skysight-inc/HackerNews huggingface dataset:
I'd be even less reserved than that. Many very popular and acclaimed musicians (be it people producing stuff with software in a DAW, or playing electric/acoustic instruments, or both) get to where they are just by messing around for a while and developing an intuitive musicality and composing ability despite never learning any music theory. So one may very well be up to more people's standards than they might think, once they put some time in.

It's probably worth it to spend a little bit of time learning the fundamentals, but like with programming, you can self-teach pretty well by just learning the absolute basics and then developing expertise through experimentation, trial-and-error, and pursuing what interests you.

Just as you don't need a 4 year degree to become a competent programmer, you don't need to deliberately study and practice music theory or classical technique for months/years to become a competent musician. In both cases, you can learn and practice by doing, if that's what you prefer. You can take a "hacker" approach for both domains.
I feel like it's a pretty weak point to say that passwords and keys would be security by obscurity if we didn't carve out a special exception for them. Why do they get a special exception? Because they're really really hard to guess, not because they're fundamentally different.

Let me give a real-life example of a good non-password, non-key piece of secret information that's used for authentication. If you need to recover a WoW account that you've lost access to the customer service reps will ask you to tell them the names of the characters on the account. Your account name isn't secret, and your character names aren't secret. But the relationship is because they aren't ever publicly connected. The odds that someone other than the account owner having this information is low and the odds of guessing it by chance is impossible.
9/11 7:31am. 69 degrees. Smoky
> They're wrong; full stop, no qualifications, no asterisk, no footnote, they are totally wrong on this and it is inevitable that their opinion will change.

This sentence takes the place of a reason. You could have offered a reason why you were right or a rational argument about the matter. Instead, you basically yelled "I'm right, they're wrong! I'm right, they're wrong!".
> 16-bit perfectly represents everything we humans are able to hear [1]

[1]:

> It's true that 16 bit linear PCM audio does not quite cover the entire theoretical dynamic range of the human ear in ideal conditions.
Yeah, I'm the technical lead and report to a director.

My contributions are 50% personal, 50% "team acceleration" (ie: ensure your teammates are able to get things done quicker including pairing, code walkthroughs, documentation, last minute team changes to ensure a project succeeds)
This absolutism is what causes more harm, because people fail to appreciate any progress when things haven’t gotten 100% of the way there.

The reason it causes harm, is because it discourages people from going after real incremental steps, because they see the mountain that is in front of them.

E.g. there are currently more slaves in the world than at any time in human history. With that mentality, we could have said, ‘oh, we can’t stop all the slavery in the world, so it’s not worth ending it here’
> I've seen security through obscurity misused too often as the only line of defence, or as a "temporary" stop-gap that outlives its usefulness. It can lead to a false sense of security.

Exactly.

> we need for some reason make this development-stage service publicly available on the internet, and it's connected to a lot of our services internally, but we can implement AAA only later and we need it now. No issue publishing it on an obscure route/IP/domain name?

And the setup stays online for 5 years.
Can I get a link to the quoted document? The quote raises more questions than it answers. Who determines that someone applying for a qualified name is the owner of that trademark (presumably this is a full-time employee; who pays their salary?), and what is the process? Trademarks are not a universal namespace--even within a single legal jurisdiction you can have the same name legally owned by different people due to different contexts--so who decides who wins?
Wanting to clear whiteboard interviews and becoming a good programmer are two different things. They have a very small part in common but that's it. Not saying wanting to clear interviews is bad, but you got to decide what you want to focus on.
If your prior art consists of "informed by several of us having experience with CPAN, RubyGems, and npm" it's no surprise that cargo suffers from the issues it currently suffers from.
I could be wrong, but if you are using public/private keys to authenticate to ssh, then even attacks that can listen in on the connection would be limited. Because the private key is never transmitted, unlike a password.
IC = individual contributor. I was trying to figure that out till they defined it halfway through the article.
> Maybe the work is not better or worse, easier or harder, but often there is more pressure/stress.

None of these are directly relevant to the power imbalance.
No doubt it is, I'm just explaining why comparing Chrome to Internet Explorer makes a lot of sense. Having a single browser used by the vast majority of people is a bad situation to be in. Especially when that browser is developed by a company like Google.
> You seem to be thinking in terms of security mechanisms either perfectly blocking attacks or being useless. That's the wrong model. It's about costs.

This is something that bothered me quite a bit in Bruce Schneier's various comments on airline security. He repeatedly wrote that profiling young Arab men as likely terrorists was pointless, because if it became harder for young Arab men to get through security, terrorist organizations would simply start sending Japanese grandmothers.

