skysight-inc/HackerNews huggingface dataset:
> What software would you write if you could write whatever you wanted using whatever language/technology you wanted?

The sort that solves problems I'm interested in. I love the idea of treating software as a home-cooked meal [1]: something you prepare with love for a small crowd of people.

For instance, I added a recipes section to my personal website. I also added achievements to it some time ago[2]. Both were completely pointless, but I enjoyed doing it the same way I enjoy cooking.

[1] https://www.robinsloan.com/notes/home-cooked-app/

[2] https://nicolasbouliane.com/achievements
When you say "phone home", how can we determine what kind of info is it sending to places like Facebook, Taboola, etc?

What does "phone home" actually mean?
I learned COBOL, Fortran and RPG II. I managed to avoid doing much of COBOL or Fortran but spend a few years doing RPG II. Glad that is in my distant path!
I understand your point but don’t see how it relates to the example we were discussing which has a paper discussing its markers.
We maintain a sensor network which consists of multiple nodes which emulate network fingerprint and characteristics of popular services. We did multiple experiments over a period of 3 years as part of tuning our sensors one of which was changing the SSH port of one honeypot to 38651. Less than 10 hits were observed on it over a period of 6 months and 7 out of 10 were legitimate (or misguided, depends on how you look at it).

During our experiments, we learnt a lot of lessons -

1) Attackers operate on a budget and are often time-bound (they have bosses as well). They have less incentive to target esoteric ports unless they have specific intel about it.

2) It is always a better strategy to ensure you waste their resources. No one is going to do full port scans of internet. The last I heard, adding an extra port to ZMap takes around 500 MB of extra memory.

3) The advent of intel sharing models typically highlight nasty scanners like a beacon.

4) Very few ISPs provide high bandwidth pipes to their retail (or even privileged) customers do full port scans. Its always a fight between scanning via low bandwidth pipes via multiple nodes over a long period of time and have less updated data or having to pay a lot more to get a 10GB+ pipe to do it which is bad for OPSEC.

5) Corollary to previous point, even if you control a large botnet that may do it for you, you will get reported or will have scanning, co-relation or computation issues. Or all of them.

6) Pareto's principle is everywhere, 20% of security/ sanity measures will solve 80% of your problems. Simply changing network ports, running your infra over a closed VPN environment, reducing your public internet exposure, configuring dual factor authentication et al - it seriously reduced our infra monitoring/ management upkeep.

7) The internet is full of spam (and water is wet), expect mass spam all the time on your mail sensors/ email IDs. Interacting with these will eventually get elevated to targeted attempts. Even simple browsing will sometime give you a high value malware payload served via AD networks that was previously unknown.
Practical Load Balancing with Consistent Hashing (2017)
As with any Postgres update, I recommend Noriyoshi Shinoda‘s super detailed change log [PDF] with examples as a reference for DBAs looking to upgrade. This version it’s 81 pages (so far): https://www.hpe.com/content/dam/hpe/download/pdf/japan/linux...
I asked this at a university recruiting event. What the CIA does is more hardware (gadgets) and embassy related.
I can't look past the syntax.
In fact, there are two general approaches to unifying ML with time series:

o Unifying ML API and patterns so that time series can be analyzed in the same way as normal tabular data. Example: sktime

o Preprocessing libraries applying data transformations to the input time series by converting them to a (tabular) form which can be used by normal ML algorithms. These are typically general or specific libraries for feature engineering, feature learning, feature selection and generic transformations. Examples: https://github.com/blue-yonder/tsfresh or https://github.com/prostodata/prosto

Which approach will win is not clear.
I took a bunch of screenshots to prepare for the session, which are available here: https://www.tango.vc/posts/working-session
Once upon a time Apple products were terrific. I was a big fan. They were solidly made. Their UI/UX was the best in the business by a wide margin.

