skysight-inc/HackerNews huggingface dataset:
I guess that is true, but if you store the encryption key in a secret store on Azure or AWS, I wouldn't really worry about that.

Maybe the real question is why use a pepper over encryption?

They have the same downside (as you mentioned) but at least you can change the encryption key without having all the users change passwords. I don't see any advantage in using a pepper over encryption, except maybe implementation complexity.
Hashing email + password is fine.

The email is the salt. It's different for every hash which is all that's needed from a salt.
I have actually long-wondered how theaters would fare if they pro-rated seats based on demand. Charging just a dollar or two for a Tuesday matinee seat otherwise expected to be empty would certainly drive ticket sales, and with them concession sales. What does the theater have to lose?
What are you trying to accomplish?

I don't know why you are base64 encoding things before sending them to the DB. Just use a binary blob.

scrypt is a hashing algorithm, not an encryption algorithm. So that doesn't seem like what you want.

LZ-String is a compression algorithm, that's trivially reversible.

The problem you'll run into is that the "right" encryption algorithm is constantly changing. Probably the best thing to do would be to not do it yourself, instead, rely on encryption capabilities of your DB if provided. If you opt to doing your own encryption, then be prepared to constantly maintain and update it. Pushing that responsibility onto the DB makes that burden a simple "make sure your DB is up to date" Which you should be doing anyways.
Given that I linked to articles describing the exact behavior I am criticizing (screwing over people in a global pandemic after offering them a job, and paying a ninety million dollar bonus to a high level executive when he is being fired for sexually assaulting a subordinate) I'm not implying anything.

I'm criticizing specific behaviors that I find to be more in line with the notion of "cardboard cutout evil capitalists".
> Go off-planet, if space colonisation becomes a thing during our lifetime

https://wikipedia.org/wiki/Asgardia

https://en.m.wikipedia.org/wiki/List_of_micronations
The nuance and poetry of this comparison to a favorite local diner is a refreshing breath of air and conjured up a very similar sensation in thinking about what the web is now compared to the one we had.

Thank you.
Ahhh I meant to say "pretty unlikely that a change in therapy is the cause" above.
> they would have been unable to stay anonymous or silent.

Not necessarily. Satoshi obviously planned his pseudonymity from the start. The decision to leave the project may very well have been taken long before it was carried out.

Satoshi could be alive and well. Maybe he carried on his work under his real name, as one developer among many, or maybe not. He obviously thought fairness and trust was important enough to value to form for him to prove the non-possbility of backdating the chain (later known as premining). Planned obsolescence for the creator plays well into this scenario.

In hindsight, having no real creator has served Bitcoin well. People would have listened too much to the creator for a decentralized decision process by consensus to form.
Ripple is not permissionless. I think Algorand[1] is the first.

[1] https://people.csail.mit.edu/nickolai/papers/gilad-algorand-...
>They should just pay you instead of paying the insane office rent.

Or pay the shareholders instead. Or the CEO. Or ... you are a cost center for your company. Why would they pay you more than the minimum anyone than they would for any other cost center? That said you should negotiate for an extra room as a part of doing business.

>I was raised on IM. I'm fine communicating like this. If I need to talk I can always call someone.

I finally got emacs connected to the corporate email server. My productivity went up 100% overnight. I'm debating setting it up for slack.
If so: Get promoted.

I love it, because it has cut my commute down 10 hours/week and my dedicated meeting time 10 hours/week. That's 20 hours. Now I can dedicate 5 hours of that to taking walks or naps or cooking healthy food. 5~10 hours of that for more work. And 5 hours for the company. Generally a win for everyone, I think.
First, your edits

>Regardless, ask yourself how you'd feel if the film, video game, or book you pirate was made by a close friend. Would you tell them you pirated their product? And if so, why?

Yes. They didn't create it to brag about how good their ratings were, and pirating their content doesn't mean they aren't getting anything from me, as you yourself mentioned.

