skysight-inc/HackerNews huggingface dataset:
Hi! OP here.

Mostly agree! Specific comments below.

> I have found that it is important not to be afraid of doing market research, surveys, conducting interviews or observations of existing people in action with existing solutions.

Don't disagree, but I wanted to build something first, even if it's just proof-of-concept.

But now that I have a prototype, yes, I'm reaching out to get opinions. Blogging is part of that effort.

(Personally, I don't really like the idea of putting up a landing page to collect email addresses for 'vapourware'. When I say 'personally', I'm not passing judgement on people who do it. Just that ... I sort-of don't like doing it myself.)

> Since you’ve already decided to build this anyway, you aren’t concerned about competition - so what do you have to lose from seeing if other people want it? [1]

Agree. This is part of the effort of putting it out there and seeing what sticks.

> I see from the website the author is taking early access adopters, so maybe they are doing this. Actually I like the approach of doing this in the open and blogging about it, it was more the original blog post that triggered my reaction.

Ack. Ack. Understood.
What do you mean? To use a Mastodon/Pleroma instead of the blog, or a blog engine that can interoperate with ActivityPub? If the latter, I can only think of https://write.as for the moment.
I wonder if RH got some special treatment because of some VC connection or something like that. But it should absolutely not be forgotten that RH was once an extremely small company.

The real issue is that de facto if you want to invest time and money into Apple's platform, it should be for a defined reason, otherwise web dev is probably sufficient at least for a POC and market traction :)
He 100% can and is.
Please pay better attention and read the news occasionally:

https://www.seattletimes.com/seattle-news/seven-charged-in-v...

And here's a story from a postal worker committing voting fraud. It was published in the Seattle Times even though it occurred in WV.

https://www.seattletimes.com/nation-world/nation/west-virgin...

This took me 10 seconds to find.

Tamper resistant envelopes don't stop fraud. They just stop tampering. The real problem is people making up 1000s of fake names (or borrowing real ones) and then filling out the ballots for their favorite candidate. Then they dutifully seal them in a tamper-resistant envelope which preserves the vote for their favorite candidate.

Open your eyes and your ears.
Based on other articles, it appears they didn't hire specialty ransomware consultants for the negotiation but still got a 55% discount. Wonder if they did, if they would have been able to get a better all-in cost.
US will take action in the coming days against more Chinese software companies
1) Facebook is unique. But it is a costly way to reach a target group and usually the goal is to build other channels. Big brands are not looking to reach smaller targeted groups.

2) Daily users/monthly users is not really the stat worth tracking. That number was going to go up because of covid. I wonder about time spent on the site and time spent scrolling. That feels the important metric that has been dropping and tells a different story.

3) doesn't completely tell the story because if coke was cutting anyway that should show up

4) The differences on how each police hate speech doesn't really matter to anyone.

The real reason is 5:
5) Facebook raised prices for everyone else.
Not in the USA, no
But now you have $4 million in a bitcoin address linked to criminal activity. Then what? How much do you lose along the way to having laundered cash in hand?
Thank you, I did not know this! Also did not know that postal service was envisioned in the constitution.

I would think that if such services were thought to be of federal powers, that many more bedrock services that are essential provide to all of society, such as internet service, would also be written in today if the founders had started in 2000.
What baffles me about people complaining about their Apple devices being locked down - why did they buy it?
To be honest, just how bad of a thing is this? It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices.

The money is funnelled to a criminal group, but what difference does it make? Some people consider the USG to be a criminal group; many people are out on the streets for that. My tax dollars directly go to corrupt crooks and nonexistent companies claiming billions for nonexistent PPE.

As a member of society, I don’t care if I’m paying a professional ransomware group, or a professional corruption gang.
Imagine you've just made yourself a thermometer by marking off the 0° and 100° points. Now delineate the 2° intervals, using only the tools you would have had available in the early 18th century.

Now imagine making a thermometer by marking off the 32° and 96° points (64° apart). Now delineate the 2° intervals.

