skysight-inc/HackerNews huggingface dataset:
Breaking "hand rolled" crypto is a very hypothetical threat, almost a non-existent threat, as in practice software with centralizedly controlled distribution model has many much much bigger weaknesses that advanced threat actors are going to exploit, like updates. Assuming they even can successfully break such crypto at scale, imagine how much effort would it take just to get to the encrypted bytes given all the VPNs, TOR and overlay networks providing extra layers of encryption and privacy/anonymity hiding who talks to whom by sending packet through other countries.

I guess what people should learn from this is that encryption isn't a protection without solving problems caused by centralization first.
App User Experience Review: How We Feel
Another article today from City Journal on the same theme: "The End of Chaz: In Seattle’s “autonomous zone,” lives are destroyed under the banner of social justice." https://www.city-journal.org/end-of-chaz
>hides it for a year

Huh? It's an open source project. Maybe you consider them closing the issue on GH to be "hiding it" but I don't. And the plenty of people talking about it in that thread still apparently don't, either.

IMHO their response made sense. You're already trusting DDG with your search history which for most people might as well be a list of 99% of the domains they visit. If you trust their privacy policy for that, I don't see the big deal here.

I do agree that it should be changed, but only because as is it seems imperfect and I seek perfection in most things. Again, it's an OSS project. AFAIK, any one of these people comprising the screaming masses are free to fix it themselves. Personally, I don't think it's worth my time.
Not eating his own dog food.
What do you make of the abnormally high pneumonia cases in Italy late 2019?

https://www.reuters.com/article/us-health-coronavirus-italy-...
Elixir Wizards S4E7 Amos King on MUDs, Domain-Driven Design, and Military Bases
Scots Gaelic could die out within a decade
That would depend more on the state of the exhaust of the F150. I have the quietest Honda inverter generator (which AFAIK is the quietest generator) and I have an F150 with the most powerful motor available. The generator is quiet for a generator, but much louder than the F150 at idle. It might be pretty close on a hot day during the times when the high speed fan cycles on, though.
"You need to provide a fast path to victory, or your work will sit unused."

Very true.
Tesla's Inflection Point
> 360x640

I'm curious of that's a 2x, 4x, etc version of high ppi devices; it's not impossible.
How to make health technology accessible to everyone
I may not be an economist, but I think this does not make sense.

If there is a worker shortage, do all of the workers go to work and say "give me more money"? I would also contend there would be no reason for say, walmart to suddenly offer more money just because everyone has been ordered to stay home. If there is an _actual_ shortage, increasing pay does not just fabricate workers.

I have relatives who are essential (specialized nurses, and hospice nurses). Their pay has not changed, in fact, their actual wages have fallen through the floor as they are working 12-16 hour days instead of 10-12 hour days (when they are supposed to work 8 hours a day), so their hourly wage (they do not get paid for all that time they are charting, after hours, at home) has dropped significantly.
I’ve been very happily using Go the last 7 years (disclaimer, I’m employed to work on Go as of 2 years ago), some random personal thoughts.

It’s interesting how a language can be boring and so fun to use at the same time.

I guess I don’t want excitement at the language layer because there’s plenty of opportunity for it in other layers.

A boring language to me means there’s usually roughly one way of doing something, so you just need to write up that one thing and move on to the next part of what you’re building, knowing the past part is finished. Once something works well and has a good API, I almost never want to come back to it and rewrite it with a different set of language features that I happen to learn.

The process of writing Go is fun to me because starting with an empty Go program to do a new task is always a refreshing experience, it’s easy to reuse any past functionality that you’ve already created (or found) and you can focus on the new task. In contrast, when I was primarily using C++, starting a new codebase wasn’t pleasant because of all the housekeeping and boilerplate (like defining a uint16 type in a platform-agnostic way) I needed to copy/paste just to have a reasonable starting point.

Also, the feeling of gofmt/goimports running on save and formatting the code on save is a huge part of what makes it fun (fortunately, code formatters are much more commonplace now; I wouldn’t want to go back to not having them).
Strictly speaking they didn't show that two separate consumer routers have the same remote management password.
Really all we need is to stop the worship of the mobile. Mobile is uniform and limited, and sadly it has made desktop uniform and limited as well.

Somehow even highly technical interfaces, e.g. DNZ zone editors are now made mobile-first. I wonder, is the majority of people really editing zone files on their phone? don't people value their time anymore?
At least the modern web looks better though.
Good tool to help you in social media marketing
Grow your sales thank me later
I think the only way to do so would be to deny themselves the ability to push software to customers (speculating that this is how it was attacked), which itself is an attack vector. It basically seems impossible to do securely if you can't trust the software on the phone, short of providing a separate device that decrypts and encrypts messages and shows them, but any software that device runs would be the attack surface.

