skysight-inc/HackerNews huggingface dataset:
This is the problem. I can't prove based on an objective source I can drop a link to, because it's all classified. That's literally the crux of the problem. When someone says 'trust us, we have all this evidence, but we can't let you see any of it because it's a secret,' does your skepticism not trigger in the least bit?

I can say that there are only 11 judges listed as being on the FISA court, and I don't believe that 11 people can personally oversee every instance of the NSA conducting surveillance on all potential Americans of interest around the planet. Maybe they can. Who knows, it's classified.

Congress is a different branch than the presidency, doesn't mean Mitch McConnell is an independent check-and-balance on the authority of the president.

It's literally their job to be aware of that. They have a staff whose entire job it is to keep them aware of that. If they can't keep track, what's the difference between them and the congressional committee that's supposed to be keeping tabs on the NSA?

The people who do national security for a living are in a bubble that facilitates the construction of boogeymen. And if they can't give me any credible evidence as to the existence of said boogeymen without saying 'sorry, that's all classified,' then why should I believe otherwise?

Right now I'm supposed to be scared of China, but I personally see no evidence that I should be more worried about them than my own president who covered-up the threat from Coronavirus in February, and then tried to blame it all on the Chinese as a diversion. Looks to me like the Chinese were actually trying to warn us in February, while the President was trying to cover it up:

Clinical features of patients infected with 2019 novel coronavirus in Wuhan, China - January 24, 2020
https://www.thelancet.com/journals/lancet/article/PIIS0140-6...

Clinical course and outcomes of critically ill patients with SARS-CoV-2 pneumonia in Wuhan, China: a single-centered, retrospective, observational study - February 24, 2020
https://www.thelancet.com/journals/lanres/article/PIIS2213-2...

If the Taliban aren't a threat to U.S. national security, then why was the longest war in American history fought on Afghan soil? Isn't that where all those 9/11 hijackers were from, and the country that bankrolled them? If they weren't from Afghanistan why didn't we sanction or invade the country they were actually from, and that gladly bankrolled the operation? Is that classified too?

https://www.npr.org/2020/05/13/855611173/fbi-accidentally-re...

Oops... I guess it isn't anymore.
easy. just stick it out for couple of years and move up to management. I know tons of ppl who did this.
> Most of my code is error checking and handling.

> Plenty of noob code ignores errors.

You can encode errors into the return type of the function to force people to deal with errors. Here's a good example:

byte[] read() throws IOException
// vs
Optional<byte[]> read()

Both cases force the user to consider failure cases.

Checked exceptions are essentially modifying the return type already, just in a different syntax. It's inconvenient because the nonstandard syntax for the type doesn't work well with all the other return types. It's still a bit inconvenient to use the other option in Java though because there's no language level support for real tagged unions (sum type) (union type). https://en.wikipedia.org/wiki/Tagged_union

The other class of not handling errors takes a bigger conceptual leap:

void write(byte[]) throws IOException
// vs
Optional<Void> write(byte[])

The caller could just ignore the value in Java, so your criticism is still valid. However, you can force the caller to never implicitly ignore return values. If the function 'throws' by returning a value, you have to explicitly ignore it:

val _ = write(bytes);

If the function can't throw (i.e. the return type is strictly 'void'), then you don't have to do anything:

write(bytes);
Imposter don't present themselves as such.
For a very specific example, look at the classified ciphers used by the US Gov't TLAs. Why are they classified? Because if they are harder to get info about -- literally obscured -- then it's an additional layer of defense.

Or troop movements during war... Sure, the locations can be figured out, but by not broadcasting locations that's more work for the enemy and thus a bit more secure.

Obscurity is absolutely a key piece of security, because it adds the complexity of discovery.
Is Netflix moving off Ruby and Rails?
Lambdas are compiler friendly. They reliably inline unlike standalone functions. It's not laziness, it's an optimization.
So 100 new listings on the App Store, plus a 30% cut to Apple, when Google and MS are hosting the games on their servers?

