skysight-inc/HackerNews huggingface dataset:
> It's important to note the nature of the failure.

Definitely! UCSF had a security firm send out a fishy-looking fishing email. My email client pointed out the url did not match the link text, whois told me it was a security company, and I opened the URL in a VM.

“You just got fished!” eye roll

I wouldn’t be surprised if most of those employees at gitlab were not so much fished as curious.
There is a way! Kinesis has a 60 day return policy if you buy directly from them.

[0]: https://kinesis-ergo.com/support/returns/
Show HN: Master SSH tunneling in an interactive lab
A little over a year ago I gave away over 4,600 copies of my intro to SSH tunneling book, The Cyber Plumber's Handbook, for free over a 48 hour period to the awesome folks here on Hacker News (https://news.ycombinator.com/item?id=19946941).

Since then, I've been getting a lot of feedback about creating an interactive lab where SSH tunneling and port redirection techniques can be practiced in real scenarios. With a bit more time during the quarantine, I finally found the time to launch the lab portion. For the HN family, I'm offering the book and 2 weeks of lab time for 50% off ($19.99) with this Gumroad link through May 30: https://gum.co/cph_book_and_lab/hackernews20200523

Why learn SSH tunneling?

SSH tunneling is a skill you can use for the rest of your IT career. SSH tunneling and port redirection are skills that can be applied in any information technology discipline, so it does not matter if you are a network engineer, red teamer, penetration tester, developer or something in between. That being said, the examples tend to skew towards pairing tunneling techniques with penetration testing tools (including Metasploit).

Lab Overview

Four jump boxes provide the Internet facing portion of the lab. However, the fun really starts when you start leveraging tunneling techniques to reach the internal side of the network to access services such as Secure SHell (SSH), Web, and Remote Desktop Protocol (RDP). The Linux and Windows targets are also running vulnerable services that can be exploited for the true tunneling ninjas. Each of the exercises has a brief description and solution to assist you in the event you get stuck.

Happy Tunneling!

Brennon
Sadly, css/html hyphenation is still pretty awful. And AFAIK on mobile kerning is pretty far off too. So to me it feels more like a latex parody than homage, unfortunately.

Additionally, it took a long time for Chrome to even implement:

https://developer.mozilla.org/en-US/docs/Web/CSS/hyphens

https://www.chromestatus.com/feature/5642121184804864

Sadly, even with auto, there's way too much ragged right in html, or too irregular word spacing. Even with tricks like inserting soft hyphens.

A list apart long held up the pretty much gold standard, but it's still not as good as plain latex (not sure about plain tex, as I've never had occasion to use it).

See also:

https://alistapart.com/article/the-look-that-says-book/

Unfortunately it appears the current ala styling is worse than it used to be (probably due to a move to use modern css, which is understandable - but only highlights the problem).
Do you have a repo by any chance?
I’m a couple of weeks into using a single giant (32”) monitor at macOS’s 3k resolution, and I’m finding it works pretty well with a 3x2 set of windows for code, terminal and docs. The center third is usually a single emacs window with two frames, web browser on the left, and inspect window or terminals on the right.

I’m also really liking the usb-c power delivery, so it’s one cable to the work laptop, and from there, it’s got a usb hub for the kB/mouse.

The killer feature is the built in KVM switch, so by switching the input to hdmi, I can switch the keyboard/moose to my mini and use it when I’m not at $day_job.
Quite sad, company providing calc tools to learn .. most probably aiming at future tech heads.. bashes on guy who does tech.
Thanks.

I'm just letting the author know.

FWIW, I watched the podcast (with auto-translation) and it's pretty good IMO.
Auth0 is only $23 per month to start with. That's not a lot for my use case.

I would have preferred to keep everything in AWS just to make it easier to use one set of credentials (IAM) to manage permissions.
The expectation of privacy came from the fact that this is a recruiting platform; even mediocre recruiters know that discretion and privacy are critical since leaks about job searches can get people fired.
Any diagram like this should include an estimate of usage, and how much that usage will cost, for every "block of architecture" displayed. Absent that, it's impossible to tell whether it's a good idea or a bad idea.