>As a video game creator whose digital games cost nothing to copy and distribute, I can assure you that piracy directly affects my ability to continue making games

No, you can't assure me of that. You can say things but would be unable to provide any proof.

>"if I can get something for free, why shouldn't I"

Any time anyone buys something they've previously pirated, this argument falls apart. Not that it needs to wait until then, "why am I paying $20 to be advertised to" breaks it too.
USC Professor Placed on Leave After Some Complained His Using of a Chinese Word
Oh, I see. I completely misread that paragraph.

If the metal strip is on the top of the ceramic and grounded it makes sense that it would be for ESD protection. Especially as they likely did hand assembly of the PCBs.
In other words, in your view, the dollar literally cannot go tits up?
Can someone explain the calibration code. They enter calibration points. Wouldn't you then need to calibrate the sensor with solutions at those PH levels?

How would you do that with the example code?
So is the euro not a success either? Or any other currency in the world for that matter?
What's so hard about pushing this sensor reading to Adafruit/any other IoT dashboard? You're either sending a mqtt message or POST, regardless of where the sensor reading came from.
The US postal service? /s

Are you saying that Stars and Stripes would deliver mail / messages to soldiers? I'd like to hear more of what you were saying.
Only the workspace can be built and tested, so the workspace is what should be committed. We should be stashing anything we don't want to test and commit yet.
The $1/2 billion they had to spend due to paperwork related to certification of the design. From an earlier comment[1] from a different thread about this approval quoting NuScale's press release:

"NuScale spent over $500 million, with the backing of Fluor, and over 2 million labor hours to develop the information needed to prepare its DCA application"

Military reactors don't have to go through this process and those designs (modified to work on land, etc) would.

[1]https://news.ycombinator.com/item?id=24346808
I like recommending “How to automate the boring stuff with Python”: http://automatetheboringstuff.com/. And if they’re still interested after a few chapters of that: Harvard’s CS50.
> There are many attack scenarios in which storing a secret separate from the DB doesn't get you much at all. Suppose an attacker finds an RCE vulnerability in the application – then they can slurp up the contents of the DB, but they can read the pepper from the configuration too.

If the auth is a service accessing only via some remote access protocol that only allows a minimum number of operations that do not map directly into database commands they cannot exploit RCE in the app to get auth database.

Such service can also enforce reasonable rate limits and quotas, something that a regular direct database access can't enforce.
California housing bills run into wall of union resistance
Hey thanks, well I'm a bit out of my area here but that sounds helpful and will research it, thanks!!
PSYWAR/PSYOPs
This news report contains a short recording of the questioned lecture. His pronunciation is actually not that off.
So you see Ethereum as a better solution!
The academic world has gone mad.
> Hence, one different password per site to protect also against the sites themselves.

Preferably one generated by a password manager, large and random and totally unrelated to any other password of the user.
Our application has an article catalog. There's an article number (primary key), along with description, classification codes, weights and other things, in addition to specific stuff for our application.

Our users have integrations which can update the catalogs "common" data. Descriptions can change, classification codes can change etc. A few users have several million articles, and they simply hand us a dump of them each night.

I tried initially handling this client side, load the articles, check if each article already existed, if so update else insert. If no changes don't do anything. I quickly discovered it used 4-5 hours each night when one of these big catalog changes started rolling in.

Then I rewrote it to issuing "insert ... on conflict" and just overwrote everything. Now it uses 15-20 minutes tops.
The Great Battery Race
This comment is definitely sarcastic. He continues:

> The hackers have worked this out too which is why arbitrary composition rules on websites are useless.
Thanks for all the tips and the link, will research further and see what better suits my needs.

For now I'm most worried about db being leaked so would look into db encryption and prob I will go with application-key
All human relations are increasingly subject to the criteria of «is it good for the corporation?». Or, is it good for me financially. Which, considering how work is increasingly central to our lives is unfortunate. We’re Charlie Chaplin in Modern Times without the factory.
You'll be better off with a per-user random salt than the <email>+<site_const> scheme. If you later want to include/exclude a re-auth flow to your email change process then you retain that flexibility (though as an end-user I dislike such additional barriers -- I suppose they thwart cookie stuffing and other kinds of vulnerabilities if your service is broken in that way, but I still don't like it).
Click "Cart" on the bottom left of the BBS entries.

