skysight-inc/HackerNews huggingface dataset:
> Why not go all the way then?

Because of more prison time. The moment you start pulling money off of someone else's card either an automated system will trigger an alert or the owner of the card will get a push notification about a withdrawal and the authorities will get alerted.

Just skimming can remain undetected for quite a while, but the moment you start stealing money, your risk will go up dramatically.
Well, pretty sure Novagratz is a still a big bull, and he’s more “serious” than anyone replying to this thread (including me!).
On the topic of masks, unfortunately people are forgetting that initial spread of SARS-COV-2 was through the eyes.

We will learn a lot from the post mortem of this pandemic...
This is a “good” read then. I thought it was really interesting. The pictures of the entrance to the cave are so unassuming too. Just looks like a little bit of dirty water next to some rocks.

https://www.outsideonline.com/1922711/raising-dead
Do you really expect them to actually make a purchase, and then admit to at least $NUMBER_OF_ROWS_IN_TABLE crimes in print?
Contentful announces Community edition, free for developers
sorry, I misquoted the first quote, I mixed up contexts.

> the motives of PWA is to make the web browser acquire as much capabilities as a native app

This is misleading. To get to the point, your argument is that PWAs strive to be just like apps, but run in the browser instead of the OS. This is simply not true.

If you want back the web of old times, just documents and links, then you can pick up any one of such initiatives. Reality however is that PWAs are a successful model: just go to a URL and use it. It runs on a protocol, not some proprietary platform, which gives users enough control (e.g. tracking), while being useful.
Another thing to note here is that the quantum theories are completely compatible with Special Relativity. That is, in non-curved spacetime Quantum Field Theory makes all the same predictions as special relativity does, plus all the quantum weirdness.
It is. The majority of the enforcement work is around industry safeguards and customer re-imbursal from insurance pools. And very little of the work is around prosecutions because the liability is shifted and moved around very similar to a corporation, but even more distributed.

The hacker doesn't hack, but sells the information to be weaponized.

The person that weaponizes only does that to get a giant leak of data, that they sell in pieces.

The person that buys a few cards, gets 1 that works, and now we are talking about a few thousand dollars. Almost too small to care for a big investigation.

And so on and so forth.

There is rarely anyone to levy the whole force of the RICO act + CFAA + Wire Fraud + Conspiracy + Using a fake ID + etc etc
>> it is completely illegible to anyone else.

Then you are one up on me. My handwriting is so bad that I myself often have difficulty reading it. It has never made much difference to me professionally. Anything that really matters is typed into some sort of device.

People at meetings often comment that I take few notes. Typing during a meeting is impolite imho and my handwriting of notes would be less than useful. So I just listen and have learned to remember what was said until I can minute it later.
"Intel losing out to ARM designs is really Intel's choice at this point."

Historically this seems to be the case most of the time. Market leaders miss the next iteration of their industry.
The "Innovators Dilemma" is ever present.

"This 'telephone' has too many shortcomings to be seriously considered as a means of communication.
Western Union internal memo, 1876.
We have recently started removing credentials in env vars and started using google secret manager (previously berglas) and its been amazing so far. AWS and azure should have the same. More challenging when you don’t have all the infrastructure and services in place (ie. when working on plain VPS or other systems without those tools)
Why is that?

Also, as an aside: The very premise of plaintext credentials for computer-computer database connections always seemed strange to me. Maybe I'm just not knowledgeable enough here, but I wish the standard for database credentials was key-based.
"there must be two groups of engineers" -- possibly, but I'm both groups - with Go i'm in the obsessive build group, to the point that people hate pair programming with me, and with Rust I compile less, review more. I'm certainly not driven away.
While you're correct, it's important to remember:

Enterprise-IT admins are morons
I don't agree at all. The reasons in the article all seem like "envs are bad because if you make a mistake you can expose them". This is not exclusive to envs, it applies to all secrets, independent of the medium used to make it available to the process using it.

In my experience, if you prevent using envs for secrets (as docker swarm does) all you get is a disgruntled programmer reading the contents of a secret file to an env in the entrypoint.
Some of the cameras near me are clearly pointed at scenery. I won't presume anything about why they are pointed at scenery and insecure; but I also won't presume that they are intended to remain private.
Show HN: The Slice – Discover products before they hit product hunt
And fix it by making it dependent on something docker specific?
‘true’ is hard to define. If we stick to scientific truth, that domain is a small part of people’s day to day existence:

e.g. science can’t prove ‘does this person love me?’ ‘which flower arrangement is better?’ ‘what color should I paint my walls?’
The way I got around this was to store secrets in Google KMS encrypted files in Google Cloud Storage. The KMS key and encrypted files share the same name and can be accessed by that name programmatically. This secret storage method works really well for me and lets you easily access & manage secrets across all environments. It's so convenient, I sometimes even use this system as a simple key/value store.
Because selling a card online where you never have to meet anyone is much safer then taking a stolen card and start using it where you may end up on camera or police called at point of purchase. Much safer to keep your distance and just sell numbers.
I definitely read every word of that post and still haven't got the slightest clue what it was talking about.
> Why is that?