That said, it's probably far more likely the crypto was done incorrectly from the off (and probable that other services have the same flaws) but the authorities needed a cheaper vulnerability to burn in public so as not to disrupt other investigations that are no doubt ongoing.
Counterargument: build systems that any idiot can run, because eventually an idiot will be running it.
I had a Revolut account for about a year but abandoned it when [like most of these so-called 'Challenger Banks'] they started making ridiculous privacy-raping demands for me to upload; selfie-video, driving license, scan of my passport, etc. to confirm my identity.

Their support forums are also full of horror stories of people being left stranded abroad without access to money when their accounts are suddenly and without warning unaccountably frozen, and of people having their accounts frozen and denied access to their cash for weeks or months [again, without warning or reason] so they are unable to pay rent, bills, etc.

I really don't know why these challenger banks get so much love from the media. I think that often the press [especially the tech press] gets so blinded by the fact that something is new and 'interwebby' and has an app with cutesy cartoon graphics that they fail to look beyond that and actually evaluate the service.

My boring high street bank's app might be a bit corporate and dull and not full of twee cartoons. But it does the business and "just works". My boring high street bank has never locked my account, never invaded my privacy by asking me to send them an identity thief's wet dream's worth of personal data and my boring high street bank is also regulated by my country's financial authorities, so my money is [as much as these things ever can be] "safe".
Thank you for re-opening and prioritizing this.

However, this problem demonstrates gross incompotence for a browser team supposedly concerned with privacy. Will you please do a post-mortem on how this code made it through your code review process in the first place, as well as how it managed to stay in place for a full year after it was pointed out that it represented a privacy problem?

"Sends every URL you visit to the vendor's servers" is the single worst thing DuckDuckGo could have done for privacy in this web browser, and that needs to be accounted for. There was a major failure in the code review process, ticket review process, and in how you treat your community. A standard marketroid "by design" response with washy promises that "we'll take very good care of this highly sensitive personal data, just trust us" is not something I want to see in the future from this team.

[reposted from GitHub]
> And don't forget that the administration has installed a lot of affiliated poeople into agencies.

I haven't and neither have our agencies.
Obviously this is all a matter of opinion but I don't consider a lack of exceptions, enumerations and generics "boring", I just consider them to be missing features.

Certainly there's an argument to be made for simpler languages being better (maybe we should all be writing in Assembly?) but I'm personally not convinced.
The important stuff they got off the street was the people and the machine guns.
Location: Hong Kong (UK/British expat)
Remote: Yes
Willing to relocate: Yes, Preferred
Technologies: TS/JS, Node, React, Go, Python, AWS, Containers, Linux, Modbus, SQL, CI/CD (Learning: Rust)
Resume/CV: Please email me for CV.
Email: gycco@protonmail.com

Full stack engineer based in Hong Kong with around 6 years of experience. Due to changing political situation, I am looking for safer climates. Please email me for further information and I'll be glad to send you my CV and tell you more about myself and my experience.
Complex systems are the core problem. Hardware, firmware, third-parties and black boxes all over, live updates, OS, apps, network, etc. etc. The upside is that it also makes them hetergeneous which is more difficult to roll en masse.
Yeah, I was actually thinking about this particular case for code specialization. In code where the inner loop is very branchy, you can have considerable gains for being able to remove unnecessary branches (and code).

This kind of technique was (is?) a fairly common in demoscene. Often just modifying constants in existing code but also specializing (AFAIK usually block concatenation) isn't unheard of.

(By the way, at least on x86, it might pay off to watch out for things like inner loop(s) branch target 16-byte alignment to avoid penalties.)
Thanks, that was exactly my point, which some people are missing.
As odd as that sounds, I believe there's a market opportunity for a company to start out again like what Google used to be: a search engine used mostly by technical people and searching within a well-defined small circle of websites.
I do most of my HN browsing in the app [Materialistic], so I usually first look at articles using the built-in webview, then open externally in Firefox if that doesn't render correctly (which is unfortunately common. Not sure why, but I'm inclined to blame either the app or webview; for example, Wikipedia is served as a static site but renders as a blank page). In this case, they both rendered the same way (but was able to read the page with FF's reader mode).

[Materialistic]: https://f-droid.org/en/packages/io.github.hidroh.materialist...
Section 230 protects companies by not making them responsible for what third party actors publish in their platforms.

Name a single US based TV station prosecuted because some of their guests made false or hateful comments on air. Heck, it is in fact easier for the FCC to nail a broadcast company for "indecency", rather than hate speech.
is there consensus on whether Node did or did not "catch"? like, sure, it was a launch language of AWS Lambda and Netflix uses it heavily. but every backend person I know uses Go or Python or Ruby, anything other than JS. pretty much only fullstack JS people consistently pick nodejs as first choice - but that's just my POV. I'd love some more definitive numbers.
Tim Hortons facing class-action lawsuit over app location tracking
CVE-2020-12418: Firefox Information Disclosure Vulnerability
I agree with this.