E.g. on https://www.lexaloffle.com/bbs/?tid=29967

Takes you to https://www.lexaloffle.com/bbs/cposts/4/44467.p8.png
Conversely, I feel like I keep seeing "woe is me" whining from corporations when there are calls for them to maintain even the barest pretense of responsibility to their employees. I've lived in both CA and MA and both states have rolled out gradual increases in minimum wage, with employers gnashing their teeth all the way and claiming they'll be ruined and need to start huge rounds of layoffs.

There has been a growing gap for decades now between productivity and real wages
https://www.epi.org/productivity-pay-gap/

It is only rational for the people being left behind - often the ones doing the labor that generates all this value - to demand their fair share
I don't see any downsides. As you point out, upgrading hashed peppers isn't as beautiful. Yes, you can just introduce a new pepper and wrap the old hash into another hash using the new pepper, but you'll still have to keep the older pepper around to obtain the old hash during checks, creating risks if the attacker gets access to the older pepper and an old db backup. With AES usage, you can throw the old key away once all of your db has migrated and you've updated your key backups.

Just make sure you use a suiting AES mode. If it turns out that you xor'd all hashes with the same stream that depends on your pepper only, it's not really helpful :).
I'm fine with that. Like "SAM Missiles" (in the sky) or "CMS System" etc.

Also, it's "pedant", not "pendant" :P
Sure -- once per year:

- Write up self review. 1-2 pages to highlight what you worked on and accomplished, who you helped, why it matters. Score yourself on various dimensions of how good of a job you are doing (working with others, getting stuff done, etc.)

- Nominate 3-4 people to give you peer reviews. Best to pick people who can speak to your work, ideally with some folks from outside your particular group, and ideally with some seniority.

- Managers decide who to ask for peer review about whom. You'll get asked by various managers for feedback about their reports. Write and submit this feedback -- could be as short as a paragraph, more typically 2 or 3 paragraphs: what did you work on with them, what did they do achieve, what could have gone better? I've probably given feedback for 5-10 people on average.

- Manager synthesizes all of this into a report, score you on the same dimensions.

- Manager meets with you, gives you their report, goes over it with you. There's a lot to this meeting. It's a review of how they see your work, a comparison of your self-scores and their scores to get on the same page, a discussion of noteworthy feedback from others (positive and negative), a chance to defend yourself against any negative feedback, and a discussion of ideas for addressing any concerns. Typically there is also a lot of goal-setting for the upcoming year, and more generally a discussion of how things are going, how happy you are, and so on.

- Formally acknowledge that you discussed the report with your manager (checkbox in some system). This also gives you a chance to formally comment on the report, I imagine in case of some dispute.

- Followup meeting, some time later, deals with compensation adjustments, promotions, etc. This is kept separate from the review itself.

Effort level has been perhaps 2-3 days per year for writing up all the reviews. I'm sure it's worse for managers.
I have used both Spectre and Instar. I prefer Instar for straight forward simple transforms, but Spectre can do more complex ones. Spectre has a more difficult API to wrap your head around and that is its biggest downside, IMO. You really need to dedicate time to learn it rather than try to pull it out on demand.
Is there a way in which finical assets can inflate more the basic of goods that make up inflation metrics? Is gold even part of the index?

Like if all that new money isn't being used to buy things like food or even housing that factor into the inflation index than wouldn't we see something like this where gold and the stock market inflate because that's where the cash is going?
"Suppose you start a successful startup in your twenties, and then live for another 60 years."

Yes, let's just assume this is true. Please!
A good manager needs to be able to have really hard conversations, including firing people.

It's great to be close, but it's important both people are fully aware of the power dynamic, and that it is real.

