skysight-inc/HackerNews huggingface dataset:
> but broke userspace

But that's never how userspace was ever designed to work during the web's history. Hosting sites this way, especially commercial ones, was always insecure because of the way cookies were designed from day one.

Same-site policies broke userspace in the same sense that Wayland is breaking X11 userspace by making it so applications can't just send keypresses to each other. Userspace was already broken, it was an insecure mess -- it's just that we recognize it now. If you were running a userdir site that supported PHP, you probably should not have been doing that.

I'm glad nothing got hacked for the people doing it, but I used to leave my bike unchained at the library growing up, and it didn't get stolen either -- didn't make it secure. I believe you that there was a time when companies advertised on TV using userdirs, because I know there was a time when Facebook only used SSL for its login screen and when Twitter forced users to enable SSM account recovery. Companies do insecure crap sometimes :)

If you don't care about same-site security, then nothing's broken -- the vulnerabilities you're exposed to now in a post-Javascript world for userdir sites are the same ones you were exposed to back then. It's just users today are more likely to actively exploit them.
No, the less mandated by law, the better
> “ Offset pagination is bad for performance. Avoid it at all costs unless you want some spider indexing page 10,432 of your archives to eat all your CPU.”

I love this! It’s so true only bots dive that deep and it’s usually a total waste. But what do you recommend instead? Should you just deny any calls past page 10? Or do away with pagination altogether?
Is this company still in NYC?
A former colleague of mine used to rail on Docker for MacOS a few years ago. He always complained about it being super slow to sync with the local file system. I never had any issues but was running everything on Linux. Since then I've moved companies and now I'm running docker on a Mac. Haven't noticed any eggregious performance issues, but as I understand under the hood it's still basically running in a VM.
The standard used to be that replies and the original content were mixed. This made it easy to reply to every point made by the previous person, and easy to see what was skipped.

As opposed to what happens here which is that when I go to reply to someone, I first read, form an understanding, and then reply to my understanding. It is extremely rare to find people going through what someone said point by point and agreeing or disagreeing with each bit.

If you've ever experienced that style of discussion, it is clearly superior for complex discussions. If you haven't experienced it, it is very hard to understand how it might possibly work.

(I often reply here by quoting several points in italics and replying separately to each. That is a strictly inferior to what used to happen, though, because they don't have a way to do the same back and keep straight what they said before, what I said in reply, and how they are correcting my reply.)
columnar, probably. row-based not possible.
I like it better than VNC or RDP, especially on a fast network.

Those others I think get it wrong with their "whole desktop" sharing. The experience of having X clients streamed as they are launched and the local WM gets to manage decorations - I like that model a lot more, for say the scenario where I ssh into a machine and launch a GUI program.

RDP is much faster than X. It had the benefit of being designed later I guess.

VNC usually feels laggier than X to me somehow. As if there is a cursor sync issue.

These are just my observations as a user.
Doesn't make sense to me to mandate it.

Different companies should be able to find their best structure on their own.
Maybe I have a narrow set of experience, but in my mind a “data engineer” is not a substitute for a “data scientist”.
Is this an established variation or something you invented?
A 60% drop in pollution in LA with WFH I think it should be mandated in high pollution zones like City of LA
Sounds like a culture worthy of damage.
yet more hoarding
Hashlife is also incredibly good at being able to accelerate large-scale computational structures, such as Unit Life cells, which simulate the game of life (or arbitrary other cellular automata) within the game of life: https://www.conwaylife.com/wiki/Unit_cell

The current state of the art is Golly: https://en.wikipedia.org/wiki/Golly_(program)
One thing is good sure. It’s not the sport topping or employees
It is interesting that people are avoiding emergency care, but some reasons to look into:

1) A lot of hospital visits are from "frequent flyers" - lonely people, homeless people trying to get a free meal, etc. These frequent flyers try to go every day, consuming 1000x more resources than a normal person. (I've met some.) They may be afraid of catching corona virus this month.

2) Depending on the area of the US, you either get a lot of gunshot wounds (Chicago) or car accidents. With lockdown, there's less going on in the streets.

3) Also, uninsured people may be going to the hospital as a last resort in order to avoid getting corona virus. For example, those without insurance may just be waiting for the all clear to drop by again. (In the US, the fallback for no insurance is to go to the emergency ward.)
Well yes, but also no. I would hope that it's not terribly surprising that just about any property in a major metro area is going to earn more revenue on average as a series of short term rentals than a long-term tenant or sale. I mean that's pretty much the standard trade you make for lots of things. You accept lower rates in exchange for lower risk and more consistent revenue.

Airbnb did a weird thing and proved/facilitated so much demand that landlords realized that listing on Airbnb could net you that increased profit with lower risk since they provide a steady stream of renters changing the risk/reward profile.

