skysight-inc/HackerNews huggingface dataset:
I work in gamedev. Build servers, version control, etc. are almost always on-premise, even if a lot of other stuff has been transitioned to the cloud. There's a few reasons:

1) Bandwidth. I routinely saturate my plebian developer gigabit NIC links for half an hour, an hour, longer - and the servers slurp down even worse. In an AAA studio I am but one of hundreds of such workers. Getting a general purpouse internet connection that handles that kind of bandwidth to your heavily customized office is often just not really possible. If you're lucky your office is at least in the same metro area as a relevant datacenter. If you're really lucky you can maybe build a custom fiber or microwave link without prohibative cost. But with those kinds of geographical limitations, you're not so much relying on the general internet, so much as you're expanding your LAN to include a specific datacenter / zone of "the cloud" at that point.

2) Security. These servers are often completely disconnected from the internet, on a completely separate network, to help isolate them and reducing data exfiltration when some idiot installs malware-laden warez, despite clear corporate policy threatening to fire you if you so much as even think about installing bootleg software. Exceptions - where the servers do have internet access - are often recent, regrettable, and being reconsidered - because of, or perhaps despite, draconian whitelisting policies and other attempts at implementing defense in depth.

3) Customizability. Gamedev means devkits with strict NDAs and physical security requirements, and a motley assortment of phone hardware, that you want accessible to your build servers for automatic unit/integration testing. Oddball OS/driver/hardware may also be useful for such testing. Sure, if you can track down the right parties, you might be able to have your lawyers convince their lawyers to let you move said hardware into a datacenter, expand the IP whitelists, etc... but at that point all you've really done is made it harder to borrow a specific popular-but-discontinued phone model from the build farm for local debugging when it's the only one reproducing a specific crash when you want to debug and lack proper remote debug tooling.

...there are some inroads on the phone farms (AWS Device Farm, Xamarin Test Cloud) but I'm unaware of farms varied desktop hardware or devkits. Maybe they exist and just need better marketing?

I have some surplus "old" server hardware from one such gamedev job. Multiple 8gbit links on all of them. The "new" replacement hardware often still noticably bottlenecked for many operations.
Ah yes, the assumption of ignorance and the belief that if I only try it I'll become a convert. Two more tiresome features of quasi-religious discussions.

I have tried it a number of times, including the current generation. https://news.ycombinator.com/item?id=23048814
Great to hear! Lots of the people who learned how to code because of Minecraft have ended up all over the industry. It's where I got my start, as well as many of my coworkers. That's part of our passion for making Hytale, to empower the next generation of youth who want a game they can tinker with and use to learn. If you haven't seen it yet definitely go take a look, got lots of cool plans for moddability and customization :)
The description is definitely weird. Any server change change should never crash an app, which should have proper validation for all data that it receives.

Thereby the mitigation "to update something on the server that takes time to propagate" also sounds wrong more like a rollback/mitigation than a fix of the actual issue.
>Nov. 8, 2016
this is funny, I did the same thing for the 8 years preceding my brother's elevation
Who cares how many entities are involved? Why does it matter?
We talk about this a lot in k12 education (I teach at the high school level). It’s often immediately apparent how new/effective a teacher is by monitoring their question style.
That open standard exists, it’s called Webmention. You can use a free Webmention server like https://webmention.io and download comments with your API. Comments are just webpages where people respond to your blog.

Webmention works like this: Someone writes a reply on their blog and then sends you a Webmention. You can add it to your site or do whatever with it. It’s decentralized and there’s no vendor lock-in.
In junior high school, at the end of the brief morning announcements broadcast to all classrooms, the principal would end with some quote. One stuck with me, and was something like this:

The character of a man is revealed by how he behaves when he knows he won't be caught.
What We Learned Increasing Deploy Speed by 2x
Technical advancements are always held back by politics. This is one of the main advantages of GPL, there is no CLA to sign.
Co-Founder and CEO at Happeo- Making Work a Happier Place During These Times
I'm sorry if I didn't explain what I meant well enough.

I was talking about statelessness on the server side. If you remove cookies from HTTP, you now need a database on the server side.

You also get extra communication (between the client/DB, or the web service/DB), whereas previously the data would've already been available in both (the client has the jar, and the web service gets it in each the request). Turning a local memory read into a network request can be a difficult architectural change.

Also, DynamoDB reads are priced per unit ;-)
SVE-2020-16747
https://security.samsungmobile.com/securityUpdate.smsb

CVE-2020-8899
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8899

From the issues page:

Q: What privileges does the attacker gain in the system after a successful attack?

A: The vulnerable codec executes in the context of the attacked app processing input images, so the attacker also gets the privileges of that app. In the case of my demo, that's Samsung Messages, which has access to a variety of personal user information: call logs, contacts, microphone, storage, SMS etc.

