skysight-inc/HackerNews huggingface dataset:
>They can’t cite any applicable case law

There's several cases cited in the dissent. Succinctly the argument is:

>“restrictions inexplicably applied to one group and exempted from another do little to further these goals and do much to burden religious freedom.” Robertsv. Neace, 958 F. 3d 409, 414 (CA6 2020) (per curiam). What California needs is a compelling justification for distinguishing between (i) religious worship services and (ii) the litany of other secular businesses that are not subject to an occupancy cap. California has not shown such a justification.

Which seems on point to me.
It’s not true that expiration is not about security. Dan Geer’s talk in 1998, noted at https://cseweb.ucsd.edu/~goguen/courses/275f00/geer.html , is just as relevant today in the design of key management systems.

Expiration is not “just” about cryptographic risk either; there are plenty of operational risks. If you’re putting your server on the Internet, and exposing a service, you should be worried about key compromise, whether by hacker or by Heartbleed. Lifetimes are a way of expressing, and managing, that risk, especially in a world where revocation has a host of failure modes (operational, legal/political, interoperability) that may not be desirable.

As for Root expiration, it’s definitely more complicated than being black and white. It’s a question about whether software should fail-secure (fail-closed) or fail-insecure (fail-open). The decision to trust a CA, by a software vendor, is in theory backed by a variety of evidence, such as the CA’s policies and practices, as well as additional evidence such as audits. On expiration, under today’s model, all of those requirements largely disappear; the CA is free to do whatever they want with the key. Rejecting expired roots is, in part, a statement that what is secure now can’t be guaranteed as secure in 5 years, or 10 years, or 6 months, whatever the vendor decides. They can choose to let legacy software continue to work, but insecurely, potentially laying the accidental groundwork for the botnets of tomorrow, or they can choose to have legacy software stop working then, on the assumption that if they were receiving software updates, they would have received an update to keep things working / extend the timer.

Ultimately, this is what software engineering is: balancing these tradeoffs, both locally and in the broader ecosystem, to try and find the right balance.
UCSF charged $18,415 for 3 Covid-19 tests
The literal first sentence
It's “the Democratic Party”, not “the Democrat party”.
Speedup numbers should be given when optimizing constant factors -- e.g. "I made this operation 5X faster using SIMD" or "By employing readahead, I sped up this file copy by 10X".

The points raised in this article are really different:

* don't do slow stuff in your latency-critical path

* threads are a nice way to unload slow stuff that you don't need done right away (especially if you have spare cores)

* dropping can be slow

The first and second points are good, but not really related to rust, deallocations, or the number 10000.

The last point is worth discussing, but still not really related to the number 10000 and barely related to rust. Rust encourages an eager deallocation strategy (kind of like C), whereas many other languages would use a more deferred strategy (like many GCs).

It seems like deferred (e.g. GC) would be better here, because after the main object is dropped, the GC doesn't bother to traverse all of the tiny allocations because they are all dead (unreachable by the root), and it just discards them. But that's not the full story either.

It's not terribly common to build up zillions of allocations and then immediately free them. What's more common is to keep the structure (and its zillions of allocations) around for a while, perhaps making small random modifications, and then eventually freeing them all at once. If using a GC, while the large structure is alive, the GC needs to scan all of those objects, causing a pause each time, which is not great. The eager strategy is also not great: it only needs to traverse the structure once (at deallocation time), but it needs to individually deallocate.

The answer here is to recognize that all of the objects in the structure will be deallocated together. Use a separate region/arena/heap for the entire structure, and wipe out that region/arena/heap when the structure gets dropped. You don't need to traverse anything while the structure is alive, or when it gets dropped.

In rust, probably the most common way to approximate this is by using slices into a larger buffer rather than separate allocations. I wish there was a little better way of doing this, though. It would be awesome if you could make new heaps specific to an object (like a hash table), then allocate the keys/values on that heap. When you drop the structure, the memory disappears without traversal.
Disclosure: I work at Google (but not on Fuchsia), and I contribute quite a bit to open-source projects.