So we're left with some awkwardness of people being priced out of their apartments not because of anything evil but because Airbnb et al close that information gap and proved that short-term rentals aren't nearly as risky as landlords thought and that forking over 30% for customer acquisition still works out in their favor.
Theme from Schindler's List (Violin Cover)
Pool Together is sponsored by Maker.
What lessons have they learned?
It now pays up to $1050 per week up to 26 weeks, plus the stimulus check of up to $1200. I wouldn't call that inadequate, especially considering that you don't have to work or even look for work.

For low paid workers, the federal unemployment stimulus can actually make their unemployment checks larger than their normal take home pay.
Airbnb clearly feeds into the limiting of supply.
I don't claim to be smarter than anyone, I'm just some guy. I just think the "no-one could have seen this coming" is obviously bogus when it was literally occurring at the time, just in different regions.
Not normally a fan, but I think Dorsey should be given massive props for being one of the few ultra rich indviduals (or even companies) to try to actually meaningfully step up to the pandemic challenge.

It's not just our governments and health authorities who have completely failed us, the response from extremely well resourced private parties and entities also has been extremely underwhelming.

It's been clear for months now that Testing/Tracking/Masks are vital to efficiently deal with this, all are basically low tech. And yet no single Western country has adequate capacity or taken any remotely serious steps to obtain it and non-governmental actors have not significantly stepped in either.
> OK, but what is the base rate for injuries?

That is the whole point of the allegations: that Tesla does not report accurate numbers so any comparison is meaningless. If the doctor supervising the clinic refuses to sign any paperwork that contains reportable injuries, then the bureaucrat's report will show that "there were no physician-verified reportable injuries" therefore "we must be the safest factory in the world". One of the more prominent whistle blowers actually worked at other car factories and reported that the injury rate at Tesla was staggering - orders of magnitude higher than at any other factory she worked at. She also said that because the physician would refuse to document or sign any documentation with reportable injuries, the paperwork did not match reality.

Look, there have been enough whistleblowers that I would be highly suspicious even if I were Musk's biggest fan. Every once in a while we get an article[1] and then Tesla destroys the whistleblower's life and the journalists just stops reporting. Elon's fans then go nuts on Twitter saying that it's the Tesla Bears or whatever new Illumanti Cabal is out to stop Musk.

There will certainly be more and maybe someday people will care, but I wouldn't hold my breath. Tesla buyers just don't care about poor people and Elon Musk literally wanted to keep his factories operating during a global pandemic, so expecting empathy from him is futile.

---

[1] https://www.theverge.com/2018/11/6/18064326/tesla-factory-wo...

Or: https://www.forbes.com/sites/alanohnsman/2019/03/01/tesla-sa...

Or: https://www.theguardian.com/technology/2018/jun/13/tesla-wor...

Or: https://www.theguardian.com/technology/2017/may/18/tesla-wor...

Really the sky is the limit.
Excellent read. Well worth the time. I'm motivated to take another look at SICP.
I found most courses I did as being useful. Many people can write code but only a few can understand how a machine running that code works, what the code they wrote does in the background , how can you write efficient and correct code, how can you better express business domain.

It's good to have a higher level of understanding, learning languages, frameworks and libraries is of course necessary but not enough if you want to be one of the best.

My advice is to read on CS topics as much as one can. Are you interested in databases or work with them? A bit of algebra will help explain how they work. Some of the introductory courses on databases I did had some algebra because that was necessary to explain relations, normalization and other topics. You can't do much AI and ML unless you learn some statistics.

As for algorithms, data structures, complexity I find them invaluable in any kind of programming.
Part of the popularity is herd mentality. I know arbitration lawyers who find it bizarre - many company’s that would be better served by not using arbitration want it anyway.
This is something I invented many years ago, I even wrote a basic implementation in C#, but it was not suitable for large-scale simulations.
Best dating apps to find Perfect love in 2020
The Art of Coronavirus Modeling
What the fuck did you just say?
> And last I heard their factories never stopped running because they got themselves declared essential.

RTFA:

Tesla agreed to idle U.S. production last month amid authorities’ orders, choking off the supply of cars to customers. The electric-vehicle maker expects to resume normal production at its U.S. facilities on May 4, according to the memo.
If a service is relying on "must have an e-mail address elsewhere" as a gate for users signing up, then there are so many trivial workarounds that this is a minor drop in the bucket.

I don't think there's any obligation to try to make that work, nor how allowing people to do so is in any way harmful.
No. Management should be able to decide if wfh makes sense for a given team based on on their personal situation. Some of my team members are more productive at home, some are deadweight. It is almost impossible to fire or hire someone at my company so I would rather have all the tools available to maximize productivity.
I work at a software company and we had a culture of not working from home very often. The last few weeks, JIRA has shown that we're more productive than ever in terms of closing tickets.