This is the worst way this could have been implemented. How could they even justify forcing a listing and a 30% cut for something that they don't even host? It just has to be streamed from a server. They have 0 costs.
Passwords and keys are not "obscurity", they are mathematically difficult to break if done correctly. There is no mathematical guarantee for security by obscurity.
The first book of his I read was Intellectuals and Race. Economic Facts and Fallacies is similar in terms of how the arguments are framed (though it touches on different subjects). I'm not sure if this is true of all his books but I would recommend looking through his complete works (there's a lot) and picking one on a topic you're particularly interested in :).
This is neither surprising nor concerning. It is exactly what you would expect from a coronavirus, remembering that a lot of what we now call the common cold is caused by various coronavirus strains. It would be shocking if we did _not_ see re-infection.

The important questions are as follows:

1. What is the _severity_ of reinfection?

2. What is the average immune response of re-infections?

3. If the infection is less severe, what is the shedding rate? How infectious are the re-infected?

4. Does re-infection occur in those who receive mRNA vaccinations (this is not really testable yet)

The pearl clutching with everything COVID related is quite concerning, moreso than the disease itself. The science is interesting, but the medias obsession with exaggerating and fear-mongering this disease is incredible. With that said, I appreciate that the link is to the paper, and not a media report on the paper. However I do await the stories that this proves we are all doomed :(
I've been the Director. HR mostly sets salary bands. The recruiter, candidate (via negotiating), and hiring manager can only really move around within those bands. Those bands are largely based on market research.
If I'm remembering right, something similar kind of happened with uBlock and uBlock Origin, but it was the original maintainer who came back and forked after the new maintainer became hostile, or something like that.
Hey, thank you! You can purchase a subscription on our website: app.tappityapp.com
Sending you hugs
CNCF End User Technology Radar: Observability, September 2020
Yes, it’s been tried before. Ethan Couch[0] used it to get a low sentence after driving drunk, killing four people and injuring nine quite greviously. The basic argument was that he wasn’t given any feedback as a child, and needed rehabilitation, and managed to get him put into rehab and 10 years probation.

Given that he was re arrested two years later for drinking and violating probation, it doesn’t seem like the rehab worked.

[0] - https://en.wikipedia.org/wiki/Ethan_Couch
That is not the definition at all. If I kept track of my passwords by making them the first letter of each page of various books on my bookshelves, that would be security through obscurity, because, while if someone who broke into my home knew about my system, it would be quite easy to extract all my passwords, but if they didn't know about my system, they would be looking forever for a notebook with cryptic letters in it, or sticky notes on the monitor, etc.
Maybe a bit nitpicky but I think port-knocking is in kind of a grey area. You can think of it as a kind of password where you have to know the correct series of ports. Since the number of ports is quite large, there is also a correspondingly large number of possible port sequences so you can't, in principle, brute force it without a lot of effort.
Well, LaTeX is great for mathematical symbols. I have not seen a typesetting in the web space that can compare itself to LaTeX. This is why scientists from the exact sciences use it.
I wasn't even addressing the crates.io team, i was addressing the author of the post.
> I just asked them for the guy squatting my first name and they gave it to me.

Your... first name? So "rene" (if I was to assume a few things about your username)?
Firefox has had MathML support for a long time. Complain to Apple and Google (and vote with your browsing activity, by using the browser that is less driven by commercial considerations).
ICs largely wield informal power within organizations, managers have real formal power, codified in organizations charts, rules and regulations.
Whenever there is conflict between the two, almost always formal power wins over informal. Not the least because managers control salaries and hire/fire decisions.
Apple: Person-to-person experiences do not have to use in-app purchase
> Security by obscurity alone is bad, but as another layer, it can be great.

I beg to differ in your case.

Had you left SSH on its default port, what would your expected time-to-compromise be? Presumably you weren't using a root:password credential, or else your system would not have remained up enough long enough for you to implement any obscurity.

