skysight-inc/HackerNews huggingface dataset:
That's all right and all fine. It's my user choice to install any crappy third party app store on the hardware I bought. I would like to not being protected. The same on windows, I'm warned than executing an unknown program is a risk for me and if I don't know what I do, then I should not do it. That is perfectly fine. Small fences with warning signs instead of 10 meters walls.
Consider therapists who have you lie on a couch vs those who have you sit in the same style chair, as an equal.

Some therapists position themselves as an authority figure for their patients. If they were to open up about themselves, the patient might think they're incapable after seeing the therapist has doubts in their own life.

This has advantages and drawbacks. It may be more efficient in earning trust, thus helping some patients heal faster. OTOH, some patients may never really accept this kind of therapist.

In my experience, psychiatrists more often position themselves as authorities, and among psychologists/therapists/counselors there is a mix.

It's really hard IMO to get communicable science out of talk therapy because there are so many variables and it is extremely subjective and personal. The whole point is to help a patient navigate their own issues.

I draw the above opinion on therapy from reading a few books about the history of psychoanalysis and the various branches it has taken.
Fair point.

I would be okay with a graduate app fee.

Tier 1: Hobbyists, you can have a “self signed” cert that allows you to have any app tied to your own device. You could also freely share source code for other people to compile themselves and put on their own device using their “self signed certificate”. This could be free. Of course you would still have to have a Mac.

Tier 2: a really cheap fee where you could sign apps that were distributed outside of the App Store for Macs. Signing apps that are distributed outside of the Mac App Store don’t require any manual approval or sandboxing.

Tier 3: the current App Store model. But the difference is that the first $x amount is charged at 30% and then it gradually goes down at larger volumes. Say the first $10K? Where eventually it is basically barely above payment processing fees. I’m sure the Epic’s of the world would be okay with this.
What is benchmarketing and why is it bad?
Find Duplicates in an Array
If the security-by-obscurity means binaries that you don't have the sourcecode to running on your systems, not only is that such a 'security method' not underrated, it's downright dangerous.
Fair points! But,

>the project has been going since 2015

True, but Fuchsia started only a year later

>Fuchsia is a lot more than a microkernel, right?

Indeed, but that is also true of Redox!
Ah, I see. I was intersecting "real-time experience" with Apple's previous "digital goods" and thinking "real-time experience that happens digitally" (which tutoring students, medical consultations, real estate tours, or fitness training all can support), and I quickly wrote off babysitting as something that can't happen digitally. I'm much less confident now based on how you're reading it.
Clever! Were you inspired by the very early machines that used serial processing to save on the number of tubes?
That's also because in addition to testing if you can solve the problem, they're also testing your _judgement_.

It's an interview. Just like any other engineering problem: use the right tool.

If you go off tangent and don't solve the problem, then that raises the question: "Ok, the engineer seems to be able to code, but they didn't finish. Will they finish other work? Will they regularly get caught up in irrelevancies?"
Huh?
Java has Interfaces.

fastutil.di.unimi.it provides unboxed Generic collections and is over 10 years old.
First of all I agree with you, that we should compare solutions in a comparable manner and I went overboard.

So yes, if we want to be fair we have to compare an in-host defense system like portknocking (which has one job: secure sshd) to a in-host vpn setup more alike to like the often mentioned wireguard.

And in this "configuration" I completely agree. I still think it may be more likely for a VPN to expose security critical bugs than a bug in knockd - but as you said this should only allow access to your next layer of defense (namely sshd) and maybe (if you're a really valuable target) a three-letter-agency might throw all their resources at you and are willing to throw every weaponized exploit they have at you - yeah than you're even more correct because than they would have a far easier time just intercepting your port knock sequence and throwing all their quantum computation power against your sshd keys.

> The rest of your argument, if I'm understanding it correctly, is that you think people will get more lax with securing SSH on a box only reachable via VPN

The argument I was trying to make is that while a VPN is in in every way a really good idea (the way we described it here - as an in-host security layer) but I have yet to see it being rolled out in that way.

