skysight-inc/HackerNews huggingface dataset:
We have a pretty good idea how fast corona virus evolve. Yes there will be selection pressure for it to become less deadly, but this can take a long time. My proposal is how we can speed up this process.
Unfortunately very little effort is done to question and push back on the requirements that brought all that complexity and performance problems in the first place. If you can never say 'no', if there is never time to clean up, balancing performance against complexity gets harder and harder over time.
A relevant read:
https://www.coxautoinc.com/an-open-letter-to-dealers-from-da...

By Dale Pollak, Executive Vice President, Cox Automotive and Founder, vAuto

"Author’s note: We are in a crisis that challenges everyone in the automotive ecosystem. OEMs. Financial institutions. Dealers. Suppliers. We are all in uncharted waters where there are more questions than answers. In the weeks ahead, I’ll be writing and speaking about the challenges and opportunities the current crisis brings to all parts of the car business. This letter, however, focuses on the challenges and concerns franchise and independent dealers are facing as the crisis disrupts their businesses."
I'm in a similar position - to the extent of largely giving up work.

I may differ in that I'm not really determined to rediscover programming. I have many interests, don't need or want much cash and am quite happy to cobble together income from other sources. But I am curious to probe the extent and permanence of the loss. Learning something new is my approach - Clojure, for the combination of lispy paradigm challenge with practicality (it suits a couple of projects I have in mind). So far I'm enjoying it more than I expected. It's refreshing.

I don't know what the results will be in my case. But learning/discovery is so close to the heart of what attracted many of us to programming, I suggest reconnecting with it as one approach.
They probably could. Assuming that these attempts aren’t executed using a botnet with dozens of thousands of machines.
Nothing wrong in changing your career up slightly. There are many other areas in tech that would greatly benefit from your experience without full on direct coding. Solution architect, management, devops, etc, etc.
The top dog usually gets the most scrutiny. And so they should. I’d be more worried if that wasn’t the case.
How many logins/second from how many different IP addresses and browsers would you have to try in order to achieve this in a way that is hard to detect? How hard is it to rent a botnet that would mean IP-based filtering would have too large a blast radius?
Fear and beauty: two weeks living with Covid-19
Haha - yes, you're probably right. Company I contracted at a few years ago (and a big enterprise at that) still had a PC running a long unsupported version of Lotus Notes for obscure, but apparently business critical purposes, and it was becoming a huge problem for them. Fortunately not one that fell under the purview of the team I was on.
A company as large as Zoom should have this kind of monitoring over auth endpoints.
> the surface area for bugs and vulnerabilities is much larger than with the jails approach

It would be great if someone wrote an article with technical details about it. I see this repeated very often, but if you actually go looking for details... it's hard to find any justification.
They had to send the Terminator back in time to circumvent Y2K
That's not true, Italy's debit was slowly declining till 2009, the big financial crisis that originated in the US and it was mostly because of US bank and funds. after that there was a sharp increase but it then stabilised at least.

In my understanding there is only a blunt no to the coronabond, not a request fro more condition.

It was unfortunate that it started with Italy, and been the first with an outbreak like that in Europe push them to take brave decisions.

To me it feels more like that these countries don't want to help because they feel it's Italy's fault and they need to pay.

But what about all the money that was given for free to Germany to rebuild after the second war war, despite a long history of aggression?

