skysight-inc/HackerNews huggingface dataset:
I don't believe so, no.

You can set panics to automatically abort, though. But that's opt-in.

The real point is that panics are absolutely unchecked exceptions, but it's really awkward to catch them and the standard library and entire Rust ecosystem has a good, solid, culture around returning Results whenever reasonable.

The problem with Java is that a bunch of people have no idea what they are "supposed" to do with the unhappy path parts of their programs.
I'm guess because VPN's and SSH became so ubiquitous? Having a single point of entry, especially when combined with 2FA, is probably good enough for most situations.
"Come for the tool, Stay for the network"
In DC there is this concept of "the blob" which is basically shorthand for "The Washington consensus that isn't verifiable, but that most people parrot since to hold an opposing view doesn't really get you anything because even if you're right, nobody will remember. All that they'll remember is that you're that weird guy that looks at stuff with a strange perspective and that you may be too dense to social signal that you're in the blob."

I've noticed the same thing with software developers.

- "Client side encryption in JavaScript is useless!" Until CloudBleed came out and the only company that was safe was a password manager that used it. To thwart client side encryption you need to actually modify the contents of the JS payload, which is detectable. But no matter how much evidence I give that this tactic works and is actually used in production and that it actually stops attacks, programmers just don't care.

- "Don't do security by obscurity!" But then we all implement passwords (which is just security by obscurity) and the best people in intelligence don't have LinkedIn accounts. Anyone can join an OSINT forum and see the actual tools that get used. Security by obscurity works for many, many actors.

There are many, many little bits of stuff like this. Think to yourself: How many times has code that you've written lead to an RCE vuln that was exploited. Personally, I can only give a lower bound, and that lower bound is zero because I'm extremely careful, but I don't pretend that it's never happened. Anyone that is familiar with data science or economics or political economy understands that when a signal is dampened the response is dampened.
Are you saying there are known impracticalities, vulnerabilities or serious reliability issues with Arduino hardware? If so, what are they?
In case anyone else is confused at first, I'm assuming you meant

s/Red Worm/Code Red/g
The joke doesn’t land though, because hot running water affects septic systems, sterilization, and many other public health concerns that easily make it considerable as a public utility.

Online banking or smartphone public transit passes aren’t just luxuries, they are extreme luxuries.

For example, I don’t have any banking apps on my phone and I get mailed a paper subway pass every month. Same for millions of others.

No banking app is owed a slot in an app store, and no consumer is owed an app based workflow. Those are just products in a marketplace, nowhere remotely close to the concept of public utilities.
Ultimately if governments (such as Australia, US) continue to prevent citizens from using encryption, we will have no choice but to employ security-by-obscurity atop secure-by-design principles to have privacy.

For example, making ciphertext look like cleartext[1], or hiding text in images[2].

1. https://steganography.live/

2. https://github.com/DimitarPetrov/stegify
Peter Thiel Met with the Racist Fringe as He Went All in on Trump
Ask HN: I'm a terrible developer, what now?
I've been programming for a while purely as a hobbyist for many years and as a professional for less. I've come to realize I'm not very good at it and thats unlikely to change. I have basically no CS knowledge and am not even really that great with the "practical" stuff despite having been at it for so long. There's not a single language I'd consider myself good with, maybe one or two I can write and maybe one I'm ok with. I can read most code and I suppose consider myself well read when it comes to tech in general, in that I have very surface level familiarity with all sorts of things many most people have never heard of, although I must stress the "surface level" part. Its good for temporarily sounding smart or experienced, but most of that however is unfortunately useless. I can recall my last interview tripping up on questions about very basic OOP concepts, which you'd think I'd have internalized now and there's no way in hell I'd make it past a phone screen for your average whiteboarding company. I know many people much less experienced or even relatively new who are significantly better at this. I suppose that some people are simply more intelligent or at least more inclined to the proper skills than myslef, which isnt neccesarily good or bad, more of just a fact. I also suppose that I'm an ok "hacker" in that I can get very interested / fixated on certain problems, although my solution is more likely to be a complete mess.

Main problem is I'm not sure what quite to do about it. I'm not sure this is a "try harder" type solution, as I've been at it much too long for brute forcing to be realistic, but most of the alternatives seem dreadful. Not sure what options I have given my strengths and weaknesses.
Obscurity has been used for detection of bots engaged in profitable ad fraud, by having web clients execute a JS payload whose behavior can be profiled. Temporary payload obscurity enables a silent alarm, which can be used to stop financial payouts.

