skysight-inc/HackerNews huggingface dataset:
I agree that there is nothing better than GPG for the narrow scope of encrypting email. But I think there are very few cases where encrypted email is the most secure way to communicate, in lieu of other forms of encryption.
Wait, Have We Wiped Out 60 Percent of Animals? (2018)
The key most people miss about the anthropic principle, and that seems to be the confusion here, is that when you're filtering out false hypotheses (those inconsistent with the observed facts), all remaining consistent explanations increase in probability equally. This means, for example, if you want to explain how Derren Brown won the lottery, the probability that he cheated raises in line with the probability that he just got lucky, which is exponentially low, hence it is almost certain he cheated.

The base probability is, as always, based on some form of Solomonoff induction, which is invariant to ‘scale’, hence why we can explain away seemingly-arbitrarily low probability events (α≈0.007297352569) by talking about universes that contain a continuum of different α. In the lottery example, the hypothesis ‘lots of people tried’ is simple, even if the probability of each individual winning the lottery is low.

You might ask instead, but what's the probability that that specific person won the lottery? Surely that is exponentially less likely? Yes, indeed, but unlike the Derren Brown case, where P(Derren Brown cheats the lottery) is fairly high prior to him winning the lottery given the public attempt, P(that random guy cheats the lottery) is very low, as most people don't cheat the lottery.

Thinking about alternative observers and question-asking is a distraction. Other people asking other questions are not you, so they are not compatible with your observations.
> We can observe both habitable space and empty space, and we have a good theory to explain why we don't find ourselves in empty space.

Yes - it's called mathematical statistics.
First of all, thanks for posting this. That takes bravery and you've started a really interesting thread. I have a couple of suggestions as someone who is self taught in various fields, and the world of programming and music have some bizarre parallels.

First, you might be wrong. You may be fine, and just need to back to fundamentals. This is very common in many complex fields. I have gone through multiple rounds of taking stuff back to beginning level. I'm doing it all over again right now in programming. I highly, highly, highly recommend reading "How To Design Programs". Putting time in to truly and deeply master the very basics as well as you can is the road to mastery in anything complex, and it's never too late to do this.

Second, you may not be totally wrong, you may be slightly off target on how you like to think best! There are a lot of people out there who like computing and programming, but discover that really, they are better off as someone in a related field, or that they like a different kind of coding. In my experience, the best low-level coders are often terrible architects (very high level software design), because they can't imagine being wrong! Also, some people naturally gravitate for whatever reason to sysadmin/dev-ops style stuff, or security testing, or embedded electronics. Or perhaps you have better than average ability to understand how people make software and would be an excellent development manager.

So my advice is to take a two-pronged approach:

A) Go back to fundamentals and learn new languages, both high and low level.

B) Experiment with related areas and see if one of them makes you say "ah damn this is what I should have been doing".

And C) give yourself like a good year or two to figure this out. It'll take some time.
This seems like splitting hairs. At the end of the day, if the consumer buys an app for $10, the developer gets some portion of that, and the retail store gets the other.

Whether that happens in one simultaneous transaction or two different ones doesn't really make a difference to how much the developer gets paid in the end, which is less with the retail store model compared to the current digital storefront model.

Let's also not forget that Steam launched with a 30% cut a full 5 years before the App Store ever existed, so it's not like Apple dictated this price, they were following industry norms at the time.
They've thought of that loophole and closed it already ;-) Basically you can only stream from a device that is owned by the user/owner of the iPhone/iPad on the same LAN, and you should not use streaming to mimic a thin client of a cloud app. See rule 4.7.2 on Remote Desktop Clients.

(Note: this does not apply for "generic" remote desktop clients that are not intended to stream specific apps or services, such as the generic Microsoft Remote Desktop Client for iOS.)
NativeIO API: equip web browsers with low-level input/output
This is exactly whataboutism.
Are there pre-installed apps you can't disable? I have a bunch disabled on my phone.
Oh, none whatsoever. This would have to be forced upon them against their will.

