skysight-inc/HackerNews huggingface dataset:
Setting aside all the imposter syndrome, confidence, etc stuff...

The only devs I've known who I thought were legitimately bad were the ones who thought they weren't. The devs who couldn't accept that their code was overly complicated, because in that moment they had no problem reading it. Or who would come out of the end of a project without any ability or desire to think about why or how the project went wrong.

Some devs dig deep into the language and libraries, some don't. There's need for both kinds of devs out there, even if there isn't at your company. Some devs know every design pattern out there, some don't. I often prefer the devs who don't -- my goal is to quickly build software that is easy to debug and easy to add on to, and people seem to usually get caught up in putting whatever type of factory where a factory shouldn't be and...

Really, though, we all suck. I've got senior devs from Amazon and Microsoft who don't know or care about dependency management or how to write integration tests or... whatever.

What do you want to be good at? Intentionally pick a thing. Not "programming" but do you want to be the best at debugging your team's software? Do you want to know all the gotchas and tricks of your team's language & framework(s)? Do you want to own a particular bit of your company's business logic? Pick a small thing you want to be the best at, figure out what that actually means, and then master that thing. Even if "that thing" is just being able to quickly add simple, not-awful-to-maintain features. Grade yourself on that, not every single thing you might see some particular other developer do better at than you.
Compilers: Lisp

Nothing comes close to efficient tree matching or list processing, esp with its macros.
You go first let us know how ot goes.
Location: San Francisco, CA

Remote: Yes

Willing to relocate: Yes

Technologies: Ruby(Rails), Python, Elixir, Erlang. AWS. GCP

Résumé/CV: https://www.linkedin.com/in/erikdnilsen/

Email: enilsen016@gmail.com

Backend engineer with 9 years of experience building and scaling web applications.
This is essentially a magazine, or at least a zine. There's niche interest in these kinds of things. I think if the content has lasting and unique value, something that I'd want to keep around for a long time, then yes. Otherwise you're sending out junk mail.
But does that make them different or are they just things that are easy to verify? If you could calculate the entropy of another authentication scheme would it be included?

The danger of security by obscurity is that your system might not have as much entropy as you initially estimate and can be easily defeated. Sounds a lot like the vulnerabilities in normal crypo applications, right?
Thanks for that, I had seen the same acronym on that article from today of a (I think former) Salesforce staff engineer describing her experience there, and of course that I didn’t know what it meant.
Mostly a bunch of pretty-reasonable clarifications, but there's also a few that seemed aimed at Epic Games and co. Changes from previous guidelines in italics:

> 2.3.1: Don’t include any hidden, dormant, or undocumented features in your app; your app’s functionality should be clear to end users and App Review. All new features, functionality, and product changes must be described with specificity in the Notes for Review section of App Store Connect (generic descriptions will be rejected) and accessible for review.

> 3.1.3 [...] Apps [allowed to use payment methods other than IAP] cannot, either within the app or through communications sent to points of contact obtained from account registration within the app (like email or text), encourage users to use a purchasing method other than in-app purchase. [previous: You must not directly or indirectly target iOS users to use a purchasing method other than in-app purchase, and your general communications about other purchasing methods must not discourage use of in-app purchase.]
Thank you for phrasing this so succinctly. Self-similarity pops up again and again in nature. Mostly we think of this in terms of geometry (fractals, etc...) but why couldn't self-similarity also apply to time oriented processes like cosmological evolution?
Should they could check if Kevin DeAnna is available to fill Thiel's position?
...so nobody notice the mess your solutions are. They work.

I’ve found what’s a mess and what’s not is often subjective.

Oftentimes the comments a guy makes in a code review come down to whether he enjoyed his breakfast that morning.

If your code solves the problem, it’s good enough.
The tube and the product are part of a holistic design whole.

Pringles are made by pressing ground up potato paste into a disc shape and drying them. That makes them weaker than regular potato chips, necessitating a rigid tube container.

You might ask why make chips that way in the first place? My hunch is that they exist as a way to use up byproducts produced by other potato products. Sort of like how sawdust from lumber production is used to make particleboard.

Pringles are essentially edible particleboard.
> Another narrative is that recycling rate shows that it is itself functioning as part of the solution to the social safety net.

In my experience, no one in good faith argues that bottle deposits are a part of the social safety net, let alone a functional part.

Edit: to clarify, mine is a US centric experience. I think the argument for recycling collection as a tool of economic mobility is perfectly sound as long as it's not economically coercive (i.e. if the safety net is adequate without resorting to roaming the streets collecting recyclable material).
Lombok has @SneakyThrows which does pretty much this but without the additional wrapping.
YC doesn't have any involvement in China. There was an attempt to set something up a few years ago but it has been unwound.
Yeah definitely, some even more. This is only applies to tech though, in finance VP/SVP is that senior of a role. A SVP in tech equals a MD in finance.
The problem of "security by obscurity" is that it assumes that the whole security is obtained via obscurity, whereas "more security obtained by obscurity" is good as it assumes that obscurity is used as defense-in-depth.
> Did Apple ever bother to implement that at all on IOS? As I recall they were not in a hurry to implement that when the iphone launched originally.