Hopefully what we'll see if that employers that we're previously skiddish about letting employees work from home home will see that it's not the distopia they imagined it would be and it'll become more normal.
I did "data science" for about a decade, consulting with plaintiffs firms and state AGs on antitrust and fraud cases. For each case, the work flow was roughly this:

-- write discovery requests

-- review production, and check out data and documentation

-- write supplementary discovery requests

-- review production, and check out data and documentation

[repeat as needed]

-- analyze data, and write deposition questions

-- help attorneys wring answers from deponents

[repeat as needed]

-- analyze data, and produce required output

-- write parts of briefs and expert reports

I generally did that in consultation with testimonial experts and their data analysts. Sometimes that didn't happen until we'd documented the case enough to know that it was worth it. And occasionally small cases settled with just me as the "expert".

It's a small industry, and not easy to get into, unless you know key players at key firms. But the money's pretty good, and the work can be exciting. I loved being that guy in depositions whispering questions to the attorneys :)

This all involved pretty simple calculation of damages, through comparing what actually happened vs what would have happened but for the illegal behavior. But-for models were typically based on benchmarks.

After data cleanup in UltraEdit, I did most of the analysis in SQL Server. I used Excel for charting and final calculations.
Any work is dull and depressing when done under the supervision of idiots. Some companies, although probably less than claimed, are genuinely data driven rather than HiPPO driven, though. This might be particularly important to look for theses to do interesting stuff in the fields of data science.
You can set default module options through a file in /etc/modprobe.d/. If you're using systemd, it can also be configured to load the module automatically on startup. This is what I'm using:

/etc/modprobe.d/v4l2loopback.conf:

options v4l2loopback devices=1 video_nr=10 card_label="OBS Cam" exclusive_caps=1

/etc/modules-load.d/v4l2loopback.conf:

v4l2loopback

Working flawlessly so far in Hangouts and Zoom using OBS Studio and the obs-v4lsink plugin.
Why some guys have all the luck
this is a fascinating line of inquiry, and comes down to the methods of detection being insufficiently fine-grain.

it's challenging to tell apart all of the pieces in a metagenomic sample except through assembly. A "viral plasmid" like you describe would go unnoticed simply because it would map to another sequence assembly.

there's indication of high copy-number plasmids in bacteria sometimes. not sure if anyone has looked to see if any of those are kept in the outside of the cell.

usually imaged cells are washed very well before imaging, otherwise background is off the charts...
those things are so useless if your time points arent equidistant (ie, you don't care about the last 100 rows, you care about the last 5 minutes). they basically force you to use very slow correlated subqueries. please do something better.
Enterprise root certs are different from client certs even if some (perhaps many or most) client certs were signed by an enterprise root. A client cert is about providing identity information/proofs (instead of or in addition to traditional credentials). I hope mozilla isn't conflating the two though I can see how they might decide that turning on one thing gets you the other as well.
Their initial results may be correct, but it is unlikely they’ve had the chance to do enough of them to pin down a failure rate with any precision. They also claim that other available COVID-19 tests haven’t undergone enough verification to establish a solid error rate, and if that’s so “on par or better” on the evaluations that have been run is fair as well.
Previous discussion: https://news.ycombinator.com/item?id=22807226
ooooo externality mandated wfh I love it
How to List All Installed Packages in RHEL, CentOS and Fedora
In addition, I think the definition of the term "Technology" is quite broad.

According to the Oxford dictionary,

Technology:

The application of scientific knowledge for practical purposes, especially in industry.

In the formal terms, tech industry is all industry that relies on scientific knowledge to gain leverage. What large industry today doesn't involve using science in some form or the other? Perhaps the industry of religion. It is hard to find one and there is a gradual curve between least scientifically based industry to the most.
I kinda figure the only purpose of the law is to protect citizens against the vagaries of unchecked economic progress
To clarify the comment you are replying to (not the author): 99% of their users. Clearly 99% of people globally aren't going to follow that custom, but many (most?) applications written in the US have a user-base where 99% of their users will follow the custom. Switching to something more globally applicable isn't necessarily a non-zero cost either - using a single name field has downsides like making sorting by last name more difficult (a ubiquitous thing in the US) and not being able to display first vs. last name where culturally expected.
Converting a Redux app to Recollect (how and why)
My personal perspective is that I can't wait for things to go back to normal and to have a workplace to go to instead of sitting around the house all day.

I'm wired to want to get out into the world and see people. That doesn't mean I'm extremely social, that I consider co-workers my family, or that they're my closest friends. But there are significant intangibles that come from being with them in person instead of being alone.
well that and violence
Firstly, I'd fix the damn spelling of the referer header instead of everybody putting up with it for close to 30 years.

