skysight-inc/HackerNews huggingface dataset:
> who are seeking to run JS as part of the business logic

You can, of course, safely use JS for business logic without executing code from unsafe sources, in the same way that you can safely use C#, LUA, Lisp, or any other language. But that aside, your criticism is completely irrelevant to the actual security flaw.

I don't see any indication Avast was trying to use JS for business logic in the first place. I'm sure they over-embed crap for other parts of their interface, but that's not what's happening here. Avast was not loading a custom interpreter to execute their own business logic, they were loading a custom interpreter to analyze user files as part of their virus scan.

> That service loads the low level antivirus engine, and analyzes untrusted data received from sources like the filesystem minifilter or intercepted network traffic.

> Despite being highly privileged and processing untrusted input by design, it is unsandboxed and has poor mitigation coverage.

It wasn't Avast's reliance on JS as a development tool that caused them to say, "maybe we should parse and run arbitrary files on the filesystem in a process with elevated permissions."

It's their business logic that's the problem. Avast's business logic is, "we want to execute untrusted source code to see if it contains viruses." It wasn't a JS engineer saying, "I can't do my job in C++". It was a C/C++ engineer saying, "I know how I can tell if this file is dangerous -- I'll run it in the main process to see what it does."

If you can tell me a safe way to accomplish that business logic in C/C++ or in any other language without process isolation or sandboxing, then I'll concede the point. But I'm pretty sure you can't.

As an aside, an interesting followup to this disclosure would be if someone tested whether or not Avast is also interpreting other languages like LUA that they regard as potentially dangerous. I wouldn't necessarily take it as a given that JS was the only language they were doing this with.
More accurate would be saying that they oppose vague morals clauses.

Which is quite reasonable to do, otherwise in the age of twitter shitstorms this is free "get out of contract" card.
Ok - this sounds interesting. Can you describe it in more detail? Or like give me a practical example? Always glad to toss around ideas.
Getting .001% of people away from it is already a market that makes you significantly less dead than Sun is right now. I don't think anyone's that worried!
Of course it is. But you go for the checkbox item for interviews. That's why you save as much and penny pinch. Also don't fall into the trap that schools have your best individual interests in mind. They just want your money and nickle and dime you at EVERY corner.
Chloroquine is looking quite promising eg see the linked article here https://www.reddit.com/r/COVID19/comments/ffztou/expert_chlo...

Even with that there seem bureaucratic type delays till it gets used. I just took some as a prophylactic which is totally unproven but as a clinical treatment it seems to work well in trials.
Coronavirus Inspires Maker, Tech Innovation
Honestly surprised to see star voodoo like this on HN.

There's literally always something happening to people on a planet with hundreds of millions to billions of people. The correlations are spurious because at any alignment you can say "oh, look at all these bad things happening".

That's why astrology and the like have zero predictive value.
Welcome to HN. It helps to prefix the question title with 'Ask HN:'. Those go to https://news.ycombinator.com/ask
Or get hired by Google or Facebook.

https://twitter.com/MikeIsaac/status/1237577750480740353?s=2...
Call this whatever you want, but it really feels like it's primary purpose is to sell me something, not to teach me something. And that's fine- that's something every company has to do eventually - but it doesn't feel like real HN content to me.
If anything those are good reasons to pursue increasing T levels without those side effects. This may be possible if the cause is environmental. The speed with which testosterone levels have been dropping in men seems to indicate it is not natural selection.

There are plenty of people who would trade feeling better for a longer shitty life.
Some interesting points there. Some I agree with and some I don't.

> You can debug it

That's your strongest counterargument and I agree it is easier if it's written in a language (or at least ecosystem) that you're already skilled in. But you have to be careful not to overstate the importance of this feature ie is it a tool that likely needs to be debugged using your preferred language tools (eg is it a simple tool, or stable and mature. Does it already have a suite of debugging tools available thus not requiring engineers to debug the executable itself? Are other tools like strace better suited for debugging instead of language-specific tools, etc).

There's very few tools I use daily that I've needed to debug. Even fewer that I've needed to resort to source code and language debugging tools.

> and it probably provides an API in your main language

That's a huge assumption to make. However if it does and it's an API you're likely to use then that is a differentiating feature which makes it the best choice tool and plus the tool is no longer something you're not using to develop in house.

So your point actually aligns with the point I was making.

> Bonuses: It integrates with your other tools

Again, that becomes a feature and thus you're not picking a tool for language purity reasons thus not violating the point I was making.

> You can fork it if necessary.

It's almost never necessary to fork a tool your using outside of your development framework (and if it is part of your development framework then it's something you are expecting to maintain so that point was covered in my previous post).

Or to put things another way, how many people here have forked Terraform to run their own distinct version of it?

If it's a tool you think you might like to fork or maintain then again, that's not violating my previous post since you picked that tool with the plan to maintain.

