skysight-inc/HackerNews huggingface dataset:
The EPA says not only that your new chemical plant can't dump waste in the river, but also that before you even start your factory you have to file elaborate plans explaining all the measures you're going to take to make sure it never happens.

If we want companies to quickly spin up new factories for ventilators and masks, it's a good idea to let them start the factory now and file the plans next year.
Web queues are ineffective as shown by sneaker bots. You’d need actual ID style authentication of accounts. If you’re talking about order queues than people will stuff the queue and cancel their orders or just have more hoarding if their multiple deliveries get processed. If it’s FIFO same technical advantages will apply: bots can click much faster than humans ever will. I think the issue is more human nature and things moving to the web creating inequality between the technically adept and non-adept.
That was my point -- you're employing people, you're building the economy, take the money. That's the whole point.
The crazy thing is that there is a correct escaping available: `escapeshellarg()`. With correct escaping, you don't even need to sanitize the user input here - the target command will parse the MAC address itself and report any errors.

The existing code is analogous to building SQL queries using string concatenation and forgetting the mysqli_real_escape_string() call. Really the solution is to use a parameterized interface (e.g. by calling pcntl_fork() + pcntl_exec(), that accepts an array of arguments instead of a string command-line).

Pcntl doesn't seem to have a wrapper for the posix_spawn syscall.
You are likely familiar with the quip that "While in theory there is no difference between theory and practice, in practice there is." Here's a delightful letter by "The Father of the Nuclear Navy" Admiral Hyman Rickover (https://en.wikipedia.org/wiki/Hyman_G._Rickover) on how that saying applies to nuclear reactor design. Excerpts:

An academic reactor or reactor plant almost always has the following
basic characteristics: (1) It is simple. (2) It is small. (3) It is
cheap. (4) It is light. (5) It can be built very quickly. (6) It is
very flexible in purpose ("omnibus reactor"). (7) Very little develop-
ment is required. It will use mostly “off-the-shelf” components.
(8) The reactor is in the study phase. It is not being built now.

On the other hand, a practical reactor plant can be distinguished by the
following characteristics: (1) It is being built now. (2) It is behind
schedule. (3) It is requiring an immense amount of development on
apparently trivial items. Corrosion, in particular, is a problem.
(4) It is very expensive. (5) It takes a long time to build because of
the engineering development problems. (6) It is large. (7) It is
heavy. (8) It is complicated.

It's a short two-page letter, so I won't excerpt more. It merits reading in full.
No, that's not a personal attack. "Ok Boomer" is personal attack in a lot of places, but I guess not here...

It's banter, it's common on the internet, it's been common on the internet for decades.
I've always seen the "cobbling systems together" stuff as actually software engineering, as that's what you need to have a final production system running. What you describe as "programming" I would say is computer science.

And for me, the work that solves real-world problems tends to be software engineering (using my own definition), rather than computer science (again, using my own definition), which seems to be more about optimizations.
This is correct. It's not open source as the HN crowd would know it. OSINT as you say is the correct "Open Source" moniker. Source: I use Maltego for work daily.

>[...]the term "open" refers to overt, publicly available sources (as opposed to covert or clandestine sources). It is not related to open-source software or collective intelligence.
A Former Special Education Teacher’s Call to Opportunity
Initially, we had the idea that if we didn’t learn anything else interesting from this search, it could have been an opportunity to talk about the concept of the Metaverse. Tyler was actually taking that concept somewhat seriously, the idea that we had fallen in between two multiverses. We even reached out to a quantum physicist from Caltech to talk about it.

Now that would have been an episode to remember.

In all seriousness, it was a great episode. I wish they could have tracked down the guitarist from Trinidad and Tobago who also remembered the song and posted about it on an obscure guitar forum.

Lots of people are talking about songs from the analog/early digital era not making it to the streaming world. This is a big issue for a lot of the music I listen to, mostly indie stuff from the 80s and 90s, much of it from local scenes. Even if it made it to CD, the likelihood of indie labels or rights holders doing the required legal, bureaucratic, and technical steps to make the recordings available on Spotify, Apple Music, or other streaming services is slim.

I know one Boston-area band whose single major label album (from 1990) is on streaming services, but the earlier stuff from indie labels in the 1980s (including their best-known material) didn't make it.

One of the band members is now a lawyer, and I asked him why I couldn't get the band's songs from Apple Music. He indicated it would be a huge pain from the perspective of getting former members who don't get along to sign the paperwork, and questioned whether it would be worth it financially considering the paltry payouts offered by streaming services to artists (https://www.theguardian.com/technology/askjack/2019/oct/31/b...).
If it was, there would be no starlink
On a larger architectural scale, see: Use Boring Technology

http://boringtechnology.club/

Also described as: "how to be old, for young people"
Instacart shoppers plan strike over treatment during pandemic
We recently ran into this problem at Cooklist in the US. We ended up setting up the ability for our users to place orders up to 3 days out.

