skysight-inc/HackerNews huggingface dataset:
> It's more than the PM's official salary

I remember going to a party in west London at the time of the MPs' expenses scandal (https://en.wikipedia.org/wiki/United_Kingdom_parliamentary_e... - remember when this was our biggest news?) and listening to people saying things like "well it's no wonder they claim for all this stuff, you can't live in London on 60K" (roughly an MP's salary at the time).

I was just amazed by that - as a member of the shiny technological elite I thought of £60K as a pretty fat wedge. Still do really. I think here, and in Europe generally, software people are usually paid as ordinary office workers who happen to have some useful skill, not as transformative irreplaceable self-governing magicians.

Seeing that this job pays £200K actually makes me wonder for a moment if I shouldn't apply myself. I could do two or maybe three years at that salary and never have to work again.
This is not dis-similar to what Strapi.io does, although I don't think they realize that's a big selling point from their marketing materials.

With strapi you configure your DB and get code generated in JS that supports a standard CRUD REST API. If you want to add business logic, you can override any particular endpoint you want. Their docs even come with the default implementation for easy copy/paste.

I would love to see research in this space continue, I think it's the future of bringing non-technical people into the product development process (if you can understand building a workflow with Excel/Google Sheets/Airtable, you can understand building an API). I'm excited to check out your project.
By raw bulk most JSON is not written by humans, it is an interchange format. Yes of course a human is going to write JSON in snapshot tests. And it is for sure a feature that it is easily written by humans.

Notice I did not mention readability. JSON was always meant to be human-readable; and its popularity is a testament to the rapid turnaround on debugging that the readable aspect of JSON affords. This is, say, in contrast to BSON which is similar but not humanly readable, and unsurprisingly less popular despite its bandwidth advantages.

Config formats are, by raw bulk, generated by humans, and need to be readable (ideally reproducibly across implementations) by computers.
Which comes all the way around to: a VPN sounds like a better option in every respect. More secure, universally supported.

I think the main reason you'd use port knocking is because it's fun and cool.
DuckDuckGo Charitable Donations (2020): $750k to Organizations Worldwide
That's why people do it, no doubt. Keep in mind, a lot of these questions are asked by vastly less desirable companies that ape the hiring practices of FAANG, even though they pay much less. And these companies complain bitterly about a shortage of good developers to hire.

So... I'm all onboard with your statement, but I think you only said half of it. Nobody owes me a job, and if I don't like it, I'm free to not get hired. Nobody owes a company an employee either, and if candidates don't don't like it, the company is free to not hire. Zero sympathy for companies that do this and complain about a shortage of candidates.
Wouldn't it be better to find someone that likes Pringles and take their can when they're done? Buying something you don't enjoy so you can reuse the packaging, that most people throw away, seems like a poor solution.
A large percentage of this food waste is perishable or unwanted stuff in the store. Produce gets ugly and, though it's still usable, nobody picks it over the fresher stuff. Milk gets close to its sell-by date and people pick fresher stuff. Someone overstocks something and a manager pitches it. Something doesn't sell. Some of this can go to food pantries, but a lot just turns into methane in landfills.

As for produce, much perishes en route as well, or is abandoned in the field as unsellable, or reaches the market where produce managers are shopping for their stores and it doesn't sell.

Changing our consumer habits is only going to get us so far. Not that it isn't worth doing, but that 50% figure isn't due to families buying two bags of potato chips and pitching one.
>buy my $100 book on how to make $100
Most programming and IT sayings are grossly misinterpreted. My personal favorite is "premature optimization is the root of all evil," which originally came with a ton of context but today is often misinterpreted as "never worry about performance" resulting in a lot of slow bloated software.
Janky shit will always come back to haunt you.
Pay People to Get Vaccinated
“Life can’t form in the emptiness of space” obviously isn’t a fundamental axiom. I’m not sure why you think I was claiming that. I even caveated with “less likely” with Boltzmann brains in mind — the probability is never exactly zero. And nobody seriously believes that life on Earth started in intergalactic space, meaning outside of the Milky Way entirely. How would it even get here? Even the most exotic theories require some non-trivial density of matter for life to form. Nobody believes life was actually “Boltzmann-brained” into existence from a literal void — those are very distinct levels of implausible, and both are distractions from the issue at hand.

