skysight-inc/HackerNews huggingface dataset:
The level of security is cumulative. You do not trust a connection just because it's connected to the VPN. So if your VPN concentrator is compromised via 0day, the only access they get is the same as if things were listening on the public internet.

To gain access to the server via SSH they now need both a way in to the VPN and a way in to SSH, vs. just needing a way in via SSH.

It doesn't do much if someone just gives up the keys for the VPN and SSH, but it would mean that you would need two simultaneous exploits for the VPN and SSH to gain access.
> often brought in by accident

also often brought on purpose
Yea and I consider dependent types to be a false idol for the reasons I outlined before. Eventually you just need to compute an arbitrary program within a type check, which is equivalent to just executing the program to begin with.
The implementation of XML is a total overcomplicated disaster in many languages (cough cough Java cough cough). The design and implementation of XML namespaces has all the hallmarks of design-by-committee (where everyone in the committee is an "Enterprise Architect'), but in practice I can't tell you the number of times I've wanted to murder the masochists that overcomplicated namespaces. Don't even get me started on the total shit-show that is XML Schema.

Want another example of how XML sucks, just look at all the "XML Canonicalizations" that are necessary in the XML Signature spec because there is so much ambiguity when it comes to the canonical form of a document in XML.

Basically, the early '00s were kind of a wasteland of all these overcomplicated "Enterprise" specs (I feel like the "Java Pet Store" EJB example perfectly highlights the insanity of that period - layers and layers of unnecessary complexity, and BTW your performance is complete shit), and XML is a bit part of that before the industry as a whole realized how unnecessary a lot of that complexity is.
No, it's not, and it won't.
AFAIK the SATA just takes the set of registers an IDE drive would have, and puts them in a different physical/transport protocol.
That quote even has its own wiki page:

https://en.m.wikipedia.org/wiki/I_know_it_when_I_see_it
That makes no sense. A voluntary pay reduction is like a subsidy leading to market distortion (more supply than the market can bear) and windfall gains (employers might just keep the extra profits) - only that this subsidy is coming from your and my paycheck lol.

The idea is an employer-side argument to counter the labour-side demand for higher wages: Don't have the wages to high, otherwise we go bankrupt and can't employ you any longer.

But programmers are already well employed, and software companies aren't really suffering. Cheaper programmers won't make website less bloated, won't make us figure out what to do with GPT-3, won't find a useful application for blockchains, won't make Windows 10 less moronic, won't make ad-tech less harmful, won't make the tech recruiters and the non-technical folk around software projects more competent...it would simply kill one of the few fields of employments that still pay well!

Look at construction. Did cheap immigrant labour make rents feel low in many areas? No, market forces drive up prices and owners keep the profit.
Raising the cost of attacks is a good thing, particularly if the cost of doing so is not too great.

However, beware that obscurity is in the eye of the beholder, or more relevantly, in the eye of the attacker. For example, script kiddie attackers may be the ones who in the twitter example only scan the default ports. This is an important element to defend against.

But a seriously skilled attacker isn't going to use script kiddie methods. They will use more complete, likely stealthy attack patterns.

Bear in mind that what you think of obscure may be breakfast for a skilled attacker. If you are serious about defense, then you will be compelled to follow the ninja threat model, which, in part, says The attacker is going to sit on the same network segment as the application. There’s no firewall or filters. There’s a special place in hell reserved for products that require firewalls or filtering to protect themselves against attack.

Focus too much on obscurity and you will fall victim to the fallacy of "defense by presumed motive."
You mean Executive Function Disorder and ADHD? Both are highly documented and you can use Wikipedia (and follow its citations, which includes DSM 5) as well as I can. The title of the YouTube channel includes “ADHD”.
“Great, thank you for your time! I hope you find the right candidate for your team”
Show HN: Nearby Doctors API
We ended up having to build a geo-localized national DB of 6m+ medical providers in the US. If you are building an app or website that needs to autocomplete nearby doctors, I'd love to chat about how we can help you help your users. Would love your feedback either here or send to david {at} medcorder {dot} com. Thanks!