Your manager should be like a coach on a sporting team (in more ways than one) - you can go hang out after the game, but during practice they will wear you down. The important point here is the context - it's when and where.

Also, keep in mind, your job is just your job, and people are more important than a job. You'll have other jobs, and other managers, so if you value the friendship, go for it.
The world would literally collapse if that happened.. so, no.
libsodium?
I was going to point out that BMW is still family run...but then again, I realize that BMW isn't also a publicly traded company...and subject to public regulation thereof...
Do both! I think the magnetic shield is an excellent idea.
This might be a stupid question, but why doesn't Microsoft just use a better hashing algorithm?
Monetary inflation leading to shifts in trading rates for other assets. USD is down against many other currencies lately (ie I checked CAD, EURO, GBP)
>Then I saw his recent tweets and especially the essay about wealth tax, I was a bit disappointed.

Why? He points out [the non obvious to many fact] that wealth tax kills compounding.

And this is something to seriously consider.
So what happens next? I unloaded a bunch of tech positions yesterday and am wondering what to do with all the dry powder.
Confusing luck with genius, and believing with said genius you can repeat such performance...
Are there any details somewhere on how the skinning was implemented in software? It’s so amazingly flexible.
I remember following those same tutorials and not really learning much (but I was probably 11 at the time). I also remember that the OS includes were around £300 and there was no way I could ever afford that. I convinced my parents to buy me Blitz Basic 2 after following another Amiga Format tutorial later on, and that is what finally set me on my path. Programming in the 90's was generally a really expensive thing to get in to... And it was even worse on PC.
Probably a rotary fluid coupling [0]. The fluid equivalent of a slip ring used in electrical applications.

[0] https://www.dsti.com/rotary-unions/
There was a class of password algorithm that used your password and some other information as a seed for generating an asymmetric cypher, but the original Stanford proposal was apparently a bit light and nobody ever implemented it. I bumped into some new algorithms in the same category, but I'm blanking on the clever name they used to describe them all.

The server would only ever have your 'public key'. I'm not sure where you get the saltiness to prevent lookup tables but still let me log in from three devices with the same credentials.
I get he's ranting about imprecise terminology, but really, what does this knowledge gain the end user? Maybe I'm missing the point. Users don't care if their password was hashed or encrypted or stored in an ice freezer in Antarctica.

They care (sometimes, sometimes they don't act like it, see https://www.ieee-security.org/TC/SPW2020/ConPro/papers/bhaga... ) that it was compromised.

An end user doesn't have any control or knowledge over the password storage mechanism for any sites, so the best thing is to use a strong random password generating password manager--because that is something the end user can control.

However, for the websites managing passwords, I'd suggest reviewing the NIST guidelines: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.S...
Most of that is too low-level, libsodium/nacl is closer to what they want.
This is a good password because it has lowercase, uppercase, numeric and non-alphanumeric values plus is 8 characters long. Yet somehow, your human brain looked at it and decided "no, it's not a good password" because what you're seeing is merely character substitution. The hackers have worked this out too which is why arbitrary composition rules on websites are useless.

Either you stopped reading 1 sentence too early, or you are posting in bad faith to try and smear Troy.
It flow inside the wings (yes copters have wings).
I really enjoyed this book as a beginner[1]. I was seriously thinking about getting this [2]. For the price, it seemed very reasonable compared to making my own. I would of gotten it if I live in a more permanent location. I got an Aerogarden to try out but the light is so damn bright. I don't have any place in my apartment that fits it without blinding us throughout the night.

[1] https://www.amazon.com/DIY-Hydroponic-Gardens-Inexpensive-Gr...
[2] https://www.lettucegrow.com/
this has nothing to do with SQL Server. on SQL Server MERGE is atomic, if the source has no indexes it's probably a temp table, of course evaluating "not matched" requires joining the source to the target, on SQL Server you should be thinking and working in sets and avoiding single row (RBAR) whenever possible. if you're doing highly concurrent single-row upserts you're already SQL Servering wrong and I'll concede that's a case where you probably need a bunch of lock hints (regardless if it's a merge statement or an update followed by an insert)
Some encryption algorithms are (effectively, but not literally) non-deterministic, e.g.: DUKPT, RSA-OAEP

Most encryption algorithms are deterministic, and most password authentication schemes depend on that fact.
... Huh

I do a lot of Wikipedia reading about strange folk in this world.

