skysight-inc/HackerNews huggingface dataset:
From the link:

> In order to enable quick demos of the feature we allowed for e2ee keys to be passed to Jitsi Meet via a URL parameter.

> IMPORTANT NOTE: This is a demo of an e2e encrypted call and the feature is NOT YET intended for general availability, so play with it all you want, but, for now, in matters where security is paramount we still recommend deploying your own Jitsi Meet instance.

> As we already pointed out, passing keys as URL parameters is a demo thing only. Aside from being impractical it also carries risks given that URL params are stored in browser history.

> Our next step is therefore to work out exactly how key management and exchange would work. We expect we will be using The Double Ratchet Algorithm through libolm but the details are still to be ironed out.

They're not touting passing the keys in a URL parameter as a "well designed encryption scheme." They're presenting it as a proof of concept, and planning for the future work that they acknowledge is necessary.

Your comment is ill-informed and misleading.
DustMite: A General-Purpose Data Reduction Tool
I don’t think this is anything to do with the legacy jitsi xmpp/sip client, but the “jitsi meet” video conferencing app.
I wonder at what point might we implement a very old CPU like the 6502/6510 on this and demonstrate the proof of concept of e.g. a very very slow fully homomorphic Commodore 64 emulator.

Has it been done?
With Stirling Moss in the Mille Miglia
Show HN: Real-time alerts for Google Analytics
Definitely! I typically do post here. There are also links for various ways to subscribe on the site itself (e.g. twitter, email).
Not Muslim, not Jewish: ancient community in the West Bank (2018)
The incentive is to help and inform other people, to allow for targeted testing and so, one hopes, mitigate disease spread.

Altruism is the bottom line.
I wrote the last reply from my phone. The command is simply

/Applications/Emacs.app/Contents/MacOS/Emacs “$@“

The script goes into /usr/local/bin or wherever that’s in your path.
You're asking about TransferWise? Says on their website. https://transferwise.com/
Can you imagine a more captive audience for ads than those in a cab? Imagine Alphabet introducing free, ad supported taxi rides.
Indeed, but that's an engineering failure. I even think that Gmail makes sense an SPA. It should be JavaScript. They've just overcomplicated their implementation.
You will not find a standard range of freelancer rates, just as you won't find a standard range of developer salaries in the United States.

The $20-30/hr job listing you shared will not attract any experienced Python developers. Experienced Python developers can easily secure jobs with $100K+/year salaries and benefits in any medium sized city. That job listing is searching for entry-level Python engineers who don't yet understand their value in the marketplace. It is not representative of standard freelance rates. The job listing requests a good command of the English language, so it's not even clear that they're targeting only Americans with the listing.

Generally speaking, the best paid freelancers do not find jobs via public job listings. They use their reputation and network in combination with their unique skillsets to find contract jobs with companies who need them.

The best freelancers also negotiate their rates for each contract. Their rate can vary significantly depending on how many other opportunities that have, the difficulty of the work, and other factors.

Personally, I don't know any full-time freelancers who charge less than $80-90/hr. Below this hourly amount, it becomes more financially beneficial to find a full-time job.

Unfortunately, it's difficult to find accurate information about freelance rates from the public internet. Smart companies will not post a high hourly rate on job listings because they could miss opportunities for candidates to negotiate lower rates. Smart freelancers will not advertise their typical rate because it will impact their opportunity to negotiate or change their rates in private conversations with new employers.

The optimal strategy is to constantly look for new contract jobs, raising your asking rate until companies are telling you "No" more than "Yes". This is how you will find your market rate.
What to Write – Jacob Kaplan-Moss (2009)
Epidemiological characteristics of Covid-19 cases in Italy [pdf]
Show HN: Covid19 dashboard. Compare from each country's day 1
You can't do control flow homomorphicly, so that tends to throw a wrench into this kind of thing.
Reagent is good for starting if you are new to React, but quickly becomes limiting.