As a privacy-first company, for them to make any decision that is for performance but adds additional privacy risk shows they make the wrong decisions.

They also left this for over a year after being told about it and part of the only reason it was caught was that their browser app is open-source. What about all their closed-source services, like their favicon service their browser apparently relies on.

We shouldn't blindly trust any company and a privacy-first company should be willing to assume we don't trust them and therefore it is up to them to prove everything they do.

I get a few of the responses on their Github page are now non-helpful, but the big point here is that by DuckDuckGo taking this series of actions (implementing the browser like this, ignoring a valid bug report about it, and only reopening the issue after massive push from users) it shows that DuckDuckGo isn't as privacy-focused as I thought, nor many others.

I've been using DuckDuckGo as my sole search provider for several years now, on all my devices, but I'm concerned about what else they may have done in the sake of "performance" over privacy.
I think it mainly highlighted an unfortunate part of our economy.

The $600/wk thing looks like making sure everyone gets a living wage on unemployment until they thought we'd be able to reopen the economy fully and they'd be able to get a job as normal.

But, it just highlighted how many people are working and not earning a living wage in the first place.
> I personally know at least 5 exploitable vulnerabilities in some government websites, but I won't be disclosing them, since that will land me in a lot of trouble.

Thats what full disclosure is for. Drop the vuln somewhere via Tor, maybe point someone there via some anonymous comunique. Et voila, you made the world a safer and better place.

Imho sitting on vulnerabilities is immoral as long as anonymous full disclosure is possible.
More than half the retail price at the pump in much of western Europe is tax. If you take the base price of the fuel in both Europe and the US, exclude taxes, then the price isn't actually all that far apart.
I always thought I was one of those people on whom caffeine had little to no effect, since we I was drinking 5 cups a day on average and still felt tired all the time.

During the lock-down I read somewhere that caffeine's half-life in your body is 6 hours. I'd always needed an hour at least to fall asleep at night but I never attributed it to caffeine. So I figured I'd quit coffee for a to see what the effects were.

I can't even begin to tell how big of an effect quitting caffeine had: I routinely fall asleep within 15 minutes of going to bed, I sleep better and longer, I have more energy and one espresso after lunch is enough to stay focused and alert until midnight.
> Oh, and they sold data about torrent users. That's right. A Swedish ISP selling personally identifiable information. Not giving it out because of a court order.

Very interesting, can you please say more or point to somewhere? I couldn't parse if the last sentence was about you or Telia.
Murphy's eighth law is contrary to every success metric. People tend to say "..but we're doing well!" and that's supposed to be a bad sign.
Our Quantitative easing and corporate bailouts are in the trillions, why would we not pay out significantly less for people who are struggling to find jobs? Why does the till start counting when its normal people affected?
I use this site to calibrate my team's automated visual diff regression testing stack.
It’s hard to say. At least in the U.S., there has been some precedent relatively recently where companies knowingly facilitating criminal activity can be subject to prosecution. They could probably argue that they didn’t have access to the the contents of communications so they were unaware of the criminal activities. However, they (it’s unclear if it was resellers or the company doing this) actively marketed to criminals, via ad placements on websites known to be used for criminal activity. Needless to say, it’s a pretty complicated situation in terms of liability.
If there is sound (e.g. someone says something) and I'm not actively listening to it, but suddenly I have to focus on what was said then I can replay the last few seconds and catch up. I guess this is common to some level at least - it's hard to see how it's possible to communicate otherwise. After all we kind of have to keep a full sentence in our heads in order to understand it.

What I definitely can't do is replaying something that visually happened if I'm focusing on something else, or not paying attention. The same goes for other physical stimulation like touch etc. If I'm not conscious about it I can't tell what happened before the moment I focused. So, if I suddenly find myself in a slightly embarrassing position relative to someone else in a crowded pub, for example, and I didn't pay attention, I couldn't tell if it was because the way I was moving or if it was because of someone else. But if someone said something I'll just replay it. Works nicely for listening to a language I don't know that well too, I just replay it and translate it. But in a conversation there's no time to do that, so I'm stuck.

(I'm not talking about creating or remembering a sequence of events and playing that in my head as a movie - that's not a problem. But there seems to be an always-on "cache memory" for audio while there's none for visual or other stimuli. For me, at least. What I'm wondering is - do other people have "cache memory" for visual or other input interfaces?)
> Speaking of lists, the domain could be on the PSL.

Public Suffix List for those like me who might not have all the latest TLAs memorized.

https://de.wikipedia.org/wiki/Public_Suffix_List
yes, if they could keep shuffling physical phones and sims with high frequency. But that is _serious_ operational drag and discipline. Professionals can't generally manage that at scale. We're talking criminals here..
Isn't the point to get people to stay home?

