skysight-inc/HackerNews huggingface dataset:
I don't know that you really need to put emphasis on "super secret way to break SGX". Any single attestation private key, combined with cooperation from Signal (or a compromised Signal operations admin) will suffice. SGX attestation has now been publicly broken twice in two years, first with Foreshadow and then with SGAxe.

To give some color to what "publicly broken" means: there's currently a live Twitter bot put up by UM that signs valid attestations using an extracted (non-revoked last I checked) SGX attestation signing key [1]. The previous exploit, Foreshadow, also had one [2]. Enclaves with the very latest microcode updates will reject those attestations (and Moxie says Signal has installed those updates, which I believe), but this vulnerability is now several months old and has been in non-public disclosure for most of that time, long before microcode updates reached end-customers like Signal. This means that any of a team of grad students and professors who worked on this paper (and this is only one such team doing this work) had access to the ability to "super secretly break" SGX during that time. Based on the team's track record: I would personally bet $500 that some team regains this capability sometime during the next 12 months, using an as-yet-undisclosed new exploit.

So we're not talking about "NSA levels of exploitation" here. We're talking about "can I pay a smart grad student" levels of exploitation. And one such exploit, combined with Signal's cooperation, means the loss of all backup data in an irrevocable and untraceable way.

[1] https://twitter.com/SGAxe_AaaS
[2] https://twitter.com/foreshadowaaas
In the article it mentions Wikipedia as an example.

Yes, Wikipedia’s content is available for Google to take and display on its own site. But by not pushing through the traffic Google risks starving it off long term.

I used to work for a very large forum and information site, and as more of our content got picked up by Google’s snippet boxes, the more no-click searches and the corresponding decline in traffic we saw.

Google’s push to increase revenue is slowly but surely killing the golden goose.
From the research institute that made the discovery: https://www.cindaq.org/copy-of-sagitario-la-mina

WHY IT’S IMPORTANT:

* The discovery has the potential to help us understand the social and behavioral complexities of the region’s earliest inhabitants.

* This new research shows ochre was of great, if not critical, importance to the culture and lives of Paleoamericans, given they were willing to take such enormous risks to get it. Red ochre is the most commonly identified inorganic paint, used throughout human history. It’s considered to be a key component of human evolutionary development and behavioral complexity. Ochre minerals were collected for use in rock paintings, mortuary practices, painted objects and personal adornment. They may even have had medicinal qualities.

* The mining activity from more than 10,000 years ago also shows the early application of geological principles that were only documented 400 years ago.

* Together with the exploration of Hoyo Negro, where the remains of Naia were found, the exploration of these caves is advancing research techniques, especially using 3D photogrammetry and virtual reality.

* The abundance and diversity of animal and plant remains found in these submerged caves enables scientists to recreate what the environment was like for Ice Age Americans.
Saying yes slowly is what’s hampering progress today
Cheap overseas labor subsidizes the rich here. The political class has crushed small business by allowing large corporations to outsource their pollution and side-step labor and safety laws.

If you want giant international corporations to run the world, this is the way.
Relevant XKCD: https://xkcd.com/378/
This seems like mostly the technical nitpicking that goes on with any crypto protocol. There aren't any holes here, and as a competent non-expert I'm having trouble deciding on whether any of these criticisms even rise to the level of a theoretical vulnerability. It's all best practices and hygine stuff. Which is fine, but hardly justfication for "Bad Cryptography".

I mean, these are the mistakes that everyone seems to make (including the blog author, who seems to have retracted one of the bigger claims). Stuff happens in engineering.

And the "GNU" angle is just bile, or a cynical attempt to get clicks by leveraging hacker political sentiment. Yawn.
Yes, that claim was repeated by many. Doesn’t make it true.
The entire concept of software and is that the marginal cost is 0. If it gets to the point where there is a one to one ratio between worker and service, it becomes yet another commoditized race to the bottom.

There is also nothing stopping many of the three billion people in India and China from producing these services and now all of the protectionist policies in the world won’t protect “good American jobs”.

But as far as Amazon and Apple, that’s just the point. Apple’s “manufacturing employees” are overseas and Amazon is trying to automate more so that they don’t need as many FCs.
There are way too much politics and partisans in science, and that is the leading driver behind people ignoring science and scientific evidence.

Just consider why a conservative or skeptical person would not trust Covid information. Fauci and the US Surgeon General knowingly lied about the efficacy masks and then now they are treating people who don't wear masks as pathetic morons. Health care policy "experts" chastise people for attending rallies, protests, or gatherings... but then come out and say anti-racism protests are okay. Apparently Covid-19 will not infect you if you are at a "correct" rally... but if you are at a Trump or conservative rally then you better watch out. Come on.

