skysight-inc/HackerNews huggingface dataset:
> You can never, ever write a static type that enforces anything of substance, because for that to happen you’d need to execute arbitrary code within the compiler (as happens with dependent types, and of course there is the constant fear of undecidable or infinite type checking in that system).

Static types are a tool. You can use that tool well, or poorly. There are applications that tool plain doesn't fit.

But it is absolutely the case that it can be an important part of enforcing things "of substance" from a very real engineering standpoint (whatever you think of them theoretically).

My go-to example from my own experience: I was working on an experimental C project in an environment that demanded minimum latency at low-to-moderate throughput on (expensive) commodity hardware.

Our approach was to pin individual threads, dedicated to their task, on individual processors which were otherwise unused.

Some functions could only be called on certain threads, usually because some resources could only be accessed from specific threads to avoid locking. Providing an additional argument that labelled the thread let us catch when a change in requirements (which is inevitable when the goal is experimentation) meant logic in the hot path could now be moved somewhere else or what have you.

Testing might have turned up race conditions; running them down would likely have been substantial effort. The type system told me "you're calling foo on the wrong thread on line 1234, dummy" and it told me that quickly.

None of this is to say we shouldn't be testing - indeed, over the course of the project testing caught a handful of deadlocks the types (at least, those types) couldn't prevent. But the types were invaluable.
It is obviously a misinterpretation of the original idea behind "security by obscurity is bad". Same goes for "goto considered harmful", which is not always true.

Although, Kerckhoffs's principle are a good way of describing how a secure cryptosystem should behave. This is what people should have in mind.

Obscuring will just add some delay as you state, but it might be irrelevant in many situations.
Yeah of course this is a typo. I've fixed. (But I appreciate the other commenters trying to interpret this in a way that makes sense.)
I would not. I've experimented with it enough to know that I am much more comfortable executing with flask, rails, or dotnet. As a manager, I would dread trying to find engineers (I'm not in SV/SF), and I definitely would not want to build a product where everyone was learning the language/framework as we went (and everyone is thinking "re-write" before the first year has passed).

As others have said, if you're building a business, use what you know. Use what you can execute on the fastest, with the fewest unknowns, and with the most confidence.
That is the reason why some countries represent not only themselves but also other countries. When I remember right, Sweden proxies dozen countries in North Korea.
It would at least be far less of an issue. I don't see anyone being confused that https://github.com/facebook/react is the official repo, and not https://github.com/react/react. It's the fact that a collapsed name is a shortcut that imbues it with this special stature. And i believe maven central doesn't even allow one-segment group names for new libraries, though clojars obviously does.
You're right (and I say so in the About section), it is based on the Sedona Method. I found the method to be quite tedious to do on paper and I couldn't focus long enough to do it in my head, which was the original reason I built the app.

However, the app works for people who don't know the method, haven't read the book, didn't watch the full DVD from 1992 and didn't attend the weeklong seminar. I think it could bring this to a much wider audience.

Thanks for the bug report, yes, there's a lot more I need to fix in it before hitting the big leagues.

I haven't considered open sourcing it because I want to make a living off it. But I will think about it. There's a more limited version, without narration or the deeper content, that I use for myself and I think I might open source that.
Preface: May be biased, as I run a honeypot company.

To your question: absolutely. They are also a very economically effective and (done right) an easy-to-implement solution with very low-to-none risk of jeopardizing any legitimate traffic.

To your why not do this - we are working on this right now. There's a lot of interest to what you described in above average maturity security teams; we have a few customers in this niche helping us design the "attacker playpen." You are right in that it is a challenge to make believeable enough without introducing risk into the environment.
Yes. This kindly-worded "Our way or the highway" is a hallmark: "If the App Store model and guidelines are not best for your app or business idea that’s okay, we provide Safari for a great web experience too."
Platforms need to be regulated and not with the anti-trust laws created to deal with industries before software even existed.

We need a new Sherman or Clayton act specifically for platforms. You can split them out, social media platforms over X users are regulated in this way. Marketplaces over x users are regulated in this way.

We cannot rely on platform owners to update policy in response to mounting public pressure. Because you get things like this - rules on Apple's platform that won't be applied to significant platforms, just the developers who are too small to have any influence.
> Devolving identity down to DNS has been a really good decision for Go

If it works for go, the because go is not old enough. Domain registrations lapse quickly and then someone else can buy them. That's very close to the worst that can happen for trust in packages.
Force is the key word for me. It's the "we know better than you" language designer mindset. My point is that if they really knew better, they wouldn't be making this anti-usability calls.
Oh, and another thing, so I'm making another comment.

> Input Elimination: Often by using - we find that a column is unnecessary

I've found this to be true in many cases. However, efficiently calculating a potential "input elimination" has eluded me.

