skysight-inc/HackerNews huggingface dataset:
Seriously, something like 50 of them cost in the $2-3M range, which is less than a lot of houses in the Bay Area. (Google says that Zillow says that the median price of a house sold in Palo Alto is $2.6M.) There are also three currently listed from $59k-$68k.
"bad faith stuff" is not dealt with directly. You could absolutely publish that crate right now, and I would have no inherent recourse about it.

For the most part, unless a lawyer says that it needs to be taken down, things aren't taken down. There is a small amount of wiggle room around registering a large number of packages in an automated fashion, but generally speaking, the principle is non-intervention.
3rd and 4th level domains exist, too.

https://en.wikipedia.org/wiki/.ca#Third-level_(provincial)_a...
Back to the Drive-In: A Renewal in the Pandemic
It seems to me that the article is missing a few of points on what "security by obscurity" means.

From Wikipedia: "reliance [...] on design or implementation secrecy as _the main method_ of providing security [...]"

So, to use the model mentioned in the article, a single slice of cheese. It's not "an additional layer of defense", it's the main one (so you have other... weaker layers? ¯\_(ツ)_/¯)

Second, "reliance on secrecy of design and implementation" is different from "reliance on secrecy of _whatever-else_", because design and implementation are most often either easily discoverable (sure, occasional skids might not scan port 64323 but what about someone who can observe your traffic?) or pretty much guaranteed to be discovered by adveraries with (not even as much as one might think) time and motivation.

Third, some of the examples mentioned (e.g., the decoy cars) are not even security by obscurity, that's called deception.

So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should never be your only (or your main) layer of defense.

Security by obscurity is not underrated, by definition it's just bad.
I think the ultimate issue is a moral one I'm unsure how to approach.

If companies encroached on my paycheck as much as they do on my time it'd be theft, and time is actually more valuable.

Edit: IANAL disclaimer... I'm sure it's not technically theft here... but it's pressure and I think the metaphor still holds.

Companies setting deadlines and not including developers in discussions is asking them to either:
- Stand up for themselves, even though they have less power/don't want to risk their job
- Spend more of their precious time on the company

I find myself repeatedly being pushed into the second option, and when I bring any of this up no one wants to tackle it at a systems-level... because the system is working as intended. Taking from those who can't or won't defend themselves seems to be how to be successful in business.

What's a good way to push back without looking like a dick or being shunted?
> If you're handling errors far away... the context is lost. So the effort to transport the exception type throughout the call graph is pointless.

I get what you're saying, and things like 'Try[T]' lose the specifics of the error type too (we just get a 'Failure(Throwable)').

My problem occurs earlier on: which code might throw exceptions, and why? Java's checked exceptions let methods declare "I can fail with an AccessDenied error (along with all the usual stuff like NullPointerException, etc.)", and the compiler will make sure that's handled somewhere (even if it's just a log and quit).

Unchecked exceptions are implicit; the signatures don't tell us they exist, and the compiler doesn't check that they're handled. This makes sense as a last resort, for things like OutOfMemory (although Zig would disagree!); but in general it's unhelpful and dangerous. I think it's a poor choice on Scala's behalf to treat all exceptions this way. Their only redeeming feature is short-term convenience; it's essentially an instance of static versus dynamic typing. "Exception polymorphism" (which I imagine would look something like row polymorphism) would make checked exceptions more convenient, since we wouldn't need exception-specific boilerplate, and this might be enough to solve the problem.

Maybe the JVM might gain such a feature in the future, but until then we can use 'Either' or 'Try' to achieve a similar thing: they show us explicitly which methods can fail (answering the question in my second paragraph), and they force us (via the type checker) to handle the error case somewhere (even if that's just a generic log+quit handler at the top level, as you say).
> "hostile fork" -- the entire notion is nonsensical.

It is not. It is based in experience. See the xMule/aMule fork. A hostile fork is when the fork project starts bad-mouthing the original project and its maintainers.

The notion that forking is by itself hostile is non-sense.
I like this analogy!
port knocking is just, another way of doing a password, right? It's pretty much just a PIN code with a slightly obscure method of inputting the digits.

I would imagine that this is open for a man in the middle attack- if this traffic were intercepted- you'd be able to see port numbers, right?
Heartbleed caused data leakage in the handshake phase of the protocol. I don’t know if SSH was affected, but there’s no reason why a similar exploit won’t be found for SSH in the future, and trivially obscuring your SSH port protects you from 99.9+% of automated attacks, possibly buying you time to patch or mitigate.
This is great in principle, but it’s only a starting point -
there are huge issues that are left unaddressed.

The biggest issue is that it presents status as if it can be conferred independently of power, or as if we can change the dynamics purely by changing the way we think about this.