But of course where it's relatively easy to find young men willing to die for a cause, it's much more difficult to find grandmothers who will do the same. And where it's relatively easy for an Islamic group based in the Middle East to connect to Arabic social networks, it's much harder for that group to connect to Japanese networks.
Show HN: Booleans – Guile Hacker Handbook (new chapter)
Carbon footprint refers to atmospheric carbon, typically combustion products. Burying carbon, assuming it stays buried, does not contribute to carbon footprint. It is in fact how fossil fuels were formed in the first place.
Do some Hacker Rank and LeetCode exercises to evaluate your knowledge. Despite a lot of criticism those sites are very useful to train/evaluate knowledge of CS concepts.
Take a 10 day vipassana meditation course.
Things might look different afterwards. You're not as bad of a programmer as you think.
A good sw eng develops good mental habits and strength of mind before anything else, and you're brave enough to admit very hard and difficult realities, which puts you in the top 10% (at least). Good luck!
I'm sure the disruption to UK recycling collections due to Covid can't have helped much with that.
Maybe Pathologic, although I don't think the narrative is entirely kafkaesque. But certainly show how to make a good non enjoyable game.
I didn't choose the shorter names because i "care[d] about having shorter names", i did so defensively, because i figured if i chose `net.sekao/iglu`, someone else would choose `iglu/iglu` which would imply that theirs was the original or official version.

Another point i didn't mention is that maven was designed from the start to be decentralized; many companies run their own private maven repos, but also pull artifacts from maven central. Having group names reduces the chances of collisions between their private servers and a public maven server.
Only the 4th point is really true: if you run SSH on a non-standard port but it's otherwise accessible, you'll still see scans on a regular basis.

Port knocking isn't a terrible idea but I generally prefer locking down the networks (or, these days, using AWS SSM / GCP IAP to avoid listening publicly at all) since having something on the internet means you're just one mistake away from problems and need to staff monitoring accordingly.

The other thing to remember here is that we're talking about one general CVE in two decades. Almost any other running service has been much worse so while SSH is important to protect I don't know that I'd make the argument that further pushing that one service is really the best bang for your buck.
https://www.youtube.com/watch?v=iOBXVOAbpdY 8-min video says rust is not that safer comparing to C in practice
It's not a strategy. It's a tactic. And as many others in this discussion have pointed out, people who recommend to use obscurity never tell others to let their whole security strategy hinge on it. It's just a useful tool; a tactic.
> The developers have convinced themselves that they're right on this, having, I suppose, not learned from the hundreds of package managers that have come before them. They're wrong; full stop, no qualifications, no asterisk, no footnote, they are totally wrong on this and it is inevitable that their opinion will change.

A thousand times this.

Why are so many things in software three-steps-forward-two-steps-back?
I'm floored that nobody else here on HN has pointed out that Syncthing is missing. Android, Windows, Linux, and MacOS all have native clients, but there's nothing for iPhone.

So much for "There's an app for that".
Yeah, it was the same on Ragnarok Online when I played a female character as a teen. You got free items and creepy messages like "are you a virgin?".
Still have my doubled C64 floppies, of which some were horribly scarred by the big blunt scissors I started out with.

You could also convert Amiga floppies from single to double density by adding a hole, giving you 1760kB. I didn't have money for quality disks, and found that "punching" the hole with a hot soldering iron lead to less problems than using what was probably the wrong bit in my dad's drill.
I've done it. Like many people, I moved to the management track when my first kid was born. I realized that moving up as a manager required actually competing with the other managers and being better than them. It wasn't going to happen. As the low level project manager, I got the low level projects.

I moved back to IC when they finally posted an opening to backfill my job. I went to my boss and said: "I can be a mediocre manager or a great engineer, you choose."

Later on there was a big reshuffling of the department, and I was asked if I wanted to be a manager. I said yes. More reshuffling thinned my team down to 2 reports, and I kind of oozed my way back into IC by just doing IC work for people when I wasn't managing.

All of these moves were promotions in both pay and title.