Unlike many approaches to cybercrime defense, obscurity-enhanced bot detection has lead to both prosecution and extradition of accused attackers, https://www.cyberscoop.com/tag/methbot/

White Ops technical talk at PSEC18, https://youtube.com/watch?v=Aqdn09myGlM
There is a reason the military doesn't paint their tanks bright pink... Armor is important, but if you don't get shot at in the first place, even better.
Shared common interest. If you're building it for one community segment, odds are that you have connections that would find use in engaging with that community. So I'd start sharing with the ones who don't mind starting the community from nothing.

Like if it's a community about a type of car, you'll want some initial owners or prospective owners (if it hasn't released yet). Maybe some DIY guides for basic maintenance, news section for OEM and aftermarket releases, etc.

This way newer visitors find already-established and useful content and stick around to discuss and add to it.
Years ago I just set up some filters. There's only about 5-10 email addresses that get hammered with SPAM.

Gmail handles the rest.
9/11 tragedy pager intercepts. (2009)
It's not clear why any of the advantages they tout occur because of the lack of namespaces.
Nineteen Is When They Forgot
It's generally more convoluted than the equivalent alternatives, with less features. You need a shared secret - you could use totp - or you could use vpn/ssh with key based auth - both offer authentication of/to both sides and encryption/confidentiality.

Blocking all icmp traffic breaks tcp - so true "invisibility" isn't that grät either.
So you're saying the hate comes from Arduino being the Wordpress of embedded design?
But they did make their projections public.

"VICE PRES. DICK CHENEY: My belief is we will, in fact, be greeted as liberators."

http://www.nbcnews.com/id/3080244/ns/meet_the_press/t/transc...
Erlang is the Actors-model version of Greenspun's tenth rule of programming:

"Any sufficiently complicated server backend contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Erlang."

Is it really the end-all-be-all model of server architecture? What are microservices, if not Actors Clunkified? "Serverless" functions, if not the simplest actors in disguise? Docker, actors except over IP addresses and clunky APIs?

The real takeaway: Valuable stuff is stateful. You know you're doing valuable work for a real human end-user if you are dealing with tricky state problems. Extracting money out of that is a bunch of developer-productivity-limited business concerns. It seems actors are a good model to solve that.
I don't see any distortion of the point. All I'm saying is that the fact that something has been criticized in the past does not (necessarily) equate to justification for a position of "it's not highly regarded".
staticman[0] for comments is a neat solution that avoids those surveillance companies. it can use heroku hobby tier for processing and github as the content backend for a free, hosted comments solution for static sites (fully acknowledging that heroku and github are both owned by other surveillers).

[0]: https://github.com/eduardoboucas/staticman
Doesn’t erlang have a REPL, allows you to do live deployments. Individual processes crashing doesn’t bring everything down, you can tell it how to handle those. Dynamic typing. Functional programming. Concise syntax, with “let it fail” mentality.
I don't use any of the Rust error helpers. I don't mind a bit of boilerplate.

I don't hate Java's checked exceptions. But I also actually craft my own Exception types when I write a Java package. I think that's the biggest mistake that devs make. In Rust you have to combine errors into composite error types. In Java you should do that.
Intentional obscurity needs to be identified as such so maintainers know what follows isn't actual security.

Obscurity also clouds maintainability, often making things difficult to diagnose and debug.
>However, if you can reduce the risk with zero cost, you should do that.

Zero cost is rarely, rarely true with regards to operations. If you use non-standard ports, you'll have to document that somewhere, or else it becomes tribal knowledge.

If you don't document it, and someone leaves, how do you know how to access your servers? At the very moment you don't know how to SSH in, you've just paid the price. It's no longer zero cost.

If you do document it, you must now take the time to manage the permissions to that document, figure out who needs to know, and then change access as people come and go. All of that requires time, which also has a cost.

Plus all of this also has training costs when you onboard new people.

Zero cost is a real thing with computer science but not operations.
>Forks are inevitable; why would you want to discourage them?

The epitome of this mindset I think is "hostile fork" -- the entire notion is nonsensical. The whole point of being FOSS/OSS is the freedom to fork -- by all damn rights, you should fork as you please, and be pleased to fork!

The actual problem is not forking.. its community fragmentation, and more importantly loss of a "source of truth". Of course, maintaining that source of truth is otherwise known as centralization, with all the problems that brings, but there's nothing inherently wrong with forking.. that's just the natural specialization and evolutionary processes at work.

The solution is to make it easier to find those top-tier libraries, and this is orthogonal to forking; mainly handled by blog posts and "official" library listings/recommendations, and things like This Week in Rust.... namespacing or not doesn't really get you anything there.
> Is there a better answer to “Why am I not in intergalactic space right now?” than “life can’t form in the emptiness of space”?