SMS and MMS on iOS both predate iMessage: https://www.theiphonewiki.com/wiki/Messages
> You're talking about a country that has active concentration camps, runs its citizens down with tanks, and harvests the organs of political dissidents.

As opposed to countries that wiped out indigenous and stole their lands, enslaved people based on race, killed protestors, experimented on people without knowledge or consent, dropped nukes on civilians, etc?

> As a gay man, I'll be first up against the wall if freedom dies.

I guess you haven't heard about what democracy did to alan turing? And no, natives, jews, blacks, chinese, etc will be lined up far ahead of you.

> “The only thing necessary for the triumph of evil is for good men to do nothing.”

Like all quotes, it's superficial nonsense. Every evil doer thinks that they are the "good guy". Pretty much all evil is done in the name of "good". The nazis, islamic terrorists, japanese imperialists, british empire and the people who nuked innocent civilians all think they are doing good. They all use your quote.

The true evil are the ones who portray themselves as good and the other as evil. Those people who are so ideologically brainwashed as the ones capable of true evil.
Exactly. If you're running crypto and think getting rid of variable names is going to stop people; it's not. Any off-the-shelf algorithm is usually easy to recognize to an accomplished reverse engineer with a basic background of what kind of things they're looking for.
The only reason I did well in my OOP interviews is because I read a book on OOP design patterns in the months before I graduated with my CS degree- I didn't know any of that shit from school.

The only reason I did well whiteboarding is that I spent months doing codewars.com bullshit to prepare for white boarding.

That's how people do well in these interviews- they game the system and optimize for the interview, not the job.
There are still geeks doing quirky and whimsical things with computers, there always will be. They are just harder to find in all the noise.
My understanding is that it's important to keep SSH (and other services) on a privileged port. (I think the default is <1024.) Otherwise, unprivileged malware that could cause the SSH server to crash and take over the (unprivileged) port. No idea if this actually happens in practice though.
I had a realization a while back, that in my opinion LaTeX isnt really needed anymore. Pretty much anything you can do with LaTeX, you can do with HTML. Want a PDF? Most browsers will print to PDF now, or you can use a library like this:

https://github.com/dompdf/dompdf

Need a page break? Here you go:

https://developer.mozilla.org/Web/CSS/break-after

Im not sure what you would do about TikZ and stuff like this, but I have seen some pretty wild stuff in CSS, so surely its possible:

https://pattle.github.io/simpsons-in-css
Absolutely. Director levels at many large tech companies certainly earn > $1M, even before stock appreciation.
The role only makes sense as a stepping stone if you don't already have a high paying private sector job.
Hey, can you please not post attacks like this, or unsubstantive comments generally, to HN? We're trying for a different sort of forum here. If you wouldn't mind reading https://news.ycombinator.com/newsguidelines.html and using HN in the intended spirit, we'd be grateful.
China Would Rather See TikTok U.S. Close Than a Forced Sale
Bingo. Self-organization, in a strong sense, is the process of cosmological evolution.
Sounds horrible to see potential squandered again and again.
1st - is there actually a higher statistical likelihood of poor people reoffending? Rich people go to jail less often, so I’d imagine those that do might even have a higher rate.

2nd - if you wanted to drop the reoffense rate, as well as the offense rate, what would you do? Why aren’t we doing it?
Using a non-standard SSH port is a bad example because nmap can see through that deception in a few seconds. Any attacker who is looking for more than just the lowest of low-hanging fruit will not be even slightly deterred.

A better example would be a port-knocking arrangement that hides sshd except from systems that probe a sequence of ports in a specific way. This is very much security by obscurity, because it's trivial for anyone who knows the port sequence to defeat, but it's also very effective as anyone who doesn't know the port sequence has no indication of how to start probing for a solution.
I made a link to the old video on Reddit
I know this is a physics paper and not a math one but as a mathematical physicist / relativist I find it very confusing that you treat "orientability" and "time-orientability" as synonyms. These are completely different concepts, though, see e.g.

https://physics.stackexchange.com/questions/14168/orientabil...
What is to serialize? When do I need to do that?
The point is that if you try to be a selfish bigotted dick and create profiling to shift the inconvenience of security delays onto the other you create a gaping hole for that shortcut - don't look the part and then do damage. It is a bad policy morally and practically meaning the only rational reason to support it is being an asshole who sees the harm as a good.
Imagine how much further ahead HTML/CSS would have been if the academic crowd abandoned latex 20 years ago.

