skysight-inc/HackerNews huggingface dataset:
> You may not be aware of how many banks/airlines/ticket websites have outsourced their fraud fighting to solutions like Shape Security, or Sift (Science). Web-wide tracking via cookies is a reasonable and widespread technique for fighting fraud.

I view that as a different situation. If a bank/airline/ticketer outsources fraud to a third party, there's presumably an informed exchange of "we'll let you run JS on every page on our website and suck up whatever information you want if you help us detect fraud."

In the case of Stripe, I don't believe they're clear with client applications that they're collecting information from every page of an app. I think most developers integrate with Stripe so they can accept payment on one or two pages and probably don't expect Stripe to be collecting the level of data they're reporting back to Stripe servers.
> A solution that works for experienced cyclists to to end the bike lane some distance before the intersection. This forces a merge in a zone where there's no risk of a right hook.

Unless the road has sufficient room for a bike lane of a minimum width of 5 feet, then you end up with a lot of close passes from cars in the right lane and also end up riding in the door zone of parked cars to your right.

In those cases, it makes more sense to just ride in the center of the right-most lane available for traffic and get more room from cars passing you. This would work for streets that have multiple lanes for same direction traffic.

> Major arteries in the suburbs or around malls are a nightmare for riding because traffic generally flows a lot faster. Some of the most hair-raising riding I've done was near a mall while bike touring. It was basically unavoidable, and also absolutely miserable.

It really depends on how much traffic is present. I've ridden on roads in the center of the right lane with speed limits ranging from 35 to 45 mph without much of an issue. Drivers almost always change lanes to pass me or slow down behind me before passing.
If you get clarity on liquidation, please consider open sourcing it à la YC's startup documents. It's something I've long wanted to include in my projects.
Interesting; is this in Auckland or Wellington? What sort of companies are opening up?
Apple Supplier Factories Reducing Staff Due to Falling Demand
Me for one. I find it hard to sit down and watch TV for more than an hour at a time.

I have a foot injury right now and the mental adjustment to sitting more instead of being up and around is...significant.
I apologize that anything about the pricing change felt sneaky. (We tried to do the opposite: we emailed every single impacted customer!) I posted a few thoughts about the refund change here: https://news.ycombinator.com/item?id=22893388.

We're not transparent about enterprise pricing since our costs on any given user are so country/business model/implementation-dependent. It's less that our sales team isn't willing to share the details and more that the models themselves are very complicated and change frequently. (Visa and Mastercard are both making big changes to their pricing this year, for example, and that will change almost all of them.)
I've done far too much research into this lately, but I believe that Wallstreet was officially supported by OS X (although only up to 10.2).

The PowerBook G3 Kanga, however, cannot without some hacking; it's a frankenstein model which was only available for about four months. It shoehorned a super fast (at the time) 250mhz G3 CPU into the old 3400c form factor and looks like it's from another era in comparison to the sleek Wallstreet.
It took me dozens of attempts. Find three days. Use the next long weekend. No excuses. Cold turkey on Friday afternoon, drink yourself to sleep, self-isolate until Monday afternoon, incorporate endurance exercise (long distance cycling is very good) if at all possible. Try not to schedule critical family/business meetings on Tuesday/Wednesday. Exercise Tuesday/Wednesday.

If you are a positive reinforcement type of person, keep a "money and time I didn't spend on cigarettes" and "days of life saved to spend with my kids" counter as a reinforcement every time you log in.
What do you do when making a right turn when there's a bus only lane to your right?
Also beware of CWE-117
We don't accept inbound applications from outside the company anymore. We do have a talent community https://boards.greenhouse.io/gitlab/jobs/4700367002?gh_src=d...

Thanks for planning to contribute to GitLab. When your submission passed review consider messaging the reviewer and mention you're interested in working here. We do still accept references from team members.

There is no need for a LinkedIn profile.

If you're currently in your first job a reference can be a peer you trust there, a former teacher, or a manager from a side-job or hobby. OSS maintainers work work as well.
While I trust him, how can we be sure that paymentiframe.com starts serving an iframe that steals the credit cards in the future?
Not sure why this got downvoted? Anyone to comment? I use C++ daily on my job, and I'm very happy with its developments - especially C++11, C++14, C++17 and what's coming in C++20 - but statically linking problems are real, and pain to solve (long term). We do mostly MSVC, where some teams are still in VS2017, others VS2019 - and while they are compatible - the compatibility works only if your final app is compiled with the latest compiler from each version, which puts our team (doing mostly libraries, and providing precompiled ones) that we should use the lowest version, but then our CI infrastructure might use even earlier.