But if an attacker, with full ability to try logins, could not reasonably guess your login credential in the lifetime of the universe (i.e. public key SSH or a strong password), then you've not improved security by moving to a port-knocking model.

You have reduced nuisance, but nuisance isn't part of the standard threat model for SSH security.

To put it another way: you've not seen another unauthorized login attempt, but would you be comfortable relying on that and use root:password as your access credential?
I have some experience with government IT (state and municipal, not national). Anyone in this space knows that changing the bureaucracy essentially requires a legislative or executive mandate. My team once got intense push-back trying to change an extract file's date format from MMDDYY to MMDDYYYY.

I suspect the person in this role won't have the power or authority to do that. Clerks are notoriously protective of 'the process' and resist any changes to it.

This honestly sounds like a miserable job and anyone who's actually worked in this space would agree that this person has virtually no chance of succeeding.
Everybody sucks at programming and there's always somebody who's better at it than you. Don't beat yourself up and keep doing what you enjoy. Things will fall into place when the time is right!
It's part of it, but I only built the app after realizing the method (which is based on something called The Sedona Method) really worked for me. I just found it super tedious to do on paper and over time added more features that help to get into a mental state where emotional release is possible.

I'm now building a business around the app and that path has multiple emotional pitfalls per day. I tried to do this a few times before and always succumbed to my fear, guilt and worthlessnes.

This time, I'm using the app on a daily basis and snap out of my funk (usually) in a matter of minutes.

So I'd say the app is helping me feel better which is allowing me to keep building it - not the other way around.
Literally new grads make $200k+ at any respected Silicon Valley company.

Senior individual contributors are probably making $350-500k a year.

Directors easily hitting $500-1m a year.

And we're not even at the VP level yet.
You know what? GOV.UK used to be an amazing team. I mean, seriously, some top talent and a really productive team. They did a remarkable job of understanding the art of the possible and writing clear guides that ordinary people could understand.

And then the rest of the civil service and the government saw its brand reputation as a resource to be used much the same way that slash and burn farmers view the Amazon. Most of the great teams left. Much of their material is still there, but it's not growing.

So yeah, that's why.
Because this guy doesn't seem like an imposter
> Being a generalist doesn't get you a job though.

It probably doesn't get you an absurdly-high-paying FAANG job rewriting code someone else rewrote the year before, but I guarantee you any competent generalist in IT can get well-paying job without much trouble. There are a lot of places out there that can't afford to have a specialist in everything they do, but can afford the kind of person who is willing to tackle any problem put in front of them.
Everybody sucks at programming and there's always somebody better at it than you. Just keep doing what you enjoy and things will fall into place from there.
"There's not a single language I'd consider myself good with"

If possible try to focus on a single language. Build a lot of different little things to cover the breadth of the language. Find a job where you only need to contribute in that language. When you become proficient at that language (this can take years!), then you can pick up other languages much easier, and you should feel more confident in your knowledge.
How do you do all this with family obligations, reliance on health insurance, and little fallback cash in the bank? This is a good idea for someone struggling to figure out what they want to do in college but a lot of us millennials who can't hack it on the coast are still paying down debt and are anchored to our situations.
Grass is always greener...

It can be a tough decision, but I have been through it enough times that I don't really care what the options package is. I just want one if everyone else gets one, but otherwise I look at salary and benefits. Because most likely the shares will become worthless, and if not, I most likely won't be around to see the liquidation event. I never exercise unless I know for a fact a liquidation event is coming.
In some ways they are actually much easier to find.

Now we have makerspaces, like Noisebridge, chock full of geeks hacking on all sorts of crazy and interesting stuff.

There are forums like Hackaday and various engineering blogs and vlogs.

HN itself occasionally has a good lead.

All of these people are easily contactable now, whereas in the past you might struggle to get in touch with them even if you'd heard about them somehow, especially if they were in another country.

