skysight-inc/HackerNews huggingface dataset:
The difference in when the error is flagged is a large difference, though. Usually, runtime semantic errors won’t be flagged until the program tries to actually perform some nonconforming action. That lets the programmer work on unrelated issues by simply not exercising the defective path.

Compile-time errors, on the other hand, ensure that the entire program meets some baseline of correctness before any of it is run. Neither is necessarily better or worse than the other, but they are categorically different things that have their own effects on the experience of writing programs.
Looks pretty good. Looks like a good compromise between Prisma [1] and pure pg.

Also the way you show examples is one of the best I've seen so far, with the output right below, optionally showing imports imports and the option to show it in a monaco editor with types.

Could you also compare it to Prisma and Mammoth [2]?

[1]: https://www.prisma.io/
[2]: https://github.com/Ff00ff/mammoth
Show HN: GoTutee, Education Marketplace
Show HN: Easy Filters – Quick and Powerful Photo Editor
Our company informed us 2 years ago that they will be attempting to phish us continuously (no frequency specified).

If you fail, the last page is corporate training on the topic.

I was so inspired to not have to do corporate training, that I assume everything is a scam now.
UofC academics at odds with each other over using SAT scores to admit
How about if you just always have a profile?
I'm not in favor of unlimited free speech. I'm in favor of limiting speech that is intended to harm, knowingly mislead, or spread hate.
We thought maintaining two platforms was too much, so we got React Native.

Now we have three to maintain.
> Why do so few software projects ever reach a state that's considered "finished," anyway?

I know you said "so few", not 'none', but let's take a minute to acknowledge TeX here.
Yyyyeah, but you do end up duplicating potentially quite a lot of code, especially if you're following the (IMHO nice) "fat models" approach.

I think a few people have thrown around the idea of creating a frontend to sqlalchemy to allow it to understand django model definitions and QuerySet semantics but I don't think anything's come of it.
Yeah, sleepers make up a large if not a majority of many recurring revenues. I once worked at a very popular online service where I was in charge of the payments team. We had many ways to subscribe or upgrade, but to cancel it online was possible but very difficult. The cancel option was hidden under many clicks and dropdowns. That was mandated from C-level management even though we kept imploring to allow us to make it more obvious.

I think the majority instead contacted customer services to manually cancel it. Some also did a chargeback, which companies hate as it is expensive.

But in the end, there were so many sleepers that every time there was a plan to email all customers about an offer, or new service, it was always raised that it might make a lot of customers aware that they have the subscription, or check with their kids if they still need it, so sometimes the mailshots were filtered to active members, or just skipped all together etc. It was an uneasy balance of "don't touch", and never felt nice.

Last year I was contracted back to that company to help sunset the product I worked on years before, writing tools to notify and cancel all recurring payments. A huge chunk of customers was then sleepers that had not logged for 7-9 years. I do wonder how many were surprised when they got the cancellation email! :)
This is especially concerning considering that GitLab is a technology company consisting of mostly technical staff.

For a crafted spear-phish like the one used in this test, I wonder what the failure rate would be in larger, non-tech organisations?
How you are breathing is also a part of your body language. I don't know how much of your breathing is recognized by other humans, but having been around animals most of my life, I've realized they perceive how you are breathing at the moment as a signal of what you are thinking. If you suddenly hold your breath, you are tense. You may not even be aware you are doing it. If you release the air in your lungs and breath out, you are relaxing. These are 2 of the strongest cues that animals react to. If you're curious, the next time your around an animal, experiment with it. Try steady in and out breathing, then subtly hold your breath for a moment, then exhale loudly, and see if and how the animal responds.
Good to see a ternary function iif() added. Case expressions are usually pretty painful and/or unreadable when using query builders.
I'd rather they update all of my merchants instead of assume that I want to cancel this or that. Citi has a nice feature that shows you all of your recurring charges. Maybe try to use a feature like that?

I also have it set up to send a text message to my phone any time my card is used.
Zoom has published an E2E encryption roadmap
Only if you have no people or capital in the EU. If you were a small business that sounds correct, but every medium to large business I have worked at has had at least something important going on in europe (clients, suppliers, offices, etc).
Is there any type that is _not_ owned by this definition?
I suspect these collective nouns as they are called were invented, or expanded, by the victorians, it's the kind of thing they did (if they were sufficiently wealthy).

A parliament of owls, a murder of crows etc. I can imagine it was a way of excluding people without education.

My speculation anyway. Whole things just seems silly to me.
Freestanding Rust in Emulated RISC-V
Bingo. And they are stored in airport storage facilities to claim international tax-free status... Storing visual art in warehouses never to be seen is a move so brazen that it should have been cracked down on long ago
> I mean, to be fair and add some balance here, a lot of people find that part of the GPL to be very restrictive.