Preliminary docs and OpenAPI specs at https://www.medcorder.com/api
That link isn't working for me, it just says video unavailable, but I think this is the talk the OP is linking to:

https://www.youtube.com/watch?v=P2yr-3F6PQo
As always, Apple's effort into presenting and packaging any product they make never ceases to amaze me. Even if it is a mask.

Questions is however: Do I get a reduced AppleCare+ subscription with this and will this be soon obsoleted by an Apple® Mask Pro® Edition? /s

As the saying goes: We can't wait to see what you'll come up with.™ /s
Ninja Threat Modeling
It doesn't really matter if we collect the genetic material if we aren't reversing the actions that caused it to become extinct. For example, arable land is shrinking and population growth as well as an increase in consumption will not leave much (if any) suitable space for some types of wildlife.
> forcing me to turn on location services when I can easily enter a zip code instead

This exists on iOS too. I recently downloaded a wardrobe app that refused to let me select clothes for hot or cold weather unless I turned on location services. Also some fast food apps (either Burger King, Popeye's or Taco Bell...can't remember which one) constantly whine about location services off and introduce extra friction to type in a zip code.
I don't disagree that it's arbitrary, but the person I replied to implied Apple changed the rules specifically to block Hey's app, which is not correct.
But new people in the industry shouldn't think that the things recommended in the article should be used as a primary defense and are accepted industry practices. Moving SSH to a new port to reduce false security alerts is one thing, having people read that article and walk away thinking this is how we do things is another. We don't.
Of course. That's the primary reason I'm personally against tasks on the interview itself or whiteboarding. That's usually a shitshow. We first do an interview where we talk a bit about our company and the interviewee, we get to know each other out a bit and try to find out if we're a good match for each other, based on the talk itself. If that's the case, we give a small (really small and basic, unless a senior position) assignment to take home and get back to us in five days. People have schedules, obligations, we understand. During the period we're always available for any questions, doubts, whatever you need. Assignment itself takes a couple of hours at most for someone that knows / has used the tech. At home, you can use google, stackoverflow, friends, books, I don't care. No one cares, as long as you show up with a consistently-looking code that works and that we can comment together on. You know, same as at work. Something to talk about for a bit, if at all. It's the basics. A damn good filter, it turns out.
Transmitting DSL over an Apple (The Fruit)
It has been possible to run OSX on PCs for quite a few years now courtesy of the Clover and OpenCore apps. There have been countless Github projects, websites, forums etc dedicated to providing material assistance in using them.

At no point has Apple ever gone after the websites or individuals despite it being fairly trivial to do so e.g. DCMA or cease and desist letter.

In fact Craig Federighi has gone on the record stating that they fully support people hacking the Mac, OSX etc and believe it to be an important part of the ecosystem.
The whole thread is interesting... As you said the mis-aligned panels, but also the variety of different materials used in the production patch job (faux wood, white plastic, clear plastic), like Tesla grabbed whatever they could find. Then some customers unwavering faith that Tesla can do no wrong despite evidence staring them in face.
> And now that I’ve publicly admitted privacy is important to me – something I tried to avoid coming on too strong about before, for exactly this reason – some people have taken it upon themselves to post my real name all over Twitter in order to harass and threaten me.

Has anybody applied the Dark Forest metaphor to internet publicity? It's fascinating (horrifying) how simply catching the attention of too big a piece of the internet can start wreaking havoc on different parts of your life. You don't even have to have done anything controversial. Attention itself appears to be caustic, at the extreme.
I would also say, since you mentioned developers making internal corporate apps, that the App Store doesn't really help them at all, and in fact makes their life more difficult, especially on a locked down software platform such as iOS, where you have to jump through all of Apple's hoops just to get your software from one computer to another.

