skysight-inc/HackerNews huggingface dataset:
EQ was not a feature sold to me, it's a free addon, a nice to have.

Noise cancellation is great for those of us that have to work in noisy environments, or for neurodivergent people that need a break from information overload, or for long haul flights... or any number of scenarios you have not considered, as if nothing outside your little bubble matters. And let me guess, your "sardine in public transport" remark is just rubbing in that you don't have to rely on such either, isn't it?

Besides the point that noise cancellation can be turned off at any time, I have a perfectly fine pair of ATH-M50x's for use at home.

This comments reeks of ugly elitism and a severe lack of capacity for empathy. Maybe sometimes you should just not write whatever comes to your mind.
Respects Your Freedom Certification:

https://ryf.fsf.org/
Homeless man talks openly about being addicted to heroin [video]
Both of you want freedom - to speak and to choose what to hear, so you're more alike than one might think :)
Glad it was good for you. It was not for me.
> It's easy to replace Slack the tech, it's hard to replace Slack the app that people are used to when they say they want a chat app for their company.

Well, that's not true. That is easily refuted by it having been replaced at least once.

> It's like saying Windows is not difficult to replace. Technicaly true but practically false.

While you may believe that Slack offers something that other solutions lack, that simply isn't true. I know of two companies which have replaced Slack, one with a commercial offering, and the other with an in-house solution. Rewriting most of Slack is a week-end project.

Slack, over time, actually locks a company more and more into their ecosystem, since to have history you must pay them. With many other solutions, including 50 year old email, messages can be stored locally and filtered as is beleived to be appropriate by each user. If all you want is a chat bot with channels, then use Slack, and throw it away when you're finished.
Ripe for implies a future problem. FB has become viral information by definition. Previously by definition it was only a vector for advertising, now the ratio of advertising to misinformation is the only measure of its utility.
Here's an aside / funny thing about jar signing on blurays. The Blu-Ray spec only really enforces jar certificate verification for encrypted blurays (i.e. AACS). non AACS blurays (i.e. decrypted), ignore the certificate chain. i.e. a self signed certificate that uses its own key to sign the jars works fine per the spec.

The only reason people can take blurays (with java menus) and make them reliably playable when decrypted (in real players, ignoring things like VLC which can easily ignore the cert chain) is because the bluray spec tells them to explicitly ignore the certificate chain. This enables decryption programs to rewrite the java bytecode (and resign the jar's with a self signed certificate) removing any protection mechanisms (think screenpass) that are in the java code itself.

While I sort of understand the reason for it (you want to be able to test discs before mastering without encryption and without the need for signing), it really killed what could have been an effective security model. Basically the standard strong security vs convenience dilemma.
..and even if you follow all the best practices you'll just randomly end up blacklisted for what I can only imagine is misguided users clicking on spam.

If that happens on the wrong email provider you're out of luck. One of the mail servers I have a hand in has been blocked by one of those difficult providers for the past 2 months and we sent them 4 mails/week before the block on average :)
I have a adjustable keyboard tray.
You're thinking about it from purely a programmer's perspective. Imagine the world switches to "bobish" tomorrow, which is 20% more efficient than english.

Suddenly, bandwidth decreases by 20%, downloads are 20% faster, server costs decrease 20%, data centre energy usage decreases by 20%, greenhouse gases from data centres decrease by 20%, and so global warming slows down by _% and on and on. Sure it won't be 20%, it might not be nearly that in many cases, but think about the magnitude of the rube goldberg of unknown efficiency increases you'll set off.
Just apply all over the place. You don't have to go for purely engineering roles, you can be a technical account manager or a sales engineer and then pivot.
I don't recommend them. We used to host an online text game there (MUD) and when one of the players decided to DDOS it, Hetzner just pulled the plug. I moved to soyoustart.com (it's OVH brand) - in following month they sent a couple emails about the server being attacked and that they're trying to mitigate the attack, but game kept working.
You would never build a large radio or optical telescope anywhere on the moon, when it’s far cheaper to build it in deep space.
A solution I am working on for these sorts of software supply chain attacks uses transparency logs. Take a look here (warning, alpha): https://github.com/transparencylog/btget

Essentially the binary transparency log acts like a notary service. It appends the cryptographic digest of a URL to an append only log. The append only log cannot be rewound without detection by clients. And clients verify the contents they receive against the entry in the log.

Two nice properties for the issues outlined in this post:

1. Hosting providers (or third parties) can add this sort of log without needing developers to do things like manage key material or 2FA tokens
2. It is complementary to good upload authentication or signing systems

In fact, Go is using transparency logs for source libraries. I think similar systems should be used for binaries in all other language ecosystems as well.

