skysight-inc/HackerNews huggingface dataset:
The WHO has come across as pretty incompetent in my opinion. We could have stopped this disease from spreading outside of China but the WHO consistently downplayed the severity and claimed travel bans were overkill and would be too damaging economically.

Now they’re saying it’s likely too late to contain the virus.

Well I wonder what will be more damaging to the economy? The proposed travel bans or the catastrophic effects of a worldwide pandemic? How many people will die in underdeveloped countries because the WHO didn’t act aggressively enough when they had a chance? If this hits Africa 10 million could die.

Thanks WHO
"DX" is indeed important. Myself and a number of other academics have been researching the topic for years.

See here for examples of publications in the area: http://web.eecs.utk.edu/~azh/publications.html

Also relevant, I wrote a blog post for students to get started in human factors in software engineering: http://web.eecs.utk.edu/~azh/blog/guidehciseresearch.html
It's better for everyone to be a leader than for the company to select the wrong leaders. But if the company is capable of picking leaders well, then that's better. But it's much harder than it looks and most companies get it completely wrong.
Are you in the current presentation of either 124 or 125 by any chance? I'm in both, planning to do the BSc too.
Reading just the headline I thought this was a tool to measure human system load (e.g. attention). Neat nevertheless.
Sorry, just to repeat the license fee is not a TV tax and is not a requirement for ownership or use of a TV.

It is a requirement if you are going to watch broadcast media with your TV.

If you just watch DVD/Blueray or play console games and don't have an aerial or dish you don't have to pay.
Snel: SQL Native Execution for LLVM
Although WASM types only have 32/64 bits it has 8/16 bit operations too. So it won't matter much:

https://webassembly.org/docs/semantics/
The mitical “it’s not a bug, it’s a feature!”
Maybe because the actual privacy benefit for this change is negligible? (Or so I 've been told).
Show HN: Livresq – An authoring tool for education – web-based
To be fair they are probably not designed specifically for that, the issue is big players are much more likely to have more political leverage.

Or is that one much like GDPR? Crazy fines that only big players can afford, in such a case, that was poorly designed.
Coronavirus looks more like a pandemic: Italy, South Korea and Iran report cases
https://mathiasbynens.be/notes/javascript-encoding
Yeah, local radio in the UK is mostly rubbish. BBC and commercial.

Commercial local radio has been freed of most of the licensing stipulations that required distinctive local programming or specific types of programming. That is a shame but it doesn't follow that all commercial media has to be rubbish.

On balance, I think the BBC has been a good thing for the UK. However, it's undeniable that the BBC's presence has made it harder for commercial providers to flourish.
Session types do exist in other programming languages. Unlike what the site seems to imply.
My first dev job saw this fad come through the department one season. It went from "Here's your feature for this week, please implement it" to "Here's your feature for this week, you're the leader for development on this! Please implement it.". I understand that middle management has basically nothing to actually do, so it invents shit like this, but it pisses us off that actually do something to have this weird changing layer of bullshit smeared over what is a feature factory job. You can't shine shit with buzz words.
Except, especially regarding the former tweet, I get the impression that he's having a pipe dream (with all respect), and he's heavily criticized. Did he actually program anything serious recently? He seems to be mostly tweeting about languages instead of actual technology.

Honestly I can't make sense of what he's saying there, so there's a chance I'm not getting an important detail, but GC has nothing to do with function specialization. What does the following even mean?

> Without garbage collection, offering an array of bytes where an array of integers is required requires stack-allocating an array of integers and converting each byte to an integer every time a subtype is used in place of an actual type. This is so absurd that it’s not done.

The only interpretation of this that I can come up with would be just factually wrong.
Its a question of tolerances, if they break when someone stands on them they there is a decent chance they will break when you sit on them, or sit down too fast, or sit on them on uneven ground that distributes slightly too much weight to one leg, or they have been in the sun too long and have become brittle.

