skysight-inc/HackerNews huggingface dataset:
> We've replaced some insecticides by letting the plants produce their own.

So, you traded insecticide application to it being pre-aplied into the plants. That isn't reducing the amount of them out there.

Yes, there are some gains, like in there being no environmental contamination due to the application. There are also some losses, like in there being long-term environmental application due to contaminated bio-matter.

> We've eliminated some herbicides (weed sprays) by producing resistance in the plant to first Roundup and later other herbicides.

No we didn't. We traded larger amounts of less effective herbicides into lower amounts of incredibly effective ones.

On both cases, there are plenty of details, gains and loses that could be weighted in a public argument and settled down into policy. But the fact is that Monsanto didn't want public arguments, so they got their goals written into laws by the dirtiest possible procedures (really, on my country the entire legislative process was completely illegal) and got the public argument shut down with claims of it being "anti-science" or similar things. Those are not markers of socially positive actors.
I think that, once you start taking down crates and users, you've opened a Pandora's box of responsibility.

The case above is clear but a whole load of not so clear cases would follow and then there would be a need for an appeals process.

My guess is that the developers have better things to do.
There's an unhelpful idea that government employees shouldn't make a lot of money. But if that person is the difference between a billion dollar project succeeding or failing, a $1-2 million salary is a worthwhile price for top talent.
>I think we can kind of view obscurity in the same way. It's a way to signal to a predator that we're a hard target and that they should give up.

This has it completely backwards. Security through obscurity's goal is not to signal predators, it's the opposite. The goal is to obscure, to hide. The "signal" is there is nothing here (or nothing here worth your time). One of the best examples (it's in the article!) is changing the default SSH port. Just by obscuring your port you can usually filter out the majority of break-in attempts.

The only way security through obscurity signals to "predators" is if they've seen past your defence, and thus defeated the obscurity. Obscurity (once revealed) is not a deterrent. Likewise an authentication method (once exploited) is not a deterrent.

>Of course in the age of automation, relying on obscurity alone is foolish because once someone has automated an attack that defeats the obscurity, then it is little or no effort for an attacker to bypass it.

This is true of any exploit basically. Look no further than metasploit. Another example: a worm is a self-automating exploit.
The way I think about this, there are some aphorisms that work as actual design principles, and some that are just used to defend a decision you have already made to someone who doesn't need to understand it.

"There's no such thing as security through obscurity" is an example of the second; you can use it to mean "shut up and stop asking questions about the secure system I designed," but you can't use it to design a secure system or explain why your choices are correct.

The useful design principles behind "no security through obscurity" are just a little more complicated -- they're more like "every secure system must have defined entropy sources (such as keys) that provide a lower bound on the security budget against a hypothetical attacker with knowledge of everything except for the entropy sources." And, "because obscurity does not measurably improve the lower bound on the security budget, it is only a good idea if it also does not raise the chance of implementation errors, does not make it harder to obtain third party reviews of the system, and does not make the security of the system harder to prove." An argument about whether something is security-through-obscurity-in-a-bad-way probably actually wants to be an argument about an underlying design principle along those lines.

I don't exactly begrudge people using "shut up and trust me" phrases in situations where that's needed, but I think they're almost always unhelpful in forums like this.
With heartbleed, a bug in the implementation of the protocol led to the server randomly leaking contents of the server’s memory, which could be anything from private keys to user or system passwords to other confidential information. No passwords or MitM was required. You can read more at heartbleed.com
Why Shouldn’t You Use Future[Unit] as a Return Type in a Scala Program
Not sure why you are being downvoted. If your public identity is linked to what you say online, and you said something bad about China, and your job asked you to get sent to China, ...

It’s totally reasonable to ‘be careful’ about such a situation, because it is going to happen that some random citizen will be sent to jail for something. It’s happened with other countries, so there is precedent.
Dude, you just made me cry. Intense experience. You got something good there on the guided and the naration experience.
It's the contrarian dynamic: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&sor...

(Your comment is arguably the third wave and mine the fourth...)
My argument is that modern IDE's are HIGHLY functional out of the box. I'm sure that Emacs can be competitive with Notepad++ in just an hour or two- but without learning the extension ecosystem, some configuration, buffers, and a lot of keybindings- You'd probably be much more productive in VSCode after that hour.

For instance- search and replace. I'm not an IDE user, but I'm sure I could pop open any modern IDE and find and use search and replace in roughly 5 seconds. Emacs- is that discoverable? Or does it require documentation?
An answer, particularly in the sciences, is to also distribute the source *.tex files, which being plain text with markup, can be handled just fine by things like emacspeak, or accessibility tooling for other sensible editors.