Considering those two tasks, 64 seems a much better number to me (only have to divide unit lengths in half) than 100 (have to divide something by 5).
Hi! OP here.

I don't quite understand.

> I'm fairly certain this process will be entirely automated by QB in the next 5 - 10 years, QB Cloud almost already is

QuickBooks, Xero, FreshBooks etc. already have entry-level online SaaS solutions. I'm aware of that.

So I don't quite understand by 'will be entirely automated by QB in the next 5 - 10 years'. 'What' will be automated?

If you care to elaborate, I'd be interested in hearing more.
Take backups, practice restoring them, invest in a security program.
Haha, I didn't even realize you could click to get more info until you said something.
For some context about CWT (I was curious about these figures) -- via Wikipedia[1]:

* US$1.5 billion in revenue
* 18k employees

For a firm like this, the payment probably amounts to a small uptick in a small portion of their IT budget and won't even come close to hurting them (and, frankly, neither would the $10m figure).

It's insane that this is the case and that companies are willing & able to pay ransoms like this, but the hackers were right - the payment is much less than lost business, bad PR, etc. if the actual information had leaked. Such is where we are.

[1] https://en.wikipedia.org/wiki/CWT_(company)
This, like AMP, looks like a blatant attempt by Google to lock in users/advertisers into the Google ecosystem. If you're going to leverage your monopoly to harm end users, then the time for lax government regulations is over.
Overall, I'm glad to see this piece proposing a more complex understanding of our largest organ. But some of what is said in this piece aggravates me, like this quote:

Disorders such as celiac disease, Crohn’s disease, rosacea, and eczema—all of which involve the skin, the immune system, and the gut—reveal just how intertwined these systems are.

As I noted a couple of days back, the so-called "immune system" is not a distinct, identifiable, separate set of organs and the skin's job of keeping out invaders makes it part of the immune system.

https://news.ycombinator.com/item?id=24015957

I will add that skin and gut tissue are both the exact same class of tissue: They are both epithelial tissue. So it should hardly be shocking that when one of your epithelial tissues has an issue, so does another.
Have you considered using friendly-traceback?
I've been using it for some time, and while i'm def. not an expert, i do love how lightweight is is! It really is a pretty nifty platform for the fediverse!
Bill Gates disagrees.

https://www.foxbusiness.com/lifestyle/bill-gates-says-school...
I'll actually be ok with that.

The security recommendations they put forward at the end are significantly better than anything I can ever get backing to implement.
Calling it a "trust token" is almost as deceptive as calling it a cookie. "Accept cookies. Um, yes? Me want cookie."
But wouldn't the payments just end up being passed through?

For example, one way to get around that is you could sign a contract with a foreign consultant firm for "security services", say for 1 year, and they would take your money, and pay a portion of it to the ransomware authors and profit on the rest.
I can tell you about an app that you might have heard of that bypassed the Google Play Store and was a security nightmare.

https://www.cnet.com/news/just-as-critics-feared-fortnite-fo...
Tricyclics work directly on gut neurology. It’s got nothing to do with the brain.
Even if VW and GM are successful in switchover, there will be a host of companies on the outside looking in that Tesla could make money off of for decades.

Tesla also could acquire many of these companies as they become irrelevant to gain instant market share.

Full supply chain commodification is probably 25 years away, especially since a vertically integrated supply chain for EVs for battery and motors will be a major advantage.

Of course, a big leap in solid state or other techs could evaporate these vertical integration advantages, and batteries will probably change quite a lot in the next decade.
I did find it ironic that composition was called UNIX philosophy, when most UNIX tools are complicated functions with many options much more akin to the lisp function examples. (Of course it's the "UNIX pipes" part of the philosophy that's being alluded to, but it's still a funny twist)
I’ll be that techno neophyte and say that I don’t really understand how to use Mastodon properly. I’m able to get on and read posts but no idea if I’m where I want to be. I want to be on a very free speech and open server, even at the cost of having some human trash posting nonsense on there. What’s the best approach? I’m tired of seeing a handful of kids at Twitter decide what is appropriate to post or not.
Fair enough. Thanks for the nuance.
Prepare for a lot of Captcha challenges for daring to opt out of their invasive tracking graph.
I don't see backups in that list. Backups would have avoided the need for decryption, yes?
I think you're comparing the voting procedures of the past with the grocery aisles of today. If we sterilize the stores, we can do the same with the voting equipment.

