skysight-inc/HackerNews huggingface dataset:
> I don't really see the point of automated triaging myself. Given the sophistication and skill of some writers out there, you should just assume that an attacker-controlled write primitive would eventually lead to RCE. The essay mentions this when it goes into the intersection of skill, motivation and resources. But on the defender side this shouldn't matter no? A bug is a bug, and memory corruption should just blindly be assumed to be a 'worst case'.

I think the utility of auto-triaging is when the bug isn't a clear arb read/write. The article links to https://seanhn.files.wordpress.com/2019/11/heelan_ccs_2019.p..., which talks about how to automatically develop exploits from limit heap corruption primitives.
I love that name because of course all beaches are by definition made of...silicon!
Not wanting to update dependencies is fine, but in that case I'm not sure how it's an issue that you also have to use a certain version of the interpreter?
> The station they set up wasn't automated and took about 7 minutes instead of the the 90 seconds they previewed in the tech demo.

I can see why people are skeptical of the demo and think the limited trial, which didn't showcase what was demoed, isn't particularly persuasive.
Great project! Rumin looks very interesting as well. I was a long-time Evernote Web Clipper user, but switched to Notion a few months ago. I'm much happier with Notion's web clipping workflow and table storage approach, but it's not perfect.
We detached this subthread from https://news.ycombinator.com/item?id=24459650 and banned this account for repeatedly breaking the site guidelines.
Sounds like a problem for your os to worry about. They don't even need to expose their internal runtime.
Controversial uninformed opinion:

Recycling is a major cause to the Homeless epidemic.
Roads, brakes, weight are major causes to pollution. Heavy cars (IE. Super dense lithium, nickel, cobalt) will cause more pollution.
Python2 aside, judging by the rest of these posts, maybe it's just me but I haven't seen any problems with forwards compatibility in Python 3. That is, stuff written 5 years ago runs fine on 3.8. The only issues I've had is with virtual environments and pip freeze because some older Python versions relied on packages for features now in the Python standard library, but since we know how to spot those now that's not too bad of a fix.

On the other hand, Python gives a growing and continuously maintained standard library and none of the headaches that, say the JS ecosystem gives.

That said, not all of the features are great all the time. Async/await comes to mind, which adds a lot of complexity without the performance gains even senior programmers might expect. But overall, we're already using features in Python3.8 for projects, and have upgraded our instances to Python3.8 without issue. I guess it's possible we leave some pip dependencies in the dust because they may have some incompatible code with a future 3.x release, but we haven't had a problem before. Tests permitting, we'll do the same for 3.9 if we find something we like or might wait a few years.
I don't think Deno supports SSL yet.
Tools for keeping focused – attention is scarcer than time
2 to 3 was so traumatic, there will never be a 4.
> When businesses and lifetimes are measured in decades (not months) it is VERY nice to build on stuff that has longer support horizons.

Indeed. I'm in the process of writing some simple web stuff. I considered python, but decided against it because I'm doing this for free, and don't want to be asked to come back and fix it in a decade because "Python 4.6 needed a feature, and it'll break compatibility with Python 3"

Yes, they could still just run it with Python 3, but do I really want to go through the effort of explaining how to configure that instead of just handing over a working binary?
I don't buy that.

Glibc and GCC introduce incompatible changes all the time.
Windows Media Player Skins
I don't have any advice, but it's not just you.

This is my passion — I've been doing it since I was a kid and am ten years into my post-college career. I've been interviewing non-stop for six months and have been rejected at the end of every interview loop.

I'd leave the industry if there was anything else I was good at. Practically, if I do get an offer I'll just try to stay at the company as long as I can. I'm great on the job, but terrible in the interview (apparently).
As the many responses indicate, you've set the bar way too high here. A more narrow question could be something like:

"Did someone ever find an exploitable bug of the type it was intended to be safe from?" In other words, are there examples of the safety guarantees themselves being exploited?

The answer to this is "of course there have." An entire class of such exploits can be derived from CVE-2009-3869. Java 6 and older did not randomize address space, so any ability to write arbitrary memory was easy to exploit. There are other examples.
I worked with Ted a few years from 2001 and though we kind of stopped working together, I knew him! So I do know him personally. He's a great guy though intolerant of nonsense.
They claim it's 1000HP, which would be simple to measure on a pad. Also I guess they could say that the engine is ready and can deliver all that power, but the power cells were not at the time.

