skysight-inc/HackerNews huggingface dataset:
While the article does have a point that obscurity can improve defences, I think security is not about defence. Security is about managing risk in a consistent and rational manner. This means that any defense mechanism need an appropriate level of defense against the threat.

Having a network share on the home network that only your household can access and use 2FA for that? Maybe a bit too much. Do you know your organization will be individually targeted by smart and tenacious actors? Changing the SSH port isn't gonna stop them.

I agree with the article that more discussion about what makes something secure is valuable security work. Disregarding defenses at first sight because they "sound obscure" isn't a good argument. But it also doesn't mean that "small things that might stop someone" is a good layer of defense.

And then there is also the cost of adding security layers...
> Epic doesn't release these numbers, yet from third party analysis in the 30 days before being kicked from the respective stores, Fortnite made $43M on iOS, and a paltry $3.3M on Android, worldwide.

"Sensor Tower puts iOS spending in Fortnite at $1.2 billion since it was launched on the App Store in early 2018." That was from a month ago.
https://www.usgamer.net/articles/fortnite-ios-removal-hurt-e...

Fortnite total revenue was $2.4 billion in 2018, $1.8 billion in 2019. Not sure we have figures to date for 2020, but assuming it's approximately $1 billion, then iOS would be ~23% of total Fortnite revenue. Is that the largest platform? Maybe, maybe not.
Apple should make a profit for providing the platform. That profit shouldn’t be 30%... as a business operator I wouldn’t mind paying ~3%
As soon as I start using an app in a regular bases and I notice they stop me too many times to watch videos or look to timed ads, I check if they have a paid version. So this is a good solution and a good compromise for paid. For free apps, I get it because developers need to make money.
It makes the barrier to entry MUCH, MUCH higher. First you have to unpack a binary, THEN you have to fixup any custom VM call that it makes. Basically only incredibly specialized people/groups will be able to do this.

Contrasting to games of the 2000s the barrier has been raised significantly for hackers
> As people earn more, they consume more in general, and more of environmentally harmful products like meat, cars, and plane trips in particular.

That is one part of the problem. But, as we have seen, there is alternatives. Because the pandemic, more people is working from home, playing video games instead of traveling or even learning new skills.

I love to travel, but also to play games or read books. A change of culture will help with that. Governments could also apply "sin taxes" to luxuries that harm the environment in favor of more social and cultural activities that hire more people but consume less natural resources.
It's not that simple.

First line managers rarely have the power to simply fire on a whim. There has to be cause, and it needs to be evidenced, and there will be multiple people involved in the decision.

If you're a more senior engineer, you may report to a manager of managers, and line managers may be your peers organisationally, and probably not paid as well as you are.

Engineers also get to make a different kind of decision to managers; and it's often the longer term, higher leverage, more strategic kind of decision. Line managers are much more operationally focused and rarely have the bandwidth or tasking for strategic decisions.
In addition to mynegation’s comments, I would say that if you’re trying to build a business out of this app, start charging now. Offer lifetime refunds if you need to to hush the inner critic, but nothing helps the same as serving people who are actually paying.
> The actual people chopping down rainforests for palm oil plantations are formerly impoverished farmers.

The people chopping down rainforest and planting oil palms are dispossessed, former farmers.

The people making them do it are wealthy and politically well connected who arrange to have their land confiscated.
> As a VP, choosing the wrong product line can definitely get you removed from your position.

In theory. In practice they'll blame someone else and use the information they control the flow of as proof. Politics matters more than ability to improve things overall. The Director who gets promoted is the one who saves the VP's backside in the previous example and not the one who increased revenue five fold.
> There are third-party tools that do all of this.

The things that today do this will be all gone in ten years, or replaced with other things that will in turn be replaced ... LaTeX has been here for a long time, and has been strikingly stable.
That's the direction things are heading.

It's (past) time to start collecting genomes and marrow samples from as many critically endangered species as possible. Unextinction is a difficult problem, but without the necessary material, it's impossible.

Sure, that's going to favor charismatic megafauna. But we like those, it's right in the name. And it's no substitute for building wildlife corridors, managing park lands better, extirpating invasives, and all the rest. But it doesn't draw resources away from those things either.
Does the problem actually have that constraint? If so then yeah it's significantly easier. I thought the reason you'd have to use a clever algorithm is because a brute-force solution to find all index pairs would require n^2 operations, where n is the size of the input array, because you can't stop after you find a single pair.
Rensch's Rule
I've seen people on Twitter claim that the experience you are describing (and I also experience) is actually ADHD, but I haven't been to (or asked) a professional psychiatrist to confirm this.
It reminds me of a US visa, which is far from free, and you pay for applying whether you is granted it or not. It allows you travel to a border control and ask to be let in. They can refuse you without explanation.
> I believe there are sshd vulns extant that you and I don't know about and port knocking allows me to worry less about them.