I just hope it’s done by governments who actually care about end users, not by those acting as though feudal aristocracy is the current economic standard and want a cut of Big Tech’s trillions.
Everything is a judgment call. You can no more spell out everything that is considered explicit than your HR department can spell out everything that might constitute harassment.
sounds like a security nightmare
Google provides side loading so I can avoid their fee. Playstation and Xbox are not general computing devices.
I completely agree. When rules aren't codified it invites biased interpretation of them.

However....

I've worked on an internal communications platform. For some reason people would forget that they were on a corporate site with their corporate email linked to it and spew garbage that any decent person would be embarrassed to say out loud.

So we deliberately didn't codify our rules. We chose not to because we were aware that if we did then people would deliberately cozy up as close to the line as they could, and that wasn't the kind of environment we wanted to foster.

We avoided bias by removing information about the flagger or flagee when content was flagged and judged it based on the content ourselves. After we judged we'd look up who was responsible for the content, and if we felt they were doing some penetration testing to see exactly where those lines were we would start to loop in their manager, HR, legal, and anyone else we felt should be aware. Our escalation procedure went up to banning, though nobody ever reached that point. And our content improved.

If the story ended there I would still be against not having codified rules, but begrudgingly accept that it worked in that situation.

Unfortunately the story doesn't end there. Staff was hired so that engineers wouldn't be responsible for this. The staff was less familiar with the ecosystem and they proceeded to clamp down more and more on acceptable content. They cozied up to HR and legal who were never really comfortable with the permissiveness of the platform, and received praise and additional funding to grow the team for these clampdowns.

I left the project and haven't looked back.

You're right, "I'll know it when I see it" is a garbage sentiment that at best is a cop out, but too often is used to withhold rules and keep people in the dark as a power play, or even squash dissenters with arbitrary and unbalanced application of force.
This doesn't consider that you can then monitor connections to port 22, and if you see any that's suspicious.

Disagree that port knocking is obscurity. That's a secret.

Security through obscurity would be using a nonstandard SSHD service.
I believe in the contiguous USA the furthest you can get from a road is only 20 miles. There are no undisturbed places left, really. Unfortunately preserving roadless areas is politically contentious here. Clinton enacted a roadless area rule at the end of his administration and Bush tried to reverse it a week later.
Fun article! I'd add that malware packers are a good example of an obscurity layer that's typically effective in practice.

But food for thought: in the general case you can't reliability predict the efficacy of an obscurity mechanism, so you never know if it's an actual layer of defense or a placebo.
The IRS offers a $625,000 bounty to anyone who can break Monero and Lightning
Thank you for that excellent overview. It's interesting that your Principal Component Analysis[0] pointed to a Caucasian language, as did a more recent Hypervector Analysis[1]. How likely is it that a 15th century process for generating meaningless text would not only follow Zipf's Law but also give consistent and plausible results under those analyses?

[0] http://www.fmjlang.co.uk/voynich/abkhaz.html

[1] https://www.voynich.ninja/thread-3314-post-39598.html#pid395...
Or just maybe they like making money on the mobile platform where people will actually spend money?
The article seems slightly pedantic in the argument that Mass Storage is "SCSI"—it implements a subset of the protocol, so yes, it has some bits of SCSI, but I don't think it follows to say "USB Mass Storage is SCSI".
I'm really bothered by the whole notion of games as less important and "[more] optional". Playing games is a fundamental part of being human, and it is certainly more important than capitalism.
I’m selling a product that I built as a spin-off from my work towards an MSc.

I originally built a product for data collection in order to answer my research questions, and realized that other people probably had the same problem.
Update on My Situation
Oh no. I've wasted plenty of time. And so have they by interviewing me and proposing ludicrous problems well outside of the problem domain of the role I was interviewing for.

