skysight-inc/HackerNews huggingface dataset:
Having been through a few of these public sector transformations as a consultant, there is no "there," from "here."

Strategically, the play for a few successive governments has been to stand up new arms length agencies outside the public service proper that have missions to develop new platforms, with the intent to migrate the public service to them when they arrive.

The successes have been where the stand-alone agencies manage to deliver and maintain their independence. The failures have been where they have become captured by "secondments," where mandarins or "retired" ones leverage their way into governance roles, subordinate them to the old system, and turn them into the same broken and staid institutions they were designed to replace.

The successes were expensive but their success amortizes that cost. The symptoms of the failed ones were visible early on, generally because of Party-connected consulting firms owning the HR contracts for them and using them as patronage factories and slush funds.

Change requires freedom, and that freedom requires independence. The accountability risk is real, and the challenge with oversight was that the overseers simply folded the agencies back into the morass.

If I were running this, I would take a radical approach, where the strategy would be a venture model that micro-funded projects to create useful products that solved for providing future services and applications, and not legacy ones.

Priority one is a set of useful and privacy preserving identity services with varying levels of assurance that meet the needs of regular people, not just public servants, as all public servants are citizens first, so are researchers, academics, police and everyone else. This must be exogenous and adopted willingly, and not forced down as a national identity scheme. Second would be an investment in FHE and other privacy technologies because they can preclude and even obviate the need to stand up new private infrastructure to support data exchange. Third, I would invest in federated and distributed techs (git/BC/OIDC, etc) because interoperability is the ONLY problem government is designed to solve well because fundamentally it is a coordination and interoperability layer for society in everything it does.

While I am not qualified for this job, with a long enough lever, I have no doubt I could move the whole thing.
Definitely made his mark and I can only imagine the feelings of imposter syndrome he had.
Fun anecdote for those who aren't familiar: He's one of the players in Space Jam whose playing talent is stolen by the Monstars.
In other words, changing the default SSH port number is similar to using camouflage. It just helps hide that something is there, but it does nothing to improve the defense once spotted. However, if the majority of predators don't see you, then the rest of your defenses are needed at that time.
There is one giant hole in your argument: both stack cookies and ASLR are mitigations that are nothing more than automated security through obscurity in the first place.
'Ugh fields', or why you can’t even bear to think about that task
Please keep nationalistic/ethnic flamebait off HN.

https://news.ycombinator.com/newsguidelines.html

You mention downthread that you're Russian. We've had to respond to similar anti-Russian slurs on this site in the past. It's not ok for any user to post like this about any country, people, or language. HN's Chinese users (and users with China-related backgrounds) have as much right to be here as Russian users (and users with Russian backgrounds) and any other users with any other backgrounds.
This is a really powerful comment. I am trying to create a sustainable income from this app so I can keep on doing what I love, and every marketing guru on the planet is trying to push me into charging as much as possible as early as possible. I have an intuitive resistance to that, but you put it in way better words than I could have.

I'm not sure how to fix this and still make a living out of it yet, but I'm going to keep looking.

Thanks for your thoughts!
Because actual imposters don't care.
This is true but I think that its not really a binary classification and there is a spectrum from useless and trivial obscurity (base64 encoding some "secret") to actually useful obscurity. After all, you can call password authentication "security through obscurity" since you only need to know the correct sequence of characters and your security relies on that sequence remaining obscure.
The pickers in my neighborhood are a nuisance. If my recyling bin is full, then they move good recyclables from my recycling bin to my trash bin in order to try to find cans and bottles. Often, then don't move them back when they're done rummaging.
I think this just makes his point.
Great post, I also think that approaching it from a higher level like product design is best. Knowledge travels down do lower levels easier than it travels upwards.
Oops. You're right, it's Harvard, not MIT.

And hardly a nitpick. It verges on a fail. Sorry.
I am not arguing that this should happen; I am asserting that this will happen. The reasons why it should or shouldn't happen don't matter when it will happen.

If you'd like to: Go back and re-read my comment, but re-read it in the mindframe that I'm against the change. It still holds. I didn't provide reasons why they should make the change, because I don't have a stance on whether they should or shouldn't. I am not qualified to say whether its the "Right" decision; just that Rust is on the wrong side of history with this one.
European countries are lagging behind with cell broadcast, even though it's perfectly compatible with GDPR and most local legislation. But AFAIK it's going to be mandatory EU-wide starting in 2022.
sure, balloons would do it.

i've prototyped that. :)
You’re completely right about the starter and I feel if I had discovered it first instead of trying to roll my own migration system with Knex and stuff, I would have stuck with Postgraphile.

But instead of rebasing my project with the starter I decided to go back to what I was comfortable with and do a Rails gql api.