Managers have power for many reasons - they generally do have a significant influence over subordinate’s career prospects, and they have access to all kinds of organizational information that ICs simply can’t obtain, at the very least because they can usually spend time in conversation with other managers or in meetings with people at higher levels in the organization.

Engineers obtain power through indispensable or highly valued domain expertise or institutional knowledge.

Both forms of power are real and confer status.

If you move from management to engineering and your power as a manager is not replaced with corresponding power as an engineer then you have been demoted in status, irrespective of how the organization claims to value people.

Organizations that want to deny this, even with the most positive intentions end up gaslighting their employees. I.e. saying things like “Our organization doesn’t see these moves as a demotion”, when manifestly the individual’s power and status has changed in a way they and everyone else can directly perceive.
I also work at a FAANG, $250k was just my fake number example of L4 averaged across FB/G (where that would be low) and Amazon/Apple (where it would be average-high). Didn’t expect people to get so fixated on that, heh
This makes me think of how Python coders say that code is or isn't "Pythonic"

So what would Rusts equivalent be... Rustic? Namespaces are not Rustic.
Hmm, never thought of posting selfies as a sign of good mental health before...
You missed the word "intercontinental" in the parent poster's message.

Good luck setting up a microwave link between New York and London that will be faster than a short wave transmission.
Become a Product Manager?
By definition cryptography is security through obscurity as you map something from a small space into a large space (e.g. multiplying Two numbers you know is easy while finding two prime factors is hard).

The aphorism is unfortunately too short to be enlightening except to someone who already understands it.
Eh, market forces are more influential than this. You can't simply decide how much to pay engineers, any more than you can decide what your rent is going to cost.
Sounds like me on a Tuesday:p. Several things: Are you trying to learn JavaScript deeply beyond hacking? if so, there is your problem, no one really knows that language. Maybe try different programming languages to see what clicks? Also remember that average mortals don’t know how to program or even how to open a text editor without getting terrified. Everyone has imposter syndrome. There will always be someone way better at programming than you. Don’t be so hard on your self.
That is horrendous and it should be taken down due to obvious non-fair and possibly malicious intent.
I've met some terrible programmers who thought they were awesome.

I think most of us wrestle with imposter syndrome from time to time. It doesn't help that there's no grading system for programming, no professional body that will certify us, no systematic learning program that we can work our way through. CS degrees don't teach actual programming skills (seemingly as a point of pride). There is literally no external source of validation except comparing ourselves with our peers - which is always a source of misery if you're not a narcissist.

There are constantly stories from famous, objectively good, developers who failed technical interviews. As with all interviews, a lot of it depends on social skills rather than technical skills. Failing technical interviews doesn't mean anything.

But, let's assume you're right and you're a terrible programmer. What do you enjoy about programming? Usually our talents lie in the direction of the things we enjoy. "Software development" as a career incorporates a huge range of sub-careers, and there are advantages in non-IT careers for people who understand coding. Can you head in the direction of your interests?
Keep it simple stupid.
Simple code is better than hard to understand code.

It's okay to just write code for the sake of writing, but keep in mind the idea that what if new requests comes thru; given the current state, can the code be changed easily?

Code organization is a work in progress.
Can your code be easily/separately testable?

Being good at coding is subjective.

Sometimes, it may just be the tool (programming language) you are using.
Try Ruby.
Try Vue.js.
It's possible to track similar passwords in a safe way over a short amount of time. Keeping any user's password or any security token in plaintext is just disgusting. Regular people have a hard enough time navigating the digital world without needing to worry about whether their credentials are safe. Anyone who stores passwords in plaintext is disgusting and should not be managing digital services. Period. This is how breaches happen, and it should be a fine-able offense.
> Typically you want to know who is connecting to what server via what service and log these connections. If something is off, an alert can be generated. If ssh isn't served on a standardized port, logging and alerting becomes more complicated - albeit not impossible.

Could you elaborate on that? I serve ssh on a non-standard port precisely in part because it drastically cut down on the noise of failed log-ins, to the point where when I check the logs I'm almost the only one who actually bothers to try to log in via that port. That seems like a win to me.
I'm surprised there was no mention of Blueprinter (https://github.com/procore/blueprinter), a format-agnostic, maintained serializer that's very obviously a successor to the ActiveModelSerializer that is mentioned.

Personally, I don't like fast_jsonapi because it's impossible to retrofit an app that already exists to it. The standard is so specific (and, in my opinion overkill unless you're Netflix) that it's just not the right fit for a lot of APIs.
Eh, I've seen tons of terrible developers who still collect a pay check. If you acknowledge you need to improve you can't be the worst of the bunch.

