skysight-inc/HackerNews huggingface dataset:
The standard string library is still pretty bad. This would have been a much better addition for safe strcpy.

Safe strcpy

char *stecpy(char *d, const char *s, const char *e)
{
while (d < e && *s)
*d++ = *s++;
if (d < e)
*d = '\0';
return d;
}

main() {
char buf[64];
char *ptr, *end = buf+sizeof(buf) ;

ptr = stecpy(buf, "hello", end);
ptr = stecpy(ptr, " world", end);
}

Existing solutions are still error-prone, requiring continual recalculation of buffer len after each use in a long sequence, when the only thing that matters is where the buffer ends, which is effectively a constant across multiple calls.

What are the chances of getting something like this added to the standard library?
Sorry, that's what I meant. I should rephrase: a commit message for a commit on the dev branch.

I was assuming a relatively lazy commit message as an example. You're correct in identifying that certain organizations might put a lot of information into a commit message.
Gitlab need only wait before GH starts adding Azure-first and Azure-only features, as they are wont to do. At that point they can just offer "the same but for any other cloud provider". Amazon, Google, or IBM, might even throw them a bone.
Secret Manager Documentation
> You cannot simultaneously be an activist and a cog in the wheel.

Bullshit. The entire history of the labor movement chooses to disagree. Employees have far more influence than customers in influencing company direction.

It is the moral and ethical responsibility of individuals enjoying cushy paychecks to ensure they don't come from creating harm to others.

What you're saying is that corporations should be able to bribe employees into accepting an unlimited amount of harm, when in many cases replacing employment and continuing one's own livelihood would be threatened by doing so.

That's horse shit and somewhere deep down, you fucking know it.
It's similar to how there's a notion that all websites from the mid 90s were full of marquee tags and MIDI music and everything was in Comic Sans.
“Typesetting Markdown” blog post series by a technical writer
The problem is that those talents are being used to solve totally wrong problems because of engineers going gung-ho and starting to "engineer" before they understand the subject. The problem is not lack of designs or ideas for ventilators.

This sort of hack still requires that someone makes those things at scale. That's a supply chain issue, same as taking an existing, proven and actually certified design and manufacturing it at scale. Hacking up a few CPAP machines really doesn't solve the problem when the hospitals need tens of thousands ...

Even if we ignore the legal and medical bits (only in an extreme emergency with no other options and where the alternative is an inevitable death would anyone even contemplate using something like this on a patient), this machine isn't really a ventilator suitable for people with failing lungs. Patients that have to be intubated and the machine actually breathes for them, filters, humidifies and warms the air, allows sucking of phlegm without spewing virus everywhere ... And those are the machines that are in short supply. This hack doesn't do anything from that.

And finally, it doesn't address the issue of having enough trained staff that will operate and supervise the ventilators - these things have to be supervised 24/7, sometimes for weeks. One ICU nurse is commonly supposed to handle up to 6 patients, tops. You can't just add ventilators without adding nurses, because if anything goes wrong, people will die - and where do you get those nurses from? Especially if they have to deal with a gizmo that isn't as failsafe as a real ventilator (because it wasn't meant to be)? If you need more staff to run fewer ventilators/beds, then you haven't really solved anything, have you?

And the lack of trained staff is not something a jailbreak or an Arduino can solve.

People should stop messing with building "ventilators" and focus on things where they can actually make a difference - e.g. the production of face masks, face shields and similar gear, which are in extremely short supply and don't require much sophistication to build. That would make a much bigger difference than pretending that we are somehow solving the lack of ventilators with hacked CPAP machines ...
pascal_cuoq cowrote it. Maybe we should ask him if his views have changed since then.

Btw, there was a thread about it at the time: https://news.ycombinator.com/item?id=8233484.
1. When will we get proper strings in the stdlib?