In my town, they've moved to paper ballots for audibility. This is also great for mitigating disease transmission because each person only touches their own paper ballot.

There's no reason why each polling place can be brought to the same level of danger as a local grocery. It won't be hard.
Do you buy game consoles? Do you have a Roku device? Do you really need the government to come in when you had a choice to buy an Android device?
Criminal conspiracy as a service. I don’t think I’d invest my money.

Edit: to clarify their marketing is transparently targeting organizers of street violence. I have no problem with encryption and don’t think government forbidding it is a good idea.
There's nothing stopping others from doing the same thing, and indeed others are planning to. SpaceX is leading the pack, but eventually there will be competition.
Why do you come here to peddle that BS? What is the point?

Here is a clear example of the federal government siding against state’s lockdown mandates

https://www.vox.com/covid-19-coronavirus-us-response-trump/2...

“ The Justice Department is pressuring state and local officials over lockdown orders
The DOJ is questioning the legal authority of top officials in California and Illinois to extend stay-at-home orders.”
And the political opposition said "Walls don't stop a virus" and called the federal executive branch xenophobic for a travel ban.

Nobody has hit 1000. It's a long game, and we don't even know if Sweden's approach is the right one or not. There is not much room for political mud-slinging, unless one backs a candidate that has not yet spoken.
Once again, you imply it’s a “bad roll” when op just said it’s a roll.

Most people are in a location by circumstance of family and job prospects. Very few get to choose arbitrary places to live.
Using right-associativity of function types, and by sugaring the lambda into another function argument, we can rewrite this as

(*-) :: (a -> b -> c) -> b -> a -> c
(*-) f x y = f y x

This reveals that (*-) is simply flip, which is in the Prelude (re-exported from Data.Function). Alternatively, Hoogling the original type signature will reveal the same thing.

So the example doesn't require any new functions:

import Data.Function ((&))

xs :: [Int]
xs =
5
& flip take [1, 2, 3]
& filter (/= 1)
& head
& flip take [1, 2, 3]

In general, it's common in Haskell to use flip, curry/uncurry, and other higher-level functions to manipulate functions so they fit into the needed context.
Aren’t there mixer services for that or just convert to monero? This is off an exchange so lots of shenanigans to make things less traceable. I am guessing these people know what they are doing.
People have been saying that since the Mac App Store was released in 2011.
I was ignorant of the mathematically rigorous definition of countability, thanks.
It should be a criminal offense punishable by prison time for companies to pay for ransomware keys. While that might cause some businesses to fail in the short term, it would benefit society as a whole by eliminating the financial incentive for such attacks.
It's missing by far the most important law: if the user uses the program the same way after a year of usage it's a failed program - in other words good program design needs to allow the user to grow.
SCMP haven't actually directly said that as far as I can see, I think they refer to this article talking about 'Chinese Apps'

https://www.scmp.com/news/world/united-states-canada/article...
Yes only Apple can sell it’s own products. That’s not how monopolies work.
This may be off topic, not sure, but will go for it since not a lot of discussion yet.

I've never even heard of this company. Perhaps I'm just part of the unwashed masses? I know Dillard's, Neiman Marcus, Sachs Fifth Ave, ummm and that's about it from the perspective of my layman's understanding of department stores.

If this company has never managed to inform me of its name over the decades I have been alive and browsing online, perhaps this bankruptcy is not as huge as surprised as one might think poor marketing, poor awareness, poor sales...?
Continuous append-only backups, where one can't rewrite them without physical access to the system, would - most likely - help with a data loss, malicious or accidental.
This is a throwaway account.