Now distance is not really an issue any more, and you can even do video communication with them, easily trade schematics or anything else you may wish to know or have pretty much instantly.

This is truly the golden age of hacking right now. Enjoy it while you can.
https://en.wikipedia.org/wiki/Serialization

It's a fancy name for turning internal program data into a stream of bytes (thus the "serial" for "sequential") you can send to another program/computer or save to disk.
Perhaps you may enjoy Python ;)
I've been programming for 40 years now and can tell you that I'm still learning. Embrace it! You describe keeping up with technology and keeping up with programming (switching languages/frameworks, etc) is no different. I'll also tell you that it's common for me to look at code I wrote six months ago and hate it. That used to concern me but I now realize that it's because my craft has improved in those six months.

Finally, others will surely tell you if you're a horrible software engineer. If you're getting constructive feedback from peers you consider superior to yourself, that's a sign they see something positive in you (why would they invest in you otherwise).

TLDR; Classic imposter syndrome

EDIT: Unless you've purposely misspelled your handle here, please, please, please make sure your spelling is correct in your software. It drives me nuts to search on a term I know should be in the code and fail to find it because of a transposition or homophone error!
It has gotten much better but in our project we got bitten by this. I gave a talk about it at GoSF last year if looking for some Go v2 modules schadenfreude :)
https://www.youtube.com/watch?v=8xAaZDSDWOc
How are any of those operations effected by capital gains? They aren't talking about moving money around, they're talking about selling stock that has appreciated in price.

With regards to frontrunning, the problem isn't that XYZ is trading at $5 and I get charged $5.05 because I put in a market order - or at least, the problI don't think you fully understand frontrunning either.em isn't _just_ that. The problem is that between when I send my limit for $5, the price drops to $4.95. But through whatever mechanism, latency arbitrage, order flashes, whatever, the HFT knows my order is coming in at $5, and they scoop up all the liquidity and sell it to me at $5.

Sure, if I priced the security correctly, $5 is a fair price. But I took market risk and I deserve the reward of buying at $4.95. The HFT, entering and leaving positions only when they know someone is coming, is taking no market risk, and is stealing my gains without providing any liquidity or hazarding the market with the rest of us.

This is a simplification of course, in order to place teaser orders the HFT has to endure some market risk. But they've cranked it down to a rounding error.

Another problem is that the retail brokers have gone to 0 commission by selling their order flow to the same HFTs. What this really means is that commissions are variable, arbitrary, and unknowable. Try putting that in a spreadsheet.
Fortnite Battle Royale 13.40.0 B11.8.2020 APK and Mod (Unlocked) + Data Android
You have to learn on the job, which demands a different skill set than getting the job. You sound humble and willing to learn, which makes you perfectly qualified for junior positions. Don't be so hard on yourself, your primary focus should be to pass coding interviews. The rest will sort itself out, you will do fine. You'd be surprised how many people in this indutry get by without having much of a clue what they're doing, lol. It's human
The ionosphere is not all that far away. Radio travels at about 0.97c in the atmosphere. At shortwave frequencies the ionospheric E layer provides the best reflection IIRC. The E layer's altitude is less than 100 miles (60-90mi) but can bounce a signal hundreds of miles horizontally.

If you want to reach a receiver a hundred miles away an HF bounce off the E layer would get there in 0.659ms (if my math is right). If you had a 100 mile long fiber optic cable your signal would get there in 0.813ms.

Microwave repeaters can be very fast so long as you've got good positioning. If you managed a straight line of repeaters to a receiver you might be able to beat the HF path. For the best results microwave repeaters shouldn't be too far apart so for the hundred mile trip you'd want several repeaters. Each is going to add something like 150ns latency. This is cumulative with the 0.97c air latency. And it's only to a single receiver.