You don't want to accidentally commit your credentials to github and have the world see them. At least if they're in ENV they stay private as long as your environment does.
Great :-(

Had to read to the end of the description of why environment variables are bad to discover that it is effectively an advertisement for Docker. I don't use Docker so the article told me pretty much nothing that wasn't fairly obvious already, although it is a valuable reminder.
How to pick the best health insurance plan?
2038: Only 21 years away (2017)
... did you just describe an advertising marketplace as an alternative to web search?
It also is completely useless because of the tens of thousands requests random bots and hacking tools do each day on most websites, the many network hops for mobile users, the utterly impossible task of counting time spent per page (on active tab), conversion tracking and so many data that web logs aren't designed to collect or present in any useful way.
It scares me that posts like this always write of Tor like it's not compromised.

I browsed Tor regularly between 2011 and 2013. Late 2012 and early 2013 brought the most precipitous drop in deviant material. Before then, you couldn't throw a stone without coming upon CP(I avoided it like the plague but knew it was there), you could buy literally any drug on the Silk Road safely, and you could easily find bomb-making and asymmetric warfare information. Nowadays? Not so much.
Well, no - it's the foundational problem of knowledge/epistemology.

How you choose to "solve" it is up to you.

The solution computer scientists like a lot is coherentism. You pull yourself up by the bootstraps - like we do with self-hosting compilers.

Of course, it's just a conceptual game (like all philosophy). The idea of "prove to me that you know..." seems a bit like "Jump for me... Higher!"
Just an FYI: I had to disable Ghostery in order to see the streams. I suspect one of the components this site relies on is typically blocked because its used for adware or tracking.
"Live a good life. If there are gods and they are just, then they will not care how devout you have been, but will welcome you based on the virtues you have lived by. If there are gods, but unjust, then you should not want to worship them. If there are no gods, then you will be gone, but will have lived a noble life that will live on in the memories of your loved ones."

Marcus Aurelius
Looks amazing ! +1 on Svelte ! My new goto tool and very refreshing :)
The advice is good. But why is ENV capitalized? The term is just "environment variable". One heuristic I use for evaluating technical material is orthography: if you spell or capitalize or spell something improperly, it's likely you'll get a lot else wrong too.

As for secret storage: didn't we solve this problem with keyrings? If I must put a secret in long-term plaintext storage, I might as well put it in a file, where I can see, access-control it, and audit it. Where's the audit log for someone reading an environment variable value?
It's not so easy, as anonymization is also considered a processing activity (there is still a debate around this but the legal opinion around this seems to solidify), so you cannot just say "I'm anonymizing this data so I can collect it without asking". You will need a legal basis for processing your customers information.

Also, the ePrivacy directive (and the upcoming ePivacy regulation) impose additional constraints on what kind of data collection requires consent, so again you usually can't just refer to the exemption of the GDPR for anonymous data when collecting telemtry from your users, even if you anonymize the data on your server.
Depending on your application architecture I'd look into nsq (https://nsq.io/) which works quite differently from most message brokers in that you're supposed to run one instance of the broker per server so you always have one local instance that you can publish to, no matter the current network conditions.
So the author offers two alternatives:

1. Using docker-secret inside of a Docker swarm

2. Using Keywhiz [1], a Java server together with a FUSE client.

This seems overkill for a lot of cases. If environment variables are such a security problem, why not just use a config file (not checked into the source code repository) with proper permissions set?

[1] https://developer.squareup.com/blog/protecting-infrastructur...
There are plenty of other ways than Ireland.

Much easier way with Americans would be to use their own territory, Puerto Rico.
> Same men that ordered that escalation are investing PRC money. If they are not same they share the same boss.

This is speculation, unless you have sources in which case please share them.

The most detailed and seemingly authentic source [1] I have seen about the Galwan brawl (that resulted in the deaths of 20 Indian soldiers and an undisclosed number of Chinese soldiers) suggests the escalation was not planned but the accidental result of a chain of events starting from a freshly deployed Chinese trooper pushing the Indian party's Commanding Officer.

[1] https://www.indiatoday.in/india/story/3-separate-brawls-outs...
What's a best practice that doesn't use this Docker-specific feature ?
Focus fusion is the hottest idea in nuclear energy
Now every developer has access to any db credential that was in source control. If your project has had hundreds or thousands of developers that is a security concern.
The Power of Static Analysis
> The Chinese government has amassed an insane amount of money and growth during their business friendly periods and is now able to deploy it for protectionist measures.

