skysight-inc/HackerNews huggingface dataset:
> Any triplebyte candidate that "closes the deal" should get opted-in automatically. Anybody without an ongoing work relationship, should get opted-in automatically.

Am I misunderstanding you? If you "get opted in automatically", then it's no longer opt-in; it's opt-out.
Another thing to mention is that TimescaleDB has much stronger ACID guarantees than ClickHouse. Which means you get more clear semantics for consistency
Geeks don’t dislike LinkedIn because the formatting isn’t right, they dislike it because of the dark patterns. If that’s the measure with which you’re trying to compete with LinkedIn, it’s safe to call this one a win.
> Any of them using this approach are just begging to have their talent pool drained

citation needed

> FAANG companies never did this

Actually it's allowed in 3 FAANGs that I know of.
Sure, and now they can keep track of those customization in a reproducible way, by keeping their docker file under source control. What is the problem?
What about work nobody enjoys doing? Who will do this work?
I am not a lawyer and this is not legal advice but ... I don’t think the European government has legal standing to fine triplebyte. Triplebyte doesn’t have offices, employees or customers in Europe.

A European visiting the US and interacting with an American business does so under the protection of US law, not EU law. This is complicated in the case of Facebook and google because they also do business in Europe, so European courts can fine their European branch offices. But Triplebyte has no such EU presence that the European courts could pursue. And they don’t advertise European jobs. I suspect an EU citizen interacts with triplebyte legally the same way they would if they went to a cafe in SF while on vacation.

The opposite would be crazy. If triplebyte can be fined by the EU, that would also mean the government of Australia or China or Russia could arbitrarily levy fines against any US company if one of their citizens interacted with a US website one time. And everyone would put geo blocks on their websites to protect from liability.
Your ISP, your phone carrier, your free saas platform you share misinformation on, the place you're posting this comment, these are all private companies.

Private companies can do what they want when it comes to censorship, if you don't like it, then fix it, otherwise, you need to learn that this is how legal precedence works.
The rumor on the street is that Zen 3 is a major upgrade with huge IPC improvements.

If that's true, Intel has basically nothing. All they've got left at this point is "I want the best gaming performance and literally nothing else matters". AMD may just win that crown too.

It's never been more exciting to be an enthusiast, and Intel was asleep for a long time. It's about time someone woke the sleepy giant.

Weren't we all sick of Intel churning out 10% incremental improvements every year on an entirely new socket every time? They were phoning it in for a long time.
Over 40% of Republicans think Bill Gates use COV19 vaccine to implant microchips
2FA (assuming TOTP, not hardware keys) prevents attacks using credentials leaked from side channels, but does not work in phishing attacks using a fake login form. The attacker just needs to channel the TOTP you entered into the real login form, and on average they have a bit more than 15 seconds to do so, which is more than enough.
In that case you'd do both yourself and those who depend on you for your contributions a favour by taking some of that time to get acquainted with alternative platforms seeing as how Apple seems to be on a course which will make it harder and harder to use their platform for this purpose. Like the Boy Scouts (used to) say, "Be Prepared!". Install a (few) Linux/BSD distribution(s) in a VM and try using those for a while to get a feel of the platform and its strengths/weaknesses so you have somewhere to land when the time comes.
A few nice little conveniences like IFF(). I like reading SQLite released because they seem good at avoiding adding cruft.
(The refusal to implement JSONB comes to mind.) Now if only I could get my shared web host to upgrade to a recent version...
My company regularly runs internal phishing tests like this, using an outside organization. We apparently have a near-constant 7% failure rate. Personally, I cheat: Long ago I discovered that the outside org puts some identifying headers into the email, so I wrote an email rule that adds "[PHISHME]" to the subject line.

The phishing emails are sometimes very good. They appear to be from senior management and address projects or other internal events everyone knows about. Some emails are very easy to spot, in the Nigerian prince category. It is very interesting that we have that 7% failure rate no matter how good or bad the phishing email is.

In general, I think internal phishing tests are a great way to educate the workforce.
The author miss-understands the paper for some call to formalise everything and then continues to ramble on how complex the world is and how futile formalisation is.

This is not what "Out of the Tarpit" is about.
Out of the tarpit is about a clear separation between the currently complected aspects of "what" do we want our software to do, and "how" do we make it do that with the best possible performance.
There is no arguing against that if you currently want to describe a website you'll have to learn some model of how the browser renders stuff, how react or vue or whatever performs update calls, and redraws, and state management and and and.

Out of the tarpit simply argues that these things are relevant but accidental to the problem that we want to solve, and proposes a functional logic-programming hybrid approach which focuses on declarative programming, separation of concerns, and immutable state management.

All of the above are pretty well known best practices by now, even though they're not implemented verbatim as the paper proposes there are still ideas that have found it into mainstream programming.