Putting aside a) the fact that there are a few people who suspect that life did (or could) start in the emptiness of space, b) the possibility of Boltzmann Brains, and c) that in your original post, you claimed that "there are plenty of mundane coincidences that have no other answer [than the anthropic principle]" [my emphasis], there are better arguments for why we do not find ourselves in the emptiness of intergalactic space, based on what we know of the complexity of both our bodies and of the biological environment they require to sustain them, what it took for all this to evolve, and the thermodynamic improbability of such assemblages forming in intergalactic space.

This is a better answer because, instead of taking “life can’t form in the emptiness of space” as an axiom, it explains why in terms of more general principles.

In fact, without some sort of explanation, your claim that “life can’t form in the emptiness of space” would be a speculative non-answer (ironically, the rest of your comment here is a demonstration of what I am saying: you are using these better explanations to justify this claim!)

Similarly, the precise value of the fine structure constant (and even that there is such a thing) would not even be recognized as an issue if it were not for our understanding of how much is dependent on it. Clearly, we did not, and could not have, reached that level of understanding by invoking the anthropic principle in response to all the "why is...?" questions that came up along the way (for example, "Why do the chemical elements have the properties that allow life to form from them?" "Because if they did not, we would not be here.")

It is only when we reach the end of our current ability to explain that the anthropic principle is invoked.
Well kind in the theme of port knocking Postfix has a Grey Listing option which kind of works like that for spam though not the same thing.
And my point was why (ie. what real quantifiable reason) shouldn't they?
Looks promising, thanks for sharing.

For those looking for typed alternatives, I have enjoyed writing browser extensions in scalajs, and ended up building a template to get started easily on it: https://github.com/AlexITC/chrome-scalajs-template
Pretty awesome. He had a binary keyboard, one button on each handlebar, and could type at 35 WPM using it. Impressive! I wonder if there is a market for that now, so people could text while biking. Or driving?

https://microship.com/on-the-loose-in-dataspace/
I've found checked exceptions pretty useful. I can pass context-specific details to the exception and encapsulate the message formatting to the exception itself (helps if I'm throwing that in multiple places). They also allow me to decide the http return code based on the exception. E.g. using Spring Boot's controller advise, I can map a group of exceptions to be user errors (say, bad request) and another group to be service errors (say, internal server error) etc and don't have to worry about where the exception is being thrown from - it'll return all the details with correct return code to the user.
I posted this because around 2003 I spent a significant amount of time tracking it down. So I saved it, so that I wouldn't lose it, and so if I ever got around to writing an article about the message, I would have it handy and easy to find. This is important, because when I finally got around to writing the articles, twelve years later, I found it where I had left it.

When I save something that I had trouble finding, I often try to save it in a place that other people will be able to find it, so save trouble for the next person. I don't remember where I found the paper the first time around, and I don't know if that location still exists. But stuff I throw into plover.com/~mjd/misc is (so far) available forever. There are files there that haven't been modified since 1994.
Currently experiencing the exact same thing. Roughly 15 machine learning engineers through hiring and acquisitions and all of them have no product or management power. Everyone with any management or product power has zero ML/Data Science experience. I spend half my day explaining to managers what ML is.
You'd do better to take arguments at their merits than resort to ad hominem attacks.

To your point: Yes, Ghost is much more than Hugo / Jekyll will ever be, but then again, most people aren't building a News site to actually want the features Ghost has to offer.

I mean, there's absolutely a market for software like Ghost and WordPress (or they wouldn't exist, especially in WordPress' case they absolutely dominate that market), but if you're the kind to run Ghost with SQLite then may be you should instead give static site generators a look.
Wayak – Social Dream Builder
Hello Everyone,

Description:
Wayak is a mobile app that helps you never lose sight of how far you've come by letting you build timelines of how your thoughts/dreams/ideas come to life.

Why:
We believe that purpose in life is found by mastering the art of turning your thoughts and dreams into the reality around us.
We are building this app as a way to help people have a way to post updates on what they are doing, share experiments they try out for their hobbies, share inspiration, ideas and over time have built a timeline that shows them how far they have come.
We did some research on motivation and found that people struggled to see their own progress, they failed to see the evolution and growth of what they are doing, which is why we built this.
Any feedback anyone could provide would be of huge help so we can shape this platform be home for those who enjoy improving on their craft and want a more calm, supportive, helpful place to share their experiences.

Thank you and I hope this can help someone here!
No idea why you're being downvoted but this is 100% factually correct in the US: you'll get sued by a company that has a very salaried legal team.

Even if Zoom is in the wrong/has no case, all it takes to "win" in the US is enough of a bankroll to troll someone via the legal system. It's pay-to-play here and Zoom likely has the budget to run an independent researcher into the ground financially with legal defense fees alone.