My point is that however specific your arguments are for exactly why life forming in intergalactic void is impossible (or “vastly unlikely” if you want to be pedantic), if you reject the notion that you should only expect to find yourself in places where life is possible (or “not vastly unlikely”), what does it matter? By appealing to the particular reasons why intergalactic space is inhospitable to life, you’re implicitly assuming that the plausibility of life is somehow pertinent to what conditions we should expect to observe in our local environment, given that we exist. That assumption is the anthropic principle.
Making security by obscurity actually work

The reality is security by obscurity CAN work, but only if three critical elements are met:

The first is to know when the obscurity has failed

The second is to be able to quickly change the obscured component (e.g. a password)

The third element is the hardest, security by obscurity only really works if you can survive exposure of the obscured data/system

Which leads to the fourth element: security through obscurity IS NOT security through secrecy (so either I'm a liar or bad at counting, leave your vote in the comments below)

Let's start with the 4th element, obscurity vs secrecy. Passwords. Passwords generally only work if they are secret. Some password systems like Kerberos take great pains to ensure passwords remain secret, for example by NOT sending the password itself to a remote system, but by sending proof that the user has the password (grossly simplified, but generally correct, now you understand Kerberos!). Secrecy involves hiding things that if exposed will be a problem that can't be solved, like your password, the formula to Coca-Cola and so on.

Obscurity won't work for things that need to be secret. Obscurity won't work for things that once exposed result in the game ending.

Even when an item can be obscured, it is still important to know when it is no longer obscured, otherwise you now have an element of your security system that has effectively been breached. For example if you are using randomized port numbers to prevent SSH scanners from constantly trying default username/password combinations and someone (like shodan.io) port scans you and publishes your SSH server ports you either need to change that, or not be relying on that obscurity for your security (e.g. I used to change my SSH port #'s just to reduce logging activity and make it easier to filter/read logs for actually malicious activity).

The second element is that once your obscurity becomes known you need to be able to change it, if you can't change your SSH port # (because you don't have a way to tell clients where it is) then you have a security control that cannot be recovered and you lose it. Security elements should always strive for long term survivability because the simple fact is attackers get to try more than once.

The third and final element (because we started counting at 4!) is your system cannot simply fail because the obscure element was discovered. Using a no standard port for SSH works if you also use strong passwords or (ideally) key based login. Obscuring SSH ports and leaving a default admin:1234 login is brittle, and as evidenced by scanners like shodan.io easily exploited.

I think, honestly, the best use case for "security by obscurity" is to cut down on the noise of logs and casual scanning/scripted hacking, which can be valuable, having less chaff to sort through for actual attacks can both save time and money, but also give you a better chance of finding the real attacks.

https://app.voice.com/post/@kurtseifried/making-security-by-...
Time is money.

If you make about $100 an hour, a six hour coding challenge costs you about $600.

If a potential employer asked you to spend $600 to fly out and see them, on your dime, would you do it?

I would do it IF I desperately needed a job. I did it back during the dot com crash; I needed a job badly and I was willing to roll the dice.

In 2020? Oh hell no. There's a million companies who are hiring, and an employer would have to be exceptionally special for me to waste $600 on the chance they'll hire me.
I wish we spent more time talking about "habitat destruction" instead of "climate change", while understanding that climate change is the largest form of habitat destruction.
Let us go back to the stone age, or else someone might get hurt.
Do you use single-port knocking or a sequence of port-knocks?
>New modelling evidence suggests we can halt and even reverse habitat loss and deforestation if we take urgent conservation action and change the way we produce and consume food.

I'm pessimistic with this claim. From my experience, if a productive process like agriculture becomes more efficient, we scale up output. The resources being used up, in this case land, won't be reduced. For an analogy, consider how adding more lanes to a busy highway ultimately means more people drive and congestion is just as bad.

What we need is more government protection of habitats. But it's hard for a government to directly and explicitly oppose economic opportunities.
There's nothing wrong with population density. We'd do better to have people living in dense city centers instead of sprawled out into every corner of the wilderness.
You misunderstand. People won't discard their iPhones in order to purchase a Fortnite phone without the iPhone apps. It is not feasible to even consider that.
Why would they verify it everytime you run the app? It already goes through heavy review before it comes onto the app store.
Ehh the majority of companies practice security by obscurity as an extra layer.

There's the idea in security that an attacker knowing your algorithm/practices shouldn't mean anything yet you rarely see companies detail the security measures they take on internal systems because we know keeping this secret has no downside.
The article gives a crude statement of the principle as

> The universe is the way it is because if it weren’t, we wouldn’t be here to discuss the issue.

That can't be right. That statement says we are here as a consequence of the way the universe is. It says nothing about causes (of the universe being the way it is).

