skysight-inc/HackerNews huggingface dataset:
Ask HN: Software Engineering Timeline/Estimates
What's the general consensus among engineers in HN about estimating for your stories as an individual contributor when your Project Manager asks for an ETA?

Do you think estimates for software tasks are worth doing at all considering complexities you need to account for? How do you budget uncertainties?

How do you handle cases where the timeline gets exceeded?

Are there any tools (Gantt/Timeline) tools out there that you'd recommend for this?
Does anyone know why judges are so deferential to the US security apparatus? It seems in general like they have a clear bias toward "taking the security system at its word", even when common sense would dictate otherwise in any particular case. It's sincerely puzzling to me why national security entities seem to get treated so differently and I wonder if there's some legal precedent or consideration I'm not aware of.

Like in this case, I fail to understand how releasing the number of requests would have any security bearing.
If you are building a B2B VC backed startup. There are many who simply run bootstrapped business making 5 figures a month. See https://www.indiehackers.com/products
Ask HN: How to get into offensive security?
I understand web application security, that means I know what the OWASP top 10 are and I know how they work. Given a 0-day I could write a script for it. I understand what people are talking about when I listen to a defcon talk or security podcast. I know what a buffer over flow is. I also understand the basics of cryptography and can write/read assembly if I absolutely have to. I know how to read/write iptable rules. I have taken part in CTFs.

1. How does one start doing bug bounties?

2. How does one start finding 0-days?

Are there any online courses that are good at teaching the above?

I don't want to find 0-days because of malicious reasons. I want to learn how to find them as articles about them seem clever. I like the exploratory nature of it.
I hope they appeal.
"No one who does this thinks it's efficient"

Erm ... clearly you have not met true believers of the movement ..
If you are looking for a single-source GPGPU framework, you should look for SyCL, not Vulkan or OpenCL.
It's worse than "silly", it's "Oriental".
Would love to see more detail as well because I'm a bit skeptical. From uWSGI documentation, it looks like to coordinate cron across anything more than a single server setup, you'd need to configure a Legion, which means you're then integrating uWSGI's orchestration framework with whatever you're already using (k8, ECS, etc).

I like minimalism, but sometimes batteries are included for a reason.
Wikipedia has a great diagram showing the process of hard disk drive manufacturer consolidation that tells a lot: https://en.wikipedia.org/wiki/File:Diagram_of_Hard_Disk_Driv...

Now it's a perfect oligopoly: Seagate, WD, and Toshiba, just like the stories from many other industries.
Except for people bored out of their minds, wanting to get away from their kids or spouse for an hour, etc.
Also, there is an altruistic motivation - it feels like you are doing SOMETHING to help by being in this study.
>Does it even matter if Math is invented or discovered?

I figure reality is part of math so if it was purely invented we wouldn't exist.
Thanks, once again, lots to learn from other industries "issues" :)
I wonder what the stress would be like if you were running a bootstrapped, profitable business instead of betting everything on one big break, as in VC backed companies. I follow IndieHackers (https://indiehackers.com) and people seem to be pretty chill on there, just treating it as more like a small business making 5 figures a month instead of trying to build unicorns.
> Why are pins counter-intuitively numbered in a rotating fashion rather than by columns as one would expect for a rectangular package?

I am not sure why this is counter intuitive, on a 8 pin package, it makes sense to keep pin 5 close to pin 4 to simplify the layout of the wires, and in general, it makes sense to keep consecutive pins close to one another.
This applies to vacuum tubes as well.
I didn't know you could forcefully end a generator from outside. IMHO generators are overkill 99% of the times. This is one of the biggest issues I had with the PREVIOUS Koa.js' documentation[1] and why I decided to launch Server.js with plain async instead of trying Koa. I had been doing JS for ~6 years by then and I could not tell how the simple "hello world" worked.