Revisit this comment in 5 years.
(Air Force brat): There's a lot of interesting game-theoretic stuff here too. If none of your prisoners dilemmas are iterated (or only iterated few times), defecting is always advantageous. There are lots of tradeoffs with "long distance" consequences you can make, but get pulled away from before they ever hit home.

These sorts of environments just have a /lot/ less feedback. Pros and cons for sure, but being blindsided by basic life lessons in your 20s that others learned in adolescence isn't particularly fun.
Rock the Excel Sheets with VBA
Our Firebase Tech Stack
Can't be stopped for texting and driving if the laws for that don't exist yet!
I make roughly 200k USD per year as a newgrad (once you count equity and bonuses, pre tax)... Of course senior engineers make way more, and senior VPs more than your average senior engineer.
Yeah, it's not obvious what the person I linked's intent is. Resale? I'm pessimistic that the above mechanism would work but I'm glad that rust is thinking about it.

fwiw I also don't think namespacing necessarily solves this problem, it just shoves the squatting problem up a level.
> An argument against obscurity is that it adds additional pains for your "regular" users (as in developers/3rd party developers/app developers)

No one should be applying obscurity to public-facing APIs or anything for which documentation is widely distributed outside the company.

A better example would be Snapchat's intense and always evolving obfuscation strategies: https://hot3eed.github.io/snap_part1_obfuscations.html

Even though someone took the challenge to de-obfuscate most (but not all) of the protections, just look at how much effort is required for anyone else to even follow that work. More importantly, consider how much effort is required relative to other platforms. It's enough of a pain that spammers and abusers are likely to choose other platforms to attack.
Most people don't seem to care about data privacy
> less opportunists = less opportunities.

You miss 100% of the shots you don't take applies to hackers as well.
Maybe this is why so many high level positions include a golden parachute.
> Only the 4th point is really true: if you run SSH on a non-standard port but it's otherwise accessible, you'll still see scans on a regular basis.

Possibly.. It does depend on the port. 222 and 2222 often are scanned with 22. 2200-2299 is probably common now. I was using 2221 for a bit but after a few years that started seeing some auth attempts.

I mostly watched entire /16s, not single hosts.. the scan patterns for a large netblock are very interesting. It takes as much effort to scan the entire internet on port 22 as it does to scan all ports on a /16.. attackers simply do not do that.

The benefit of some of the port knocking systems is that the attack surface is almost nothing and they are easy to audit. I used it a few jobs ago on my management system/bastion host. I couldn't rely on the VPN since I was the one that managed the VPN, so I needed a way to securely login remotely that did not go through the VPN, and did not end up having sshd exposed to the world.

These days I run sshd at home behind https://www.tarsnap.com/spiped.html

Ubiquitous wireguard may change things.. we'll see.
Whow. They really met on a south-east asian island to conspire against the state?
Why Don't VCs Index Invest?
My main purpose of tools like these has always been prototypes, or hobby one-off type stuff. For SPAs, or a sketch with a Jupyter notebook. They're great for this sort of thing because in my experience, this used to require building some sort of API just to get a simple json interface to the database. It was my understand that the purpose of these types of tools was mostly that.

Are folks using these kind of things for non-trivial production applications?
Tooting -> Kings X is 49 minutes according to citymapper. Cambridge -> Kings X is a 48 minute train. I personally wouldn't consider Tooting to be deep south, but maybe we have different definitions. I have a friend who lives near Kingston, it's roughly an hour commute for him.
That is experimentation. This is organization say it lets people to make mistakes because of potential payoff.

If the organization did not believe in potential of value from these ventures there would just be a small limited amount of languages to choose from because it is more economical when you consider support system. This is starkly visible in banks where there is huge need for development support system but no belief in value from ventures into obscure languages. The end result being that everything is written in Java and maybe couple other JVM languages (just because it is easy when you are already invested in JVM).
Just a tip, since I notice the author included it in their poll: "nmap -p0-65535" can be (almost) abbreviated to "nmap -p-". That excludes port 0 but is otherwise identical.
Security by obscurity refers to obscuring the design of a system, not obscuring credentials.

Hiding your password isn't security through obscurity. Hiding the fact that you need to say a password to get into a building is.