I’ll definitely be trying it out in the future though! I felt so incredibly productive with rolling stuff out before auth became a concern.
The Sorcerer’s Apprentice Guide to Training LSTMs
I like the article overall and agree with the author. Only thing that stuck out to me was when he puts out the twitter poll which shows that a majority of people do scan the entire port range, it defeats the purpose of saying that most people stick to default scans.
It has its place; the key thing to remember about it is it's not sustainable.

Security by, say, mathematically-hard problems stays secure even when the problem's design is understood. Security by obscurity breaks any time the secret gets out.

(There is an overlap point where a math problem is too simple to solve and, meanwhile, an obscure secret is "The sixteen digit number the President memorized to launch the nukes" where the security-by-obscurity can even beat out mathematically-secure, but the middle points of those two sets are separate and the reliability heavily tilted in favor of the mathematical cryptography).
So why not just package them Ritz Cracker style, cardboard box outside, wax paper inside?

Again, seems more like a failure of imagination.
I think the main issue with imposter syndrome is everyone realises they suck but don't realise so does everyone else. If you look at the majority of private code bases in the world, they'll look like crap. Even the stuff getting leaked out of the major companies look like crap. Even some of the offical open source stuff coming out of the major companies get pulled apart for valid reason.

Everyone feels like they suck at programming, because they do, it's ok, everyone else sucks too.
Cached: https://webcache.googleusercontent.com/search?q=cache:_LOT09...

These things are cool.
Personally, I tolerate/support linux only because it's the only OSS alternative to windows (Yeah I know about OpenBSD).

I absolutely dislike some of linux philosophy like "everything is a file" which I find plain wrong.

But I agree that he go too far and hurt users only due to engineering taste.
Let’s go with that. :)
Yes, objects have the cruft and primitives don't. So you use primitive types whenever you can, including mathematical operations (unless the numbers are big and you need a BigInteger or BigDecimal, but that's another story). So far so good. But then, because of type erasure, collections (and literally anything generic except arrays) only accept objects, meaning that if you need a set of longs, you use a set of Longs instead. And if you are using some complex algorithm that relies on maps or sets of primitive collections, where you are constantly adding or removing elements, boxing and unboxing will kill your performance. I have been hit by this more than once. The last time I measured this (about half a year ago, which was the last time I encountered this in my job), the difference in memory usage was several Gb, and in particular there were about 7Gb used just for the Long class.

There are third party libraries that alleviate this. I use koloboke a lot, for example (which works for maps and sets, but lacks sorted collections and multimaps, which I also need to use very often); but the problem remains for anything slightly complex, and it's not uncommon to find yourself writing two almost identical copies of a relatively complicated method or class, one for objects and another one for ints (and maybe a third one for longs, a fourth one for floats...), because otherwise you hit the same problem.

So yeah. Primitive types are not objects and that limits them because Java doesn't work well with things that are not objects. C++ is much better in this sense, because generic code is actually generic and any type will do.
If it was that simple why does literally every nuclear power plant run way behind schedule and way over budget?
Reminds me of this Clojure talk- https://www.youtube.com/watch?v=Mfsnlbd-4xQ

Using functional composition to build a Bach canon out of pure sine waves.
I was going to suggest looking at a QA/testing role. I bet you can break down problems, and you can trace through code (even if you didn't write it), and... QA is definitely a needed role in many companies.
It's also the age of NZ launching it's own satellites. Sadly this thread bumping up against the Nikola investigation seems to have tainted this thread with doubters. Growing up in NZ we are taught to have an inventive spirit even without resources. Using "number eight wire" as we call it. Stories about farmers inventing jet-boats to head up rapids looking for lost sheep, or a young Peter Beck with a rocket on the back of his bike, then naming his rockets after Rutherford. Not saying every kiwi invention is a winner, but don't let the knockers put you off trying is all.
1 + 1 = 2

Aren't formulas easy to insert in plain text?

The problem with maths notation is that it was invented by sighted people for sighted people as a short hand for very complex ideas, which at the time weren't fully understood.

If you want to type equations use s-expressions, the clarity you get from saying what you mean is astonishing.

(define integral
(lambda (function)
;; Implementation of Risch algorithm left
;; as an exercise to the motivated reader.
))

(define definite-integral
(lambda (lower-bound upper-bound function)
(let ((anti-derivative (integral function)))
(- (anti-derivative upper-bound)
(anti-derivative lower-bound)))))

Hey look, you don't need the dummy variable explicitly any more. It's almost like it's a relic from a time before people understood what function application actually was.

