skysight-inc/HackerNews huggingface dataset:
> Well the point is, Authenticating the user happens before the JWT token is issued

In the case of OIDC, the ID Token is the contract of authentication. So when I login via Google, both the consumption of my username / password to produce the ID Token JWT, and the consumption of the ID Token by the third-party are authentication.

> For example, a user signs in and gets a JWT token that has the permission Delete.Everything which in this example is the permission required to delete all a users resources, the client takes this and passes it to the backed.

This is again confusing a common use case of JWT with what it actually is. A JWT is just a signed token. The concept of a 'permission' used here is an abstraction upon what JWT really defines, which are 'claims' (i.e. signed information).

> On the backend however, the user might not even be allowed to delete everything. Maybe they're under investigation, or maybe this particular service just doesn't allow it. But its not the role of the JWT to tell you whether or not this particular user is allowed to perform that action,
all the JWT token tells you is that this user has allowed the bearer of the JWT token to perform that action on their behalf.

This is a usage detail for which there are several valid approaches. It's not uncommon to see a JWT used as an authentication token be the source of truth, with only invalidation based on unique id (jti).

The concept of the JWT being correlated with a user authorization is an entirely synthetic one. It's a common use case. Check the original RFC.

> But, doesn't mean the user is allowed to perform that action to begin with, so the user has given the client permission to perform an action they themselves aren't allowed to perform.

Consider this counterpoint: if the JWT itself is not itself a statement of authorization, what's the point in signing it at all? We could just be sending a unique id corresponding to this token (like a circa 200x OAuth token) and get the same effect. JWT is used for a common pattern, but it's important to understand why that pattern is chosen.
Java uses lazy linking, but Java's static type system is sound (modulo some bugs [1]). The Java VM type system is different from that of Java the language, but it is also sound.

[1]: http://wouter.coekaerts.be/2018/java-type-system-broken
This is one of the things Ruby nails with its ensure statement that lets you clean up properly even if an exception was raised.
As a software dev just to the north in Vancouver, BC at 110k CAD: that's bananas money.
So, removing incentives and expecting the same results?
GDC gave attendees incomplete and outdated virus updates
I had a lot of insights generated from this opensource program.

https://medium.com/guesstimate-blog/introducing-guesstimate-...

https://github.com/getguesstimate/guesstimate-app
I think you two are using the word "safe" differently. I agree with you that go is memory safe, but I think they mean more that business logic will do something wrong because you got an err you didn't handle, vs deferences a null or something.
Ocaml can be extremely performant - both in terms of throughput and latency - in the single-threaded case. There's a particular set of problems where Ocaml's performance is bottlenecked without multicore, but that's far from most.

Anecdotally, I once worked at an Ocaml trading firm - where microseconds could matter! - and at least at the time, folks there weren't particularly interested in multicore. We have async/lwt already, and we spun up multiple processes for parallelism. A 10% performance drop for multicore support that we didn't need would have been unacceptable for us.
The broad theory is that austerity is necessary for growth - it's a serious theory even if I think it turned out to be wrong with terrible human consequences.

The Reinhart and Rogoff paper was more like factoid of a theory - no complicated model, just a dubious claim that trips off the tongue - "Studies have shown that when debt reach X level, growth tanks"

The thing about this is when the shoddy quality of the study became obvious, people could act that was what drove all the horrible things coming under austerity, as if these weren't the consensus of a large group, study-or-not-study.
Devil's Advocate; Aren't you asking for a Browser to manage your content like the Cable Companies?
> On every page you navigate to from within the website you'll first get a pop up asking to choose between browser and reddit app.

There's a user setting for this, somewhere. I found it once. It's default on but once you un-check it you no longer see the app nags. It's great. And terrible they hid it like that.

--edit-- Or there was, damned if I can find it now.
People are packed together a lot more closely at an event than at work.
They aren't even telling employees which group or floor the employee was in, so employees cannot even gauge their risk level.