Moreover the cloud providers should make it harder for an uncontrolled "block of architecture" to accidentally spend too much money. The focus seems to be on "always available", but depending on how fast it's spending your money, it might be better if it crashed.

Expanding further, perhaps each "block of architecture" should have a separate LLC dedicated to it to control billing liability. Incorporate your "lambda fanout" to keep it from bankrupting your "certificate manager" when it goes haywire, and let it go out of business separately.
High level developments:

* AMD introduced their Ryzen architecture ~3 years ago. This was the first time in years that their chips were competitive with Intel chips.

* AMD's newfound competitiveness forced Intel to increase core counts in their consumer chips. 6 and 8 core chips are now extremely common in the consumer space.

* AMD has released consumer chips with as many as 16 physical cores (32 threads) in their most recent generation. This is a huge improvement for tasks that scale well to multiple cores like (I presume) 3D animation. Intel has 10 core consumer chips out.

* If you're willing to move up to the HEDT chips you can now buy an AMD Threadripper chip with up to 64 cores (128 threads).

* Intel has struggled to make the next step in manufacturing. Their desktop chips have been stuck at 14nm for half a decade now. AMD contracts their manufacturing out and has been able to take advantage of other foundries improved processes. Their current chips are using 7nm process nodes and use significantly less power than their Intel counterparts. Because of this they require less extreme cooling.

* There are some new instruction sets such as AVX and AVX512 that can improve performance in some software. I'm not an expert there and you'd probably want to do some research on sites related to 3D rendering to see which chip would perform best for your needs.
Ask HN: What are your favorite IRC channels?
I know all the cool people are on Discord but where are you spending time on IRC?

Also what are your favorite IRC clients or tools you use?
> E.g. when using keyword lists for function options, callers need to pass the keywords in the exact same order.

This would've been fixed by creating a map from the passed in list, which would remove the order dependency but still keep the ergonomics of a keyword list, or just querying the keyword-list with `Keyword.*` functions. Not that big of an issue, to be honest, and not a showstopper. There are much bigger issues with the language, but Ruby doesn't offer any upsides in those cases either.
Is the handshake all that is needed to verify? Is the data you're expecting sent during the authentication phase of the handshake?
The progress of PV technology over 3 decades means it's probably cheaper to recycle them for raw material and build out new PV.
> You should still have tests, but IMO tests that are just checking that a string is a string are

The correct completion to this sentence is "irrelevant.", because that's not what anyone is proposing.

The fact is, behavioral tests catch a lot of type errors even without intending to, and more to the point, if you test all the behavior you care about, then you don't care if there are type errors, because they only occur in situations where you don't care.
yeah the article says 10 out of 50 entered their credentials, which is the same as the headline
A well organized and understood single binary always beats a bunch of decoupled systems nobody can untangle fully, this is not rocket science. It’s why we started coming up with tracing systems like Jaeger and OpenTracing to merely figure out what happens across different domains and code boundaries. The skill is in making changes that accommodates both current and future business needs as well as future developers. If your random CRUD app isn’t understandable without a PhD in a niche domain, you need to decide if that’s a feature (HFT perhaps?) or a fault (99%+ of commercial CRUD apps).
> There was a talk back in January which made headlines due to its claims. https://www.youtube.com/watch?v=8SoJR3sCaR4

That talk has 3194 views at the moment. That's pretty obscure.

> Using your same link, you can turn off the optimizer and see that it follows C calling conventions--mainly so the debugger can follow each step.

If you change -O0 to -O3 you will see a lot of stack traffic, that's true. This has nothing to do with calling conventions -- there are no calls generated for the intrinsics. Rather, you just see stack traffic because GCC doesn't try to do proper register allocation at -O0. Nothing to do with intrinsics.
Try being less dismissive, you might be happier and make others happier while you are at it

Guaranteed good performance (the bit you picked up on) for a feature people want in an easy to use package sounds great. Well done the author and thanks for sharing your work.
I live in Tokyo, and I just want to point out that the voluntary compliance with the "request" to limit how much you go out appears to be better than the compliance with legally mandatory lockdown in California, which itself is far better than most other states in the US.

