skysight-inc/HackerNews huggingface dataset:
You seem to be thinking in terms of security mechanisms either perfectly blocking attacks or being useless. That's the wrong model. It's about costs. Obfuscating otherwise-open code doesn't mean that nobody can ever figure out what it does, but it raises their costs. Randomizing variables raises costs. Encrypting the DB raises costs on an amortized basis (some cracks may get the key and then it may not raise the cost much, but other cracks may only get the data in which case cost is raised a lot). Things are "secure" not when it's impossible for any actor in the world you don't want to get access to get access, but when the costs to those actors exceed the loss you may experience. (Preferably by a solid margin, for various reasons.)

As to whether this is good or bad advice, that depends on how expensive these things are (e.g., encrypting database fields may be very expensive if you write raw SQL calls as your primary DB interface but may be dirt cheap if you're using an ORM that has it as a built-in feature) and your local threat model (e.g., "dedicated, personalized attackers reading your source" is very different from "does it defeat automated scanners?"). You can't know whether these are good or bad ideas without that additional context.
There's a good early episode of the Reply All podcast on Minitel: https://gimletmedia.com/shows/reply-all/8whoda

One story: They got more business use than you might otherwise expect because they didn't list what services you paid for on the bill. So businessmen were racking up larger charges for sex chatrooms and what have you without having to explain them to their company.
Cool. I guess there's no real reason to solve a problem till it's a problem. Hasn't hurt me yet so optimizing for adoption doesn't seem so bad.
AP can't really make sense because it doesn't explain anything. We know a universe with our values works because we are observing one. Any set of values that "work" in this sense will have someone to make the same observation.

Unfortunately, that doesn't explain how these values are generated. That is the important question.
It was a Dave Matthews Band fan community and I shut it down in 2015 due to server costs, (which the community mostly covered Via PayPal but I had to do fundraisers) looming security issues (drupal and vbulletin integrations that became hard to get security updates for and my own passing interest in the band.

But not because there wasn’t community.

I had a solid moderation and community admin staff and people writing content for the blog.

To your point yes. Any community, band fans to burning man needs new blood constantly or it will die. People move on.

There’s a lot of talk about this in the DOTA 2 community—-fear it will not stay at the top of esports if it doesn’t do more to make itself welcoming to noobs.
> Just use SSH keys, and disable passwords.

CVE-2001-0144 - SSH1 CRC-32 compensation attack detector allows remote attackers to execute arbitrary commands on an SSH server or client via an integer overflow

CVE-2008-0166 - OpenSSL 0.9.8c-1 up to versions before 0.9.8g-9 on Debian-based operating systems uses a random number generator that generates predictable numbers, which makes it easier for remote attackers to conduct brute force guessing attacks against cryptographic keys.

I had a machine almost get compromised from the 1st vulnerability ( noexec on /tmp broke their script ).
When the 2nd came out I was using non standard ports and or port knocking. Despite having vulnerable keys I was safe until I could upgrade.

If a SSH RCE 0day was released:

* every "Just use SSH keys, and disable passwords" box sitting on the internet with ssh on port 22 will get compromised within hours.

* The boxes using fail2ban will get compromised within hours.

* The majority of boxes on nonstandard ports would likely be ok, at least for some time.

* The boxes using port knocking would be safe.
And Asshole it take time to deobsufucate no matter how clever as you are
Operate with the skills you have and the connections you have made. There's room for many kinds of folks, doing work at every level and with most any tools. Its a big world.
perhaps because he gives himself credit[0] ?

Or do you think industrializing a design is not valuable ?

[0] https://twitter.com/NAK3DDesigns/status/1303470020450750472
How do you jump from the initial tens, to hundred to thousands of users? How does the popularity scale in your experience?
Force firmware code to be measured and attested by Secure Launch on Windows 10
Excellent article from Microsoft about firmware security
"programming for a while" and "been at it much too long" are pretty nebulous time frames. However, in general, I personally feel that time is not a great indicator of whether or not someone should be good at something.

My opinion is that you need to take a serious look in the mirror and ask yourself why you're not where you want to be at and if you want to get better. If you do, start with something small. You say you have no CS knowledge, so start there. Take an online course or find a syllabus from a CS course and buy the textbook. Don't worry about how long it takes you to grok it. Just work on it consistently and keep looking in the mirror and being honest with yourself.

If you end up not wanting to put the work in that's fine as well, move on to something that interests you (CS related or not). Good luck!
Hi,

You seem to do a lot of retrospectives right now. That is probably a necessary skill to be a good developer. You are questioning your solutions, looking at other developers' works, understanding that they are doing a better job. I can only say congratulations to you about that.

Do not focus too much on the technology or in what you know at the moment about the technology.

As a first step, you must answer if you want to be a better developer in a specific language or a better professional in one particular industry.