> You talk the language of their support forums

This is your weakest argument. :)

I've never typed a line of TypeScript in my life yet can talk in depth about it with the TS developers when issues arise. Why? Because I've programmed in well over a dozen other languages and the way we communicate different concepts doesn't generally change that radically from one language to another.

> And you don't know in advance whether you will need to submit patches.

You can make a reasoned guess though. A bug in the Linux kernel: I think I'll raise a bug report and leave that to others to fix. A bug in Terraform: then maybe I might submit a PR but odds are I wouldn't have the time to learn the code, devise a fix, write tests, etc. Again, I'd probably end up raising an issue on Github and working around the problem at work. Anything higher level than that then perhaps I'd raise a PR but choices often get more diverse and the impact of picking "the wrong tool" becomes less significant.
I really take issue with this characterization. Please have some respect and humility: addiction is a serious matter, and this characterization of addicts as weak-willed and immoral is inaccurate and misleading for anyone out there who is seeking a way out.
Hey, this is amazing! I'm currently working on www.inverse.network, a new way for groups to talk all over the web :) Would love to chat. haris@inverse.network
Yet the Smurf festival in Lombardy lives on https://twitter.com/chamILYAn/status/1237397658773286913?s=2...

As for the movie I think Contagion 2
The site is pretty sparse on details. Does PurpleAds engage in user tracking or targeting?
Anonymous is at the level of press, radio and films...
Perhaps one day unsafe programming languages will be forbidden to use.
i would guess that a full %50-%70 of HN content is content marketing of some sort (either for a startup or for someone's personal brand). so many prescriptions on HN but no ban on this kind of content. makes you think.
Flutter vs. Native vs. React-Native: Examining Performance
You're going to have to include more of your reasoning than that.
The kids still talk and hang out. I don't think there's anything to worry about.
> Unlike America professors are paid lower than the industry and those who can't get jobs in Industry become professors and treat students like slaves

Just sharing experiences, I was in-industry at the time of my education which caused a huge issue in backlash from the professors. These old salty men were dinosaurs and although I wasn't at some prestigious company I was still learning what it meant to run large-scale and highly-available web services - ie: they were stuck in the 8/16-bit era and I was HUNGRY to learn web.

Although I never felt like a slave, I felt like I was always a "lesser" to them no matter what. Coming to school with a fair amount of programming ability subverted them as I had a ton of people calling me up/IMing me for homework help vs. going to their restrictive office hours.

I wasn't the best student, aced the tests even with horrid attendance, organized collaboration on Google Docs so everyone had a consistent study-guide, and I tutored half of the class because I had better "office hours" that lined up with when college kids are working on homework/assignments... they haaated me.
Maybe an over-enthusiastic customer here, but obviously I am also an investor. That's helpful feedback for me, so I appreciate it.
The obvious solution to this would be to offer free testing to anybody without insurance who a doctor thinks should be tested. It's somewhat stupefying that neither the insurance companies nor the government are already doing this (assuming they're actually not).
>If you extend this to its logical conclusion, then he’s claiming that there is no value in teaching.

I'm not sure slippery slope fallacies are logical conclusions. In fact I don't think they are.
Hello HN! We released this week a free version of our solution for small teams.

OKRs and 1-on-1s have become a very important part of a manager toolbox, but it can be difficult to justify the cost of paying for another productivity solution.

We think every manager should be able to communicate well with their team members and keep them engaged. And every employee deserves a great manager!

That's why we switched to a freemium model with full access to our OKRs and 1-on-1 features. We have additional features (analytics, reviews, surveys, etc.) under the paid plan.

If you're a manager and you wish it was easier to manage your OKRs and 1-on-1s, please try Happierco free plan and let us know your feedback. We hope you like it! :)
It's also great for people who have alcoholism
There aren't any rules, there are just suggestions... that being said, a higher-power is something that's "not you", could be the group, yoda, the universe, a light bulb. Seriously...
Have done demo day twice, and I can confirm. It was way, way worse the second time around. Lots of companies had filled out their rounds by demo day, despite the official YC advice (i.e. "don't fundraise until demo day").

Also, it's not a subtle effect at all, particularly now that demo day is split up into batches with similar companies grouped together. If you're presenting on the same day as some company close to your space that has raised millions, it looks bad. Investors routinely ask who else has invested in your company. If company X has a long list of name investors and you don't, investors want to put their money in company X. It's a downside of the dynamics of the feeding frenzy created by demo day -- investors have little to go on, so they make a big deal out of herd signaling.

Obviously, this doesn't matter for the hottest deals, but most companies in a batch aren't hot deals, and the hot deals don't need demo day in the first place.
I currently work on a codebase that is in part React based, and I have no idea how to get it running from scratch or how data flows through. It seems asinine.
Show HN: Assembled – Scale great customer support
> Tesla has ... like a 10-year head start from my uninformed opinion.