React is a functional reactive and mostly declarative library that takes care of a lot of state management for you.

Clojure is a functional programming language with heavy emphasis on simplicity, state management and functional programming, with logic extensions.

Differential Dataflow is declaratively describing computation and reactively executing it across clusters.

People rediscover the virtue of relational programming and write more SQL than ever, with ORMS becoming out of style.

If the author had argued that the proposals made in the paper are necessary but not sufficient, fine.
But arguing that it's "wrong", because they perceive that the sources of complexity focused on by the paper, are not as important as the ones they choose, is just silly.

He even makes the point for them, by quoting:

> There is no point in using exact methods where there is no clarity in the concepts and issues to which they are to be applied.

This is exactly what the paper is about.

"In order to program something, I should not have to formalise it to the degree that I have to formalise it currently.
I should not be forced to choose data-structures, and algorithms that I care about tangentially.

Those should be specified as an afterthought, when the need arises, and when performance, reliability, resource consumption become a concern."

This whole Post reminds me a bit of Tim Minchins 'Storm':

"Programming is full of complexities, yeah
But there are answers out there
And they won't be found
By people sitting around
Looking serious
And saying 'Isn't code mysterious?'
Let's sit here and hope
Let's call up the fucking Pope
Let's go watch Oprah
Interview Deepak Chopra
> Much of this stuff can be cached between grant requests, but some of it will inevitably have to hit the disk (or the network!) for a lookup—in the middle of a blocking syscall.

Running any kind of I/O during a capability check is a broken design.

There is no reason to hit the disk (it should be preloaded), much less the network (such a design will never work if offline).
We really should use a clever term like AAI,

artificial ... artificial intelligence.

(not to be confused with humans)
> Clicking a hyperlink is certainly bad.

HN must be a boring place if you are not prepared to click on external links.
Same here. It's annoying that a technical aptitude test that I took when I was a freshman in college might now be publicly viewable as a benchmark for my skills.

And I know the e-mail says that results will only be shared if you did well. But, if you have a profile on TribleByte and there's no signal on your profile that you did well, the only logical conclusion is that you did not do well.

I'll be deleting my account, anyways. I didn't ask for this.
This is quite awesome!
>The fundamental disconnect here is that Ammon seems to think this data belongs to him, for uses he deems appropriate, rather than belonging to his users.

This is the reason why I ultimately like GDPR: the foundation is that the user owns their data and not the company that has it on a database server.
Thanks for mentioning https://en.m.wikipedia.org/wiki/WebAuthn According to Wikipedia Dropbox supports it. Any other widely used adopters? Need to check whether gitlab supports when I am at my computer. So it might well be that they even mandate it for their employees. But the statement or at least the part of the statement that made it to the article was not that specific.
With face-id and password vaults, I never need to enter passwords :D
> Email clients often do things like load images, which can tell the sender you've read the email, which is an information leak.

That makes it less than ideal, but describing it as a ‘failure’ isn’t going to help any users pay more attention to phishing mails, because they get tons of legitimate emails with images in.
> What makes you think anything on your TripleByte profile was ever "private." It was not. It was merely hidden from the majority of the world. If you have a TripleByte profile, presumably, at some point, you were job hunting, and likely advertising that fact to anyone you thought could help you.

Are you arguing for this change? Whatever the argument is seems to be based on misinterpreting 'private' as 'known by no-one else'. Exactly the same argument could apply to e-mail: it's not private in the sense that no-one else sees it, just hidden from the majority of the world; presumably, when you sent it, you were advertising what it said to the recipient.
Most of the apps that sell well originate from a developer solving a need they had, on the system they were using.

If this drives developers from OSX to other OSes, chances are they will develop apps for those OSes first.

Apple is too big to fail at this point, but driving developers away from your platform isn't a very clever strategy. You never know when you are going to hit a tipping point, and after you notice and people stop using macosx for development its already too late.

It took me ~150 hours to migrate to Linux, but my user and developer experience on Linux is much better than on MacOSX (emacs daemon "just works"!!!), so after all that work I wouldn't consider switching to OSX in the next 5 years at least. I had a Macbook air 2012, and because Apple still hasn't released a laptop that isn't a downgrade from that in some sense (keyboard, magsafe, ...) I've went with a think pad instead. Tiny details, like having a webcam that doesn't suck now prevent me from going back to OSX.
This is explicitly mentioned in the FIRST sentence of the article.
That's both unfortunate and infuriating.

Are there other hosting options? Vimeo, one of the podcasting "networks", or even a terrestrial radio station which has online archives?
First? Windows SmartScreen has checked for malicious binaries since Windows 8.
> Phishing emails often look pretty obvious - that’s part of the program! It filters out people you can’t trick and leaves you only with the most gullible ones.

