skysight-inc/HackerNews huggingface dataset:
Some more recent titles I know of are Pocket Rumble and Blue Revolver.

A lot of game devs use frameworks or engines that strongly encourage or require the user to use C#, javascript, gdscript, or gml. Solar2d and love2d use Lua but don't seem very popular. Fewer people are throwing together their own thing in C++ and putting Lua inside.
> -1 points

Stay classy HN
I still have some more research to do for the OIDC article, but in theory, yes. OIDC runs as an identity layer on top of OAuth. The only thing that makes OIDC unique is that there's a widely accepted "scope" that provides standardized ID information, which is bundled into an ID token and sent with the access token. So there's no reason two applications that are built on the same protocol can't communicate.

Good question, I'll include it when I write the next one.
Why Coinbase Is Not Using Kubernetes to Run Their Container Workloads
Yes. I just posted asking basically the same thing:

https://www.washingtonexaminer.com/business/jack-dorseys-per...
Getting Work Done in the Scala REPL
In the US, "tax avoidance" is a term which describes procedures that are always legal. When you stated "avoiding taxes" I believe you really meant "tax evasion".
Sabine Hossenfelder examining if there is a minimal length might complement this.

http://backreaction.blogspot.com/2020/02/does-nature-have-mi...
Or maybe people will stop believing everything that they hear on the internet.
It's quite common to restrict connections to whitelisted IPs
Right.

For a very good (but not exceptional) developer, I wonder if ending up "out on the street" would be a reasonable expectation if something like this became truly widespread.

If companies like Google were no longer able to filter false positives __at Google scale__ using their current hiring practice, I wonder how long it would take to decide that the next best thing is to contract some tunable number of N contractors for K positions where N >> K and only keep the best M (K <= M << N) of them. (I expect a company like Google to occasionally keep more than K because they can't afford to throw away rockstars if they get a great cohort).

So, even if you're pretty good - if you aren't better than the bottom x% of your cohort (or some other aggregate measure) - you're out. Stack ranking for C2H, basically.
Everyone’s views in this discussion are really enlightening for someone like myself who has been consumed with nothing but programming the last few months! Miss being a kid and dreaming about space travel.
STAR is not just for Amazon. It's a great way to answer "behavioral questions" at any company. On the other side of the table, as an interviewer, I can recognize the STAR format instantly and am very appreciative that the candidate has taken the time to structure his or her answer in this easy-to-digest way.

Also, and I don't know if there is a nice acronym for it, but I like the formula where you:

1. Say what you're going to say

2. Say it

3. Say what you said

So if the question is "Tell me about some things you consider when you need to do task ABC," You structure your response like this:

"I'm going to describe the top three things I consider. 1. Foo. [Details here]. 2. Bar. [Details here]. 3. Baz. [Details here]. In summary, Foo, Bar, and Baz are the things I consider in that situation."

Is a much better response than unstructured word salad that contains the same detailed content but jumbles it all together and kind of trails off, leaving the interviewer wondering if the candidate is done talking.
Twitter allows users (typically companies) to "promote" tweets, causing them to be seen by users who are not following the account, and hence would not typically see the tweet.

When a user promotes a tweet, they are given the option to hide it, so that it won't show up to users who are following the account directly, or who are looking at the account's profile. This is so that (for example) a company that posts a dozen different variants of an advertisement for different markets won't have all twelve of those show up on their profile page, or on the timeline of any user who's following them.

Apple, for whatever reason, seems to set the "hide this" option for every tweet they post and promote. Why? Beats me.
A Hacker Used Twitter’s Own Admin Tools to Spread Cryptocurrency Scam
Not turning the whole thing off brings more attention (and thus ad revenue) to Twitter.
The problem is we don't like the process, but not many people propose reasonable solutions. One extreme is just hard LeetCode questions, and the other is, "they should just talk to me about my experience and projects." We need something in the middle. Some ideas I've been thinking of:

- Pair programming with a problem that neither the interviewer nor the candidate has seen. Doesn't matter if they can't find the optimal solution. It would show how good of a communicator and how proactive the candidate is.

- Make the candidate implement a solution to a problem that's already solved. The interviewer shows the problem, explains the solution, and the candidate needs to code it. It would reveal the coding fluidity, understanding of specs, how they ask questions, etc.

Thoughts?
I’m seeing a lot of discussion of the DMs being the real target, but executives and politicians usually have staff who monitor and post to their social media channels. Hard to imagine Barack Obama communicating anything of blackmail value over a channel that a mid-level social media manager has the password to.
Discussion from two days ago: https://news.ycombinator.com/item?id=23825132
Pittsburgh Pro, 34 pc. precision screwdriver

The label is on the back. The front is a clear lid which shows the flexible extension, a straight extension, the screwdriver (black and green), then four rows of bits.