I've done research into various relational-database techniques. I've looked at binary decision diagrams (or their relational multi-valued counterparts: Multi-Valued Decision Diagrams). Etc. etc.

It is "obvious" that minimizing columns and removing unnecessary columns can grossly improve performance. But I can't find any efficient algorithm that detects this case.

Lets say we have Table ABCD (with 4 columns: ABCD). To test if Column C can be eliminated, I came up with:

ABD = (Select a, b, d from TableABCD where C = true)
ABD2 = (Select a, b, d from TableABCD where C = false)
If ABD == ABD2, then C is redundant.

That's for binary variables. If C has multiple values, then you have to do this for every value C could have.

-------

This seems inefficient to me. Especially if I'm checking every column to see if they're redundant. (Repeat the above process for A, B, and D). I feel like there has to be some kind of dynamic-programming magic (or even Greedy-algorithm) that can figure out the redundant columns all simultaneously. I just don't feel like coming up with the algorithm.

I can't believe that I'm the first one to investigate this problem. But I don't know the "magic word" for this to search on. I don't even know how to search the internet for this algorithm, even though I know its important. If anyone knows the most efficient solution, please let me know :-)
Previous discussion: https://news.ycombinator.com/item?id=17915560
I don't believe it's an easily changeable tunable with a config flag or sysctl setting, no. You could of course modify the kernel source code, but there's probably lots of unintended side effects to this - your setting is alright for most Linux distros, but what if someone picked one that overlapped with ephemeral port ranges? Or if you're running software that the commonly used port binds to something under 16382 but above 1024 - now you have to reconfigure it, or set up temporary privilege escalation so it can bind to it before going back down, a la httpd.

It's also a bit of a contract with the client - on Linux something below 1024 is ALWAYS privileged so you know you're not connecting to a fake sshd and giving away your password or current 2FA token unless that system has been totally owned. If you modify the kernel you're modifying that contract - are you sure that this system has modified kernel?

That's really my issue with this whole idea (and one of my top level comments goes into this in more depth) - but there's a lot of unintended side effects from these obscurity changes that people don't know about or think about.

Meanwhile there's lots of well understood practices that provide real security that solve both the issue of noisy low effort attacks while also providing real security against determined attackers. VPNs and jumphosts - why should SSH be internet accessible in the first place? Use key based auth, as well as 2FA.

Port knocking is... interesting... in theory, but it increases complexity for the users at a similar level of requiring them to use a VPN or jumphost (or both), but has additional flaws that they don't have - if they have access to sniff your traffic via some means, they can figure out the sequence and now they have completely removed it as a layer of security. They don't even need to be able to decrypt the traffic - just see the destination ports.

Is this level of attack something most of us have to worry about? No. But if for similar levels of effort we can get better security, why would we go for the weaker form, even if it's unlikely we need more? If for some reason you do have a dedicated attacker, you're better prepared. You can also extend it to provide even more security - lock down SSH to all of your production hosts to only the jumpbox(es). Alarm on any attempt production host to production host SSH attempts. Easily audit ingress SSH access on a subset of hosts. etc.
> Obscurity is bad because it makes you _think_ it adds security.

I agree with the OP, but I also fully agree with this point. I've seen people download the fishiest stuff or open anything because "I have an antivirus installed". Now, I don't claim that no AV would be better in all cases, but it is very much a factor.
I realy like your tool. In fact I am slowly integrating it into a solution which will expose a REST API and workspaces identified by a UUID. In our organisation it is so common to receive an Excel or csv which you have to join with the database. Octosql is great for that.

I am wondering what future role badger will play in the future? It would also make a great additional KV backend btw.
Apple should just be forced to allow alternative app stores.

Yes, they will loose out on money and yes, this will dilute the iPhone experience.

But come on - That company is worth 2 trillion and it’s holding a whole economy hostage.
The word "innovative" is still in common usage but for a while it was sprinkled into every product description and every conversation with developers when they described their product or service.

Today, "innovate" has lost some of it's sheen and passed into the pantheon of generic, meaningless words. Everyone uses it unthinkingly regardless of whether they believe in it or not (the word "inuitive" is another example).

There was a time once when it was for other people to hail or judge a product as "innovate" - rather than today when you proclaim your product as "innovate".
Moving to plastic significantly reduced the cost of transportation and the resulting CO2 emissions (but increased CO2 through production of plastic - net?).

Better to haul a trailer full of coke that 98% product and 2% plastic than one that’s 90% product and 10% glass.
There are two kinds of exceptions: (1) those that can (and should) be handled in a meaningful way, and (2) those there's no way to handle and you should just crash.

A big part of the reason people hate checked exceptions is that actually doing #1 correctly is really damn hard. It's a whole separate dimension of complexity that your design needs to tackle.