This comes up a bit around the blind accessibility issue for mathematics, which is why I suspect it's bubbling up this week on HN.
The Chicago Mercantile Exchange's data center is a stone's throw away from the Fermilab facility in Batavia (the same town where Parable wants to install their HF/HFT transmitter).

It's not out of the realm of thought!
> hey encourage developers to really think about what happens in the failure case.

It's a noble goal, but once I started thinking about what happens in the failure case, I came to the conclusion that checked exceptions are no help here:

- there are always unchecked exceptions. I found it useful to think that any function might throw. So if extra reporting or graceful shutdown are required, just catch everything

- in most cases I have no idea how to recover from error: just keep throwing it to the caller until someone knows what to do. I want it to be the default behavior and I don't want to clutter my code with all the catch-wrap-rethrow boilerplate.
Some do, yes
The job title should read. Person wanted as fall guy for Uk government when we mess up any it project.
Security by obscurity is not painting tanks in camo. Security by obscurity is assuming your enemy won't find your tanks because you didn't broadcast on public radio where your tanks are.
I think you need to make your concerns more objective and focus on what can change about each one.

You don’t seem to lack the critical thinking skills that are the hallmark trait of a good developer. The most objective criteria you can ever pull from is, regardless of the messiness or efficiency of the solution, whether you’re able to solve problems. If I asked you to do some work, and you could do it in any amount of time, that is the most difficult milestone many fail to achieve — And it seems that bar is more than met with you.

Perhaps you are worried with the quality of your solutions. I’d argue that in many situations, it comes down to domain knowledge. That is something you will naturally gain as you continue to code and read about CS theory, and especially so if you keep exposing yourself to new things out in the wild or at work. Brilliance is often witnessed or measured by the application of domain knowledge, but the genuine underlying brilliance comes from your ability to recognize patterns and having the discipline to see things through to a working solution.

You’ll almost always find yourself with company that can work faster or slower than you and be different shades of brilliant, because our brains gravitate towards different things when we hear about a problem. It is not easily compared, and when forced it easily becomes unfair and unproductive.

If you had to leave this post with anything, it’s this: don’t you dare judge your programming abilities by the typical big tech interview. They are created in a way that tries to gauge your critical thinking skills, and sometimes that is executed quite well, but more often it requires arcane domain knowledge that demands deliberate and specific attention you would be unlikely to give and come across otherwise. It is a specific process that is related to our daily work, but do not get it confused with the actual work we do. Many incredible programmers are rejected because they haven’t nailed the interview domain — that’s okay and can still be consistent with being a good developer. It’s a different isolated problem you can focus on.
Microsoft AI tool enables ‘extremely large’ models with a trillion parameters
there's a sweet spot between limitation and DOA. My first bass was what I'd describe a shovel. I thought a good player should be able to groove on anything.. but I saw my error the day I tried something more balanced (even a simple squier vintage was enough to help progress)
Pipenv: Breaking Release Bottlenecks – What Changeset Can Do
> Ideally there would be an ergonomic way to use a Result/Try type a la Rust and Scala. If such a thing existed, I would stop advocating for checked exceptions immediately.

On that note: would it improve things, compared to checked exceptions that cause compile warnings if not handled?

I'm currently dealing with similar problem on the C++ side - a codebase that's using a lot of tl::expected<> and "functional interface" instead of exceptions. And the more I work with it, the more I realize this introduces a lot more of boilerplate/book keeping to achieve the same goal exceptions would, with little to no benefit - except the possibility of error being visible in function signature. Which wouldn't be a problem for exceptions if "throws" in C++ wasn't broken.
Discussing Fuzzing in Go
You know you're a terrible developer, which automatically makes you a better developer than most of the terrible developers out there right now.
I wonder what the barrier would be to using Swift for something like this. Obviously there is one, but I wonder what it is.
It could be that. But if compensation is important, a high profile government job will usually give you your pick of high paying private sector jobs once you leave.
It's a pragmatic thing. Telling an imposter syndrome sufferer that they have imposter syndrome is more productive than telling an imposter they're an imposter. On the internet when you can't be sure which person you're talking to, it's better to give advice that could be helpful if it turns out to apply to the person you're talking to, than to share commentary that wouldn't be too helpful either way.
Yes? Especially at large tech companies, it's largely in stock not cash.

Most senior/staff engineering ICs at large tech companies make much more than 250k USD.
Facts - We all suck at this.

This career is so subjective it hurts. There are no right solutions, only okay solutions. There are also so many different types of programmers. It's okay to be the hackish type. That type drives value to customers while unearthing complexity so that the system can be rebuilt around that complexity... To further my point about "types", there is going to be a whole subclass of dev that will read what I just said and think "No, you must find complexity before writing code!". Usually this type has pulsating veins in their forehead. Guess what? We need them too...