[1] https://koajs.com/

[2] https://serverjs.io/
I wish there is a Twitter employee like Edward Snowden or Bradley Manning to leak those surveillance requests. Leaking documents seems to be the only way forward in the U.S.
I was at a talk about mainframe security recently where the state of play with one company was, there were three users in their admins group for the mainframe, two had retired, and the third was past retirement age...

When you combine retirements with decades of under-documented code doing critical functions, it's not a recipe for good long term success...
That's very thoughtful of you. One of the things I find frustrating is that politicians will say, "being a mom is the most important job in the world." But we know that it actually isn't valued as such, otherwise we would have stay-at-home moms (and dads) as part of the political decision-making process, and we would have policies that support families like affordable healthcare so that the health of an entire family isn't dependent on the go-to-work person not being subject to lay-off or benefits change.
Trying to pass SMR as PMR is kind of pointless since HDD becomes more and more pro and enterprise territory and consumer are shifting away to SSD.

Their customers are increasingly likely to be the kind of people who care about this kind of thing.
Whenever I hear/read lots of words about how secure something is and how strong their commitment to security I think “they don’t know what they don’t know”.
Could Twitter set up a warrant canary for every user? Append "/canary" to URLs and make it 404 if the data has been compromised.
Charvaka: An ancient school of Indian materialism
Online resources on applying Deming's ideas https://blog.deming.org/online-deming-resources/
Surely the servers enforce the Vanguard requirement
> I have a strong suspicion that if we could run the counterfactual, 29% would be right on the money.

Conditioned on what?
How would you model that? Go back and change the weather? Redo polls?
That is a lot more effort than re-building the game, isn't it?

At that point, just make your own game, or easier yet, play another one.
Transactionality is enough for most systems. Your order either succeeds or fails, it never stays in an incomplete state. Queues are not a panacea, and introduce their own problems like obscuring problems by delaying them long enough to bring everything to a halt.
The inherent issue with anti cheats as compared to anti-virus software is user intention.

A user who installs a anti virus program wants that program to do its job and find bad actors. The virus on the other hand is completely unwanted by both the user and the software- Its existence is threatened by all fronts.

However, a anti-cheat lives in a extremely adversarial environment. The cheater (and the cheat) wants the cheat on its computer. As such, the user will be willing to do extra steps to assist the cheat. This makes the anti-cheat software in this case, the 'un-wanted' virus, so it has to exist in the most hostile of environments and somehow detect programs which have higher privileges than itself.

That said, Cheating is something that will not go away. Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform. It involved a second computer, which man-in-the-middled all network data to the client computer. This second computer then would display a 'radar' of where enemies were. As the anti cheat would have no possible way of knowing the existence of this second computer, there was not much they could do.

If you wanted to get more aggressive with the system above, you could have that second computer modify outbound requests as well. So if you shoot your gun and it would have hit the ground, it will now instead shoot a enemy in the head- as such even something like a aimbot is entirely possible with this setup.

However, there is indeed a anti cheat which can detect all known cheats and its basically what Valve did/does for CS:GO - Allow users to report suspected cheaters and then have the community analyze the reports. This catches all blatant cheats, but unfortunately will never get rid of radar/esp cheaters, only aimbots and the like.

Honestly, it sounds to me like there is a business model in the above. Years ago we had companies like evenbalance/punkbuster, easy anticheat, etc.. which provided software based anti-cheat systems. As you would expect, most would by bypassed and a daily cat and mouse game would ensue. The solution imo is to create a SaaS where you essentially provide a reporting + monitoring tool. Users of your game can report suspected cheaters (which includes the demo file / vod / replay / whatever) and your trained wet-ware staff would review all reports and take action where necessary. No invasive software necessary. Actually, no software on the end users computer at all would be necessary- It is all done on another users PC.

