skysight-inc/HackerNews huggingface dataset:
> As a developer of web apps, I will personally continue to not think that much about HTTP/3. Perhaps in the future network/systems engineers will have figured out how to make it bear fruit? I don't know, but it seems to me of unclear wisdom to count on it.

Congestion control algorithm - and congestion window sizing/tuning - plays a not-insignificant role in throughput, especially when comparing a 15KiB object vs. a 1MiB object. It's often _more_ outsized for those "medium sized" objects, as too small a window won't scale up by the time the transfer completes in some cases.

In other words: this is a good post, but the caveats around congestion control algorithm are a little understated w.r.t. the benchmarks.
What is not human is measuring the "rate of return" of what you learn exclusively in economic terms. Culture is a thing, although not always a very profitable one. There are people (particulars, governments, and even the UN) spending money to conserve languages. Also, I find quite extreme that you consider being able to talk with old and poor people a "waste of time", just because it won't help you to make a living.

A language is a tool, but it is also much more. In particular, it is much more than a tool to make money.

I don't know you, maybe you are a wonderful person. Maybe you could have done better things with your time than learning that language (I do not know how much time you invested or your possibilities to use it), but reading your comment made me feel bad.
I don't think it's a big deal for Java because it's always easy to transfer in from and out to UTF-8. Very few Java programs use UTF-16 as a persistence format, and Java-native applications can directly marshal strings around as they are a first-class datatype.
All of the top comments are anti-CCP.

There are four dead comments in this thread.

* Two are entirely unrelated to the article at hand.

* One is a plea to not have this kind of content on Hacker News.

* One is meta-criticism that HN is fragile.

None of them match your criticism.
It depends on how the app is displaying the link. They could be setting all sorts of cookie info/metadata in the original http request. There are many answers as to why it is accepted. I'm obviously not the developer of the valve app so I can't tell you exactly.
> transitioned form cubicles to open office. Each step in this process has been notably worse than the previous and no one argues about that at all.

I see people complaining about open offices almost every day on HN...
> First, Microsoft was evil back then because they didn't just rely on excellent pricing and features (both of which they had) - but also because they leveraged their monopoly in one market (desktop operating systems) to prevent competition in adjacent markets (browsers).

Isn't that exactly what's happening here?

Gitlab competes with Github, but doesn't have the equivalent of Azure to subsidize it with.

Azure competes with AWS and GCP, but Amazon or Google don't really have a Github competitor. (Maybe Google has a small one (?), but I've never heard of anyone using outside their cloud product.)

Bringing Github and Azure closer together is an obvious move.

Github might not be a monopoly in the legal sense, but it's a solid #1 in the space, with strong network effects. On the other hand, Azure is far behind the near-monopoly AWS.
Corn Laws
and deaths are up to 5 weeks behind cases.
CPAPs control the amount of air by measuring backpressure AFAIK.
For folks looking for extra protections, you should include a call for protected concerted activity when voicing your opinions and directing them towards fellow employees:

https://www.nlrb.gov/about-nlrb/rights-we-protect/the-law/em...
Yep, so far this is on the order of a bad flu year in terms of excess mortality. Given that Sweden seems no worse yet than other countries it suggests that the lockdown may not be as effective as claimed.
They weren't "representing the company" which means speaking its behalf. They were criticising some of it's policies.
It's a little odd to say something is not a "net security benefit" and, in the next sentence, make a powerful case for it as a net security benefit. SSO is probably the most important organization security tool there is, and a survey of tech company CSOs will average it in the top 3, if not the top 2 technology acquisitions most would make at a new firm (this is a question I've actually surveyed).
Show HN: Timmy - a Pomodoro timer with a social twist (inspired by HN)
Same question here. We use the hosted version of Azure DevOps for work, but I use github for open source contributions. They both have their place, and DevOps feels more suited to enterprise use than GitHub right now.
I use Gitlab's CI runners and I agree. However, I am pretty excited about the direction that Github is going with their actions. Having a directory of user created actions and integrations seems like gold to me and I hope Gitlab starts leaning that way soon.
I stumbled across Druid (with superset) and it looks great but has a really low profile, even though it is in a hot area. Does anyone actually use it?
Contact tracing via technology doesn't have to be via phone towers or anything like that (I agree those have little value outside of the aggregate). Anonymous tracking solutions via bluetooth that are much more are actively being developed and have also been advocated for by people affiliated with the CCC (as well as epidemiologists).
Exactly, I would not like being hooked up to a machine that could overinflate my lungs without sounding any alarms.
Both share the same attributes: The spec allows them to work, but they require lots of effort on the implementation side to get it right. HTTP/2 require a library which does sane write scheduling and prioritization to make it work.

QUIC handoffs are a lot more complicated. They will require a library which supports all the necessary features. And it will require infrastructure which supports it. Without infrastructure support, packets from the client might get routed to the wrong host after a IP tuple change, and can from there on not associated with the QUIC connection.