Then Apple made a conscious decision to emphasize form over function. The result was products that fail often (e.g. the butterfly keyboard), cannot be easily repaired (if they can be repaired at all), and have a terrible UI/UX. Discoverability, configurability, and reliability are things of the past. Every software update (which are no longer optional, BTW) is a crap shoot (no pun intended) with regards to whether it will introduce more problems than it fixes.

> we get 5-6 years out of each one we buy

Then you're talking about products that were built before this trend really took hold. The butterfly keyboard was only introduced 5 years ago. The UI/UX horribleness began with Yosemite, which only came out 6 years ago, and didn't get really bad until Catalina, which is barely two years old.
Nikola/Milton and Tesla/Musk are inextricably linked. I mean... its even in the name.
> To compensate this issue a new optic surveillance system “Negus” with 300-400 meter range that was capable of detecting, when objects entered the house, what he did in the stairway and some of the main areas of his apartment.

Seems like the "Negus" device is a photo-camera with a large magnifying attachment, sturdy base, stereo viewfinder, and knobs for focus. I found a description and some pictures here: http://ussrphoto.com/Wiki/default.asp?WikiCatID=46&ParentID=...
that looks great! I made an extension too, but to add videos to my app with one click: https://youtu.be/MiiKrvxSNbo
Do you really want them to be able sell information about you like "Heavy home alcohol purchaser" to whoever pays them?
When you listen to some of these early recordings, you realize how far ahead Job's thinking was from almost everyone else. Then you realize it took him decades to eventually ship these things. Despite being often a dreadful person to deal with, he was an original thinker who could actually ship things even it took most of a lifetime.

I left Apple a year before he came back, I still regret it.
I didn't find urbackup trivial to keep running. For some reason I can't figure out, it stopped being able to backup the systemvolume, and I can't figure out how to get it to at least backup the C drives either.

Other than that, it did seem like it fit my needs. :(
just to be sure, can't this problem be handled in OOP with a "trivial" class (or object) field?
I agree. I came to realize a few years ago how arbitrary the HTML, CSS, JS separation is. It makes sense if you think of the web as simply a set of documents (with progressive enhancement and all that), but we've gone way beyond that metaphor. If you're building a web app, separating the three is cargo-culting.
Starting at PostgreSQL 12 you don't even have to feel bad about all of those CTE's.
> If you have multiple threads which try to bind the dynamically scoped variable to a new value, that should work fine and result in different values for the variable in each thread.

That would work with proper threadlocals. However with dynamic variables you'd also get this for different sub-thread stacks. Not all languages can expose that but languages with generators do e.g. in Python if you `yield` then the stack is suspended, this means a threadlocal you've changed would not be rolled back, but a dynamic variable (which Python does not have) would.
Replying to my comment because its too old to edit. Apparently Carmack is still somewhat involved and spoke at a recent Facebook event. He talked a bit about working on this problem. I'm hoping we see the results of Oculus' effort soon. I already like using it tethered to my PC, but if it can get significantly better that would be awesome.

He also mentioned he hopes they can eventually get an official wireless solution out to the public.
There is a flip side of that as well though. You may have a tool that tries to look at all SSH traffic across a fleet of servers (maybe trying to identify compromised internal hosts). If every server has sshd running on a different random port then you can't do this (or at least it becomes a lot harder).

More generally, I think there is in fact a trade-off involved in deciding to explicitly ignore standards. Whether it hobbles automated network analysis or just causes friction in the development process, it can add up over time. That is not to say it is always a bad idea but I would just caution that, just as you shouldn't blindly reject "security by obscurity" you shouldn't blindly accept "security through obscurity" even if you have layered defenses. There is no substitute for thinking about individual circumstances and weighing explicit trade-offs.
No. I want no ads, at all.

Ads and advertisers insinuate themselves into every goddamn situation, they destroy trust in human communications by introducing a profit motive f*cking everywhere, and they degrade every experience they're part of.

No tracking, no ads, go away.
Of course we can escape set theory (and categories) when talking about the natural numbers. The concept of "two" predates the concept of a set by at least a thousand years. People were happily manipulating and investigating the natural numbers before set theory ever came along.