In fact, if someone is interested in doing the above, hit me up. Sounds like a easy win.
1957–58 Influenza Pandemic
There's plenty of nerves running around the face and due to the amount of bone, probably necessarily close to the surface. Are there occasions when these get severed leaving the recipient less able to control their facial or jaw muscles?
Math models are real things, hence reality also.
None of the popular distributions use GANs, except that GANs have been used in experimental (later abandoned) modules. Unfortunately the Deepfake/GAN fallacy has been stuck in the Wikipedia entry for years.
This is a lovely 30-minute read on the history of the C programming language, written by Dennis Ritchie (dmr), one of its authors.

https://www.bell-labs.com/usr/dmr/www/chist.html

Here's a comment I wrote about it elsewhere:

https://lobste.rs/s/hba9nn/development_c_language_1993#c_hw6...

One other essay that comes to mind is the 1945 piece by Vannevar Bush, "As We May Think", that lays out the vision for a "Memex", or memory extension device, in the direction of what PCs and smartphones eventually became.

https://www.theatlantic.com/magazine/archive/1945/07/as-we-m...

I think it's nice to reflect on a time, not too long ago, where these devices were a mere figment of a scientist's imagination, only to materialize decades in the future. What can you dream up today?
Actually, the whole point of choosing the cooperative form is to avoid doubt and risk in governance. We don’t have to make the choices you’re positing, because our rights are actually enshrined in law. Cooperatives are one of the oldest forms of collective enterprise, and there’s four hundred years of law governing them. The rights of cooperative members (every .ORG registrant, in the case of CCOR) are much more strongly guaranteed by law than are those of, for instance, shareholders of a corporation.

Every member of a cooperative gets an equal vote in all governance decisions, and it’s not possible for the board to change that, that’s guaranteed by law, not contract or charter or agreement or anything. It’s also not possible to create membership “classes” with different rights. Also, the rights of capital are subordinate. Creditors, for instance, get no say in what happens.

That’s governance. Finances are equally clearly defined, but instead of one-vote-per-member, they’re proportional. If the wholesale price of a .ORG domain remains $9.93/year, and the savings (which are the “profits” in a corporation like ISOC) are $4, those savings are guaranteed by law to be distributed back to the members proportionally with the amount of business they did. Someone with one .ORG domain will get $4 back at the end of the year, someone with ten .ORG domains will get back $40, et cetera.

We don’t have to debate these terms, because they’ve been inalienably guaranteed by law for the past four hundred years.

Which is why we picked a cooperative as the best form for self-representation.
You can stop using Twitter, you can't stop using your government.
BBC's The Computer Literacy Project is a great resource

https://clp.bbcrewind.co.uk/
It’s ok to be wrong though.
Nonetheless it looks very appealing. I’m not sure exactly why, other than I fence and like beer.
what to look for:
https://raw.githubusercontent.com/neomjs/pages/master/resour...

=> a massive worker ping pong game

the performance feels extremely good, especially zooming in and out deeply (e.g. use the country selector dropdown multiple times while being zoomed in deeply somewhere.

using chrome 80 you can see the code like in the screenshot (no builds):
https://neomjs.github.io/pages/node_modules/neo.mjs/apps/cov...
In many cases (e.g. banks) these systems have been running for decades, they're often badly documented and have had a lot of fixes applied for issues that arise.

Re-writing that, is going to be a nightmare, as you've got no spec. to work from and mistakes may not show up immediately (think monthly or annual payment processes)

It's a very high risk endevour with little immediate reward for the team doing it. If it goes perfectly, no-one notices, if it goes badly it could seriously impact your whole company.
> unless you're running a dedicated PC for gaming

That's the approach I've been taking for a long time now.

If you don't, you will always a) have your fun ruined by trying to be security conscious b) in the end, most likely give in and allow things you really shouldn't allow on a trusted machine because otherwise you can't achieve your task (getting a game to run).

So I have a game box, try to make sure that nothing important ever touches it (which is a huge PITA when game clients insist on forcing email-based 2FA on you), but in exchange I don't worry too much about its security.