Technologies are too many nowadays, focus only on something you like, even if you know nothing about it at the moment.

The key is not what you have been until today. The only thing that matters is what you want to do.
This is the 21st century version of tattooing a number on each person's arm.
There's becoming a fashion to write fucking awful shite because it's functional so it must be written that way because it's good because it's functional. People need to get out of this habit now.
This kind of child mortality is fairly common for humans historically. Did they know when they'd lost children? Could they remember the missing children? Of course.
I think the focus on "managers have power" is overstated. Places I've worked (as both an IC and a manager) there's also greater responsibility and higher ups hold the managers much more accountable than the ICs. I know many people who simply do not want the responsibility or accountability. Maybe the work is not better or worse, easier or harder, but often there is more pressure/stress.
Totally echo all the other comments in here about imposter syndrome.

Also:

> I can recall my last interview tripping up on questions about very basic OOP concepts, which you'd think I'd have internalized now and there's no way in hell I'd make it past a phone screen for your average whiteboarding company. I know many people much less experienced or even relatively new who are significantly better at this.

Okay, so depending on the question, I'd probably have the same problem. It's hard when someone asks a question like "what are all the uses of static in C++?" It's just not the way a programmer thinks about it, or at least, not how I do. It's a tool, and when I see that word I know what it means, but I can't just rattle it off my head.

So let's say one of the "basic" OOP concept was about multiple inheritance, which is basic in that it's easy to implement (and screw up), but given all the problems, I'd never implement something that way personally if there was any way around it. So I'm not familiar with all the ways vtables and inheritance might work, or which function gets called. I'd probably just say "I'd run the code and look at the output"

Internalizing knowledge is hard. It's more of an instinct I feel than something that is necessarily easy to explain that you know to someone else.

Also, a lot of people are great at interviewing and shit at getting work done. Interviewing has nothing at all to do with work. (which is why hiring is broken)

> I also suppose that I'm an ok "hacker" in that I can get very interested / fixated on certain problems, although my solution is more likely to be a complete mess.

This I think is the first rung for any solution for me. Get it working. Prove it's possible and that you have something that will work, not just "might work" or "hope it works". Then you can refine it. Look at things like names, lines of code, repeating yourself, etc. I've seen a lot of code that looks great but doesn't work. Messy code is sometimes the outcome of a messy problem!

Also let me just close by the fact that at least you have self-awareness of your issues, which is required on fixing them (even if it's just a psychological issue). Many devs write terrible code and think they are gods. I'd rather have someone I could teach.
"It's not a bug it's a feature" is the phrase I usually see thrown about for things like this.
It's an interesting question. Like bounties, I think it would not work, for similar reasons.

Work you contract out is effectively saying: none of you volunteers are up to the task. We'll have to get someone better than you to do it. That's not great for the psyche of the project.

And this has already happened from a certain perspective. (I'm biased here, for the record.) Look at the systemd debate and fallout. At its core, this was effectively contracting out the maintenance of the whole base system to a third party organisation, and telling the Debian developers that they weren't allowed to touch it in all but the most superficial way. This isn't about the technical merits of the decision, by the way. It's about how the organisation went from being an independent technical leader with development driven by its own people, who were highly regarded in their own right, to being a follower being told what to do by others. It took away the primary driver of Debian's independent existence and the agency of its developers to drive change at that level. (It was a minor contributing factor behind my leaving the project.)

And like bounties, there are concerns over who gets the money. Is it subject to favouritism, influence, or other factors.

As I said in the original post, I think it could (and does) work for other organisations. What makes Debian unique is that its origins were a 100% volunteer-driven self-sufficient effort, and that essentially defines the project's culture to this day. Every bit of internal infrastructure and tooling was originally self-developed. I used to maintain some of it myself. Other organisations would have no political issues with paying a contractor to "get x done". But being a volunteer effort, actually "doing x" is as important to the volunteers as the end goal.
> Because the universal solution to almost all the problems you mentioned is to drastically cut consumption.

Yet the thread is about recycling.

Efficiency (in consumption too) is a real valuable goal to work towards. And way more relevant than recycling. So, go on, you have a good problem to solve.
> "CWI established the first connection between Europe and the Internet on November 17, 1988”

Not at all true; I used to connect from the Centre Mondial in Paris via transpac to MIT-Multics to read my email in 1982. And that only worked because those links already existed.
> Well, that just encouraged everyone to choose collapsible names. In retrospect, this didn't buy us much. Who cares about saving a few characters of typing?

This appears to be using evidence to prove the opposite conclusion; if everyone voluntarily chose to use shorter names, then it means that everyone cares about having shorter names. If there is a more substantial argument for why people have decided that the collapsing was mistake, I'd like to read it.
Google out to annoy its users
It seems Google chose 9/11 to start annoying its users.