I come from a more traditional sysadmin setting, and of most sysadmins I worked with would find implementing this "correctly" to tedious and would either

a) terminate the vpn connection at the rack or co-location "border" and shove a bunch of servers down a single VPN connection
b) terminating every servers vpn connection at a single vpn concentration point

Regardless of which, in virtually all cases that I know of never was there any thought given about intra-VPN firewall rules or allowing only certain ports on the VPN. Most of the time you get the servers that are somewhat related, shove them in a subnet expose that subnet via VPN and you're golden.

And so from my practical experience, I would think that a compromised VPN in my reality would be worse than a exploited knockd, but only because it isn't scoped to the same level.

On a sidenote: I'll guess that modern orchestration tools make it pretty easy to roll out knockd and / or wireguard pretty easily in the discussed fashion - it's just I don't get to play with those.

That was a lot of text, just to say I agree with you - but hey, I guess agreeing on something on the internet is somewhat nice so have a great day.
> I just rolled my eyes and laughed and said

In this case, it sounds like the mood was right in the room for it to be taken well candidly.
Why does it take threats of a national embargo to unlock functionality that should be present in EVERY device from the start?
> Rust imposes one of the possible disciplines for memory-object management

Until you load a shared library not written in Rust into the address space.
By 2050, the area burned annually in the West is expected to at least double
My PS4 and Sony Android TV are general computing platforms in every sense e.g. Salesforce is open right now on my TV.

It's simply that Sony won't approve non-gaming or non-entertainment apps. And if Apple were to follow the same path and block productivity apps then it would somehow stop being a general computing device ?
The US routinely bans foreign companies that threaten its cash cows, Bombardier is an example.
I think you're missing the point I was trying to make. When Gmail decides to ship their own native client on MacOS, this platform will become abandonware.
"the libc is written in Rust"

This is cool, are there any downsides to calling Rust code from C? I guess it's basically a black box that behaves like a regular C library from the outside?
You can install apps on iOS without using the store.

And if you are willing to jailbreak then you have the full suite.
Apple is really waiting to be toppled over. If only Microsoft could up their hardware game and start producing good computers.
Surely a portion of grazing land is also habitat to a significant amount of wildlife. Whereas large mono crops leave no room for competition and result in much death in the automated processing of crops. Not a lot of great options with billions of people to feed.
fastutil.di.unimi.it

You don't need to rebox in performance sensitive code.
most people have firewalls configured to simply drop traffic not destined for open ports, in which case there is no response as the traffic never makes it beyond the firewall.
Did you remember what software did he use? I have been looking for some solution with this "methodology" but has not been able to find something satisfactory 4 me. tks in advance!
Or, you can use C# and not put anything at all.
This isn't actually all that new, 25 years ago when I worked at a large Motorola facility, I was always amused when I worked late, which was often, of having the janitorial staff empty my wastebasket into the large bin they pushed around, and then dump the contents of the paper recycling basket into the same bin. It hasn't been economical to recycle paper waste streams in the US maybe ever.
I try not to look down on social science, for the most part data is data as long as you can reason about how it was collected and who by.

The only thing that worries me a little (or a lot sometimes) is that there doesn't seem to be much "bone" for the meat to hang off of - that is, in physics, if your theory doesn't match experiment it's wrong whereas in social science you're never going to have a (mathematical) theory like that so you have to start (in effect) guessing. The data is really muddy, but thanks to recent (good) political developments whatever conclusions can be drawn from it may not be right in their eyes. For example, (apparently) merely commenting on the variation hypothesis can get you fired [https://en.wikipedia.org/wiki/Variability_hypothesis#Contemp...].
>A significant portion of the FS are second or third career people.

