skysight-inc/HackerNews huggingface dataset:
I agree, I think some people in this thread need to slow down and think very carefully about what they are suggesting. Let's remember that America at least was founded not only liberty, but also on life and the pursuit of happiness. I agree that we should always stay vigilant against governments using crises to erode liberty, but at the same time we must also consider the public good in decision making. For example, we have broad freedom of speech protections but we do not allow people to yell "fire" in a crowded theater or make terroristic threats because we have decided that such actions overly encroach on the public's well being.

As this article correctly points out, we should be very concerned about contact tracing, and any contact tracing program needs to have broad privacy and legal protections built into it. What this article does not say is that there should never be any contact tracing for any reason because it has the potential to be abused which automatically outweighs any benefit to public good. Similarly, our stay at home orders should have termination dates based on transparent metrics, and we should be very careful about how we apply martial law. That being said, I find it not only ridiculous but enraging that people would advocate flaunting quarantine out of high level principle. You do not have the right to do harm to others by acting as a viral carrier. You do not have the right to endanger other people with your behavior. You do not have the right to get sick behind principle and then demand scarce hospital resources and provider time. I'm sorry but that is not reasonable, ethical, or in line with the principles our country is based on.
Covid-19 Contact Tracing We Can Live With: A Road Map and Recommendations
Current plan is:
https://github.com/dotnet/corefxlab/issues/2350
That agents of President Nixon kidnapped and beat the wife of one of his cronies to silence her seems unbelievable, but it's true. E.g.,

https://en.wikipedia.org/wiki/Martha_Mitchell#June_1972_kidn...

This was also covered in season 1 of the Slow Burn podcast, which was excellent.
Ask HN: Ways to deal with over zealous co-workers
How do you deal with over-zealous co-workers who do not understand estimates?

Either they seem to have acutely absurd estimates or constantly keep mentioning that pace is very slow and that there are no visible outcomes for something like a software platform.

The expectation is a fully ready B2B SaaS product platform that supports multiple B2B SaaS web applications to be built and operated on that platform, which must be designed and developed within three months plus getting at least two products live to production on the platform deployed on a public cloud within the same timeframe.

From my past experiences, I see that software product platforms warrant and demand more focus and nurture over multiple months, and that they get designed and built organically, and the benefit reaping period is at least a year down the line even in a cloud native scenario.

How does one sensitize co-workers about the reality? Any help or pointer is much appreciated!

My employer is a small shop which has about 80 odd people in Eastern Europe building B2B SaaS in the employee engagement space, if the context helps in any way.
No. No. No. No! Everything about this is wrong.

The load balancer ABSOLUTELY should be HTTPS only and all request from the app, from the very first request, should be over HTTPS. If you want more security, add Strict Transport security as well as certification pinning in the app.

But at a very basic level, there is absolutely no excuse for this app to making HTTP plain-text requests to steam at all.

In your example, I could setup a free Wi-Fi hotspot with a different DNS entry for http://loadbalancer.steam.com, have it go to my local ngixn server with a page that looks exactly like Steam's login, capture their user credentials, and then redirect them to actual Steam.

You can't just have a plain text load balancer redirect to https because someone else can intercept you BEFORE that redirect takes place.
>it's rather shocking to observe so much obviously biased downvoting and flagging in one story. A number of anti-CCP posts already dead, and others on their way...

And which posts would that be? I have show-dead on, I see four dead posts, and I struggle to see any substantial criticism of CCP in their rank.
This was just a little swipe, I didn’t intend to go deep into it, and actually planned to delete the comment after a few minutes. Of course that plan was foiled by your reply.
WP reported Amazon stated they violated company policies. That is probably true too ( talking to media or some such ).

https://www.washingtonpost.com/technology/2020/04/13/amazon-...
Also shows Papoose Lake, the infamous lake from the Bob Lazar story - S4.
Agree strongly with this. If a repo is public and gets banned, I think it's reasonable to expect that the community can know why, regardless of the rights or wrongs of the decision.
I love stand-up and this is a great idea. One feature that I'd love is to have 1-2 embedded "highlight" clips on each performer's ticket page. Otherwise it's hard to know what kind of comedy they do.
Gfgffgffffgfgfgf
fgfgfgfg
For me it's not so bad, just 10ms, but my ping to Google and CloudFlare DNS is 0.8ms.

The weird thing is that on their front page they claim to have a PoP in Zürich, the nearest city, yet my traffic is going via DE-CIX. My ISP (AS13030) even peers with Misaka Network (AS57695), which appears to be their backend.
It's like he's... being frustratingly, abstrusely different for the sake of being different.
This seems like a poor way to establish criteria for standardization. It essentially encourages non-standard practice and discourages portable code by saying that to improve the language standard we have to have mutually incompatible implementations.