2. When we will get the Secure Annex K extensions?

3. When we will get mandatory warnings when the compiler decides to throw away statements it thinks it doesn't need?
Like memset or assignments. Compilers are getting worse and worse, and certainly not better.

ad 1) Strings are Unicode nowadays, not ASCII. Nobody uses wchar but Microsoft. Everybody else is using utf8, but there's nothing in the standard. Not even search functions with proper casing rules and normalization. Searching for strings should be pretty basic enough.

2. The usual glibc answer is just bollocks. You either do compile-time bounds checks or you don't. But when you don't, you have to do it at runtime. So it's either the compilers job, or the stdlib job. But certainly not the users.
Show HN: tsaug – Open-source package for time series and audio data augmentation
Countries have exported food at least since Roman times. Much of the ancient Mediterranean shipping was transporting food.

Hunger was still a constant specter, though.

Consider the rise in height in Americans after this achievement. This doesn't happen without plenty of food available all the time.

I'm old now. It wasn't until a couple years ago that I EVER went 24 hours without food (I was experimenting with fasting). Historically speaking, that is incredible.
These are also common ones. It's also transplanted onto a bunch of other less well known non-sinitic languages like Khitan, Jurchen, Okinawan, Zhuang etc.
> (This story corrects second paragraph to say Christian Smalls was fired for violating paid quarantine, not for raising health and safety concerns.)

I'm I misremembering or was that story "fired for violating paid quarantine" proven to be iffy at best? I'm looking for confirmation.

Edit: Found what I think I was looking for [0]

> Here is the key point Amazon claims he was exposed to the worker on March 11th. Over the weekened he said he is organizing a strike, so over the weekend they order him and only him into quarantine. A full 18 days after his 5 min exposure. From my reading of it, this almost certainly looks like retaliatory action due to the strike, and a company using the excuse of quarantine to cover it up.
Key excerpts from a much clearer article. And yet again, why you never 100% believe a company's PR response when they're trying to cover themselves. They tell just enough truth, but use it to intentionally mislead.

> https://www.theguardian.com/us-news/2020/mar/31/amazon-strik....

>> According to the company’s previous statements, the infected co-worker in question last reported for work on 11 March. Had Smalls been exposed that day, a 14-day mandatory quarantine would have made him eligible to return as soon as 25 March.

>> Smalls said Amazon did not send him home until 28 March, three weeks after the exposure.

>> “No one else was put on quarantine,” he said, even as the infected person worked alongside “associates for 10-plus hours a week”.

>> “You put me on quarantine for coming into contact with somebody, but I was around [that person] for less than five minutes,” he told Vice.

>> According to Amazon, no one else was fired. Smalls said he was considering legal action, calling it “a no-brainer”.

[0] https://news.ycombinator.com/item?id=22739059
0-RTT requests mess with the traditional lifecycle and have security implications that many won't handle safely.
Cloudflare includes such a toggle for HTTP/3, though to be honest I forget if it's still in a closed beta or more generally available.
It’s obviously not focused on private comms, so it won’t be a replacement for actual e2e private messaging and chat.

For the public content, the lack of commercial advertising incentives is probably a big one. IME the client apps and server instances aren’t injecting trackers and selling ads based on user behaviors.

If an instance or client went rogue and started introducing such practices, it would likely be moderated out of relevance.
This would explain the template spam I recently came across.

Here are a couple samples:

Full stack web developer for {type of app or your company name}

About us:
{Description of your company and target audience}

What we're looking for: develop a website for independent living program.
An experienced full stack developer to help kick-start/build on {description of website or platform}. We need someone to work on {specific project requirements}. The project is based on {software platforms, frameworks, languages, databases used by your company}.

We need the following deliverables:
- Deliverable #1 by {date}
- Deliverable #2 by {date}
- ...

To complete all the deliverables, the right developer will have experience in the following:
- Experience translating designer mock-ups and wireframes into front-end code
- {Software platforms, frameworks, languages, databases, unit tests, version control, APIs}

In your proposal, please share a brief summary of your experience and tell us about a recent full stack web development project you worked on.