Our system then books their pickup order at midnight when the new pickup slots are opened. We are seeing that most pickup slots are filled for the next day by 9am.

It is interesting that the stores don't allow booking several days in advance anymore. It makes sense though because even with booking for the next day we are seeing that 25% to 50% of the order is substituted due to out of stocks.
DIY Face Mask – 8 Steps in Making Protective Gear (Hong Kong Consumer Council)
There's a lot more that goes into "Link Analysis" as you say, other than the URL itself.
I once discovered a botnet running on my Ubuntu system. I always assumed a PPA the culprit. The ip addresses were gazprom, some stuff in China, a ton of others, etc - too long ago to remember details. I also remember when I first started with Arch, which at that time had unsigned packages.

Edit: comment truncated by sleeping aid. I've gone dumb, but also remember the router suffering too, even after a hard reset, westell, I think.
Since we can't turles-all-the-way-down with this, where does the chain end? What do they do there?
Agree that isn't a great example. Linux package repos are still far in advance of the mish mash of stores and direct install that is Windows and MacOS.

Programs like Thunderbird and every Gnome program with an embedded web browser are a bit problem. It's really hard to prevent random web stuff from happening on your box, and I don't want anything except a fully patched Chrome/Chromium or Firefox talking http(s) to anything unless it is audited, isolated and constrained to do a small number of tasks.

Office suites and file viewers are ripe for exploits. I'd argue that open office has an essentially unlimited supply. PDF readers ... Ugh. Even simple image tools have occasional oopses.

Confining the small Linux tools that do simple things is actually a good match for containment technology; where it fails is big complex GUIs like office suites, or tools that need broad file system access and network comms.

If Linux had any standards for the file dialogue it would be much simpler to retrofit access controls. Even Android is so far in advance of desktop Linux it is hard to see the catch-up happen. I almost can't believe that desktop linuxes still don't support running Android apps.
Well, in a sense, nothing is independent of genetics or upbringing, so how do you decide that something is caused by either one? Can it not be caused by either?

Regardless, the obvious implication is something developmental or environmental is important, after conception, but not particularly related to parenting behavior.
The problem is that php expects a string that is then passed to sh -c, which is then parsed by a shell.

Instead php should have an interface that accepts:

exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]);

without any shell trickery.

If there's a sudo in this specific like doesn't matter, your reverse shell is going to run as a regular user and after that it only matters low locked down the sudoers configuration is.
Sometimes I think the optimal subscription model isn't to pay for additions to software but to maintenance for a stable environment/OS/API set. Like, I've long since failed to get excited about upgrades to macOS, but I might well pay Apple some yearly double digit number to keep snow leopard stable as long as I have hardware that runs back that far. That way, nobody's software rots out from under them, there's always the environment they first brought it to as long as there are enough people to pay the subscription.
That’s just an adversarial network. The deepfakes will become so good that we won’t be able to tell anyway.

It’s like AlphaZero playing against itself and you hoping that the “defensive” AlphaZero is able to win the game every time.

In reality, each side will win sometimes but will have absolutely no way of explaining why or how. So we will have no idea anymore what is fake or not, just whether the detector said it was for some reason that time.

Basically, it’s game over very soon after you do this arms race. See CAPTCHAs being solved etc.
"A light-weight password manager with a focus on simplicity and security"

Simplicity? Written in C++?
Note that our CI is doing way way more testing than most kernel developers do. It's not meant to exercise 100% of the kernel, just be a basic smoke test to see if we really messed something up.

From triaging reports daily from kbuild test robot aka "0day" bot, I'd say 1/3 to 1/2 of kernel commits pushed by various developers to their trees have never even been compiled (very obvious mistakes regardless of toolchain).

We get way more coverage in actually shipping these kernels in Android and ChromeOS.
Likely would. The `validMAC` function doesn’t just fail silently if the regex fails, which would get past naive signature detections. Oh and feeding user input directly into `exec`…
That’s because they were busy praising China for getting so efficient at oppressing their population.
Require SMS or callback confirmation of the order slot using a non-Google/Twilio/SIP number (mobile phones or landlines both work here). Provide for one time order cancellation at no cost, cancellations after that incur a $10 cancellation fee.