What's a better statement of the principle?
Crypto Exchange Gets Millions After Copy-Paste of a Rival’s Code
I agree that code challenges aren't ideal. But we've been struggling with parsing resumes and titles to identify the competency of developers. Our current coding challenge isn't super hard and based on the type of code you'd see in our product. It asks you to read a simple javascript function, explain it, and then implement new functionality that can built by refactoring the existing method. It's about 20 lines of code and 50 lines of documentation. You can use any IDE that you like.

We've had many candidates that look strong on paper (3+ years of experience, senior titles, etc) come in and struggle. Struggles ranged from basic code literacy (think for loop to traverse a nested json object) to basic programming like writing a function. We've especially noticed this more with coders coming from purely a javascript and front-end background (React/Angular, etc). They understand control structures like if/else but struggle with loops, setting variables, and basic higher level concepts like breaking a problem into smaller functions.

My philosophy is for junior candidates, any level of competency is ok. Strong mentoring and experience on job usually can allow anyone to thrive and so you can prioritize soft skills and culture. But for more advanced roles, I don't know, it's hard to parse out the quality candidates without having some sort of technical interview. Definitely would love to hear how other's learning and experiences.
That's really great to hear!

We're considering moving to a more in-memory model, as we're not sure if the badger storage idea was a good one and worth it.

TBH we're still not quite sure in what direction we'll be continuing. Though we're surely gonna be developing it further.

But currently we're considering a rewrite with multiple assumptions changed (column oriented).
I think one can be creative about it. Applying the principle "nobody wants to buy a 2 inch drill bit; what they want is a 2 inch round hole", the people in the company do not want to give you a coding test, they want to hire a competent candidate. So convince them you are competent for the job in other ways if you do not want to spend the time doing the coding challenge.

One way of going about about it is to find former colleagues that work for the company you are applying to, and ask them to provide references on your behalf.
You can’t keep looking at everything through the narrow definition of local choice. By that count, no anti trust action was necessary against Microsoft - users were always free to install Netscape. Comcast does not stop users from laying fiber to their home, so what’s wrong with Comcast?

The issue is whether making your own hardware also allows you to set policies on the software that can be run on it. One viewpoint is that these are separate industries and a dominance in one (smartphones) should not allow you to dominate the other (software distribution). There can be a legitimate discussion about what the boundaries are (operating system vs browser apps in case of Microsoft)
Show HN: A compilation of cybersecurity book recommendations from 25 articles
I've looked at recommendations in 25 articles and compiled a list of the most recommended books on cybersecurity sorted by how often they were mentioned.

Hacking Exposed 7 by Stuart McClure

Countdown to Zero Day by Kim Zetter

Ghost in the Wires by Kevin Mitnick

Spam Nation by Brian Krebs

Practical Malware Analysis by Michael Sikorski

Threat Modeling by Adam Shostack

Social Engineering by Christopher Hadnagy

The Hacker Playbook 3 by Peter Kim

The Practice of Network Security Monitoring by Richard
Bejtlich

Dark Territory by Fred Kaplan

The Code Book by Simon Singh

Hacked Again by Scott N. Schober

The Hacker Playbook by Peter Kim

The Art of Invisibility by Kevin Mitnick

The Art of Deception by Kevin Mitnick

See the full list at https://www.readthistwice.com/lists/best-cybersecurity-books
Apple owns the platform. I'm still going to try and change how they do business because that would be better for me. Everyone is allowed to do that and there's nothing wrong with it. If you want to give up your power as a person to try to affect change, that's cool but I'm not giving up any non-immoral tool I have.
The probationary period seems incredibly stressful for the employee. If I am currently employed I would never switch to a role that uses a probationary period as a significant evaluation step because of the risks of leaving my stable employment, and not passing your probationary period. As an employer I wouldn’t want to limit my selection to people that either are unemployed or have a higher personal risk tolerance to handle such situations.
Man I just want to have control over my phone is that too much to ask?
I find it notable how indirect the author is about the “Why” in this story:

> New modelling evidence suggests we can halt and even reverse habitat loss and deforestation if we take urgent conservation action and change the way we produce and consume food.

> The British TV presenter and naturalist Sir David Attenborough said the Anthropocene, the geological age during which human activity has come to the fore, could be the moment we achieve a balance with the natural world and become stewards of our planet.
Thanks a lot for that link. I just browsed throug a few stations in Siberia located hundreds of kilometers away from anything and it is quite an experience to imagine these places through a radio.
> It doesn't make much of a difference if Sun, the authors of the language, or Sun, the authors of the runtime, is screwing me.

But it matters for me, the programmer using modules written by other co-workers and third party libraries, that I'm made aware of what can fail and at what point, when I'm using these modules/libraries. It also matters to me that my tools (e.g. the compiler) force me to handle these cases correctly, or at least warn me when I'm not - lest I ship broken code through carelessness or ignorance.