For frauds that requires the attacker to spend time with the victim, sure. For a fully automated phishing attack? There is no reason to lose out on people early on.

And for a targeted attack against a company? Makes even less sense to make it obvious.
It sounds like the most relevant thing to discuss too, and guessing that is always a good exercise too keep yourself on your toes. Large institutions mask often mask their intentions in ways very difficult to figure out, so maybe a thousand people can put it together. It sounds like misplaced effort only as long as nothing comes out.
Gitlab.com has used U2F/WebAuthn for years (not sure which, but they're both isolated by origin anyway).
I agree that adding new dependencies on external central services, or things that need to be centrally coordinated, is something we'd generally want to avoid, unless adding the dependencies gives us a lot of value in excess of the costs.

But, isn't there's a difference between needing to centrally coordinate a common protocol vs central management of state of individual tokens? JWT protocol itself can be regarded as some centralised definition of how different services agree to interoperate with JWT tokens, that all token producers and consumers must implement. It doesn't logically follow that we need a distributed DB that must be queried at runtime when processing tokens to implement JWT support. Similarly for nonstandard variations on JWT protocol that are independent of the state stored in any given token -- all services would need to embed some library that can understand the new (centrally defined) protocol, but there would not need to be any dependency on an external database at runtime.

Even with standard usage of JWT tokens, does there not need to be some degree of agreement and coordination between token producers about what a particular scope string means & agreement between different services in the same ecosystem not to use the same scope string to mean two completely different things?
Link to paper (PDF): https://www.nature.com/articles/s41467-020-16265-x.pdf
In theory, sure. In practice everyone is clicking on links all day. If someone is has a 0-day, employees manually checking domain names on emails is not going to stop them.
I think that the article is missing a major point: cultural and soft skills !!!

In a ideal world, coding would be just using some fully specified langage to implement some fully specified specification or feature. However, in real world, a lot is left implicit and the programmer (not talking about more client or contractor facing position, like project manager) will fill the blanks with its own culture...

And that's the moment where living in India, Turkey or US will make a difference ! Not on specific coding skills but on a more general cultural appropriation

In fact, after a lot of offshoring, some companies brang back the jobs in the country because the friction were annihilating the cost gains

So I don't think that the worker pool will grow that much, internationally. However, the competition will grow more inside the different countries, between urban and countryside... and it will be a race to the bottom : why would any company pay 20, 30, 50% more for the same job ?
This is not a great substitute for installing through an app store because the app will not update automatically.

This is, however, a great thing to have.

A better substitute would be using F-Droid. By the way, some free software apps are not gratis on the Play Store but are on F-Droid.

It can still be confusing to manage two app stores for some people, while installing an app from a downloaded executable is usual on Windows, so Krita probably did the right thing.
$50.
People Share the Biggest Loophole They Completely Exploited
The search space of possible code is unfathomably enormous. I think you'd have better luck generating amazing art with random colours for each pixel (i.e. still none).

People have done more limited genetic programming for a long time now (essentially randomly mutating formulas, keeping ones that do better), but neural networks are doing the arbitrary function-fitting better at the moment.

What does it have to do with Nix, though?
Ask HN: How do you brand yourself as a freelancer?
I'll quit my CTO position in a few months to become a Freelancer.
I know personal branding is an important part of the job to get customers.

In short: what do you do for that?

* Where do you ensure to be visible? LinkedIn, personal website, etc?

* Do you create and post content (blog, LinkedIn groups, etc.)?

* What content about you do you emphasize to find leads?

* Do you use your own name, or a company name?

* Did you chose to brand yourself a generalist Freelancer ("I'm a developper working with X and Y languages") or a specialist one ("I can be a CTO as a service building your MVP for your startup and help recruiting and train your team")

Thanks for sharing your tips and experience.
Abstract:

> Micro-combs - optical frequency combs generated by integrated micro-cavity resonators –
offer the full potential of their bulk counterparts, but in an integrated footprint. They have
enabled breakthroughs in many fields including spectroscopy, microwave photonics, frequency synthesis, optical ranging, quantum sources, metrology and ultrahigh capacity data
transmission. Here, by using a powerful class of micro-comb called soliton crystals, we
achieve ultra-high data transmission over 75 km of standard optical fibre using a single
integrated chip source. We demonstrate a line rate of 44.2 Terabits s−1 using the telecommunications C-band at 1550 nm with a spectral efficiency of 10.4 bits s−1 Hz−1
. Soliton
crystals exhibit robust and stable generation and operation as well as a high intrinsic efficiency that, together with an extremely low soliton micro-comb spacing of 48.9 GHz enable
the use of a very high coherent data modulation format (64 QAM - quadrature amplitude
modulated). This work demonstrates the capability of optical micro-combs to perform in
demanding and practical optical communications networks.
La política de la mentira
Google, GitHub, GitLab all support it, at least. Azure AD, notably, does not.
That’s not fair. Much of what gives art its value is its usefulness in money laundering..... arbitrarily high-priced items with no inherent value are staples for legitimizing cash transfers.
You're observing the effects of this: https://blog.chromium.org/2020/03/updates-to-form-controls-a...
> The general trend toward returning computing to the edge

By "the edge", do you mean users' devices, or just more local data centers a la Cloudflare?
You mean our modern super-computer level machines with gigabytes of RAM and GHz level processors can actually show basic animations at 60 FPS!? Wow!