As I said previously, it is true that set theory provides a way to encode the natural numbers as sets (or features of a topos, etc.), so that questions about natural numbers can be stated as questions about sets. It is further true that this endeavor can be incredibly fruitful, for instance for studying the foundations of mathematics. But it does not mean that natural numbers "are" sets (or objects in a topos), any more than Quicksort "is" a piece of C++ code.
The referenced page seems say you get an additional 13 days of sick time per year, carried over in an unlimited amount. So that would be 26 days per year from the start.
Good managers are like unicorns. I have yet to see one.
The US has fought some interesting cases that have extended US law outside of the United States and cases that allow foreign nationals to use US law outside of the United States. A good example of the latter is when Iraqi citizens were able to sue Blackwater in a US court or where asylum seekers were able to sue governments and cartel members in a US court.

The way I see it, as a largely uneducated-about-the-formalities-of-law citizen, is that this exemplifies the need for a world court who has proper interests and jurisdiction to hold fair trials for international matters.
Also, if you can change the framing so the decision becomes 'which option should I go for?' instead of 'do I want to buy this at all?' then that's a valuable bit of sleight of hand. But it comes with the risk of decision fatigue
I agree. You have to know your lego blocks well and understand where they fit and where they don't. But if you choose to remain ignorant of the available lego blocks, and instead write everything from scratch every time, you're wasting a lot of effort.
> If you’re really just publishing materials you got from a leaker, you’re protected.

My understanding is that they (the US government) have actually argued the opposite during the hearings.
The federal government pays a comfortable six figures (if I were offered this kind of job without being told the salary, I would value that opportunity estimating the salary to be $150,000). Plus you retire really early (I'm not certain whether CIA lets you retire after 20 years, but many fed roles do, with full salary), plus you have access to really hard to find information (valuable from the point of view of sheer curiosity). Not to mention, if in the course of your research you make enemies out of say hackers in Russia (totally plausible if you're researching computer security) they'll think twice before messing with you because you're part of the team (some liken it to being a "made man").

And you get paid that salary and those benefits even if for reasons outside of your control you don't come up with anything. I would speculate there's a limit to how much you can keep trying and failing, but at that limit you get moved to a different role where you don't need as much luck, but I know this is a smooth process.

It's a far cry from an entrepreneur with no backing, or even VC backing. VC's generally don't take technical risk, only market risk: they won't pay for you to come up with a 10x better product, instead their contribution is backing an working 10x better product and helping it debut in the market (product-market fit, or final stages of development, but no research). And if for reasons outside your control your research fails in the market, venture capital practices "venture capitalism", you had a shot, you tried an adventure, it was an incredible journey, but they can't afford patience and faith like the federal government can, so they pull the proverbial plug.
He was not under house arrest. He choose to enter the embassy, he chose to break bail.

Now the point about I may have done same thing given the same actors against me - does not make it house arrest.
At least for me, this is exactly why I do personal projects. E.g., here's something random I did a couple weeks ago. It's so simple that it's almost embarrassing to post, but it's:

100% vanilla Javascript
no dependencies
no cookies
100% client side; no server side state, no ajax
state is stored entirely in the URL
state is correctly maintained across page loads (i.e. page edits its own URLs to maintain state)
Javascript is 100% local, so it's instant and doesn't require any data fetch
correctly detects a potentially spoiler-full page load by looking at the referrer (so it doesn't annoy you as you navigate around the site)
... and the entire thing is less than 100 lines of code

And it was surprising to me how genuinely fun this project was. I work on compilers/runtime systems for a living and I often get stuck in large code bases. I enjoy what I do, but working with a small codebase that's not massively overabstracted is just so fun.

https://exanderproject.com/spoiler-test/

The other thing that stuck me, as I was doing this, was how much the Javascript ecosystem has improved over the last 10-15 years. It was possible to do this in a very small amount of code with no dependencies precisely because of the all the bells and whistles that have been added to Javascript over the years. Maybe this isn't so obvious to someone who has been neck deep in Javascript for 15 years, but as someone who has been mainly in other languages, it was a very noticeable and dramatic improvement. The web platform is way, way nicer to develop for now than it used to be when I first got started.

