skysight-inc/HackerNews huggingface dataset:
> But if I lose my phone my number is gone too since I always use prepaid.

Writee is obviously NOT in Europe, where even to get a prepaid you need ID/passport. That way you can keep the same number forever (if you abide to the "add funds even X months). I have phone numbers in 4 countries (that I tend to visit 'often' and all I need to do is add €$£10 every six months to keep them alive.

So one solution for that is to go to that ISP of yours and ask them to bind your number with your ID. And if you lose the SIM one way or another, you show up with your ID/passport and in 10mins you walk out with the same number.
I would cackle in hexadecimal and cherish my Rube Goldberg-esque setup of cross-cloud syncs and backups.

Also, for anyone thinking about giving up gmail: check out fastmail. I never regretted switching my email over to them.
Probably something like this should help: https://blog.invisiblethings.org/papers/2015/state_harmful.p...
Plague, meet pestilence.
Not much. I guess at some point you realize how much you depend on things and how a single point of failure could greatly perturb your life. Unfortunately diversifying your identity is not as easy as diversifying, say, your stock portfolio. Are people willing to lose parts of their identity in the same way they're willing to lose parts of their assets?
The article seems only to focus on what happens if you lose your ways to authenticate, but another possibility is getting caught in some weird ban wave like spamming emotes on a youtube stream when the streamer asks you to (https://9to5google.com/2019/11/09/google-account-bans-youtub...) (most of these bans seem to have been reversed, but I don't know if that would have happened without the publicity that came from a popular youtuber calling out google for banning his fans ...)
Do my best to get my story to HN front page. That's the only thing that actually works.
I work in a startup and unfourtunately we don’t have cash lying around to offer any bug bounty that would be reasonably priced. And, I think, that applies propably to most of the startups.
Copying the data to an external drive and keeping it in the same location as the original is even worse. Where do it put it? The bank only has so many safe-deposit boxes - mine doesn't have any available atm.

Giving the drive to friends or family isn't viable either because I need to encrypt the data and need to store the keys somewhere. So the cloud, i.e. AWS, Azure, Backblaze, etc. is actually a pretty good place.
Depends on the "Cloud".. cloud is and will always be "someone else's computer, somewhere else". Google Drive is not a backup. Carbonite (or Crashplan) is a backup solution.

Of course a successful backup needs to be at least "3-2-1". Not "1" (Google Drive).
I disagree for another reason. I don't think bug bounty is the best fit for a few reasons:

* HackerOne is very expensive for most startups, IIRC it's around 30k USD/year only to be hosted on their platform (the price is probably different for different companies though.)

* If one doesn't want to use a platform like HackerOne you're in a tax hell doing payments to people all over the world

* The cost of paying for the bugs reported which can be massively expensive if you want to be competitive.

* The time it takes to handle all reports is massive. You might imagine you get cool and interesting research but 99.9% are people copy-pasting output from automated scanners, people reporting on out of scope things, usually low severity with things like "missing x-frame-options" or just straight up false positives. It's both frustrating, demotivating and time consuming.

I think a self hosted responsible disclosure program is better and more sustainable for most startups. Add a security.txt [0] to the website. You might still get a bunch of low quality reports but at least you give people a structured way of disclosing findings.

0. https://securitytxt.org/
Reading this always makes me sad. It's like computing got utterly corrupted post-2008 and there's yet to be a fix.

The tragedy of all this is that a 2008 laptop should be more than enough for today's needs if web development wasn't greedy and was resource aware.
Depending entirely on how good a worker you are, almost anything can be sewn by hand.
Designers often start with a picture, so they can calculate the required dimensions from measurements. There is a lot to learn about different cloths, their orientation in a garment and the way the garment "falls".
There are often courses in garment design and construction available at technical colleges. These run anything up to 3 years (in New Zealand, my country) and end in a degree level qualification.
I learned this behavior by reading the Luck Factor, but that book isn't magical. What was magical is that it nudged me to do this.

One small tidbit that might be fun to share was when I met a seemingly shy woman and we started a conversation and eventually I asked.

What do you do?

I program traffic lights.

What language are they programmed in?

In C

Who knew? :D
https://en.wikipedia.org/wiki/Defence_in_depth
Is there really any way to securely host static assets in a cloud bucket? If you host profile images, etc... locally you can easily give or deny access to static assets without having to obfuscate the file path. From what I read here, the dating app was using UUIDs in the URL paths of the images to obfuscate their identity (I’ve done this sort of thing before but afaik it’s not considered secure?). Is it possible to set up ACLs for bucket objects though? From my limited experience with Google Cloud Buckets are object can be simply public or private.
I actually am a nice guy trying to give some experience/advice in dating apps. I've had numerous long term relationships. I'd like to share my knowledge for whatever it's worth. I have zero interest in monetization and absolutely will never try.