It's a pretty decent set. It's kind of funny though, the warning label on the back says to wear "heavy duty work gloves during use."
It means they use paid tweets (ads) to ‘tweet’.
At the moment yes though I have previously lived in other countries with and without obligatory ID.
Yes, true regarding the very last part.

My first "real" CS-related interview, which had technical questions, I had on the very same day that I had taken my final exam in our data structures and algorithms class. And because our DSA class was quite rigorous, I knew the material in and out.

I absolutely aced those questions, but did poorly on the systems design questions because, well, I simply did not have much experience designing or building complete systems/software.

Years later, it was the other way. I stumbled my way through the DSA questions, while acing the systems questions.

But with that said, I think also the order of your performance matters. If you walk in, and absolutely bomb the first topics, I think there's going to be a bias against you. Maybe they'll think you're a moron, or something like that.
They're not always losing schemes (i.e. only some people lose), it just depends on if you're at the end or not. The reason they were encouraged is because people enjoyed gambling on how long they would last, and it was extra incentive to use BTC, etc.
You can, but typical spam target won't, because they don't think they need to - they think it's a legit thing so they don't need to make any effort to hide it.
Are you?

Or just avoiding an easy conviction under tax evasion laws?
Twitter support explains how they were hacked
There are companies that do that and make AML/KYC databases for the exchanges to use.
As the replies to this are getting at, it's really important that if you do this you don't require the candidate to use their own laptop.

You need to provide a laptop or like, a mac mini or something you know you can plug in and has baseline requirements for working on the problem you're giving them. And you need to make sure that the problem isn't complex enough that they can't do it in the allotted time if they struggle a bit with an editor they're not used to (including like, vim without their usual barrage of scripts).

Otherwise you're just trading one bias for another: winners will be people who have personal laptops set up for coding, which is not a universal trait of good employees who code.

Let them use a laptop they bring if they want, but be ready to supply them with something they can use if it doesn't work out.
> Cloudflare uses this extensively

Thanks for this mention - I found:

CloudFlare repos on GitHub using Lua: https://github.com/cloudflare?q=lua

Blog posts with "Lua" tag: https://blog.cloudflare.com/tag/lua/

Pushing Nginx to its limit with Lua - https://blog.cloudflare.com/pushing-nginx-to-its-limit-with-...
Just want to say congrats for coming out of the pandemic better than you started
I don't know of any countries that are still on a gold standard.
Buy Chinese tea set-Oriarm tea shop
One thing I've learned in life is that nothing is as polished or automated as you'd think. I would be surprised if anybody was doing this except maybe high tier law enforcement.

Only because I've seen first-hand how advanced their taint analysis is, so I'm already over that surprise.
Yes, modern query-oriented compilers (such as TypeScript and C# Roslyn) keep the AST in memory and co-operate closely with the editor via the language server protocol.

I recently saw an example of a language that aims to be AST-first rather than notation-first: it serialises to XML! http://mbeddr.com/
Could PWA's be installed on a phone like this, through browsers like chrome or firefox? That would greatly lower the barrier to entry to "develop" for them!
Exactly, this was the bug bounty
In this thread some people shared screenshots of the dashboards. I said low-level because some reports said that the hacker paid 2k to the employee to have access. I dont think a high-level employee would sell the credentials for that amount of money.

Although I could be wrong if the reports are wrong too.
I'd like to read more about this. It would be a little unfortunate to end up with Python's "x in y" and "del y[x]" just to differentiate between missing entries and present entries set to nil.

On the other hand, my not-very-well-considered preferred approach creates some asymmetry between arrays and maps as to what values can be stored. Or it perpetuates the existing asymmetry between varargs and tables...
“I would probably look it up” is the correct answer unless you’re interviewing for a very specialized role. I had a similar experience interviewing at google (and I regret not walking out), and a much more pronounced experience at MS (where I did walk out and don’t regret it).
It's telling that you can't point out one specific example; that you have to make one up.

If it was protecting you, or others, it seems it would be easy (or at least possible) to rattle off several examples.
I would love that. and a future eInk device.
Because that would require dozens of simultaneous simjacks on corporations, billionaires and politicians. Simjacking has about a 20 minute - 4 hour effective window, shorter if the person uses their phone extensively. Hacking the 2FA of Apple, Bezos, Buffet, Gates, Obama, Musk ... in that time window ... naaaaah.
I had the opposite experience, once you grind problems on leetcode and figure them out yourself, you somehow never forget them, esp under pressure in an interview. The problems aren't exactly the same of course but like Polya's book "how to solve it" describes solving a problem by considering something similar you solved, when presented with some interview problem to work through the first things that came to my mind each time were previous silly leetcode solutions I came up with that bought me some time instead of blanking out.
Since the subject is pretty abstract, you need a certain level of mathematical maturity to grok the concepts. A previous course in abstract algebra or geometry (involving proofs) would be useful.