With "C" there is less to care there, as most is set in stone (unless you use some really compiler vendor specific extensions, that appear during link time).

Just an example - https://devblogs.microsoft.com/cppblog/making-cpp-exception-... - this is great improvement, but also means that if you've compiled your lib with VS2019, and it throws an exception under application that uses VS017 - it'll not work.
Can you force Chrome on Android to render this simplified? It's illegible otherwise.
Email is a compromise to the readers. It works out more or less. There is no good answer but if you understand it exists you can work with it. Sometimes that means you have to work hard in a medium you don't like, other times you can suggest yours is better and win.
> My "solution" to this problem is to carefully but fully occupy the bike lane before making such a turn. Yeah, it's illegal, and draws lots of swearing (and worse) from bicyclists. But there's just no other good way to keep everyone safe.

Which state/country are you in? This is actually required in California, and I'm always annoyed at the majority of drivers who simply DO NOT come and occupy the bike lane intentionally, making it confusing for me (as a bicyclist) whether they are going to wait for me or not. (coupled with how a lot of drivers just don't use turn signals accurately).
"Usual behavior" should not be "usual" in such an extraordinary situation as a deadly pandemic. Your premise is flawed.
Which engineer would shut down an open protocol to fight a competitor instead of offering the better product

Probably any engineer that wanted to implement cross device message syncing or end to end encryption without dealing with the politics of 1000s of other companies.

Not saying what Google did, but I'm tired of hearing about this XMPP (and/or IRC) pancea when both had non-trivial UX issues.
Look for Elon Musk to Unveil a New Battery That Will Shake the EV Market
It was treated as an unrestricted file access vulnerability. I don’t want to accidentally disclose any non-public information (as an employee of Google) so I’ll just say I suspect there wasn’t really a ton more to see other than status and debug pages. Not to downplay the value of such a vulnerability, just saying that with defense-in-depth risks like this should be relatively well contained. It sounds like they got access to some confidential operational information but were nowhere near user data, and there was no obvious path to get there without much worse vulnerabilities.
> within Google are looking at their “rivals” for inspiration, rather than the fundamental problems Google is rewarded for solving (Search, targeted advertising, IT infrastructure).

Most of my cloud experience has been with GCP, but I tried Azure this weekend. I'm not sure how good specific cloud services / products are, but Azure has a much better story on a cloud-first development.

In Azure, I used Visual Studio Online (VScode in the browser). This ran in a VM with command line access. It's integrated with Github, and I imagine other Azure web services will come next, such as a one click deploy button. Microsoft's acquisitions and open-sourcing (Monaco editor, TypeScript) has been so strategic and well-integrated. Amazon acquired Cloud9 but not sure where that went. GCP had a lead with a more feature filled web console which has all the right pieces (SSH emulator/shell), but it seems they squandered the opportunity to make it fully integrated development solution with a Web IDE.
The current world situation is anything but usual.
I can't help but feel like the author sounds excessively credulous.

I had to stop reading after he wrote "I could tell something big was up and there simply wasn’t time to debate the merits of handing over my source code to the NSA", because at that point my eyes rolled so hard they fell right out the back of my head.

After I put them back in, I skipped down to the comments. I have a hard time not agreeing vehemently with the top comment on the post, which says:

"You took time off your vacation to help the shadiest government agency on the planet do God-knows-what, as well as give them your IP for free. In addition, your ignorance and glee motivated you write this propaganda post, helping their cause, all for the price of a mug with a fancy sticker on it."
Shame this didn't make it to the front page after all the other, less accurate results garnered tons of uninformed discussion and speculation.

Truly sad to see that it doesn't work, at least in this fashion, but hopefully it means we can focus on more promising therapies.
Maybe Amazon should hire Google to redesign their search interface and product database so it's useable.

Maybe Google should hire Amazon to redesign the shopping search so it's not a waste of space for a significant amount of time for billions of people daily.
Not even once a week?
I'd say yes. Stirring up mud about issues not remotely related to the context by presenting a false dilemma (that resources were applied to a instead of hindsight worthy b)
This is a super exploitable human behavior when playing with novices at poker. Even smart folks can just become a bit to curious about seeing more cards even though they know it's not rational. Making the best decision requires discipline and maybe going against "instinct" and "gut feeling"
The reason why an epoch in the past was picked, I think, is that the designers wanted date stamps to represent all dates in common use, e.g. birth dates (of course, that did not cover >80-year-olds in 1984).