"I'm making more doing what I'm supposed to be doing" seems like a good approach, not a side effect of rushed legislation.

Aren't you also not eligible for this unemployment if your work has reopened? You only get unemployment if you're willing to work.
For the past year or so I've regularly seen heady topper in mass and nh.
Really they should have fixed the software instead of telling the user to change it. It's a perfectly valid SSID.

And really, using raw environment-derived data directly on the filesystem?? What if the SSID had been "/etc/passwd" or something similar and it wrote to that?
The tanks’ guns are disabled. They aren’t functional tanks in regards to the one feature that makes a tank a tank.
Yes, it’s because of the manufacturing cost.
Zit-popping channels on YouTube are fairly common. I’m not familiar with the details but it seems people who can’t afford a dermatologist find care that way. Their full face is never filmed so I’m not sure there are blatant issues.

An interesting thing is: patients from areas with poor hygiene, etc. tend to have massive zits, which are clearly the most popular —— so there’s still a whiff of poverty as spectacle. But I don’t have a self-paying economic model for care in that case.

More to the point, I’m always curious about claims that newborns have image rights. I get the principle. Less sure about specific damages.

I’d be interested in the idea that showing the process helps medical education. Antivaxxers (and careless drivers) have benefited from rules about not showing gruesome medical images broadly, including recently with COVID.
From the time Congress passed the $6.2T Bill that gave $4T to the FED to prop up the stock market, $700B in PPP loans; and and estimated $300B to the people ($1,200) stimulus checks, it should have put things in perspective.

Ideally the stock market wouldn't have been propped up and the PPP loan program would have been more legitimate to save real small businesses (just wait until all the fraud comes out of this thing). If all that money instead went to the people/taxpayers they would all have received an $18,000 stimulus check instead of $1,200, I think this would have been the best move possible (and maybe some form of healthcare coverage for the uninsured, being in a pandemic and all instead of pretending providing coverage to the uninsured would be taking away their freedom to be uninsured).
> Claiming that EU does not support freedom of trade, movement and work is bizarre. Those are the principles at the core of the EU.

> And of course a country has to, first and foremost, be a part of the EU to have access to EU rights, like free movement in the EU area and so on.

These two paragraphs sum it up nicely. You've fallen to the newspeak.

Back when we were joining the EU in 2004, freedom of trade was supposed to mean everywhere, thus also with Norway and Switzerland, the UsA, Russia, Australia etc. As you said, these coubtries have never been to the EU, so why do they have access to the EU market? How is "left" different from "never been in"? Because you're angry the state left? That's supposed to be fair (core EU value, right?) to the people (as in humans) of the UK?
This is an interesting aspect of the criminal system I don’t often see discussed - for a lot of kids who are dabbling in crime and get caught sending them to prison is how their criminal network grows. It doesn’t help “reform” the edge cases so much as it allows the edge cases to be easily recruited by existing criminal operations.
What about action to figure out what happened?
Tesla Shares Power Higher as Q2 Delivery Figures Smash Forecasts
Exactly. I don't want sum types becuase they're exciting, I want them because they're the simplest way to communicate to the compiler that "my data can either be this or this and nothing else", so I don't blow off my foot by accidentally making it that.

When I was younger and less jaded, it actually was fun and exciting thinking up ways to hack around language limitations like that. Now it's just frustrating.
Ask HN: Should one avoid leaderboards in a mobile game that is not popular yet?
Leaderboards would reveal the game's lack of popularity to players in an obvious way — and hence might discourage them from playing the game.

What do you think?
Speaking as someone who technically would fall in b) in your community list: Java has all of those nice features and tooling now of other static languages, and when I tried out Go I found it tedious to work without them, especially generics.

I mean sure, I'd rather be working in Kotlin, but Java is at least acceptable now.
>Seems like management believes it is better to wait for real bad actor to purposefully destroy your site than have it done by your honest employees by accident.

From a politics standpoint that is completely true. Which would you rather tell your boss:

Q: Why is the website offline?

A: One of our sys admins accidentally deleted it.

OR

Q: Why is the website offline?

A: Some nation-state/teenager launched a sophisticated cyber attack, we need to increase the cybersecurity budget. It's the wildwest out there!
Yeah and definitely never use user-derived data directly in your filesystem.
Incentivizing people to stay home was a bug, not a feature. There is absolutely nothing that suggests the federal government is interested in doing this on purpose (and we might see a lot more people outside if the eviction protection measures aren't revisited by the end of the month). Quite the opposite - the message has constantly been that they want to get people out working as soon as possible in deference to "the economy", public health be damned.

Your local government's response and motivations might be different, but I largely doubt it.