It's not a surprise that people wants to break the EU, it's sad to see this project heading this way.
Son’s $2B Guarantee at Risk as Virus Hits SoftBank Star
Thank you! You should be good to go now.
Cred stuffing can often be done with 5 or less "known" passwords used by the victim. When the attackers have enough IPs (via proxies or cloud providers - remember that most cloud providers give out multiple ipv6 /64s no questions asked), It'll end up looking like any other login attempt from a consumer VPN where the user forgot their password and is trying 3 or 4 different ones.
https://archive.md/NjUyd
Thanks, interesting read. Not a writer with whose principles I necessarily agree with 100% but certainly reaching towards a similar view.
I've been learning it for a couple of weeks. It is humbling as an experienced dev to find something quite straightforward (parens-whining aside, Clojure is a small & simple language), yet not have a clue how to approach problem-solving with it.
It'd be cool to have the option to feed my webcam to the face of the character, and for the head to point in the direction of the mouse cursor like Minecraft.
lol +1 for audio libraries / drivers on linux. spent many hours on the "battle of configuration".
Unless you are a nuisance customer that frequently files chargebacks, there shouldn't be any drawbacks for you. The onus of responsibility lies with the merchant who must provide the processor with sufficient evidence that your claim is fraudulent or unjustified. Which, in this case, almost certainly means you will win the claim and Ticketmaster will lose the funds and be assessed a chargeback fee for the privilege.
As an example: "At the 2020 RSA Conference, Microsoft reported that in January 2020 480,000 Microsoft accounts were compromised because those customers had reused passwords that had leaked from somewhere else." [0]

[0] https://jesperjo.com/f/intro-to-multi-factor-authentication
Usually in the case of network programs you want users to have a way to control their view of the shared backend/database/whatever, which means providing things like REST APIs and hackable clients.
Not disputing that WebEx is worse, but CVE counting should never be a metric for security.
Do you compile this info manually or do you scrape Amazon? If you scrape, how do you get around the blocking restrictions?
It's common for quirky, easy-to-understand technical posts, for example that cover something familiar from an unfamiliar angle, to do well on HN.
I am not a lawyer, but I believe you can sue Amex in small claims court as well for not doing due diligence on a chargeback request.
Most NoSQL databases, for sure. I tried plenty, but will avoid naming and shaming specific ones here.
> We must have differing definitions of freedom, because I regard the GPL as a severe curtailing of options and equate it with being forced to adopt a narrow, ideological worldview. If anything, this leads to fewer freedoms on use by directly creating more obligations for the user, and if my code is to be of utility for anyone, freedom of use is paramount.

Please, if you extend my work, let me know what you change, so that I can grow as a developer, aswell as giving the benefits of your work back to my userbase. Obviously you are free to maintain your project on your own and use another licensing for different modules.
In fact I believe that these licensing models have strenghten the unix community, but this is a highly personal assumption.

Nonetheless, you are always free to choose your own licensing for your project. Related GPL work, unchanged though, just needs to be ackowledged, right? So you dont have to license your code at all and just throw it at your users - The benefits of possible improvements via GPL unused.

As a user I highly appreciate the GPL, because it promises (not forcing anyone, free licensing, right?) me to inspect the source code shipped with a binary (if any).

To support the minority (original author) against the majority (everyone else) there are implications to them, but desribing it as a narrow ideological worldview forced upon the userbase sounds unreasonably harsh
People have been saying this since before Startup News was renamed to Hacker News in 2007: https://news.ycombinator.com/item?id=13852

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

More here: https://news.ycombinator.com/item?id=21755721
Yes, that is my thinking also.
Dungeon Crawl Stone Soup, better known as DCSS. https://crawl.develz.org/

The premise is simple: Dive into the dungeon, retrieve the famed Orb Of Zot, and abscond with it in your possession. Easy, yes?

What sold me were the vi-style controls, the ability to play directly from a terminal (or a prettier web GUI if you so choose), and how every action is on a turn-by-turn basis. You get to pause/stop at any time, and your progress remains for years.

It can be a little daunting to get into it, but it is a lot of fun!
I'm very critical of how zoom handles security issues, but I agree this is mostly a non-story.

The fixes zoom could implement seem limited to IP address rate limiting and checking passwords against haveibeenpwned (or similar).
Covid-19 and Screen Time
It helps to do things you love, even if it’s not programming.

A little trial and error aids in discovery.

Initially you won’t know what it is you want to do but you’ll have some sort of curiosity about a project.

You can follow the trail and see where it leads.

Most trails are only five centimeters long. But don’t be discouraged.