*

Copywriting for {type of product or your company name}
Email Marketing

About us:
Funnel marketing and landing pages

We're currently on the lookout for a world-class copywriter to help us write {types of assets}. The copy will highlight {brand benefits or business objectives}.

Deliverables:
- Copy for {assets needed for the campaign}
- Copy suggestions to conceptualize marketing campaigns
- One potential round of rewrites based on client feedback

This project requires:
- Copywriting expertise
- Background at {list agency, in-house, etc.}
- Creativity and ability to conceptualize
- Familiarity with {your company or industry}

In your proposal, please share a brief summary of your experience and tell us about your most successful copywriting project to date.
Boy I wish I could edit that for grammar now.
> The problem is that the only organizations that would make this single issue of SSO support a deal-breaker are bigger companies who can afford to be upsold

That's not true. We are a tiny company (~10 ppl), but SAML, OIDC (or GSSAPI or Radius, if really necessary) support are a deal-breaker for anything we use.

We used to have separate accounts for everything we had. It became a drag, we had to solve it. Nowadays, either it can be integrated with SSO, or we will do without.

> so everyone treats this as an up-sell feature.

And that's the mistake.
Failing that, you could also adopt a naming convention with prefixes to indicate what sort of thing it is you're storing there:

hsCode = hsFromUs(usInputBuffer);

ssStoredCode = ssFromHs(hsCode);

https://www.joelonsoftware.com/2005/05/11/making-wrong-code-...
Detect malicious Linux behavior using SIEM
Node v13.13.0 (Current)
What it’s like to suffer from the coronavirus’s weirdest symptom
What Is Interferometry?
Not really. Only in that the kids symptoms were fairly mild — cranky, cold-like symptoms, etc. Which is apparently fairly common with coronavirus and younger kids (thankfully).
Thank you for sharing this story! I have regretted not going to that tour for years now. I just didn’t have the money but I wish i had found it because I would have been in those cheap seats screaming for Clifford too!
Amazon employed UX designers?
We just released v0.2 of tsaug, an open-source Python package for data augmentation of time series and audio sequences.

Data augmentation is a common technique applied in deep learning. Augmentation of image data for computer vision models has been a mature and standard process, and several open-source packages (e.g. imgaug) are popular choices. However, open-source libraries for data augmentation of time series (including audio sequences) are rare.

In tsaug, we developed several common augmenters of time series and audio sequences as well as pipelines that may connect augmenter instances. More importantly, tsaug is an expandable platform where new augmenters might be developed following a unified API.

Issues and PR are welcomed, as well as stars and forks!

An example of time series: https://arundo-tsaug.readthedocs-hosted.com/en/stable/quicks...

An example of audio sequences: https://arundo-tsaug.readthedocs-hosted.com/en/stable/quicks...
Gitlab, yes. I don't see Bitbucket as much of a player (unless you're in the Atlassian ecosystem and you like it, which seems... rare).
Looking at How Browser Zoom Affects CSS Media Queries and Pixel-Density
Hey Marc! Good to "see" you again. There's a sad old saying in business that you know you've "made it" in business when someone sues you. There's something to that unfortunately, that if you are in business long enough, chances are you'll be on one side or the other of legal action. It happens. You misjudge a client, maybe they have some personal issues that bleed into a business, maybe there is a market downturn and they make some question choices. Things happen. Point being, the posters in this thread recommending the use of lawyers and accountants to protect your interests are spot on imho.
Show HN: Chrome extension that indexes all your work documents in one place
But also: "fix stupid fucking sql injection"
And the state shouldn’t prevent companies from discriminating against laborers in labor unions. Unless the union has a private contract with the company.
I don't think that splitting is usually necessary. If the company can prove that someone already reported it and there are not too long delays to fix the vulnerability, I would think that people would accept that this time they were not the first and they will try next time knowing that no one tries to screw them.
Sixth Tone is owned and operated by the government, for the purposes and goals of the government. Does Trump control the NYT? I think he wishes he did, but no.
"ij" is sometimes considered a single letter, but certainly not always. Quoting Wikipedia (https://en.wikipedia.org/wiki/IJ_(digraph)):

"Ĳ (lowercase ĳ; Dutch pronunciation: [ɛi]) is a digraph of the letters i and j. Occurring in the Dutch language, it is sometimes considered a ligature, or a letter in itself. In most fonts that have a separate character for ij, the two composing parts are not connected but are separate glyphs, which are sometimes slightly kerned."