That's interesting, that's the first time I've heard a justification for port knocking that actually makes sense to me.

I'm curious for others' thoughts here -- are non-public vulnerabilities something you consciously try to mitigate? So that, for example, using 2 different 8-character passwords that are implemented with different technologies, is therefore fundamentally more secure than a single 16-character password? Precisely so that a vulnerability in one is still protected by the other?

To me this feels like it's really only applicable if you need to protect your data from hostile governments targeting you specifically, who might actually have zero-days they have weaponized.

However, if you're just trying to protect yourself from everyday hackers or even targeted corporate espionage, is unknown vulnerabilities really something that's realistically worth protecting oneself from? (Assuming you're always installing all security patches.)
Don't know what to say, but I think this is one way to iron out senior folks who don't do daily coding and most of the time was on designing, diagnosis or debugging.

When you go to interview,you may be interviewed by a fresh graduate who throw you a trick leetcode question that is, pretty much, requiring you come up with code in 30 minutes. Without a few months careful practice, it's hard to get it right under stress.

Coding challenges are like driving, you drive at normal speed in real life so you can drive everyday safely, but for interview, your brain has to be speed up the max speed under pressure, not everyone, not even the brightest guy who can do this well, again without months preparation.

I got interviews at Amazon etc but I never had time to practice leetcode etc, there is no way I can pass its whiteboard process without at least 3 months preparation I feel, and I absolutely have no time for that.

How about hiring senior folks as a contractor for 1 or 2 months then to decide the level and pay and such? nobody wastes anytime and no obligation either.
This attack seems pretty surgical and might not be very practical, but pretty interesting nonetheless.
Oh, I guess I must be trapped in a Cubicle of Awful. The Improve the Moment technique sounds perfect. One thing that I do when I need to wash dishes or other tedium is put on headphones and listen to music, otherwise the “ugh” is too overwhelming.
There are, but you often run into limitations in praxis.

For example you can take a look at tokio::LocalSet::{block_on,run_until} which require neither 'static nor Send or Sync. But then spawn_local does require 'static.

Same is true for smol where we have smol::block_on, smol::{Executor,LocalExecutor}::run and here too we have the limitation that calling spawn on a LocalExecutor requires static.
Many countries with high population density have managed to deal with COVID-19 rather well, and vice-versa.
To begin with, I think they made it to accommodate Tencent, who once threatened to pull Wechat from App Store if they don't let them use their own payments.

First, they used them for transfers only, but later came games, and etc.
If we're being very charitable I guess the idea of using a HashMap for an optimal solution might slip your mind but even a freshman in CS can just loop twice over an array and solve it.
> Shipping a binary means I'm no longer worried about my build environment and pip and shipping all my Python junk the right way.

I'm not sure it is that clear a win: for go, if you want to be able to reproduce a binary in future, you would still need to keep track of exact versions of all your build-time dependencies such as the compiler toolchain & all library dependencies, and version control or archive backup copies of these. You still may need to figure out exactly what version of each component you're running if serious security vulnerabilities are found in some component.

I agree it is much simpler and easier to ship a single statically linked self-contained go binary than a python app, but both languages arguably require a similar amount of effort to having a reproducible process to build and deploy.
Of course... but to clarify, I was asking about reuse specifically. I can't think of anything you'd reuse the paper packaging used with sugar or flour for...
HTC is going commercial only. From what I’ve seen with other Chinese companies going that route, it makes it either harder or near impossible to buy a single headset when a company takes this route
yeah but they're variations on the same stuff. it just allows gaming of the whole process where if you solve enough of those types of questions, you have a better chance of getting in.
I'll just put the code up on github. It'll take me a bit, so check back in a day or two.

http://classicempire.com/

I'll announce it here:

https://twitter.com/ClassicEmpire
We had a hard time showing users why we are different from other aggregators/curators.

Eg. we extract 3 most information dense sentences from article, we show different political perspectives, we analyze the articles and score them, we group related articles to a story into a cluster etc.

It's a fine line between showing too much and showing too little.

We also plan on building an app soon.
The Strange Emptiness of Egypt in 19th-Century European Photographs
Funding digital infrastructure through state sponsorship is hard. Because the industry moves fast and politics does not.. nor is politics particularly efficient, they just can't be experts on everything.

Sponsoring large research projects might go along way though.

> Governments want to control their populace.

That's a pretty broad statement :)

In my country we have free speech, and the state/government protects freedom of speech.