As of today it would seem they have mandatory modal dialogs on google.com as well as on youtube.com.

The one on google.com is a cookie prompt, Youtube asks you to log in.
By your logic, We don't need borders at all.
I think you can still succeed at development if you want. Interviews are stressful-- don't take that trip up as a gospel reflection of your knowledge. And there's a chance that your "not very good" is better than a lot of people.

But it depends on what you want. There are plenty of tech paths from where you are that don't require hard cs knowledge. You can lean into the people side, building teams. You can focus on wiring up big systems with flowcharts. Or you can imagine this a speedbump and keep going in the direction you know.
There was a whole scandal about this, wasn't there?
> There's not a single language I'd consider myself good with, maybe one or two I can write and maybe one I'm ok with.

Can you get things done in the one or two languages that you can write? If yes, that's already something. Forget OOP, forget whiteboarding questions - if at the end of the day you can build something even if you write sphagetti code it's _something_. I'm of course not encouraging writing unreadable code and I'm in no way saying that OOP is not required-knowledge, but if you can (somehow) get things done you are sufficiently intelligent. The rest is all a matter of putting in some effort (writing clean code takes some practice)

> and there's no way in hell I'd make it past a phone screen for your average whiteboarding company

One of my friends has never (AFAIK) passed a whiteboarding interview. Regardless, if I start a company, I'd pick him over everyone else I've ever worked with - not because he's the greatest engineer ever, but because I like working with him. He loves what he's doing and he get things done, and engages in interesting conversations. Leetcode skillz (IMHO) are so overrated.

> I also suppose that I'm an ok "hacker" in that I can get very interested / fixated on certain problems, although my solution is more likely to be a complete mess.

Most people I know are day programmers - they'll do what you ask them to do, but they'll never do something for the fun of it. This does not make them worse programmers, but I'm inclined to think that given enough time, people who do things for fun tend to get way better than people who just see it as a job. You got to love the process and not just the results.

Also, if you are feeling terrible because you tend to get harsh comments during code reviews, I'd whole-heartedly recommend detaching yourself from the code you write. Now that I look back, a lot of the code review comments I got were annoying nitpicks rather than genuine design/code critique.
Same here. In the evenings and nights with warmwhite lighting 12% brightnes and 10% contrast, during the day usually between 25% to 33% and even during brightest direct sunshine at noon no more than 50%.
Extracting SQL code from SSIS dtsx packages with Python lxml
Because of this: https://crates.io/users/swmon
> For example, `Either[T, Either[FileNotFoundCheckedException, RuntimeException]]` is basically isomorphic to a function that returns T or throws and has the same monad support, but can still force the developer to handle the checked exceptions.

Yes, and I tend to write my code this way (although I find right-biased 'Either' a bit cleaner). The problem is (a) the mountain of JVM code which uses checked exceptions instead plus (b) the Scala compiler completely ignoring that exception information. Solving (a) is unrealistic, but (b) is an entirely self-imposed decision by the Scala developers. Their type checker could have incorporated checked exceptions in exactly the way you describe, and I wouldn't have any complaints (about exceptions, at least... null is a whole different beast ;) )
Depends on their situation and environment. If they have a good manager who recognizes that "helping someone to grow" is better for both sides of the interaction than "drop 'em and take a risk on hiring someone else", and/or if they're in a situation where the engineer can accept the risk that their manager isn't that, it's certainly the best bet.

Employees are an investment. An employee who can take the initiative to flag-up areas that they could benefit from training is valuable.
24bit audio makes sense in the studio to avoid compounding errors from all the effects used to produce the track, but it doesn't make sense for the final piece because 16-bit perfectly represents everything we humans are able to hear [1].

https://web.archive.org/web/20200202124704/https://people.xi...
The problem with real news, and what we can do about it
Monthly current affairs magazines fare slightly better than daily news in dealing with sensational content.

This problem is even worse in tv media. Only a few shows do in-depth analysis of big issues. A notable example being Last Week Tonight with John Oliver.

Another problem not mentioned here is the different levels of interest people have in different topics. For instance, some people may want to know every little news about the new iPhone, some may want to know only the major changes, and some may just want to know when the new iPhone releases. The current news groups readers of all levels of interest into one or two groups only.

Should news have more levels? And would it be practical to do?
Wind carried embers land and start a new fire.

Some of my family is in affected areas. They do nightly ember watch after one nearby home saw a big one flare up.
The short poem "I will not die an unlived life" by Dawna Markova has had a profound impact on me. I don't think about it often, only when I am making big decisions, but it has convinced me to take some of the biggest and most rewarding steps outside of my comfort zone, including living in Germany for 6 months.
> Assume for every code obfuscator there's a deobfuscator or at least someone as clever as you out there.