Imagine going home to your family without knowing if you've been exposed to a disease that has a ~2% mortality rate.

...and then the company asks everyone to come back into work the next day.

Google's response here is shocking.
Take a look at SAASPASS Authenticator & Password Manager. You can use them separately or integrate them for extra convenience and autofilling options. The desktop browser extension can autofill both passwords and Authenticator codes and on mobile with iOS 12 onwards with autofill capabilities.
> Moore's law is about transistor density

It's about the number (not density) of transistors on the most economic die size.

It's broken for a long while, since modern processes are much more expensive than older ones.
Well no, for the reason I describe above: if you have the pattern

mut a = 4
f(a)
print(a)

In rust and python, you'll always get 4 in python, but the value in rust depends on `f`.

This means that the passed variable is immutable but shadowable, as in rust. (An object in python is much more like an Box/Cell, so the contained object can be mutated, but the reference to the box itself is immutable).
Sure but an e-bike is allowing one to replace a car, not a bike. In that case, L1500 is a steal.
I forgot to mention this earlier, but there are also forums like the "SomebodyMakeThis" sub-reddit. Basically, a place for people to talk about things they wish existed. This could probably help seed some ideas for you as well.

https://www.reddit.com/r/SomebodyMakeThis/
"I'm expecting an explosion of these new light vehicle body types in the coming decades, as global trends of cheap electric drive + batteries, increasing urban congestion, and less car-oriented urban planning trends converge"

Don't motorcycles already serve that purpose? Its already the chief form of personal transportation in most of the Earth's population.

The problem I see with all the concepts you posted is that they have all the drawbacks of a car and a motorcycle. They would fare as well as a motorcycle in a crash, and have almost the same footprint as a small car. Also, a motorcycle will handle much better than a trike with narrow tracks and short wheelbase at higher speeds.

Then, there are electric assist bicycle. They have two main problems that small motorcycles/scooters don't suffer from. A 350lb scooter/motorcycle is much harder to steal than a 50lb electric bicycle. I own a rather expensive electric assist mountain bike that I don't feel comfortable parking it out of my sight. You can't travel on the highway with electric bicycle unlike motorcycles.
You use a firewall on the device to block requests to the ad server. Most apps will keep working fine. Then all it takes is an OS that lets you revoke permissions on sensitive data without the app knowing.
Make them look like dinosaur tails, sell them with a dinosaur hat, market them through grandkids!
More travel, more mixing. There's probably also more of a short-term optionality with events (although cancelations affect lots of people in various ways) than with basically telling companies to send everyone home.
What kind of persisted settings?

Surely those things should live in the application, no?

Other things like blog gadgets to choose different themes (or whatever) probably should live in the URL to facilitate bug reports! I think Internet users are savvy enough to remove that stuff from a URL when sharing on HN (and if not, the mods seem to).

Also, I think it's pretty clear I'm talking about navigation and queries in the above though, just so there's no other confusion: I definitely suggest continuing to use setState or ref for input boxes!
Yes back in the day - SEO’s would “link sculpt” internal do follow links as an on-site optimization technique. The idea being to give the do followed pages all of the link juice to rank their key pages for sales/conversion etc
Tech Preview: Real-Time SQL on MongoDB Backed by Converged Indexing
What history? SARS and MERS?
I used to work for a GIS company. All of these companies' tools are based on whatever software development platform was current when the project was initiated. The mapping tool may grow to be 8, 10, 15, even 20+ years old and new features are continuously added, but never is the underlying software platform upgraded or the tool rewritten.

I'm not sure why this is or even if it is peculiar to GIS, or just more visible compared to the many slow-to-upgrade software fields which don't have a UI or which do more server-side. Also I think some of it is also driven by having one or more big customers who themselves refuse to upgrade.

The effect was particularly visible as an outside team was developing a greenfield iOS app for our data at the same time as our team maintained their old-new Windows app. The iOS team was able to, as they say, "move fast and break things" and gain accolades for whizbang features. It was interesting to watch them accomplish more with less computing power and a more primitive (IMO) development language (their Objective-C to our C#).