(Anyway, I'm not saying they are so honest, transparent, open as fuck, but this is like a trailer for a movie or game, it's a PR piece. It's less shady than the Tesla/SolarCity roof tile demo that Elon did. And I'm looking forward to the court case, because I have no time nor much context really for unwinding this, but I'm interested in what really constitutes fraud in these days when everything looks amazing, everything has a super emotional soundtrack, and of course everything is super over-hyped.)
Sept 13th Beat Pack and It's Bad News for Live Streams on Social Media
Kill the Newsletter Code Review
Depends on who reviewed it.

Easier to think of this from the other side. I have a few friends that, if they tell me to avoid something, it can typically override however popular something may be.
> Operation initiated

> Dossier update in-progress

> Operation complete

>|
We've banned that account, but in the future please flag egregious comments instead of feeding them by replying. that's also in the guidelines!
Go 1.15 can compile Go 1.0 programs. That's why I'm grumpy with the Python team but not grumpy with the Go team. There's simply no more to be said about the situation than that.
I've seen multiple companies ask candidates to write working code for machine learning end-to-end from scratch. As in, write a stochastic gradient descent logistic regression model with training, inference, etc. without any libraries beyond pandas/numpy If you're lucky they'll provide you the equations or let you google them. So something to memorize including the various numpy/pandas gotchas.
> Ideally; error codes should provide information about how to fix the problem (which python in this case does). That falls on the developer side of things (and may not be possible in many cases).

Rust generally tries to do that, although the fixes it proposes tend to lack context, and can thus lead you into the wrong direction entirely (e.g. once upon a time it would tell you to go and implement a trait on your type when the issue was that you'd forgotten a trait bound on a generic type, it still kinda says that but now there's a snippet which adds the trait bound so it's less error-inducing).
That player goes by the moniker "MitchFlowerPower" and has performed that 'speedrun' live in a race with Stephen Colbert to eat a hot pocket [0]. It definitely is not a trivial procedure but humans can get pretty consistent at it.

[0] https://www.youtube.com/watch?v=jvLwpnn1F4Y
"There were programs here that had been written five thousand years ago, before Humankind ever left Earth. The wonder of it—the horror of it, Sura said—was that unlike the useless wrecks of Canberra’s past, these programs still worked! And via a million million circuitous threads of inheritance, many of the oldest programs still ran in the bowels of the Qeng Ho system. Take the Traders’ method of timekeeping. The frame corrections were incredibly complex—and down at the very bottom of it was a little program that ran a counter. Second by second, the Qeng Ho counted from the instant that a human had first set foot on Old Earth’s moon. But if you looked at it still more closely…the starting instant was actually about fifteen million seconds later, the 0-second of one of Humankind’s first computer operating systems."

- A Deepness in the Sky, Vernor Vinge
Really welcome changes! These small quality of life improvements really make a difference.
But that is exactly the point the author makes with the quote from Alan Kay "simple things should be simple, complex things should be possible". He is not advocating complexity he is advocating that the possibility of "power user" complexity should be there.

An example of this used to be :( Firefox, you can use the browser from the start unchanged but the possibility of complex addons and customizing 'about:config' is there.

The point that annoys a lot of users is the 'google UX' type of decision arrogance, that enforces users to operate in a padded room with no sharp objects. That mindset of "we know better than you how you should want to use this app", is what I suspect frustrates a lot of users.
“The plan is not to do 4.0 until 2.7 is barely a faint memory, and then we will consider how to handle the transition very carefully.” - Guido van Rossum

https://mobile.twitter.com/gvanrossum/status/128544327896012...
Osaka 'a Jesse Owens of Japan' for racial injustice stand
There is a pretty good chance they all have a python 3 version.

It's not easy to determine which versions of the library to upgrade to however. What's the latest version compatible with both python 2.7 and 3.7. Would be nice if pip had a setting to get that.
> some of the harshest criticisms from others I have seen of C are not from expert practitioners in C.

But were they expert practitioners of C in the past? My experience is that most of the harshest criticisms of C come from former C experts who moved on to other languages because it became clear to them that C would never be fixed - Walter Bright included.
Could you please make your substantive points without breaking the site guidelines? There's interesting information in your comment but it's drowned out by the name-calling and dissing of the community.

https://news.ycombinator.com/newsguidelines.html
I was about to agree with you before I realized I use XeTeX, not TeX.
The ticket for TLS support was closed in December (https://github.com/denoland/deno/issues/1568) and there seems to be a lot of TLS support including esoteric use cases now.
If we take your supposition as true for the sake of argument, what else would have to be true? I think specifically any boat smaller than 50' would then become a target. As there are many, many boats in the Mediterranean that are much smaller, and easily overwhelmed by Orcas, if your idea was accurate the report would include many events of people being lost and their boats being damaged.