Such as the head of the American Institute in Taiwan (the de facto embassy), Brent Christensen (https://www.ait.org.tw/offices/taipei/director-christensen/), who has a dental degree.
> You don't even have to have done anything controversial. Attention itself appears to be caustic, at the extreme.

I haven't read it but I assumed the blog was controversial based on all the concern about anonymity. Is that not the case?
The Hitman Sniper app does at least one of those “unacceptable” things: They offer (not really) “free” digital items in exchange for “likes” on Facebook. And there seems to be more app functionality tied to Facebook logins.

Will big players like Square Enix be made to comply with those rules or is it only the little guys?
"Offline experiences not involving as phone do not have to use in-app purchases."

"Family interactions do not have to use in-app purchases."

"Your hopes and dreams do not have to use in-app purchases."

Thank you Apple. I for one, appreciate your generosity.
There was a 4 chime variation:
https://en.wikipedia.org/wiki/NBC_chimes#The_%22fourth_chime...

On D-Day in World War II: "At 2:30 a.m. the network was put on 'flash' basis; the NBC four-chime-alert calling all newsmen and commentators to their microphones, key operating personnel to their stations, sounded from the newsroom control room"

The fourth chime and NBC Radio's announcement of D-Day are here: http://www.nbcchimes.info/nbcsounds.php
> If (you feel that) your job is incompatible with a personal association to a popular 'rationalist' blog, and you write a rationalist blog under your own partial name, and it then becomes popular - well you will have to take that decision at some point - resign, or shut down the blog.

Scott did shut down the blog and it still cost him his job.
So don't use generic code in critical inner loops.
I think you should look into some more programming languages before you claim that this is unique to Kotlin. ;)
Comparisons are a little unfair, because traditional cars are like department stores: nobody pays MSRP. Tesla, however, everyone pays MSRP. That's not a knock against them, it just muddies the comparison a bit. I bought a brand new Colorado last year, seats six, 5.5 ft bed, for less than 23k. I'd love for Tesla to have a model similar that cost about the same.
Where’s the mention of Digg? Thay was a large contribution to Reddit’s traffic after their... redesign
Lol, I might've woken up my neighbors with my laugh. It's 5 AM, and reading this. Jesus I just realized that Apple is the same as Microsoft in 90's. Do all companies when become behemoths start to "do you are have the stupid?". Because it seems so.
The manager asks the developer "how long is this project going to take you?" and the developer replies "2 weeks." The manager yells "That's unacceptable! How long will it take you if I give you another engineer?" to which the developer says "4 weeks." The manager asks again "Fine, take as many resources as you need. How long if I give you 100 engineers." to which the developer replies "it'll only take us 30 years to finish the design and after that it'll pretty much be smooth sailing!"

jackpot51 describes himself in his bio as a "BDFL of Redox OS" which means he's likely personally passionate and just does what he thinks is best. This will likely not lead to a better outcome than Herd and Fuchsia would lead to but it will lead to an outcome within our lifetimes.

In many cases, however, "working" is better than "planned"
I don't think I've ever told anyone about a good interview experience, but I certainly have talked about a few bad ones.
Had the exact same experience interviewing for Amazon way back in 2005. I was still in college, and the answer he was looking for involved some obscure Linux/Unix command. I really felt defeated and thought “well I guess I’m just not enough of a hard core coder.” I still remember his smug attitude as well. Looking back it seems ridiculous, deciding a college student was not fit for a software engineer position because he didn’t know an obscure Linux command off-hand? Bizarre. But I guess back in 2005 there was much less demand for software engineers so they could afford to be absurdly selective.
When people go this route, do they still see or talk to another therapist?

I always figured people's chemical imbalances were influenced by behavior. If you just treat the chemical imbalance without addressing the behavior, isn't that rather risky?
Thanks Robert. We’ve had great success hiring from Facet at our FAANG team. Facet has a strong candidate pool (often other FAANG) and has cut our time spent recruiting by at least half.