I understand some problems are meant to judge your thought process, others are meant to measure your basic literacy. I'm not talking about those, however.

My experience in interviews has been that most of them are engineers pulled into the process who searched the web for "software developer interview questions technical" and cobbled together a few disparate options without a moments concern more.

Then again, those kinds of interviews have certainly cemented my desire not to work there.
If you are doing person to person cash transactions via a app, you aren't dating.
Teslas Used as Police Cars
I tend to also point out in a lot of these discussions that "checked exceptions" and "java's implementation of checked exceptions" are different things.

Java's implementation has undeniable issues, e.g. in designing stuff with callbacks. It can and often does lead to "everything's runtime" or "everything throws Exception" or other hell-scapes people have heard of. Personally I still prefer them, for pretty much the same reason you mentioned - they are effective, especially with a bit of restraint.

Checked exceptions as a concept are not bound to that. And I wish more languages would make use of them. They can be just as flexible as ADTs, which are pretty widely approved of... because they describe exactly the same thing, just short-circuiting rather than requiring an explicit return. On that front, it's "exceptions" vs "returns" and there are plenty of opinions and tradeoffs between them.
Rich Hickey, the creator of Clojure, has a wonderful talk where he made a case against Semantic Versioning: https://www.youtube.com/watch?v=oyLBGkS5ICk
I'd disagree that filing taxes is "awful".

For most of my adult life, it only took me one hour per year to do my taxes. Form 1040-EZ, filled out on paper.
I've heard a variant of this repeatedly. A company justifies technical exam style interviews on the grounds that many people who look good on paper "can't code". Meaning, can't program fizz buzz. Can't write a method or function. Can't write a loop, or an if/else conditional.

But I can do all these things. I've gotten bounced from my interviews because (this was the official reason, anyway) I didn't get far enough with the coding in finding all matching subtrees in a binary tree, in 45 minutes, at the whiteboard.

Companies should feel free to hire based on my ability to do this, they should not say they were just testing basic things like lists, loops, and conditionals, or even basic data structures and algorithms like binary trees or hash maps. These exams go way beyond that.

This may not be the case for all, and it sounds like it is not the case for your process. But in the broader industry practice, I smell a motte-and-bailey fallacy here.
Great article. I don't know what is more disturbing there -- not knowing what parts of MOD's own answers were generated by GPT-3, or (if) what parts of "human" interactions came from it, or if the whole thing is generated by it with minimal editing...
So are you not going to buy any electronic items?
A facilitators recipe for event storming
This isn’t about the iPhone, it’s about iOS, which is one os out of two. And they have an absolute monopoly within iOS and on iPhones, while creating a market which can and will be regulated and being a publicly traded company and therefore subject to even more scrutiny and laws.

And people care a lot less about the consoles because they are a lot less important to the economy. This is like McDonalds complaining about paying fair wages and pointing to a two-location mom and pop shop and saying “but they do it too!”. Classic whataboutism.
What Is a Singular Limit?
I'm glad I found this. I will come back to your blog and to the app. Thanks for sharing.
>Imagine a 0day for SSH drops tomorrow. Almost immediately script kiddies all over the world will be trying to take over everything running on port 22.

Yep! And I should be clear: I am not saying just don't change the SSH port. I'm saying if you care about security, at a minimum disallow public access to SSH and set up a VPN at a minimum.

>Unfortunately that's all too rare in most web-servers I see (<10%), as most just add SSH and secure it and call it a day (even worse when CI/CD scripts just copy files without chowning them).

I'm a bit confused here. In every major distro I've worked on (RHEL/Cent, Ubuntu, Debian, SUSE) the default httpd and nginx packages are all configured to use their own user for the running service. I haven't seen a system where httpd or nginx are running as root in over a decade.

