skysight-inc/HackerNews huggingface dataset:
Wouldn’t there be a point where we run out of readily exploitable vulnerabilities against a specific platform ?

For instance if I was running a server on an 50 yo IBM framework serving static pages, how many serious attack vectors have been left unpatched at this point ? (ignoring DDOS type of issues where the content is not compromised)
Yes, making websites secure requires work and maintenance and modernisation. The author even admits this. I think i'm ok with what's being lost in this transition.
If Trump Is Down in the Polls, Why Do So Many Americans Think He’ll Win?
I wish technical people would stop using the words hard and easy. In general use when developers use the word easy is it supposed to mean simple, convenient, done by somebody else, low timeframe, fewer steps, less research, faster learning, something else, or all of the above?
SSLv3 is deprecated and modern clients don't allow to use it any more. Old HTTPS servers, that predates TLS are already inaccessible.
Totally insane. Think about the bandwidth it might be able to support...
Remote Developer Jobs
From the narrow scope of web development, JVM is fine. Kotlin is able to have every ergonomic feature you'd want from a language, and it gets closer to the performance of C in TechEmpower than many other languages (notably C#, Node, and Python, three of the most popular languages).

Tuning can be a pain, but scaling anything is hard.
I think you should just report it to the RCMP and leave it be. Vigilante action can have unforeseen consequences and since you are a business owner, it's best avoided.

p.s. incorporate stronger authentication mechanisms (2FA) for your offering, if not already.
Data-Driven Modelling of Daylight Scattering by Roman Window Glass
If she wants to sell to enterprise Marketo is a good option because of the deal size / volume. Google uses it for selling Google Cloud Platform. Otherwise Hubspot is probably a better idea.
I think in this analogy the issue I see it that we treat a one-man hut and airport terminal the same. For some buildings it's fine to have higher risks than others.

Of course people would need to be educated on those risks, which would probably be the biggest issue.
That "antiquated" VM is head and shoulders above any other extant runtime in compilation, GC and observability. Not only that, most of the major innovations in recent years in those areas seem to be happening there. Moving from the JVM to almost anything else -- be it Python, Go, Erlang or Node -- feels like being transported to medieval society. Don't get me wrong, some find it liberating as in, huh, I turns out I can survive without my smartphone, but calling the state-of-the-art technological leader "antiquated" is taking it way too far. If you care about performance, productivity and observability, there really aren't that many alternatives out there, and whatever adequate alternatives there are, they are even more "antiquated." And guess what? It turns out that a great many people care about those things.
Dragon 2 lacks the grapple point necessary for the Canadarm to grab it (unlike Dragon 1, which did indeed get berthed using the arm).

Dragon 2 has already done an autonomous docking to the ISS, as part of the DM-1 mission.
⏳ 3 Years. No Income
Vienna’s Unique Social Housing Program
It’s more that you can’t live in a house now, you have to stay in a flat built and continuously maintained by others. Where before you could have built a simple, sturdy, and drafty castle that would stand for centuries, now you get a flat in a modern super-secure condo, which is very energy-efficient but requires constant maintenance not to crumble and decay.
> This is the very problem of certificates, because self-signed was never trusted and is not an option.

What I don't get, with DNSSEC getting rolled out more and more, why can't every site operator simply stick the fingerprint of their HTTPS cert in DNS and have DNSSEC take care of the trust chain?
>They already don't pay their employees, offloading that on to customers via tips.

DoorDash got in trouble for even taking the tips recently enough!
Small team lunches - 4 people, 6 people max, are great for bonding, since not everyone can go hang out in bars after work.
You cannot obtain certificates in the Web PKI ("SSL Certificates" that "just work" in people's browsers) for private names like this "friendlymachinename". Public CAs are forbidden from issuing anybody such a certificate.