Edit: I called it the "old-new" Windows app as there had been an even older app (predating C#) which the C# app replaced. In the circle of life the once-new C# app itself became ossified and stuck with whatever short-sighted design legacy decisions were baked in. There was a lot of technical debt in the codebase.

I should say, partially replaced, as they were never (while I was there) able to convince all of the customers to upgrade from the original app built, hence why I say that big customers who can simply refuse to change might be a factor.
Then they should have multiple marks.

One which means “we sanction this person/their twitter persona” and another which means, “this twitter persona belongs to or is controlled by the person who it claims to be.”

We don’t need this muddled confusing system.
Well FAANG seems to be missing an A, and a certain company does cloud computing starting with an A
The Drunk Men I Drive Around Every Night
the new UI is so uncomfortable to use, I don't like how bloated websites are becoming, but usually I can cope with it. Reddit's is just bad. It's buggy, it's inconsistent, and its resource-intensive.
Banning events is also cheaper.
How to improve our chances to build useful software in an ethical way
Like the Apple 2, having so much logic exposed, due to use of discrete logic chips, there are mods to do lots of things.
The premise of the article is about incorrectness in a language. So while I agree that most bugs are likely caused by the developer and not the language they are using, I think my comment makes sense in reference to the main post.
In terms of vaccine development, yes. In terms of the economics of health care distribution, I'm not so certain.
There is a clear distinction. RuntimeException (and descendants) is an internal problem (e.g. divide-by-zero); Error (and descendants) is a VM-internal problem (stack overflow, OOM); checked exceptions are external problems (e.g. IO exceptions).
Did Vancouver's experience result in a shift in transportation priorities long term? Or after the Olympics, were people eager to go back to the prior status quo?
We want to work on something cool and this is one way to jump in.

I think it's really case by case if it works or not.
Bitbucket also have frequent downtimes: https://bitbucket.status.atlassian.com/
This virus transmits most efficiently in a cool dry environment, like an A/C controlled office.

That is why the hotel in Singapore and the cruise ship were such hotbeds for transmission.

What Google is doing here is acting with complete idiocy - with ZERO regard for employee health and safety.
Compatible with everything except IE 11, but in draft: https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pref...
A fully illustrated article [1]

And Lilian Weng blog on self-supervision [2]

.. CPC is .. translating a generative modeling problem to a classification problem... uses cross-entropy loss to measure how well the model can classify the “future” representation amongst a set of unrelated “negative” samples...

[1] https://ankeshanand.com/blog/2020/01/26/contrative-self-supe...

[2] https://lilianweng.github.io/lil-log/2019/11/10/self-supervi...
The value in Rust does not depend on f.

I will be precise. There is no definition of f such that this function will print anything other than "4".

fn main() {
let mut x = 4;
f(x);
println!("{}", x);
}

Again, you seem to be confusing mutable references and mutable variables. If I had written f(&mut x) rather than f(x), you would be right.
Fair point, except - I am more concerned with tracking than the ads themselves. Which means I want to block Google fonts anywhere, and only allow domains when I want to. So no, I prefer uMatrix approach.
Well, realistically many people are dying from spreadsheet incompetence (also named "clinical research") every day, so...
In our office, in Europe, it is mandatory to work from home for 2 weeks after traveling to any area affected by the virus (whatever it is a personal or job related trip).

I do not think that USA work culture is compatible with this measure. I hope I am proved wrong and health care takes higher priority that having people siting in an office.
Ray Panko of the University of Hawaii has studied the problem (and prevalence) of spreadsheet errors for decades:

https://www.researchgate.net/profile/Ray_Panko

https://web.archive.org/web/20070617035246/http://panko.shid...
>He realised that he would not only have to slash his salary, but also mortgage his two houses and give up his stocks and savings.

Not sure if this means ALL of his stock, but this doesn't seem to be the same thing.
Hardware is evil, this is why we migrate everything to The Cloud!