Remember how Apple temporarily shut down a lot of Facebook by revoking their enterprise certificate? We can quibble about whether Facebook "deserved" it, but why is internal software even subject to those restrictions in the first place. I certainly wouldn't call that "liberation".
It solves none of your problems and adds complexity and cost to your defense without corresponding increases to attacker costs.

If you believe there are unknown OpenSSH attacks, you can't coherently believe that port knocking is a real defense, since port knocking doesn't do anything to protect the SSH channel that attacks will be carried out in.

Instead, if you're actually worried about OpenSSH vulnerabilities, you shouldn't be exposing SSH to the public Internet at all. I'm not super worried about OpenSSH server vulnerabilities, but I would never recommend that teams leave SSH exposed; they should just hide that stuff behind WireGuard.
> the industry as a whole realized how unnecessary a lot of that complexity is

The industry didn't, new players did and backed new simpler tech. But that tech itself has, as a result of the same forces in the industry that haven't gone anywhere (and in many cases have some good reasons), progressively had much of the same complication attached to it that XML once had.
Yeah but if they compromise the VPN they potentially have access to a lot more than just the SSH server. At least in the setups I've seen deployed.
> We talked about hashing, and when he asked if I knew what hashing was I said sure, its a one-way function to create a unique identifier. He asked me to elaborate, so I sorta... talked more?

I had a similar experience at Apple where my experience lined up well with the position. I felt like the interviewers were hostile - repeatedly asking weirdly pointed questions about hashing too!
In my experience the talent shortage is a giant myth - there are two thing going on: companies that can't hire or won't pay, and companies that can, but wish it were cheaper.

Evey job I've applied or hired for either a) had lots of candidates with a very selective process, or b) telegraphed that you should avoid the company or didn't pay well enough (and often still got plenty of applicants who wanted their foot in the tech door despite not being capable).

My current company would claim there's a shortage, but they actually don't know how to hire and telegraph that you probably don't want to work there in a variety of ways.
> The tiny little recycling symbols seem pretty useless, unless you force consumers to hand-sort their recyclables according to them.

It gets worse: in King County, WA (Seattle metro area) where WM has most of the contracts we received leaflets from WM telling us to ignore the plastic recycling symbols entirely and to use only WM's "what we can / can't recycle" picture chart - which includes things I didn't think were recyclable (stained pizza boxes) and excludes things that I'd think were recyclable (plastic films).

...and the list varies within the county too: some cities' leaflets say not to put any pizza boxes in recycling (even completely clean ones). Aieeee.
Holding an asset does not result in a capital gain. The Tax the Billionaires bill wants to tax holding an asset that has appreciated in value. Not only that, but they use a handpicked time boundary that from the bottom of the market crash to calculate a windfall tax.

Lets say you owned 1 BTC since the inception ($0 cost basis) and held it until today. The value of 1 BTC has fluctuated the entire time, but you've only ever owned 1BTC.

Here are a couple lows/highs during the period:
Dec 2018 - $3500
Jun 2019 - $12000
$8500 gain (on paper)

March 2020 - $5500
Aug 2020 - $12000
$6500 gain (on paper)

To use the Bernie Sanders standard of 60% windfall gains, you'd owe $5100 from the 2018 crash and recovery. If these types of windfall taxes become a common thing, you'd owe an additional $3,900 from the 2020 crash and recovery. So you'd have paid $9,000 to hold your 1BTC.

If you sell your 1BTC today, you'd get $10,000. With your $0 cost basis, the entire $10,000 is a capital gain. Lets say your long term capital gains rate is 15%, you'd owe $1,500 in taxes when you sell it.

So for investing in 1 BTC, you'd have $8500 in your bank account, and would have paid $10,500 to hold it.