I found Rum (https://github.com/tonsky/rum) to be a much more flexible choice. It doesn't force you into a single way of doing things, but rather offers a composable way of adding behavior to components using mixins. Especially for larger and more complex applications this proves to be a good tool.

Another thing which I really like about Rum is "isomorphic rendering" (not a good name, but I didn't invent it) — pre-rendering the DOM on the server instead of shipping an empty page to the client and requiring the client to render everything using JavaScript.
> still trying to figure out how to get paid for my patent, will probably just open it up

I don't fully understand the situation you are in, but from what you describe that would be impossible. just because you are the inventor on a patent doesn't mean that you are the owner of the patent. Only the owner, not the inventor, can authorize other people to use the patented invention.
That I can agree with, I use re-frame quite a bit in my day job, it's straightforward and lets you get things done.

I'm also of the opinion that the Fulcro docs are very substantial, but aren't always easy to get your question answered. I've been blogging little bits and pieces of things that I've figured out that I don't think were super easy to discover, considering the amount of work that's gone into it, I'm hopeful that the situation will improve.

However it's an interesting change to see something designed that's trying to be a complete end to end solution, take the new RAD tools for example[0], there's some cool stuff going on there. There's a demo[1] available as well.

- [0] https://github.com/fulcrologic/fulcro-rad

- [1] https://github.com/fulcrologic/fulcro-rad-demo
Explain? To my mind, the article explains a problem...

The article seems to explain a problem, but what it's really doing is expressing some opinions, misrepresenting opposed opinions as strawmen and going meta to further attack them.

The criticism of the contrary opinions is not wrong, it's technically correct, just misses completely the point since it doesn't respond to the strongest version of the objections, just to the weakest ones.
Why not relicense your software then?
Important milestone for important application.
I looked at both screenshots, and aside from the dark theme, it's not clear how the Komodo screenshot is different. They both show a bunch of windows that presumably allow you to navigate files and classes, and the code window offers syntax highlighting. Sure, the window style is different, and the fonts too; there's more color in the non-coding windows on the Komodo side. All right, design-wise the Komodo screenshot feels more modern.

However, my take on "modern" is that the authors of the TclSqueek were thinking more at function than form. I can't speak about that one with first hand experience, but I talked with Smalltalk developers, and they think the Smalltalk environment is still unmatched. If that is the target that TclSqueek tries to emulate, then it is "modern".
Help With Covid: debunk misinformation using innovative media format
Exactly. People worrying about what their smartphones could be leaking via a convoluted point-to-point aggregation process while every telephone conversation and email is routed through dozens of third-party machines with unaccountable auditing going on.
If you are noting deadlines, how about ones else beat? Model Y was 6 months early.
But they all have timestamps, right? Newest is current, and then you have a time history of prior work....

(How it was explained to me once... that person swore they were worked to the bone to keep everything updated but they were SO inefficient and refused to listen to any constructive input because THIS IS HOW I HAVE TO DO IT.)
What 50 years of remote work teaches us
We used Inkscape for a print asset in 2010. At the time it really struggled with:

a) Lots of layers, large resolution
b) Rendering accurate printable colors after calibration

After many long nights we gave up and redid it in Illustrator. Inkscape is a fantastic product though, so it was extremely disappointing.

Does anyone know if these features have improved since?
A Goat Farmer Built a Doomsday Machine That Just Booked a 4,144% Return
Performance is I think for most people a matter of good-enough performance, most of the time, with good-enough and most varying wildly depending on context.

Regarding the move towards the web, I think portability still matters, because a lot of web developers write code and potentially test code on Windows and but deploy on Linux for production.
Well, if I'm reading this right (https://investor.uber.com/news-events/news/press-release-det...), Uber's share of it alone brought in $65 billion in gross bookings last year. So, not exactly what I'd call small.