That also fits nicely with games requiring Windows 10 and Windows 10 being so outright privacy- and user-hostile that I can't imagine running it on my primary machine.
Or better yet, code 451!
I think this is wrong. Pins really pads that are numbered on the die. The die is square (or was back then). Pads are numbered in sequence around the pad ring. So the concept of columns doesn't exist in the context of the die. As to why number counterclockwise vs clockwise, possibly that's to do with existing convention from valves. However note that in the beginning dual inline packaging wasn't the norm. There were flip chip packages, die on board, circular TO-xx metal can packages etc. So whatever led to the counterclockwise numbering convention certainly predated DIL packages.
I love the way they basically say they are gonna do their own assessment and won’t roll in behind the consensus on RPKI. Like the trend-setting industry leaders they are.

They deserve to be called out for this. It’s not hard to implement RPKI. Only valid excuse is if your routers don’t support it.

Signing ROAs is trivially easy in the RIPE region. Why haven’t they done so before the pandemic???

Wasting time with this response instead isn’t maybe the best use of their time.
> I've seen journalists say "We can't talk about all the 10% catastrophes, we'd look alarmist!"

Alarmism is the bread and butter of journalism. Media consensus was that electing Trump was supposed have led to invading Poland and gassing minorities by now.
I used to know what a cubit was
Since when? Governments have a history of greed, corruption, and trampling on the rights of it's people for it's own gain.
Ref: any history book on any country, ever
No wonder they wanted to replace Dorsey
A Drugstore's Website in Japan
I still use and greatly prefer gevent to this day. They are indeed quite similar to goroutines. Asyncio is a different model, and more irritating for me to work with. (I'm sure this isn't the case for everyone. I'm just more productive with gevent, personally.)

Performance is pretty close for both. I was disappointed to not see Python get an official green thread implementation. The counter-argument I commonly see cited is https://glyph.twistedmatrix.com/2014/02/unyielding.html. I personally don't find it to be a very convincing argument.
Likely conjoined. The same factors allowing the film to be aired/released are likely to have caused the market drop.

Only certain times when availability opens up for non A+++++ films.
I see. Just a c-style loop absent conditions. I find it kind of ugly for some reason.
"First, a bunch of generic smart people on Twitter who got things exactly right"

I think it is far too early to declare anyone "exactly right". We won't know for months, maybe years; maybe we will never know because it will be impossible to disentangle the effects of the virus and the response. The more fundamental problem, in my view, is tunnel-vision on the epidemiological models. The epidemiological models represent, or should represent, input into a higher-level model that we might call the covid overall impact model. Such a model would take into account second and third order effects, it would include not just the virus but also the effects produced by the response. It would factor in economic, political, psychological, non-covid health, and broad societal effects. This is the model and perspective that really matters.
No evidence that people who have survived coronavirus have immunity
"But in a lot of cases it is a bit of a pyramid scheme / agile consultancy feel going on."

Definitely, Sepp Holzer is sadly a prominent example of this as well. There was a case of a new project, where a naive women, a true believer of permaculture, invested all her money in a permaculture school project under the guidance of Holzer, where all the ordinary farmers could learn how much more efficient permaculture is. And it failed spectacular and ended in court. [german wikipedia for more, english version is very small]
When the government pays your salary and controls your workload and picks whether you get promoted...
There's no 5G there, so I guess nothing.
>On the SSD side we have DRAMless and TLC.

Are you sure you're not talking about QLC? Current TLC drives can be pretty decent in terms of write speed and endurance.
social distancing may skew everything towards kiosks.
>Twitter has argued it free speech rights are violated

That's rich coming from a company famous for censorship.
Which is prudent, but let's be clear: it doesn't make it right for them to do so.
Carrier?
Moreover, specifically I’m running 19.04 and I click anywhere on the screen to open the password. Maybe they changed it over time.
I skimmed, but it seems none of this addressed why the service (edit) runs at boot-time? Also, expecting a service to not not look at your data if they have access is not security.