1) Is BTC more volatile than Amazon stock: Yes
2) Does that amplify the numbers in my example: Yes
3) Is wealth inequality a giant problem in the country: Yes
4) Will I shed tears if Jeff Bezos gets a giant tax bill in the mail: No

However, I think it does demonstrate the problem with taxing the change in value of an asset, vs your capital gain from when you sell it.
>They trust the App Store because they trust Apple's curation/privacy/security. That's what has caused this flood of software purchases from consumers. Trust doesn't come cheap.

People buy way more on Amazon, and Amazon doesn't rob 30% of your sales.
> All software security comes down to obscurity

Isn't this the same as saying something like all astronomy is a matter of looking at the right place? Or all math is solving an equation? Or all surgery is cutting the right thing?

If you reduce anything to it's simplest part, it will sound simple.
2 specifically, just to um-actually a minor detail: Rust does have this problem. This code: https://repl.it/repls/LoathsomeCompleteColdfusion

#[must_use]
fn get() -> i32 {
5
}

fn main() {
get();
}

will compile and run. It does emit a warning by default at least though:

warning: unused return value of `get` that must be used
--> main.rs:7:3
|
7 | get();
| ^^^^^^
|
= note: `#[warn(unused_must_use)]` on by default

Without the `#[must_use]`, you won't even get that warning. Result has it, so it's common, but it's definitely not enforced. To get the Result's value though, yes - there's no way around it.
How good a predictor is a GitHub account with open source contributions?
The assertion was that there is a group that values the lack of side-loading, which your post doesn't really address, so I'm not sure why you've responded to me.

In any case:

> the people who really cared about side-loading

> 1. People who care a little bit about side-loading but not enough to choose a difference device.

This is not a useful model. If I choose feature X over feature Y, all you can really tell from that is that value(X) > value(Y). It doesn't tell you whether value(Y) <<< value(X). It's also important to note that this is vastly simplified, because there are many features and issues that people must combine and weigh against each other.

To illustrate, if a product offers side-loading but kills your mother on first use, if you choose a different product it doesn't mean you don't "really" care about side-loading. You might genuinely care a tremendous amount, but sacrificing your mother isn't an option for you.

I differentiate between products that I buy because they are a good option for me and products I buy because they are the least bad product for me. Phones are currently in the second group. It's not that I don't care about side-loading. It's that all issues combined, IOS is less bad for my purposes and preferences than Android.
> Then do the same thing as a random employee. See the difference in how much of your team doesn't show up and absolutely nobody from the other team across the corridor comes.

And then do it not as a random employee, but as the senior employee who isn't technically anyone's manager but who is known for having saved the last 3 major projects by pointing out pivotal details and coordinating with other teams, and observe that everyone who's worked with that person shows up regardless of the org chart. YMMV, but let's compare apples to apples.
Steve, thanks for all your work on Rust!

I'd like to understand more about the arguments for and against a URL-based module naming / resolution approach. Could you point me to any past discussions on this for further reading?
I do not run my VPNs on the same systems I am running other services on, so an RCE at most compromises the VPN concentrator and does not inherently give them access to other systems. Access to SSH on production systems is only available through a jumphost which has auditing of all logins sent to another system, and requires 2FA. There are some other services accessible via VPN, but those also require auth and 2FA.

If you are running them all on the same system, then yes, that is a risk.
As someone who lives near Pittsburgh with a reasonable salary and knows what Silicon Valley/NYC salaries are usually, I am not that upset about it.
> These are not internet-attached devices, they shouldn’t be spying on us.

Should all internet-connected devices spy on us?
It doesn't add enough to compensate for its costs, which are commensurate with those of VPNs, which provide drastically more return on the investment. But VPNs don't have a cheering section, because they're so obviously useful that nobody has any incentive to make that banal observation. "Port knocking" is idiosyncratic and widely looked down on by security engineering teams, so there's a contrarian impulse that makes them seem worth discussing.
What problem was recycling supposed to be solving? Understanding just what the negative of plastic is supposed to be would inform how it is to be dealt with.
They don't have to. For big enough players (think NFLX), these things are beyond their pay grade and are duked out by lawyers who craft these intricate sequences of laws and bylaws so that these apps make their way through. For small players, well what are they gonna do? Stay hungry?
> I hate to say that the signal to noise ratio is not particularly high in 2020.