My guess is some QUIC deployments will figure out how to make it work - others likely won't, since a lot of efforts is involved.
One more aspect of why this design is appropriate is consistency. The 1998 version found in the wayback machine is basically the same design. Given the product the consistency is especially appreciated.
In general, trash talking one's employer in public is usually inversely proportional to the longevity of one's employment with said employer.
More importantly, the president was able to discern who was smart in the movie. In real life we have Jared Kushner.
The policy could also be in violation of law. Hard to see without looking at the policy and also without looking at the substance of the comments. But there are federal laws protecting certain worker activity and a policy doesn't overrule that.

It depends on the specifics of this case.
Impact of Covid on the Service Sector
Do you plan to make github enterprise available for free on their own premises for teams?
There's nothing magic about it. Web Forms was a great innovation and brought the WinForms model to the web. It was more productive than anything else at the time and directly influenced MVC patterns (which asp.net itself went towards) and component-based UI.

Blazor is the next evolution in client-side and offers an alternative to building component UI with C# running through WebAssembly instead of Javascript. Again it's much more productive and lets backend teams reuse much of the same code, similar to JS/node projects today.

Blazor's server-side runtime is a optional model where all the component logic can run on the server and be delivered over a SignalR connection to further increase productivity and efficiency where it makes sense (highly constrained devices, local intranet apps, etc. There's even experimental projects to bring Blazor for mobile apps.
Not really. It's very vague -- he is just repeatedly saying "well, you could write down X in terms of graphs in this way." But you can write down anything in terms of anything. You can write a compiler in PowerPoint because it's Turing complete. You can write the Bible in Klingon. You can write about making a burrito in category theory.

Languages are just packaging. In order to have content, you have to nail down specifics, and here the choice of language can be useful because the specifics might be more naturally expressed in some languages than others. But Wolfram hasn't begun this journey.
Admittedly, I only skimmed NKS. That said, I don't understand how the approach is different than anything else abusing the incidental fact that something is Turing complete to re-prove existing results.

The problem with these approaches, like trying to write a neural network in MS Excel, is that it's going to be cumbersome, slow, and provide little advantage over more straightforward calculation methods.
But I think the complaint is that it doesn't happen through mount(8).
The author stated that Valve ended up patching this and switching to fully-HTTPS, which makes me think that this was a bug and not intentional.
Trying to be snide that GitHub should copy you is not a good look. I'm sure most people haven't forgotten that you built your entire business off their work. You used their open source git libraries without contributing back, you ripped off pull requests, and you copy-pasted their CSS for a long time.
Quite the opposite. So enthralling one obsesses over it and incorporates it into their own dreams and fantasy.

Nintendo is quite special. The Studio Ghibli of gaming.
It's not a technology problem. Integration with "foreign" SSOs is complicated no matter what protocol you use, with lots of corner cases and support costs, but these features are expensive for the same reason that single-day-turnaround short-notice flights between Chicago and NYC tend to be expensive: the people who want them have money to spend on them, and it isn't their money. That money pays for the cheap seats everyone else sits in.
I'm following his "technical introduction" here: https://www.wolframphysics.org/technical-introduction/
Khan Academy’s economics and finance videos are excellent for learning the fundamentals.

Ray Dalio’s talks on YouTube, and his most recent TED talk are great for context around economic downturns.

Real Vision and Anthony Pompliano’s podcast are good for deep dives into what’s going on with a bit of an alternative take.
I'm gonna do little quotes but, I don't mean to be passive aggressive. It's just that this stuff comes up all the time

> I think it's quite obvious that UTF-8 is the better choice over UTF-16 or UTF-32 for exchanging data (if just for the little/big endian mess alone...

This should be the responsibility of a string library internally, and if you're saving data to disk or sending it over the network, you should be serializing to a specific format. That format can be UTF-8, or it can be whatever, depending on your application's needs.

> and that UTF-16 isn't a fixed-length encoding either)

We should stop assuming any string data is a fixed-length encoding. This is a major disadvantage of UTF-8, because it allows for this conflation.

> keeping the data in UTF-8 for most of its lifetime also when loaded into a program, and only convert "at the last minute" when talking to underlying operating system APIs makes a lot of sense, except for some very specific application types which do heavy text processing.

Well, you're essentially saying "I know about your use case better than you do". It might be important to me to not blow space on UTF-8. But if my platform/libraries have bought into "UTF-8 everywhere" and don't give me knobs to configure the encoding, I have no recourse.