(and equivalent in the Dutch Wikipedia article)
I'm glad to get this background info. I've been following your progress for the last few months, it's good to see you get some traction here on HN.
want to point that ever since Terraform 0.12, all terraform params and modules etc are transformable in objects, what I mean by that is you can use functions like yamldecode or jsondecode to decode any yaml or json into terraform objects and pass into modules or resources or locals, also "real" programming language is always funny to me when ops are going to be much more comfortable with HCL. JSON/YAML are not in the same class as HCL. YAML maybe can do nesting with & but they can't just create simple config style interface, where the user facing side is a simple yaml file, and the terraform code underneath take it in and pass it to its modules
Maybe not but IETF took over the development from Google and now Quic is a generic and widely useful transport protocol. What is needed is kernel support and hardware accelerators.
As a person who comes from a country with non-ASCII alphabet, I strongly disagree. Since UTF-8 became de-facto standard everywhere, so many headaches went away.
They've taken some mitigation steps - closing high schools and universities, banning large gatherings, encouraging work from home, social distancing, etc. It's also unclear if it's working:

https://abcnews.go.com/Health/wireStory/virus-deaths-rise-sw...

> For weeks, the numbers of COVID-19 cases and fatalities were proportionally similar between Sweden and Denmark, but while the economic results of the strict isolation are being felt in Denmark, Sweden’s mortality rate has reached more than 88 dead per million, compared with around 47 dead per million in Denmark.

> After a sharp spike in deaths in Sweden, Prime Minister Stefan Lofven proposed an emergency law allowing the quick closure of public venues and transportation if needed. Lofven also warned citizens to prepare for possibly up to thousands of deaths.
The domain and what they are reading off of that filesystem matters though. Like for example, if there was a credential that is in the clear/poorly encrypted and used in other parts of your system.
Against who, The Generals? Those guys are all like 5'10''
So it's okay to show someone how to make something extremely hazardous as long as you include a flimsy nonspecific disclaimer?
That's good news. Last time I looked, more than a decade ago admittedly, that bug was WONTFIX.

In fact I was so surprised I just wrote a test program. They have fixed it!

It was the dumbest bug I ever saw in Windows. It was special case code in the console output code path of the user mode part of WriteFile. It only existed to make utf8 work, and it didn't even do that.
It's great to have opinions about how things are/should be done, but the right place to express them isn't a public press conference.
The reason is that we were positioning to deal with customers who had financial data which was stored as time-series. We aren't hoping to compete with kdb+ on speed (which would be hopeless) but we have a prototype of Constraint Logic Programming [CLP(fd)] based approaches to doing time queries which is very expressive and which we hope to roll out in the main product in the near future on hub.

The graph database is still in its infancy and there are a lot of graph query languages about. We played around with using some that already exist (especially SPARQL) but decided that we wanted a number of features that were very non-standard (such as CLP(fd)).

Using JSON-LD as the definition, storage and interchange format for the query language has advantages. Since we can marshall JSON-LD into and out of the graph, it is easy to store queries in the graph. It is also very simple to write query libraries for a range of languages by just building up a JSON-LD object and sending it off.

We are firmly of the belief that datalog-style query languages which favour composibility will eventually win the query language wars - even if it is not our particular variety which does so. Composibility was not treated as centrally as it should have been in most of the graph languages.
The coronavirus is revealing our technology blunders
An official or bureaucrat, particularly one that is reactionary and secretive.