I would love to see a world where major source code distributions start running transparency log servers as part of their own file host integrity protections. Imagine maven, github, npm, etc all running these sorts of services for all uploads and using them by default in their clients. Users would have additional confidence that the v0.4.3 package they downloaded to their system two weeks ago is the same one their colleague got or the CI/CD system got.
Yes! You could approach a Professor at a public university here in the U.S. (like the University of Colorado at Denver in Denver, Colorado) who mentors PhD candidates and explain the kind of on-the-job experience you have relevant to the industry in lieu of a Bachelors degree and request a formal recommendation letter to be included in your application to the PhD program. You will need between 10-20 years of professional experience, preferably team leadership. Although I heard most people are rejected anyways for things that can't be covered on-the-job like knowing how to write a proper academic research paper.

Edit: I just remembered that the measure of success in addition to writing a thesis is being able to explain your argument in as much detail as you can in front of panel of experts while answering their questions for at least a couple of hours up to several hours. Something you will likely encounter trying to convince a mentor you're ready for the PhD program.
Are Startup CEOs Happy?
I rarely look forward to using the old, crufty shell, but I'm a madman who would like things like arrow keys and backspace and maybe even box select to actually work in a sane manner.

I don't need spreadsheets and rich markup in my terminal. I just want basic HCI to work - consistently.
Conceptually you could do that, if you were willing to only use dependencies from people you trusted that closely. That can only be a very, very tiny minority of people using Maven.
There is an even easier analysis. If you were designing your own headphones just for your own use, would you have them collect personal data? If your answer is no, then choosing headphones that do not collect data is a logical choice.

The author cites some idea of "trading" ongoing collection of personal data^1 for features but I can't see how that applies here, assuming the user has already paid for the product, e.g., he has already paid for the headphpones.

1. This does not appear to be a one-time, voluntary submission of data by the purchaser. For example, submitting one's name and a product serial number in order to register for a warranty.
Long term means years, give it time. Some companies can and will pull it off, most will not. It's not blanket policy better
Yeah, if I'm being honest, I'm quite senior as an IC, I've been at my current company for a long time, I've been skewing increasingly remote for an even longer time, and a lot of what I do is individual with relatively limited syncs and collaborations. Some aspects (mostly I miss travel to events) are lousy right now but otherwise everyone individually on video conferences is pretty good--though most of the teams I work with are pretty distributed anyway.

I think as a junior person more or less just out of school I'd find it pretty awful.
And that data is money.
I Learned to Stop Worrying and Love the Artificial Intelligence
I wonder about the motive. Why would anybody do this without blackmailing or even telling people. Maybe it was a frustrated sysadmin... :/
Surely the attacker can serve up an SSH server implementation that forwards the connection to the intended server while recording and/or modifying the decrypted traffic as desired? To the user everything would appear as normal (expect perhaps for some additional latency) but their data would be exposed to the attacker.

If there were no way to perform a MITM attack because you would notice that you were connected to the wrong server, the whole system of keys and fingerprints would be pointless. So would the CA system for HTTPS.
The Librem 5's PureOS is very nearly stock Debian and the Purism devs have been very diligent about getting their stuff upstreamed into mainline Linux and Debian.

Pine doesn't employ software developers, but the Manjaro and Mobian communities are also doing their best to stay as close to stock desktop distributions as possible.

A key difference between the Pi and both the Librem 5 and Pinephone is that the latter two made an explicit design choice to use stock-standard (nearly) blob-free hardware. Unlike Raspbian, which relies on a custom kernel, PureOS, Mobian, Manjaro, etc... are very nearly standard desktop operating systems, with relatively minor tweaks to system defaults. Heck, PureOS and Manjaro are desktop operating systems just running on the phone with mobile-oriented shell .

There was a nice, related post on this from Purism a few days ago:
https://puri.sm/posts/investing-in-real-convergence/
Unfortunately this suit doesn't address the MHA law (a large tax on new homes); they just found that this case wasn't subject to it.
Those are our only two choices? Bummer :)
the only thing that sucks about strict typing is that there's no way to toggle it globally. so if you want to transition a codebase that's simultaneously actively being developed in other ways, you have to mess around with scripts that append it to the start of all php files/remove it again
There really needs to be

a) a docker container (or other standardized, easy to deploy technology) with a "mail server in a box implementing best practices"

b) a test for the stuff that Docker can't cover like DNS config, ideally with scripts to set it up on the most popular providers and clear copy&paste instructions for the rest.

People shouldn't need to fully understand DKIM, SPF, etc. - they should just be able to click a button, copy&paste generated DNS records, and be up and running.

Otherwise, commercial providers are just the only option that makes operational sense for most cases, _even if you know how to do it right_, because doing everything right manually step by step is still to much work to be worth it in many cases.

None of this seems _hard_, it's just tedious.
Ha! Clever!
CA is a partial direct democracy via its proposition system. It is currently dealing with a housing crisis more or less directly attributable to bad decisions made via that democracy.