And get angry every time The Cloud serves us a painful reminded that it's just Someone Else's Hardware.

My favorite Faulty RAM story involves working for a hosting company that at some point homebrewed some Linux-based TCP/IP load balancers to offer customers instead of a proper F5 or whatever. This particular load balancer is restarting itself every time one of the Windows servers behind it fails a health check. Obviously not a desirable situation.

A tenacious young tech not yet battle-hardened to the fallibility of hardware had been working on the load balancer for hours. Eventually throws his hands up and calls for a Windows guy 'cause obviously Windows must be doing something weird to make the Linux crash. Linux never crashes, amiright?

Grizzled veteran that I am, I'm telling him to replace the RAM before he can finish explaining.

If you can't fathom what the problem could be, if it really isn't DNS[0], it's probably going to be RAM. If it's not RAM... update your resume and burn everything to the ground.

[0] https://www.cyberciti.biz/humour/a-haiku-about-dns/
Why does HN assume I have a Times subscription?
That's interesting, thanks.

Non mobile link: https://en.wikipedia.org/wiki/Special_English
The File Clearview AI Has Been Keeping on Me, and Probably on You Too
This is worth the read. Regardless of how you feel about Bloomberg, the article reveals a lot about how elites work together to "protect" one another. My impression is that the elites who do this don't consider it "bad", any one of us would probably behave the same way and convince ourselves we had the best intention.

However, the net effect is to create a deeply skewed picture of reality.
They do translate into real-life performance though and unlike many other languages, for the most part without "writing C in language X".
Scholars Debate Causes of Women’s Underrepresentation in Stem
Or, I keep using single factor because services MFA implementation sucks tremendously, and as per service agreements service is liable in any security compromise case.

Frankly, most of MFA is security masturbation, is nowhere near to being a real solution, not even a real problem. Its just neat from a technical standpoint (if done well, which nearly never happens).

A minimum of 2 registered u2f keyfobs, that's all you need to make it usable and safe. Nobody does it, and trusts people either backup their otp codes or never lose or break phones. Ridiculous.
golang's broken interface design also encourages hacks (which lead to difficult to track down bugs) like this: https://github.com/golang/go/issues/16474
Classic: “There are only two kinds of languages: the ones people complain about and the ones nobody uses.”[1]

The thing that bugs me is the comparison to Rust. I mean, the author did caveat that he chose it because Rust provided the best available counter examples to his specific gripes. But my issue is that comparison seems to make a false conclusion: Rust is better. My intuition says if the author used Rust (or any other language) as much as they have used Go, and in the same environments solving similar sized problems, they would have a completely different 1000+ word rant on all the things they hate about that language.

We have an expression "use in anger". It describes a particular kind of understanding that only becomes available when we face the real problems and not just idealized ones. I even see smaller rants within this comment section showing how the very systems he lauds in Rust have sharp corners when used in anger.

I thought this rant had many good points and highlights many shortcomings of Go. I would have preferred that it did not contain the comparison which draws an implicit conclusion that IMO is likely incorrect.

1. https://www.goodreads.com/quotes/226225-there-are-only-two-k...
Articles like this are evidence of Go's huge success.
JavaScript Reference Monitors
Part of me thinks theres an internet ad bubble. I think its really hard to know how much value an ad provides, so it gets handwaved as being critical to success and worth tons of money. A lot of big internet companies rely on ads or provide services to companies that provide ads or make it easier to use ads.
A 486/66 ran Doom well and Duke Nukem 3D mostly ok. (Even a 386 run Doom, although quite poorly.) It's quite reasonable to be able to draw a few polygons on it at low res, although it can depend on tricks and skill of the programmer - including math approx yielding a visually good enough result for a fraction of the computing power required for the exact one - to get very good or mediocre results.
For Google's predominant age group the mortality is more in the realms of 0.2%.
And seven times as much as I make working as a compiler engineer with a double BSc and MSc in STEM. Salaries do vary a lot with location.
Censorship or 'work elsewhere': Inside Shutterstock's free-speech rebellion
Is it two different arguments you're posting? How's $0 on zero requests is a better solution when the range would be 0 to $2000 for what's a fixed $4 without Lambda?