Yes, "businesses from restaurants to hairdressers stayed open", but most of them that I've ever used living here closed. Almost none of our restaurants (meaning the ones we used pre-COVID19) are open, or only do takeout. None of the places my kids have ever gotten their hair cut are open.

So I think this article might be placing too much emphasis on what the government mandated, and not enough on what people and businesses actually are doing.

I was watching TV news and they were naming and shaming pachinko slot-machine parlours that refused to close — and it was like 4 of them.
Not sure about parent’s case, but I’ve used it for small blog-type applications where the only writes are from me (the admin) creating new entries. The rest is read only and behind caches, cdns, etc. The blog is effectively a singleton. Analytics and comments are handled by 3rd party providers.
His monitor resolution is unnecessary AFAICS.

I have one, also 31.5" which is 3840 x 2160, without any scaling, and the text is sharp as fuck. Given my experience the only thing I'd do if I bought another monitor given what I know now is to buy one same res but larger because 3840 x 2160 is a lot of pixels in a small space. A single black pixel on a white background from 60cm away is very, very close to invisible (just tried it).
At what point do you just run a "normal" application instead of this giant spaghetti mess? Is this really cheaper compared to ecs or eks? What do you get out of this?

This can easily be 1-2 very simple services.
My company (big Valley corp doing robotics) does exactly the same, and it's very good at it: if you get phished, you'll automatically get signed up for a long and tedious training.
Learn MongoDB in 15 min using Python MongoEngine
What's the Raspberry Pi for? You put a Raspberry Pi in the picture and you don't tell us what it's for. That's like total cruelty. ;-)
Modeling your domain using types and checking your types are two different things.

Could you explain where you think the Elixir type system falls short for modeling domains? Your post only gives examples of problems with type checking.
Thank you, Austin!

BTW, not sure exactly what you mean by cross-half mixing, but I'm assuming it means mixing both halves of the 128 bit state with each other. There is that, on 3 lines 91[0], 100 and 108.

The 128 bit mix, stirs two adjacent blocks of 64 bits. Those 3 lines can mix blocks 1 & 2.

Subsequent mixes on either half then propagate that cross mix. So it does use the full 256 bit state.

Is that what you meant?

[0]: https://github.com/cris691/discohash/blob/master/src/discoha...
It is concerning that big companies have such undue influence on industry and engineering of an individual who legally bought a product, and was not in any way stealing it.
So you think it's great they don't have to depend on anyone else, but that they should still for some reason be interested in someone who, by your own admission, doesn't have a clue about "that industry" and has nothing at all to offer to "get shit done" (whatever that is supposed to mean)?

And you're confused why these people already making lots of money by and for themselves aren't interested in yet another random guy selflessly offering to "help" them, and think it can only be the fault of "creeps" (people more likely to be supporting the performers, and not just looking to make money off their backs)?
...as if "retina", a marketing term, meant anything in particular other than "higher-than-usual density".
If you can live with switching between different applications rather than windows, this is the default behavior on Windows 10 and Gnome 3 using win+1, win+2, ….
Are they really moving in that direction, though?

An App Store from which you can download software with confidence is a pretty sensible first step for most users.

Complementing that with a Notarization service for apps that can't live in the App Store, while still giving both users and developers confidence that the user is installing the "real" app, and not something malicious, seems like a pretty sensible way to protect most users outside the App Store.

And if all else fails, there are ways to allow running that un-Notarized, non-App Store app that you're sure you trust.

None of that seems like something that inherently means to take away your ability to run what you want on your PC, it just sounds like a common sense approach to giving your users confidence in what they run, and guiding them to do so safely by default, while allowing overrides as needed.

Are these ALSO things that Apple could use to lock down your PC completely?