Such names are a bad idea for a wide variety of reasons and you should definitely look to give the machine a name from the Internet's DNS (even if the machine isn't accessible in any way from the public Internet), but assuming you cannot or don't want to for now:

You can use a variety of thin "reverse proxy" services to just wrap the HTTP service as HTTPS. Many such webapps won't care that this happened, as the maintainer you probably have a good sense of whether it could work (does the webapp use Javascript that cares about its own URLs for example because that could be a problem?). HTTPS servers such as nginx are well suited to this problem. Security between the wrapping proxy HTTPS server and your PHP on IIS setup is still zero in this setup but that might be acceptable.
Same argument is also possible if the CEO/board/other insiders have a decent chunk of their net worth as options for the company stock. But in that case, the increase in insider net worth can be highly nonlinear as a function of the price of the company's share price.
Nothing wrong with a friendly face, its more that it can throw you out of your flow, especially when trying to debug some code. This describes it best:

https://heeris.id.au/trinkets/ProgrammerInterrupted.png

This for me is why WFH suits me so well. In my morning I get around 4 hours of pure uninterrupted coding (as long as I stay off here or reddit).
Besides Telegram, I have also electron based Rocket Chat and Slack (different teams, different apps :/) and all these apps look and feel very similar.

Telegram uses this non-native visual language which is very common in electron apps.
USB4 to Be King of All Ports at 80Gbps with DisplayPort 2, Dual 120Hz 8K Panels
You are right, just the timing and example is so striking :)
Just commenting to say that I feel similarly to you, and I seem to be the only one among my coworkers that feels it to this extent. Good to know that there are others out there.
Sure they are open source projects, but the majority of dev work is done on Google's dime. Google employs many of the most important people in these projects. Sure the code will still be there if Google gives up, but will anyone have the capacity to step up and maintain them?
We're looking into using local GPUs, but can't promise anything at the moment.
Goodbye accessibility.
Could you please point to a tutorial/howto on this?

EDIT: why on earth was this question downvoted? It was genuine, I honestly don't know how to do it.
The wages are indeed much lower than in US, atleast for me. However, I work in a company with a proper labour Union (IG Metal). I have 36 hours working time, any overtime will be paid 30% more than normal. I have extremely good health insurance. My kids get free education all the way to university ( and are part of my insurance until 24). The retirement is linked to the government, not the company. 30 days of compulsory holidays. Sick leaves are not counted.

With all this calculated, the salary sort of equalizes itself.
What is parallax view? What does this solve?
It doesn't "depend" on Lua at all, but you can definitely feel inspiration from Lua in the language. Has coroutines, tables, small and easy to embed as a design goal, has a LPEG-like PEG built-in. Really lovely if you can appreciate those things in Lua-land.
It is state of the art in the same sense that America is the uncontested leader in WWE.
I used to love GitLab, and I still do in a lot of ways but I will no longer recommend them.

If you're looking for a shiny pretty interface for all your users, then Gitea can serve the same purpose. Personally, I find cgit to look fine too. I think GitLab simply tries to do too much, and they've built their entire app on a poorly scalable and bloated tech stack.

I think SourceHut probably provides the best platform for teaching developers a more native way to use Git that provides most of the same features as GitLab. For CI/CD there are so many better options outside of GitLab that integrate into Kubernetes and you won't regret it.
Just to clarify, CLOS is very a-la-carte too.
Memorisation is also just not that useful in my day to day as a programmer. I mean, sure, it’s great when I know something off the top of my head, but I have autocomplete and reference material and an interactive shell and whatnot.

In uni, we had one particular class where we were supposed to study something like ten or twelve different concurrent algorithms in some weird concurrent language that I’ve forgotten and not seen since, and would be asked to write four of them out in the test and talk about them a bit. We didn’t know in advance which four, so most people tried to memorise as many of them as they could and hoped that the four that came up would be among them.

Me, being stubborn, thought that was too much effort. Instead, I learned the bare minimum about the language so I could wing it in the test and write it up myself. I already programmed as a hobby so thinking critically about problems wasn’t a big deal. My code was a bit weird, because, for example, I only learned the syntax for while loops and not for loops, so had to make do with what I did know, but it didn’t matter which four problems came up. The problem description gave me enough to figure it out. I got really good marks in that class and put substantially less effort into preparing for the test than my classmates did.