When one thread disappears, another often takes its place.

Do this for long enough, protect that sacred time, and you’ll discover some passion.

I don’t doubt programming will find a way to re-emerge again in your life some day (in a pleasant, not tedious way). It encompasses so many fields.

You’ll sort of know when you’re on the right track, because what you love will be oddly peculiar and unlike many other people’s interests. You’ll have trouble explaining why you like doing it (as if it needed justification).

True interests (when properly followed) always looks a little crazy to outsiders.
I think you're confusing the risk of buying an asset with the day to day reality of operating in.

In the current environment, asset value decreases and certain costs (prices charged) have decreased as the supply chain adapts to try to maintain break even volume.

Maybe it's different across the board.
SSO is offered at the "Business" plan level. So I guess the question would be how many of the stolen accounts were for users at a lower plan level but were also controlled by espionage-worthy companies.
You don't have to build the executable yourself. You can just apt-get install whatever and then bundle only the shared libraries used by whatever particular executable you care about (for instance, moreutils includes a ton of tools, maybe you only care about `vidir`, and `vidir` probably doesn't need all the libraries that `isutf8` (also packaged by moreutils) uses).

I did this just recently by hand when I wanted to run a source-only binary in my dom0 but didn't want to build it in the dom0. I built it in a container, checked what shared libraries it wanted with `ldd path/to/binary` inside the container, copied all of the referenced libraries to ~/libs, then copied that dir and the binary to dom0 and ran it with `LD_LIBARARY_PATH=$HOME/libs path/to/binary`, worked perfectly.
Just wondering, is this article out of date?

https://www.koin.com/oregon-2/oregon-loosens-self-service-re...

Have they further loosened it since late March?

"Effective immediately, gas stations will be allowed to let drivers pump their own gas if they meet any of the following requirements:

The owner (of the gas station) retains documentation that there are no employees available to work as an attendant, including documentation for absences and employee hiring and retention efforts;
The owner is subject to State Fire Marshal audit and has posted safety signs for how to safely operate a fuel pump; and
The hours of operation under this subsection do not exceed 10 consecutive hours.
“During this unprecedented time of state emergency, we need to ensure that critical supply lines for fuels and other basic services remain uninterrupted,” said State Fire Marshal Jim Walker.

Additionally, active stations must abide by the Fire Marshal’s latest guidelines:

Prepare, implement and enforce social distancing policies consistent with guidance from the Oregon Health Authority,
Require an attendant to be on duty to supervise self-service refueling consistent with the social distancing policies and help mitigate the spread of COVID-19 through sanitization measures, and
Designate an employee at each station to implement and enforce the social distancing policies."

The above doesn't seem like it's actually self-service unless the owner has certain issues. My brother just told me he isn't seeing self-service at his area, and wasn't notified it was an option.
Did you guys try paid YouTube ads? Or simply behind the scenes sponsored content marketing?
You could do secure anonymous DNA testing. Just submit your encrypted genome and their FHE algorithm, presto chango, computes the answer to your sensitive queries without them knowing the result.
This is the reason I can't stand zig: its so aggressively opinionated about something that doesn't matter at all.
Having let go of my car years ago and having never missed it, I feel that car ownership is still not cheap enough to make sense, and we can do better.

I realize that if you live out in the countryside or in the suburbs, the car is your lifeline. But for city folk cars are a luxury. You can walk everywhere you need, you can use Instacart and Amazon to handle groceries and shopping, and, if you're lucky, you can work on distributed teams. You never need to get behind the wheel, and even then you're better off getting a Lyft.

$250/mo for a parking spot where random people can still scratch up, dent or break into your car. $100-200 for insurance, $x for gas, $300+ for financing or leasing a car, $y for repairs and maintenance, $z for tickets and parking meters.. This stuff adds up. If you only need the car occasionally, let's say a couple of times a month on the weekends, then this system is horribly inefficient.