I often see comments like this, but they make no sense. If you don't agree with the GPL, then don't use software licensed under it. The same as if there's proprietary software you don't want to license, don't use it. There's nothing to debate.

> There are many organisations who have banned the use of GPL code altogether because of this

Good, they read the license and don't want to follow it, so they don't use it. Exactly as intended.

You're confusing the GPL viral nature, which is a central feature, with something different that you wished for, but isn't real.

And by the way, since Linux is GPL, those same companies almost always make an exception, don't they now?
I think it's worse than that. The things Snowden leaked were simply the details of what I would think most people assumed to be true anyway. Not in a conspiracy theory way, but just an accepted thing. Most people don't really know the difference and supposed limitations of each three letter agency's powers.

Whether that's due to the media's portrail of them in film and TV over the years with their omnipotent powers or just the view that the government is an all seeing entity.

So in most people's view he just leaked the governments methods, not the fact they were doing it (and abusin their power in doing so). Because of this the Government can spin this as him leaking their secret sauce rather than them being in the wrong.
Recently I've been using Openboard (http://openboard.ch/) while screensharing. Yes its not a team board, but at least it's local. It helps me explain concepts to others easily.
Many ChromeOS devices do not support Android apps.
What can be done with the info that user has read, opened and clicked on the website? Our company for example has completely predictable e-mail addresses with first letter of first name and then last name @ company.com. You would have this knowledge even without having to send e-mails. I assume Gitlab has it similarly.

Also I assume Gitlab already has 2fa.
Get a server or some hosting, load it with whatever you need - mail, web, cloudy things, media, communications etc - and use a portable terminal to access it when on the move. That portable terminal can be a phone with a browser or some future device which is more tailored to this type of application. With the current generation of SoC, Wasm and a capable browser (Firefox Nightly Preview is shaping up nicely) this setup is a viable replacement for most 'apps'. One of the advantages of such a setup is that those 'apps' do no get to track your every move - that is, as long as that capability is not built into the browser at some stage (persistent web workers etc).
Gnome settles patent lawsuit: interview with Neil McGovern, Gnome Director
Seems that in fact even though scripts aren't signed, IF YOU DONT have devTooling enabled for a given terminal, scripts are hashed and checked against bad known digests.

not a big deal, assuming no data is kept.

Also I wonder what it looks like if a script is deemed bad...
Tbh, I'm not sure that reading a list of falsehoods is the best introduction to actually programming in a language.
Yeah, is a bit shocking this being news in 2020...
Some 42% of Jobs Lost in Pandemic Are Gone for Good
This is not lawful under both the GDPR and the CCPA. If Triplebyte follow through with their request against an EU or California resident, they'd be breaking data protection laws.

IANAL, but they may already be in violation of the GDPR with the 30 days processing time. While the GDPR states 30 days as the upper bound, the article about erasure also states:

The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies [...]

Notice the phrase undue delay. It seems that the legal interpretation of undue delay is as soon as possible [2]. Since the sign-up for Triplebyte seems to be immediate (you just create an account), they could also remove an account with a simple delete account button (remove some rows from a SQL database). So in the case of most web services as soon as possible seems to be with the click of a button to delete an account itself. Allowing a few more days for changes to propagate through storage systems and backups.

For anything longer, they should probably come up with damn good reasons when this is brought to court.

At any rate, they will have more serious problems if they make citizens public for people in the EU. They'll open up themselves to a huge liability. You are simply not allowed to use data for other purposes than what the data subject gave explicit well-informed consent for. And no, burying somethings in the terms and conditions is not explicit consent.

[1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

[2] https://www.linkedin.com/pulse/term-without-undue-delay-cont...
Interesting argument, I am curios though why this would hurt other streaming services more than netflix? Is this based on an assumption like "netflix has more content so less people will not watch anything for a few months than on [other platform]" or something like that?
Thank you for the calm and instructive response. I was about to hoist my pitchfork but set it aside instead.
The purpose of the piece is to provide insight and depth. Reading with full comprehension can take patience. Practice.
yeah, when i saw that i got so mad that I created a virtual credit card, changed the billing method, and then deleted the card. You can not imagine the big smile on my face when i received the email "we cannot charge you"....

Reaaaaaally big smile on my face
Microsoft: Official Windows package manager. Users: Not a package manager
Britain's Electricity Generation Dashboard
My understanding is that Google mandates U2F (the de facto predecessor to WebAuthn) for employee systems, certainly the Google employees I know have FIDO keys. One interesting thing is that some of them don't really understand how those keys work - and the U2F/WebAuthn design means that doesn't matter at all. I believe way more firms should do this and I've tried to gently encourage it at places I've worked.