My point, I guess, is that memorisation is a stupid thing to optimise for (I guess it’s harder to design good tests that can’t be best beaten by memorisation), isn’t that useful in “real life” and is a lot more work than if you were thought the actual building blocks so that the students have a toolbox they can use to approach problems.
That would be nice, but not even wikipedia would use it.
Ugh, sorry to hear that! You could probably order online? There's loads of food suppliers, both retail and trade, that have setup online shops recently.
All of that can be achieved with CSP headers. But I think browser vendors will ratchet up their rhetoric and claim it's still unsafe and must be warned about because someone may learn which site a user visited.
Give them a minute - they're drafting an offer.

And when you counter, don't forget to mention how much a successful docking would save them.
Power to choose options environmentally friendly
Generally agreed. However there are two problems:

First: the more support you allow, the harder you have to make the test.

Second (especially relevant for the equivalent situation in job interviews / hiring): the student can hire someone to do the exam for them. (Or more casually: a friend can help.) There's no guarantee that on the job you'll always have that friend available, or are willing to shell out for hired help, nor even allowed to leak company secrets like that. So that hired help doesn't approximate real world conditions as allowing to look stuff up on Googe definitely does.
Please let me know how those two resources treated you and we can go from there. (Part of it will require that I know where you want you career to go)
Very nice!

This also has potential for landing in many movies where a hacker at work is involved.
Judging by the prices Xeon Phi coprocessors fetch on eBay, I'm not really optimistic about finding these floating around.
Windows XP came out in 2001.
While I personally agree with making the entire web run on https, I can definitely see the argument that it requires more monitoring and maintenance, especially when your certificate provider changes their protocol.

I wonder if there can be a future drive for a system where this is not required anymore, and where we can create a decently standardized form of encryption of the same or better quality as TLS, without being dependent on external services.
Tenders embracing renewable energy sources
> What I don't get, with DNSSEC getting rolled out more and more, why can't every site operator simply stick the fingerprint of their HTTPS cert in DNS and have DNSSEC take care of the trust chain?

This question is extremely relevant given how DNS-based authentication is the preferred way to authenticate with letsencrypt.

If DNS is good enough for letsencrypt to validate you and give you a cert, why can't DNS be good enough for the browser alone, without needing to rely on some third party service?

Letsencrypt has certainly made HTTPS easier in practice, but we really need to get rid of the whole CA-model entirely.
I agree with the author's points entirely, but I'm going to be the devil's advocate here and argue that this is fine.

Sure, old websites will stop working, but just as we shut down our FM radio and analog TV to make room for new amazing technology, and therefore rendered several generations of radio and TV devices useless, the internet will need to learn to live with the fact we can't possibly support its entire spectrum of functionality forever.

However, I see this as a tooling and ergonomics issue. Despite what people say about certbot, it is still not 100% trivial to use it. If your stack differs slightly from the canonical HTTPS server, you're gonna have issues. I'm not saying these problems are inherent to certbot, just that there is room for improvement.

Once we have normalized how certificates are signed and verified, and use encryption methods that can easily be tuned for increased computing power, and more importantly, once HTTP 1.0 is no longer an expectation, I believe the amount of manual work needed to maintain a server will go down again.

We're at a transition phase and we all know these are never easy (except if you're Apple and you're transitioning CPUs architectures, apparently).
There is definitely a glass ceiling for immigrants/expats in many companies in Europe.
Combo of fasting and vitamin C effective for hard-to-treat cancers, study shows
Ah,I guess context would help - "The Beer Store" is Ontario's [Corrected From "Canada"] monopoly province-wide beer retail chain.

You are absolutely right, a single retail store would not use such an ERP :)
Show HN: Passwords Fountain – password manager interface as a PWA
I've just created Passwords Fountain - simple, ultra-optimised, password manager interface.