Quality Sun's API design is a different issue. This is about giving people tools to express and enforce error handling semantics in software they design.

EDIT:

> Edit: OK, someone is downvoting because opinions. No more comments by me.

It's good to not be attached to imaginary Internet points. They come and go and ultimately don't matter much. And FWIW, bad downvotes often get countered, and the score of a given comment settles to something reasonable over time.
The difference is the interviewer is being paid for their time, the interviewee is not.
Apple isn't the end all for privacy at all. Use Linux devices in which you have 100% control over every aspect, not proprietary black boxes which still track you.
That was actually the same thing Reddit did, IIRC. Have a bunch of different accounts and post interesting stuff.

Nobody wants to join a barren community.

That's also why clubs and other social gathering places entice people with free drinks, VIP passes and get some cliques to be in early, to generate movement.
SetTimeout with a Shorter Delay (2010)
If the exceptions thrown by your code aren't part of the interface, then pretty much nothing is. That means strong typing is actually Java's biggest mistake.

This isn't to say that checked exceptions are always used well. (What exactly am I supposed to do about an exception from .close()?)
> what is bad exactly

The phrase you quoted says exactly what.

> and why

The next paragraph I wrote explains why.
> Distribution in the sense of distributed computing, not in the sense of giving somebody else binaries to run. That is not something erlang is good at. But you can rather easily join nodes together and not just have them communicate but have them leverage one another e.g. spawn processes on an other node in the cluster.

Ah, I misunderstood, sorry. Personally, I see limited benefits to making things fully distributed at the runtime level. I'm sure it's nice sometimes.

> Go is a shared-memory concurrency language, with no restrictions on the sharing.

Sharing is the critical word there. You don't have to give access to that shared memory to anything, but the point I was making is that nothing can take shared access to your stuff without you handing it to them. It's not the wild west of interpreted languages where any piece of code can access all of your code and variables and edit them just for fun without you realizing.

Go also supports channels. How you design your system is up to you, and doesn't BEAM also support shared memory concurrency? A little thing called ETS? I would guess that there are other escape hatches as well, but I'm not familiar enough with Erlang or the BEAM to say for sure.

If you want to make a poorly designed system, I'm sure that Erlang won't stop you, but it will obviously try to guide you into certain accepted patterns by making other things harder.
I'm happy finding a mixture of medicine that seems to work for me and has been for a couple years now. It took me over 20 years to get to this point though. Most of this time was just me actually realizing a problem then taking a couple years to actually find a decent doctor.

The problem seems to be that we don't really understand enough about how to brain works and how these medication work with the brain. So many psych meds are like "we don't really know how this works, but we think it might do this".

I think that's why there so much trial and error with psych meds. Plus don't get me wrong, the wrong med can be devastating to certain people. I ended up in the ER a during my trials due to bad reactions.

I still try to exercise and watch my diet. I don't have any studies or anything but low carb seems to keep me more mentally stable.
This is one of the reasons why I've started to call a good layer of concealment and deception on top of a hard system OPSEC rather than obscurity. It's a less ambiguous term and probably more accurate.

For example, I have no trouble revealing that all our SSHDs at work are ssh-keys only with a strong key policy and periodic reviews, whitelisted accounts, most are firewalled to be VPN only, configs are hardened periodically, some are 2FA secured. All in all, those are good or best practices to follow in order to harden an sshd, so I'm losing little info there.

A pentester under NDA would get more info to be effective, like the whitelists, might get IP whitelisted even. Security audits during pre-sales might some other additional info.

However some details and measures don't need to be known outside our operations team. But they can and have been a royal pain to visitors.
>Most people experience this from time to time.

If you're unlucky enough to be at the tail end of the distribution where basic tasks make you feel this way every day it's no longer called an 'Ugh Field' instead it's called the "Wall of Awful"

https://youtu.be/Uo08uS904Rg

One of the absolute best techniques I've found for breaking it is a trick I learned from DBT called "Improve the moment" where you simply think about what pleasant sensory experience could you introduce right now to make you feel better and then you do that quickly. I find if I put on a song or smell the lemon scented dishwashing liquid or run my hand under warm water it helps me to get moving on a task. It's not fool proof but it's a good tool to have in the toolbox.
The subsection this falls under is "Unacceptable" as in "Will not be accepted". The "should" in the sentence is a normative statement about values, not recommendational.
Sorry, there are no viable linux mobile devices for regular folks. When one arrives I'll purchase.