Now I'm trying to figure out what other small projects I can get involved with.
Leave a comment/post-it note on any website and refer back to it later
Show HN: Realtime Collaborative Drawing with WebRTC and Canvas
And on top of that you can't read HN at work from your air-gapped locked-down PC!
“Protecting your source” means that you don’t disclose your source. It doesn’t mean you help your source cover up a crime.

This is not a difficult line drawing exercise. Lawyers do it all the time: you’re protected from disclosing client confidences. But it’s highly illegal to actually assist your client in obstructing an investigation!
Expected Value Game
> Not to mention that those CRUD apps have been done, exactly the same, 10000s of times before and 10000s of people are doing the same work you are doing now at this moment.

And yet now OP is making wood furniture, which has been made before the same thousands of times. Some people need originality some don't. Some just like the work for its-own sake. For those who need originality they should find a job working on something that's not a CRUD app. Not everything is a CRUD app. That's on them.
That's not true. Median single income in Alabama is $26,846, most of Western Europe is above that.

Alabama: https://www.census.gov/quickfacts/fact/table/AL/BZA210218

EU: https://en.wikipedia.org/wiki/Median_income#Median_equivalen...
I'm with you on that, but I still find the game forced enough combat on you (especially the end game) and it didn't feel good.. I felt like a lot of my deaths weren't due to my mistakes but to the gameplay being janky.

But of course I'd say that. ;-)
The key paper (Consistent Hashing with Bounded Loads) referenced in the video: [0].

Here's a similar talk by the same presenter (Andrew Rodland) from HAProxyConf 2019: [1]. It's a bit broader and less iterative/historical which I preferred about the OP.

[0] https://arxiv.org/abs/1608.01350
Nope. An ASP.Net MVC project dragged through since CTP versions.
You can do left to right function composition with (>>>)

Given functions f, g , h,

h >>> g >>> f is equivalent to f . g . h

Its from Control.Category, so it generalizes to other things, but for functions specifically its left to right composition.

( theres also (<<<), which in this case is identical to (.) )

( Also present in Control.Arrow . Why? I dont know this topic well enough to explain. My understanding is limited to what these operators mean in the specific of functions. Functions(->) are a type as well, so they can be instances of typeclasses. for example

instance Functor ((->) r) where
fmap = (.)

)
> I wish I could go back in time to when I didn't need to tense up before opening up the news each day.

This really hits home. These four years have been such a depressing time for just reading the news. Every day it seems the US is edging closer and closer to.... I don't even know what. With half the country happily marching to the drumbeats. It's amazing just how fragile our systems were.

I've been wondering if it's just mentally more healthy to go the ignorance is bliss route. I know so many people who don't even register these kinds of events, and they seem happier.
My VPN doesn't answer to my government. It is not how well do you hide, it is from who.
Not a huge fan of journalists or the BBC but in this case what are they meant to report? Vallance saying "this is not a prediction" and then making a prediction just reinforces the impression that the UK's public health officials are trying to have their cake and eat it.

He said:

"If, and that's quite a big if, but if that continues unabated, and this grows, doubling every seven days... if that continued you would end up with something like 50,000 cases in the middle of October per day. Fifty-thousand cases per day would be expected to lead a month later, so the middle of November say, to 200-plus deaths per day. The challenge, therefore, is to make sure the doubling time does not stay at seven days. That requires speed, it requires action and it requires enough in order to be able to bring that down"

If that's not a prediction but rather a pure hypothetical then why is he saying it? And why is he then using what he just said to justify a call for "action"?