I have been in companies where we'd outsourced to firms in India. The experience was not good for us, at all. The arm of the company that set up this arrangement, it went under. The offshore firm did not deliver.

I realized what seems to be a cultural thing with folks I'd worked with from offshore firms. They would nearly always exude absolute confidence in their ability to deliver what you'd requested from them, no matter how complex the task.

"Oh yes. Sure. No problem. We will get that done for you. Absolutely, yes. No problem."

You never heard humility in the sense of, "well, I/we aren't experts in _________ but we'll research and get back to you." It was always confidence, to the extreme.

I wonder why this is?

The reality ended up being entirely different. Many times, they had no effin clue. These were with some very big-name offshoring firms.

The flip side to that same coin… the folks from those firms that were genuinely skilled… they weren't in India. They got brought over on visas and were working in the US.
Countries where kidnapping was common, are also usually countries with weak government and very ineffective policing, so it's not that simple. Laws like that are in the end pushing responsibilities of law enforcement on the companies and citizens.

I'm against ransoms, but if I was CEO of company that's about to release COVID19 vaccine, or provides jobs to 100k of people, you bet I'd pay that ransom.

But even if that would happen, it's naive to think that corporations wouldn't work around it. They already do, by outsourcing payments to 3rd party companies - they can proxy it via other countries, fake identities, etc, etc.
Is this claiming to detect 99% of CSAM or claiming to distinguish between CSAM and non-CSAM with 99% accuracy?

Relevant: https://bohemian.ai/blog/99-accuracy-99-lie/
> It’s a direct financial punishment for a company with lax security practices. It encourages greater security practices.

That argument could be used to justify any theft or even kidnapping.

I know many people who grew up in countries where kidnapping was a very real concern. Consequently, they had to adopt "greater security practices" and it had a very real, negative effect on their lives.

There are real harms to randomware. Companies go out of business, people lose their jobs, people lose their service providers, etc.

To say, "it serves them right for not following proper security" literally can be said for a mom/pop business in a poor neighborhood who didn't have bulletproof glass or bars on their windows. It is negating the fact that (a) the harms are very real and (b) security costs money and resources, which is effectively another tax on their business.

If instead the government made it illegal to pay such ransoms and actively audited large BTC transactions and charged people accordingly, then we could get rid of the incentives to do this in the first place.

The government should similarly hold firms accountable when they are hacked (due to the harms on consumers) and require prompt disclosure of any hacks.

There are ways to incentivize the preferred outcomes without supporting the active theft of property and destruction of someone's business.
Hi! OP here.

> "I'll create the software X to fit my own specific requirements/needs, then I'll see if anybody else wants to use it as well (which would mean that that niche of people have the same needs/requirements), and if that's the case then I can decide if to put more energe/effort/$ into it otherwise it will just be something useful for myself"
>
> ..., right?

At a high level, yes.

(At a lower level, well, there will be variations on the same basic idea. The devil is in the detail.)

> I think that for that to work the important detail about the concept&implementation is that the SW must be complete
> ...
> and that the full functionality will be always available, even if in the worst case I don't have an Internet-connection.

Yes, GigoBooks is intended to be desktop linux/mac/windows software that runs entirely offline. If the OS doesn't change, it can keep operating forever.

> Btw., the GigoBooks app does not currently allow to save data, or did I overlook some menu-entry?

You're looking at the online demo which is necessarily functionality-limited because web browsers don't allow access to local files.

The 'REAL' thing is a desktop app which does allow saving data to local (sqlite) files (and yes, there are additional entries in the menu for this).
Linux 5.8 Changelog
I agree. It's a trade-off, especially if you're a startup or a company with a hot product trying to beat competitors to market. Security practices would translate to loss of opportunity, so maybe it's a worthwhile trade-off to pay 1% of the gained revenue to these kinds of threats as a company. Unless there are harsher penalties and victims start caring more (and are given more tools and power to punish the companies that make that trade-off), this situation will remain.

