I’m not fond of but open to changing my view in the coming decades, the insane part is the introduction of a new type of tax we previously didn’t have, and near as I can tell isn’t intended to replace the sales tax, and not just a new tax, but at a pretty high rate.

Actually you know what? I just looked at the bill text, it was less than I thought and it was more insane than I thought. Here’s section 2:

“SEC. 2. It is the intent of the Legislature to fund the CalUBI Program with a value-added tax of 10 percent on goods and services, except medicine, medical supplies and equipment, educational materials, including textbooks, tuition or fees for education, food, groceries, and clothing.”

It is the intent of the legislature to fund it with a VAT, and if you know anything at all about California law, then you probably know that means a ballot measure which will need 2/3 support from the electorate. Theoretically that ballot measure could be used to replace the sales tax, but it probably won’t be because only part of the sales tax is State, and much of it is appropriated by law to fund very specific projects or programs.
It's not completely uncommon for SQL code execution, especially in complicated legacy systems, to become a performance bottleneck. You normally think of data access being the resource the server is trying to manage, but occasionally it needs to churn on that data as its querying it (because the computed values can't be stored for some crazy reason). In such situations, it would surely be nice to have SQL code itself able to access low level optimizations.
HackerOne’s community team also seems trained to gaslight ethical reporters who try to follow responsible disclosure practices.

I submitted a vulnerability to a vendor on H1 along with a typical “I plan on publicly disclosing this vulnerability on X date” note, and started getting emails directly from H1 telling me that this undermined vendors’ confidence in the platform and that doing what I was doing might make it so I can’t use HackerOne any more. In the same correspondence they said that my approach made sense—but they continued to threaten that “it would be a shame if you weren’t able to participate any more”.

In my case, the vendor verified the vulnerability quickly, but kept dodging my follow-ups by replying without answering my questions. When the vendor refused to assign a CVE after I asked four times, I contacted the HackerOne CNA directly to get an assignment. They replied within 48 hours asking if there was any public information already, I said no and that I was planning on disclosing on X date, and then they just stopped replying for a month until after the deadline passed.

At a glance, H1’s disclosure guideline appears fairly reasonable: 30 days by default, an upper bound of 180 days. In actuality, those times only start once a vendor closes a ticket, and can be extended indefinitely. Reporters aren’t allowed to speak publicly about anything they send to the platform until the ticket is closed and the vendor agrees to allow it, even in the public programs.

As far as I can tell, HackerOne’s primary purpose now is to act as a shield for bad vendors to hide their security defects from the public by using network effects to bully reporters into keeping quiet. The community team claim this isn’t what they’re doing and that they always ask “why should this be private?”, but their marketing material to vendors tells a different story[0], their actions with me tell a different story, and the vendor I reported to had over 100 closed reports, going back years, and none of them were publicly disclosed.

Unless you must pay your bills with security bounties, or don’t actually care and just want to dump a report and forget about it, I unequivocally recommend against using HackerOne to report a vulnerability.

[0] https://www.hackerone.com/sites/default/files/2018-11/The%20... page 12: “even with a public program, bug reports can remain private and redacted, disclosure timeframes are up to you”
It's like there was real value in a physical store where you could go, look at the product, and speak to experts about said product. Weird.

All snark aside, though, I see a resurgence in small, boutique mom-and-pop shops for goods in the next 5-10 years as Millennials and Gen-Z get sick of being scammed online. The biggest new thing is that unlike gen-x and boomers, Millennials and Gen-Z are savvy enough to have tried to remedy the situation for themselves and understand it's a whack-a-mole game with no winners.
Although both a smaller payout and a smaller state, the Alaska Permanent Fund is interesting precedent.

https://en.m.wikipedia.org/wiki/Alaska_Permanent_Fund

I agree that the CA proposal feels reckless, though.
Can you point to where the IRS has said that they can prepare returns for taxpayers?

As far as I know they can correct isolated pieces of information (e.g. wrong numbers from a W-2) but do not have the ability to prepare a return from scratch.

Edit: I mean, they can obviously put all the pieces of information they know about you onto one return and do the calculations. But there will be many pieces they don't know, and I think you are unlikely to get an accurate return without them (or based on guessing). But if the IRS says otherwise I would like to know.
2013

https://news.ycombinator.com/item?id=5842281
Do you know anyone in your community who don't have enough to eat but yet they are tall?
Interesting. Where do you get the elevation data?
> The sky's the limit when we do the things we were "born" to do.