What they need is to figure out how to massively decrease operating margins, and for many years now the story has been how it'll be done - at least partly - with autonomous vehicles. I'm skeptical, but we'll see. It would make a lot more sense to me if the robotaxis were used only on certain roads outfitted with multiple types of redundant roadside sensors to assist the self-driving cars.
Check out Corona (https://coronalabs.com/). It’s a pretty straightforward 2d engine with support for many platforms. Games are written in lua which isn’t hard to learn if you’re already familiar with JS.
Great. Then we should keep an eye out for the actual thing that's down the slope. Forgoing useful technologies because a slope exists is like refusing to mine coal because the uranium nearby could some day be used to build atomic bombs.
I like this project! I think I've asked you about it supporting parquet before... I'll add it to my list of similar projects.

Regarding goyacc and "usually", I myself was curious about this years ago and asked on Stack Exchange: Do modern languages still use parser generators? [0].

Most of the time, major languages _do_ use hand-written parsers.

Of course it may literally be the case that most other SQL projects in Go do use goyacc. My point is that in general, hand-written parsers are more common in real software than you might think.

[0] https://softwareengineering.stackexchange.com/questions/2502...
Are the tons of glitches and incoherent UI fixed? I recently tried Inkscape again (on arch, so I assume a relatively recent version) and it was still pretty bad (although better than a few years ago) :s

Snapping is a nightmare. Layers are kind of hard to work with. Elements don't keep their ratio by default. The way the canvas border works by default makes no sense. The UI is just not sensibly arranged in many places.

Since they talk about crashes I hope at least the spontantous crashes while copy/pasting are gone now. A nice bonus would be touchpad zooming (at least moving around now works smoothly).

It's still the best FOSS vector editor out there, but 1.0 is a big release. I hope it now has the polish it deserves.
I wonder how they handle having a hundred people needing access to a restroom. My memories of drive in included a line up 20 deep of women waiting to use the restroom.
I think if you do that it becomes really hard to compare a lot of things.

So health insurance is a cost ... albeit not the same for everyone, at some companies you pay surprisingly little and that is compensation ON TOP OF your pay...

Other places not.

It's really hard to get good 1:1 comparisons.

Taxes and etc in the US are widely unevenly applied depending on the situation compared to what seem to be 'more' standardized and predictable numbers, services, in Europe.
I hole-hardedly agree, but allow me to play doubles advocate here for a moment...
I know that some of the members of the organized data-hoarder community are spending huge amounts of money on disks month after month, and it really bothers their spouses. So, even if there is no physical mess being created in their homes, their obsession is still affecting their lives and other people around them.
SQL is a humongous spec. Any serious project would rather piggy-back off an existing parser. Most of the interesting parts for most people is implementing backends against in-memory, disk, S3, HDFS, etc.
It's psychological. Most users don't really care how fast something runs once the JIT warms up: instead, they care about the latency of their starting the program to the time they can use it and use this latency as a psychological measure of the performance of the program as a whole. Stupid? Yes. But that's what actually happens.

The JVM has always had a slow startup path. Much slower-overall systems like Python don't. That's why people don't complain about Python performance and do complain about Java performance.
Roles of the clinical pharmacist during the COVID‐19 pandemic
How much does the U.S. rely on other countries for medical equipment?
It's simple: You shouldn't run Docker images on FreeBSD.
But it's not. There are far better ways to do that, if that is the path you're going down. This is specifically designed to make that kind of thing much harder.
I believe the difference here is between categorical and empirical thinking.

In each case the person replying is saying, "the principle is violated by this counter-example, so the principle does not hold".

The author of this article should be saying, "this isn't a principle, its a heuristic whose utility depends on context".

Ironically the author of this article misunderstands the point these replies are making and straw-mans them as much as he believes he's straw-manned.

They're not failing to capture relevance. They're taking a statement phrased categorically as a categorical principle, when it was an heuristic one.

This comes down to how people reason -- more mathematically-inclined people are often categorical thinkers; trying to reason in terms of universal principles & iterating on those until they are universal.

The goal of the person replying isn't (necessarily) to undermine the OP; but, to helpfully offer a counter-example to evolve the principle until it holds.