If it looks, walks and talks like a prediction then it's a prediction. The BBC are right to ignore his mealy-mouthed attempt to wriggle out of accountability by pretending it's not.
Great video, I think I've watched it at least once a year since I found it.
use grammerly... oh grap
A few useful resources:
If you don't want your SSH server being found by trivial port-scanning, apply port-knocking:
https://github.com/moxie0/knockknock

If you want to help secure the interwebs, host this tarpit to try to slow down network scanners:
https://github.com/skeeto/endlessh
Because AOA sensors > 1 (2?) was an option but not in the base model.
That works both ways though. Imagine in your scenario you have thousands of servers across a large organization, many that may be running on auto-pilot and don't have any active team maintaining them. When the hypothesizes critical OpenSSL bug pops up, the first thing you will want to do is find out all the server in your network running sshd so you can patch them. If they are all listening on some random port then that task becomes much, much harder.
If the attackers are using botnets to distribute the load across IPs, then perhaps we need to distribute the detection across IPs: https://www.abuseipdb.com/fail2ban.html
All these complaining is funny. I was building software since the later 1990's. I'm not tired of it. Sure, most of the jobs out there are your standard CRUD stuff. But I still like it.

A lot of people complain about not having interesting stuff to work on in the day job. Well, that's why it's called a job.

I was burnt out from my software job as well until I got a shift in perspective. I picked up a photography hobby and got pretty good. In fact, I was seriously contemplating changing careers and was gaining steam. But I realized the more clients I picked up, the more uninspiring crap I had to shoot. This wasn't your everyday wedding or family photos. It was fashion photography where the industry was seen as more "creative" and "edgy." But once you get down to it, it was the same crap as any other job.

Sure I shot a lot of my own personal projects as well (like open source projects for software engineering). In fact, in that industry it's more required to have a huge portfolio of test shots where you're constantly evolving. In software engineering, that's not as required. But even that became a grind since you're pressured to constantly hone your blade while new, younger, more creative people were coming up.

Is it hard dealing with your manager, product managers, changing requirements, etc. in your software job? Well it's the same stuff in commercial fashion photography. Change their minds constantly. Sometimes I doubt they know what they want either. Budgets change, scope changes, a ton of politics, and so on. It's all the same.

This is when I realized I actually liked software engineering better. I found it more fun solving "boring" problems and learning the new technology of the day instead of hustling hard in the photo industry.

I get people complaining about not doing interesting work in their job. But that's what 99% of the industry is. You'll most likely create another CRUD app or work on stuff that is the least interesting to you. Only the lucky/elite 1% (just like in other industries) gets to do cool, interesting stuff.

Grass in greener on the other side. But I've stepped my toes on the other grass, and it's the same shade of green. I learned to enjoy my job as a software engineer. I'm in the 40's, and hopefully I'll have enough energy to keep it up for 20+ more years.
That video is a year and a half old. I hear the game has improved since then, but I haven't tried it myself.
Same, and I'm in Berlin. I asked a few friends spread around EU and all of them saw the error page.

This is probably a dark pattern disguised as a mistake.
Until you travel to the US. I am sure the DHS uses this data as well.
This is not necessarily true. In a large enough organization you can have a lot of that done for you, and you just basically "pull tickets" (to be reductive about it) and deliver the work.

You have to be able to interview well of course, but do design and project management? I'm not talking about a freelancer who delivers an end-to-end project here, I'm talking about hiring a remote developer to join an existing team and deliver features.
The Leitner system is a good mechanism for spaced repetition: https://en.wikipedia.org/wiki/Leitner_system
Incidentally that makes it super easy to mock out or intercept subsystems if they use dynamically scoped hooks e.g. in most languages intercepting stdio is a pain in the ass (you might have to swap out multiple globals, it's not thread-safe, etc…).

If you're in CL however, you can just rebind standard-output and you'll capture what anyone downstack sends there.
Docker works fine with IPv6. Don't get me wrong, it had it's fair share of bugs over the years, but recent releases are in a usable shape.
How to Tell If You’re Running a Zombie Startup