It has been said that design patterns (not just in the GOF sense of the term) are language design smells, implying that when very common patterns emerge it is a de facto popular-uprising call for reform. That, to me, is a more ideal criterion for updating a language standard, but practiced conservatively to avoid too much movement too fast or too much language growth.

On the other hand, I think you might be close to what they meant by "existing practice". I'm just disappointed to find that seems like the probable case (though I think it might also include some convergent evolutionary library innovations by OS devs as well as language features by compiler devs).
Responsible Disclosure does not mean waiting for arbitrary and unilateral decisions from a company just to be undervalued.

If your argument for responsible disclosure equally applies to this post, a $100 payout and to a $100,000 payout - as long as its from the company that needs to patch the exploit, then re-evaluate your argument.
Aerobic exercise rejuvenates stem cells in old mice (study)
> …what would the impact be if the compiler assumed (correctly) that the loop might not terminate?

Loaded question—the compiler is absolutely correct here. There are two viewpoints where the compiler is correct. First, from the C standard perspective, the compiler implements the standard correctly. Second, if we have a real human look at this code and interpret the programmer’s “intent”, it is most reasonable to assume that overflow does not happen (or is not intentional).

The only case which fails is where N = INT_MAX. No other case invokes undefined behavior.

Here is an example you can compile for yourself to see the different optimizations which occur:

typedef int length;
int sum_diff(int *arr, length n) {
int sum = 0;
for (length i = 0; i < n; i++) {
sum += arr[2*i+1] - arr[2*i];
}
return sum;
}

At -O2, GCC 9.2 (the compiler I happened to use for testing) will use pointer arithmetic, compiling it as something like the following:

int sum_diff(int *arr, length n) {
int sum = 0;
int *ptr = arr;
int *end = arr + n;
while (ptr < end) {
sum += ptr[1] - ptr[0];
ptr += 2;
}
return sum;
}

At -O3, GCC 9.2 will emit SSE instructions. You can see this yourself with Godbolt.

Now, try replacing "int" with "unsigned". Neither of these optimizations happen any more. You get neither autovectorization nor pointer arithmetic. You get the original loop, compiled in the most dumb way possible.

I wouldn’t read into the exact example here too closely. It is true that you can often figure out a way to get the optimizations back and still use unsigned types. However, it is a bit easier if you work with signed types in the first place.

Speaking as someone who does some numerics work in C, there is something of a “black art” to getting good numerics performance. One easy trick is to switch to Fortran. No joke! Fortran is actually really good at this stuff. If you are going to stick with C, you want to figure out how to communicate to the compiler some facts about your program that are obvious to you, but not obvious to the compiler. This requires a combination of understanding the compiler builtins (like __builtin_assume_aligned, or __builtin_unreachable), knowledge of aliasing (like use of the "restrict" keyword), and knowledge of undefined behavior.

If you need good performance out of some tight inner loop, the easiest way to get there is to communicate to the compiler the “obvious” facts about the state of your program and check to see if the compiler did the right thing. If the compiler did the right thing, then you’re done, and you don’t need to use vector intrinsics, rewrite your code in a less readable way, or switch to assembly.

(Sometimes the compiler can’t do the right thing, so go ahead and use intrinsics or write assembly. But the compiler is pretty good and you can get it to do the right thing most of the time.)
I sure hope not ;)
You said "OAuth only does authz and must be combined with other technologies to get authn"; obviously, that's not true, in the sense that you can simply use OIDC --- a dialect of OAuth --- to get both.

Since OIDC is better than SAML, which is probably the scariest security standard on the Internet, I think it's worth being clear to people that OIDC/OAuth is viable.

The SAML authz story, for what it's worth, is pretty shady.
No mention of Noam Chomsky.
I just sent this to my friend who is a professional comedian. She’s been doing a weekly “pay what you want” show the last few Saturdays.

I’d love to see this take off because I don’t want stand up comedy to go away.

Thanks for making this!
Yes, there's already emulators able to run the game (if barely and not really playable)[1]

[1]: https://www.youtube.com/watch?v=8EdJ2dfL9S8
> I doubt very much that anybody can launch a website / web-app today with only user-agent stylesheets and be successful. Even for an internal product that would be seen as bad/lazy/unoptimal.

The triumph of form over function.
> My accountants saved me enough money every year to be basically free

This is true for a _lot_ of people. :-) "basically free". It made me smile because it's usually not "saved me megabucks," but rather "their work allows me to focus on other things and that's worth something to me."
I was thinking about how many low quality Bloomberg News stories have generated complaints on HN. They keep getting posted and upvoted and are just junk.

The quality used to be there. The stories were well researched and more business on-topic than other places like the Wall Street Journal, but now that’s over a decade ago.