Those things haven't appeared in the press. As a result I'd guess that something more specific about these boats, or maybe this place, that has them attacking.
>>"I wouldn't want to be in a small boat or kayak near orcas. "

What about swimming with them?

https://www.youtube.com/watch?v=bTIcQMwYC1o

These are highly intelligent animals with complex behavior and in general, they are pretty friendly to humans. I suspect that the pod in the article has some powerful reason for attacking boats.
This is a really good point. “Stupid” is a fun and dramatic framing (I will sometimes use “drunk user” as the equivalent), but it’s also reductionist and less useful for specific design decisions. Thinking deeply about why they are operating at less than peak efficiency helps you make decisions that accommodate those reasons.
> I see you’ve asked similar questions to this since 2016

That's good context. And to OP's point,

> I have been in the field for a few years...this field has never been my passion, just a profession I like.

I've been programming professionally for 10+ years, 20+ when you add in college and what I did growing up. That, and computers are a hobby of mine, and I definitely have a passion for them, and I know a lot of stuff beyond my day-to-day work. I've worked for multiple FAANGs, at other big name's you'd recognize, and startups you wouldn't. I get past phone screens probably 80%-90% of the time and get offers 33%-50% of the time.

There are a lot of people like me in the industry. We're not a majority, but it's hard to compete with us, it's not helpful to compare yourself to us, but it's hard because that's what interviewers compare you against.

> Apply for jobs that don’t require algorithmic/systems interview tests.

Yup. Companies also go easier on system design when someone has ~4 years of experience.

> Crack the coding interview

I can't remember which one of these I skimmed, but I didn't find any of it super helpful. I might be the wrong audience.

> competitive programming sites

Not the "competitive" ones, but if you haven't done 50 medium questions with some easy ones thrown in on HackerRank before doing a round of interviews, you haven't prepared. I'd actually avoid the hard questions because they usually involve a twist on one particular algorithm that will take a while to implement, so you'd never actually see it in an interview.

The important thing is to know your way around heaps, trees, tries, linked lists, graphs, etc.

I found this book helpful, but I read it specifically because I'm better at coding than algorithms. It's not great for knowing how to combine standard data structures to solve problems or how to traverse a tree.

http://mimoza.marmara.edu.tr/~msakalli/cse706_12/SkienaTheAl...
We (and our ancestors) have been laughing for at least 6 million years (MRCA of Homo & Pan).

I don’t doubt that one day our descendants will prefer something else than laughing. I doubt it will happen in my lifetime though.
My approach is to provide 3 topics of conversation (no right answers just talking):
Let's say the person is applying to be a dev in product P.
1 how would you build an mvp for P? Which stack, what are the main issues, how would you deploy etc (usually I ask if it were a side project , so I can see which technologies are in the intersection of fun and reliable for this person)

2 what would be a moonshot feature for P? (If you had a perfect AI lib or unlimited processing power or devices spread all over the world)

3 if you had to find someone to take over your job (for you to manage the new one), what would you look for?
TLS is supported but poorly documented. I got something working after scouring Github issues and Stack Overflow. HTTP/2 is not yet supported.
Deno not supporting TLS isn't a show stopper, in my opinion. Not many production environments expose Deno (or Node) instances directly, but rather have a reverse proxy sitting in front providing SSL and routing.
“The researchers modeled the optical response and color appearance of nanostructures, as found in the natural world. They found that saturated, matt structural colors cannot be recreated in the red region of the visible spectrum, which might explain the absence of these hues in natural systems.”

Sounds like circular reasoning to me: “Red colors cannot be recreated in nature because (according to our modeling) nano structures found in nature cannot produce them”. What do I overlook?
What, like perl5 status?
Story seems pretty much the same with Web push notifications. You send a json to the temporary url provided by the browser push api.

1. From client get a push url.

2. Pass that to your app server for future use.

3. Send notification json to that url.

4. That url points to the specific browser vendor's Push notification server, and when it recieves a notification from your app server. It relays the message to the client.

And that url is different for different browsers.

Firefox - https://mozilla-push-service.readthedocs.io/en/latest/

Chrome - uses FCM

Can't configure a custom push server endpoint, like self hosted server without shipping your own browser.
An Introduction to Spatial Partitioning
They are probably orca-hestrated attacks...
Recently i interviewed a guy that failed all the questions. During interview.

I know he can do it. So we hired him anyway. He turns out to be really good and started contribution with in days.

Corporations really needs to know what kind of problems they are trying to solve. And see if the candidate is right fit for the job.
Better leave that to a terminator/proxy anyway unless you’re interested in hotpatching your app layer every month. It’s usually less problematic to upgrade a proxy.
I worked as a SWE at Google for several years on two different teams, I never talked about work with a non engineer, and one person I worked with talked to non engineers. SWE's outnumber SRE's by something like 10 to 1 at Google so my experience should be more common than the people you talked to.
You understand your comment is talking about the balancing act OEMs are supposedly putting on to save battery life?