Facet’s staff augmentation service is uniquely strong in the industry. I can get temp employees for both long and short term, and scale up or down at any time with just two weeks’ notice.
If the invitation has no other context, I would PM the person calling the meeting asking what's going on - whether they're the newest hire, or the CTO.

If the meeting is something where I'm needed, I'll attend, whether it was scheduled by the newest hire or the CTO.

If it's not, I won't, etc., etc.
But cigarettes are so bad for your lungs. Likely the worst way of intaking nicotine.
Honeypots are fun, but be VERY careful how you deploy them. Ideally they are on a completely separate network on the WAN side of a second firewall. The last thing you want is for someone to find an exploit in your honeypot and use that to gain access to your network.
"McDonalds" listed as an example under Spelling, Spaces, Hyphens - Option 4 confuses me. Sure, it may have been a compound in its original language ("Mc" meaning "Son/Son of" IIRC) but I wouldn't consider it one in modern English. Definitely sticks out to me among the other reasonable examples. Of the options listed, I'd categorize it as timeless given that it's based on the founders' last name.
CM1 had 65536 single bit processors. They were not connected in a crossbar, instead the chips that were the fundamental building block of the supercomputer each contained 16 of those bit serial processors and 4096 of those chips were connected in a 12 dimensional hypercube. The total dimension of the hypercube was 16 but the 16 on-chip processors had local routing.
Id recommend a standalone instrument. As soon as you connect midi controller to the computer the millions of options start to distract away from the fundamentals. The controller is an option if you can stick to what you decided to do and have the will not to get lost in options
> the focus should've been on producers not consumers

on producers AND consumers. They're not exclusive. Producers have deceived, but consumers have been all too happy to suspend skepticism when buying things once the producer puts the word "recycle" on it somewhere. Consumers overwhelmingly skip the reduce part. Everyone I talk to about it, when they drop their defenses, says somewhere inside they knew they were participating but wanted to believe recycling was more benign than they knew it was. They just wanted their latte without thinking about it too much.

I'm not removing responsibility from producers or government. Consumers have a lot of power. Single-use plastic at least isn't hard to avoid with practice, at least to drop 90 percent of it. Just avoiding packaged food, with a few years practice the last I emptied my garbage was December and I expect my next emptying in 2022.
Apple won’t allow it because of $ and because it breaks their vertical integration strategy
Libraries can convey that information through IntelliSense with an XML comment:

<exception cref="FileNotFoundException">Thrown when file is not found</exception>
how do they even have that kind of money
Dude - you're not even making $180k/yr (gross) at FAANG and you've been there for 8 years?

What is your position...? I earn about $9k/month (net) at $170k/yr (gross) in CA as a software engineer. So, I'm already past the 2/5 mark and I'm just at a startup that doesn't even pay well! On top of that - you should be getting stock that translates directly into a good chunk of cash - not just a salary component. (Unless Netflix I guess)

Check out https://www.levels.fyi/
The ironic thing is that it would be logical not to share or publish examples of security by obscurity, in order for them to be more effective!

Doesn't that reveal part of the problem of 'security by obscurity'?

Indeed, how many people publicly disavowing 'security by obscurity' do so to secretly benefit from the methodology?
Nobody wants to reduce their own consumption and the disposable, single use, “it’s not clean if it doesn’t come shrink wrapped in a plastic wrapper” mindset has all but destroyed “reuse”. All that’s left is lying to the public that recycling will make up the difference.
Apparently so. I don't disagree that you'd be well-off, but you couldn't never work again without a very frugal life, you couldn't vacation every month, you're entire subsistence is still tied to your job you must work to survive, and so on. Certainly in a great position, but being rich is very different
Doesn't apple own the operating system?

They licensed the OS to you with a specific set of permissions to enable a specific business model. I understand how you would want them to not get paid but I don't see how that's fair.