I'm a relatively tall guy and am wary sitting on these, standing on them would be certain failure. They are essentially cheap trash that will spend ~12 months looking like a chair and 500 years looking like a broken chair in a landfill.
Well, besides anonymity, my requirements for a reliable communication method include not being tied to my phone.
If you’re willing to share, I’d love to see photos! This sounds very much aligned with permaculture philosophies (which can be extrapolated to areas of life beyond food production) [0]

0: https://en.wikipedia.org/wiki/Permaculture
Lambda Functions Marketplace: Idea Validation. Help Needed
This is a good story, but the title seems needlessly clickbait. The flaw was fixed rather quickly, the process for communicating the issue did not seem to be a hassle.

It does not really say that the app is "super not secure". Just that people make mistakes, and it's not even shameful the way they reacted to it.
HackerOne appears to be completely broken and I wouldn't recommend it to anyone.

Disagreements are to be expected on a bug bounty platform, but these days they just stop responding altogether and don't pay. It borders on outright fraud.

I've been trying to report a Squid RCE (CVE-2020-8450) since October. The Squid maintainers seemed unprepared for dealing with the report as they kept being unresponsive and it took 2 months to merge my patch. Maybe they're volunteers, so I can't blame them. Reported it to the bug bounty [1] which promises high rewards on January 20th and apart from triaging it, there has been radio silence since despite having invoked HackerOne mediation. I have more Squid memory bugs and I'd rather rm -rf them than go through this process again.

HackerOne used to be decent but this appears to be a structural problem now [2].

[1] https://hackerone.com/ibb-squid-cache
[2] https://twitter.com/DevinStokes/status/1228014268567547905
Version 2.9.11 of MONARC has been released with several fixes and a new feature
Same here. Making things simple actually takes quite a lot of practice.
They've certainly been criticised for not "attracting and retaining younger audiences" who are "increasingly turning to subscription on demand services, such as Netflix" [1] which don't need TV licenses.

Of course, a Rupert Murdoch type who wanted to shut down the BBC would argue that low viewing figures prove the injustice of forcing people to pay for a service they don't use, and therefore the justice of privatising; while high viewing figures prove the viability of the BBC as a subscription service, and therefore the viability of privatising.

[1] https://www.telegraph.co.uk/news/2019/10/24/bbc-losing-gener...
Well for one thing it prevents ISPs from injecting ads (or worse) into sites.
The Demystified series is amazing. You can learn anything - from Pre-Algebra to Supersymmetry!
> PCI DSS requirements specify that companies have 30 days to refute or remediate externally reported issues [1]. If they don’t respond or fix some of these issues, then PayPal will no longer be compliant and all credit card companies will be forced to stop working with them unless they wish to set precedence that PCI-DSS compliance is no longer required to be followed.

Quote from your source:

> If your scan fails, you must schedule a rescan within 30 days to prove that the critical, high-risk or medium-risk vulnerabilities have been patched.

Scan in this sentence refers to "a PCI DSS external scan".

The list of approved vendors that can conduct PCI DSS external scans can be found here: https://www.pcisecuritystandards.org/assessors_and_solutions...

Please find cybernews' certificate number there and quote it for us, I have looked and can't find it.

I would guess that, contrary to your implication, they are not an approved scanning vendor. If this is the case then it really does not speak to the characteristics of PCI-DSS and your comment just seems wrong.

And even if they were an approved scanning vendor, from what little I know about PCI-DSS, these scans are part of larger process - so even if they were an approved scanning vendor the scan failure would still have had to be part of the larger process for this 30 day limit to apply.

I could go on and on about how much I hate PayPal and random other things, but just because I don't like something does not quite justify making false claims about it.
Parallelize Pandas Dataframe apply function
You can follow the WHO records themselves.
https://www.who.int/emergencies/diseases/novel-coronavirus-2...

I'm not sure why you're getting upset/annoyed with the media. They're not going to cure / help with anything other than information.

No need for the tinfoil hat.
> Cellular automata are a very interesting device to recognize languages.