I think the bare minimum for anyone that is running a business or keeping customer/end user data should be the following:

1) Only allow public access to the public facing services. All other ports should be firewalled off or not listening at all on the public interface

2) Public facing services should not be running as root (I'm terrified that you've not seen this to be the case in the majority of places!)

3) Access to the secure side should only be available via VPN.

4) SSH is only available via key access and not password.

5) 2FA is required

I think the following are also good practices to follow and are not inherently high complexity with the tooling we have available today:

1) SSH access from the VPN is only allowed to jumpboxes

2) These jumpboxes are recycled on a frequent basis from a known good image

3) There is auditing in place for all SSH access to these jumpboxes

4) SSH between production hosts (e.g. webserver 1 to appserver 1 or webserver 2) is disabled and will result in an alarm

With the first set, you take care of the overwhelming majority of both swarms and persistent threats. The second set will take care of basically everyone except an APT. The first set you can roll out in an afternoon.

With the first set, you take care of the overwhelming majority of situations.
This scenario inevitably ends up with the solar system inside a very big Pringles can
The sibling comments are talking about performance, but there's also a conceptual disadvantage to overriding.

There are two different ways to create a subclass in OOP. Java treats the subclass and the superclass as the same object. If the subclass calls a method on itself, it may go to the superclass first. This is a valid way to do things, but it can be dangerous and confusing.

Another way to create a subclass is to create two objects: the superclass and the subclass. The subclass has a reference to the superclass, but they are not the same object. If the subclass doesn't override one of the superclass's methods, then it implicitly proxies the method call to the superclass. If the superclass calls a method on itself, then it goes to itself rather than the subclass.

The difference between the two approaches is whether you want your class implementation to be open to extension (monkey-patching). Allowing class inheritance (Java's approach with the virtual methods) means that subclasses can override methods you define. It can be convenient, but it can also be a foot-gun. Class composition (proxies) prevents monkey-patching by subclasses.
People like that are somewhat ignorant of the day to day struggles of people surviving in the mundane reality that is the modern world, and how people are not interchangeable cogs in the machine of productivity.

That isn't a solution, its a dismissal.
Funny thing about this is that the time of the Apollo program, Boomers were the young punks.
A family member is a chef, and for new jobs you have to "stage" [0] where you come and cook for a (unpaid) shift to see if you are a fit, have the skills, etc. To me this is exactly the same thing, and I expect this is very common across different kinds of jobs.

[0] https://en.wikipedia.org/wiki/Stage_(cooking)
Thanks. I'm guessing (based on my knowledge of J and all its optimizations/special forms) that Dyalog APL would still be more performant too? I didn't see it mentioned on the GH README.
Hah, I just encountered this for a completed though similar reason. I'm still not entirely sure what was going on, but in Azure it seems like their network fabric that underpins VM networking stack were combining TCP packets into larger ones between two VMs.

One of those was tunnelling the traffic elsewhere and was getting packets "from the network" with packet sizes up to 65k despite the MTU of the tunnel being set to 1400. The transmitting host was respecting the MTU. I had to force clamp the MSS to the PMTU in iptables to get things working again.
CVE-2018-17145: Bitcoin InventoryOut-of-Memory Denial-of-Service Attack [pdf]
You're mentioning the largest American Brands, which do not represent the bulk of businesses. In fact they have different channels to setup their businesses and lobby their way around.

When I made that comment I was referring to SME, which is also the bulk of let's say, Chinese sellers on Amazon US.

Try to do what Chinese people do on Amazon, but on a Chinese platform as a SME, to sell products in China.
I mean, this varies team by team and company by company. To spit an anecdote into the bucket, I asked some teammates to help me take care of a problem, and they did - and I don't think I hold a particularly large cache of informal power.
Quantum Paradox points to shaky foundations of reality
I interview a lot of people for frontend positions. I ask one two-sum question to see if they have some knowledge about data structures and simple algorithms. Then I ask them to build something trivial in React, which is what we use. If you can do those things, you're probably fine. The number of people who can't is truly shocking.
No. If someone falls and cuts their finger in prison, I’d hope it was bandaged.