Of course you end up paying more for living close to work in say.. downtown Seattle, NYC, SF, LA etc... but the tradeoff is to move to the burbs, shave off $1000 from your rent, and instead spend that same amount on your car, in addition to now having to sit in traffic jams for an hour or two every day? No, thanks.

I'm hoping networks of press-a-button-on-phone-receive-car systems like Zipcar keep expanding. Seems like their growth has been sub-linear at best this last few years.
Virtually Real Estate
It exists for software that considers itself a platform in the form plugins, themes and such. And it’s very different, much harder, software play for support and reputation management.
> I'm a consumer who consumes a basic set of supplements (vitamin d, vitamin k2, magnesium, multivitamin) and I'm very happy with how things are now.

Fundamentally, no you aren't. What you are is a consumer who thinks they consume a basic set of supplements naively without oversight. Without a regulatory body verifying the safety and efficacy of the products, you actually have no idea that they contain what they claim and that they aren't tainted by e.g. lead or arsenic.
The context is companies with 30+ engineers. At that point you're going to want some form of formal project methodology that allows everyone to co-exist somewhat peacefully. Generally, the results otherwise are varying level of dysfunctional.
That's a good idea. There's already a `--glob` option, which allows selecting what to include with globs. It's the inverse of `.gitignore`, so `--glob foo` includes foo, and `--glob !foo` ignores foo.

I think that the glob library I'm using implements the same syntax as `.gitignore`, so it would be easy to add an `--ignore-file PATH` option.

I opened an issue to track this:
https://github.com/casey/intermodal/issues/378
German SARS-CoV-2 sequences
I like them a lot, they're a small local ISP that does fiber to the home. I just wish they supported IPv6.
This goes straight to one of the biggest holes in the web platform: there is no mechanism for code signing or release tracking.

The web already has the world's most widely used public key infrastructure. When I go to amazon.com, I can be confident that my browser is talking to a service operated by Amazon, with nobody spying on or modifying messages in flight.

However, I have zero guarantees regarding the HTML/CSS/JS that service returns. It can return code modified for me specifically, different from what any other user of that app is running. For traditional server side rendered web apps, this is normal and expected. SPAs often return identical app resources for every user, and all user specific data is later transmitted via API calls... but nothing in the web enforces this.

For decentralized or end-to-end encrypted apps, this is very bad. Most Ethereum apps today, for example, are used primarily via Metamask browser extension. Nothing stops an operator of such an app from just serving a different, malicious version to one specific user, based eg on IP. Such a compromise would be very hard to prove.

Similarly, Jitsi might like to give users confidence that they are running the same code as everyone else, and that the code is logged, versioned, and open to security analysis.

In principle, an approach similar to Certificate Transparency could provide this kind of assurance.

For this to really work well, they would also have to practice good dependency hygiene and ship unminified bundles.

--

This is an important web primitive that's currently missing. Do any browsers have a solution somewhere in the pipeline?
89 libraries is a lot. Even the most complex project I work on has just 20. The list you gave seems somewhat reasonable, but I'm willing to bet that the long tail of stuff you didn't mention includes a lot of more trivial dependencies. I don't know your project, but I imagine that you ought to redefine your scope to avoid introducing a need on complex dependencies. Simpler software is more robust, more maintainable, and often gets the job done better - but it's more difficult to make.

In any case, I'm mainly criticisng the typical JavaScript, Ruby, etc project, with their giant pile of node_modules or whatever the case may be. It can easily get out of hand with other projects, too, especially in languages which encourage over-engineering and over-abstracting like Rust or C++ (let me guess: yours is the latter?).
@jcranmer absolutely agree. This is maddening, and unfortunately we all can't do much except sit at home and watch this train wreck. Can't protest, complaints are seen as partisan attacks, and trying to volunteer locally to help out with something that involves leaving the house is seen as either incredibly risky or frowned upon by the mask police. It's driving me nuts.
Ask HN: What are you reading to make sense of the economy?
With so much happening so suddenly, what are you reading to make sense of the Economy and markets.
I think our internet behavior and metrics makes certain topics trendy for outlets. Most news outlets metric the crap out of their stories (journalists performance is often judged at least partially by clicks) and if pieces on Zoom get lots of clicks, they’re gonna keep writing them.