On surface level knowledge - this is the most powerful thing ever if utilized properly. Once you know enough high level concepts you can organize them into a plan and dive deep on them. There is no use in knowing everything deeply. Strive to learn depth only when it's required.

On beating yourself up - Stop. It's not helping you. Find the value in what you do and how you do it, and then go deeper on that. You'll create yourself a niche. A good manager will see it, and you'll quickly start getting passed around a company so you can go do that thing you do.
agreed. https://pbs.twimg.com/media/CqkJwTWWcAA88PL.jpg
Agree with most people here that security by obscurity is bad "by itself".

For example, changing your public server ssh port from 22, to say, 2942, is a great way to limit the amount of bot autoattempts from trying to log into your server. Having a password-less ssh port 2942 open is clearly bad, but not when combined with all the standard good practice ssh security.
I feel similarly.

Lately I've been limiting myself to a simple groove box and working pretty hard on getting able to perform interesting stuff on that box alone.

One thing that is nice about this practice is that it has made me way less picky about tools... I've been mixing an album this week for a band I'm in and I pretty much am just using Logic pros default eq and comp, plus a single reverb and a single delay plugin. So, like 4 plugs for a whole album and I'm not finding it any harder to get a good sound out.
I don't buy CDs any longer, I certainly don't buy LPs (the last time I bought an LP was in the early 90's), and I don't stream. I do buy a lot of music on iTunes. I've stopped buying select songs too, preferring to buy albums. You get to know the artist and their work better. When listening to music I tend to listen to albums. For better or for worse my iPhone is now my sole music player. The audio engineers mastering for iTunes are doing an excellent job.
I feel very identify to this thread, I push myself to create software and yet don't feel I'm good enough as my peers. After feeling this way for a long time, I started learning how to manage developers instead of developing software. . I've come to realize I understand how software works and came still be involved in technology but on a different path. Hope this can helps!
Yes, I scan them all: 53.2%
No, I use default scan: 46.8%
186 votes

Well, I doubt that. My private VMs have had ssh listening on some random port for the last decade, after I was annoyed how the auth.log became an inreadable spam-fest. Now it's been well over a year since the last probe.

Maybe the author's pentesting pals do that on a few public /24 or some intranet (I would, if I was a pentester). But you're average bad guy scanning /8 blocks looking for an easy catch? Maybe with a botnet...

(TBH, I focused on security/crypto during university, but ended up in an other field - so my practical knowledge is limited).
That’s an incredibly long-winded way to say “don’t think of reference counting as a (potentially-avoidable) cost; think of it as an investment.” Then you, too, can be happy, as long as you don’t think too much about it.
In Oregon it is amazing how effective this program is. You never see cans or bottles as litter.

Another effect is it lowers your garbage/recycling bill as homeless will often rummage through your bins for cans/bottles freeing up bin space so you never really have an overflow problem of glass or cans.
>Take your average computer science graduate from the last ten years. Do you think anyone would be remotely able to understand what is going on there?

Yes, you literally read the literate program of TeX and understand what's going on: http://brokestream.com/tex.pdf

I had never learned Pascal but I've managed to edit and compile TeX successfully, and it was easier than trying to understand any of my own non-literate programs.

>My point being that if we wouldn’t rely on TeX itself and use ANT (or whatever alternative) which is written in the quite elegant OCaml, than hacking it would be at least possible for mere mortals. Although I have to admit, despite being in love with OCaml since my PhD days, it’s also a quite niche language. But imagine if the whole thing was written in Python, or at least C.

Imagine if software engineers were actual engineers instead of glorified script kiddies.

>I wish someone would design a new space shuttle because while it's a neat project I only understand MKS units and it's too much effort to use a calculator for converting between them and Imperial units.
I hate this attitude that treats corporations as having zero responsibility beyond what they are legally mandated to do. Yes, it is an observable fact that corporatism and market economics incentivize corporations to behave that way. But it is an unjustified leap to turn that into a moral claim that it is ethically acceptable for that to be true.

People are incentivized to commit package theft in the US today. The odds of being caught and prosecuted are very slim, and the upside is you get free stuff. As an economic action, it is very market efficient: low barrier of entry, large number of "sellers", few cabals or controls over prices. There definitely isn't perfect information on products, but given that the cost is near-zero, that doesn't matter much. As a business, "package theft" is a great one to get into, and the market highly rewards you for doing so.

However, we correctly consider people who do so as despicable shitwads who rightfully earn our scorn and condemnation. We publicly shame them, and certainly don't want to hang out with them and count them as friends.