While not explicitly tested, I also strongly suspect that local privilege escalation may be possible with the help of these bugs. For example, the highly privileged System UI process may display arbitrary images supplied by other apps in notifications, and I have observed it crash in Qmage-related code a number of times in my experimentation.

===

Q: Have you tested any attack vectors other than MMS?

A: I haven't devised any end-to-end attacks similar to that via MMS, but as noted in the original bug report, all apps in the system which display untrusted images with the standard Bitmap interfaces are affected by these issues. For example, I have confirmed that the Qmage file which is used as the final payload to get a reverse shell via MMS, also gives the attacker remote access when it is copied to the device's file system and opened with the Gallery app.

===

Q: Are there any mitigations available to users against this and similar attacks, other than updating regularly?

A: For Samsung devices, these issues are fixed in the May 2020 patch. Generally speaking of image codecs, I am not aware of any generic mitigations against these types of bugs. One easy way to mitigate against attackers using exploits delivered specifically through MMS is to disable the "auto retrieve" option for multimedia messages in the Messages app.

From Mateusz Jurczyk of Google Project Zero‘s YouTube page:

https://www.youtube.com/watch?v=nke8Z3G4jnc

‘This video demonstrates the exploitation of a vulnerability in the custom Samsung Qmage image codec via MMS. The exploit proof-of-concept achieves remote code execution with no user interaction on a Samsung Galaxy Note 10+ phone running Android 10 (February 2020 patch level).

‘Vulnerabilities in the Qmage format were reported by the Google Project Zero team to Samsung in January 2020, and were addressed in the Samsung May 2020 Security Bulletin as SVE-2020-16747. The bugs were also collectively assigned CVE-2020-8899.

‘For more details, see:
* https://bugs.chromium.org/p/project-zero/issues/detail?id=20... - the original in-depth report discussing the codec and security issues. It also includes an FAQ section outlining how the exploit works.
* https://github.com/googleprojectzero/SkCodecFuzz [currently 404] - source code of the fuzzing harness used to identify the crashes.
* https://security.samsungmobile.com/securityUpdate.smsb - Samsung Security Updates website.’
Most people grew up with parents who love them. They might not know how to show it, and I'm sure there are exceptions, but love for offspring is about as close as it gets to universal human experience.

Parents may not express that love all the time, and may even harm their children in spite of it. And they will probably hate themselves after the fact for it.

I was oversimplifying, of course. You can certainly end up with enemies. But your boss didn't start out hiring you because he wanted an enemy. He hired you to do a job.
I am sympathetic to your viewpoint and will give it some more thought. That said, my immediate thought would be that a fluid and healthy secondary market is necessary for a primary market to exist at all. Also, a secondary market allows growth companies to channel revenue into investment instead of paying out dividends. Last and relatedly, the overall secondary market return makes it nonzero and this incentivizes investment in lieu of dividends.
Money is a safe guess. Research pay scales aren't even close to private sector, especially not finance.
yeah even if they're great. I worked for a nobel laureate, was hoping to get great letters of rec or whatever for professorships, but all he really cared about was getting his projects funded, tinkering in the lab, and spending pennies at the slot machines. After about three years, I just left.
I work for a large video games publisher, as you might expect we use a lot of windows.

Windows server licenses on AWS and GCP are hundreds of times more expensive at our scale. Incidentally we actually do have some cloud infra and we like it, but the licensing cost is half the total price of the instance itself.

In fact, you might not know this but games are relatively low margin, and we have accidentally risked the companies financial safety by moving into the cloud.
Not heard this term before - I believe this is often called "open Vs closed questions" (where open questions are the open-ended ones that cannot be answered with yes or no).
Thomas Piketty’s plan to fix the economy
"Is."
For models where static files need to be served efficiently, using cloud compute and aggressive CDNs works great. For any model where you've got volatile data that can't be cached (Gaming, VOIP, etc) you're tough out of luck.
First Manned Aerobatic Racing Drone – Will It Flip? [video]
We launched Liteflow framework. Build and ship faster
Totally. I've had personal colo'd servers for 20 years at this point. But I'm tired of knowing that at any point I might have to wake up and haul my ass down to San Jose to swear at some piece of failing gear. I'm excitedly moving it all into the cloud.
Infiniband and friends aren't cpu interconnects, they're alternatives to ethernet. Network latency is important and it's not that hard to write code whose performance is bounded by io latency/throughput.
Vim: Scroll up/down, keeping your cursor in its row
VSCode team's highest priority is Javascript/Typescript, everything else is just trailing behind. Python and C++ are the very well supported ones. .NET is still really bad.
> Rules are inflexible

Most people aren't this pedantic and implicitly interpret rules as breakable, that's why we have sayings like "rules are meant to be broken" and "the exception that proves the rule". Generally the enforcement bodies of any set of rules, like courts and police will have a lot of discretion on when and how to apply them.