Disclaimer: I'm not a lawyer, this is not legal advice, etc.

I'm not sure what you mean by "you grant a license to Google to use it in non-proprietary code" — was that a typo and did you mean "proprietary"? In any case, Apache/BSD/MIT licensed code can already be used in proprietary code, the CLA does not change that.

The Google ICLA you cited [1] is basically the same as the ASF ICLA [2]; the gist is that you retain copyright of your contributions, you're not giving up your copyright — i.e., it's a copyright license, not a copyright assignment (as some other CLAs are).

And, naturally, anyone can fork it if they wish, or distribute proprietary, non-open-source versions of an Apache/BSD/MIT-licensed project, subject to appropriate attributions, if required, by the relevant licenses.

However, neither you (nor Google) can claim copyright over the entire project, because the copyrights are held by the relevant contributors. Changing the license for the entire project requires agreement from all copyright holders — for example, see what LLVM had to do when they chose to add a clause to their license [3].

[1] https://cla.developers.google.com/about/google-individual

[2] https://www.apache.org/licenses/icla.pdf

[3] https://llvm.org/foundation/relicensing/
Wow, this bug is incredibly simple but severe. I’m wondering how did Bhavuk Jain find it
There's actually a third certificate for "USERTrust RSA Certification Authority", also using the same key pair, signed by a different root called "AAA Certificate Services". It looks like the intended replacement for the expiring one is this one, rather than the one where it's the root itself.
I edited my comment to say "some non-essential businesses" to avoid implication that all non-essential businesses were opened which I didn't intend.

>Churches are not given an exception to those rules, which still bar similar things like concerts.

This was the decision of the Supreme Court. The Pentecostal Church and the dissenting judges think differently.

>And cases like that most definitely have and do reach the Supreme Court: consider hobby lobby or this year’s rulings on teachers at religious schools.

These are cases on nuanced applications of the law. The idea that churches have to follow building codes, labor laws and health laws is a settled matter.
Show HN: Write a bot that plays SpaceX's ISS docking simulation
If 95% of Your Writing Dreams Have Not yet Come True, Why Not?
What DB has a better active-active HA cluster option than RAC? I love me some Postgres and MariaDB but I've never seen anything come close to RAC for making high volume queries against active-active just work.
Piston engines can also do. You want max output for take-off, but to maintain the cruise speed you need around 75% of the engine output and you fly at "steady efficient power" (75%) for cruise; there is no difference here. It's not like cars where you brake and accelerate many times.
> There's literally no content to this sort of discussion other than yay-celeb vs. boo-celeb

Being proud of Elon Musk and my country is not 'ubsubstantive'. It points out the greatness of immigrants, capitalism, technology, entrepreneurship, and everything else that makes America GREAT.

> Just look at how vacuous this subthread is.

So it is my fault what other's choose to post on HN? Got it!
I was introduced to fzf by a co-worker about a year ago when I started working on a team that used git.

Now I use it literally everywhere, from the command line as a quick git workspace switcher, to all sorts of git commands in vim using fzf.vim [1].

fzf is brilliant.

1. https://github.com/junegunn/fzf.vim
Well, the escape velocity for Earth is 11.2 km/s...
Depends on your definition of art. Good copywriting must be a very skilful trade. Not sure about the whole "must serve no purpose other than itself" aspect.
Replace "zero-day" with "privately reported security bug for which I got $100k"

That's not how zero-day works
Well done SpaceX, this is a historic day. Next Starship!
How can programmers help end police racism?
That's why I like gliders - one less component to fail (the engine) and every landing is an engine out landing, with the plane built and pilot trained to do that. :)
I've seen variations on this trick multiple times. Using threads, using a message sent to self, using a list and a timer to do the work "later", using a list and waiting for idle time...

They all have one thing in common: pampering over a bad design.