Pretty sure that the reason to pick 1904 in particular was to simplify leap year calculation to !(year & 3). 1900 didn't have a leap day, and by picking 1904, all leap years within the range of the time stamp had one.
I don't know how you can know that. In the US, some lawyers definitely work hard to remain on the good side of judges.

I have dabbled in some areas of law that are 'bubbles' with specialized lawyers and no juries (family law, bankruptcy, landlord-tenant). It doesn't take much to disrupt them with conventional good lawyering because most people in those practices areas, judges included, are in a rut.

Criminal law has some similar problems mostly at the low level. But it is usually the prosecutors and the defense attorneys colluding to quickly pass cases through the system. The last thing most judges, prosecutors, and defense attorneys want is a jury trial because then they would have to do their job.
What a delightfully geeky post!

After explaining how this one affects computers over 2 decades old, that this doesn't affect the system but _only_ setting of the clock, and how a utility already provides a workaround, I had a moment of giddiness when I read that we're going to walk through patching every version of the 20-40 year old OS.

Why? Because we can!
The original Xbox has a similar problem coming up soon, I believe the clock only goes up to 2022… I can't remember the exact year and it's become impossible to Google thanks to the clock battery issues.
I honestly cannot fault him. While online fraud prevention is a massive industry that touches almost every major website we use, you don't exactly have people giving talks about how serious the problem is or how advanced the detection tooling is because the nature of the industry requires you to keep your methods secret.

Heck, I have a friend who's working on a non-finance web app with <20k MRR, and even at that size he's starting to encounter fraud problems that require tooling to mitigate.

If your app stores any data that may be sellable on the dark web, you are a target.
This thread is full of people who, never having been immigrants in societies hostile to immigration, dismiss the tone of the article as ridiculous.

Those people are simply wrong. Speaking up in places where you are not lucky to have that societal right has consequences. Some of those are legal, but some are not.

Criticizing the author for the politeness and secrecy of all things is a statement of immense privilege.
Criticizing falsifiability, on the other hand... One usually expects more precise estimations for a hashed prediction.
This doesn't answer your question, but the site looks to be made using Apple's iWeb, interestingly. That's where the dependencies on JS may come in.
I don't know about NZs relationship with science (or how to quantify that). But compare them to other countries. The UK ignored the warning for weeks and did nothing until it was in a much worse position than most nations. The US is still struggling.

And more widely, other countries are very anti science at the moment. The UK refuses to follow scientific advice on almost any subject. From Brexit to Badger Culls to fracking to emissions to drug policy, the UK gets excellent advice and does the opposite. The USA similarly has climate deniers running the federal government. Being pro science is very easy by comparison.

I get where you're coming from, there are too many "isn't science great" articles and people agree with them from their own bias, not sense. But be careful, you may be making the opposite mistake. Or maybe you're right? :)
I wondered if this was Google Express but ... nope, seems like that closed and morphed into something else [1]. I know a lot of people joke about Google shutting down projects or aggregating disparate projects poorly but I actually think it is comical at this point. It makes me think of other recent attempts to coalesce businesses like combining their music subscription services YouTube music premium, YouTube Red and Google Play Music.

It just feels like Google keeps squandering its brand. It's like they try to break into a market (e.g. Express for shopping, Hangouts for video chat) and fail to gain sufficient traction so they shut down the attempt only to spin it up again with a new brand.

It seems Google's ineptitude at creating successful brands is causing it to continual create bad products. Instead of just sticking with a brand and growing/improving it incrementally over time they throw it away. That leaves them back at square one trying to gain traction with a brand new product with its own set of issues.

1. https://techcrunch.com/2019/09/11/google-express-to-close-in...
Prisons Launch “Absurd” Attempt to Detect Coronavirus in Inmate Phone Calls
I appreciate that. My particular beef with the enterprise negotiation experience was that Stripe lists a specific number after which they're open to negotiating and when we'd far exceeded that number (with minimal fraud risk due to the nature of our business), their answer was "You have too many Amex customers, but aren't you happy you're grandfathered into x, y, and z feature we now charge extra for [which we don't even use]".