I get that HN wants to have it's "hacker" ideals and all, but, I would expect to cause myself legal troubles for publishing security details on such a service (unless done anonymously with reasonable opsec).
AFAIK, Reddit was created in a similar manner. According to Reddit cofounder Steve Huffman, in the early days the Reddit crew just faked it ‘til they made it – hundreds of fake profiles to boost popularity of the site.
Book: The Psychology of Money
I would love to learn more about what crates you use and how you manage infra. Do you blog about it by any chance?
Stuff like this frustrates me from a corporate open source stewardship perspective.

Companies love to talk about how they support FOSS during recruiting, but they can't even be bothered to formally update the repository with a deprecation notice when they decide it's no longer in their interest to support a project. And in this case, a lot of people rely on this package.

I don't necessarily think that companies should be expected to maintain OS packages they write forever, but respecting the community by openly communicating their plans for the project instead of making end users figure it out should be the bare minimum for acceptable stewardship.

Just abandoning this project without a heads up is some bush league BS by Netflix.
What is a “productivity device”? You seem to think that’s some kind of platonic “thing” that exists, but it’s not. Web browsers, email clients, etc., are just discretionary products people may prefer to use for recreational or personal reasons. They are not structurally required.

You seem to be conflating the idea of “this thing is convenient for what I like to do” with “this thing should be supported as a pivotal component of civic life.”

Smartphones are absolutely nowhere remotely close to the latter.
But ethics is an ill defined social construct. It might also apply to a finite set of circumstances.

Going back to concrete laws, there vast swaths of human effort not covered by law. For example, there is no law either guaranteeing my right to or forbidding me from thinking certain thoughts. You can say that’s a gap in the legal system, but I think that’s outside our legal system. Similarly, you can (fairly trivially) construct other situations that are not covered (I don’t think there is a law about flipping pages when reading books). Goedel’s theorem says that you can never create an axiomatic system where every proposition can be rewritten as true or false, and therefore you can’t create laws that cover literally every situation in life, but vast majority of things do not need to be covered.

For example, a system that has as its only law “you must give XXX money to the taxman on April 15 in such a way that a jury of 12 of your peers selected at random believes this has occurred” will not suffer from any coverage issues (at most you need to define some terms). This is because it is a finite rule that covers a finite set of situations.
There's this talk, The Sould of Erlang and Elixir, that opened my eyes to what makes this platform great:

https://youtu.be/JvBT4XBdoUE

It's not so much about what Erlang, as a language, "offers that Go does not". It's about the BEAM VM that runs it that makes all the difference.

I very much recommend watching the talk if you're interested in the topic :)
Please elaborate, why?
I’m trying to do this right now at conferacity.com, and it’s really hard. But I hope people will continue to try to experiment with new discussion communities online, not just based on the topic, but also on the governing rules and structure. It seems unlikely that 50 years from now, we’ll look back and say that the existing formats for online discussion were the best we could do, even though the existing formats are all clearly providing value to users in their current form.

An area I’m particularly interested in is, given that anonymous forums require moderation, but “moderation doesn’t scale”, what would happen if you only allowed moderators to contribute to the discussion. Or rather, what if you only allowed people who have the required attitudes, ability and emotional intelligence to be an effective moderator to contribute to the discussion?

You’d obviously grow much slower if you’re restricting contributor growth to a small subset of users. And maybe that constraint on growth would mean you never become a viable online community. But if you could get to some threshold size, you might find that the quality of discussion is sufficiently different that a lot of people might want to read such discussions without necessarily taking part directly.

Ideally, the contributor community would make decisions about what those required qualities are, and how to assess new applicants. But we already have communities like this offline - this is exactly how academic communities behave. Existing “contributors” (professors with phd’s in the subject) decide who they accept to their community, based on evolving standards decided by that community. It’s also interesting that this, at least from my outsider perspective, is also how YC operates - they have a particular ethos, norms of behavior etc, they admit people who they think are consistent with those norms, and then enforce those norms: https://www.ycombinator.com/ethics/

I think there’s an interesting analogy with professional sports. Baseball is a super accessible game, all you need is a stick, a ball and a field, so almost anyone in the world can play. But the way to get high quality baseball that people want to pay to watch is not by allowing anyone onto the field, but by restricting the players on the field to those with the required skills.

Regardless of how my particular “experiment” works out, I think it would be great to see more innovation in this area.
Good, thought-provoking article, but use with caution.

I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to a false sense of security.

Such measures also do not tend to keep up with changes as attacks become more sophisticated or cheaper to carry out.

You also need to make sure that there are no unintended consequences - does your non-standard configuration make it harder to apply upgrades? Does your own penetration testing also scan all ports, or is it only going to discover weak servers running on port 22 on your network?

That said, I would do the type of things mentioned in the article as an "added bonus", but try to exclude them from my overall security evaluation (either rough mental model or formal threat model).