Sure... but then, why bother with any of it if that was the intent?

They already have Mac App Store, and they already have the infrastructure to deal with a "whitelist only" approach, so why bother with this Notarization and Gatekeeper stuff at all?

Don't get me wrong, there's plenty of room to criticize Apple for their implementation. They are clearly figuring out some of this as they go, and trying to find a proper balance. That isn't easy, despite how many people make it out like it is.

Give the average user too many prompts or chances to override security, and they will do that, every time, without thinking it through.

On the other hand, bury the overrides too deeply, and risk making things miserable for the developers and power users who need to use your platform freely.

So far, I see only evidence that Apple is trying to find that balance, but no evidence that they intend to lock the entire platform down entirely.

Are they doing it perfectly? Clearly not. But I think if we're being honest, no other platform has either. I appreciate Apple's approach the most so far, but time will tell if they are able to figure this balance out or if another platform will at some point.
I mean more stuff like Devise for authentication, Apartment for multitenancy, ancestry for hierarchical data, etc. Seems like every common problem has a gem that solves it. Does Elixir/Phoenix have equivalents?
Why are there 12 notes in an octave?
Are there any public interest organizations that would pay for the countersuit in order to preserve users' freedoms?
Personally, I like the Microsoft approach of having backwards compatibility forever in Windows, until the end of time.

They could have made 32 bit support slower, and gone through a virtualization layer.
Your SO account was also never private, didn't contain "test scores" for job skills, and was never a repository of sensitive information about you that you only allowed them to have because you trusted them to keep it private.

I've seen some epic CEO fuckups but this one is special.
A bit of a translation barrier so I'm not positive but the company advocating this appears to be an agency that builds things for multiple clients. For that case it makes more sense to split out capabilities like that so they can easily pull them in like Lego blocks to other projects. For everyone else I'd advocate starting with a monolith until you need to split things.
Mostly because mirrors aren't perfect.

Let's say if a mirror can reflect 99% of the light that hits it, and we shot it with 1kw laser. That means 100w is still heating the mirror and it might melt or shatter it.
Microsoft effectively forked Linux here -- some pieces such as integration with the host NTFS filesystems or Direct3D support are unlikely to ever be upstreamed. Yes it's Linux, but not really.

Another way you can tell it's not actually Linux: if something is acting up, where do I inspect the source code? Where can I send a PR if I come up with a fix?

It's smart that MS bought itself a Linux foundation platinum membership; that probably goes a long way in preempting trademark claims of the 'Linux' name.
Regarding HN’s policy on discussions of YC companies: https://news.ycombinator.com/item?id=23280121

What 'nabilhat is talking about is the way the Triplebyte CEO’s comments in this thread (which are the opposite of “highly critical”) are being downvoted to very light grey.
Intel has had serious yield issues for their top-end chips for the better part of a decade, so that will also affect pricing. Everyone from ARM and Qualcomm to AMD and nVidia has been able to successfully step to new process nodes with acceptable yields where Intel struggled to hit the same node steps.
I'm not making a claim about all languages, I'm talking about languages that support any kind of extensible type validation, whether statically or at runtime.
How does a person get started in paid technical writing? I’m especially curious about getting paid to write books about programming topics.
Hospitals, nursing homes seek more liability shields
You're halfway there.

What's really happening is that the headline writer knows what wording gets clicks.

They're not fools. Their job is just different from what you think it is.
Yeah, #3 sounds like an invitation for abuse... keep submitting work designed to trick rights holders into submitting claims until you get three. If you have infinite chances, you will eventually get them to strike 3 invalid claims.
>It “phone’s home” only on first run.

Do we know that? The cache may well have an expiration date. Does the cache stay after an OS upgrade? I suspect further research will discover it's not just 'first time'.

>They can have your IP address but another mechanism would be needed to relate that to you.... if they wanted to do that they would surely use a more capable mechanism.

