skysight-inc/HackerNews huggingface dataset:
I assume you're equating picking a random SSH port with scanning for an ASLR slide or guessing a stack cookie, but they are different situations: processes that die are generally treated quite seriously, and they leave "loud" core dumps and stack traces as to what is going on–usually this gets noticed and quickly blocked. With SSH you can generally port scan people quickly and efficiently in a fairly small space (and to be fair, 16-bit bruteforces are sometimes done for applications as well, when possible)–and the "solution" here where you ban people that seem to hit you too often is literally what you are supposed to be running in the first place.

And in general, the sentiment was "if you are using those things, you are likely to have invested time into other tools as well such as static analysis or sanitizer use" which are not "security through obscurity" in any sense, whereas the "obscurity" that gets security people riled up is the kind where people say things like "nobody can ever hack us because we changed variable names or used something nostandard" because it is usually followed with "…and because we had security we didn't hash any passwords".
I wrote my bachelor thesis in markdown with inline mathtex(?) and compiler it from there with pandoc.

I also tried from/to HTML and the result is just bad. HTML isn't suited at all to write scientific documents with proper formatting.

Also I still need to do some things directly in latex and include them with inline latex in markdown.

So no HTML+CSS isn't suited for this at all.

At least for now where scientific papers are still DIN A4 real paper based/targeting.

Maybe it's time to change that. People read papers a lot in 24" Monitors, tablets, laptops and e-book readers for all of this the current formatting sucks.
In my case, I have a simple obvious use case.

I work for a large corporation. They want to implement the Bezos mandate [1]. No direct database access between teams, API abstraction for everything.

OK, now let's think in onion layers (or hexagonal/clean architecture if you like). Think of layers of services with different purposes - data services (containing no application/business logic), application services (for business logic, orchestration, process), and UI/UX services (to power differing end user experiences).

Data services don't have to do much - be the data/repository layer, expose productive interfaces for CRUD. Need to read across data sources? Think of federated data services that can combine data on the fly, perhaps like GraphQL.

These kinds of tools are perfect for the first layer of services that abstract the database world from the application world. Just simple services, even ones that effectively let you mimic what SQL queries can do (filter, sort, page, etc.). Individual record oriented interfaces, and bulk oriented interfaces. The query side of CQRS (command query separation).

Many will say, "I don't need all this complexity and layers" - and sure, for smaller or simpler applications, probably not!

But, if you have to operate on any kind of larger scale, with multiple data sources, systems, etc., you end up needing the layers. And these types of tools automate some of the lower layers.

Perhaps when we talk about this, we shouldn't be focusing on "oh it's too complicated", and instead building frameworks or reference architectures that automate away the complexity - so it looks easy again, but now it is more flexible, perhaps easier to scale.

I believe that we are on the cusp still, of an almost fully defined, service based architecture (microservices and server less were just one part of the continuing development of that story). Federation is another part of that story oft ignored. Thinking of the onion as service layers is another part. Erasing the network boundary as a concern through much higher speed internetworking is another part.

Eventually we may come to see, that it is all a big "system", some parts just aren't connected to each other directly.

Sorry, got a bit rant-y at the end there :) Just passionate about sharing this world view with others - as I continue to see this architecture developing!

[EDIT] I wanted to add, it's not just that the use case for this is in a data service layer for automation - from a logical perspective I mean. In big companies such as the one I work for, we never get the resources we need, ironically. We are overwhelmed with demands, and must operate under the Bezos mandate rules. Tools such as Octo are not a panacea, but, they are a good compromise if you have to move fast, they are time-and-cost-savers. And they can get you surprisingly far.

[1] https://www.calnewport.com/blog/2018/09/18/the-human-api-man...
It's still bad security.

Sure, it increases costs for a certain subset of attackers. Instead of sending easily found and trained young Arab men, they have to put more effort into recruitment. However, in return for that, they get far reduced scrutiny.

Therein lies the problem. It is the real-world equivalent of dropping all packets from a country instead of properly analyzing the packets. You'll stop the low-cost automated garbage attacks, but you won't stop a dedicated attacker, even if the attacker is in that country.
I can't believe MathML just died and it's like not even part of the conversation about the history of math markup.
Hey, total stranger on the internet here - I have no qualifications to help someone with suicidal thoughts but I have been an engineering manager for a decade and I'm pretty decent at it. If you ever want to talk to someone about your career and don't feel comfortable opening up to your own manager about it, please reach out. Email is in my profile.
What, in your mind, is fraud if announcing fake products as real does not qualify?
Thanks for the interesting historical example!
I can’t speak for Apple specifically, but most companies I’ve worked at fix hardware issues or make cost down component tweaks after release.
…which has its own issues, of course.
Why would you do manual backups? Just schedule cronjob to periodically upload the database somewhere. You can save it anywhere - other $5 server (not $15), to s3, even on google drive. I don't know if there is threat of database being corrupted midbackup due to writing in it, but if you don't want to risk it, just use sqlite online backup api.
Hell yes, couldn't agree more.