RIP native development, long live non-native native development?
Not really.

Someone told me they did the same thing at his company, send out fishing emails to see who fell for it.
Those who did (management was disproportionately represented) had to attend some training lessons.

They resent another phishing email a few months later.
Most people who fell for it the first time, fell again, despite the training.
> The email client is specifically designed to be able to display untrusted mail.

No, they weren’t, which means chances are you are using one that wasn’t.

> web browsers are designed to be able to load untrusted content from the internet safely

Yes, but they aren’t perfect.
Broke students cash in after discovering ‘Amazon voucher glitch’
This would be interesting if I could read it. Would it be possible to display text without enabling JS?

I have read several IT books recently and they aren't good. Basic stuff like visibility of diagrams, presenting advanced subject matter but also supposedly in a way that will teach you programming, or having pages of code to illustrate something trivial.
Qubes awarded MOSS Mission Partners grant
All they've got left at this point is "I want the best gaming performance and literally nothing else matters".
For the average person maybe that's all they've got left.
But technically their are still ahead in some interesting ways when we look at x86 extensions:
By decreasing order of impact:
AVX 512
TSX
SGX

Their next architecture could bring bfloat16 too but I wonder how useful that would be on a CPU instead of on a GPU.

AVX512 and TSX can give Intel a BIG performance advantage in some niche (but foundational) applications
Well I live in France and will certainly not send them my ID. Lets see how they respond.
Cant wait for the next Pentium M from Intel to beat this Ryzen thing
https://endrainc.com/
This technology can have a huge impact on people's lives (specially in the global south).
Show HN: ESP8266 RGB LED strip. Try it out with live cam (look for RGB widget)
Wow... Budapest is a such a visually appealing city (great all round really) that you’d have never thought it was this bad during WW2.
Is this newsworthy? My company does this very regularly, and the phishes are well crafted convincing.

20% seems low if they're reasonably well put together emails. In the wild there's plenty of badly made, easy to spot phishing campaigns but one would hope any decent Red Team could put together a good one.
Corregidor Island Tour
The supplementary advice (which I guess is left out of this post for brevity but which I've heard PB say in public talks) is that you should work very very hard, both before and during the dev project, to determine what those three key attributes should be. It can change over time.

In the case of Gmail, he spent countless hours sitting next to Google colleagues at their desks, watching them use MS Outlook throughout their work day, and asking them why they were using it the way they were and figuring out what could be improved.

Then when he had a first working version of Gmail, he'd get people to use it and watch intently to figure out how they responded to it, what they liked/disliked, and how it needed to be improved further.

(The first version was mainly just a search box for PB's email inbox. The first thing he was told that needed to be improved was that it should be able to search the user's own inbox instead. But it was still a useful test; they loved the search experience enough to want it for their own inbox.)

Anyway, there was every opportunity to chop and change what the three key attributes should be along the way; the point is to not try and be all things to all people and build every feature anyone ever asks for, lest you end up with your own equivalent of the Homer car.
Check this out. You can see and even create playlist of your top Spotify tracks
There are a couple of websites that will let you see your top tracks. But this one also let you create a playlist of them. Really cool!!
Right, according to https://en.m.wikipedia.org/wiki/Universal_2nd_Factor it's U2F. So I would not be surprised if gitlab requires their employees to use the dongle instead of simple OTP which they allow for customers/users. A shortcoming of the article not to mention whether that's the case or not.
The Murderous Legacy of Cold War Anticommunism
The point is to recognise the email/situation as phishing or otherwise malicious before deciding to click the link. The chance of clicking a malicious link on HN is pretty low if you stick to the front page.
NYT is not even stopping me sending newsletters even after unsubscribing multiple times.
Like the Sigma Male

the introvert side of alpha

perhaps INTJ/P type ...

https://www.youtube.com/watch?v=3i_USBo4vBs

https://hackspirit.com/sigma-male-11-things-they-do-and-how-...
There’s a fundamental difference between HN links and links in targeted emails. I cannot start phishing GitLab employees using HN posts, the threat model is just different.