You understand me replying to you and talking about how they're not balancing anything but personal gain and optics is relevant to that?

Or you don't understand that?
I also doubt that the point of the study was to find out which type of couple had "more" children - even if that is what the news picked up.

It is obviously important for population and demographic research to know just how age, type of couple, divorce, income, etc. effects family size with actual estimates.
> I've been interviewing non-stop for six months

Is this just market conditions right now? I'm guessing landing a job any time from 2010-2019 was easier?
The Computer History Museum organized a session with Eric Bier, and several other folks demoing the Mesa/Cedar environment.

https://youtu.be/z_dt7NG38V4

The only modern environments that seem to have kept alive several of these ideas are Windows/.NET/COM, the ones designed by Apple/NeXT and to certain extent Android (although with a messed up execution).

Even Linux could grasp many of these ideas, if D-BUS would be properly taken advantage of and settled on a specific development experience.

Somehow it looks like we are still missing so much from Xerox PARC ideas.
I agree with a lot of things you say, but I think that “lack domain knowledge” is a better description than “stupid”.

There are many people who have little interest in the underlying “how” and “why” of computers work. They haven’t been educated, more importantly they don’t want to be educated. They want to focus their time and energies on (What they regard as) more important things.

I have two bright teenage girls who need to use computers every day to get school work done. But their focus is art and reading, and writing. Their eyes gaze over whenever I try to explain why their computer is behaving the way it is.

My eldest did an amazing project in just a couple hours the first time she ever used Photoshop, removed a person imperceptibly from a old scanned image, realigned it to be upright from a mislaid scan, recolored it to make it look present day without oversaturating it.

Most of this she learned from in app tutorials. But I had to show her how to save the file and explain file formats and the difference between cloud and local storage. She just didn’t care about that part any more than she needed to turn the assignment on.

But how to use Photoshop is like another form of sketching or painting, so she ate those tutorials up like chiclets.
Hmm - in our case all of the embeddings we process exist on SSD already. Idk enough here honestly but will see what I can learn.
> Computers can be really frustrating to use, the biggest offender in my opinion is hidden state. So many programs don't mention something has changed, and so if you fumble a click or a shortcut you can end up in a program state you didn't want to be in and may not even realise it until something goes wrong.

There is a high degree of irony to this when you think about the extremely popular Unix philosophy, which is kind of the antithesis to what you're saying.

I know that it's meant for power users, but even for those in many cases it's still bad UX.
> Users have tasks to concentrate on.

Right, we also need to remember that simple is not better than possible.

If your interface is too simple and feature limited that your user can not complete their task, then you have gone too far.

We want to reduce friction as much as possible while still allowing a customer to solve their problem.
This is quite hand-wavy and not solidly founded. Some things that fall out from evolution align with advantages some do not. An example might be that 'allowing' a low rate of random murders may not have any practical difference in outcomes but humans are concerned with personal safety an a random event may apply to anyone so everyone (over) reacting would be the norm but not optimal in a game-theoretic sense. Negative bias leading to inaccurate judgements is such an example.

> cooperative species will have something that looks like morality

For the argument of the post to be valid, it has to apply to 'species' rather than a correlated subset.
I was wondering about the terms of this deal. GM agreeing to provide vehicles to Nikola is a no-brainer. Taking on a stake in the Nikola was the big question mark in my mind. If Nikola gave them the shares, maybe the goal was to give GM a reason to keep Nikola solvent? Now GM has something to lose if Nikola tanks so they might be willing to invest some amount of money or repetitional capital to keep them afloat?

Or maybe giving the GM stake was just another smoke and mirrors bit on Nikola's part so they could claim a high profile "investor".
> Python 3 provided no extra value at a high migration cost and painful library ecosystem issue

I disagree with this. There was a lot of value add for specific (and relatively common) workloads. If you were doing unix automation you didn't gain much (but I argue this is because unix does unicode bad, not because python). But web development did, even if most of it wasn't obvious or was too soon to be obvious.

As for c++ the effort the language goes to to maintain backwards compatibility has costs, both in terms of syntax and semantics. Those costs push people to rust etc. Much the same that migration to py3 pushes some people to go. It's difficult to say which is right without the ability to time travel.
Still remember that Javascript bug that only occured when Firebug was NOT installed.

Was quite tricky to debug, until it finally clicked. Back then the browser did not have a console.log() function.
Posting like this will get you banned on Hacker News. Please read https://news.ycombinator.com/newsguidelines.html and stick to the rules from now on.