If you want the implicit mess (and incredible power) of higher maths, be prepared to deal with the the mess of typography. Which is why you need TeX, or worse.
I think it is. In my younger days I wanted to rise up so that I could work on really complex and challenging code. But now I'm there and I hardly code at all. Most of it is working across teams to figure out dependencies, blockers, security concerns in launching a new project. About a year in, I still don't like it much, nor do I feel like I'm good at it, even though I consider myself a good coder. I asked my manager for a transfer to a more code forward role and apparently they really don't exist at the high levels. There are some exceptions if you are a known expert in some field, but for a generalist in optimizing queries or caching patterns, there's usually someone cheaper and younger they can get to do the work.
If you want accessibility, it would be better to convert your content to XML and run the LaTeX through MathJax first, using accessibility extensions (https://mathjax.github.io/MathJax-a11y/docs/). Then use a third-party converter such as PrinceXML to generate the PDF from the XML.
Changing the ssh port would still fall under security through obscurity whether its effective or not.
That is another appropriate analogy (and it's why the military invests in SIGINT).

To the point though, no one should "assume the tanks won't be found", but it's still worthwhile to do things to make it less likely they will be found.
This is a good list. I’d add that I’ve had two friends that didn’t like programming and became product managers and have been very successful at it.
It's either some kind of career change or identifying your weak spots and working on them.
It's impossible to tell whether you're actually that bad or just being extremely hard on yourself.
You don't have to be the best at what you do to make a living you know. Are you getting by? Can you keep a job for more than a year?
The only thing I can currently measure in the app is the intensity of an emotional experience - before the process and after the process. I'm still compiling the stats, but I think the average reduction in intensity of the experience of e.g. apathy is about 40%.

I really like the idea of incorporating a standard depression symptoms test into the app and then taking another test at a later stage to see the longer term change. It still won't be conclusive proof, but it would help.
Not thinking about the design of the language is a necessary adaptation for Java coders; the cognitive dissonance would be debilitating.

The reasoning goes stepwise.

1. In a good design, a class interface represents an abstraction. The public interface provides access at the level of the abstraction, obscuring details of implementation.

2. If it is a good abstraction, by definition it maps the public view to an internal model that differs from the public view.

3. Inheritors provide different implementations of the abstraction by defining their own versions of inherited virtual-function signatures, operating on the internal, abstracted model.

4. Because these virtual functions operate on the implementation, they should not be exposed to the client. Exposing them would violate the abstraction, exposing the internal model.

5. The public members of the base class translate abstract operations to operations on the internal model, and call virtual functions that provide variable concrete operations on it.

6. Therefore, it is wrong for the public members of the base class to be virtual: their interface is the public view of the abstraction. It is their job to map that view to the internal model, and to call the virtual functions that implement the model.

7. Similarly, it is wrong for the virtual functions to be public, because they implement the internal model. Making them public would expose it.

All that said, since Java offers only one organizing mechanism, the class, it necessarily gets used for everything, and not just for well-designed abstractions. It is not wrong to treat language features as a pot of mechanisms, and use them in ways that do not match their designed intent. Coding Java, there is no choice about it; classes are all you have, so you use them for everything, and the well-designed abstraction may be a rarity among all the other uses, and might not exist at all in many programs.

But Java's limited feature set is out of scope for discussion of the designed purpose of virtual functions. Used according to the Object Oriented model, public virtual functions are an oxymoron. But as mechanism, they are as usable as any other, if they work.
Apple to Allow Streaming Game Services That Submit Each Game for App Store
The only downside I see immediately is that there's a counterweighted risk to obscurity in your security layer: you can confuse your own users (or yourself).

Many security tools I've used are downright user hostile in how little information they provide the end-user (or the admin!) regarding why an auth process failed. It incentivizes people to simplify or bypass the system entirely when they can't understand the system.
Obviously we're all talking hypotheticals here, but Rust-the-language doesn't need to support crate-level namespaces (which isn't to say that some first-class support couldn't be imagined, but again: hypotheticals). Rust links to libraries (via explicit or implicit `extern crate`) that it finds on the system via the ordinary OS-level library search path mechanism; it's up to the package manager to put those libraries on the system in a place (and with a name!) where Rust can find them. As long as the package manager can turn the registry namespaces into something usable from Rust, then there's no need to add anything to the language itself. A package manager could decide to put a namespaced package "foo/bar" on the system as merely "bar", and require the user to manually disambiguate when colliding (using ordinary rename rules, such as is already supported by Cargo). Alternatively, a registry could forbid uploading packages whose names internally contain underscores, and then the package manager could install "foo/bar" as a crate "foo_bar", which has no risk of collision (well, with packages from that registry).