This should negate any technical advantage from a sophisticated entity. Queues still work, if managed properly.
Wouldn’t the sign in mechanism (which validates e-mail) prevent this, in the sense than they won’t be able to get a third-party account to authenticate with for a particular e-mail without verifying ownership of that e-mail to the third-party provider?
Thanks, yes. It makes our life lot easier too, if they accept it, so that we do not have to constantly maintain this forked version.
Taxes paid for the initial cost of not only most of the infrastructure of internet but also cable. This was "paid back" at zero interest loan payments over dozens of years, in most municipalities.
The problem here is it is a cat and mouse game. Software algorithms that can detect deep fakes can also be used to patch detectable flaws in deep fakes to evade detection, at least until new detection approaches get better but the cycle repeats on future generated content.
That thing is a masterpiece of modern engineering. Also, the tach labeling gave me a good giggle.

edit: I just noticed the multi-meter glued to the "dash". Nice.
You would be surprised about what is happening in modern computers. I don't know about REP SCASB, but IIRC, REP MOVSB is now an insanely efficient way to memcpy on last Intel microarchs (not necessarily always the fastest, but really fast enough for tons of scenario, and very I cache friendly). But it might be less interesting on some other x86 processors.

It makes sense to delegate some of the microoptims to the hardware.

But regular scalar instructions are also optimized like crazy. Write a small loop, and your state of the art microarch might sort of unroll it by using register renaming and speculative execution, so sometimes basically multiple iterations are executed at the same time (and on top of that you sometimes get uOP cache locking, which then improves energy and hyperthreading efficiency).
Were you a team member on this team before you were promoted to lead? If so, it's going to be a tough road ahead because you are going from a peer / co-worker relationship to a manager & direct report relationship. These are tough transitions to make, and a reason the military will often transfer someone who is newly put into a leadership position.

Have you started to train yourself as a lead / manager? A couple of resources I've found useful in the switch have been Manager Tools [0] (book, site, and podcast) as well as The Manager's Path [1].

While his shtick can be a bit thick at times, I enjoyed Extreme Ownership by Willink [2], if only because it codified a lot of thoughts I've had for a long time. I've worked with a lot of military and defence so the stories and life views he teaches through didn't throw me, but I know it does for some people so YMMV.

I have found that the Manager's Tools suggestion that the single best thing you can do is have weekly one-on-ones with your team to be true. It can be tough, especially if you still have a lot of your IC responsibilities alongside your new team lead roles, but it is truly remarkable how much more insight you can get into what your team is thinking from holding these sessions. This is they crystal ball you are looking for. And remember, the weeklies are about your team members, not about you (refer to manager tools).

[0] https://www.manager-tools.com/products/effective-manager-boo...

[1] https://www.amazon.ca/Managers-Path-Leaders-Navigating-Growt...

[2] https://www.amazon.ca/Extreme-Ownership-U-S-Navy-SEALs/dp/12...
His explanation does not explain statements like https://twitter.com/Surgeon_General/status/12337257852839321...
Complexity? Written in C++?
Smartproxy – The Best Residential Proxy Network with 10M+ IPs
People will do what the system forces people to do. You don't want people who are in danger to starve? Let's change the system to one where we help those in need. The current way of living, in many parts of the world (especially the US), is that you have to eat others, otherwise they'll eat you. This is the system the leaders keep defending, and the people keep cheering the leaders on.

So you get what you want. Otherwise, go out on the streets and show you're not happy with it.

Getting people who are writing scrapers for groceries to stop is not realistically gonna change anything.
They don't seem to understand what TARP was, or how what is happening now is completely different. There would be no mortgages if it weren't for the government involvement in 2008, because no bank would be willing to take the financial risk that was imposed upon them by Dodd-Frank. The government guaranteed bad loans back then that the banks were forced to make, so when the banks went overboard in taking them of course they were going to be bailed out.

Similarly, this forced shutdown by the government is killing businesses, and to save the businesses from the government action the government must compensate them in order to compensate the population they have severely damaged. It's not just jobs that are being lost along with businesses, it's people's futures as retirement plans are being devastated. It would have been cheaper to require citizens all wear masks and gloves or painter's suits than to shut down everything for what amounts to a bad flu. Now we have Congress requiring trillions of dollars of our money and requiring hundreds of millions of dollars for arts programs be included in the bill. The oversight needs to be over congresses priorities as they are openly abusing the crisis for their own ends.
Blame video calls: Walmart sales rise for shirts, but not pants
Cancellation costs may be against local consumer laws.

But I think you wouldn't need it with upfront payment and some simple anti-hoarding rules.

Also the delivery address or payment id could be used in a way to make this fair.
escapeshellarg is an ugly hack, php is passing everything through `sh -c` for no reason.

The pcntl_exec function is the only one that has a reasonable interface, but is way too low level.

php should simply accept this as a valid function call:

exec(["sudo", "pihole", "-a", "addstaticdhcp", $mac, $ip, $hostname]);
Not sure if this is unusual, but it takes me ~10 seconds to turn on my car and pull out of the driveway. What are you doing for 60-90 seconds?
To add to this, if the sick can’t get grocery delivery, they will go to the grocery stores.
SELinux is just so complicated. I'm sure there are B&E tools out there that will just search to see where you have misconfigured it and attack there.