I'm going to require one hell of a source for this...
As a Brit, I consider the BBC to be at least as essential as most schools. Life without it is really hard for some of us to imagine.
GDPR only charges big fines to big players.
I've been pursuing mathematics as a hobby for the last 2 years or so. I got a mathematics major in undergrad so my motivating factor was mainly to explore some areas that I hadn't done coursework on, primarily algebra and number theory. (I focused more on logic in undergraduate/grad.)

I really enjoy how the subject is divorced from a lot of the modern attention demands and encourages more of a 'zen' thinking style.

As others have highlighted, it can be difficult. I work full-time as a software engineer and at the end of the day there's usually not much left in the tank in terms of "creative work". The morning is usually more productive for me - generally I'll spend 10-15 minutes on the commute in reading over the proof of some lemma or working through some computational exercise.

Things that have helped me:

- Focusing on a particular problem area rather than just "mathematics". The classical problems of Gauss and Euler tend to be more my speed than the modern mathematical problems of Hilbert or beyond. What started my journey was looking into the insolubility of the general quintic polynomial equation, something you learn in high school as a random factoid but has a lot of depth.

- Studying from small textbooks that I can fit in a backpack, so I can "make progress" during my commute. Dummit + Foote might be a great algebra reference but it's just too bulky to transport.

- Limiting the scope of how I think about the activity - my goal isn't to master these concepts on the level of a mathematics graduate student, it's more on the order of Sudoku. If I don't get something, that's okay. People spend their whole lifetimes learning this material and I'm just trying to fit this into whatever creative time I have left after the full-time job is done.
First mention of hoodie here. I'm surprised.
Note to self: check out Pangolin and Clamp.

I've got to say, they sound totally believable. I'm not entirely convinced you're making a joke here.
The 2% mortality rate is for the whole population, if you end up in the hospital with acute pneumonia the mortality rate is around 61%

https://www.scribd.com/document/448385523/s-2213260020300795...
They were created for sincere reasons, and with best intentions. In the real world best intentions always conflict with the motivations of individual players.

It just isn't reasonable that PayPal would be cut off. That was always a toothless threat, at least for larger players.

As an aside, PayPal is a marvel to me because it is effectively lost in time. Using their tools and interface is like stepping back to 1995, and it seems -- from an outsider perspective -- that it must be some duct-taped quagmire that is barely holding on.
Can I verify that the build installed on my Android phone[] is identical to the one that I compiled? For instance, if I mount the device in Linux I can only see /mnt/sdcard, not /, so I can't copy the binaries off.

[] i.e. the build installed on my phone, not the build available no Google's server to download.
This is cool, reminds me of the vulnerability search too.

https://shhgit.darkport.co.uk/
My estimate is that > 90% of apps would be better written like that.
Neat! I love the names too.

Is it using the cell network out of interest, or..?
You can only test for cases that you forsee and predict. The advantage of staging environments is you can see many of the cases you never predicted before it hits customers.
The Security of GitHub Actions
reading both, looks to me like this is pretty much 2fa. isn't 2fa defined as a "second factor" beyond user:pass?

isn't that what this bypass is about?
When dealing with decades old legacy data models sometimes it's what you have to deal with.
Here in Columbus, Ohio, we have a site called the Warrior Watch - https://warriorwatch.columbus.gov/ww
It does a great job of showing when my street was last plowed and what it's priority is. We haven't had a lot of use for them this winter though.
Classic hard-drives with platters that physically spin rather than a solid state SSD hard-drive. Nothing necessarily wrong with the older HDD technology, though most people have come to expect the better performance characteristics that come with newer SSD technology.
You put in way too much effort. Call your credit card company first. Your credit card company profits from vendor (PayPal) mistakes by charging fees, so they are always happy to help you.
I have hard time understanding what this is. Is an alternative to docker somehow? What other framework/platform would bastion compete with?
> In parallel to this, the "left" of the country are rather annoyed by the BBC for their perceived bias towards the government and brexit, and thus they are saying "it's time to turn off the BBC"

It's the right that are currently advocating for the removal of the license fee and therefore de facto, the end of the BBC
HackerOne states they are a PCI-DSS auditor approved organization [1].