This is why the conflation in the title of the OP here is especially annoying; package management is a concern that the language doesn't necessarily benefit from being aware of, hence the separation of the compiler and the package manager. :)
Do you hate the C++ syntax for lambdas or the concept of lambdas?
> But definitely take obvious and easy measures that leverage obscurity to add another layer of defense, such as changing default ports, port-knocking, or whatever.

Except that can lead to operational problems down the road. For example "oh yes, we're nice and secure, not only do you need a 512bit private key to get into this device, you also need to connect from a secure network"

Then along comes covid, and you can't get into the building.

"Oh dear, you're not on the secure network, you can't come in"

So you spend 2 hours (while your network isn't working right and you're losing customers) finding and getting in through a back door.
The decision is whether it meets the threshold "public interest" (which includes meaning of "broadcast"). And it'll be made either by FCC Media Bureau, or by Commission itself. It's highly unlikely it'll get appealed to courts.
I don't know what to tell you man. I live in the South and I've interviewed at my fair share of IT cost centers. They tend to ask the same kinds of questions. The ones that don't end up paying $50k/yr for 60+ hour work weeks and treat their developers like dirt.
> It's a (seemingly) pretty simple matter of keeping track of how long someone looks at a video, and optimizing to show them videos they'll spend a long time looking at.

It just push the creators to try to keep the viewer the longer by pushing the actual content further and further into their 1 minute.
I'm sorry but a language that has data entropy and link rot built into its compiler is not appealing to me.

I prefer the Go approach which lets you host or import packages via a HTTP or git URI. If you have to have packaging built-in to the standard toolchain these days, then please use already well-known and existing protocols like DNS and git. Java also figured this out years ago (com.sun... etc).
All encryption is "security through obscurity". The parameter space is very large. The key is somewhere in it. You have access to the whole space, but no clue as to where the key is. Good luck finding the key.

> Instead it was originally meant as "if your only security is obscurity, it's bad".

Since all security is essentially "through obscurity" somehow, I would simply reframe that into the onion model. Good security is like an onion, it has many layers. When you only have one layer, that's bad security.
Just a heads up

1) OOP concepts don't mean everything.

2) Forcing Whiteboard interviews is bad. Some people prefer writing code (on computers) to think. Some people prefer whiteboards.

Please dont write yourself off because of these things.

> I also suppose that I'm an ok "hacker" in that I can get very interested / fixated on certain problems, although my solution is more likely to be a complete mess.

This is a good skill set to have and build on. If you care about code quality or improving your skills, try to find people who can mentor you in those directions.
I agree with you that the example is not the best, but obscurity has a lot of benefits. We did an experiment with a few students on obscuring a WordPress installation some years ago to catch ppl scanning for certain plugins. That gave us the ability to use the regular paths as honeypots. Gives you an ability to detect 0-day attacks as well.
Not sure about now, but when Steve Jobs passed in October 2011, the iPhone 4s was about to be released, and CNET published an article saying that Steve Jobs had already been involved with the final design of the iPhone 5, which didn't launch until September 2012.

https://www.cnet.com/news/steve-jobs-last-big-project-the-ne...
pfft. One nucflash=buy, two nucflash=sell
I think a lot of the people in this comment thread are missing the point when using the `sshd` example. There is no single infallible way to secure ssh, but there are a lot of things that can be done together to make it pretty darn hard to hack, and most of those countermeasures have some degree of 'obscurity' to them.

Example:

* Use RSA keys instead of passwords -> This will eliminate most risk, except for exploits in sshd itself,

* Change the default port from 22 to something in the 40k+ range, which will keep you from being scanned, and

* Whitelist IP addresses that can connect to port xx on your server -> This will eliminate 95% of remaining risk

* Using a 'clean' bastion server to access other systems via agent-forwarding, preventing malware on admin workstations from being able to propagate over SSH.

So, no you're never going to be 100% secure, that's just unreasonable. But like you said, the cost can be increased to the point that all but the most determinted state sponsored APT groups.
I know a lot of people are conditioned to not drink tap water, however, we need a world where tap water is not only clean enough to drink but also seen as the definitive clean water that you would want to drink.

I live in the UK and never buy water. All mine comes through the tap. There is no lorry delivering water for me although the water supply does have lots of big pumps and processes that mean it isn't arriving in my house by gravity alone and it does have a carbon footprint.

If you are living 50 miles out in the desert then you are going to need a lorry to fill up a big tank rather than bring lots of little glass or plastic bottles. Otherwise, tap water rules and needs to be kept clean. Drinking bought bottled water should be discouraged.
> any connection to a database or other external system needs to be build into that interpreter as a plugin.

Guess: that could be the general area where Dyalog is burning most of its alleged, monstrous 500 KLOC.