There is still some information lost in the process:

- "let eigenvector_coefficient = 23" => "let x = 23"

A de-obfuscator isn't going to be able to recover the valuable information contained in the original name. Will it stop a determined attacker? Maybe not, but it would surely slow them down as they now need to spend an order of magnitude longer trying to understand what the code is doing.

> Randomizing variable names it just a nuisance, it won't stop any competent pen tester or attacker.

Believe it or not, nuisances are enough to stop some people. A lot of would be attackers are just cruising for low hanging fruit.

Remember, the goal is to "reduce risk" and not "stop any highly skilled targeted/tailored attack". Because let's face it, even if you are the greatest crypto wizard in the world, you will fall victim to a highly sophisticated attack tailored specifically to you.
I wonder how light you could make this with current tech. A tablet computer + raspberry pi would cover most of the features, plus electrified with today's lithium batteries would make this a beast (pun intended) range-wise.
The supply of database marketing VPs seems harder to define than the supply of engineers who could build production features in large database projects. In particular, the former seems a lot more easily manipulated and dependent on who existing VPs consider qualified.
As they say, there are three things that help - practice, practice and practice. Don't know CS? There is tons of books, courses and tutorials available. OOP in specific? Ditto. Being a better sw architect? Build some non-trivial hobby project, then rewrite and refactor until satisfied.
Modern Dating App Featured on Product Hunt
On Promenad people don’t swipe. All functions are free. You can look unlim profiles, can see who visited your profile and who liked you.
Sure — it’s a business phrase: https://en.m.wikipedia.org/wiki/Blue_Ocean_Strategy
I spent my undergrad years on a music scholarship, while quietly taking computer classes in the background and hanging out in the labs at night instead of the practice rooms. I had talent, but I think even then I subconsciously knew I didn't really want to do it. I got into four out of five of the grad programs I applied to in music--good programs, too!--but I just didn't have the motivation. A summer of interning as a sysadmin and I was lost: I deferred grad school for a year and then never went, and I've been in IT ever since.

The thing it took me a long time (and some therapy) to grasp was that I didn’t fail. I made a positive decision for the direction I wanted my life to go in, and took it. And more importantly, I didn't have to give up music just because I didn't make it my career. I now play multiple instruments and enjoy a much broader array of music than I ever did as a student, playing and singing American traditional, Irish, and folk music with my family and other people. Having let go of feeling obliged to make it a career, I felt free to make it a passion without feeling like I had to succeed. I wish more people felt like they could study music in college in order to make it a wonderful part of their lives, rather than "if I can't be Horowitz, there's no point in continuing with this".
Vanilla.js
The rule of thumb is “the closer you are to the money, the more you make”.

People rarely demand what they are worth since they usually value security over maximizing income, but if you are familiar with the numbers, then you are in a much better negotiating position.

People should always keep applying to jobs, even if they don’t intend on accepting them just to keep a pulse on the value of the labor they are selling.
Imposter syndrome is not something that just goes away magically. People often feel it throughout their entire careers. Also right now everyone is under additional stress, so I wouldn't be surprised if this is exacerbated.

Also, you may want to get checked for ADD/ADHD if you find you can fixate on things, but have trouble focusing on broader tasks.
Being a generalist doesn't get you a job though. I'm in a similar position to OP and, while I can figure out a problem given enough time and motivation, I can't adequately answer most interview questions and I fail most coding interviews. I don't know if I use ES5 or ES6 or whatever and I don't know the difference between Java 7 and Java 8 (8 has lambda expressions or something?) and I don't see why I need a wealth of experience in the latter in order to maintain a Java application. Before every interview I have to look up the difference between an interface and an abstract class because, while my brain knows when to use which, I can't explain it in concrete terms and I don't know the difference between the two across different languages. I can't explain DI and I have no fucking clue what a FactoryFactoryBean is because I've never had the need to write one so how am I supposed to have this experience? I don't have enough time to dig into the particulars of a language or its compiler/vm/interpreter or microservice design patterns and I'm sick of having to be passionate about programming outside of work in order to even stay employable. All of the jobs I've ever had have been through friend connections and that well's starting to dry up with the pandemic and all. I'm sorry for the frustration dump, but I've truly grown to fucking hate this field. I'd just quit and be a bartender or something if I didn't have tuition debt to repay.
Recently there has been a growing interest in developing AI for cooperative games, like Hanabi. I believe the challenge originated from a paper by Google Brain/DeepMind [1], but several other groups have tackled it, including Facebook AI Research [2].

[1] https://www.sciencedirect.com/science/article/pii/S000437021...

[2] https://arxiv.org/pdf/1912.02318v1.pdf
Why is he not banned / moderated?
Startup Ideas for Inspiration