Saying this, you need to mention just how fast they burn that money.

I once did a contract for a company that participated in a $1.9B OBOR project, where $600M managed to vanish into thin air, $150M was outright stolen, and the remaining $1B never materialised.

The procurator office of the country managed so far to recover $460M from all over the world from the missing $600M.

The most shocking out of the whole story was how the Chinese side reacted. Their stance was like "You "lost" $600M, and so what? We have more"....
>And the latency would add gaps between songs.

You can't preload the next song ahead of time?
Yes you could write a book, but no one would buy it or even hear about it unless you put in the work that he did to make a name for himself.

By the time you established yourself as an expert in the field like he did, consulting opportunities would open themselves up.

I just have a very small network compared to him, haven’t tried to market myself and just through word of mouth, I’ve had a couple of people asking me about consulting for their startups that could have easily netted $30K - $40K at $125-$150/hour.

I have a strict policy about not doing side gigs so I turned them down. But now, I probably would have had to turn them down regardless because of a conflict of interest since I do consulting as part of $day_job.
Because if I give an external developer access to the source code for developing, I won't expose internal data and systems.

Bigger companies also may have different compliance restrictions which means developers don't get access to production, only the Administrators.
I like to use "uncleftish beholding" as a sort of test for possible future hires. If someone has the will and the patience to decode at least a bit of it, then we are into something.
Are contemporary architects disliking his work a sort of counter culture sort of way (because he is everywhere)? What are fundamental complaints against his work?

Did Frank Gehry advance architecture in a way that people are standing on top of his work (figuratively speaking)?
>It feels like one of those things in philosophy that religious people greatly exaggerate the importance of.

Appropriately named then!
The proposed solution appears to be "use Docker", which is a bit lame.
Ask HN: How are online code runner/playgrounds made?
For example, https://play.crystal-lang.org/#/cr, https://play.rust-lang.org/, or https://executeprogram.com

I'm thinking there are two options. Either having some kind of <Language> to JS interpreter that runs the code in the browser, or, running the code in some kind of container on a server and returning the response to the client. In which case, how are the servers secured against potentially dangerous input?
Do you have something set up for the remotes to sync with each other?
Does it take that long for an incremental build?
> Wearing a mask (for the most of us not working in healthcare) prevents you from spreading the disease. It's not for protecting yourself, but for protecting others.

This is true for surgical and cloth masks but you can also buy better masks that also protect the wearer.
By the title, I was ready to read an article about software that was created in 70's or 80's. Nope, 2008.
There will always be someone who thinks being welcoming to a more diverse group that feels offended by existing behavioral norms is madness. I don't see the need to be inclusive towards anonymous people who don't even use their regular identities to debate their points of view.
China announces retaliatory sanctions against Marco Rubio and Ted Cruz
I'm surprised the SOX auditors didn't shut this down. Its the type of stuff the ITIL fanatics hate and makes IBs toxic places to work.
Is Sonia Gandhi PM of India?
Incidentally, for weather, if you are in the US, have you tried weather.gov/<zip>?
Indeed, and this is very far from Brixton! https://www.insecam.org/en/view/370031/
It will result in massive capital flight from other foreign investors.
if you hard code the credentials you can’t tumble them without a complete rebuild. Also, and more importantly if you check in your code those creds are now in source control and should be considered compromised.

Injecting via secrets allows us to tightly control where the secret goes and who has access as well as make it easy to tumble.
The idea that governments can write arbitrarily complicated regulations and this is just "good government" or "moral duty to pay and pay" is stupid on the face of it, regardless of the terminology used.

The so-called loopholes were put there for a reason to benefit someone. If another corporation comes along to take advantage of them in a different way, well, that's just how laws work. Sauce for the goose is sauce for the gander.
You also have to adhere to the ePrivacy directive, which specifies, among other things, how you are allowed to identify users on their devices (e.g. using cookies).
The difference between belief and faith is that belief may be substantiated by evidence and can change with new evidence.

I believe that kangaroos are real. If there were suddenly overwhelming evidence to the contrary, I would say okay and start believing that they probably aren't real, not stay firm in the original belief and dismiss the new evidence as a test of my faith.
Washington NFL team dropping 'Redskins' name after 87 years
If migrating your infrastructure to swarm is not feasible:

- make sure to sanitize the environment before spawning any child processes.

- Be sure to `set +x` (or your shell's equivalent) in your CI process

- that your secrets never get interpolated into a string through your scripting language.
You're right, it's harder on very long, unfamiliar words (especially technical terms). I do have to reread some of those, and it slows me down.
No love for MQTT as message bus in this space?
I’ve been moving towards implementing an API based CMS, specifically prismic.io which allows me to setup content elements that marketing staff can edit.