Similarly, my government tend to promote human rights. I think that can still be said about the US too.

No governments aren't perfect, but control is not their major concern.
Very little of a job like this is about technical chops. Oh, they should be able to understand technical issues and tradeoffs and have staff that can dive into technical details, but they're not going to be implementing technical solutions. But something like this is fundamentally a people job.
Also: the Patreon model can be really great if your goal is to offer the service to everyone for free. That can even be something that happens when enough people donate a specific monthly amount.
Their 30% has been their rule since the beginning. I could see your point if they increased that but that isn't the case.
> Lots of large companies are competing for talent, and if you can't pay bank salaries, you're going to have a hard time.

Sounds like Economics 101. The curves of supply and demand meet at some point. Some customers can't buy (enough of) the thing because the price at the intersection of the curves is too high for them. Yes, that's how free market works.

There are things I can't buy, because they are too expensive for me. Or I could buy them, but I would have to sacrifice something else I need more. This is considered normal. When some company can't afford (people like) me, it's the same thing.

They would like to have cheaper developers. Sure, who wouldn't? There are also things I would like to have cheaper. Same problem. Why am I not entitled to get things as cheaply as I want, but my potential employer would be?

In my experience many companies prefer to whine about the shortage of talent, even if they could easily hire another person by increasing the offered salary by 50%. But they won't. Then they make millions of profit, which shows that the money was there, it was just their decision not to spend it on salaries. Okay, fair, it's their money, their decision. But if it's your decision, own it, don't pretend there wasn't an alternative.

Make it known that you offer double of the market salary, and you will be surprised how many people are out there in the "empty market". At least I never heard about a company that offered lots of money and couldn't find a person for the job.
>In Europe, 10 countries have implemented programs, with return rates ranging between 82% in Estonia and 98% in Germany.

https://plasticsmartcities.org/products/deposit-return-progr...
I realize you're probably a troll who's pushing a political agenda, but what you're saying simply doesn't square with the facts. It isn't true. There's no question that a person wearing a BLM hat to a Trump rally would be at least kicked out, if not in danger of physical violence.

Trump himself has incited violence against his opponents at his own rallies. Here's him saying it in his own words:

https://www.youtube.com/watch?v=iCLvJE26wGY

Here's an example of him retaliating against a reporter just for trying to attend one of his rallies:

https://www.vice.com/en_us/article/akzp34/the-trump-campaign...
> The plastic-in-the-environment problem is mainly about collection. Collect it, bury it, and it will eventually turn back into oil.

This is incredibly uninformed and misleading. Burying it will not solve any problems, a PET bootle takes something like 450 years to fully breakdown, on top of that the particles released as it breaks down will be washed away into the subsoil and end up in ground water, then rivers, water supply, and eventually then back into the oceans.

Most plastics also have a hazardous health side effect they act as hormone disruptors, effectively mimicking estrogen. Having any additional plastic purposefully break down and leak in even greater concentrations, into our water supply, sounds like a remarkably poor idea.
The opposite of that is more common I think, and really pisses me off. More often, I think, upper management will protect the lower managers and side with them whenever there's a dispute with an IC, even intentionally pushing the IC out.

My assumption is that upper management doesn't want to admit they've made a mistake in hiring their subordinate managers. And all of this just goes to reinforce the existing power structures.
First off, thanks to the authors for making it clear that this is a difficult attack vector to exploit. I'm tired of sites like these that make it seem like it's the end of the world.

As this is a timing based attack, I wonder what the feasibility would be in a real-world network environment. From a brief skim of the paper, it looks like they were getting a false positive rate of 10% between two VMs on a Gigabit connection. I wonder how quickly that would increase if the servers were in different buildings / cities / continents.
Yes it does, you can open the leetcode and see for yourself. That also explains the "easy" difficulty rating.

I guess you've been giving candidates a more hardcode version of the problem, not having that constraint?

edit: nevermind, it's the other poster who was giving that problem, not you. No idea how they formulate it in their interviews.
Had the same experience. First language I learned was VB and felt like I had to learn programming all over again when moving on.
Except you don't assume that just because someone is on the VPN you're secure.

If the VPN server has a 0day, they now have... only as much access as they had before when things were public facing. You still need there to be a simultaneous sshd 0day.

I'll take my chances on there being a 0day for wireguard at the same time there's a 0day for sshd.

(I do also use selinux and think that you should for reasons far beyond just ssh security)
>Why is the attack called "Raccoon"?

>Raccoon is not an acronym. Raccoons are just cute animals, and it is well past time that an attack will be named after them :)

Better naming and mascot than the last five TLS security bugs if you ask me
Artificial Intelligence Aids Gene Activation Discovery
Most PC game sales occur in the first 30 days after release. Protecting even a few days adds significant value to the publisher.