I don't think it's that JavaScript and HTML are a bad choice, but there are some things that would have made life a lot easier if they were strongly enforced sooner, including secure cookies by default, SameSite=lax, removal of referer header and CSP - doing them sooner would have stopped bad developer practices while also removing a fair chunk of application security complexities, but at least we're moving towards a better world regarding those now.

I don't know if it'd be technically possible to implement, but additional characters to mark unsafe strings would have a huge impact on webapp security. Reflection of untrusted data at the moment generally relies on one of: HTML encoding, URL encoding or JavaScript escaping and escaping a safe way is highly context-dependent (I've seen an unescaped "\n" cause injection within JavaScript contexts). A way of effectively storing the level of trust a chunk of data has across multiple transports when marking untrusted data including within HTML/JS, SQL statements and interpreted languages like BASH or PHP - this would eliminate a bunch of vulnerabilities and would probably have mitigated a bunch of notable historic vulnerabilities and/or hacks.
From a personal opinion standpoint, I agree with your latter statement. I don't block throwaway email domains from my services.

The few times I've hosted something like this (previously running open source https://gitlab.com/markbeeson/maildrop), it just never ends well.

What typically happens is abuse reports start rolling in for mass forum spam, mass registration, comment spam, domains get blacklisted and added to global blacklists like URIBL.

Over time as bad actors found it, I eventually was doing more than 50-80 Mbps of _purely text traffic_ of bots flooding registrations, inbound SMTP traffic of nothing but spam, bots effectively sending DoS-level requests looking for activation links. It was frustrating to want to run something fun and inevitably end up spending half your day responding to "this is a development/testing INBOUND ONLY mail service, we did not originate the spam, we are not signing up 5000 times to your forum", adding a domain blacklist to never show messages from certain websites, etc.
Your comment, unfortunately, won’t be appreciated by lemmings until the unemployment rate is 45% and hundreds of thousands are dying from disease and starvation.
> What if the police were wrong here though?

If the police is to do their job, they will be wrong sometimes. The only way to make sure that they're never wrong is to keep them from doing anything. Americans should stop acting like a pointy-haired boss running over sysadmins. It's getting ridiculous.

Also, if you want to protest police brutality there are legitimate cases all around the country. You don't need to sell made-up outrage.
that sounds like the company needs to restructure it's hiring/firing framework rather than punishing those who would be great at wfh.
Show HN: I built a successful product using microdata
I'm in no way saying that it wasn't a broken insecure mess and needed fixing -- just that the fix that actually happened broke some already established ways of organizing websites. Any website that relied on that doing naughty things with cookies that crossed logical boundaries they weren't supposed to -- sure -- makes total sense to break them. But having one site at mysite.com/a and another at mysite.com/b is a perfectly valid use cause and ought to have had a path to being secure instead of being fundamentally insecure which is what we have now.

Like doesn't it seem a little silly that you can't make a.mysite.com and mysite.com/a behave the same way?
Doesn't the D&O insurance cover this?
Hi, I worked for the UAW campaign to organize Tesla a while back, and I did some of the data analysis for this report. https://uaw.org/report-worksafe-internal-tesla-data-shows-in...

I wish I could answer questions about it but at this point it's been years and I've forgotten basically all the details. I will say though that there were suspicious gaps in Tesla's incident reports of months going by without the slightest incident, from the very beginning of I think April 2015 to the end of the calendar year.

You may dismiss it as biased, since it obviously is, but the methodology of the portions I worked on or saw was honest.
I've always found it interesting that the Japanese use the character 赤 generically for the colour red but Chinese speakers use the character 紅. When they both refer specifically to different shades and tones of red and speakers of both languages would know the specific meaning of both characters.
I'm really hoping to see that - certainly some teams will underperform but I have a gut feeling that there's a lot of people who would do a lot better without having to do any water cooler chitchat
I worked as a data scientist for 4 months at a VC firm. I have a PhD and thought the work might be legit when I was hired. After the 4 months I quit when it became apparent that my credentials were being used for managerial intrigue and the work was essentially a joke, with no rigor at all. This article hits the nail on the head, unfortunately, these positions are not often real jobs.
interesting, do you live alone?
Exactly. It feels like the term was invented by people who think that Information Technology is the only technology worth mentioning, and that's a bit perverse.
It's standard practise in lots of kinds of sequencing experiments to use a spike-in. Makes perfect sense to use it here - in fact all the other sequencing based SARS-CoV-2 tests I've seen also use spike-ins.
Hi all,

Founder here.

I just wrote this informative blog post on how I built a product by researching microdata on my target market.

By scouring the web and collecting microdata, you can use clues left by your competitors’ customers to build your product around their weaknesses.

Their weaknesses become your UVP.

Hope you like it!
The fact he had to make a rule for her not to belittle him in front of the children makes me think I wouldn't want to be married to his wife either. We're only seeing one half of the picture here, but she doesn't sound like a saint.
does that hold true for car rentals as well?