A compiler that checks exceptions forces you to do it. Abruptly, if you're new to the language. It flips the floodlights on at full brightness and makes you see the full scope of the problem. It's tempting to shoot the messenger.
Which is where the featured article is relevant
They may have meant mobile marketplaces before AppStore. Those charged anywhere up to 90%.

And retail doesn't charge "0%" on boxed products, or they would go out of business. Logistics, distribution, and store markup all add up to the final price of the product on the shelf.
Agreed, although on top of that there is usually an informal power structure within the formal one of the management hierarchy based on who is favored by those above them at a given time.
There's also this magic function:

private static <T extends Throwable> T sneakyThrow(Throwable ex) throws T {
throw (T) ex;
}

Due to generic type erasure, the entire throw clause gets erased so it looks like this method doesn't throw anything.
> Separation of minor and patch versions doesn't make sense.

Yes, it does.

> Both in the case of a minor or patch version change the client should be able to upgrade to the latest version.

Yes, but if it's a minor version change then, as a developer, I also want to review the changelog for new features I should consider whether we should add backlog items for refactoring to take advantage of, while a patch doesn't create that need. There is more space for SemVer-aware tooling than “is this safe to update”, though that's obviously the most important single piece of information.

> The real reason for minor and patch versions is that libraries actually don't follow semver, and patch version change means 'small change, don't worry about re-testing'

No, you always worry about retesting because SemVer is a statement of API intent, but does not include a guarantee against bugs, including new or modified bugs.
Deep following Makani Power, LLC:
http://www.energykitesystems.net/AirborneWindEnergy/MakaniPo...
As a former London based FAANG employee my experience is that base salary might be that for a relatively junior engineer, but a mid-level with 5-8 years experience would make around £150-200k total comp (base, bonus, stock, benefits). 10-15 years experience is £250-400k++ total comp range
On its face it’s clearly harder, just because now you need three parties to sign a new loan agreement. It could be made much easier if the loan is assignable under same terms, especially if parts of the loan are assignable for proportionate parts of the shares.

And if the benefits are significant, I would bet this creates a whole tertiary layer of brokers, bankers and lawyers enabling these kind of transactions with standardized loan agreements and clearing houses.
Fond memories of lugging a 4.77MHZ Compaq "laptop" [0] to and from Paris to hook a Prestel game up to Minitel via X25.

Which fits the mindset as you say, since the game was priced per-unit time and BT were coining it in on the UK side (this wasl still a few years pre-eternal September).

[0] Plasma screen, 1 16-bit ISA expansion slot and 1 8-bit, built in PSU.
> That doesn't change the fact that Java's checked exceptions are bad

You keep saying that but without justifying it.

Let's start from the beginning: what is bad exactly, and why:

- Checked exceptions in general

- Java's implementation of checked exceptions

- Or the way some Java API's use checked exceptions

?
Wait till you learn how much Apple charges for app promotion -- which the 30% cut has nothing to do with. App promotion is a $500 million to $2 billion dollar industry for Apple.
And the reason there was a sale on Into the Breach on GoG is that it was free on EGS last week. This is a direct result of competition.
The language isn't forcing you. The developer who chose to use a checked exception is forcing you.

Is the language "forcing" you when someone writes a function that returns a String? What if I wanted it to be an Int?
They allow third party stores though, and even installation without any store at all. Apple devices OTOH are severely limited regarding sideloading. This leads to Apple capturing a much larger percentage of transactions pertaining software for their devices.
eavesdropping, maybe. There are tools like https://github.com/mrash/fwknop that are not vulnerable to that or brute-forcing.

But brute forcing in general? not a chance. There are 18446744073709551616 4 port sequences.
Fair point! Obscurity as confusion is not what I had in mind, but your points on confusion are totally valid. Your analogy with predators works better here.

Using base64 encoding, or encrypting your database, are both examples in the article. While I agree base64 is super trivial, the point about either of these is defence in depth. In the language of the article, it's reducing likelihood of being compromised.

>If an attacker sees that your SSH port isn't where it's supposed to be OR if an attacker sees that your SSH port ignores all packets sent to it (unless you first send a packet thats 25 0xFF bytes), then either way they're being signaled that you are more trouble than the computer that has an open telnet port.

This is semantics. Personally I'd say if an attacker cannot sense anything to connect to, there is no "signal" you're sending. You're rather not sending a signal that you're a threat, as you're not sending a signal at all due to being functionally invisible. Otherwise, we could say literal nothingness is sending the same signal that your server is. We agree on the substance here, i.e. the obscurity increases the economic cost of hacking and works as a disincentive, so we may just agree to disagree on the semantics.
I’d recommend Doom Emacs over Spacemacs for a few reasons: Spacemacs tries to be everything-for-everyone and it is far too dense for someone trying to learn Emacs. Evil-mode is its “killer feature” but that’s available without Spacemacs. Doom Emacs is more like Vanilla Emacs with an obvious lean towards evil-mode. It comes with sensible defaults and loads up so much faster than Spacemacs does.
> Retail used to buy boxed software and sell it at risk.