Depending on which definition of principle you want to use the can also be a lot stricter than rules, looking at some definitions online "A basic truth, law, or assumption.", "a fundamental doctrine or tenet; a distinctive ruling opinion", " the laws or facts of nature underlying the working of an artificial device". So substitution principle for rule would make things less clear.

Most people are far more cavalier about breaking rules than principles.
This works surprisingly well. I think to also pays to master a language for the same reason to be able to articulate thoughts precisely to self and to others.

Tangential: https://fs.blog/2012/04/feynman-technique/
> Lastly, this is driving a trend towards the so-called "cloud kitchens" letting restaurants operate with a subset of staff in cheaper to rent places

These exhibited the same failure modes as UberEats, et al., namely that your food is cold by the time it gets there.

Delivery works when it's local and immediate--period.
Also offtopic, but my 12 year old is obsessed with Hytale.. Loves to read the blog updates and watch the videos and can't wait to eventually play it :)
Didn't Samsung literally get caught uploading screenshots of content played on their TVs to some server? Maybe it was some other company?

These days, unless you take drastic measures to defend yourself from spyware embedded in consumer technology or forgo it all together, it seems that you'll be subject to this kind of surreptitious abuse as a matter of course.
What about first-party SaaS? Those can also be big features that bring people to some cloud providers. Not all SaaS requires you to trust your data/availability to some random vendor. Of course those first-party SaaS aren't typically suitable for lift-and-shift by their very nature, and they can still have some rough edges, but IMO you can expect them to be almost as reliable as IaaS
I think it has a lot of potential answers on a case by case basis.

Often people don't want to maintain an old code path. Sometimes people get into that line of thinking without clear understanding of just how many people like what the old code path is doing for them and why. Sometimes they also over-estimate the maintenance cost of the old thing.

In the case of win8, there was a strong drive for "we're doing a tablet now", very little intuition about how their thing was going to be received in the market, and the company culture and talent pool was already markedly different from the one that produced their 1990s greatest hits, so it's not like they were automatically going to reproduce prior success.

Also notable that in vista and win7, turning on the classic look disables dwm.exe, the compositing engine, and some GPU-based optimizations.
Turns out "when a tree was planted" is kind of a fuzzy concept. Do we mean, when the seed first germinated? Or when the sapling was first installed on the site?
I don't think we're in disagreement.

You asked: Of all the people who read that quote and nod along thinking, “yes this is me” how many are actually right?

Of those people who think "yes this is me" as beginners, those who stick with it and move beyond the stage of beginner by fighting their way through their creative difficulties will be the ones who actually did have good creative taste and were right. Those who reach creative roadblocks and blame the cause on external circumstances are not among those with good creative taste.
I don't have a quote handy but one idea I'm partial to is that that mind is not one. It's a noisy group of sub-minds all clamouring for attention, with different goals.
Sorry, we're not currently looking for Embedded Software Engineers in Munich. We will likely be add an opening there later in the year.
Some science behind it: https://www.pnas.org/content/111/20/7379

Disclaimer: I was one of the guinea pigs.

The method is found on YouTube actually. The hallmark of you performing the method well is that you can go longer without oxygen by timing yourself (my progression went from 20 seconds to after 16 rounds to 3 minutes -- by breathing out all air first and then not breath). I won't describe the method here as you're more helped with people overexplaining it than underexplaining it.

One wouldn't teach a full programming language to a novice in one comment either.

Disclaimer 2: I'm not a doctor.
> criticize the testing

Criticise the process that let it through.

Why was the testing not sufficient? Was it even tested at all? Maybe a developer just "pushed it straight to master"? Why/how can they do that (hypothetically)
For sure. There are absolutely use cases where the cloud doesn't make sense.

Most businesses out there aren't those kinds of businesses.
That was actually the first Uber Eats business model, sadly I can't find a source. They'd have a restaurant cook a couple hundred meals in bulk and then the drivers would bulk deliver them.

Letting customers order from restaurants they already know is obviously a bit easier to scale.
I'm a developer and I hate closed proprietary ecosystems with a passion, so that was just lip service afaic. Current microsoft is much more "developers developers developers"
We can do OPT Visas (and try to convert it to an H1B), but are not able to sponsor an H1B from scratch.
That is the entire business model of mobile.
We have now replaced the old GitLab instance totally and all went very smoothly.

We love the custom fields in issues, the feature helps us a lot when defining our issue process. I think it can also replace our JIRA instance. I do have lots of thoughts when working with OneDev and will absolutely let you know soon.
DragonFly BSD 5.8.1 released 2020-05-06
‘Like’ is a positive verb so it’s not a neutral question.