In some ways yes, in other ways the incumbents are a decade ahead. Both sides are racing to replicate the other's competence.

Tesla has just shipped their 1 millionth vehicle ever, after 17 years. (1)

VW ships around 11 million vehicles per year. Every year. (2)

Tesla needs the scale with reliable high build quality that VW has. VW needs to make more of them electric vehicles, and to that end make them comparable to Teslas.

1) https://eu.usatoday.com/story/money/cars/2020/03/10/tesla-el...

2) https://www.statista.com/topics/1574/volkswagen/
dang? has explicitly stated that content marketing is allowed on HN; it just has to satisfy everything else required for a post (intellectually interesting, etc.).
The AA way was described in The Power of Habit as one of the examples of successful habit change. Basically: keep the habit's cue(e.g. feeling depressesed) and the reward(social interaction) but replace the bad habit(drinking) with a better one(meeting with the sponsor).
> If your intention is to say that they shouldn't run untrusted code, then just say that.

Or maybe stop trying to "gotcha" other commenters by making assumptions about what they were trying to say.
I agree. But also it doesn't make sense to pick a tool that doesn't quite fulfil your requirements, is buggy or has other problems over a battle tested tool that does solve all of your requirements bar the language it's compiled in.

I have no issue with people picking tools written in their preferred language if that is the differentiator between two competing solutions. However picking the wrong tool because it's written in the right language is a fools move. Which is the point I'm making. Language purity is great just so long as it doesn't lure you into using shit tools.
It is just a static HTML page with lists of links to articles the author thought were interesting. I remember making something like this 20 years ago to use as my homepage.
Still no coat hangar symbol.
Top US health official: coronavirus is 10x ‘more lethal’ than the seasonal flu
I'm an old asm/C/C++ programmer (retired) who wanted to learn Rust but didn't make the effort because of all the stories about how hard it was to deal with the borrow checker. Then I realized that for a programmer like me that was used to managing memory in my head, the borrow checker would be a piece of cake. I wrote my first program in it and it was not hard at all. I get it that JavaScript/Python etc... programmers who always had a garbage collector might have trouble.

It was so nice to have the compiler catch several stupid errors for me. If I were King of the world I would decree that all new public facing software with real world consequences had to be written in Rust. I'm pretty sure I read that Microsoft is looking at Rust to mitigate some of these issues.

Edit: added "new" to make it clear I don't mean rewriting everything in Rust.
Hey there, I really ought to update that to make that a bit clearer. It's a tricky one for me to get across. The free plan doesn't have any hard limits, and I've toed-and-froed with what to place under that section in terms of "limits".

What I was trying to say was for the alias, you can get as many paced digests as it takes to receive all the emails it received in the month. Not having hard limits prevents people from not getting all their emails. My plan was to then use those "limits" as a way of encouraging users to move to the premium plan. Premium has some extra functionality around what time of the day digests are sent.

I hope that clarifies the pricing!
That's very similar to the reasons why I oppose codes of ethics. There's nothing wrong with being ethical and moral - but in these cases, it's just a pretext used by bureaucrats to attain even more power.
Too late: https://www.facebook.com/onoranzefunebritaffo/photos/a.79642...

(translation: "stay at home or we will all end up in a box")
> If you don't understand your network then graphql is an easy vector for DOS (speaking from experience).

When GraphQL came out I was quite honestly shocked that this didn’t get more attention. It’s essentially trivial to not notice that a query could cause the server to loop heavily. User > Friends > Friends = easily 10000 results, and that’s the simplest top-of-the-head example I can think of. When an object has even 3 or 4 possible relationships, there are exponentially more attack vectors.

And on a minor note: the fact that objects are returned inline makes a query for duplicates that much larger in KB.
I actually agree with your conclusions, however, if they had dropped privileges before running javascript it would be worlds and worlds better. Whoever bootstrapped the C parts should have known this.
Patients with mild coronavirus symptoms may be highly infectious, study warns
Same in the Netherlands. When one of my colleagues asked to get a test her GP asked if she’s been to one of those countries, when she said no, she didn’t get any tests :(
> Not to mention I have zero dedicated space to actually work.

This is key for me. I can work from home without a problem. I've even started and run entire companies from home. However, I absolutely must have a room which is entirely devoted to work. It's an important psychological thing -- when I'm in the room, I'm "at work" and when I'm not, I'm "off work".

This also provides an important clue to others in the house about when I can and cannot be disturbed.

Without a dedicated space, I cannot work from home with any significant degree of productivity -- and I'll quickly burn out.
As a VC, marketing is part of the job. Perhaps the most important part of the job.

Getting LPs to invest in your fund encourages strong personal brand building.