It is a good strategy to arrive at general criteria for when, eg., GC is useful. In fact, this article is an exercise in that because it replies to these counter-examples.
Sorry, it’s not your patent. It’s IBM’s.
Native MacOSX Support!!
"Inkscape is now a first-rate native macOS application, and no longer requires XQuartz to operate. The minimum required operating system version is OS X El Capitan 10.11.

It has a standard Mac-style menu bar (rather than a menu bar within the window). Keyboard shortcuts now use the command (⌘) key rather than the control key. Retina display screen resolution is now supported. The build is now cleanly 64-bit, a prerequisite for macOS Catalina 10.15 and beyond. It comes bundled with Python 3 to power Inkscape extensions. "
You can still open Control Panel in Win10 and get the prior behavior, almost. I just Start menu search for it and done.
I wish people in general could get used to the idea that not everything is designed with them in mind, and they might not be the intended audience.

If privacy is your number one priority and you absolutely can't have Google "spying" on you, then a lot of software and websites probably just aren't for you.

Instead, they bombard people who are doing great things for free, making them make little changes to please them instead of great changes that could please most people.

I'd be less critical of them if they were submitting PRs instead of just bug reports.
#DEADBF is dead beef, as it should be.
What “they say” is 75/hr, salary divided by 1000. I’m guessing you doubly applied the 2x factor.
You need to play hard-ball with them. They really want your signature on the form assigning them the patent once it's filed. Refuse to sign it until you get paid. They don't need your signature, but they're trying to avoid a legal fight in the future, so you have some leverage. I left there 13 years ago and I've gotten paid for 6 patents since I left, one that was even filed 2 years ago, 11 years after I left.
It’s one of the more common bugs in our office. Before we integrated a Python linter in our CI for a prototype project, we would see several such typo errors each week with a small team (and that was with symbols, not string literals).
It's a nice tech demo, but it runs into the same problem that so many of these systems run into: individual users don't want to be arsed to self-manage their encryption keys. You can't solve the UX on that, and users will ignore your service in favor of one that doesn't require that of them.

As service provider, you could keep their keys, but if they trust you with their keys, why aren't they trusting you with being MITM on encryption? Especially since if you have their keys you already could.

Still, very cool technical demo, even if the odds of it displacing something like Zoom are near nil.
Ah, I they see they're using libolm, as is the Matrix project!

I have a number of critiques of libolm that I haven't developed into a practical attack, but are simple enough to fix (if you ignore the massive legacy support and backwards compatibility t̵r̵a̵p̵ ̵t̵h̵e̵y̵'̵v̵e̵ ̵s̵e̵t̵ ̵f̵o̵r̵ ̵t̵h̵e̵m̵s̵e̵l̵v̵e̵s̵ EDIT: see Arathorn's comment below).

Libolm is encrypting with AES-CBC [1]. In addition to side-stepping entire classes of attack (i.e. padding oracles), CTR would allow better performance: You can parallelize both encryption and decryption with CTR mode. With CBC mode, you can only parallelize decryption (but not encryption) since the IV for all but the first block is the previous block of ciphertext, which means you'll know the correct IV when decrypting but not when encrypting (since you have to calculate it sequentially).

Yes, they HMAC the ciphertext [2]. However, their variable name choice doesn't inspire confidence in its correctness.

Furthermore, they truncate the HMAC to 8 byes and attempt to justify the truncation by appending an Ed25519 signature, but that sort of configuration is just begging for a confused deputy scenario, like an old iMessage vulnerability [3]. It's no where near as bad (iMessage eschewed MACs entirely, this still uses a MAC, so it's not exploitable), but it's something that probably would make anyone working in cryptography (and any adjacent fields) give a confused puppy head tilt when they read it.

Regarding their ratcheting protocol [4]: Instead of feeding HMAC-SHA256 back into itself at each ratchet step, I'd feel way more comfortable if the protocol did HMAC-SHA512 and used one half of the output to derive encryption/authentication keys and the other half the ratcheting-forward key (instead of one HMAC-SHA256 for both purposes).