It's basically PWA app written in Preact with the help of other micro-sized libs like goober.js (CSS in JS).

Whole codebase can be found here https://github.com/kolodziejczakM/passwords-fountain.

If you're willing to check how it works, then official instance is here https://passwords-fountain.com/, but you can easily create your own, even free of charge (you need only static site hosting).

I hope you'll like it and I'm opened to your feedback.
> As someone who doesn't have much training or experience from the field this felt great.

Oh boy, someone without experience is messing with the brakes of their car. What could go wrong? UX problems might turn out to be not the most important ones here.
Is it? I've looked hard and couldn't find any runtime that isn't more than five years behind OpenJDK(+Graal) in those areas, but maybe I missed something. I'm not saying it's perfect, but there's nothing out there that's better in those areas.
> No matter what some people say, getting started in Clojure is a nightmare.

You just need Java installed on your system, then you install clojure (via brew, or sh install) and that's it, you're good to go.

I've written a guide to starting with Clojure covering installation to REPL & IDE configuration: https://grison.me/2020/04/04/starting-with-clojure/
> If you are able to cheat so well that I can't catch you, it means you don't actually need to cheat.

Well, it depends which skills you want to test with your exam..
Zabbix and Netdata
On the software side, we're getting HTTPS churn now, because we've only relatively recently started taking it seriously, after over a decade of ignoring it. TLS 1.0 is from 1999!

Hopefully, we'll eventually figure out how to make a TLS stack without endless buffer overflows and padding oracles, so it won't be necessary to upgrade servers all the time.
Users are all about privacy and security until they realise they have to actually maintain their websites to achieve it, then it becomes an unnecessary chore.
How's the whole "I can unlock my trunk, and they can place it inside and close it" going to help?

If you're worried about exposure, someone still prepared your food, touched it in the kitchen, brought it out to your car...
Very interesting, I'm a beginner at Forex market, I've decided to start here because of good reviews: http://www.forex-broker-rating.com/instaforex Maybe this will be helpful for me as well, thanks.
Since when do you order parts based on plate number?

If you're using OEM parts rather use the VIN (or the make/model/year/variant) to look up the manufacturer part numbers for the parts you need. This is the only semi-fool proof way.
A Melting Glacier Could Redefine the Albert-B.C. Border
Tesla superfandom becomes toxic, negative for electric revolution [op-ed]
Identifying Bugs in Design
I tried to suggest something off the shelf to our place, as we have a lot of code and a small team. Our prima donna tech lead insisted that we need something custom for one small case (like everything) so we have Prometheus.
The work-from-home trader who shook global markets
Same idea as UVD Robots ( http://www.uvd-robots.com/ ) but UVD has this as a commercial product already.
Bio-IT Trends from the Trenches
So long story short, today's internet is all about big corps.

And there are always T&Cs. AKA we didn't like that article on your account, we kill all your services and deactivate your account.
A few interesting insights/theories in this (FiveThirtyEight weekly political chat transcript):

- the polls had Clinton as the likely winner in 2016 and Trump won — so, of course, some people are wary of the polls again., in other words, "once bitten, twice shy".

- there’s also a sense that Trump is Teflon politically

- ... the reporting that Trump staffers X or Y or various senators or GOP strategists think Trump is in trouble tells us little. I read those stories from May to October 2016, and they often turn out to be wrong.

- ... events still matter at the margins, and the margins could be decisive, considering Trump won because of about 78,000 votes in three states in 2016.

But, sadly, the bottom line for me is:

... people are correct to be uncertain about the election. We are still six months out.
This is super impressive, thanks for building and sharing it!
His last sentence:

> (At the same time this is necessary to keep HTTPS secure, and HTTPS itself is necessary for the usual reasons. But let's not pretend that nothing is being lost in this shift.)