And that's the entire basis for this. It's "having to mess with encodings is worse than the application-specific benefits of being able to choose an encoding". I think that's... at best an impossible claim and at worst pretty arrogant. Again here I don't mean you, but this "UTF-8 everywhere" thing.
OP here. Five days ago I got inspired by this post on HN:

https://news.ycombinator.com/item?id=22806609

and decided to build something for myself. Maybe others will like it. Very early MVP, go easy please. :)
Also worth understanding that a ventilator is not always the best option - there have been findings recently that a tactic called 'proning' is often enough to increase blood oxygen:

https://www.nytimes.com/2020/04/14/nyregion/new-york-coronav...
Per https://lwn.net/Articles/575563/, Debian at one point found that 40% of the C/C++ programs that they have are vulnerable to known categories of undefined behavior like this which can open up a variety of security holes.

This has been accepted as what to expect from C. All compiler authors think it is OK. People who are aware of the problem are overwhelmed at the size of it and there is no chance of fixing it any time soon.

The fact that this has become to be seen as normal and OK, is an example of Normalization of Deviance. See http://lmcontheline.blogspot.com/2013/01/the-normalization-o... for a description of what I mean. And deviance will continue to be normalized right until someone writes an automated program that walks through projects, finds the surprising undefined behavior, and tries to come up with exploits. After project after project gets security holes, perhaps the C language committee will realize that this really ISN'T okay.

And the people who already migrated to Rust will be laughing their asses off in the corner.
I'd ask them if they really meant "impossible" or just "harder than I wish it was".

I've typically found that the tradeoffs between security, performance, and implementation efforts are usually more to blame for why writing secure C code is a challenge. There are a ton of tools out there to help with writing secure code (compiler diagnostics, secure coding standards, static analyzers, fuzzers, sanitizers, etc), but you need to use all the tools at your disposal (instead of only a single source of security) which adds implementation cost and sometimes runtime overhead that needs to be balanced against shipping a product.

This isn't to suggest that the language itself doesn't have sharp edges that would be nice to smooth over, though!
Craiglist absolutely gets praised because they have been so successful with that design. There are plenty of websites that looked like Craigslist but were not as successful, and you won't see them in thought leadership blog posts in 2020.

Also, Craiglist has evolved their site quite a bit and at this point their "design" is no longer a matter of simplicity, but essentially a visual aesthetic that they maintain as a matter of branding and culture, kind of like Amazon giving people door-desks long after it became cheaper for them to just buy regular office furniture in bulk.
> A good portion of medical device RnD is related to creating technology that is hard to misuse and result in accidental death, and I just don't see that here.

The people relying on these hacks would be definitely dead without the hacks, that is the point. Even if the chances of this working successfully are only 10%, you just saved 10% of the patients compared to 0%.
Is there anything in this data indicating that there is something going on more severe than the flu? I don't see anything.
I don't have references because of the intentionally opaque way this stuff is negotiated; but the level of consolidation was one of the most eye-opening things I found when building a video product in the space back in 2016. Rooster Teeth (owned by Otter Media, which is WarnerMedia/AT&T) is a good example here; they have their fingers in a lot more YouTube pies than is obvious at a glance.

But yeah -- the real money in video is still in negotiated campaigns that target a specific channel or set of channels. There are only so many ad buyers, so there are benefits to centralizing ad slot sales as well as SSP activity.

Those kids doing a billion views have a magic combination of personal charisma, work ethic and well-connected, pushy parents in the media industry. Things were different pre-2015 but the level of sophistication required to get big in online video is much higher than people think. There are a lot of talented, charismatic people out there making videos; the ones who find financial success are the ones who can amplify their voice above the crowd (which really just takes money).
Glad to hear it, looking forward to seeing what you come up with! The question becomes, once you have the heterogeneous operations, is there any reason to keep the others around (my experience is that they simply become a distraction / attractive nuisance, and we're better off without them, but there may be use cases I haven't thought of that justify their inclusion).
> verifies that the response has the steampowered.com domain and is https://

But you're trading an easy solution (only use https://) for several points of failures (validate potentially untrusted input all along the chain).

> verifies that the response has the steampowered.com domain

An attacker is going to look for any exploits on steampowered.com (open redirect, xss, etc.). So now your domain name check is insufficient, you also need to make sure that all of steampowered.com is secure (which, odds are, is managed by multiple teams).
Sorry for the delay here -- I use a third party app and not the one from Huami/Xiaomi.

This is the app that I use: https://play.google.com/store/apps/details?id=com.mc.miband1...
I understand, I mis-typed. I meant self-signed cert. That should have been pretty obvious from what I actually posted though.

https://store.steampowered.com is the official steam marketplace. It does not use a self-signed certificate.

> There are many benefits to using a self-signed SSL cert over purchasing a CA one.

I'm sure there are (not that any are immediately coming to mind), but this is the official web marketplace. It is NOT self-signed. It's signed by DigiCert, Inc, which is easy to check if you go there.