Older sites tend to support U2F rather than WebAuthn. If you're on a greenfield install, you should just do WebAuthn, but it can be complicated in some scenarios to migrate from U2F especially if you're huge so it's understandable that not all have. In at least Chrome and Firefox the UX is identical anyway.

So, not differentiating them:

Facebook, GitHub and Google are three popular examples

You can also authenticate for some US Federal Government business on Login.gov (even if you aren't a US citizen)

And the UK's "Gov.uk verify" authentication can use Digidentity's offering which in turn relies on WebAuthn or U2F.

Edited to add:

AWS can do it, but, for some crazy reason they won't let you register more than one FIDO dongle. So I would not advise securing an "admin" AWS account this way, only users who can go to someone with admin privs to reset if they lose the dongle, but it's good for a team of developers I guess.

Not allowing multiple dongles goes against the intended security design, ignores a SHOULD in the WebAuthn standard, and also makes a bunch of the fairly complicated design pointless, I can't tell if Amazon are incompetent or had some particular weird reason to do it.
I use a virtual card (valid only once) when there isn’t a simple and clear way to unsubscribe.
You cannot reasonably expect a person to refuse to even look at a suspicious email. Let's say your support product x at your workplace. From: Person you don't know. Subject: Bug report.

Noone would delete that email without reading it, just like the finance department when they see something claiming to be a bill. Now what if your email said "I have sample website that demonstrates this bug". Again, there's no reason for you to not click that. The only thing that you should be able to reasonably expect a person to "fail" on is getting there and downloading a .exe or providing a set of credentials.
Absolutely! You can scroll down to close it as well
University of California is usually abbreviated UC rather than UofC.
Black Americans dying of Covid-19 at three times the rate of white people
What if it shows physical changes? E.g. "Effects of Long-Term Mindfulness Meditation on Brain's White Matter Microstructure and its Aging"

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4712309/
Ask HN: What is that blog platform with runnable/editable code chunks?
It was relatively popular on here a few months ago, a kind of medium-style site but the twist was you could run code examples, edit variables and indeed edit/fork the whole source. Often used for explanations of programming or statistical concepts. For example I saw one for COVID-19 where you could adjust variables like R to see a live update of the drawn curve, and run simulations of people interacting with various rates of transmission etc. Googling various related terms has not shed any light...
Not a support forum here - but does someone know, if there are ways to resize UI fonts for the Windows Krita application without touching the Windows setting for the whole monitor?

The only way still working for me is an arcane - in fact deprecated for a long time - Qt environment variable (QT_DEVICE_PIXEL_RATIO), that makes a difference for at least a portable Krita installation.
Yeah, I'm not surprised. Having worked for multiple service and content providers I would assume that abuse like this happens.

One notable case was when a deal to license a database fell through when the would-be client said "I've found a different free way to solve this".

Turns out that "different way" was to scrape our website in real time and present it to their clients as their own, without attribution or payment.

Abuse happens. Shoplifting happens. That doesn't mean that the shoplifter "found a loophole", nor that it's morally or legally right.

And it's not unfair if the selective enforcement is based on "bandwidth actually used" or "in addition to violating our policies you're also hurting the world" (or even "we just plain don't like you"). I.e. in the case above about scraping our data, we just dropped it. They weren't going to be our customer, clearly, and suing (they were in a different country too) or technically blocking them would not be worth the cost. And they didn't consume that many resources at our scale, so whatever.

But if that site had been a porn site or something then the cost of doing nothing would include potential PR issues of being associated with them[1].

So in short: This (CDN from article, and using google drive like this) is abuse. A proof of concept likely won't get shut down, but it's not something that'll work in the long run.

[1] I'm not against porn as such, but let's say our database was one of children's toys. That kind of company would understandably be hurt by apparently making deals with porn sites to show up there.
He is Alan Wilder of Apple
> My company regularly runs internal phishing tests like this... I think internal phishing tests are a great way to educate the workforce

Yes and no. I used to report phishing attempts to IT. Then we started running tests like every month, so I'd just delete suspicious messages and move on. Of course, that's when we got a real phishing message.

Frequent company-wide tests are, in my opinion, overboard. Once a year company-wide tests, followed up by more-frequent tests for sensitive groups and/or those who failed previous tests, makes more sense.
Tipster leaks Apple plan to honor Steve Jobs w special version of 5G Apple Glass
Is that meaningfully more secure than something like Auth0 with Duo MFA? (Which doesn’t require a dongle hanging off my USB-C port and works seamlessly on virtual machines.)
Funny. As if declaring your opinion changed people's tastes.
I'm not a huge fan of these phishing-test exercises. I run the service at https://urlscan.io which a lot of folks use regularly to check out suspicious links in mails / chat messages. I've been approached by some of these phishing-test companies asking me to prevent scanning their domains/IPs. They flat-out told me that they weren't happy about users using my service to check the link, which I always found odd, and I never got an explanation for it. Probably less spectacular findings for these companies if users can figure out a phishing test by themselves...
Have I written anything that is contradicts that? I simply pointed out that in the example the delay was artificial, and it was definitely due to network, not due to something other than network, as the comment suggested.
I dunno, Rockefeller commissioned the man to paint a mural, and the guy deliberately included themes offensive to sense and to the Rockefeller personally. Seems reasonable to remove it.
Large employers push back on U.S. healthcare mergers
I don’t really understand this argument. Apple has long been heralded for its safety and security. It’s why in three decades of owning macs we’ve never installed antivirus software.