This last year, I found out about knockd and if that isn't some awesome shit, I dunno what is. Yet, there are plenty of articles saying, incorrectly, how it's awful. It is simply another layer of security on top of everything else you have. Like you said, security by obscurity is more about making it fucking slow, irritating, tedious, and without any sense of reward. "Aha! After only a week, I've figured out you're port knocking! Oh shit... wait, you still totally have the server properly locked down. FML." Because after each "obscure" layer there is a "real" layer of security and hopefully those all those real layers buy you the time to detect and prevent the threat.
In the US alone, there have been have been several congressional hearings and FTC reports on malware and spyware over the past 20+ years. Microsoft was under significant political and commercial pressure in the 2000s to clean this up, and they answered the call.
Progress studies: many hard questions
Calvinball?

https://xkcd.com/1002/

That comic is from 2012, and since then Arimaa, Go and Poker have moved solidly into the "Computers Can Beat Top Humans" category. Jeopardy would probably be there too if there was a consistent effort behind it. I think the Starcraft AI is pretty good these days, but people argue over things like APM restrictions.
Thanks, I am playing with the app, it looks great.

I got one question what other books did you read on Highly Sensitive Person (HSP)? And if you recommend any? I have been told that I am "Empath" and lately reading up on it (mostly online). Empaths and HSP seems related, based on quick research.
Yes, it seems every other URL is the same as the one before.
In theory it should be possible for a package manager to check the public API for obvious breaking changes and throw an error if the major version has not changed.

Its been done as a research project [1] but I don't think it has been done in any major language or package manager.

[1] https://drops.dagstuhl.de/opus/volltexte/2018/8456/pdf/OASIc...
I think the point he was making is: why the API if you just want to talk to the db? You can connect to a SQL db over the network and protect the data with views and stored procedures.
They're wrong; full stop, no qualifications, no asterisk, no footnote, they are totally wrong on this and it is inevitable that their opinion will change.

To be honest, that's an impressive oratory monstrosity you've produced there. No argument, no nothing, and nevertheless it sounds completely brain-shutting-down conclusive.

I don't think the rust people are deserving of it. They've done impressive work with minimal resources, and they have shown the ability to create consensus that's better than any of the individual parts that contribute to it. So I'm going to trust them in this for now, and maybe, they'll evolve in the future.

Nevertheless, I have to admit respect for that sentence, in the same sense I'll admit respect for an earth-shattering nuclear explosion. You might want to run for US president if you produce more of them, though I'm not sure if that's praise or damnation.
Relevant section:

3.1.3(d) Person-to-Person Experiences: If your app enables the purchase of realtime person-to-person experiences between two individuals (for example tutoring students, medical consultations, real estate tours, or fitness training), you may use purchase methods other than in-app purchase to collect those payments. One-to-few and one-to-many realtime experiences must use in-app purchase.

This is huge news. Being able to use third-party payments methods to bypass Apple's 30% charge is essential for service driven marketplace apps. Classpass and AirBnB bumped into this issue [0], but, I wonder if this exception will apply for them?

[0] https://www.nytimes.com/2020/07/28/technology/apple-app-stor...

Edit: In excitement, I missed the last sentence; group services aren't covered by the exception :(
This is the problem with "sound bite" bits of conventional wisdom. The more it's used and misused, the less it's actually understood. People hear "Security through obscurity is bad" and just interpret those words however they want without listening to the rest of the actual advice being given.

It's not to never use obscurity to your advantage. It's that you need to be aware (and far too many weren't at one time) that you cannot rely on obscurity as a form of defense.

If I have an old, buggy unpatched version of an admin page sitting on an obscure random URL, but I decide I don't need to bother patching it because eh, it works and it's too much effort to patch and what are the odds someone will guess my super secret random URL, then I need to think about why "security through obscurity" is bad.

And that false sense of security is why they say security through obscurity can be worse than no security at all. They key is to promote vigilance and actual hardening of systems and not expend precious time devising ever more elaborate obscurity hoops that cost you more than they cost an attacker in time and effort to defeat, and are in the end ineffective.

That's not to say you should leave ssh listening on port 22, you really shouldn't. It's like the difference between leaving your front door unlocked and leaving it unlocked and putting up a big neon "Open 24 Hours!" sign in the window.
Never thought about this before, but is this a tunable thing in the kernel config? Some way to signal to the OS "only use port ranges above 16382 for unpriv" and move the boundary up?
Not at all. I have and use both because half of my customers use one and the other half uses the other.