Some protection methods do last a long time. StarForce 3.0 protected SplinterCell took 422 days to crack. Not long ago cracking Denuevo protected games took around 75 days [1,2]. I'm not aware what the current best protections are or how long such protected games take to crack.

[1] https://news.ycombinator.com/item?id=21953764

[2] http://web.archive.org/web/20200104093734/https://iscracked....
which, from the Darwinian perspective, will cause either our extinction, or an adaptation, but only after many have died. It's probably all avoidable, but I don't see the human kind, in its current form and way of societal organisation being able to get out of this.
> Maybe you don't want automated unit tests

Interested why you'd say this, can you elaborate? Do you mean tests in general or unit tests specifically?

I can't imagine automating a CD pipeline without having some automated testing as an integral step. If you don't have automated tests, how do you remain confident that you haven't introduced bugs/regressions?

Even in a small codebase that's easy to do - especially when you're evolving quickly.

Like I say: not tacit criticism, genuinely interested.
For me, washing my face with cold water does the trick. It somehow breaks me out of that "ugh" thought pattern, to start thinking afresh. Also taking a shower - interesting how these both involve water.

Giving a name to this feeling, the "ugh field" and "wall of awful" (I hadn't heard of that one, thanks!) - it helps to recognize it as it happens. It takes practice to catch it as soon as it starts, because the longer you sit in it, the deeper hold it has on you.

It's related to anxiety disorder, I think, in that there's a spectrum of how bad it gets, how much it affects your work and personal life. It's also a symptom (or a cause?) of the burn out syndrome.

Having broken through countless walls of aweful, I've learned that patience and persistence are key. It's important to be patient with yourself, to lovingly steer the mind and body towards your goals, and forgive yourself for feeling how you do.

If you feel so bad about doing a task, it's a sign that something is out of balance. Sometimes the best thing to do is let go, whether it's prioritizing your mental health over work demands, or searching for a better job situation.
Personally, I've written a few multi-threading implementations at various places and my accumulated wisdom is that any data received by threads has to be passed by values or be constant. Anything else is a lot of risk for little value.

I've also come to the conclusion that async/future are a bad idea for multi-threading. They're fine for managing mono-thread asynchronous events, but using them as a poor man's thread pool is begging for trouble. Among the problems are:

- you do not know if the execution will be synchronous or not.
- you often don't know and have no control on how many threads will be spawned.
- it makes following the flow of data and execution much harder.

What I've come to rely on is the trinity of:

- a thread provider (non-committal name, we all know it's a thread pool behind the scene), which provides the threads of execution.
- a work item provider, which provides the input data to the algorithm.
- a worker provider, which provide workers that receive a work item, execute an algorithm and produces a result.

Then something gets executed when all three are united. For the curious, the reason to have a work item separate from worker is that it allows the worker to be long-lived and re-used and, most importantly, allows containing heavier data. For example, a cache. The work item are light and are just the necessary data needed to process one... work item.

I've also sometimes divided the work item into two parts: a work item and a context. The work item is the changing data to be processed while the context is the almost constant data, and can be shared. (For example, configuration data.)
“Please cut off a nanosecond and send it over to me”
Facebook board member Peter Thiel met with white nationalist
Epic is a mom and pop? Get outta here..
> You have become incredibly insincere in your arguments, or you are seriously misunderstanding this discussion.

Please refrain from personal attacks.

As you noted in another comment, I'm primarily a Mac developer, and in my experience, the extent of the third-party Mac software market has often been vastly underestimated. Maybe it's just because people aren't familiar with it.

There are of course large numbers of users who never buy third-party software, but with any large platform, such as Mac or Windows, all it takes is a significant % of users to buy software for the market to really add up. Doesn't even have to be a majority of users.

I haven't been a regular Windows users for many years, but back when I was, there was a thriving consumer software market on Windows. Again, it doesn't even have to include the majority of users, because those who do buy software are willing to pay good money for it.
They're a lot more competitive too.
If we ever make any progress on general AI then everything might actually be a nail... But we're so very far from that.
And/or you're on the speaking circuit, field lots of feelers about being on boards, etc. Depending on where you are in your career and your interests (this isn't really a technical job but then neither is the job of CIOs at large companies mostly) the money is almost irrelevant. It's not like you'll be in this position for more than a few years anyway.
Because it is not about fairness or rules. It is about extracting as much values as possible from app developers.

That made sense when the Apple store was a small kind of start up enterprise. Nowadays, it should be regulated so all developers can use the platform in a level field where competition is real and it is not just a game for big corporations.