That being said I was very interested in talking to the op on this and politely asked to connect.

I recently turned 38, im currently single and I have an 80 percent chance of being dead in the next 8 months and 17 days. If I can help 1 person out to find that special person before I die it will be more successful than any SV unicorn.
> Two other R-C snubbers filter the diode bridge, which I've only seen elsewhere in audio power supplies to prevent 60Hz hum; perhaps this enhances the iTunes listening experience.

Is this really the reason? That when engineers are designing chargers, they are considering the music listening experience?
If you don't already, you can set Google Takeout [0] to create an export of all your Google data every two months for 1 year and it'll email you when it's ready. I download my data and move it to an archive drive, it would be cool if there was a way to automate the process of downloading and storing x latest archives but I haven't looked into it.

[0] https://takeout.google.com/
12 year old Thinkpad with Intel Core 2 Duo
And HN is a very good resource on "how to divorce with Google". I remember reading many articles/discussions on this topic.

Thankfully I rejected the opportunity to "date" Google when all my friends were jumping on that train many many years ago :)
What do you mean by "hooked into systemd"? It seems completely standalone. Do you mean it's activating when new devices are plugged in?
On the enterprise software I worked on (IWMS system) we did both. Customers got their own schema, but big customers would give each branch their own virtual tenant within that schema. We started out with only the multiple schemas approach and ended up retrofitting a bunch of multitenancy features.
Physicists to improve plasma fusion mirror devices
Previously on HN: https://news.ycombinator.com/item?id=3996171
I wasn't sure. After a bit of research, this seems to be a debate [1]. Using the common definitions, it's possible to have a data race that doesn't cause a race condition. [2] It's also possible to have a race condition without a data race.

[1] https://en.wikipedia.org/wiki/Race_condition#Data_race

[2] https://blog.regehr.org/archives/490
This comment could not be upvoted enough. There is a massive productivity level difference between someone who has mastered their expertise in a language's ecosystem and someone who is just coming to the language but able to understand the "linguistics"/syntax quickly (usually because they carry some similarity to an already known PL).

This is not even considering all the little "gotchas" each language will have. Although, Stackoverflow et al. help ease this a bit.
Analysis of the ABTraceTogether App
Absolutely I agree. K and APL like languages have an excellent philosophy. I've found that you can carry this philosophy over to a lot of other languages as long as they have some respectable level of composability.

Going on a bit of a tangent but I feel like just about the entirety of software divides fairly cleanly into five cases more or less regardless of the scenario.

The first case is scripting for automation or duct taping services together. Shell scripts are more or less ubiquitous so they serve the purpose well.

The second case is application scripting DSLs. These are definitely oriented towards an end-user and most likely need to be usable without too much prior programming experience. These end up much like the first case where they end up serving as a high level duct tape. If possible non turing complete DSLs should be preferred or if something fully featured is absolutely necessary, something like lisp or lua or possibly even a prolog-like language works well.

The third case is data based programming. This covers most of the "interesting" code that people write. I'd argue that this applies to any ML, control theory, data processing, compilers, graphics applications, and other algorithmic code. This is arguably best suited to APL-like languages(functional and array based). The only exception to this would probably situations where encoding properties into a type system could prove useful. Things like differentiable programming benefit from this and APL like languages don't really have the tooling to handle these cases as far as I'm aware.

The fourth case is user interface, hardware abstraction, and/or systems programming. I'd argue that low level languages with strong type systems and zero cost abstractions like Rust or Boost/Metatemplated C++ cover almost all of these cases. Being able to encode formal properties into the system through variable bounds, Hoare logic, and state machines while still being able to interact in a "low level" way is extraordinarily useful. Surprisingly in this sense, creating a user interface is very similar to interfacing with hardware over SPI, I2C, USB, etc.

The fifth case is quick and dirty prototyping. The languages in the prior cases work perfectly fine for this but sometimes the very high level duck typed languages such as lisp, lua, and python end up being easier for when just trying to flesh out an idea. I'd argue that this case shouldn't see production and should really only be used for prototyping and academic work.

Rant over. I definitely think APL derived languages need to make a resurgence as they could definitely improve the ergonomics, readability, and reliability of developing the "interesting" stuff which is honestly the class of application that desperately needs this.
> But who does this

Everyone below a certain scale. Or when it just makes more sense, like Proboards' free tier.
You can serve them from the application layer and use authentication there. It's just slower.
Location: Skåne, Sweden

Remote: Yes!

Willing to relocate: Pontentially, but not within 1 year.

Technologies: iOS Developer, UIKit, SwiftUI, RxSwift, Combine etc.

Resume: https://www.linkedin.com/in/sergheevandrian/

Email: sergheevdev@icloud.com
> One of my other Google accounts actually have been inactive for so long that Google doesn’t trust me when I enter the password and there’s no way to recover.