In the particular example given, the sub-vector probably come from a common source. One could keep a big buffer (a single allocation) and an array of internal pointers. For example of such a design to hold a large array of text strings, see for example this blog entry and its associated github repo:

https://www.spiria.com/en/blog/desktop-software/optimizing-shared-data/
https://github.com/pierrebai/FastTextContainer

Roughly it is this:

struct TextHolder
{
const char* common_buffer;
std::vector<const char*> internal_pointers;
};

This is of course addressing the example, but the underlying message is generally applicable: change your flawed design, don't hide your flaws.
For author and GMing purposes I can recommend https://www.fantasynamegenerators.com/ , which has been a huge help for running my weekly DnD seesions.
Why dont Facebook engineers quit over Zucks stance on fake news and hate speech?
Why don't Facebook engineers quit over Zuckerberg's stance on fake news and hate speech? Is it the money? Do they actually agree with the policies? I really want to understand the thought process of people that actually work there and unfortunately (or fortunately) no one I know works at Facebook.
They're working on it. Can't ban it since many airplanes still require it.
Light aircraft aren't really known for having enlightening names.
I'm under the impression that the US heavily subsidizes European security. Obviously, the US gets a number of advantages from this as well.

It seems like Europe will have to build up its military if it wants to be able to stand alone. Not that I think a multi-polar world is good for stability. I think US leaders used to keep that in mind a bit more before trying to leverage their position.
Andrew Cuomo should resign and here's why?
Towards the end of the article, Gerben makes the point that the comparison is not on the critical path of his variant of QuickSort, so even if the comparison involves indirection, that comparison can still proceed in parallel with the main loop of the algorithm:

> Combining these two tricks could lead to merge sort on par with the simple partition loop of QuickSort. However it’s just a mitigation. If instead of sorting a simple primitive value we would sort pointers to a struct. The comparison operator would have an extra load which immediately adds to the critical path. QuickSort is immune to this, even rather costly comparisons do not influence the ability to make progress. Of course if the comparison itself suffers from frequent branch misses, then that will limit the ability to overlap different stages of the iteration in the CPU pipeline.

In the benchmark code for the blog, he includes a benchmark that has indirection to illustrate this, though these results were not included in the article itself. On my machine I get:

$ CC=clang bazel build -c opt :all
$ bazel-bin/bench_sort --benchmark_filter=BM_IndirectionSort
-------------------------------------------------------------------------------------
Benchmark Time CPU Iterations
-------------------------------------------------------------------------------------
BM_IndirectionSort<1, std_sort> 64 ns 64 ns 10900000
BM_IndirectionSort<1, std_stable_sort> 89 ns 89 ns 7900000
BM_IndirectionSort<1, std_heap_sort> 112 ns 112 ns 6300000
BM_IndirectionSort<1, exp_gerbens::QuickSort> 26 ns 26 ns 27000000
BM_IndirectionSort<1, HeapSort> 96 ns 96 ns 7300000
BM_IndirectionMergeSort<1> 45 ns 45 ns 15500000
Ask HN: How does Clearbit Reveal know who I am?
When I visit https://clearbit.com/reveal there is a screenshot of a web page. I've visited the page a few times from my home internet connection, and the image has been either:

A) My personal blog (on my own domain)

B) My company's web site

It's pretty impressive (or creepy, depending on your viewpoint) that they can map my IP address to a company and/or individual identity.

I'm curious about how they do it. I have some ideas, but nothing that would explain it working so well. Maybe I entered my email address on a form on a site that shares data with Clearbit, but wouldn't my IP address change often enough that this wouldn't be useful for more than a couple of days?

Anyone else have any ideas?
Most people are floating the idea that eventually we would either have commercial companies adding a "space hotel" to the ISS for testing purposes and when the ISS is retired that the hotel would continue to exist.