That's not science. Get politics and partisanship out of science.
The author's arguments aren't compelling. Most of his points can be solved by properly configuring any logging processes to grab only what's necessary and not letting newbies commit unreviewed code.
>The results page always has links if I care to dig deeper but 99% of the time I'd rather get the answer and move on.

So, by your own numbers, websites that create the content have just lost 99% of your page views to Google.

>What kinds of searches are you thinking about?

Sounds like pretty much all your searches can be used as examples then.
Show HN: Django on WebComponents (without NodeJS)
I think the perspective to think is Google is investing despite perceived ‘protectionism’.
Best Marketing and SEO Tools to Crush Your Goals
Some context: https://news.ycombinator.com/item?id=23789659

https://news.ycombinator.com/item?id=23793942
Underdetermination is the idea that evidence available to us at a given time may be insufficient to determine what beliefs we should hold in response to it.

https://en.wikipedia.org/wiki/Underdetermination

This is closely related to the is-ought gap - now that I know the facts, what am I supposed to do with them?
> Also avoid and evade are similar term.
> P.S. can someone explain why I get down votes for something factual? This forum is ridiculous at times

"Tax avoidance" and "tax evasion" are technical terms in accounting with very specific definitions and entailments, and the difference isn't just in the English words. Most accounting textbooks and courses cover this.

https://en.wikipedia.org/wiki/Tax_avoidance

https://en.wikipedia.org/wiki/Tax_evasion

Even in Europe, this technical difference is recognized, but with one catch: the EU has enacted a counter-avoidance directive (ATAD, Jan 2019) - evasion is always illegal. This is not the case in most places around the world.

Infographic:

https://www.europarl.europa.eu/news/en/headlines/economy/201...

Fiscal vocabulary:

https://www.europarl.europa.eu/news/en/headlines/economy/201...

Finally, the HN guidelines provide good tips on how comment productively. (see the In Comments section) This helps us learn from each other's experiences.

https://news.ycombinator.com/newsguidelines.html
How many sites break because of Google Analytics being blocked? Do they even realize that their content appears broken?

Many sites use JavaScript client-rendering, even for static content. Sometimes, the analytics failure blocks the rendering. I've experimented it recently, with a blank page for a French governmental site (securite routiere) and with a truncated content for an American newspaper (Boston Globe, IIRC).

When you send a server-rendered page, you know the content is present, and very probably it renders correctly on the client. Transmission errors are logged by the web server. With a SPA, many factors could break the rendering, and the web server won't hear about it unless hard work is done to collect JS errors.
Kapital (the Smalltalk system) wasn't much of an influence on Athena. Athena was very much a SecDB/Slang derived effort.

And Kapital was an interesting experiment but rightfully died. Smalltalk just wasn't the right environment for something that complex and scale. I'd expect most lisps to suffer in the same way. And TBH it was more the image based model rather than the dynamic language per se though that was an issue.

There's a point where dynamism becomes a liability and Kapital went way beyond that point. Python fares a bit better but still, a huge effort is needed to control its failings at scale. This isn't helped at all by sticking a DAG in the middle of it as was done with Athena and its ilk. This all can be made to work but in the "cos its Turing complete" sense rather than the language helping in any meaningful way.

Source: I suffered through it.
Interesting post and very nicely arranged.

I wonder if framing the problem "correctly" and applying domain-specific transformations (as you mentioned are out of scope for this post) would present a synergistic response, that would otherwise be lost in poorly framed solutions?
Brokers in Pulsar can be seamlessly added or removed.

Bookies can seamlessly be added.

Kafka unless there has been a KIP since I stopped paying attention to Kafka doesn't do this.

I remember adding brokers to Kafka and taking advantage of them on existing topics meant repartitioning which if I recall correctly breaks the golden ordering contract that most devs bank on. The data written to the partition will always be in the order for that partition itself.
You lose the serendipity of other things sites might tell you - you get Dr. Fauci's age quicker, and a few other bits that Google sanction as appropriate for you, but that's all you get. Google can censor the rest of the facts if they choose to, and you'll never know because you don't leave the safe walls of Google's search page. To date Google have 'only' censored search results in countries like China, but doesn't have to be the case. They could manipulate what they show people. At least on Wikipedia there's a visible history behind every edit.

The other side of that coin is that you also have to pay the cost of losing of the freedom to be discovered online if you have something to say. If you have a brilliant way of telling people the weather with 100% accuracy then you're not going to get anywhere with that because no one leaves Google to get the weather forecast any more.
We made the mistake of not conflating East India Company with Britain, and it didn't end well for us.
Entreprenocracy, Fake Scars, & Unfulfilling Fame
In years past I've done some shotokan karate, tae-kwon-do, and Brazilian jiu-jitsu. And I wrestled in high-school.