Then shortly after, Stripe raised pricing on a model I'd just been told was grandfathered in.
Thanks for the info, pc! I'm worried that this is a dismissive answer, though. Stripe has been in business for 10 years, and fraud has been and will continue to be a constant battle for you. When can I expect to start seeing other problems like this prioritized?
$100 works for me for an internet bet. I think charity, can just provide proof so don't have to bother with transferring money. And I'm ok with the terms. If you have a favourite charity can go with that.
Good ideas, but without distribution of profits how are these companies going to be capitalized? Maybe government owns the equity?
Short-term consequences (positive or negative) are far mor cognizable than long-term, both to individuals and organisations. Cognizability is, then, the market for exchange and evaluation.

Options with short-term benefit but long-term harm, are excessively adopted.

Options with short-term harm or cost, but long-term benefit, are excessively rejected.

Put another way, markets consistently under-rate risks, and more complex ones to a greater extent. But they also under-value long-term. positive benefits. Markets operate in the now.

Related is Robert K. Merton's work in manifest vs. latent functions, from sociology.
This is not the only thing that bothers me about Stripe.

For example, if you run a Stripe Connect platform, and you set up webhooks to receive some events asynchronously, Stripe will send you all events of the types you select about the accounts connected to your platform, no matter if the events are related to your platform or not.

There may be applications which might need to receive all the activity, but in a simple case of a marketplace which allows merchants to sell stuff and collect a small fee, this is a disturbing amount of information. If I were a bad actor, I could silently collect the information about my merchants' activity on the marketplaces of my competitors.

Moreover, if your platform has enough merchants, you could track their buyers. Stripe will readily hand over all this information to you. In a charge.succeeded webhook alone, you get quite enough information to fingerprint a customer, and if you use some deduction, you can identify them, too.

This sounds like putting a Ring of Power into the Gollum's hand all of a sudden.

I'm wondering if the marketplaces should hang a big warning, for privacy reasons, that "this site uses Stripe for payments. Any payment information might be shared with an unknown number of third parties, and there's diddly we can do about this."
Removing --experimental--modules flag, seems like a plan put esm support as stable by the time it goes LTS?
I thought Theranos had those 5 years ago.
I'd go so far as to say that critical and valuable are not necessarily the same thing. I'd like to think I'm valuable; I go out of my way to not be critical. Intentional knowledge shares, documentation, mentoring, etc, plus focusing on writing systems that are fault tolerant, means that I could leave and it -should- be a minor hiccup. Heck, almost an entire team left along with me at one point in my career, and the projects we left behind just...kept working, no issues. Doubt that company is actually looking to figure them out so they can extend/support them should something need changing, but that's on them.
Ask them what's going on. In the current climate, they may be struggling with anxiety and depression. Or distracted by having their kids home all day; etc.

Be up-front about what you need from them and why. Be clear about what accommodations you do and do not have the ability to make.

If it turns out that they're dealing with something temporary, or if they can continue being worth employing in general, consider shifting the bottlenecked responsibilities to someone else.
Current stats: upvoted 3 times and downvoted 4 times, which is one way of proving that we suffer empathy deficiency on HN. In fact, I don't think many on HN know what empathy is. Proves the point that commenters that say NZ is not special in its handling of the crisis don't understand what empathy is or its role in successful leadership during a life/death emergency.

EDIT:

It could also be 1 user using 4 different accounts that they've accumulated some time and karma under (so they look like legitimate user accounts) ... HN makes it impossible to tell if that's the case since they hide stats on who up votes and who downvotes.
Git config email/name, depends on if they are looking at IP addresses though, you might need a proxy. Also how commits time and code style could be give aways.

Git is distributed, so your brother can push to your headless repo which you the pull from and push back to theirs from your working copy.
Covid Club: Alumni Club for Covid-19 Survivors
> Stripe.js is part of the ML stack that helps us stop literally millions of fraudulent payments per day and techniques like this help us block fraud more effectively than almost anything else on the market. Businesses that use Stripe would lose a lot more money if it didn't exist.

Can someone give an example of the kind of fraud schemes involving bots that this would stop? What are the bots programmed to do, how does it benefit the owner of the bots and how do you detect it?
I mean, if your server is compromised, you are completely screwed, no matter what services you do or don’t use.
Have you tried since 2017?

You can nowadays move payments profiles between Google accounts (add the other account as an admin on the profile, then remove the original account from the payments profile), or close payments profiles.

My Google Payments settings were incorrectly set as "business" for a long time, but in late 2017 I was able to move the incorrect profile to another Google account and make my main account "individual" (Google prompted to create a new payments profile when the previous one was no longer accessible to the account). Presumably closing the payments profile would have worked as well.

https://pay.google.com/gp/w/u/0/home/settings
Show HN: Building a continuous integration pipeline for ML with GitHub Actions