Can you explain a bit more about the non-tech user experience for content editors?

Would love to find a magic Wordpress replacement with a proper git & tailwind supported workflow for devs and a simple interface for content editors. I’m hoping this fits the bill.
The website of the divers research institute has some neat 3D models of a couple of mining sites: https://www.cindaq.org/copy-of-sagitario-la-mina
> It does protect yourself, also.

True, but not 100% accurate. You can get it also through your eyes, or by touching something infected like a door knob and touching your eyes or mouth.

> CDC and WHO were both saying NOT to wear masks

I believe they were saying to not rush and PURCHASE masks, that is different to say "NOT to wear masks". It was the period they were appealing to common sense: to keep a distance from others and cough in a kleenex or in your arm, and stay at home.
> Yes you could write a book, but no one would buy it or even hear about it

Lol thanks for the attack on my writing skill and ability to promote myself!

Being an expert in a field and being able to write a book doesn't mean you're any good at consulting. That's my point. It's a different skill.
>Expert consensus is more likely to be correct" is falsifiable

That's one of those things that sounds like it should be falsifiable, but in practice it's not. The statement is far too broad to conduct reasonable experiments, and if you narrow the scope to the point where you can conduct experiments, then your experiments won't support a conclusion that's broad enough to be a sound foundation for "expert consensus is more likely to be correct".

I happen to think expert consensus is generally useful, but there's still an element of faith in my opinion.
Use a config file not checked into git
“Sold out” doesn’t mean anything if the are selling below cost (doubtful) or if they aren’t selling enough to make it worthwhile investment of time and money.
Productivize Issue #2
Hey there! Happy Monday. Productivize issue #2 is out. Super excited for this issue!

I learned a lot from last week and made some improvements. Hope you like it and find value out of it: https://productivize.substack.com/p/productivize-issue-2
I think some readers are misunderstanding this, a cloned card in this context is actually skimmed from an ATM, which allows you to copy the physical card because you have copied the magnetic strip and also have the PIN associated with the card, though this is not the same as having the card number, expiration & CVV2 code from online phishing.
Totally. Not only made this possible technically but was a huge inspiration.
Amazon has a similar offering called Secrets Manager which can be used for sensitive secrets as well as configuration values.
https://aws.amazon.com/secrets-manager/
a) Likewise!

b) This repo contains a sample research repository. The sample we provide is training MNIST for classification.

To use: (1) install using the installation instructions in README.md, then (2) train using "python research/train.py".

When you train:
(a) a timestamped folder will show up in (/outputs) containing training logs
(b) a Visdom server will auto spinup on port 8000 (localhost:8000) showing training plots

Correct, the config comes from (research/configs/default.yaml). The magic of Hydra (thanks to Omry Yadan @omry) is that you hierarchically define yaml configs. I.e. in default.yaml, when you say "backbone: vgg19", that pulls in the config "vgg19.yaml" and merges it with the default.yaml config.

Specific things we include:
- "LogDirector" that lets you log to multiple modalities by setting up a recipe
- example of correct Hydra usage
- example of Ignite usage
- auto Visdom server spinup
- lots of helper functions common in computer vision research

We're still working on docs, they are not clear enough!
No report button. Already seeing racist usernames.
Ocean Protocol Delivers Proof-of-Concept for Daimler
India does not want more East India Company - like situations, maybe?
ThinkTiny Volume #1: Newsletter About Tiny/Unique Living
> That works only as long as the machine is truly optional, ie you cannot have a case of people not able to vote because the machine doesn't work.

The OP said the machine was for counting, not for voting.
Arch for desktop, mostly because packages are very up to date and I like the AUR package system.

Debian Stable for production stuff.
This is commonplace for most people when they start working on a new project, including myself. And sometimes when you are rushing through to meet some deadline it slips through and you end up realizing a lot later. In order to tackle this, I've developed the habit of adding a middle layer in the code between the configuration (whether it be ENV variables or config files) and the actual application. So when you eventually have time or realize that you forgot about it, swapping/fixing it isn't an issue.
Wow. That is wild. The brain never ceases to amaze.

In your case the scotoma was causing interference to the visual signal after or ouside or ?? the part of the brain that is processing the vision for reading. Or like in a hologram (which the brain is sometimes likened), you can remove any part of the hologram and still get back the origional image as it is distributed through the entire thing?
Your argument assumes this is a fixed-sum game?

The story changes if the web continues to grow and more folks do more business over the web.
Why not use KMS for storing keys directly?
> how is that possible and acceptable by authors?

I had no problem accepting just 10% of my book sales - without going through a traditional publisher, it would have been impossible for me to get my book carried by physical book stores. Of course, this was 10 years ago, when physical book stores were more common; this may not be such a consideration today.