That’s the problem though. When half of the people in United States have no choice but to leave their digital home in order to get some rights to use their own equipment without begging Apple... that needs to change.
> If we are talking about a civilisation that has means and time to wipe off other star system then they definitely don't have that problem.

No, I'm not talking about a civilization that would "wipe" the star system. I'm not talking about a civilization that uses instruments bigger than the solar system only to detect us. I'm also not talking about a civilization that would be faster than light. I'm just talking about a civilization that has some very strict (imagine, like the extremists in our world, but a few orders of magnitude more) views about what they "have" to do, and that has the attention span and endurance more orders of magnitude longer than ours, meaning that they wouldn't mind to send something to the Earth even if it would take, for example, 1000 years, and then make more steps to their benefit, etc.

In short, our thinking of what is "far" and "reasonable" are limited by our very short lives. I of course don't think that I should worry in my lifetime about the possible responses, but I don't think that the humanity in thousands of years should be put in danger by our "young and naïve" actions now.

The dangers I see are certainly not in the magnitude of "wiping off the star system", but more like those described by Rod Serling as "to serve man."

https://en.wikipedia.org/wiki/To_Serve_Man_(The_Twilight_Zon...

Even the current humans are certainly technologically capable to destroy our civilization as we now know it, even if there's a possibility that a few specimens of humans would survive for a while somewhere. The aliens don't have to be much more capable than that.
It's very entertaining to see Microsoft, Apple, Facebook, and the ringer epic games battling it out for the privilege to poach on each others turf. All these companies have moat building policies that hurt the consumers and the companies selling through the respective platforms. I'd say bust them all up intostrongly divided companies by sector. Make them compete on merits, not by screwing over their customers.

Edit: I really hope this ends up in massive anti trust breaking up all the behemoths in the room.
This reminds me of one of my favorites: "The best measurement is the one you don't have to make."

E.g., if you want two boards of the same length, cut one and then use it to mark the other, avoiding a — potentially inaccurate — measurement.
No idea how cats ended up as a "feminine" signal. I've seen cats act as deadly hunters killing snakes, birds, rodents and fighting off animals significantly larger than themselves, standing their ground. If anything I'd thing that'd fit closer to the "traditional" masculine stereotypes. I don't own any pets now but had both cats and dogs growing up.
You don't mention what your manager and peers think of you. Do they all agree that your a shite programmer? If they don't, you're succumbing to imposter syndrome. If they do, you might all be correct.

But, that aside, if you just want out of daily programming, you can...
- move into a BA or product owner role. Your technical background will serve you well as you interface with R&D teams (and communicate their concerns back up to senior leadership)

- Sales. Same as above, but requires a certain personality.

- MBA or some other graduate program. Could help you break out of tech completely. Or, move into some other tech-related role.

If you want to stay in programming, the best bet is to just stay in programming. I wouldn't worry about flubbing a few interviews, not all companies do ridiculous white-boards. And not all expect everybody to be the equivalent of a semi-genius from Stanford. There are aplenty of programming jobs where you can solve interesting business problems with more ordinary technology (vs solving interesting technical problems and building new tech stacks or whatever).
When I first learned about the Minitel, most things I found online just said it was done to reduce the cost of printing and shipping phone books. That never sounded right-- very interesting to hear more of the actual story.
> Rust links to libraries (via explicit or implicit `extern crate`) that it finds on the system via the ordinary OS-level library search path mechanism

Nit: rustc gets passed each crate available to be used or extern crate via an --extern flag that specifies the name of the crate as well as the full path. The path is optional and if not specified rustc performs a search, but the name is mandatory. Cargo only uses the mode with both path and name specified. This also isn't an edition 2018 thing, it exists on older cargo versions too. It's possible to specify the same file under multiple names, then it's available to Rust programs under multiple names. It's also possible to specify multiple paths for the same name, but then only one will be taken, the first one which is available.

Also, note that Cargo works in terms of packages, and rustc in terms of crates. A package can contain up to one library crate, and the names of the two don't have to match.
Comments like these remind that while I miss the US personally, I don't at all miss it professionally. While things in my current country (Norway) err on the side of making it damned near impossible to fire someone, the upside is as a manager I can have very frank conversations with the people on my team about how they're performing. They don't live in any fear of this, they see it as a way to improve.
Lambda School | US REMOTE | Full Time | https://lambdaschool.com/

Lambda School is a fully-online alternative to booth traditional college and fast track bootcamps. Our goal is to make entry into the software industry accessible for everyone.