I tend to think the sky's the limit, and we all need good mentors. Check out "Stand and Deliver", another great movie, based on a real story.
N95 vs. FFP3 and FFP2 masks – what's the difference?
Always when aided by a compiler or interpreter.
It's okay to point out duplicates, it's just odd to see it done in such a spartan manner over here.
> it would be pretty difficult to commit time to such a task when it's more fulfilling to work on personal side projects

Or if you, I dunno... have a child. That's something that (as a relatively new parent) leaps out at me with interview requirements like this. It feels like you need to get a job at Google before becoming a parent, or you're going to need to wait until your kid is in high school.
OpenSMTPD: An out of bounds read in smtpd allows remote root
Nope, she's not a venture capitalist, so this site couldn't care less.
Looks like an OCP mezzanine interface tho.

If a server can take OCP mezz cards and the BMC can be managed in the same manner and with the same tools as a fully OCP-spec system, does it really matter that it's not in an OCP-spec chassis and rack?
FlatHub has commercial, proprietary apps in Flatpak sandbox format. It's generally targeted at "desktop" users, but the Flatpak sandbox ought to work just as easily on mobile devices based on mainline Linux, including the Purism phone.
They "clearly aren't up to the responsibility"? Paypal has one of the larger application security teams in SFBA. You've decided they're not qualified because someone reported a self-XSS and Paypal didn't freak out?

Did you read downthread about the actual "2FA" feature this team "bypassed"?
Point blank: is it all worth it? Googlers and Xooglers alike, is going through all of this worth return? If it depends, what does it depend on?
Show HN: Viewing S3 File on LocalStack
Don't blame it on the machines: Robots and employment in Europe
Total lie by guy who goes after what other want from them: profits.

Getting something others want from you, especially figuring what it truly is, is a huge skill and advantage.
Epiglottitis. Oops.

And it's a he.
This would be good for in-memory database when the IO bottleneck becoming less a bottleneck.
They are not dense. Not by any measure. Show me a statistic that shows that the Bay Area is dense in comparison to anywhere else in the world. I am so sick of people make such incredibly inaccurate statements about density and housing.
Another post about success is only measured by position at work and money and "following your dreams", where usually the dream is get rich and/or famous.

According to my 10 years old me, I'm the most successful person in the world, because I wanted to learn to play the bagpipe (in my original country it was pretty impossible), now I'm moving to Scotland and learning to play the bagpipe.

Please don't buy this bullshit, that success is measured in job titles and whatever you can do at work. (Dont get me wrong, my job is important part of my life, I have a nice and IT fulfilling job, which buys my family food, a roof over our head because Scotland is pretty rainy.)
Please don't spread misinformation. This single comment is doing more damage than 10 comments based on facts.
Yeah it's one thing that gives some hope. Recently:

>Chloroquine Phosphate, which has been used for more than 70 years, has been tested in 135 cases in Beijing and southern China's Guangdong Province. Among them, 130 patients have light and common symptoms, and five are severe patients.

>None of the patients with light and common symptoms have developed severe symptoms. Four severe patients have been discharged from hospital, and one has seen severe symptoms mitigated to normal, Xu said. http://www.china.org.cn/china/2020-02/22/content_75732846.ht...

Which seems quite promising. Also it could be used prophylactically.
I've heard that performance is a feature but I feel like that understates the effort involved in seeking performance for a piece of software.

If you want to call it a feature, its closer to N features: 1 for each feature you have. If you have 10 features, and add performance, the effort involved isn't like having 11 features. It's like having 20 features. The effect is multiplicative.

This is because performance is a cross cutting concern. Many times cross cutting concerns are easy to inject/share effort with. But not with performance. You can't just add an @OptimizeThis annotation to speed up your code. Performance tuning tends to be very specific to each chunk of code.
Should I take risk of downvotes and explain it?
What Did the People in Hidden Figures Do?
I'm not aware of another industry that has interviews as awful as FAANG and their copycats. There may be something out there but I've not seen it. Try describing what they do to non-tech folks and watch the reactions. Incredulity and/or astonishment are typical, in my experience.

But yes we do have tons of jobs and IME most places don't do this crap. So that's nice, compared with how other workers have it. Though you won't get anywhere remotely near FAANG comp without encountering those sorts of hazing, high-prep, high-variability interviews.
>Not by any measure.