So, to stay within your analogy: He acknowledges the need for new houses, but says that huts had a unique flair which is lost now.
Integrating REST API in ReactJS with Fetch and UseEffect
> In fact, Newsome's Executive Orders refer only to GOV § 8567

This is both false and irrelevant; it's false because Newsom’s 39 (to date) executive orders relating to COVID-19 (they are almost daily) reference more than just that section—i.e, the first, EO N-25-20 (3/12/2020), references government code sections 8567, 8571, and 8572 [0]; but more to the point it's irrelevant because while the EOs have some importance in state COVID-19 response, they aren't the shelter-in-place order, which is a Public Health Order issued by the State Public Health Officer / Director of Public Health on March 19, 2020 [1], citing Health and Safety Code Sections 120125, 120140,
131080, 120130(c), 120135, 120145, 120175 and 120150, which pertain to the power of the Department of Public Health to issue such orders and the obligation of local officials to enforce them.

[0] https://www.gov.ca.gov/wp-content/uploads/2020/03/3.12.20-EO...

[1] https://www.cdph.ca.gov/Programs/CID/DCDC/CDPH%20Document%20...
I don't think font geometries are copyrightable, only names.

In any case, the IBM PC fonts are horrendous. They should have gone with the sans-serif they used in their mainframe terminals.
In companies that actually manage to get to revenue, may be. But if you take together all the software companies, including many that have not yet and may never get to revenue at all, I think it would be much closer.
I use icinga2 with satellites/agents on nodes.
Satellites push their data, but the central node/master can still request an update.
I never liked working from home before this whole covid situation when the office had a lot of interactions.

But with the whole office working remotely, virtual hang out sessions, asynchronous communications, everyone joining remotely for office updates etc etc. I hate to admit it but I quite enjoy it now. I feel more productive. If a company sets up the right culture for remote work, it's not that bad.
Prometheus scales down very poorly for small teams. Other monitoring systems are effective in few hour of work and require installing only one component.

Prometheus requires a plethora of tools around it to achieve feature parity and plenty of manual work to create dashboards, alerts and so on.

Not to mention the need for custom exporters for each application (!), contrasted to agent-based platforms that have built in plugins and autodetect what need to be monitored.
It might be due to your home sitation as well. I have my wife and kids, so I have the opportunity to go and chat with them or grab some lunch. I remember when I WFH'ed on my own as a singleton and I did not like it as much, as I was on my own for a good 8 hours a day. We are very social creatures. You only have to look a prisons. You're surrounded by criminals, quite a few who are manipulative / hostile or just hard work from untreated mental conditions, yet the form of punishment is to place you on your own into Solitary confinement.
In theory there is the CERT DNS record type that could be used, but no OS/lib uses it unfortunately as prior to DNSSEC there was no way to prevent the CERT record from being manipulated/intercepted :/
Without a Vaccine, Herd Immunity Won’t Save Us
> never heard of anyone eating a dugong.

Hydrodamalis gigas will not be in the menu anymore, that's for sure.
That's literally how most of music production works. You torrent sample libraries, get used to a couple of genres that you do well, and then use the same tools all over again for every client.
I like that HTTPS forces you to actually care about improving and maintaining your website. Somehow, leaving your site alone forever to gather dust is considered a good thing. The author totally missed that one.

Yes, some sites serve basic content that can stay up forever without change (thistothat.com comes to mind as a good example) but it really doesn't hurt to force people to put a little bit more care into their sites.
A bit of automation can help with most of the 'cheating in the software world' you mention.

For example, writing code without tests can be caught with a coverage checker.

In my ideal setup, you would be allowed to bypass the coverage checker with a simple comment-annotation in your code.

The point is not to be bullet-proof, but to have the automation remind you to do the Right Thing; and to make doing the Wrong Thing something you explicitly have to go out of your way to commit to. Not just something that happens because you are absent minded.

(And there are lots of legitimate reasons why you might want to bypass a coverage checker or a linter. So an easy, but explicit bypass is useful.)
Impacts of statewide lockdowns on the United States power grid