So microwave repeaters would beat HF sometimes, depending on topography, to a single receiver. I think HF would end up winning out more often than not and wouldn't require the infrastructure of the microwave repeaters. It would make siting receivers much easier and would likely allow receiving stations to optimize siting for the last mile to the trading systems.

That being said I don't think HFTs should be able to abuse HF by broadcasting things not usable by the general public. If they want to cut their latency they can use some of their hojillions of dollars to build microwave infrastructure or pay everyone for use of the HF airwaves they want to make money with.
Apple’s new App Store guidelines address streaming game services,in-app purchase
I don't get your comment

Is Civilization IV going to change? I'll welcome any update that fixes this
https://www.youtube.com/watch?v=H83TxBL3yOE

followed by

https://www.youtube.com/watch?v=25Zcy8Uu4dw
Welcome to Sales Engineering Friend
bit of a rant, but all very reasonable. in general though, i find that people who get this upset about semver tend to view the "contract" of semver to be an ironclad one (right down to being automatically determined by the package ecosystem rather than by the maintainer).

I am much more persuaded by the argument (not mine, i get this from more experienced maintainers) that semver is a social contract, because what constitutes a bugfix vs a new feature vs a breaking change is exactly as well defined as "what is this piece of code really supposed to do"? aka it's not well defined at all. all software "contracts" are underspecified, given enough users and scale.

remember Hyrum's Law: "With a sufficient number of users of an API, it does not matter what you promise in the contract - all observable behaviors of your system will be depended on by somebody." Even bugs will be relied on and people get pissy about semver when you break them!
AM radio (medium-wave/long-wave) is different from shortwave.

In US, similar "utility response" is permitted as well for AM broadcasters, since 1981 https://docs.fcc.gov/public/attachments/FCC-81-258A1.pdf

Subsequently, permission was granted to all AM and FM broadcasters for "subsidiary communications" of any kind, https://docs.fcc.gov/public/attachments/FCC-84-113A1.pdf

But that's not "shortwave"/International HF broadcast
I think the predator/prey real world analog to "security through obscurity" would be camouflage.
Not the poster you're asking, but in my case, have used Python extensively for cloud-related programming, lots of AWS lambda. Currently in a special kind of hell trying to move our company's lambdas from Python 2 to Python 3. It should be easy but there's an internal Python 2 library that is in everything that is massive and almost impossible to excise without significant effort. Started writing lambdas in Go, you ship your compiled binary and the lambda environment will never care what version you're running. Shipping a binary means I'm no longer worried about my build environment and pip and shipping all my Python junk the right way. Also in other areas, simply transposing some code to Go has had huge performance benefits over Python and concurrency is just so easy to pull off.
FAANG offers more money to some entry level employees, and at least after working as rank-and-file at a private company, every mistake of the organization isn’t publicly laid at your feet.
This is actually the misunderstanding that the author is talking about:

People commonly misunderstand the concept and assume that obscurity is a bad practice in general, even when used as a secondary layer. It's not uncommon for junior engineers to object to any level of obfuscation or security because they can imagine a scenario where a sufficiently skilled attacker can defeat it, but that's missing the point. Slowing down your adversaries and weeding out the low-effort attacks is still valuable.

> So, sure, you can do non-standard stuff to make it harder for _some_ not discover your vulnerabilities (ssh non-standard port is actually a good thing given the massive amounts of bots around), but that should never be your only (or your main) layer of defense

That's exactly what the author says in the article. I don't see where the author is disagreeing with what you said.

I would go one step further and say that engineers commonly underestimate the volume of low-effort attacks that will pour in at scale. Some of these, such as brute-forcing or DDoS, can be disruptive to users unless you have perfect rate limiting (which you won't at first). Adding layers of obscurity before attackers can authenticate with and interact with core services can dramatically reduce the volume of these low-effort attacks. The skilled attackers tend to be more surgical.
Sorry, the site is down now, but here is a cached version: https://web.archive.org/web/20200826125737/https://news.nus....
I'm the guy who filed it. AMA.