Person per mile squared?
https://en.wikipedia.org/wiki/List_of_United_States_cities_b...
Correct usage of IEnumerable helps a lot, as well as the magic that Linq can do with expressions.
The mathematical notation has developed over centuries to __think about and solve problems on paper__. Besides it being taught in schools and hence familiar, I think it’s not at all a good tool to use in the significantly different digital medium.

Another reason is that the notation is mostly a tool for __oneself__ to think in, but is fairly bad at communicating (think about the level of expertise required to read a math paper vs reading someone’s code).

Here’s a concrete difference to support these claims. Using math notation we often write large expressions which include many meaningful subexpressions and complex operations. In code we prefer to use lots of names (variables) and simple expressions.
> Younger coders seem to believe that technical ability should be the only criteria, and it’s not the only criteria.

You're the one defending rote tests (that literally only test for technical knowledge), not me nor anyone who replied to you (as far as I read).

From my previous comment:

>> You might have half point if you were saying that you discuss someone's portfolio during the interview (which would be analogous with the new hire discussing the code with the rest of the team to better gauge the decisions made), but you've said that you dismiss it and instead defend tests.

I value discussion, that's ultimately one of the things that matters most for a developer. And, mind you, thanks to git platforms (GitLab, GitHub, etc.) this is also becoming more transparent in portfolios, like by looking at how the candidate handles merge/pull requests and issues.

> your many personal insults directed at me.

Could you quote which sentences in my previous comment were personal insults? I'd like to know where I phrased myself poorly and apologize and/or explain my intent.

> If someone who was interviewing you read your comment, do you think they’d want to hire you more?

If someone who was interviewing me disagreed with any of my points, I guess not. Then again, I wouldn't want to work in such a company either; making it a win win situation.

I fail to see how this sentence is apropos anyway, HN isn't a job board.

> You said you’ve never gone long in between jobs, so why are interviews bothering you so much?

That's all but spelled out in the article and most of the comments, but I'll share my experience explicitly: I am yet to have a job, that used those leetcode type tests or generic coding challenges as part of the hiring process, where I needed to use the knowledge required for the tests or the challenges in the actual job.

It's a gigantic waste of time, testing for all the wrong things.

> Just because you feel like they’re pointless and interviewers are trying to feel smart doesn’t mean it’s true.

I'm yet to find a counterexample in any job I've had. You seem to be mistaking your own experience (assuming you actually do those tests for the "right" reasons) as the norm. Though I guess all of us are a little bit at fault of that.

> Jumping to a negative conclusion isn’t the best idea, even if you’re right.

You are the one who told someone else to stop complaining and even made another not-apropos comment about how complaining is a red flag. There's no way to interpret that other than negatively. If there is, I would love to read what you meant by that.

> The person who’s criteria matters for loving programming is you.

Alas, evidently it doesn't, because even hiring managers/interviewers/recruiters who comment in HN posts about the awful state in hiring for software engineers think that rote algorithm tests are of utmost importance, and I don't particularly agree.
What kind of mathematical correctness are you getting by using FP? The same kinds that the Rust compiler offers?
Same just down the road, but they're also service vehicles, so they're out and about regularly. http://hamilton.plowtracker.com/
I was referring to the native execution using LLVM. Which should be independent of the underlying storage strategy (column-store, row-store)
In this case instead of a golfing buddy, his son-in-law was appointed to deal with Israel/Palestine.

Nepotism is a problem, as is cronyism.
Read the bill - many of CA's existing welfare programs are staying in place. Their INCREASING admin costs with this bill. UBI should replace most/all other welfare programs, if reducing admin costs is a goal.
This is one of the fastest, most responsive searches i've ever used. Great work!
The guidance I've always seen is that the black bar is added "when someone important to the HN community dies". And I agree with the commenter you're replying to, Katherine Johnson and her work certainly qualify as important to the HN community.
Some combination of:

- fully interpreted

- very weakly typed

- highly applicable to a broadly desired use case, i.e Personal Home Pages (hence the name PHP)

It's not too different from what made Excel such a broadly accessible and impactful 'programming' tool.
In Portugal there is this thing called viactt which is a crappy reinvention of email. The issue is that it is mandated that official communications with the state be done like through it. It emulates the conventional mail so much that the "letter" contains a picture of the stamps. If you are a company it is the official way of communication. It was done as part of a modernization initiative but now everybody just hates it due to its general uselessness and rare usage.
"Equating credit card fraud to physical theft is silly. "

In both cases someone is out money. It isn't a difficult step.