I think this is the most likely reason with their explosion in usage due to COVID. Anecdotally, around 25-30% of news articles shared in my company Slack channels recently have been about Zoom. We saw the exact same phenomenon during the 2016 election.
A Replacement for Database/SQL
The Triumphs and Failures of “Superman” in TV and Film
That's autocrypt. It is awesome and should be default on all email clients. As part of the autocrypt standard MITM is not detectable as that would just provide users with information they could do nothing about. Autocrypt is fine just as long as the users are made to understand that the privacy protection is a lot less than the protection they would get from a PGP key they actually got from someone directly. No UX in the world can overcome that incontrovertible fact.
20 years is a long time in anything. My first piece of advice is that nobody here knows who you are, nobody here knew you as a teenager, and nobody is going to understand what "love programming" and "don't enjoy it" actually means for you. The point is: anybody who claims that they got de-burned-out with this one trick isn't necessarily dishonest or naive, and if something in the comments here resonates, then by all means try it out. But they might be offering a good prescription for the wrong diagnosis.

This may sound dismissive or condescending and I promise it isn't my intent: have you considered speaking with an actual therapist? As a society we tend to think of therapists as something you do when you're mentally ill, but you don't just go to the dentist when you suspect you have a cavity: mental hygiene is important, and humans are universally bad at self-diagnosis, either physiological or otherwise.

In my current job I write Python, which I really don't like very much and I get burned out on Python-specific things. But I know my feelings of burnout are due to things that would be true regardless of the technical environment - and that an overall job with Python is far preferable to my previously miserable job with F#. And there's a lot of non-job stuff going on - such as the historic pandemic, and domestic stresses from being cooped up at home.

So speaking with a therapist about what's actually eating you might be quite worthwhile. If it is just burnout with programming, there really are specialists out there who might give well-informed, non-anecdotal advice. If it's something else, then having a professional suss it out means you can make better decisions about major aspects of your life. Plus, therapy is something that's easy to do over videochat. I am not recommending therapy, but I do think you should consider it.
Service providers have an obligation to mitigate credential stuffing. Zoom failed to do so.

They should use MFA but at the very least they should prohibit the use of leaked passwords.
How associative fear memory is formed in the brain – EurekAlert Science News
Shout out to visit(1) for lots of renames
Apollo 13
I still think even with viable FHE, my personal information should not be shared with a 3rd party, it should be treated as if it was still plain text. I say this because like any crypto work,being vaible isn't enough it needs rigorous testing over time and lots of peer review.

Even for FHE adoption, it would be horrible if a lot if trust went into it and one popular method or implementation messed it up, ruining its reputation.
I just traded a 2006 miata for a 2005 Ford Ranger. It feels like truck times.
You can authenticate with Zoom using your existing SSO solution, not the other way around. When using SSO the Zoom account wouldn't have a password at all.
It is not working a all. I cannot verify a single one of my devices. With cross-signing enabled. It used to work just fine, and then one day there was a Riot update that broke everything. The issue seems to be known to you, though. Please see also my comment on the already open issue at https://github.com/vector-im/riot-web/issues/12959#issuecomm...
How We've Adapted to a 588% Increase for E-Commerce
I do a lot of Facebook and most of my clients target CAC earnback in 7-9 months. I once was able to do arbitrage for my product and made a non-infinitely scalable positive ROI within one week with targeted Facebook ads but it was 2012. Not nowadays, the CPGs finally jumped in and the CPMs/CPCs are too competitive.

I think now the move is to go after territories that the major brands/agencies are afraid of. Tik Tok? I don't know, but I would trust doing DIY and examining the real numbers, I used to sell agency services, I'd say anything to win business. And 30% of the time we actually overdelivered on my absurd promises.