The app profile would already tell a great deal. Once enough of these 'non-capable' surveillance mechanisms add up, you end up with a very capable surveillance mechanism.
This is the modern equivalent to gunboat diplomacy, frankly.
I don't know about the curve, but deaths seem simple, don't they? You look at those who died and figure out what killed them. Especially when you do not have a giant number of them, that sounds very much doable and would get you a pretty exact count.
Indeed, these claims have no merit and can be safely ignored.

...provided you have GREAT legal representation.

Absent that, the best you can do is apologize for the wrongdoing you have committed and comply with ALL of the claimant's demands.
https://www.nidirect.gov.uk/articles/your-rights-if-your-emp...
NI but it should be same across the UK.
I've done both, much more Rails than Phoenix, but I'm not doing any new development in Rails.

I do regret choosing Elixir at times for the following reasons:

1. I am new to the language (I've been using it for "years" but only very part time (not part of my day job)). While the functional approach does lead to much more elegant code, it can also be super esoteric to me as I'm new to and somewhat uncomfortable with the idea of recursion for everything. There are pre-written macros to help of course, but it's just training wheels. This will improve with time and experience. I also don't fully grok how to write my own macros. What I really need to do is spend a couple of days deep diving until I get it.

2. Phoenix is changing quickly (tho slowing down). I wrote some stuff if Phoenix 1.2, 1.3, and the upgrade path is a bit involved (no more so than a rails upgrade was tho). I suspect it's stabilizing, but when I first created one project it used brunch for assets, now it uses webpack (which is a good choice, but as a non-frontend person I'm not well equipped to make the change myself to upgrade my project). 1.3 (IIRC) also dropped models, so that required some refactor to work as a 1.3 project.

3. Deployment changes quite a bit. The old rules for Ruby go out the window. You can still treat your Phoenix app like a rails app if you want, but it's like buying a Ferrari to drive around the neighborhood at 25 mph. This takes some learning, and while much of the old rules about scalability, etc are still applicable, they do change a bit and it requires making new mistakes and learning from them.

4. I get irritated now when working with non-functional code in other languages. My tolerance for side-effects is down to nearly zero, and I get irritated when there's a dozen lines to do something that in Elixir is a couple of pipes.

That said, overall I much prefer Phoenix/Elixir. None of the downsides are the fault of Elixir, so I believe with time It'll be a no-brainer. I am already at the point where I don't start any green field projects in Rails (tho I do use Ruby extensively for scripting as it's by far the best scripting language IMHO).
> Type systems are really a set of comprehensive tests you don't have to write yourself that cover a subset of the things you need to test for.

Maybe in a very strongly-typed language, but having used a pretty wide variety of statically-typed languages, I can confidently say none of them had strong enough type systems that the assertions made by the type system could be considered "comprehensive". You still need a test suite.
Electro-optic conversion is expensive in terms of power, so you better be sure it's necessary. There are still some people looking at hybrid computers with both optics and electronics. To be practical, you'd need both to be realized in the same platform, but they don't exactly work on the same scales, and laser integration is a big issue.
Big Transfer (Bit): General Visual Representation Learning
How is your company training employees for a remote work scenario?
Many companies look at financial and talent benefits from remote collaboration and some like the Zenefits CEO are calling out the end of 'office centricity'. But how are people training their troops to adjust to this shift?
VM escape exploits are a actually used in the wild, so yes, if that was on your work machine, you failed the test.
Isn't CBPV more of a way of accounting for both strict (call-by-value) and lazy (call-by-name) evaluation in the same programming language? Not sure how that would help wrt. static memory management.
I have yet to find something that works better than medibang for all around doodling on phones and tablets. However, I'm excited to keep an eye on this as well.
Also, most HN profiles use pseudonyms. the profile might be public, but the connection to a human being isn’t.
Yes, we will find ways to spoil the gains arguing it doesn't matter.
Every MMU-less micro lets you read address 0.
What problem do you have connecting to SMB?

It's one of the things that work better for me on Linux than on MacOS (no problem with browsing shares, no disappearing shares, no problem with non-normalized unicode filenames).