With a really minimal system (like an IOT box) you can lock things down very tight with SELinux, but not practical for a standard desktop to have full coverage, it just protects some standard components.
What if there's no mock for the hardware? Whoever wrote the driver didn't supply one. Is it better to not accept drivers unless there's mocks? Do you know how few drivers Linux would have in that case?

FWIW, I agree 100% with you. It's just simply not the way the world works.
They exist if you dont game them too much. And there isnt that much incentive to do so given the wide variety of tests.
Mugu District Nepal
You're pretty confused if you think "the company" won if the taxpayer didn't. In the GM case, "the company" was owned by shareholders who lost 100% of their equity. The bondholders lost a lot, too.
38% of the people hospitalized with COVID-19 are between 20 and 54. [1] Everyone can catch the illness, everyone can wind up in the hospital, and depending on the state of the local hospitals, everyone is in immediate danger.

[1] https://www.msn.com/en-ca/health/medical/close-to-40percent-...
Ah OK, that makes sense. So Python doesn't have that issue because it doesn't overload braces for hashes and blocks.

Oil does overload them, but it has a separate lexing mode for statements and expressions. It switches when it sees say the 'var' keyword, so the right of var x = {a: 3} is lexed as an expression rather than a statement. This sort of fell out of compatibility constraints with shell, but ended up being pretty convenient and powerful.

The lexing mode relies pretty strongly on having the "first word", e.g. 'var' or 'func', Pascal-style. So yeah I can see how it would be more complex with Java-style syntax.
At least with Sketch the file format is well understood and you can keep using whatever version you end up with when your licence expires.

For me, this is the #1 issue with the recent trend for subscription models. I do think a lot of these firms are price gouging as well, but even if they weren't, it's just too much risk that something we depend on to do our work might be changed or even entirely discontinued if the business running it changes its mind or fails.

I've had salespeople straight-up promise me that X or Y software company is far too big to fail and will be around forever. I've also seen enough big name tech companies fail over the years to know what that promise is worth.

We would rather stick with old versions of the big name titles, or use alternatives like the Affinity suite or Sketch where you have your copy and it really is yours, than jump on that bandwagon. I've had salespeople tell me that this is a liability, and that everyone else is moving on and our software won't be compatible with the new file formats or other such excuses. To date, the number of times we have been seriously stung by that since the likes of Adobe went subscription-only is zero, and the number of cases where it's caused a bit of inconvenience but we worked around it without too much trouble is I think one, so I'm willing to take my chances.
So find the rest and fix them
> Right. No one has ever studied contagions among the community at large and the effect of masks.

It's been studied. There has not been a randomized controlled trial because performing one would be extremely unethical.

There is plenty of study evidence to support their use, just nothing meeting the gold standard of a RCT and there never will be one against a true live fire contagious disease.

The irony with all this is that the US administration really want to get people back to work as soon as possible. Massive deployment and mandatory usage would be the safest way to do that the soonest.

Too bad they already foreclosed that option by materially misleading the public.
And maybe the Junior developer is allowed to do this because they cost less, so if it gets abandoned the company can take it, but a senior out for a month would impact other areas.
Icons have become a real problem. Today, the icon for everything should be a smartphone. Which doesn't help. What would you use for "Save"?

Here's where it all started, with Susan Kare.[1] She designed the original Mac icons. The original Windows icons. And is still at it.

Some icons have changed in meaning. The envelope icon on web pages used to mean "Compose email to author of web page". Now it means "spam this page to someone else."

[1] http://kare.com/apple-icons/
Related: https://news.ycombinator.com/item?id=11175244
You can't assure code quality, you can only use them to make you code is a bit better because you fixed issues found by the tool and asymptotically approach ideal code and lower the probability there are serious errors. AKA better than nothing.
How many people do you know who would be competent enough to use a teleconferencing web app?
You address this by only linking accounts once a user has successfully signed in with another provider. That way if their email exists from another provider, you're more certain that it's the same account
Ditto. The only downside to this method is having to transplant twice: once to soil pots after sprouting, then to the ground.
People said similar things about cotton before slavery was abolished. The world managed to survive.
If anyone has a forecast for the United States, this website is aggregating forecasts:

https://www.unitarity.com/app/challenges/us-coronavirus-outb...
But not everyone can get grocery delivery, so who should have priority?
Bots are typically used to buy out a limited supply of something like concert tickets. Clicking quickly or responding immediately to availability changes wouldn't give bots any advantage when there's nothing but a FIFO queue.

If I were setting this up for a grocery delivery platform, I would require the delivery address be provided upfront to enter the queue. Validate and standardize the address using the official Postal Service API (in the US). Prohibit changing the delivery address once in the queue, and prohibit the same address from appearing in the queue multiple times. Those requirements eliminate the mechanical possibility and incentive to partake in any sort of hoarding or profiteering using bots.