One thing you learn by being through a few annual cycles at your business is how it really works. For instance, things like performance reviews, pay increases, promotions, etc. This knowledge will serve you in any career.
"BEHEMOTH, whether moving or parked, must provide maximum possible autonomy in power generation, computation capability, file storage, communication, navigation, and maintainability -- anywhere in the world, all controlled via a flexible graphic user interface..."

also:

"My original motive was simple enough. Horrified by a view of the American Dream from the curtained windows of a three-bedroom ranch in suburbia, doing things I didn't enjoy anymore to pay for things I really didn't want, I hit System Reset. Six months later, in the fall of 1983, I put my house on the market and moved to a recumbent bicycle -- I was a 30-year-old technomad heading across America with a primitive laptop, solar panel, and xnet connection..."

and later:

"I've had the dream over the years of putting together a nomadic community, a tribe of network-linked freelancers who move freely in physical space as whim, weather, and clients dictate. If this seems risky in these economically troubled times, remember that your real security is not what's in your bank account, but what's in your head. Skills are highly portable, and many of them can be wielded entirely via networks, phones, fax, pagers, satellites, and so on. If you are a wizard in some field, you will be welcome anywhere -- yet you can maintain the illusion of stability via methods that are now very familiar...

Technology has developed enough in the last few years that this idea, once rather fanciful, is now quite realistic. Virtually any information-based business can be operated from the road...

...it all points to one thing: getting away from your desk without simultaneously disappearing from Dataspace."
Not really, I just want to buy games and play them without installing a client. Right now, these types of downloads are available from Epic. If Epic stops offering DRM Free games, I'll stop buying them.

The nature of DRM-Free media is that once I've downloaded it, no one can take it away from me. I may miss out on future updates, but I always make purchasing decisions based on what's available today, and not what may be available in the future. (And I don't play online multiplayer.)

The EGS version of Tetris Effect was DRM Free at launch, but DRM was added in an update. This means I can't recommend Tetris Effect to anyone who cares about clients or DRM—but on a personal level I don't particularly care, because I already got my copy!

Separately, if e.g. GoG was the only PC game vendor, they probably would never have made DRM-Free games a core focus of their business, because why bother when you're the only game in town? And so, I'll always welcome new entrants into the market.
Not quite, if a ‘truth’ is defined as some ‘justice’ then there could be an unprovable ‘justice’ that should be carried out, we just can’t reason our way there.

(again disagreements like this are usually because of a disagreement of terms)
A significant fraction of that 70% is collected by homeless individuals and others living below the poverty line, for whom recycling is a zero cost, zero training income source that can pay out the same day. If our (California) social safety nets were effective, I suspect the collection rate would be more in line with the national average.
I agree with your understanding of security by obscurity. But I think the popular understanding has started to be more along the lines that the author counters. That if any security measure is "obscurity" then don't do it, it's bad.
Professional programming is less about raw ability and more about you being able to function within a team, discern what customers/clients are really saying, and deliver that in a way that doesn't create more problems. It's not as much about skill.

Many tech interviews are BS. You cross that bridge when you need to.

Also, there's a pandemic at hand, and that has an associated emotional cost that is not often accounted for. IME, it amplifies whatever fears you have.

Perhaps you've forgotten why you like to write software. Figuring that out might open a path forward.
> In short, being able to automatically decide the validity of a proof is almost as useful as being able to generate a valid proof automatically.

This statement is not known to be true, and is definitely false in practice at the moment. Validating proofs is a P complexity task, so generating proofs is by definition NP, very likely NP-complete.
Sounds cool, except I was immediately denied -
> Unfortunately, we've detected this email as spammy.
Give yourself more credit. The rest will come.
I clicked through to one of those articles where it soon brings up "Ego Depletion" which AFAIK has been debunked.
You have my sympathy. I'm not in exactly the same boat, but I sometimes feel really inept. It can be an awful feeling, especially for people whose self-esteem is on the line.

It might be helpful if you could share a few more details about your situation:

- Do you need to stick with programming in order to make enough money to survive and/or provide for your dependents?

- Is your current job at risk because of your programming skill level?

- Are there any other marketable skills you have outside of programming?
> Regardless of whether the average friendship length is similar, being FORCED to abandon your friends based on someone else's schedule is much more traumatic than friends entering and exiting your social circle due to the natural cycle of friendship.

No. Losing friends through the "natural cycle of friendship" is just as traumatic or even more so.

You are forced to "abandon" your friends regardless. This is true when you switch schools - from elementary school to junior high to high school. The same group of friends you had in your freshman year isn't necessarily the same as you'd have in your senior year. Heck, you can lose friends and make new friends just by having different classes/schedules. People just simply drift apart, fight, etc.

Just like people have a romanticized view of your childhood, you seem to have a romanticized view of childhood in the suburbs.

Also, losing friends because you have to move falls under "the natural cycle of friendship".
I'm obviously not the target user, but what is the use case of this?
Almost all the responses here talk about impostor syndrome or being mediocre. But maybe OP is really bad. Like really, really bad. I know that is possible because I'm a very bad developer myself, I know it's possible to be a bad developer (not mediocre) for years on. We still deliver, we work on very small teams or in places where we are the only developer, so nobody notice the mess your solutions are. They work. But you know they are bad, no tests, no best practices, not even consistency between code.