If a customer wants a different app store, the customer can buy a non-apple device. Apple doesn't have a monopoly in mobile devices or app stores.
Seems like you are a brilliant programmer but lack domain knowledge for that specific job.
Regardless of how many CTOs do care, 100% of them should care. The reason they don't is there's no real incentive for them to care. Outing companies who do things like ghost candidates or have shitty, arbitrary interview processes probably isn't going to be enough to get most of them to care. But, some might, which is why I think it should be a regular practice.
Careful there with that "legit" solution! With extreme values, it can cause overflows and other weird behavior.

For example, in Javascript with:

x = 2
y = 9007199254740991

then:

x = x + y // 9007199254740992
y = x - y // 1 (!!!)
x = x - y // 9007199254740991

Or in a somewhat more sane language like C, it'll usually work but may technically invoke undefined behavior:

% cat test.c
#include <stdio.h>
int main() {
int x = 2;
int y = 2147483647;
x = x + y;
y = x - y;
x = x - y;
printf( "%d %d\n", x, y );
}
% gcc -fsanitize=undefined -O0 -g -o test test.c && ./test
test.c:5:7: runtime error: signed integer overflow: 2 + 2147483647 cannot be represented in type 'int'
test.c:6:7: runtime error: signed integer overflow: -2147483647 - 2147483647 cannot be represented in type 'int'
test.c:7:7: runtime error: signed integer overflow: -2147483647 - 2 cannot be represented in type 'int'

And even in Python you can end up with it silently turning your ints into longs.
Thanks, I appreciate the thoughtful response.

It sounds like port knocking and VPNs, while starkly different in approach, have some overlap in their approach to threat mitigation.

Wireguard et al are much better equipped to handle the needs of an organization, while port knocking's value trends to smaller teams, or even individuals.

I wouldn't want to manage knock rotations for 600 employees, for example.
> I’m a self-taught programmer working with a lot of very smart CS grads, so I constantly find myself thinking that I’m not fast or good enough to keep cutting it.

I'm just gonna throw my experiences out here: I'm self-taught who then got a BS in CS, and day-to-day, the vast majority of the skills I use are the ones I started developing before college. The CS knowledge is something that is extremely useful, but it's not a day-to-day thing - it's more like, it pops up in special circumstances, and the degree never really touched on the self-taught things.
Thankfully, C# team made the right call and used reification.
If this is a timing sidechannel, why is it considered s protocol vulnerability and not an implementation vulnerability? Could it be mitigated by using a time-constant implementation of the KDF?
If you want to learn the fundamentals it is better to remove all distractions. If you want to produce a song it is much easier on a computer. But the meat of creativity comes from limitations though
Ppl that say obscurity is bad must be saying look here try hacking my site, it’s unhackable and secure. Everyone knows it’s good, it just make you look weak to say obscurity is useful. Ppl are scared to admit how useful it is in security.
I remember cashiers asking me "would you like to kill a tree or kill a fish?"
> And there are more documents, echoing decades of this knowledge, including one analysis from a top official at the industry's most powerful trade group. "The costs of separating plastics ... are high," he tells colleagues, before noting that the cost of using oil to make plastic is so low that recycling plastic waste "can't yet be justified economically."

I bet if you went back 40 years, there are all sorts of negative documents you can find about all sorts of tech. Think about solar. I bet if we went back, we could find experts talking about how it is is infeasible due to being too expensive or that rare earth minerals to too environmentally damaging to mine, or that it fluctuates too much.

Not saying what Big Plastic did was good, but using archives to find dissenting opinions about feasibility seems more like a gotcha fishing expedition.
The manager's job is to communicate necessary information to the whole team. The IC isn't. If a manager starts abusing that presumption to schedule irrelevant meetings, people will respond appropriately.
Sure, like giving a login page an unexpected URL to foil bots (eg hiding WordPress admin).

If that was the only security it’d be terrible.

But not having 1000s of bots pounding on the door saves a lot of headaches.