Fraud costs the credit card industry. It costs issuers (they shoulder 60% of the direct cost), merchants, and it costs the future of the industry because it is a nuisance for end-users.

They make a standard of best practices to reduce fraud. Following those best practices is good for every single participant, outside of criminals. Reducing fraud wholesale is the goal, obviously.

Spinning this in a nefarious fashion is not helpful to anyone, and does nothing but muddies the waters.
> Also, there's a world of difference between "managing" and "leading". Conflating the two is a root cause of many problems.

Exactly. I think the military distinction between command (leadership) and control (management) is very relevant here. One is setting overall enterprise goals and defining personal missions in this context. The other is checking resources, constraints, reporting, etc. These two are very different, hence the fundamental military distinction between the commander and his chief of staff.
You assume that all webpages are "a bit of HTML", which is imho an arrogant way to look at Client-Side web development.
I did not downvote you, but how is static typing in any sense revolutionary? It is certainly not a new concept and you know it, but your answer does not elaborate any of this at all.

It may be factual, but it is factually useless.
Sadly, I'm not in his district, so I can't vote for him.
The current interview process is expensive for giant tech companies.

In one hour chunks, per candidate:

- Engineers for the phone screens or coding assessment reviews: 1-2

- Interviewers for the on-site: 6-7. 3-4 engineers, 2-3 managers

- Reviewers for the feedback sessions: Interviewers + 0-2

This doesn't take into account the cost of HR, flights, hotels, on and on.

Giant tech companies have data going back decades now on the performance of this method vs. alternatives. The position that they blindly incur this expense for no benefits is hard to believe.

If you have a cheaper, more accurate way of identifying candidates that also improves the candidate experience it sounds like you have a winning start-up idea. Please go execute.
Thank you for sharing! I recently started working from home and had the stiffest neck after a few days. I realized I needed to raise my screen to eye-level again (as I had at the office).
The Sculpt and Kensington expert trackball (big trackball, not thumb trackball), while not fixing my issues completely, did improve things for me quite a bit.

That said, barring genetic lottery, as the sibling said: enough 15 hour sessions are going to give you RSI no matter what you’re typing on. There’s no way to do that every day, and exercise, take breaks, and sleep enough. Balance is important.
The part about Google not respecting your time is I expect pretty ubiquitous among big tech cos. The hand off between outsourced sourcing (LinkedIn searchers) to inside co recruiters is often a fumble point, so is the time between passing a screening and next step in the interview process. Whenever it seems you move between one functional area and the next (sourcing,recruiter,interview, packet/candidate review) there is some unnecessary (from the candidate perspective) waiting. I think this is unlikely to ever get better.
Uhm, but weren’t they operating via a bug bounty program? Now they’re supposed to be a registered auditor or whatnot?
Living in a trailer anywhere too uptight to approve a tiny house is almost certainly not something you can do above the table since that is likely what the bylaws that are preventing the tiny house were adopted specifically to prevent.
Every expert? There are other out breaks and issues happening now and could happen in the future.

From my minor lay person knowledge, every year there’s a decent sized (not in a good way of course) outbreak in Africa, South Asia, and/or more rarely, South America. If not multiple.

Why would you re-assign people working on those or other things that are serious?

I don’t want to put words into your mouth, but personally I know one person who essentially said because the African or South Asian issues are localized. He only cares if it’ll possibly affect him. Again not saying you are saying this.
Platforms invert collective action problems
Storing grain for multiple years was possible for a long, long time. The Bible story of Joseph is perhaps an exaggeration or an extraordinary event, but storing grain from "good" years in order to consume it in "bad" years is something we've been doing since prehistoric times, we have archeological evidence that this has been done in Egypt before writing was used.
Google will at best deliver you privacy against everyone but Google.
Ask HN: Should I disclose disabilities in applications?
Hey Fellow HNers,

I'm in the middle of finding a new job and I wanted to see how all of you handled the disability part of resumes. I've seen a lot of posts lately about depression and ADHD, and was wondering if you used this to say you had a disability and disclosed it in initial applications? Thanks!
Safari will stop accepting HTTPS certs that are valid for more than 13 months
> So you need to be MITM'd and have a malicious cert installed?

No. The attacker is the man in the middle to himself, because why are you trusting the client.

> A "security" flaw that requires stolen creds and brute forcing isn't going to get much traction anywhere.

The feature is meant to stop people from using stolen creds.

It does not work.

Given that stolen creds exist, that sounds like a security flaw to me.