[1] https://www.hackerone.com/product/challenge
Pizza Conveyor Ovens
opportunity lost.

Microsoft, Apple, Amazon, Google, Facebook make up something like 20% of the S&P 500, and most of its gains. Apple and Microsoft are 10% alone.

So you could make the same argument for someone who chose to invest in the whole index, vs just the top 5. Its not necessarily a good argument. It will be interesting if they are still the top 5 tech companies in 10 years. It feels like they have a bit more of a foothold than the Dell, IBM, HP of years past. Maybe cloud vendor lock in isnt worse than the platform lock ins they sold.
I guess you're not at all familiar with the self report nature of PCI audits.

The purpose of PCI is to shift liability
SGX is patchable via microcode updates (and some parts are software). The remote attestation contains the patchlevel of the system, so, a client can tell if you aren't keeping up to date with security patches.

And so far these are not zero day bugs. The researchers work with Intel to only publish when there are fixes available, usually. It's not much different to any other security system in that sense.
Ask HN: Can you help me find this article?
Not so long ago I stumbled upon a really nice article in some IT guy's blog about cognitive biases, logical fallacies and other 'truths of life' that he learned and found useful throughout his years.

It was stuff like "It's reasonable to assume that a complex system for which it took some time to reach the current state is very close to being in an optimal form under the circumstances". Everything was nicely structured and put to words beautifully.

I also assume that this guy is a big figure in IT since I've somehow found him, but I can't remember who exactly. Anything pops in mind?
Show HN: City Filter – Travel to the Right Cities at the Right Time
I live in a warm place so I am out of touch, but isn't that like a lot of gritters for how small Scotland is?
As always, also worth noting that this is literally acid rain. Putting it in the stratosphere is intended to lessen the amount of acid rain per warming averted, but it's still the exact same chemicals that caused acid rain. There are very good reasons we removed sulfur from gasoline.

Acid rain is probably better than global warming, assuming it doesnt literally kill the ocean. Its good that we have a potential backstop- we could definitely halt warming in a very short time and it might not kill all life. We can even produce the necessary sulfur for a short while. Or like, we could stop warming without dumping incredible amounts of acid in the air we breathe.
The point of being a branded platform is that you take responsibility for the activity on your platform. Otherwise you are just an email gateway.
Ask HN: Do you expect to attend a funeral this year due to the Coronavirus?
> You have to plan and architecture for it

And even that is not enough. You also have to know how to plan and architecture for it, have a well developed mental model of what can get you there, which means you have to practice doing high performance things, follow research and high performance ideas and generally have a habit of building things that are fast. Few people actually do that.
A healthy exercise, I think, is to replace "developer" with "scribe" whenever we have these conversations. It becomes clear that in large part it is the overall culture that is missing the point -- which should be a kind of mass literacy. Smalltalk is a different universe indeed, but its goals were also completely different from today's. Its creators assumed that "using" a personal computer would be, in part, "programming" it, and they sought to define what that interaction would be like.
David Plowie!
Show HN: K6.io – modern load testing tool for developers
My biggest problem with Oracle is not the database itself. There is no doubt that Oracle is a fine piece of software, and is bullet proof, and has decades of experience built into it.

My problem is the scalability and elasticity of it's licensing model. It doesn't meet the needs of today's analytics without spending enormous amounts of money up front.
> We selected the AMD EPYC 7642 processor in a single-socket configuration for Gen X. This CPU has 48-cores (96 threads), a base clock speed of 2.4 GHz, and an L3 cache of 256 MB. While the rated power (225W) may seem high, it is lower than the combined TDP in our Gen 9 servers and we preferred the performance of this CPU over lower power variants. Despite AMD offering a higher core count option with 64-cores, the performance gains for our software stack and usage weren’t compelling enough.