I though they just returned unsold boxes back to the vendor?
I'm not saying latex is exemplary in all forms. (I would also like to know if the big browsers render all web pages as accessible PDFs, though).

I simply meant that a plain html document + the browser leaves much to be desired for even non-technical documents.

Tbh, I would like to see a more advanced and open html-based ecosystem for documents. Latex has many watts, but also a lot of features.
I disagree. This is an annoying compromise for something that doesn't need compromising. My phone's home screen is cluttered enough as it is and now I'll need separate apps for all the games in my Xbox library and those on Game Pass? I'll also need to download a redundant amount of code for each game and may not be able to play certain games due to Apple's arbitrary rulings? I'll have to dig through hundreds of games on Microsoft's developer page just to peruse through Microsoft's non-gaming apps to stumble upon something like Family Safety or Math Solver?

This sounds like a huge pain in the butt for users and kind of loses some of the value proposition of game streaming: trying games instantly, not needing to download anything, and not taking up a bunch of space for your whole library.
Apple does just the distribution. The promotion is still on the developer and you may not even promote your own services in your own app. It is also save to say that a lot of developers would like to do the selling themselves. Apple is not supposed to do the distribution for free, but 30% is really a lot, especially when they do unwanted stuff for you (the payment).

Also the App Store really is the only way to get apps on an iOS-device, so the user has no real choice anyway.
There's nothing "secret". Everybody can roll their own payment in the web. They cannot advertise alternative payment methods in the app.

See Spotify as an example.
I don’t have time for coding challenges
> If I were running this, I would take a radical approach, where the strategy would be a venture model that micro-funded projects to create useful products that solved for providing future services and applications, and not legacy ones.

The above is more similar to some ideas being floated about in various halls of government than you might think. That of course doesn't mean it will happen, given the quirks of government.

> While I am not qualified for this job, with a long enough lever, I have no doubt I could move the whole thing.

I think your above insight and actually addressing some of the real issues and opportunities shows you are (technically-speaking) well-qualified for the job. Better than a lot of candidates, and better than anyone else that will take up the post.

The fiefdoms in central government are very real, but there's a value to the people who are able to navigate these, use rivalries to good effect, and achieve the desired outcome by pitching everyone off against each other correctly. Of course very different in a "CDO" role than as an outside consultant coming in with a scoped brief of what needs achieved and which eggs are able to be cracked in the process.

The sad part is that the whole system is such that you'll probably not want to apply for the role, due to the highly politicised nature of most senior appointments - you need to implement what an elected minister wants, even if it doesn't make technical sense. The civil servants who are happy to project-manage the blockchain-backed AI-enabled boondoggle (that lacks a ledger and any form of ML) are the ones that survive.
HTML form to jam the search string into a format like below (:

https://duckduckgo.com/?q=site%3Ayour-site.tld+the+user+search+string
I would add that all atrocities depend on unreasonable people. Reasonable people keep the world running smoothly.
Sure but by that logic no two jobs can ever be compared to each other. Someone can always say because I am comfortable doing X than Y, thats not something anyone can respond to.
The same with "GnuPG is bad" mantra on hackernews. There is nothing better that GPG currently for all its functionality and the only answer you get when asking for substitute is don't use this function or use some obscure application. Yeah right.
I'm soooooo excited about this.

Question: how does performance compare to HiPE. I see reference to improvements over the Interpreter but what about performance vs HiPE?
Hey, I think, what you need to do is go meta. Think about the way you think. If your brain know when to use an interface or an abstract class, then the next time when you make a decision like that, spare a few moments to think about why. You might not get an answer but you will get hints. If you do this enough times, you will understand why you decided to do what you did. Thus you will will what's the difference between an interface and an abstract class.

I hope what I said makes sense. Try not to feel frustrated. Frustration never helps.
I'm not hurt at all by this comment and it's true. I didn't create the app in the depths of my most intense depression episode (two months in bed, couldn't even get myself to watch a TV show). Medication helped me out of that. I've also actively working on methods to improve myself for about a decade and by the time I started working on the app about two years ago I was mostly stable with occasional bouts of depression and rage that lasted for a few days to a week.

The first version of the app took a couple of weeks to build and I was flying on a good streak at that point, but it's prevented me from spiraling down ever since.

I don't know if the app could have helped me in my deepest depressive state. I don't know if it can help other people in even deeper states. I think it might.