If Valve can mitigate hacking in CSGO without such an intrusive service, I am sure Riot can. I, myself, did a very, very, very poor job with an autoencoder to detect anomalous matches in Dota and caught a large amount of players abusing the system. As far as I know, CSGO anti cheat does involve an ML component.

My point is that a non-intrusive anti cheat, advanced analytics, and tracking of user feedback goes a long way.

Ofc, none of this matters. If the playerbase actually cared, they'd boycott or stay away. And I cannot remember the last time gamers ran a successful boycott campaign.

edit: Also read that uninstalling the game will not always uninstall the ring 0 anti cheat. I can't verify since I would never install this on my system, but for what it is worth: That is terrible IF true.
> Years and years ago, I developed with a friend of mine a completely undetectable cheat for all games on the HL2 platform.

> It involved a second computer, which man-in-the-middled all network data to the client computer.

Out of interest, was there no transport level encryption to deal with here? Or did you need to do something special to capture keys on the client?
If you're like me, finding vulnerabilities is like solving a puzzle. There's a certain satisfaction but you learn something at the same time. There was a great session at the All-Day-DevOps conference yesterday called "The 5Ws of CTF" that espouses learning computer/software exploits through playing "Capture-the-Flag" (https://www.alldaydevops.com/addo-speakers/ell-marquez). I thought the session was recorded on YouTube but couldn't find it. I did find an earlier version of the same talk at https://www.youtube.com/watch?v=WGiCO2u8JCg.
Office Chair Buy it now
How do you backup your motionless piles of sand, then? /joke

Perhaps all the data you care is on the cloud, but HDDs are still important for backups. Although it's the most acceptable scenario to use an inferior SMR disk. The real issue of SMR is RAID/servers, which, of course, is what the cloud is made of...
You could create a corporation with the rules (and problems) that you’re proposing, but in a cooperative the rules are fixed: one vote per organization. Your family .ORG domain gets the same one vote as Microsoft.ORG, as your kids’ soccer league, as the church down the street, regardless of how many domains they register.

Obviously a bad actor could try to game the system by pretending to be multiple organizations, but it wouldn’t buy them anything, because board members don’t have any rights that non-board-members don’t have, and the rights of the members to their financial interests are also guaranteed under law... the bird couldn’t, for instance, vote to pay themselves.
What's missing in asyncio when compared to gevent ?

The coroutine and queue model is the same right ?

Cool thing in 3.8:

Running python -m asyncio launches a natively async REPL.
Judges are nominated by the president, and approved by the senate. If the people that nominate the judges are controlled hook line and sinker by the security apparatus, there's no reason to believe judges would operate any differently. They know where there bread is buttered
It would be interesting to see how far you could get using deepfakes as a method for video call compression.

Train a model locally ahead of time and upload it to a server, then whenever you have a call scheduled the model is downloaded in advance by the other participants.

Now, instead of having to send video data, you only have to send a representation of the facial movements so that the recipients can render it on their end. When the tech is a little further along, it should be possible to get good quality video using only a fraction of the bandwidth.
While RPKI is great, saying BGP will be “secure” once it’s deployed is not true.

It’ll be more secure, sure. But RPKI only addresses origin validation, not path validation. It won’t stop me announcing your space spuriously provided it has your AS as the origin. Path-validation a la BGPSEC would be needed to stop that. But that’s an extremely difficult problem to solve given the amount of churn in the global routing table. The amount of crypto validation routers would need to do is prohibitive. And Moore’s law doesn’t help because as CPU power goes up so do the key sizes we need to use.

Either way people should implement RPKI, or at least sign ROAs for their space. It’s easy to do and makes a bit improvement.
But couldn't they force Twitter to keep updating the canary as part of the gag order?
Ike Mann – The Talent Manager Every Artist Wants in Their Corner
The future of anti-cheat is machine learning specific to the game. CS:GO already does this, where it used the Overwatch community review program to train it, and it can now automatically ban some cheaters.

I don't think it's a viable model because players are willing to do it for free, as CS:GO's Overwatch shows.