Getting startups to want _you_ to invest versus others—and for many "great looking" deals (the ones you want), the company has options—requires strong personal brand building.

In the medium term incentives are less towards being good at helping companies.

You have to do enough good marketing to get founders to sign on the dotted line. After that, if they don't like you or are "bleh" on you, there's nothing they can do about it. What's done is done.

By the time you've fully deployed the capital in your fund (2–3 years, excluding reserves for follow-on), you're raising your next fund. That's _far_ too short of a time span to know what the results will be for Fund I.

What does it take?

Good marketing.

It's not a coincidence, then, that successful funds revolve around good, or at the very least incessant, self-marketers.

Garry has appeared numerous times on @VCBrags (and has, funnily enough, blocked them.)
Except the S-class system is just suspension, not shock absorbing like the Citroën-system. Plus it's just suspension, not steering and brakes either. How would you incorporate that if you replaced it with the S-class system? You're certain the S-class pump could handle that?

And while, yes, the LHM-system is technically not supported any more by Citroën, there are plenty of licenced manufacturers out there, particularly in the Netherlands, that can provide you with the needed parts.

An LHS-system, I'd rather avoid entirely.

Still, I'll wish you luck on that project.

(And you're right, the ID19 came later. And my DS 23 is with electronic fuel injection. And a 5 speed manual gearbox.)
I'm not saying whether this is a good or a bad thing, but religion has done a lot over the millenia to teach people how to be productive in society. Religion is first and foremost a tool to keep people in line. The fact that part of it happens to incorporate a belief in the afterlife is an implementation detail.

Sure, it might be obsolete now, but if someone is in bad enough shape (such as an alcoholic), even an obsolete religion may still be a better tool for the job than something like psychotherapy. Psychotherapy doesn't directly add any sort of community to a person's life. I had a drinking problem for some time and a big reason for that is I hated the people I was surrounded by (who were often not much different from myself at the time) and needed to tune out somehow.
Hi HN,

I'm John, one of the co-founders of Assembled. Our mission is to transform and elevate customer support.

Today we’re launching a product that solves workforce management and helps support teams get staffing right. For the past two years, we’ve been building it alongside some of the most innovative support teams in the world like Slack, Stripe, and Harry’s.

Sam Altman’s startup playbook says: “great startups always have great customer service in the early days” [0], but he doesn’t talk about the later days. It turns out to be really hard to scale great support with spreadsheets and internal tools. We’ve built Assembled after talking to hundreds of different organizations that have been trying to solve this problem.

Our product tackles three core operational challenges:

- Forecasting: We automatically forecast support volume and translate it into the right staffing plan.

- Scheduling: We provide an intuitive team calendar that works across time zones and/or multiple specializations.

- Unified metrics: We make support schedules and metrics, like response times, visible across all levels.

Assembled is available today and you can request a demo here. We’ll be around all day answering questions, so feel free to comment here or email me directly at john@assembled.com.

[0] https://playbook.samaltman.com/
This is great advice for almost any problem, not only math. I've used the same approach when programming, thinking through product problems, even thinking through issues that come up in life- describe the problem and the outlines of potential solutions. I find this brings clarity that's not always present if I just think through problems in my head.
not so sure. the way of thinking i got from university professors has been invaluable. it is the meta-skills that count
Reminds me of: https://aphyr.com/posts/342-typing-the-technical-interview
The content has to meet certain quality standard to survive here. Most content marketing dones't, but some does, sometimes. And when it does, you may as well leave it up - per https://xkcd.com/810/.
Just for clarity: Do you believe China would have reached the inflection point for this epidemic without their extreme social distancing measures?

And at a similar death toll, and with the epidemic continuing to flatten towards an asymptote if they were lifted today?
> There is no news feed. Rather than showing you a massive inbox of new posts to sort through, you see a list of recently active individuals. No one can noisily take over this page, since every follow has a summary that takes up a mere two lines.

I absolutely love this timeline algorithm and was just thinking about something similar last week. This way prolific posters don't flood my feed. We need more experiments like these.
> Bad examples, they are protected by certifications, market compliance processes, and paying for ISO and similar standard documents.

So then what do you need copyright for? Do the same thing for your API. Copyright is the wrong tool for this.

But in particular, notice that if your "market compliance processes" start trying to charge monopoly rents, someone will reverse engineer the thing and launch a competing compliance process which insurance companies will happily accept as long as it has reasonable quality.

Also notice that the compliance process for things like that is generally shepherded by a third party non-profit like UL or IEEE and not a competitor in the same market.
COVID-19 accelerates mortality rates and certainly is additive in low risk groups. It's disingenuous to normalize risk as "non-additive" to fit your narrative.
Nicely timed to post this on the day of the Weinstein conviction.
Screw drives are patent territory. Just about every one you've used except the simple flat head driver for slotted screws was patented at some point.