Eg. American Power and The New Mandarins. (Book)

I think it’s an important and relevant term.
> When you have to fill the reservoir every night

I accidentally found out one night that I don't need the air to be humidified. That was a revelation, and one that's saved me a lot of work since.
He did do a satirical video called "Germs and You": https://youtu.be/c8fYSW53WsM

So it's not like the subject is off-limits to him. He's just not going to go for the poor-taste, easy joke.
Yeah, it doesn't do blonde hair.
> but I have not seen a single report of American hospitals running out of ventilators

Are you really not going to just google "USA ventilator shortage"?

Also BiPaP machines require the same hack as CPAP machines. And of course a further hack for invasive intubation (which ventilators can do out of the box), though you aren't going to do that to your nightstand CPAP machine either.

Anyways, rest assured that the few people who can be bothered to jailbreak their CPAP machine are not the same kind of people who drink their koi pond cleaner. I think this kind of fear about people hacking their gadgets is misplaced.

It also reeks of what I can only register as this weird "doc knows best" subservience to the medical system. This is probably the weirdest meme I see on HN. And, as people upstream point out, nobody out there is paying attention to your insulin pump or CPAP machine settings. They just leave it on whatever default setting. It's all entirely on you to do the research to improve things for you.
>The core claim he makes "all mice are broken" is a hyperbole that a lot of people will tell you is unsubstantiated. He makes it sound like all tests done on mice are flawed because of it.

It isn't hyperbole, if Bret's claims are substantiated. The claims being that most lab mice are from the Jackson lab, that all of their mice have extremely long telomeres compared to wild mice, and that this could have serious implications on the potential harm to humans by some drugs - even while also accounting for the fact that mice are already not a good model of humans and that the same drugs are later tested on humans. (I could elaborate on this, but it's covered thoroughly in the paper and podcast.)

I agree Eric hasn't satisfactorily proved they didn't change the protocols, but if it is the case that all of their mice still have long telomeres, and if all of the other claims are true (most US researchers still using those mice + the other claims), then the claims "most mice used by US researchers are broken" and "most tests done on mice by US researchers are flawed because of it" are likely also true.

I have no idea if the above claims are true, of course, but they should be investigated on their merits.

Bret Weinstein's 2002 paper: https://www.ncbi.nlm.nih.gov/pubmed/11909679

The podcast between Eric and Bret Weinstein covering the full story: https://www.youtube.com/watch?v=JLb5hZLw44s

Not sure if you already listened to the podcast, but if you haven't, I'd recommend listening to all of it.
> I don't see this as such a terrible problem. The configurations may have more LOC's but there are not as many surprises. The dependency of declarable configuration makes it rock solid and favorable among operations teams who need to make these kinds of changes all the time.

The issue is that your static configs often have lots of boilerplate sections that have to be kept in sync. Further, you can use an imperative language like Python, JS, etc and still write in a completely declarative fashion (or you can use a functional language which tend to be declarative out of the box). Conversely, you can model an AST in YAML (which is what CloudFormation is trending toward) and get the worst of all worlds. Bottom line: don't conflate "reusability" with "imperative" or "static" with "declarative".
The idea of using a service worker to install a persistent loader is a good one, and it was used by the WebSign system:

https://www.reddit.com/r/crypto/comments/42kzx1/thoughts_on_...

Unfortunately it relied on the HPKP Suicide technique, since otherwise a compromised server could send a malicious update to the service worker code. Now that HPKP has been abandoned by browsers, WebSign is no longer viable (and it always required you to trust that the server really was throwing away its private keys).

As for the question of "why", it seems like you are asking either "Why would someone choose to write/use a webapp when they could just write/use a native app instead?" or "Why would a webapp developer/user care about the threat model of a web host being compromised?". Both of those questions have reasonable answers for at least some non-zero number of webapps.
Working fine on my Android 10 phone in both Firefox 68 and Chrome 80
CPAP machines are usually used when you're asleep, right? Since sleep apnea can sometimes be fatal, it seems like screwing up your CPAP machine could conceivably lead to your death.
Mongolian script is already on every piece of Chinese legal tender while Cyrillic is not. So it's quite the reverse.