Once you have companies either vying for real estate in orbit the demand for people to visit the hotel could eventually spur demand for other places to go.
All your questions can be answered by reading “Sign in with Apple REST API” [1][2]:

1. User clicks or touches the “Sign in with Apple” button

2. App or website redirects the user to Apple’s authentication service with some information in the URL including the application ID (aka. OAuth Client ID), Redirect URL, scopes (aka. permissions) and an optional state parameter

3. User types their username and password and if correct Apple redirects them back to the “Redirect URL” with an identity token, authorization code, and user identifier to your app

4. The identity token is a JSON Web Token (JWT) and contains the following claims:

• iss: The issuer-registered claim key, which has the value https://appleid.apple.com.

• sub: The unique identifier for the user.

• aud: Your client_id in your Apple Developer account.

• exp: The expiry time for the token. This value is typically set to five minutes.

• iat: The time the token was issued.

• nonce: A String value used to associate a client session and an ID token. This value is used to mitigate replay attacks and is present only if passed during the authorization request.

• nonce_supported: A Boolean value that indicates whether the transaction is on a nonce-supported platform. If you sent a nonce in the authorization request but do not see the nonce claim in the ID token, check this claim to determine how to proceed. If this claim returns true you should treat nonce as mandatory and fail the transaction; otherwise, you can proceed treating the nonce as optional.

• email: The user's email address.

• email_verified: A Boolean value that indicates whether the service has verified the email. The value of this claim is always true because the servers only return verified email addresses.

• c_hash: Required when using the Hybrid Flow. Code hash value is the base64url encoding of the left-most half of the hash of the octets of the ASCII representation of the code value, where the hash algorithm used is the hash algorithm used in the alg Header Parameter of the ID Token's JOSE Header. For instance, if the alg is HS512, hash the code value with SHA-512, then take the left-most 256 bits and base64url encode them. The c_hash value is a case sensitive string

[1] https://developer.apple.com/documentation/sign_in_with_apple...

[2] https://developer.apple.com/documentation/sign_in_with_apple...
Is that a cURL bug?
Once he/she figures out how to do development and get paid for it sustainably.

Unfortunately, either of the sides is not automatically guaranteed with age. So, general guidance is to practice it as early as viable. Some luck helps too.
Darnit. I saw Grand Caravan and thought it was an all-electric minivan.

I've been waiting years for an electric minivan. The moment someone comes out with one, I'm turning in my current minivan, which I love, for an all electric van.
Actually yes, there is a sense in which a comment is partly responsible for the subthread it leads to, because reactions to certain things are so predictable on the internet. That's why concepts like 'flamebait' and 'trolling' exist. Your comment wasn't flamebait, exactly, and definitely not trolling, but it did have the property of being much more likely to lead to a vacuous subthread than a curious one. (Btw, I rotated between 'dumb', 'vacuous', 'lame', and a few other adjectives in the GP before returning to 'dumb'. You saw it in an intermediate state.)

Edit: one way of putting this is that the value of an HN comment is the expected value of its future subthread: https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu.... That includes the original comment since a root node is part of its tree.

I realize you're just being enthusiastic and am sorry to pee on the party.
I didn't pay enough attention to usernames as I was replying and thought I was talking to multiple people through the chain.

We are in verbose (and unnecessary on my part) agreement.
He said the wind is the only thing you hear. Yes, in a glider you hear the air moving, but adding a propeller adds a huge amount of noise over that base sound.
if a country does not do this, it is only because they lack the strength
American opportunities and education are an important part of what his achievements. That is true.

But, he was born and raised in South Africa and moved to the US as an [almost] adult (age 17).

If he was born and raised in America, maybe his priorities would have been different to the person we know today.
That is entertaining to know!

Thank you for writing this, it seems very well done so far. And thanks for also making it available in the way that you did: I almost certainly wouldn't have played with Perl today without your book, made effortlessly available on my e-reader via Pragmatic. I'm curious why it's not available in physical copy from Pragmatic? And I'm not confident about the correct "buy" link to use to properly support the book.