I agree that there are plenty of incorrect comments, but that's life everywhere... You can't enforce truth for every comment, and especially not in a place with such general discussion.

Also, I've been reading HN for around a decade now, and I actually disagree that it's gotten worse. I like HN of 2020 too!

Are there any other similar sites that are better? (Asking seriously, I'd like to know!)
How can i setup pihole
Do i have to get a raspberry pi or can i rent a server and host it there
I think this has the ability to be similar to Dropbox. Everyone on here knocked Dropbox with “all you gotta do...” alternatives.

I’m interested to see how incumbents like Notion try to compete.
No other note-taking service has been able to get me to stop using paper notebooks the way Roam has. I think it's because the default view is a daily diary and it's low-friction to use it. The linking is simple enough that I actually do it (versus having to remember to do it consistently). I'm undecided if it's software that I'd pay a lot for every month, but it is nicer than Notion for my use case.

All that being said... wow, that's a crazy valuation!
> all the normal literature on overcoming procrastination

Enough for weeks, months, years of reading... and plenty of other people reading it to argue about it with!
No, it's so that if Ticketmaster wants to do in-app purchases for concert tickets, Apple gets 30%
Air-borne embers can travel tens of miles.

Birds can carry burning twigs (deliberately to spread fires to flush out prey).

Arsonists.

Lightning strikes.

Electrical problems: sparks, wires rubbing on trees, faulty wires, broken wires lying on the ground, etc.

Broken glass acting as magnifying glasses.

There are plenty of reasons for wide-spread outbreaks when conditions are 'just right' over extended areas for fires.
Checked exceptions are the poor man's sum types.

They're overly ceremonious for relatively limited functionality (don't encompass the broad range of circumstances where you would want to have multiple return types) and poor composability (e.g. lamdas).
‘It’s a five-alarm fire, a 100-year fiscal tsunami’
>And besides individual action what community action have you taken?

I didn't have any kids.

Its a message that unfortunately most people still refuse to hear (much less accept) - the earth is massively overpopulated. It doesn't matter how think try to dice the onion, there are far too many people for the earth's finite, renewable resources to sustainably support. Certainly our wasteful and overly consumptive habits are accelerating this destruction but no matter how we tailor our habits, the fact is that there are simply billions too many.

Some people ignore this obvious issue because its a difficult problem to solve that carries with it a host of economic and ethical issues. Others ignore it due to religious beliefs, and others because they worship at the altar of technology (which they believe can solve every problem). As long as this remains the case, we cannot even begin to acknowledge the issue and seek solutions.

Some argue that the population levels of "developed" countries have plateaued or begun to shrink slightly but that isn't happening remotely fast enough given the rate of degradation of our ecosystem. Unfortunately, at the end of the day, objective reality doesn't care about our economic or ethical concerns and the sustainable resources we all depend on to survive (the birds, the bees, the wildlife, the oceans, clean air, clean water, contiguous forests, ect) will continue to be degraded and will force a solution to this problem whether through famine, war, disease or otherwise.
Oh thanks! Looks like another Helwer reclaimed it. I think you can message people on linkedin as part of a connect request maybe?
Yet, they do. Lambdas with captures are explicitly modeled as a struct holding the captured values, and a member function that takes its implicit "this".

That function, with its implementation fully exposed, is as easily inlined as any other. The struct is moved or copied as needed to keep it live after the originating context evaporates.
we're not asking programming puzzles. i described our process above. struggling to define a function and basic code comprehension (e.g. tracing a for loop that traverses a json object in candidate's preferred language) is a strong signal that candidate is not a good fit a mid to senior level for us. If it was a junior level position, sure you can learn on the job.