The idea of a republic is that one elects a wise leader who can take the time to understand the issues and surround themselves with knowledgeable experts that can help fill in the gaps — which isn't even remotely possible in a direct democracy, as not everyone can know an expert in every necessary field.

Now, that said, our country is obviously quite far from an ideal republic. But I think it's other things — gerrymandering, a lack of good participation by voters, and a FPTP voting system that forces a two-party system — which many people think would persist pretty much as-is in a popular vote system —, and forces voters to vote for someone other than who they want to vote for. (Some would also add money-in-government, i.e., rolling back Citizens United; I'm still on the fence there, myself, as it would also prevent coordinated efforts by citizens.)
What exactly does "unsecured" mean in this sense? The article never explains the attack
You call it an excuse, I call it a valid reason. The current administration is a perfect example of what happens when you let people with no qualifications make decisions that impact the entire country. The current administration if failing in large party because it isn't acting according the norms and structures of the current system, and they are encouraging "independent thinkers" to question whether the virus is even real. It's a terrible example if you are looking to say that our representative democracy doesn't work. Pandemic response was top notch under the previous administration - turns out hiring experts and letting them do their work is effective.

> Examples please? What country/government has ever implemented a real/direct democracy?

That's my point. The French revolutionaries tried it for a minute until they realized you can't run a nation-state that way - it's too complex and the average person is too disconnected from the issues to fully grok the n-th order consequences. Plus the tyranny of the masses tends to get out of hand.
> None of the non-Macbook trackpads are great.

That's a myth. It's just macOS that has well-integrated touchpad gesture support across the whole UI stack, unlike any other OS so far. The only real thing Apple touchpads differ from others in hardware is pressure sensing and haptic feedback, but unless you really need silent clicking I'd say it's just a gimmick (I own a Magic Trackpad 2 precisely because of silent haptic feedback feature).

That said, Pinebook Pro's touchpad actually is very bad.
Yeah, but there's no guarantee that it'll do recognition on device (you can't force it). So it's not really useful from privacy perspective.
How to protect yourself from NPM (2019)
Wikipedia maintains a list of films now in the public domain. de Havilland's films are of the right age to be on the list, but don't appear to be. Most of the films on the list got there from failure to renew the copyright, a requirement which has since disappeared.

> Prior to 1988, all motion picture films published after 1909 with a copyright notice where the 28th year of copyright would occur before 1988, had to be registered and before the 28th year, the registration had to be renewed, or the copyright for the film would expire and it would enter the public domain. This would apply to all films registered for copyright prior to 1960. Copyright renewals became optional in 1988.

https://en.wikipedia.org/wiki/List_of_films_in_the_public_do...
That's orthogonal to the PGP signing though. That verifies that you control the domain for the Maven group id but doesn't need any PGP keys (it's more akin to the process of verifying DNS records for SSL certificates).
Then Facebook quickly becomes a platform of super-bubbles, and their influence on humanity becomes 100X worse over night. Content management policies exist because sometimes the creators of these platforms don't like them being used for evil.
why would anyone want to have their work be talked about all across the internet and become part of internet history??
We are using Go for all of our backend services and business logic. We needed something that is statically compiled, easiliy deployable and sufficiently fast.
Post a Gmail outbound VIP that is not in a SORBS blacklist, then, if you're so sure.

Whatever the opposite of a disclaimer is: I was the tech lead of gmail delivery SRE for four years, so it's likely that I know more about this topic than anyone on this board.
There was a fraudulent and malicious DMCA claim against one of my sites. Heroku without any notice took down ALL of my sites, one of which was a part of my livelihood. They claimed they emailed me with 24 hour notice but that absolutely did not happen. I had to pound on their door to make them reverse it, they victim blamed me the entire time and had a super snarky and shitty attitude, told me I should have been more proactive about the notice I never got.

I cannot in good faith ever recommend a service that would take down a website with zero notice and be so uncooperative in fixing what was ultimately their fault. It cost me money for that site to be down and I had to cancel my entire day to deal with them, and if the stakes were bigger it could easily wind up costing my employer hundreds of thousands of dollars.
There are still huge advantages in testing off-world tech in a place where it takes 3 days rather than 7 months to get there.

Are you advocating that we try to go straight to Mars rather than testing (some) things out on the moon first?
>... I have plan B, plan C, and plan D ready to be put into action if I suddenly don’t have a career in software engineering, or I don’t want a career in software engineering.

I would like to read more about that if you would care to share more details. I cannot imagine a career in anything but software, but this year has me very low on contract work and some backup plans are something I am trying to devise.
Or another one:

People find out there's a great business plan for creating oil companies so they can be sold to environmental groups
You are right, although this doesn't feel all that exotic to me, even though it might be unique for built-ins, it's essentially the same as what happens when you pass variables to functions (you get a copy of the references, i.e they are added to the scope), in this sense a block scoped for loop feels similar to a series of function calls passing and returning a variable.