All in all, I'm a fan of grappling oriented arts like BJJ, Judo, catch-wrestling, etc. But what art to study depends, in part, on what your goals are. Self defense? Fitness? Mental discipline? Making a living fighting in the UFC? Something more "spiritual"? Those choices could affect what makes sense for you.
I've worked in one, at Case Western Reserve University in Cleveland. The Peter B. Lewis Building: https://weatherhead.case.edu/about/facilities/lewis/default

Among other problems: (1) no provision was made for the fact that Cleveland gets snow and ice, leading to barriers for pedestrians to avoid their evisceration via detaching ice sheets from the curved roof, (2) the glare off the roof is focused straight down a nearby street @ 5pm, creating driving hazards, (3) it's difficult to navigate internally from one side of the building to the other.

Most star architects are hacks, coasting one step ahead of being made to answer for the flaws of their previous projects. The more famous the architect, the more they feel obliged to ignore basic design.
There's two parts to this that you're unfairly combining

There's what you don't like, and there's what you don't trust (in the computing security sense of the word).

If you don't trust them to not do stuff that actually harms your computer, you shouldn't trust their content.

The sites that serve most of the malware on the internet don't have stuff Google is going to quote in a search result...

-

Now there's the stuff you don't like, their big ads, and their slow page and what not, but that's their content. They need to pay for it somehow.

People will pay $5 for coffee from some random coffee shop they've never visited, but they won't pay 99 cents for an app someone put a few years of development into with 5 star reviews.

-

If you like their info, but not how they want to deliver it, why not abandon it until they change their tune? Why act like Google is doing some great service robbing them of their traffic just because you don't like how they serve info?

Especially when enough people apparently are ok with it that Google felt they were the best place on the internet to steal this info from?
It doesn't seem like even with analytics they know

It just gives a false confidence in bullshit.

Most internet analytics and the billions spent on data mining is all for naught.
Sure. And sidecars share a bunch of things with the main container. I am simplifying in an inexact handwavey way. You should still think of a pod as primarily a single container, and design deployment around that.
Maybe he's got a history of working with PHP? $_ENV is an autoglobal array that gets filled with environment variables.

https://www.php.net/manual/en/reserved.variables.environment...
Hong Kong isn't a golden goose any more. Hong Kong went from representing about a fifth of the Chinese economy to about 2% today. The Shanghai stock exchange today is larger than the one in Hong Kong, and the perception in China has shifted from seeing it as an important economic region to a political nuissance as the role of foreign capital diminishes. It's not seen as a dynamic region any more and the tech talent goes to Shenzhen or the Greater Bay Area and to mainland universities while HK suffers from stagnation, so basically they've decided that now is the time to incorporate it before the situation becomes politically untenable.

The situation with India is more complicated and there's actually no consensus inside the party. The arguments for the more assertive stance are mainly that there's right now a huge asymmetry between China and India, simply put India doesn't stand a chance in an actual conflict. The hawkish factions inside the party argue that conflict is inevitable so now is the time to clarify matters as long as China has a tactical advantage.

The jury's actually out on whether that's a smart move or not. From the perspective of the Chinese there's certainly a case to be made for it as the US is in political disarray under incompetent leadership.
If you put secrets in your codebase, they're now on x machines, where x is the number of developers on your team, plus their old laptops they gave away to family members and forgot to wipe, plus Backblaze because one developer doesn't have git repositories excluded from their backup settings, plus GitHub because that's where your repo is hosted.

If you don't store secrets in your codebase, they're just on ~one machine: the server hosting your application.
You can make everything in anything, and it doesn't prove anything!
Quote from WHO in May:

>If you are healthy, you only need to wear a mask if you are taking care of a person with COVID-19," the WHO guidelines read.

That was the early advice, countries with experience in pandemics like Korea knew this was bad advice. Seems to have been generally common knowledge that wearing masks reduces the chance of both contracting and spreading, which is why doctors wears masks
> "...there has to have some advantage at some level even if it isn't obvious at all."

I don't think 'natural selection' makes a bidirectional claim in this way. Not every gene expression is an advantageous mutation. In other words, a lot hinges on your interpretation of 'advantage'. Darwin's observations of advantage explained difference, whereas a mutation which leads to similar traits in organisms would not have an advantage per se--it's just mutation, replication, selection. repeat.

This is not my field of study. Maybe someone else can correct me or say this better...
Just How Good Are the Mainland Chinese Fighter Pilots?
> If you see the letters GNU in a systems design, and that system intersects with cryptography, I can almost guarantee that it will be badly designed to an alarming degree.

Battle of heuristics: furries vs GNU
As the comment one level above mentions, trusting experts is basically just a heuristic.
Kubo_Lis talks about his sense of style, photography, fashion and more
Open source isn't a term exclusively owned and defined by the OSI.

You can define it however you like, but that term has long been used to describe projects that don't quite fit in OSI's box.