The $0 argument is also flowed because $4 is a fixed cost for unlimited $0 to $2000 solutions through hedging. If you have 10 solutions, what's the likelihood of all of them still doing $0, or at the very least below $4?

The unit economics argument is likewise hard to see in practice, because we'd be talking quite different numbers on a per-unit cost with Lambda vs. without, which may easily make the difference between making a profit or taking a loss, especially if it's a lifestyle business we're talking about.
Brilliant! This really resonates for me, as someone who's used to dev tools for centralized state management (a la Redux or especially Mobx) ... thanks for sharing and good luck! :)
In a similar vein there’s a story and YouTube video of Russians plugging an out of control burning oil well with a small nuke.

Edit. It was a gas well here’s the link https://youtu.be/S57Xq03njsc
Not shocking at all.

It's a lack of leadership which shouldn't be surprising given that most corporate executives don't really know how to act in situations outside of their realm of experience.
I see many listings for them on US Amazon.
You get a compiler warning.
Why would allocation become more expensive in parallel? Surely you’re allocating in thread-local space? It’s like two machine instructions. Where does the extra overhead come from?
Its probably an employee health privacy issue. With sufficient hints you could probably narrow down who it is.
Yes, plenty of languages do this. For example, Racket exposes permissions as bitmasks but they work portably across platforms, and Racket handles all the filename encoding issues mentioned here.
I use BlockAda, It functions like a VPN which can be annoying if you use a VPN a lot but otherwise it is a simple on off switch for people who aren't very savvy with their phones.
I think most physicists are either religious ("sneaks in at a higher level"), or believe that free will does not exist; from a physics perspective you are no different than the smartphone in your pocket.
Even if golang gets generics, it has so many other flaws that make it an non-starter for serious projects. This won't stop people who are driven by hype from using it of course.
Can you cite some of the worldwide public health community that disagrees with the assertions? All the alarmism I've seen is coming from a media, typically with wildly outdated or incorrect statistics.

WHO's clickbait ten tips for conoravirus include statements such as "Most people will have mild disease and get better without needing any special care." [1]

If you read the stuff they've been publishing, you'll get quotes such as "Most people infected with COVID-19 virus have mild disease and recover. Approximately 80% of laboratory confirmed patients have had mild to moderate disease, which includes non-pneumonia and pneumonia cases", and "Recognize that COVID-19 is a new and concerning disease, but that outbreaks can managed with the right response and that the vast majority of infected
people will recover;" [2]

They also discuss how we're already seeing the death ratio dropping substantially, and treatment is being improved: "In China, the overall CFR was higher in the early stages of the outbreak (17.3% for cases with symptom onset from 1-10 January) and has reduced over time to 0.7% for patients with symptom onset after 1 February (Figure 4). The Joint Mission noted that the standard of care has evolved over the course of the outbreak." [2]

CDC publications and announcements follow similar sentiments.

Edit: adding NEJM quote that supports my assumption about sampling issues: "We found a lower case fatality rate (1.4%) than the rate that was recently reportedly, probably because of the difference in sample sizes and case inclusion criteria. Our findings were more similar to the national official statistics, which showed a rate of death of 3.2% among 51,857 cases of Covid-19 as of February 16, 2020. Since patients who were mildly ill and who did not seek medical attention were not included in our study, the case fatality rate in a real-world scenario might be even lower. Early isolation, early diagnosis, and early management might have collectively contributed to the reduction in mortality in Guangdong." [3]

[1] https://www.who.int/dg/speeches/detail/who-diretor-general-s...

[2] https://www.who.int/docs/default-source/coronaviruse/who-chi...

[3] https://www.nejm.org/doi/full/10.1056/NEJMoa2002032
And that age group does not have social contact to people over 50?!
Why I Joined Imply