Is there genuinely no solution to this?
Zoosk Spam: Ignore or remind them about GDPR?
Hi HN,

I recently got an "invitation" to Zoosk. Likely someone in my contacts registered to Zoosk and allowed Zoosk to harvest my email from their contacts list. This strategy is, unfortunately, not unique to Zoosk and was (likely still is) quite a popular strategy to achieve "hockey-stick" growth for many websites.

I feel my rights as a data citizen have been violated. IANAL, but I never gave my consent to Zoosk to collect my personal email and process it for the purpose of sending me spam. How should I (in the collective interested of European data subjects) behave?

1. Ignore the email, wait until they run out of cash, and let the problem sort out by itself. Don't feed the troll.

2. Request them to remove all my data under GDPR right to be forgotten. If enough people do this, it will add sufficient overhead to make their strategy unsustainable. In case a future leak shows that they don't properly erase data, they will likely have to close shop.

3. File a GDPR complaint to my national data authority. My experience with the Swedish one is that they are already overwhelmed and tend to reply "it is a problem, we don't have the resources to fix it".

Please advise.
A better title might be "Pricing Your Service" since the overwhleming majority of examples cited are services, not products.
Hi Tastroder :)
I see we have quite different "takes" on how to learn sewing.
Of course you are quite right but there are different strokes for different folks (a clothing designer I once knew told me that)
"There is one more option for super paranoid people. Backup all your data."
I would argue that this should apply to everyone, not just the paranoid! The fact that most companies make this easier nowadays, like the linked Google Takeout, is actually a real, useful improvement.
probably just shrug and move on with life? same thing as when I deleted my facebook account.
In BASIC the equal symbol "=" can mean assignment or equality depending on "context". Is this an example of a non context free?

On the other hand, I've seen EBNF definition of BASIC (VB, actually). Is this a contradiction?

(just someone still learning)
The problem is that the solution is political, not commercial. In terms of political process the "just leave it to us, we'll look after you" argument is winning.
I expected something about PostgreSQL too.
SaaS Quick Ratio – Growth Efficiency of Your SaaS Startup
Open a new one, it's empty anyway. I only have it so that Android can track me.
I don't know if you are an admin or an admin wannabe, but this is absolutely not nationalistic flamebait. Anyone who knows anything remotely about India will agree with this statement. And no, it does not lead to lower quality discussion. It looks like hacker news admins are about as a power abusive as Indians in power
Clean power does have lots of benefits, cleaner audio is one of them
At best this is like a teenager trying to be deep. At worst it's just nihilistic.

We get your point, but for those of us not assuming the destruction of humanity, there are still choices we can make.
It's still absurd to me that you can get a full account ban for anything, no matter how big or small. Why aren't these bans more fine-grained? Is it so difficult?
Because I think the average four year bachelors degree has regressed to soft sciences taught by lackluster instructors with very little rigor. So no glamorization of blue collar work, it's just that a two year trade school is more transactional - if you graduate, you'll have learned a hard skill that you can earn money with. That used to be true for most four year degrees, now I'd guess it's only true for a minority.
Great article! The most important part for others reading this:

Narrowing your niche down attracts specific types of clients who have specific needs that few people in the world can solve.

My expertise is NLP/ML for Asian language processing and language education. When defining your specialty, I think it helps if you define it in terms of the industry, not in terms of an ML stack. People look for, e.g., “AI solutions for healthcare” and “text analytics for finance,” not for “GANs” or “Seq2Seq models.” You need to be willing to learn a very wide range of ML techniques and models, from simple regression to GANs and RL, no matter what industry you work in.

In other words, define your niche in terms that make it easy for someone with budget authority to say "yes" to hiring you.

This is worth noting also because if you accidentally cross over into talking with recruiters or other gate-keepers to the real budget authority holders, you'll be misled into talking or padding your resume with technical terms that are not the key value drivers for why you'd get a nice-paying contract.
Ask HN: How to do hybrid remote work successfully
I work for a company that was up until the COVID-19 issues 100% on-site.
It is now 100% WFH.
Now we are considering how to do this going forward. We realize that in the next few weeks we will work hybrid WFH/office so we will probably still use Zoom for the meetings pretty extensively. However we're considering allowing WFH even after the whole COVID-19 issue subsides. The concern is - how to do hybrid remote work successfully.
For example- how do you do a meeting where 5 people are in the office and 2 work from home? this doesn't work really well from my experience but haven't tried it a lot.

Thanks
Their account recovery (which only needs answers to one or two of their questions, not all) seems to be used for account highjacking. I lost one that way, and searching around I found many people with a similar story.

If they just stuck to requiring a very strong password and not letting anyone in without it, no exceptions, no ifs, no buts, I would still have that account.

Fortunately it was an old account I wasn't using anymore.