The mind is a bunch of fingers.
Sure you can avoid their fee. See how many customers you will get if you force them to side load - ask Epic.
Not yet. Medical science has progressed to where it's starting to become possible to investigate this in a clinical setting, so home tests aren't going to become available just yet. One will have to resign to doing what has been done previously which is to look at how a person lives their lives and inferrence from that. I'm not a doctor, but having a pronounced need for variety and change is somewhat indicative. Also, if someone intuitively seeks out dopaminergic foods and drinks that's an indicator also (dark chocolate, foods rich in tyrosine). It's not uncommon for a person that's low in dopamine to become noticably relaxed after a high-carbohydrate meal as that meal would elevate serotonin and when dopamine is low and serotonin is high you become chill. People low in dopamine tend to be addictive. Sugar-bugs, coffee-fiends, sometimes adrenaline-junkies.
Yup definitely. Reloading was just top of mind. There's another part to it also.

"Too slow is dead"
I remember that if I wanted to play anything other than Snake on my Nokia, I had to pay like $5 a game. And those games were even worse than the majority of 99¢ games on the store.

You can argue lower prices lead to more crap, but it also encourages people to spend more. Most people would debate a $4.99 purchase, but think nothing of 5 99¢ purchases if done separately.
This is so true. I now get paid over twice what I got as a coder because what I do involves a combination of code knowledge, writing, and interviewing people. My skills in the last two make me a star there, and I am way more appreciated than I was in pure coding roles. Finding your "superpower" is the best thing you can do for your career.
I'm kinda disappointed, these aren't much larger than the giant isopods that you can buy at a well-stocked Asian grocery.
- CVE-2018-17145 was discovered 2 years ago and "responsibly kept secret" lulz

- Denial-of-Service that could have been used against over 50% of the $BTC network and every Decred node(!)

- $ZEC + $KMD + $HUSH never had this bug

this was discovered as part of a $DCRD bug bounty program and the bitcoin bug had to be burned publicly (and the many other coins it applies to) after keeping it secret for 2 years, DOES THIS SOUND FAMILIAR???? Much "responsible disclosure", such wow.

source: https://nitter.net/dukeleto/status/1304368190139572226#m
> You can save money and exercise your options.

Can you though? Your thesis has been that the majority of your income will be due to equity + appreciation. If you are able to save half your after tax income, which is feasible but requires some frugality, you can't actually afford to exercise + taxes on a stock grant whose EV is equal to your base salary.

Many people complain about how difficult affording a house is in the bay. The tax cost on an equity event is larger than the down payment on an equivalently valued house, and you're casually suggesting to save for it, on a much lower income (since you can't use your equity).

> There are also companies that will help you exercise your options for a cut

As far as I can tell, the terms of these deals mean that unless the price of the stock increases well beyond the strike price when you exercise, you'll get nothing, and even then you're going to end up losing 50%+ of the returns.

I'm not saying that you can't ever come out ahead, obviously some people do. But if you sample startups at random, the median stock value is zero. If you sample private unicorns, the median payout is mich worse than amazon or microsoft.
And so is UAC....
Your two fringe examples hardly render that "utter nonsense".

There have been over a billion Windows devices in play for 3+ decades. The average Window user has paid for at most anti-virus, Word/Office, and sometimes Adobe. It is rare to find someone who has paid a penny for anything else.

Even critical software that people used day after day like WinZip and WinRAR became a meme for being something that went unpaid for.

Yes, some guy bought an activation code, but that guy was a serious exception. The pool of developers working on commercial Windows software was absolutely minuscule.

And today, with 1.5 billion Windows devices, how many people are making commercial software for Windows, outside of Adobe and Microsoft? That numbers is a rounding error. Despite it being, conceptually, the most amazing, incredible, liberating platform.