Besides this CCP thing, one wonders what else they are watering down. Why would Bloomberg report anything negative about their major customers?
If the compiler knows that the loop will terminate in 'x' iterations, it can do things like hoist some arithmetic out of the loop. The simplest example would be if the code inside the loop contained a line like 'counter++'. Instead of executing 'x' ADD instructions, the binary can just do one 'counter += x' add at the end.
If you're working on a code base that is this sensitive to change, I recommend you find another project to spend your time on. Choose your battles wisely. Not every hill is worth dying on.
The US government was kidnapping people to torture them, and some people still believe it wasn't real torture. Gitmo is still open. The US prison system is often used as a tool against minorities. NSA reach is always growing. Corporate retaliation to silence dissenters is real, as highlighted in this very article.

Yes CCP is worse on many fronts, but we can't do much other than unwind our ties to China, which corporate America does not want to do, and fix our own backyard. Anything else just sounds like someone looking for a convenient excuse and scapegoat.
Yikes, thanks, I'll submit that for re-review.
> Pass laws that deliver consequences for lying and disseminating false information or fabricating narratives.

This is essentially impossible to do while maintaining a free society.
Depends on your system and what fonts you have installed. The font-family is `SFMono-Regular,Consolas,Liberation Mono,Menlo,Courier,monospace;`

In Firefox:

- Right click on the element, select `Inspect Element`

- Click on the Font tab on the right hand side and it will tell you which font is being used.
Isn't that what you would expect any clinician to say, even if they were doing sampling? They're not going to use people asking for tests, they're going to select a group of people at random from the general population and invite them to be tested. Everyone else who has no symptoms they're going to politely say they're not testing people with no symptoms.
> and then verifies that the response has the steampowered.com domain and is https://*

One would still need a justification for that design IMHO, but I don't think it is vulnerable to what you describe.
This is most likely not a typo. The redirect from http to http is most likely due to valve using a self signed ssl certificate and not directly exposing it to ATS, (iPhone). If they went directly to the https endpoint the OS would block the traffic to an invalid, (not CA authority signed), SSL certificate.
Good point. For anyone using the Student Developer Pack (or any other similar student offer), ask yourself this: Do you really want to become reliant on software and services that will cost you ~$70k/year as soon as you graduate?

Well, unless they decide to switch market or shut down, in which case you're hosed no matter how much you're willing to pay.
> (Edit: not sure why HN won't let me make a list without empty lines but there you go)

because hn formatting doesn't actually have a "list" concept https://news.ycombinator.com/formatdoc
OP here. One subtle distinction - lab origin does not necessarily mean engineered. It can also just mean a lab employee got infected while handling and then was a vector for one or many human to human transmission.

Intuitively that transmission vector appears to be higher probability than zoonotic transmission (animal to human). Just my intuition.
Seems kind of odd as Pro isn't listed on https://github.com/pricing as far as I can see.
Work on small projects. I'm writing all projects myself and it's still fun, when you decide everything. I can write my own HTTP server implementation if I feel like it.
>My productivity has definitely dropped, and it feels like my brain never really fully turns "on". It feels a lot like those times in university I decided to study for exams from home instead of going to campus. I can't explain it, but 9 out of 10 times it just feels bad, like the way your brain feels if you've spent the day watching TV or something (when, in fact, I haven't). This doesn't even begin to consider the social punctuations of work that are essential to my psychological well-being.

>

>Does anyone feel the same?

I can't believe no one mentioned it yet: Mental compartmentalization based on where you are is a very real thing. Everyone experiences it, some more than others, and if you want to be productive working from home, learning how to work with it is of key importance.

For good work from home hygiene it's required that you isolate a physical space dedicated for work only tasks, like a home office.

Some people can get away with having a separate computer or seperate user to separate their space while using the same desk. Having a work account that blockes reddit, ycombinator, youtube, and the like helps, but as a general rule of thumb the easier it is to switch spaces, the smaller the isolation between them. ie, if switching users takes 10 seconds the isolation is small, but if you need to walk two minutes across the house, it's going to be a much stronger isolation. This is one of the tricks the rich use, by having an office far away from their bedroom in their house.

If you don't have things in your room to play with, like a tv or something, then the digital space separation works well, but if you find yourself fiddling with a tv all day while on your work account, it may cause problems. Alternatively, having background noise can help and turning on a ratio or tv in the background while working can accelerate productivity. It depends on your mental frame and how you think of it. In your situation it may be better to set up an ad hawk work space in your kitchen or living room.