I find this a bit puzzling for density reasons. I can definitely appreciate the clock speed benefits. One 64-core part (AMD EPYC 7742) has the same TDP of 225W, so power should be in the same ballpark. There's also lower clocked 64-core SKUs with 200W TDP. I can't imagine price would be major factor for a company of Cloudflare's size, but it's definitely true that the 48-core part is much cheaper. There's also the 7H12 with a higher base clock than the 48-core part, but its TDP is 280W.

All of these EPYC chips have the same monstrous 256MB of L3, so maybe part of Cloudflare's workloads maxes out the cache before being able to feed all 64 cores, but that's a bit wishywashy. Maybe since they also all have the same PCIe lane capacity 48 cores is the sweet spot.

The 64-core parts still seem like a nobrainer.
I've raised a chargeback with the issuing bank, which should hopefully make PayPal sit up and put a bit more effort into sorting this out.

Or just close your account and ban you.
Bankruptcy results in them getting as much money from you as possible as well as funds from the government. Further, as most hospitals are local monopolies they have little incentive to change. It’s a win win for them as long as they can receive significant amounts of money.

Actual poor people are a slightly different story and often left alone fairly easily.
In principle, my interviews, which tend to be a lot more about "take this text from a DB and process it in this way and display it on a web page" are algorithmic too. I mean, if anyone's writing code, they're writing algorithms. But there's day-by-day algorithms where you're basically gluing lots of things together, and there's Project Euler problems. In my 20+ years of software engineering, I've personally encountered maybe 3 or 4 Project Euler-type problems in my real job. (And even those weren't as clean as those problems; I still had to integrate them back into some other real-world code base.) Expecting your candidates to be good at inverting red-black trees recursively when you want them to hook databases to web pages without massive security vulnerabilities or performance issues is silly.

"Gluing lots of things together" is a descriptive term, not a derogatory one. There's a ton of things you need to know to be a good gluer nowadays; security, performance characteristics of all the pieces, we're adding more and more distribution into our systems, higher level stuff like integrating with teams, documentation of your code, how your workflow goes... there's more than enough to interview all day on these issues without ever having to quiz the candidate on puzzles from the back of a Knuth book.

(This is agreement with you, not disagreement.)
Bypass means skipping steps on PayPal's side (like reading user data without a a password), not skipping steps on user side (stealing their password).
Better to use the tire pressure sensors and a software defined radio module to pick up the unique identifiers of your wheels. Way lower power than OCR.
Conclusion:

> "Finally, it is important to emphasize again that our effect sizes are very small"
Squid is vastly under-equipped to deal with the security hygiene needed for a project this important.

That's the tragedy of the open source world : mission critical for everyone, but no actor willing to maintain it properly. It's Heartbleed all over again.
I've been bitten before by the fact that if you don't use PayPal, eBay's interest in helping you with a refund dispute is exactly zero. And now I learn this. I guess PayPal + credit card is the way to go if you want any chance of a successful refund.
It’s more like Nats.io - an async message server, just for rust
GDPR max fine is (iirc) 4% of revenue. So if you are a small fish you will be paying less then the big fish. Also the fines are for wilful failure to comply, if you accidentally broke GDPR then your first offence is going to be more a slap on the wrist then an instant 4%.
So just anybody can call themselves engineer?, don't you realize this is a disservice to the actual engineers?
> They were created for sincere reasons, and with best intentions.

No? They were created by the industry to avoid actually being regulated and are a way to shift liability.

That doesn't mean they aren't also beneficial, but that's more a side effect than the intention.
There is plenty of blame to go around beyond the management. Management is always going to deflect, deny, or do whatever to save their face. There must be “architect/lead engineer” level folks whose primary task is to engineer these stuff well. WTF are they doing?

There should be a wall of shame for these (not by person, but by company and group). Next time you get a contact/candidate who “lead the sign-on 2fa management” at PayPal, we will know to be extremely cautious.

There is no “karma” in tech world. People design the shittiest systems in company 1 and then move on to some other role in company 2 and float around taking credit for more and more stuff someone else did.