Just use one Google account per Google service, it's the safest way haha.
It isn't the best proxy though, because it's not even trying to simulate the conditions under which real work is done (e.g. in real work, most developers will often look up details, and it's no problem at all - what matters is how they think about solving problems, that they know what they don't know, and that they fit into the team). This is a proxy for 'is this an experienced person with a strong memory?', not 'is this a qualified candidate who would perform well in the position?'. It's quite possible to fit the latter and not the former. If you're the size of e.g. Google so your problem is more to weed out bad candidates quickly rather than catch all good candidates, then sure, go ahead (false negatives are acceptable to completely avoid false positives). If you are a smaller company, then your pool of applicants is quite limited and it's much more important that you don't pass over any qualified candidates that happen to fall into your net.
It's a decision I'm sure the author deeply regrets. The author has another post on their blog promoting security practices[1]. Just going to the settings pane to enable 2FA shows your backup options: backup codes, sms, webauthn, etc.

I only remember one password, and that's the password to my password manager. The rest are arbitrary random strings. Always use MFA. I employ efforts to make it difficult for an attacker to port my phone number, too.

At this point in the maturity of the internet these measures should be a no brainer, but it's a good reminder of how far we have to go.

[1] https://blog.viktomas.com/posts/security-is-like-ogres/
But hey, everybody loves the single account login! /s
News I've read in the UK over the last week includes BA laying off a quarter of its staff and stopping flights from Gatwick, Rolls Royce laying off 3,500 staff, Airbus contemplating layoffs. These people put their money where their mouth is and they don't see a quick recovery.
Oh yeah, they won't even let you access Recovery if you haven't logged in for a long time and all of your devices are new to Google. Pretty funny.
Ok, a central store is a problem, but I don't get hn's bitterness about autoupdates.

I don't mind autoupdates of apps, especially sandboxed ones like Snaps, and especially when they can be rolled back if issues arise. Snaps do, in fact, allow for easy reverting to a previously used revision:

$ sudo snap revert vlc
vlc reverted to 3.0.5-1

It will even remain on the reverted version without updating until another version is published.
100% a local business directory but we tried to apply a lens of 'what are these businesses doing differently during lockdown'. For some this is a huge shift in their business model or way of operating, others it might just be shipping free to local people.

We'd love to add a solid way of helping people only see which services they can have delivered to them. The issue here is that every business has a different rule - 1m radius from shop, specific postcodes, only on certain days of the week. We're no-coders and this problem pretty much exposes the limitations of a solution like this. Despite that, it would still take a developer weeks to crack that one and how many extra weeks to ensure the 500+ business listings had the right data to support a technical solution. We gambled that lockdown wouldn't last long enough to invest in it and instead just show a delivery area label so you can see at a glance.
The problem this article touches on is huge, because everybody who has a computer is affected and almost nobody takes the necessary precautions. Especially non-technical computer users can easily lose years worth of important data.

I've tried to set up contingency plans for the cases that I lose access to my:

- phone (which contains Google Authenticator with plenty of important logins; unfortunately some of my 2FA is still based on SMS)

- my laptop

- my Yubikey

- my wallet (with ids and a credit card)

due to theft, damage (house burns down) or simply loss.

Another under-appreciated risk: losing my memory (my master passwords are only in my mind - what happens if suffer a head injury and forget?)

Redundancy is one countermeasure: Have more than one bank account + stock portfolio, more than one credit card (servers might go down if a credit card is blocked) and physical devices (phone, laptop) in store to stay operational in case of an emergency.

Full machine backups + regular uploads "to the cloud" for raw data; occasional transfers to (multiple) external hard drives.

I don't think there is a way around a safe physical space with printed backup codes on it. Ideally not in the same house - maybe with a bank?

A list of instructions for numbers to call for account recovery or blocking. Which information will I have to provide?

In a similar vein: what happens to my data after I die? How would my (non-technical) family be able to access my pictures and writings? A digital inheritance would be prevented in my security set if I don't prepare.

This space is fascinating to explore, the zeros and ones people have stored on their devices are incredibly valuable to them and this treasure is poorly protected. Generally speaking: No backups, weak passwords, outdated software, old hard drives ... risks abound

Google surely has very capable security people, but right now my account there is the central vector of attack, most of my passwords can be reset through my email, a huge portion of my communication runs through Gmail, Whatsapp is backed up to my Drive, most of my pictures are on Google. It's probably a good idea to disentangle the situation a bit to be prepared for the case that Google's fortress gets breached one day.

Without compromising your security - I'd love to know how others approach their personal IT security challenges?
> There are often courses in garment design and construction available

I was thinking about a different kind of teacher. There are seamstresses in my town and adjacent towns that offer sewing lessons.

(Also, thanks to tastroder for his advice)
Intel Virtualisation: How VT-X, KVM and QEMU Work Together