My point is: I hope some advice acknowledge that maybe OP is correct about his real skills.
There was no bitching or diminishing intended, you have completely misread me.
> If having a [password] grants you access to the system then it's obscurity.

Perhaps if you're hiding it under the doormat in front of the door and expecting it won't be found. Or writing your PIN on your ATM card with a sharpie and leaving it on the dash of your car with the doors unlocked and your windows down.

In most cases, however, it's part of an overall system that involves authentication, authorization, and (hopefully!) accounting to protect access to resources.
> This means that anyone advocating democracy in Hong Kong, or criticizing the governments in Hong Kong or Beijing, could potentially face consequences if they step foot in Hong Kong, or have assets or family members in Hong Kong.

I'm not likely to go to Hong Kong, so I don't need to worry too much about setting foot there and having to face consequences.

But I am married to a Chinese national and we tend to visit Shanghai and Anhui every 2-3 years, and I'm not sure how much safer, if at all, that is.
The GP made nothing more than a prediction about the future.

Let's let the future determine whether he was right or wrong, no need for squabbling.
To check the new account's password at creation time against existing salted hashes, you'd have to hash the new password with each existing password's salt. If you are using something like bcrypt or scrypt which is designed to be slow at this, that might take a while if you have a lot of existing accounts.

Maybe a Bloom filter approach? Besides the salted slow hash you store of each password, also put the password in a Bloom filter. Check new passwords against the Bloom filter. You'll get some false positives that way, but maybe that is acceptable.

I'm seriously tempted, if I ever have to implement a password system again, to allow up to 256 characters, just store an unsalted SHA256 hash, and tell people on signup that they should be using a password manager with a long random password if they care about security of their account.
The article is correct but they miss the true value add of security through obscurity: signaling lower ROI to attackers. Security through obscurity generally forces attackers to perform more actions and do more recon. Every additional action taken increases the risk of detection by defenders, costs the attackers valuable time (meaning lower ROI), and makes the target less appealing relative to other targets. Security through obscurity tactics are absolutely useful tools in a defender's toolbox (in conjunction with other security countermeasures).
Think Confluent ends with one-size-fits all employee experience
Our mission is to ensure each employee in your company has the best work experience possible.

People have very different expectations, goals and personality, and it is challenging for managers and HR to consider everyone in their decision making.

With Think Confluent, highlighting what matters to each individual in the company is a matter of minutes.

We are combining AI and cognitive data to help every leader to understand better their colleagues. We accompany you in your decision making by suggesting personalized training plans matching what your teams need the most.

Finally, we involve and empower your employees by giving them customized training based on their work preferences and personality to help them take action individually or collectively to improve their work experience autonomously.

We have the vision that the only way to have successful work experience is to design a unique tailored work experience for each employee.

If you want to register for our free private beta, please find us here: www.thinkconfluent.com/register
All awful shite is functional.
All functional is good.
So all awful shite is good?

I think that might be a tad reductive. Also, concluding that "people" must do anything now isn't useful. No one will be persuaded by your argument. People that are knowingly writing awful shite aren't bothered by that fact. People unknowningly writing awful shite will assume you're talking about other people.
One of my favorite talks is by Rick Reed about scaling Erlang at WhatsApp. What an absolute savage. He flies through an articulate and in-depth curriculum on system performance and bottleneck mitigation.

The talk is called "That's 'Billion' with a 'B'" and makes for a great lunchtime watch: https://www.youtube.com/watch?v=c12cYAUTXXs
I mean, hornets are wasps, genus Vespa. Other social wasps tend to be largely peaceful as well; most of the polistids ("paper wasps") in particular are almost totally unconcerned with humans, although I understand some of the tropical and neotropical species can be fierce. Yellowjackets, genus Vespula and ironically more closely related to hornets than are other social wasps, mostly get the bad name, but that's mainly just because their underground nests are less obvious and thus easier to trespass on. But there's generally enough daytime traffic at nest sites to make them observable, if you're paying attention at least.

I'm careful to approach only lone foragers and not nests, and I have yet to be stung while taking pictures of any wasp, something I typically do from as close to my macro lens's six-inch minimum working distance as I can manage - usually within 12 inches (30cm). Hornet, yellowjacket, paper wasp, or solitary, they all seem about equally willing to leave me unbothered, so long as I don't bother them first. Happily, having a camera lens and flashes going off nearby doesn't seem to count as bothering!