It depends on what your goal is. Do you want to get better at creating software as a goal in itself? If so you might want to think about optimizing for lower pay check jobs at startups where you will get to work with talented engineers and do new and different things although be careful they actually have good engineers who can mentor. This could prove to be the most monetarily rewarding path over a 5 or 10 year time frame as well if you drastically increase your skills.

Do you just want to make money off of it? If so look for skills that are highly valued in job listings, maybe react.js right now, and spend a few months of your free time studying that one thing as much as you can and maybe build a test project like todo mvp. If you can do anything at all with react you can collect a paycheck somewhere.

Software has a lot of froth these days. You don't have to be incredible to get good outcomes in the industry.
Mayvr. I've felt this on and off for maybe the past year or two alternating with short bouts of motivation
HN submissions should use the same title as the submitted page, unless it's misleading or clickbait (cf. https://news.ycombinator.com/newsguidelines.html). E.g. here "The Urgency of Rearchitecting Bitcoin's Mempool"
If you don't have a CS education or a lot of professional experience yet there's no logical reason to expect you just "know" things - even what is considered basic knowledge. It's okay to not know what you don't know, you just need to address that.

Seek education (either a CS course or the multiple online courses), seek the help of a mentor (someone at work? friend w/ more experience?) and keep working on getting more experience.

Don't think people are "born programmers" - the good people invariably sank a lot of time into it.
Being able to read and understand other people's code is a tremendous skill. Passing technical interviews is a skill in and of itself. Everyone has room to grow, and even the most experienced software engineers have gaps in their knowledge. Seek honest feedback from your peers, explore data structures, "Big O", and software design patterns (OOP isn't the end-all-be-all), and watch yourself grow. Most of all, believe in yourself, keep coding and making things happen.
In nature, prey animals will sometimes jump when they spot a predator[1]. One of the explanations is that this is the animal communicating to the predator that it is a healthy prey animal that would be hard to catch and therefore the predator should choose to chase someone else.

I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up.

Of course in the age of automation, relying on obscurity alone is foolish because once someone has automated an attack that defeats the obscurity, then it is little or no effort for an attacker to bypass it.

Of course, sprinkling a little bit of obscurity on top of a good security solution might provide an incentive for attackers to go someplace else. And I can't help but think of the guy who was trying to think of ways to perform psychological attacks against reverse engineerers [2].

[1] - https://en.wikipedia.org/wiki/Stotting

[2] - https://www.youtube.com/watch?v=HlUe0TUHOIc
Yes, due to the insane amount of single-use plastic bottles being being wasted without recycling, we nowadays have to pay deposit for most bottles, which we then get back by returning the spent bottles to special collecting stations that use some computer-vision to check each bottle one by one for eligibility of deposit return.

So whatever you drink at home, you usually quickly start amassing lots of empty bottles at home that rot and wait for being returned to the supermarket.
one of the reasons the cost and weight of glass is such a problem is because the supply chains have consolidated around huge centralized bottling plants that require the transport of individually-packaged goods clear across the country.

bottling isn't a specialized task, it can be done anywhere. If companies were forced to pay the true cost of their plastic packaging, we might see a return to a system where bottling plants were set up locally, provided local jobs in smaller communities, and customers could return their used glass bottles directly to the local bottling plant for sterilization and re-use.
This is the only good argument I've heard yet for not adding namespace. And maybe it's a defeating argument, maybe Crates is doomed to not have namespace due to the cost of putting them in after the fact.
I wish all the dudes who don't believe women get harassed _all the time_ would take a spin just playing an online game as a woman. Shit is real.

I've had coworkers in customer success get messages from stalkers via Intercom like "Hey <female name> I know where you live and work, be careful."
Keep in mind that if you joined airbnb, or palantir in 2012, instead of snap (and both were hot companies) you'd be stuck at the company even now, since if you leave you'd forfeit your options unless you were independently wealthy.

That's 8 years forced to stay at the same employer or your options are worth nothing.

And again, those companies were already unicorns. And the stock will still be worth $0 to many. Now imagine a non-unicorn where you don't even know if you'll go public eventually.
I argue against that. because the problem is not that error handling is hard, the problem is that it is mostly unnecessary.
Basically if you would write a hello world that writes directly to STDOUT you would need to handle IOException, guess what? it's basically useless to handle any kind of IOException in that case, because guess what? if your i/o device for output to display is broken you can only let your program crash.
and that is the most common case how most exceptions are handled. and thats excalty where the k8s hype is about.

fail fast, start from scratch. you can't handle a network error in your application, but you can basically kill everything that lost network access to your database and recreate it where database access is still possible.
but you don't need to do that in your application, your infrastructure should handle these and thats why most checked exceptions in the java stdlib are basically stupid. 90% of the stuff reuses exceptions for ease of use but 90% of the stuff should be runtimeexception and 90% of them should split them up, between stuff that I COULD recover from and from stuff that I can't (i.e. SSLException should be split into validation of certificate exceptions and protocol violations!!! that mostly can't be handled without reconfiguring the JVM!!!! I mean there is a SSLProtocolException but it's basically useless since it reports a totally different thing..)
It's a cool approach to a problem a lot of people are struggling with right now. It's also not trying to sell me something right off the bat. Great work! It's a net positive contribution to a planet that needs it right now.
This sounds like the majority of developers i've worked with. The main difference being you have self awareness.
To my knowledge, digital radio mondiale is only used on shortwave bands, and not on conventional ("broadcast") AM radio stations in the United States.