More importantly it directs you to frame your reaction on a simple like-dislike axis, when the full spectrum of your opinion is probably more complex, and eliciting that yields a better conversation.
Well they can be both, so I can see how parent might have gotten confused.
Does it run Fortran?
If the intention of the law was to stop all tracking they should have stated that. Instead they said "you need consent before you can track". So websites are asking for consent.
.io is just the tld for the British Indian Ocean Territory. TIL.
This is amazing! And SSL option right off the bat too? Well done. Feature request for Postgres: it looks like this version mostly displays tables in the 'public' schema. Would be great if it could display all tables and views in all schemas present in the database
When I was in college I was a member of the Society for Creative Anachronism (https://www.sca.org/). To provide an evening's entertainment, I adapted a folk tale, Why the Sea is Salt, into iambic pentameter.

http://www.flownet.com/ron/salt.txt

It is meant to be performed vocally, not read. The first time I had to read it from my original manuscript (and it was a manuscript, written by hand with a pencil because this was the mid-80s). After that I decided I wouldn't perform it again until I had it all memorized. It took me over 30 years to get to the point where I was confident I had it memorized well enough to perform it without notes, but last year, over thirty years after its debut, I finally did it.

Then Covid happened. Now I recite it to myself in my head to help me fall asleep. It works remarkably well.
I wish there were an easy way to deploy rpi to people I know much in the same way it's easy to tell them to install uBlock Origin
I've never seen this quote and it is excellent.
> Failure to validate a product before building it? Premature optimization.

I largely agree with your comment, minus this. Unless everything after the initial idea for a product is an "optimisation" - which is quite a claim - building something shouldn't be lumped together with optimising it.

My point is that it seems like you're attributing more to this idea than is fair.
> Cloud is great if your workload is variable and erratic

Or if you're just constantly iterating on a large product with many engineers. Those engineers' salaries almost always outweigh all of your cloud costs and so making them productive is cost effective. Things like SNS/SQS/S3/VPC/ELB/etc. save you countless hours and often make up for the increased cloud costs with increased developer productivity.
This makes me think of all those UFO sightings of weird craft that flash multicolored lights that look like emission spectra you would get from plasma. I wonder if at least a few of these might have been classified experimental propulsion systems similar to this. The basic physics of this is not new and it's not like these programs have lacked the funding to experiment with crazy tech.
Most likely the Human Interface Guidelines that Apple enforces for all of their software is a major enabler for this, as it mandates minimum touch areas and spacing that should eliminate that type of issues. No other platform has as much native UI adoption - used to be the case for Mac too until Electron and others came along.
Could a saturated network interface prioritize some other company's traffic over your own in AWS? Could the same happen in your own private network?

Consider that building fault-tolerance into their application may be very difficult, or impossible. Cloud would be incompatible with that.
MS and Boomi runs on AWS. Not those ones.
An atomic read fork isn't sufficient. The file could be inconsistent if another process is currently writing to the file at the moment of the snapshot. What you need is an atomic write, which is already provided by rename(2).

I've always found it odd that binaries and scripts are often installed 755, including in /bin and /sbin.[1] Perhaps it's because install scripts don't bother changing the read-write permissions, so executable end up with 755 because the default umask is 022.

Anyhow, I've taken to removing all write permissions from most of my files, not just executables. I haven't yet experimented with changing my umask to 222, but I suspect it would cause many programs, especially editors, to fail.

[1] At least on Linux. I just checked OpenBSD and they're 555. But even on OpenBSD most files in /usr/local/{bin,sbin}, installed by third-party packages, are 755.
>Devil's advocate: you could always not run those apps. Although for non-technical users it would be challenging to determine if the apps were transmitting that info, it's possible for technical users to detect it (assuming the info goes to an obviously-facebook url and isn't piped through e.g. spotify)

But therein lies the rub: the overwhelming majority of users of software are not like you and me and have no idea what's going on behind the curtains.

>Additionally I don't think there is anything wrong with client-side analytics in general since it's basically the only way to monitor performance/usage in production. And this type of thing is hard to discern from the more benign case

I hear this argument a lot and I empathize with the idea that having such information can aid in the development process. However, the argument asserting that some data may be useful to the developer so the developer is thus entitled to it, doesn't wash.

Regardless of the ubiquity of this behavior in today's software development industry, the fact remains that this process consumes the user's resources without their knowing or say in the matter and it's not OK.
I think it can lean either way depending on how you ask it ("Did you like the movie??").

However, regardless of leaning, the non-leaning version feels like it will generate more interesting responses, while "Did you like it?" is likely to elicit a "yes" or "no".