But then again, this makes the barrier to entry even higher for newcomers and gives an unfair advantage to the entrenched players. Tragedy of the commons?
It should encourage companies to lock down their infrastructure as well.
Offsite offline backups. Redundant ones. This scenario is really no different than if your datacenter had a gas leak and blew up, particularly because you never will ever be able to prove the attacker didn't retain your data somewhere so all you can do is guarantee recovery. Of note in this case is that the thieves only stole 2TB of data - this is a trivial expense to orchestrate a manyfold backup regime for in near real time when the alternative is shelling out millions.

And its also about your threat model. If data leakage of any form threatens your business you need way more security than if you just want to be able to recover from exploits in your publicly facing infrastructure (or the ability for a rogue actor inside the company from sabotaging the business from the inside).

At the most extreme having physical separation of infrastructure with physical token based auth and multiple signature verification to interact with data is going to be a heavy price in diligence to maintain secrecy. At the lowest end having a redundant backup storage array with a cron job on all employee computers to versioned backup files every minute that doesn't have network signin access.
Here's a link to (photos of an lcd screen of) more of the chat, does anyone know where to get the full transcript? Feels like it has to be available somewhere.

https://www.reuters.com/article/us-cyber-cwt-ransom/payment-...
I don't know about that. For one, travel margins are not exactly the same as SaaS margins. Secondly, there's the global pandemic and all, kinda hurts the free cash of most travel companies.

I wouldn't be surprised if they genuinely would have trouble coughing up 10 million two days after the attack hit.
I would like to pick your schedule.

How did you get to a 4 hour work day? I’ve considered pursuing a 4 day week or something similar but think I’m a good ways off from a 4 hour day.
Where are you getting your information? Tricyclic antidepressants are generally SNRIs, which definitely do effect the brain. It is true that the gut also has serotonin receptors, so there can definitely be side effects there, but to say that it's the only place where TCAs have an effect contradicts decades of medical research.

https://en.wikipedia.org/wiki/Tricyclic_antidepressant
They also do hire non US persons that don't get access to certain materials but it's rare.
Wouldn't usage metrics tell you that?
Mastodon is federated which means you want to pick an instance that follows the moderation principles you adhere to, the instance you are on determines your "local" timeline while the federation of all the instances is the "global" timeline. This link should be a good start to decide which instance you want to join https://joinmastodon.org/
The scary part is this is just the beginning. I took a drive through San Francisco a few days ago and I was shocked to see many restaurants I used to patron are gone already.
Just having backups isn't enough. It's ransomware 101 to wait and try to encrypt all of their online backups and any recent offline backups.

You really need comprehensive, air-gapped backups that date to years back.
One of the things I miss about older laptops is the keyboards. I would love to buy a laptop that is built like a PowerBook G4 or a ThinkPad X61 but with modern displays and modern internals, and with extra bonus points if it has user-replaceable batteries and user-serviceable storage and RAM. I've found the Thinkpad X62 (https://geoff.greer.fm/2017/07/16/thinkpad-x62/) and X210 (https://geoff.greer.fm/2019/03/04/thinkpad-x210/) projects rather intriguing. Unfortunately I missed out on the 2017 ThinkPad T25, which I would have purchased had I not been strapped for cash at the time.

One idea that I have is for a laptop manufacturer to develop a chassis that comes with a high-resolution display and a high-quality keyboard (like those of older ThinkPads), and where the user can supply an Intel Compute Stick or a similar device for computing power. This way the chassis can be used for a long time while the user upgrades compute sticks.
Is it the ad execs at company 1 & 2 calling the shots or is this a board level decision?
Maybe require cyber insurance instead, pricing premiums based on audits performed by infosec practitioners. Similar to auto insurance, and what happens when you’re a high risk driver; you still have insurance, but you’re paying out the nose for it.

Our current legal framework doesn’t support such a draconian suggestion as presented imho.

You want poor security practices to be painful, not fatal, to the corporate entity.