We have many open roles, but the roles in my group are for the Labs organization. In Labs, we give students the opportunity to work on cross-functional teams in an environment that closely emulates a high-performing software product development organization.

The first role is in our part-time track, we're looking for a Data Lead to work with our Data Science students during Labs: https://jobs.lever.co/lambdaschool/c8c2492b-0562-434f-80f8-1...

The second role is in our full-time track, we're looking for a Client Product Manager to source and manage our relationships with internal and external stakeholders: https://jobs.lever.co/lambdaschool/61e1a6fa-942a-4d31-89f1-8...
It’s typical for US based consumer electronics companies building products at that scale and complexity to have prototypes (Protos) that are form and function complete but made only partially with proper mass production processes (e.g. some CNC parts instead of injection molded) at least a year before launch. Places like Apple would have non-form factor boards, ID mockups, and some key modules in place at least two years ahead of launch.

Some companies work on much more aggressive schedules though. Samsung for example often has a bunch of paths running in parallel that they downselect late on, and Xiaomi will compress a full development cycle into a year for some products.
I'm glad someone else realizes that individuals (outside unusually-nerdy HN readers... myself included) do not have infinite patience for enjoyable things being shut down. The DGAF attitude will hit a tipping point whether we want it to or not and jailing 40% of the population isn't possible, even in America with it's love of outsized incarceration [0].

[0] http://news.bbc.co.uk/2/shared/spl/hi/uk/06/prisons/html/nn2...
You can save money and exercise your options.

There are also companies that will help you exercise your options for a cut (you don't need to be independently wealthy).

I don't disagree though - this is part of the risk to factor into the price. I'm not saying it's easy I'm saying it's worth thinking about and not reflexively assigning a value of $0.

It should be a non-zero factor in evaluating a comp package and evaluating the company.
used to this so, too; contrary to that, deadmau5 is pretty great even though he doesn't play any instrument or know theory, he just uses his mouse and keyboard to try stuff in Ableton. Watch his masterclass, it's pretty eye-opening

seems similar to coding - some people do a short bootcamp and start to produce, while others are kind of helpless even with a masters degree in CS
> De-duplication on ZFS is currently an uncertain bizzaro universe populated with misshapen horrors crawling along a broken landscape. It’s a world of extreme memory overhead for de-duplication tables, and potential lost data due to inherent conflicts with the CoW underpinnings. Please don’t use it, let anyone else use it, or even think about using it, ever.

Is this advice still valid?
I guess I don't see a choice as an experiment. It's about using the right tool for the job. There could be multiple languages used by a team and a choice be made to use one over another. There are pros and cons depending on what is most important (speed, safety, hiring, etc.), but that doesn't cause those choices to be experiments.
That account is weirder though, they have a bunch of real (and real popular) projects like zeroise, the filled-in projects are rather complex, and even the placeholder packages have a somewhat proper description, though some of them are very very odd.

They're not out there hawking popular names for sale and some of their placeholders are even "namespaced" (the abscissa or signatory subcomponents).
Sure it might be 'worse' equipment. However experts were operating it.

And then you further get into an analog vs digital discussion. And that they were recording on 'the best' analog equipment of the time.
There were a bunch of mathematicians who used roman numerals for arithmetic between 0 AD and 1200AD. That they existed is not a counter-argument to the fact roman numerals are terrible to do arithmetic in. That is an argument that people can get used to anything, and become proficient enough at it that changing to a new - and better - system will set them back enough for it to be not worth while doing - for them. The same is true for modern maths notation.
I really hate these kinds of articles, primarily because they are trying to sugar-coat reality here.

The fact of the matter is this, management _is_ a promotion, because you get paid more and you gain access to more powers. If it were _not_ a promotion within the company, no one would take it up.

Management is a simple deal, you give up power _outside_ of the company for power _within_ the company. It is far easier to join another company as an Engineer than it is as an Engineering Manager.

However, I agree that it should not be. It should not be there to create a sense of hierarchy. This is why, I believe that you should rotate your managers _within_ the team. Back at my old company, we had people who would go into a Team Lead position for a certain project, and then someone else would take over.

Pay was already high, so no one really wanted to take up lead because it meant more responsibility.

This is how power needs to be treated, you should not have it for too long. This is why we have term limits.
If a person moves to the US on an H1B Visa due to securing a job at a tech company, are those people subjected to this?

I guess put another way, does everyone who moves to the US have to do this, or is it only under some circumstances?
Seems nice. I would subscribe to a feed, but not to a newsletter.
Can you share the name of book ?
I think today's technology does stifle creativity as well, though. Music was meant to be spontaneous and improvised, which is very easy to do with older synths and acoustic instruments. Production in a modern DAW is anything but that, and it's way less tactile.