Using two distinct 256-bit secrets (even if they're generated from the same input at i=0) instead of reusing a secret strengthens the forward secrecy of the entire protocol.

HMAC-SHA256:
One ring to rule them all (at any given ratchet step).

HMAC-SHA512-split:
If you (against all odds) guess one of the keys, that doesn't give you the ratchet-forward key too, since they're two distinct keys (albeit generated deterministically from the same input).

Nothing I said above is exploitable, otherwise I'd be emailing their security team instead of posting on HN. :)

That being said, if the Libolm devs want to shore up the security of their protocol in a future revision, the following changes would go a long way:

1. Use HMAC-SHA-512 and split it in half for the ratcheting step of Olm/Megolm

2. Use AES-CTR instead of AES-CBC

3. Stop truncating MACs

[1]: https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/me...

[2]: https://gitlab.matrix.org/matrix-org/olm/-/blob/930c4677547e...

[3]: https://blog.cryptographyengineering.com/2016/03/21/attack-o...

[4]: https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/me...
fwiw my current billing rate is $300/hr. Full stack. Mostly web. 18+ years of experience. San Francisco. Clients all over the Bay Area.
Yes, that is the tradeoff you are making to keep actual human beings from dying painfully.

You can afford to give up a few days of your privacy for that. Really, you can.
No idea about the history.

From my perspective (as the author of OctoSQL): I need a SQL parser. Vitess has a fully fledged MySQL compatible one. I'd probably want to copy the open source vitess one and add the necessary features myself, instead of writing it from scratch. It's just a big endeavor, a few thousand lines of goyacc code and even more Go boilerplate.

I'm not saying everybody is using the same library, because the code has been heavily modified after being copied. A look at the cockroachdb parses suffices to see how much changed it is.

If you look at OctoSQL, there too have been many changes to add stuff like table valued functions.
Truth is I've written about how to parse in better languages before (JavaScript, Python, Standard ML, etc.) and I wanted to figure out a good approach for doing it in Go.

As for databases and GC, you may be right but there are still major databases out there written in Java for example.

https://www.quora.com/Which-databases-data-stores-are-writte...
> On the other hand, they don't mention the fact that the reason OpenBSD is so "secure", is because their marketing focuses on the default install, which has almost nothing.

Which in my opinion rather shows that to be (rather) secure, the system has to be kept as minimal as possible. This is (in my opinion) a lesson that the GNU/Linux advocates should learn and embrace (just to mention one emotive word: systemd).

> as if ZFS was somehow their invention.

ZFS was an invention of Sun/Solaris, not the Linux ecosystem.
From Brazil, I've used TransferWise until it became way more expensive than my regular bank to receive wire transfers.
>Disagree; surely the null hypothesis for any given training programme is that it has no effect.

That's not what's under test here though. It's training program A that includes domain specific knowledge or training program B that does not.

>There isn't anything unusual about professional programmers having a degree in maths or physics rather than CS. At least in my experience it was pretty close to an equal split.

Look at the number of graduates, the only way that is true is if almost every single physics or math graduate goes into programming. The fact that you think it's true is just further evidence of bias.

According to the Stack Overflow Developer Survey [1], about 8% of professional developers with degrees majored in math, or natural sciences vs. 63% in CS, software engineering, or computer engineering. There could be some sampling bias, but that's a huge difference.

1. https://insights.stackoverflow.com/survey/2019#education
If viable, FHE solves some very urgent problems in sharing personal health information data sets for research, and there are literally billions of dollars in individual transaction data locked up behind legal firewalls in banks.
This is a great usable library we can reason about, but in terms of a trust model for it, is TFHE a candidate or on a certification path?

Given people trust institutions, and institutions trust other institutions that trust math, from people who write the code - you have the math and the code, my question would be, which institutions can we help to get priority for trusting this?
Probably! That's the most interesting and most difficult part so it may take me a while.