To be clear- I think OSI has the best definition that I would like to see- but 'somewhat open source' is certainly better than nothing.
I've had PyTorch Lightning recommended before, and heard it works great! My main concern is that it isn't officially supported, while Ignite is part of PyTorch.

Ignite is still in alpha and needs to catch up, but I get the feeling that PyTorch / FB will commit resources rather than folding in Lightning (unlike TF did w/ Keras). The new releases are already promising (w.r.t. distributed training).

Always looking to collaborate, and please lmk if anything above is incorrect.
Maybe if all of your stuff is in docker does this article make sense. Otherwise it is just directly wrong.
Use ENV variables they work.
"Philosophically science is about being interested and studying broad range of topics and areas to judge everything for yourself and make your own conclusions, not trust expert opinions."

Not quite. It's observation of the world around you. It doesn't preclude experts' opinions, it takes them into account. Reinventing the wheel isn't the goal of science. The goal is to understand why a circle might be the best shape for rolling and under what circumstances it might not be.

More specific to current times, ignoring the advice of epidemiologists with respect to masks and social distancing is proving to be costly in life and economy.

"In my experience, whenever I have to rely on an expert opinion I usually feel bad later when I acquire more knowledge in the area myself, as those opinions are almost always wrong."

Care to share a specific example from your life?
WeWork expects to have positive cash flow in 2021, Financial Times reports
So to mitigate the security risk of ENV variables I should run a JavaVM, a Java Server, and a FUSE client? No thanks.
Yeah, nobody sells dumps+pin for $25. This just doesn’t happen.
How Bluetooth Got Its Name
1. the OP works for Plausible

2. The OP uses a non-standard call to Plausible which probably isn’t in many block lists

3. It’s in mine
Enigma code-breaking machine rebuilt at Cambridge
My wife used to say that a lot of the words were sexist and violent in programming - e.g. when I talked about killing a child process, I never thought about it, but some do it seems.

(I've also had women say, they'd never become programmers - its to competitive and macho), to be more inclusive language means something to many people. I'd feel silly for example if instead of saying fork a process, we say we nurture a child process. I can't speak to race - grumpy old white guy, but I can see how it would matter.
because traditionally envs are all caps. I think it conveys that extremelly well
I don't understand the relationship between containers, kubernetes and JVM.

I run a prod Pulsar cluster using helm charts. All containers & kubernetes, zero issue.
We did 200 miles over four days (across the state of Maryland on the C&O trail). We brought a tent and a hammock for sleeping, then we spent the last night on a hotel.
And in their desktop apps (at least for slack and zoom).
If we break AI apart and look at it; Artificial - human made. (As opposed to something emerging from nature)
Intelligence - ability to acquire and apply knowledge and skills, (oriented agency modulated by prior experience or observations)

Slightly tongue in cheeky; in most countries it seems corporations gained the right to vote before many minorities (or even majorities) [citation needed?]. If we assert that voting is the measure by which one affects political power
If you’re already installing and removing skimmers, quickly stopping at a few ATMs doesn’t seem like much work.
As I used to work in a high-crime area, I placed fairly low daily and weekly limits on how much I can spend. I have to warn the bank at least 1 day before if I want to spend more. So chip+pin allows for mitigations where cash doesn't
Who was the us in that scenario? There was no India back then, just a set of kingdoms and 'princely states' that hated each other as much as they opposed any European takeover. The present circumstances are in no way similar.
Agreed.. No way you’re getting access to private repos, ever.

Too bad, looks like a really good product.
From experience, it's good to support multiple ways of configuring an app. Depending on your case, this could become hard or requires naming conventions.

This way you can move secret data to files if needed depending on the deployment choice.

My own rule of thumb is:

1) sensible default value

2) read from file

3) read from env

Examples:

- https://github.com/spf13/viper

- https://docs.spring.io/spring-boot/docs/current/reference/ht...
I am progressively adopting Hashicorp Vault as the secrets manager of choice. It can be used by a variety of different scenarios -- directly into the application using AppRole, with Terraform using it's secrets provider, by developers, during vault authentication when they get their secrets and access regenerated.

This way I am not bound to docker swarm, or keywhiz, or god forbid AWS Secrets Manager.

As of now, I am still exposing secrets with Env Vars, but the next step is to use Vault directly. Vault has been pretty reliable so far. It is using AWS KMS for managing the master key and a scalable DynamoDB table for high availability backend.
It all tends to be interconnected. A number of people ask me for advice based in part on the last book I wrote. I'm happy to give them a free hour phone call as it's sort of good ambassadorship associated with my day job. I could do a side consulting business in the space but don't really have an interest so I give them the name of one or two people I know who do have consulting businesses if they want to dig deeper.
Excited to try this. Nice work!
> I think the author should consider supporting other languages though

Looks simple enough that someone could clone it to run "Subreply for Korean."

IMO: I find mixed language social networks and threads difficult because I usually don't understand the other language.