Protecting your encryption keys isn't security through obscurity. Hiding which encryption algorithm you are using is.
Except this is the kind of thing that you can get around if you know the person and/or the account.
No, their first paragraph was a prediction. Their second was a assertion of fact without any evidence provided. They could have hedged that statement with "I think", or "in my opinion", but instead they went with "They're wrong; full stop, no qualifications, no asterisk, no footnote, they are totally wrong on this". Strong assertions require strong evidence, and not providing that evidence deserves to be called out. At least that's generally the consensus of the community here, as I see it.
That's a better rationale, although I don't think that really solves your stated problem; as an uninformed user I am still more likely to think that iglu/iglu is the more authoritative source there. Given this, any project that wants to authoritatively own its identifier should probably also register its own top-level namespace... which unfortunately brings us back around to where we started.
Isn't there some model where the keys that you use to decrypt the database are acting something like one time codes, and you have to use particular credentials to access the key server? So the attacker would need to be able to stay in the network to be able to actually access the data -- they couldn't just download the entire database and crack it offline. I don't know how that actually is implemented, but just curious on that.. I also wonder how many people put things in their various systems that are obvious attacker trip-mines -- like having some fake button that says like "copy image of database to disk" or something that the actual internal employees are told to never click that button -- but maybe they have even some confluence page that talks about "how to download the database", but is actually a fake entry meant to trip up an attacker in case they get access to your confluence pages as well as your database.. so they click that button and the admins get alerted...
Security is not just about preventing attacks, but also about detection and response.

In detection, honeypots are very useful, like a machine named gitlab.yourcompany.com in your internal network, but which just alerts SOC about login attempts. That's pretty much obscurity.
I work for a large communications company. We had this top-down approach for a really long time. It doesn't work too well. Essentially you're blocked from using something until its a "standard" at the company and the larger the development team the longer they take to converge on a "standard". The standards still exist now, but they're more guidelines. If you use the standards (Python/Java) you have a lot of existing tooling that you can utilize to get your project off the ground (e.g. APM tooling, docker build templates, SDK for internal apps, etc.). You can use other languages if you want to but you're going to have to do the tooling yourself. So, although Go isn't a "standard" for app development it is used to create k8s operators, etc.
Rust's macro system is not what makes its "system equivalent to checked exceptions" bearable.

That the language provides tools to operate on both results themselves and their content (in part because results are reified and thus normal values of the language, and in part because specific tooling like `?`) is what does that.

Also that there is no issue of misclassification as in Java, because everything is a result and that's that.
True, normally RetroComputer Clubs are a good starting point.
How to Join a Team and Learn a Codebase
Oh man, that's heavy. I'm of the opinion that you have to enjoy what you do for work to have a decent quality of life.

If you don't enjoy it, find something else! If you hate it so much that it makes you suicidal, doubly so. I tried doing the "practical" money making thing, and it made me miserable. Programming is the thing I found later that brings me joy.

Find what brings you joy, and do it. Until you know what that is, explore. Hop on a bike and ride across the country. Move into the woods. Go volunteer in a developing country (some positions provide room and board, you just have to get there, but the pandemic does complicate things). Literally anything other than 1) what you are currently doing 2) suicide.

I have been there and I feel for you, truly. No matter how it feels, there are other options. Take care of yourself and hang in there. From someone that has been to the very bottom and made it back, it can get better.
The way Rust does it is not perfect, but it's the best I've used so far, IMO.

Rust, if you are not familiar, has a special operator that let's you call a function that returns Result and automatically unwrap it and return early if it's an Error rather than Success. It will even automatically CONVERT the error for you if you've defined the proper trait implementation to convert the one error type into the other.

So, in Rust the boilerplate happens ahead of time (implementing the conversion trait), outside of your function's internal logic. In your function you just write:

fn foo(): Result<String, Error> {
let f = something_that_can_faile()?;
uses_the_success_value(f)
}

No try{}catch{}, no match statements, nothing. Just a question mark.

Swift also strikes a nice compromise, IMO. It just has a throws tag like C++, except it actually works.

I never considered a warning-level check for Java's checked exceptions. That sounds like a nice idea at first blush.
I imagine developers as experienced as the creators of this evaluated the C options and decided C++ was in fact not more of a detriment than a gain.

It has its problems but blindly being anti C++ is silly.
Strauss is great but they need to use amber glass bottles to protect their delicious milk from light.
DRM has the problem that it is illegal to bypass, even if your intent is not malicious.
Configuration or YamHell would be my choice with Cuelang as the answer.
I'm pretty sure the potential recruitment pool of young Arab men is still many times greater than the pool of Irish girlfriends of Arab men.

It's about improving the odds/reducing the exposure, not achieving some theoretical absolute perfection.
And it still doesn't matter, because sshd literally never has the private key that allows access. If a server only allows access via SSH key, you could literally have a complete RAM dump of the whole system and not be able to access it.
Like what they told Epic, its all about Money and control
> I'm going to find whatever port your running ssh on if your running it.

Not if you have to port knock before the ssh port is open to new connections.
100% agreed, except "5" should read "2"
I've been in marketing for a while and my technical chops extend to being able to "run the demo" and even that gave me opportunities that others didn't.

One of the most valuable people on my marketing team when I was at a large company was our "Tech marketing" person. Someone who could build the demos and POCs and answer technical questions from customers and prospects. Maybe something like this or a "Solutions Engineer" could be a good fit