I had not yet come across this dude.

Wiki page is quite the interesting read. Thanks for making me aware of him.
Is that not the default? Err on the side of better security?
Somethings will get filled later, eg: a rush on wedding venues when folks catch up with delayed plans...

Somethings are lost opportunities, eg: _today's_ lunch being provided by safeway + my kitchen vs a restaurant.
I'm hoping we don't continue to see yc turn into 'the old guard'.

YC folks, startups & the people yc startup school attracts that I've personally spoken to in the past few years are more imitator-types.

YC folks & startups of 2009 were more authentic & original types.

Though I suppose it's tough to avoid this deterioration in culture following $-influx & 'success', in any domain.
Today, for our Linux Runners on GitLab.com, those Runners are currently offered only on one machine type, Google Compute n1-standard-1 instances with 3.75GB of RAM. Our current Windows Runners on GitLab.com are Google Compute n1-standard-2 instances with 2 vCPUs and 7.5GB RAM. In the future, for Linux and Windows Runners, we will offer more GCP machine types. For our soon to launch macOS Build Cloud beta, we are planning to start with one virtual machine size and then possibly offer different machine configurations at GA.

So as you get going initially with GitLab SaaS, you don't have to set up your Runners for your first CI/CD jobs. Then, depending on your requirements, and as your use cases evolve, you can easily set up your own Runners but still benefit from the included minutes.

Darren Eastman - Product Manager GitLab Runner
In my youthful days of Microsoft bashing, I learnt that many people couldn't distinguish between the man, the company, and the product. They also seemed to have trouble separating the motivation, the behaviour, and the consequence. In the end, I suspect that the reputation he acquired as a businessman was embellished.

I suspect that Gates will have trouble shedding that reputation since those people will have a hard time distinguishing between his past and present behaviour.
To take your question to an unnecessary extreme, what would Adolf Hitler have had to do in early 1945 to shed his reputation?

Once a nail has been hammered in place, even after removing it the hole in the wood is there to stay.
This is a covid problem though, not a work from home problem. In a normal world, possibly even next year, this will go away
> open-collector bus

Ah right, and that's still used by I2C if I remember correctly (a low speed bus that's surprisingly common).

I didn't know about IBM's AND-OR bus before. But now that I think of it, the open-collector bus is the exact opposite of AND-OR.

Open-collector is common today because modern chips (CMOS) can sink more current than they can source. I don't know if TTL (or whatever IBM Mainframes used back then) had different characteristics which made the positive-variation more useful.
The US Supreme Court to Hear CFAA Case
It looks like it has some details on "slow" i/o like UART and I2C, but not sure if that counts things like analog PWM timers for certain pins, like there are on RPis. Does anyone have any more information on that? You can do it all in software on a UART, but I think that can be a little more tricky. Since so many basic embedded projects can be helped with that kind of functionality, it would be awesome if it was available.
Haha awesome! Sounds like something you could print on a tshirt

r/namemyvariable

Hmm feels a bit weird, maybe r/namingvariables haha already think'n bout re-naming the naming sub lolz
Clearly you are someone who strongly believes in the superiority of remote work, but is it really that hard to believe that there are people who disagree?

I'm a software engineer with no connection to the commercial real-estate industry, and I'm pretty sure I haven't been a "victim of a subtle PR campaign." And yet I find remote work alienating and psychologically difficult, and I'm eager for a return to the office.

In addition to just...not enjoying remote work, I agree with the author that it would have been especially hard to be remote when I was younger. I would have missed out on a number of opportunities and connections that have been very helpful to my career.