We should do the same with businesses that do morally harmful acts, regardless of whether the act is technically illegal or incentivized by market forces. It is certainly the business's fault when they do a shitty thing. They have fully agency in the choice of whether or not do so.
Burying plastic puts all the leachate into groundwater, where some will end up in the water supply.
Reminds me of the venerable Datasette by Simon Willison: https://github.com/simonw/datasette
One pattern I like to use is to write my documents using markdown which can be compiled into pdf via latex with a template of my choosing. It is also capable of compiling to other formats which may be more accessible such as plain text, html and docx.

https://pandoc.org/

[edit to add link to pandoc]
I'm a team lead who gets rave reviews from pretty much every client and senior manager I work with. I did an interview a couple months ago and was basically verbally assaulted with trivia questions I couldn't answer. Something people need to realize is that just because interviewers are in a position of power doesn't mean they know what they're doing and it doesn't mean there's something wrong with you if you fail one. Maybe you just don't fit their specific role, maybe they have a stupid evaluation model, maybe your skills are just not quite there. None of that is a statement about your general ability or worth as a human being. We need to stop defining ourselves by our jobs and how well we fit into the incentive structure of the economy and particular organizations. To everyone on this thread who is feeling like shit: you have value, don't let a fucking abstract entity like a business or a shitty interviewer or even a lack of a specific skill convince you otherwise. There's more to life than selling your talents for money.
The new source generators in C# 9 seem like a good compromise. Rather than rewriting code they can only add code but that ensures some amount of predictability.

https://github.com/dotnet/roslyn/blob/master/docs/features/s...
Yeah OP, come and give us the layman's version of Quantum Entanglement! (If that is indeed possible)
Acceptance is a bit of a misleading term. We can't directly accept anything, especially if we're trying to force it, because we'll be fighting against not being able to accept the fact that we aren't accepting our circumstances. It's quite recursive.
> But you know they are bad, no tests, no best practices, not even consistency between code.

The question is: Why do you get away with writing bad code?

That's as much your fault as it is your manager's or the product owner's. My advice, therefore, would be to go find a job where you're held accountable and where you get pushed (to learn how to) to deliver quality work.

I myself am working for an IT consulting firm that predominantly hires math/physics graduates fresh out of school. And while they're usually very smart, they typically lack programming experience and might be rather bad coders. When they start. After one or two months of extensive training (both on and off the job) and a ton of advice by their colleagues, they're usually much better already. Years later they will be among the best coders under the sun because that's what our firm – and especially our clients – demand from them.
Yes, for example:-

? Enter the database password: ${DB_PASSWORD}
Plenty of money is always a relative term. If you think you have "plenty of money" but you don't have X, in reality you don't have plenty of money. There are exceptions like X=love, admiration, etc, but for most X, if you have plenty of money and a shortage of X, you just exchange some of your loads of money for X and you are good.
This comment breaks the site guidelines. Could you please review https://news.ycombinator.com/newsguidelines.html and make your HN posts more substantive (and less mean) in the future? Note these guidelines:

"Don't be snarky."

"Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith."
I believe they were saying that your site wouldn't let them add their email to the list. Buttondown seems a bit overzealous in not getting bounces in my experience and rejects perfectly valid emails. It's a great service otherwise.
> I'm not likely to go to Hong Kong, so I don't need to worry too much about setting foot there and having to face consequences.

But you'd still have to worry a little bit -- if you're flying in the region your plane could possibly get diverted there due to weather or all kinds of other reasons.

> But I am married to a Chinese national and we tend to visit Shanghai and Anhui every 2-3 years, and I'm not sure how much safer, if at all, that is.

If they care about complying with the letter of the law, I suppose they could transport you to HK for prosecution under this law. But given this is China, they undoubtedly have many similar laws on the mainland, and if they decided to prosecute you it doesn't really matter if their legal justification is thin. IIRC, in the Soviet Union, the prosecutor not the judge was the one really calling the shots in the courtroom, and I wouldn't be surprised if China was similar.
I don't quite understand how we go from "Ancient aliens" to "real science" - I've never spoken to someone who believed in that stuff as the jumping off point that later went on to being curious about actual science when they weren't previously.

>Just as many right wingers are going to buy passive houses, closed loop energy, solar panels, Teslas as left wingers.

I also don't know that this is actually true. I as only able to find "what do you want to buy" polling for cars, but in a study surveying actual solar usage, it's 34% democrat and 20% republican.

https://www.autoblog.com/2016/10/26/democrats-tesla-republic...

https://grist.org/article/republicans-are-buying-rooftop-sol...

But I think this is also a false premise - that somehow conspiracy theory nuts have the same impact on public perception of science as one of the most public scientific issues with consensus from tens of thousands of scientists including basically 100% of the leading experts in the field. And the fact that there are long term economic advantages for things like solar, etc. that don't take into account at all whether or not you believe in man made climate change.