Introductory texts in topology tend to divided into two main subareas - point set topology (the low level axioms of how you define a space and its connectivity properties), and algebraic topology, which focuses on the global mathematical structures of these topological spaces. I found point set topology extremely dry when I first learned it, but it's important to understand those low level basics before moving on to the "cool stuff" in algebraic topology. I recommend "Topology" by Munkres to learn the fundamentals.
A lot of people are buying bidet toilet seats, which retrofit onto existing toilets.
It is not just Italians, but latin based languages (Spanish, French) are also known to use more gestures, while Germanic ones, a lot less... eg. German, Swedish folks almost come out as 'robotic' compared to Mediterranean countries.
Can you describe what that is in more detail? that’s fascinating because i thought monero was untraceable from their claims
I wonder if Twitter will get sued for this...
There is no gold anymore, mate.
Another good one is "A Man for All Oceans" about Joshua Slocum. Slocum was the captain of several large commercial sailing vessels in the late 1800's before his famed solo trip around the world. Over the course of his life he also witnessed the transition of commercial shipping from sailing ships to steam ships.
This looks great! How would you compare with Tandem?
I mean because nicotine might be protective against the coronavirus, and that protective effect might outweigh the harm of vaping. Certainly not proven (and please nobody start vaping because of that), but there's some weak evidence and it's funny.

Of course vaping's real benefit to public health comes from smoking cessation as you say, since smoking is (per my comment above) really deadly. I was disturbed to see the public health authorities blaming nicotine vaping for the lung injuries last summer, given (a) the ample evidence for vitamin E acetate as the cause; and (b) the cost in mortality from smokers who got scared by their misleading warnings and either didn't switch to vaping or switched back to cigarettes.
Why would you need to anonymously short the stock? It feels like it would be easy to get lost in the noise of regular shorts.
This is correct. It's unfortunate, but unless you can mandate Google to change their entire interviewing regime, you have to simply understand that this is the perspective, and move forward demonstrating yourself against this criteria, whatever else you may think.
>We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.

I wonder the size of the population of employees that have access to these internal tools. How many people can independently fire off a Tweet from Jeff Bezos or Elon Musk and erase billions from the stock market? How many people can seize the account of Joe Biden (or presumably Donald Trump) and cause a huge international incident?
So I assumed this was fake news until I looked it up.

Section 11.d.2.c of the executive order

https://www.michigan.gov/whitmer/0,9309,7-387-90499_90705-52...

>Close areas of the store—by cordoning them off, placing signs in aisles, posting prominent signs, removing goods from shelves, or other appropriate means—that are dedicated to the following classes of goods:...
Garden centers and plant nurseries.

Also, I find it terrifying that politifact and numerous other websites claim that this was false.
It's interesting this article is not treading higher on HN. With the general rational / enlightenment perspective that HN has this should be a hot button. The denial of rationality and logic as a way to know things is antithetical to most of what gets posted here (and this view is gaining traction).

I was hoping for a strong defense (steelmanning) of the pro intersectionality view. When I don't see how anyone could believe the claims, I question if I really understand the counter arguments.
The feature wouldn't be tweeting per-se but acting on behalf of the user, which can prove useful for support or debugging. The side-effect is that obviously it also allows tweeting if you wanted to.
Dude, you're missing the point. Women are actively chased out of tech. This has been going on for decades. Don't you remember a few years ago when half of the guys of 4chan doxxed and threatened to kill dozens of female gamers because those women dared to ask if games could treat women a little more fairly? I mean, its not like this is ancient history.

Can't you take some responsibility and educate yourself rather than asking me to educate you? I'm sure you taught yourself how to program by researching online, why can't you do the same thing to understand how shitty girls and women are treated in tech domains? Unless you just don't care? I don't get it. smh.
At one company where I was the interviewer the company used a few simple java questions for each screening (not great I know). It was basically just a way to make sure they did have experience with Java at at least a junior level. This became an issue when we started getting candidates from recruiters. One candidate bombed on the first question. Then when we asked the second question they answered the 3rd. Clearly the recruiter was trying to coach the candidates based on past questions.
So it was a social engineering attack against employees with high level access. This sentence still doesn’t make sense to me:

“ Once we became aware of the incident, we immediately locked down the affected accounts and removed Tweets posted by the attackers.”

The accounts were posting for hours after it seemed Twitter became aware what was going on.
My heart thought aliens, but my head knew better
Just as everyone else has said, I just want you to know that I appreciate your hard and well documented work.

As a late-but-early adopter of other phone projects the thankless work that you do is what allows adopters like me to even get started. Thank you.
You should consider Asia as well. For example, Singapore would be a great demographic fit for this kind of product:

- low-birth rate

- high education

- high per capita income
They’d still happily wield him as a rhetorical cudgel, probably, though.
RE: social engineering, as long as a human is involved somewhere, the system can be compromised. IT security is a very depressing field because of this fact.