To clarify, store.steampowered.com is not some special app store subdomain. It's the official store, and where you are redirected in a browser if you go to steampowered.com. It is very unlikely they are using a self-signed certificate given it's an actual web address used by many tens of millions of people in their browsers primarily.
What I’m saying is this is just the boring old way of writing websites and it’s still widely practiced today, there’s hardly any genius in it, nor is it a masterpiece.

Also, your argument that any company with enough money to fix a dysfunctional website must have a good enough website is kinda laughable.
Midnight Coder – Spotify playlist for jamming out code and getting shit done
This is a facile take. Here’s another corporate site:

https://www.scotiabank.com/ca/en/about.html

This is for shareholders etc. Suppose you give that page + the berkshire page to a group of shareholders. I’d bet they can find what they need faster on berkshire’s site. And it loads damned fast. Scotia’s is bloated.

Moreover, Berkshire shareholders are wealthy. Berkshire has a large portfolio, but Geico is the one product pretty much all of them need (car insurance). There’s a highly visible geico add with a clear call to action right on the home page. That’s no accident (Buffett also mentions it constantly at shareholder meetings and in his popular letters)

I genuinely think the Berkshire site is better suited for its purpose than 95% of corporate relations pages.
Looks to me like a Windows UI or one that was influenced by Windows.
^^^ CORRECT ^^^

Unless expressly stated, it’s the lifetime of the product or offering, not the buyer’s lifetime.

Buy a non-stick frying pan with a “lifetime” guarantee on the coating. 3 years.
”It has four main registers R1-R4 and nine extra registers R5-R13“

I found that ‘4’ a weird choice for a ternary computer, until I read that R1 is special.

Register-to-register moves always involve R1. There are 12 such moves into R1 and 12 out of R1. That leaves 3 trit patterns in a 3-trit value for “increment R1”, “decrement R1” and “NOP”.

Also, this architecture doesn’t allow reading data from, or writing data to memory. The memory only is there for storing. programs. So, it’s almost as if this has one register, 12 words of data memory and 729 words of program memory.

Weird, but economical on the hardware, I guess, so it keeps the cost and amount of work down. Also, there’s room for extension commands, so the above may change.
It isn't neoliberal propaganda, it is just editorially neoliberal. Having some particular editorial voice does not make something propaganda. Similarly, there are many magazines that are editorially progressive or socialist or any number of things, and are also not propaganda. Maybe this is all you meant, but if so, I don't think it is a useful definition of the word "propaganda".
I mean, it's also irresponsible for societies to have fewer respiratory therapists and ventilators than are needed to support their patients, but here we are.
I'd totally support the employees if they got fired or even cautioned for exercising their free speech rights. Amazon needs to get penalized if that's the case. Where it gets into the gray zone is when employees misuse company property and time to engage in activism. Like the Google Employee who used her access privileges to distribute messages supporting her position.

Personally I think we should draw a clear line between these two types of actions. When we don't do that, we weaken legitimate free speech.
There's a "Discussion Forum" link on the homepage.
Agree with your sentiment. Now to nitpick: the first iPhone jailbreak was achieved days after the iPhone was released
way back in July 2007.

Source: https://www.cultofmac.com/192850/the-history-of-jailbreaking...
Not to worry, they'll simply say they have a "talent shortage" and ask the government to help supply them with workers whose situations are so desperate they won't think about the company's business practices.

(Note, this is not actually a jab at Amazon in particular.)
There is an argument, and I think Wolfram has made it, that one would expect the systems and the math to become simpler the deeper and more fundamental the models became, and the opposite seems to be true with modern physics.

When you say conventional math, you’re referring to math that would be quite difficult let’s say for even a dedicated undergraduate math, physics or electrical engineering major. The CA, on the other hand described a process an interested child can comprehend.
Craigslist had a 2019 annual revenue of about $1b. Craig Newmark's net worth is said to be around $1.3b.
I wonder if this will lead to more closed source software being written. I don't mean by MS specifically, but overall.
The cynic in me thinks that for any number of potential candidates who feel the same, there are exponentially more candidates that just want to work there regardless, and the recruiting team knows this.
That's fine. I'm not saying you have to switch, but it looks like there's a way.

Maybe they could combine efforts? Maybe they could look at the code, and if the licenses allow, port things to theirs.
Probably the same way that recruiters for large government contractors feel when the government or military gets bad press.
> Most of the benefits that HTTP/2 brings to the table require a new model that doesn't map cleanly to the traditional request/response lifecycle

This is not true. The only HTTP/2 feature that doesn't fit into the traditional HTTP semantics is PUSH. And even that is the request/response model - the only difference is that the request is injected also from the server side and not being received from the client. We just pretend we would have received such a request from the client, send the response towards the client, and hope the client won't reject it.
https://netflixtechblog.com/how-netflix-uses-druid-for-real-...
Sorry for seeing this so late! I didn't have any in particular in mind, but it comes up pretty frequently throughout, I believe.