This space separation is recommended in just about every work from home guide you will find, and it is a well studied phenomena, going back to the vietnam (or korean I forget) war where they were able to get 98% of solders off of heroin using the same tricks: the addiction was tied to physical cues like a physical room, or a friend. Get rid of those physical cues and the mental part of the addiction would vanish for all but those using drugs to avoid their problems. Same mental process, but studied in a drastically different subject.
Okay, I have to ask - are the app names from the game, or your addition?
Since they just said they were waiting for Enterprise revenue to reach a level where they could free the core product, and since SAML is an important driver of Enterprise upgrades (I've seen it happen), I wouldn't hold your breath.

Now that the core Pro features are free, I wonder if Rob will update sso.tax to set Github to :inf:.
I've actually been in a similar situation except it was a former stationary closet that they had put counters around and there was five to six people in there. It actually wasn't that bad as we all face away from each other, and everyone was quiet. It was only 5-6 people of noise instead of the entire floor's.
I took some creative liberties there.
What is Return on Equity, how do you calculate it, and why is it Important?
https://help.github.com/en/actions/hosting-your-own-runners/...
The Fascinating History of the Color Blue
Why would they use a self signing cert? They could use a real Cert. It's Steam. They can afford real certs, or just use LetsEncrypt.

There is absolutely no reason for the app to connect to a login/authentication service (or any service) over plain text, period! There should be unit tests that scan for http:// and will fail the build if found in the code or resources.

I know some things are not simple fixes, but this is absolutely a fix that can be done and we should all know how to do. It should have also been made a security priority and pushed through.
Not a doctor. A major issue with using this type of CPAP machine on a Covid-19 positive person is the high amount of aerosolized virus particles it exhausts. Anyone using this should be extremely careful and know what they're doing. That being said, doctors in many countries are using positive air pressure machines with an air-tight helmet/bag with filtered exhaust.
I think this is a reasonable position. In general, the media itself has convinced us of its importance and at times. Which it is, but I think that less scrupulous entities have abused this privilege to a truly distasteful and disappointing degree.
Zoom security: Your meetings will be safe and secure if you do these things
We can prove violation of the CHSH inequality, and hence compatibility with Bell's theorem, as a natural consequence of our formalism. See, for instance:

https://www.wolframcloud.com/obj/wolframphysics/Documents/so...

Or, for a less technical version of the basic idea:

https://www.wolframphysics.org/questions/quantum-mechanics/h...
I think we are going to come to a time where it does. I only hope that the algorithms will eventually recognize that the best things we say are always polarising, rather than seeking a bland conformity.
The app labeled "noom" looks like Skype, not Zoom.
I agree. There's a million SAML for Java/Python/Node.js/Foo libraries out there, all with a long list of issues and known cases that don't work correctly, security issues etc. but it's the wrong model in my opinion.

Instead of directly bolting SAML into your app, I think a FOSS implementation of an independently running service is the way to go. You run the battle tested open source service (locally / in your cloud), it accepts the SAML assertions and mints something sane like JWTs which can easily be consumed by the service providers, isolating the entire thing from your core app and allowing it be used with any stack. E.g. essentially an open source locally deployed Okta. Doesn't even need to do any user management, just focus on rock solid interoperability and forward all decision making to the actual app server.
This except I'm hunched over two 720p laptops with awful displays that have glare at every angle. I probably could achieve more in one day at the office than 5 days at home.
> The Berkshire Hathaway sure can look like that precisely because it’s the website of Berkshire Hathaway, an established and trusted holding company - pretty much the hallmark of blue chip investment.

> Furthermore, Berkshire does not try to entice visitors or market any services through its website. Its only purpose is shareholder communication, and for that, this website is one step removed from sending those by fax.

That's exactly what the post says:

> The official website is built for the shareholders of Berkshire Hathaway. It’s not built to convert customers. It’s not built for you or me. Shareholders are really only concerned with very specific things: news releases, reports and letters from Warren Buffett to name a few.
For me the first example where I really got why algebraic structures was useful this video on using abstract algebra in analytics[0].

This helped me grasp something that I had read from Alexander Stepanov[1] that I hadn't fully understood before (not being familiar with the algebraic terminology):

> I suddenly realized that the ability to add numbers in parallel depends on the fact that addition is associative...In other words, I realized that a parallel reduction algorithm is associated with a semigroup structure type. That is the fundamental point: algorithms are defined on algebraic structures.

I think the use case of building infrastructure for parallel/distributed computation as described above is a nice, concrete example of why using abstract algebra in our programs can be useful. It certainly isn't the only use case though. Other things include managing complex control flow, or passing an implicit context through a computational pipeline.

[0] https://www.infoq.com/presentations/abstract-algebra-analyti...

[1] http://stlport.org/resources/StepanovUSA.html
Hey, that's my favorite XKCD!
Sweden is on the same track as Switzerland, but about a week behind. They will probably show up on the map in either 1 or 2 weeks.

http://91-divoc.com/pages/covid-visualization/