I also hope these incidents remind people of how little control you really have over your online identity. We're all just IDs in a database somewhere, waiting to be impersonated.
Decentralization is the only solution for this IMO.
> nobody would've been the wiser.

Except they would have footage of two people going into the apartment (one person apparently wearing a ninja outfit), and only one person leaving.

That could have been a tipoff that something was askew.
How would a VPN help in this case though? They social-engineered some employees to gain privileged access to the admin UI. If a VPN was in the way they'd do the same thing to get access to the VPN first.
Not at all. I have to have the license when I drive, along with other documents so I just keep it with the insurance and registration in the pouch with the manual. Much safer than being stopped by the cops When driving and not being able to produce it.

Anyway, these days ID theft is done wholesale, not one person at a time. I have other defenses against that. And someone who wanted my DL info could simply find it online.

Who cares about car locks: people will just break the glass and grab anything that looks worth taking.

You need to think of the risk. My house has a Medeco key system (slightly modified outside the Medeco license). It’s not to keep people from breaking in (you could just throw a brick through a window there too) — it’s to prevent key copying.
This introduction is pretty simple and concise to just understand what it is: https://www.cloudflare.com/learning/access-management/what-i...

Follow that up with this SAML and OAuth comparison: https://www.ubisecure.com/uncategorized/difference-between-s...

Then see how OpenID Connect fits in: https://www.okta.com/identity-101/whats-the-difference-betwe... https://www.gluu.org/blog/oauth-vs-saml-vs-openid-connect/

And this page shows examples of a web app using OAuth2: https://connect2id.com/learn/oauth-2
IIUC, any rogue high-level access employee could take over any account and post anything? Like make trump's account post "nuke inc @nk". I'm not sure if that's any more reassuring than just saying they got breached
The point is to screen outrageously out of character or dangerous tweets, for instance Hillary Clinton giving away bitcoin, or a politician declaring war on another country. Something timid or benign slipping through is not that big of a deal.
“We detected what we believe to be a coordinated social engineering attack by people who successfully targeted some of our employees with access to internal systems and tools.”

I think it happened because everyone is working remotely and it is easier to perform social engineering attacks. Maybe this incident will have impact on their long term remote work plans.
Sent her to juvie for violating probation on assault and theft charges, mind.
> Not that either. It feel like the conversation around these things is stuck in the far past. Large-scale organizations can and have driven the number of people with root passwords to zero. "Filesystem access" shouldn't be as easy as you're implying and it also shouldn't be of any use, since everything in the files ought to be separately encrypted with keys that can only be unwrapped by authorized systems.

OK, what about the people who have physical access?

> even a minor application of imagination can lead you to think of an init daemon that can enforce the pedigree of every process on the machine.

Who watches the init daemon?
I know nothing about twitter's architecture but it could be:

- at-rest encryption of the datastores with the content encryption key protected by a HSM. A KMS (key management system) would be the interface to retrieve the key, with access control enabled. An even better solution would be to have the HSM cipher/decipher the data directly, thus the encryption key would never leave the HSM (or the encryption key is also ciphered by the HSM). But performance-wise it is not realistic.

- in-transit encryption from the client to the datastore. No end-to-end encryption more likely thus allowing admins who have access to encryption termination hosts (reverse proxy, twitter backend app, datastore,etc) to read (and maybe alter) the data by doing memory dumps

- access control for datastore operations: allowing only the twitter backend and some privileged users to read/write in the datastores, etc.

Doing end-to-end encryption from the client to the datastore with a key per client is possible but it would make the solution very complex to operate and not performant.
In the early days of the internet the FBI was kind enough to call my employer and inform us that we had left open an anonymous FTP server, and it was serving up Disney movies. Those were good times.
Honestly? I’m not sure that would work. As sad as that is.
but at what point do you just let youth engage in certain behavior without consequences?

Much more often when they are not minorities.

https://www.sentencingproject.org/publications/racial-dispar...

Juvenile placement ought to be reserved for those who pose the greatest risk to public safety, but national data show confinement is still used for less serious offenses. In 2003, 76 percent of all committed juveniles had been adjudicated on a nonviolent offense; by 2013, that proportion had barely changed and is now 74 percent14)
Do you believe that the NFL is biased against non-blacks?

Do you think the ratio of imprisoned men/women in US (or globally) is indicative of institutional sexism?

Is the gender disparity in nursing/teaching also evidence of a system which unfairly discriminates against men?

And then, if we are truly interested in erasing demographic inequities, why does it seem like the only fields under attack for racism are those occupied predominantly by [straight] white men? Are we going to come for Asians next? And then Jews again, just like in Germany, and the Soviet Union?