I haven't kept up on the SW scene in a decade or so, so I may be mistaken.
Apple issues new rules for App Store that impact streaming game services
Has HN changed a lot since it inception? Or has it stayed mostly he same?
Show HN: Learnings from My Open Source Startups' First 100k+ Visitors
How “Go Build” Works
I'm not sure I'd recommend highlighting your potential lack of competence to your manager.
In my experience good developers end up being good because they tend to do a lot of coding, read a lot on how to code correctly, and on how to improve their skills. Most people that I know don't do this because they need it, but because they are motivated to do it. So my question to you would be: do you like coding/developing? Are you up to spending time improving your skills?

You're saying you're not sure what to do about it, but from your post it sounds obvious to me that a next step would be to spend some time learning about CS, practicing coding/maintainability, and such?

I'd also add that not every developer needs to know every single aspect of CS, all the theory behind it, or even be an excellent coder. There are different areas in developing and you might find one that motivates you without needing a lot of any of the specific areas you mentioned.
That also works?
It doesn’t have to be directly end-users — could it be like the HTTPS chain of trust, only with Apple and Google as the roots of certification?
Hey! A lot of people have mentioned you should keep going, and that's really good advice. You're probably better than you think you are.

But if you don't like it, you have other options! There's a lot of jobs out there that you might like more, and will benefit a ton from you having a background in engineering. You now have a superpower... you know enough about engineering to be dangerous!

For example – sales, CSMs or support teams for technical products will love you, because you can debug and figure things out – and your job will still involve more talking to customers than code. Look at solutions architect jobs, too.

Same goes for marketing. Most companies would kill for someone who does marketing but with a background in engineering who can do the work of setting up tracking/funnels/etc, rather than bugging engineering teams.

DevOps is a place where the hacker mentality will go a long way. There's not many "languages" you need to know deeply; but rather be really good at figuring things out and understanding how everything works together.

The list goes on! (EDIT: check the replies for more ideas!)
for me programming mainly consists of code organization, logic, and communication. i guess what are you bad at? Do you write code which is not logically sound? (missing edge cases, not being able to simplify which results in spaghetti logic), or do u write code that can't more or less be maintained, or is architecturally unsound or maybe you just don't understand the business problem you are trying to solve and have a hard time figuring out the right questions to ask and get the answers. Those are three different problems, for the logic part, i would try doing leetcode (as much hate as it gets), it will help you reason about problems better and studying the solutions give u new ways of thinking about certain things. Clarity is essential to coding, if you are not clear about what problem you are trying to solve, or clear about why your solution must work, then you will always feel like a poor developer.
You can do that - I do it all the time myself - but I'd stop short of saying, "you'll be fine." That approach has its own downside, which is that it makes life obnoxious if you ever do want to actually handle exceptions. Then you'll have to add extra logic to determine if the exception you've caught is the actual error, or just a wrapper of some type. So your error handling inevitably becomes more error-prone.

If you can get your team to commit to a "let it crash" policy, though, then it's pretty doable.
Covid-19 creeps into a sprawling Syrian refugee camp in Jordan
That's only a small part of it. Most of the people are the richest in their extended family, and tons of friends from HS, college, etc. so they do know people who are not in their income bracket.

I'd say it's more related to the imposter syndrome. IE if I got here and I'm just ok, clearly this wasn't too hard a level to reach.

That and "well I used to work with so-and-so, and we're about equal, but they're making $800k while I'm stuck making $400k, so I'm clearly failing". Or even $2M vs $10M, etc.

Again, it's crazy, because both people are clearly actually "rich", I'm just trying to explain the mechanics of why so few actually feel that way.
Blog seems to ignore the fact that password is just security by obscurity. And having absolutely no obscurity with security is very hard.
Guess obfuscation is the goal, and the methods include using random variables, disordering code, inserting verbose code...
I upgraded my Atari STE to a whopping 1Mb of memory in order to play the first Civ. It's a toss-up between that and Civ IV as to which version I spent the most time on. Civ III was the only one that disappointed me.