One sidenote that I hate to mention, but: I couldn't figure out how to open a PR for this or even email someone who would care, but I found a code-typo on the CPAN website: it's instruction to "install via App::cpanminus" and then use with "cpanm name::module" is...an unfortunate early typo on that site.
(or fellow anti-semites like Ezra Pound)

Not to make excuses for Eliot's anti-semitism but Pound was a raging fascist no mere 'fellow anti-semite'. A whole other level of ick.
Can you elaborate on this? What is the backend used and why is it problematic?
I have a theory that we'll be able to reduce the RPM and increase the torque of these engines, versus conventional gas turbines and piston engines, thereby reducing the tip speed of the blades
Stopping the Noise in Your Head - Reid Wilson

Get Out of Your Mind and Into Your Life - Steven Hayes
I see a lot of beauty in this.
Yes, I've heard of that. They closed 1 transaction with it, for a total, if I'm not mistaken, of a million dollars. It's a pathetic joke.
It's true they don't work so well with bagels, as bagels are thick, but there is an adjustment screw on the bottom which can normally solve any problem with regular toast not coming back up again.
I'm not sure that is very on point. Secular businesses are something different in gathering type than Church services. And when it comes to gatherings where there would be similar close contact inside with often static groups of people, the Supreme Court majority properly made that comparison: "similar or more severe restrictions apply to lectures, concerts, movie showings, spectator sports, and theatrical performances."
Check out magit.

I tried to look at the web page but it has ~16MB in 3 images (please don't do that) and blew up my palemoon process by over 3GB (not MB). I have never seen that before. JS is disabled. There's something really nasty going on. Browser is palemoon, fairly recent.
You'll still be able to do most of your pattern work and general handling training in vastly cheaper electric aircraft.
Do you know how many people work at Facebook? Do you think they all share the same moral and political views? Your question seems to expect an answer that applies to all FB engineers. You could just as well ask why everyone isn't vegan.

Some people have quit. Some maybe agree. Most probably need the job. You would have to sample a representative number of FB engineers to get any kind of meaningful answer. Anecdotes and speculation aren't worth anything.
"Generational/compacting GC has the opposite problem. Garbage collection takes time proportional to the live set, and the amount of memory collected is unimportant."

Takes time proportional the live set times the number of GC runs that happen while the objects are alive. In other words, the longer the objects live, the more GC runs have to scan that object (assuming there is enough activity to trigger the GC), and the worse GC looks.
Only 6 months after the first commercial airplane electric flight. https://www.harbourair.com/harbour-air-and-magnix-announce-s...
Am I the only one who finds the “unpopular opinion”-type threads on Reddit and other sites don’t generally yield high level discourse?
The obvious solution would be to borrow the HeavyThing instead of having it dropped inside the function.
Can you give a example of a set of gauge theory equations for a non-U(1) gauge group? This seems interesting but I'm not really sure what it would actually look like.
I am suggesting they apply good practices. I'd never imagine that compilers were actually doing what was stated -- sounds awful.

I understand it's tradeoffs and we all have real-world limitations to contend with -- but again, of all the corners that could be cut that's exactly the one I didn't imagine they would.

Nasty.
'American' is not an ethnicity. That is a big reason it is so great. If America is such an awful place why are you here and not in albania? Why did Einstein et al. come here? The American system enables things that are impossible in other countries.
Perhaps, but it doesn't take a minority opinion to do so. When Muhammed Ali (formerly Cassius Marcellus Clay Jr.) was charged with draft dodging, the SOCTUS ruled[1] 8-0 in favor of him, but specifically tailored the ruling to only him and not other draft dodgers.

[1] https://en.wikipedia.org/wiki/Clay_v._United_States#Opinion_...
Why mock people by calling their opinions "hilarious"?
Wait wait, you’re telling me there’s Javascript floating around in space (not including web traffic being sent through satellites)?
I don't see anything about expiration in that talk.

If you don't have a strong revocation system, then your host is vulnerable whether or not you have expiration, since attackers aren't going to wait until the day before your key expires to try to steal it.

In general, when a CA's root certificate expires, it creates a new one and gives it to browser and OS vendors. What's the difference between the CA continuing to guard their old private key, and starting to guard the new private key?