In fact you could emulate a block scoped for loop with an object with little trouble and without being all that confusing:

const FOR = (s, c, f) => c(s) &&
(f({...s}), FOR(s, c, f))

FOR({i: 0}, s => s.i++ < 8, s => {
setTimeout(() => {
console.log(s.i)
}, 100)
})

This doesn't prove anything, but the fact that blocked for can almost be implemented with in one small function makes me feel like it's not all that magic, rather it's just nice syntax.

[edit]

getting a bit silly now but was seeing how close I could get to built-in syntax... yes this is horrible, never use `with` or `eval` like this.

const EVIL = (f, s) => eval(`
with (s) {
${(f + '').replace(/^.+>/, '')}
}
`)

const FOR = (s, ce, fe, sb, ii) => {
if (EVIL(ce, s)) {
EVIL(sb, {...s})
EVIL(fe, s)
FOR(s, ce, fe, sb, 1)
}
}

FOR ({i: 0}, _=> i < 8, _=> i++, _ => {
setTimeout(() => {
console.log(i)
}, 100)
})
> fallback to no colors/decoration if the user wish so

Fallbacks are frequently not implemented, not tested or not supported as well as the main feature.

> Even detecting if the terminal support colors is a pain.

As the end user, I don’t mind. This means that I’ll see colors only when it’s important.
I decided that a broken link is better than having people spend money on something that will be deprecated. We're obviously working on cleaning up those broken links but it's an easy thing to explain if anybody emails support@shodan.io

The ordering is based on timestamp and it can happen that new results were indexed in between your 1st request and 2nd request which creates an overlapping result. A 30% overlap is unusual and sounds like it's for a query with many results.

Finally, most researchers don't actually need to download data. They could just use our free API and facet queries to get the information without downloading the actual data. This entire website is powered by a free API key that uses facets:

https://exposure.shodan.io/#/

I think a lot of researchers go into the default mode of "I want to have the data" but using facets is way easier, faster and doesn't cost any money at all. And you can navigate the available facets using our new beta website (another area we're trying to make things a bit clearer). For example:

https://beta.shodan.io/search/facet?query=http&facet=http.co...

Note that we provide free upgrades to universities/ students/ professors as well as routinely work together with researchers so we're not trying to push them into the enterprise product. We also let universities monitor up to ~120k IPs for free using Shodan Monitor (https://monitor.shodan.io). But the use cases for researchers are few and we figure that if you need lots of data then you can send us an email.
I agree. I'm here because I like being part of a community where folks are balanced and measured and without outrage culture.
It’s a fact that the guidelines are bendy. It’s a fact that comments that break guidelines but have a liberal sentiment get flagged and danged much, much less often than the same comments with conservative sentiment. That is a fact and I invite everyone who reads this censored and flagged comment to see for themselves.
Sounds like the problem is not colors, but the amount of stuff we're differentiating then. You could say the same thing about making things bold, italics, shades of grey, etc.

I would think people recognize different colors better than shades of grey or bold text though.

Interestingly, in a lot of Japanese advertisement it feels like all the ways of making something stand out have been exhausted.
Booting a Windows 95 PC inside Minecraft and playing Doom on it
The Cat Game is no laughing matter.

https://www.youtube.com/watch?v=1rlSjdnAKY4
Drivers are (usually) fine these days, it's the higher parts of the stack (toolkits, DEs and applications) that have neglected their touchpad driver support on GNU/Linux.
Cities are very small and expensive compared to the rest of the planet.
You will notice that in my post I'm not defending the people behind the meow attacks. I agree, they are very much in the wrong.

But being careless with other people's data is also wrong and we should not feel bad for companies whose negligent practices backfire on them. That is what I was trying to highlight with my analogy.

Like bacteria, there will always be bad actors trying to exploit poor security. If not these attackers, then someone else. That is why we have security measures.

The people we should feel bad for are the individual customers affected.

Ps also, there is a big difference between being careless with your own property (your analogy) and someone else's property/data/wellbeing (my analogy and the case at hand).
Seems inconsistent with IRS guidance, which treats bitcoin as property, not money.
I have built most of my personal workstations, so I can speak for building your own. I love the granular approach to it - I get to pick an choose across vendors and choose my favorites. Something to take into consideration: building your own *may* be cheaper, but it's not always.

Of course this is valid for workstations - for servers to do target practice I can't stress enough as buying second hand servers is the best options in most cases: you can find servers that were the "hot s**t" 5-6 years ago, for 300-600$.
How do they know the CPF you give is really yours (or exists at all)? Do they also insist that you use a credit card?
That just means "I love you" in tooth.