What is the point of all this security these days? What are they protecting us from?
Indeed, but I've found out that only VSCode can handle remote environments, VSCodium (the stripped version of Code) doesn't work
Many businesses in the UK are selling tickets/packages/passes preemptively of the restrictions being lifted.

But, even more just don't have a system that lets them easily turn off items for sale, pause subscriptions, or pause reservations. I'd imagine it's just been forgotten...
Summary of Talks and Posters from ICLR 2020
Bitcoin.com isn't a neutral source on LN related material. The parent company (St Bitts LLC) directly invest in Bitcoin Cash startups that compete directly with Bitcoin itself.

The bug has already been patched, and had a limited userbase. The user who supposedly lost all his Bitcoin ended up not being true, vast majority was recovered. It's also worth noting that the user also deliberately went against various UI warnings that funds may be lost.

https://github.com/lightningnetwork/lnd/issues/2468
Last time I checked, they force you to use the safari engine for your web browser on IOS.
Also having a curated app store doesn't mean they have to disallow any other means of installing software. It's even ok if they say: You installed other software, no support for you. But making it not possible is a money grab.
Yes, really. They up and dropped an entire HDMI mode used by "older" 4K displays.

A cynic would say they wanted to boost sales on newer displays, but it seems more likely that a bug of some kind came up in a driver (I was unaware of any problems, but that's hardly proof of anything) and they just decided it was easier to cut support of those displays than to fix the problem.

Support forums filled with complaints by the dozens of pages, but Sony didn't care, because why should they? I'm sure somebody did the calculation that said we weren't a big enough demographic to matter.
They are really putting the smtp servers to work this week, I've been getting two or three emails a day from Triplebyte, spamming about these changes.

If they are really doing remote jobs, maybe I'll have to look again, but when I aced their silly test and got interviewed originally, they only worked in the Bay Area, Seattle, and NYC, and I'd rather pull out my toenails with hot pincers than relocate to any of those places.
> What can be done with the info that user has read, opened and clicked on the website?

Follow it up with a much more tailored spear phishing attack - https://www.knowbe4.com/spear-phishing/

Reworked to sales terms: it's the difference between a cold lead and a hot lead. A user who's clicked through has proven themselves to at least be warm or receptive to phishing campaigns in general.

As an adversary, I'd probably couple unique links (for tracking clicks) with heatmapping and other front-end tracking technologies to see what exactly the user is doing and how far they've gone before backing out, which helps me refine the attack. Most attackers probably wouldn't go that far (spear phishing the people who clicked would probably be the extent of it), but if someone is after something of particular value at your firm, there's no reason why they wouldn't put more effort into sharpening the attack.
Finally, we can do tabs in tabs!
That's part of value but not what big money billionaires do.

They actually spend money to fund institutions that eat hundreds of millions and what they get is galas and places to mingle. Really really rich are not laundering money. They are burning it to show they are cultured elite and not just rich.
What can be done with this information?

Most companies have e-mail addresses that are completely predictable, so you can pretty much assume that this e-mail address exists. If this really was a security risk shouldn't you have UUID emails for everyone?

Also how do you as an attacker know that it was user not a e-mail server checking those images?
Ok, that makes sense if you average over a year considering night time etc. Yeah, car mounted solar isn't a great idea unless we were in a mars rover type of situation which is not how we use cars.
OK, you need to change the "Demo" section to be clearer, now that you've changed what it's loading. Leave a history behind, otherwise this conversation, and hence the comments that appear on that page, won't make sense.

So you need to change the "Demo" section to say something like:

> "Initially as a demonstration we were force-loading comments from a different discussion, but now we can use the real comments for this post."
That’s the problem with credit cards. Once they have your number, it’s very difficult to “stop paying”.
Neil McGovern says that the outcome is much better than invalidation of a single patent:

https://openuk.uk/gnome-settles-patent-litigation-amanda-bro...
There are people out there who make enough money that they don't bother with an item-by-item check of each charge. I can't blame them. Being that careful is a huge cognitive load that scales with the number of charges even if it comes back to bite them when times aren't so good.
Nanotech Energy graphene battery 1 year away charges 18x faster than all others