skysight-inc/HackerNews huggingface dataset:
This is silly. But let's take it seriously for a moment, and talk about threat models, the ones that Troy Hunt has brought up specifically.

1) Threat: Unencrypted Traffic

An international VPN doesn't solve this. If the traffic is not requested over HTTPS, it will be equally unencrypted once it exits the VPN tunnel. At which point your traffic is not only vulnerable to the VPN and the VPN's ISP, it's vulnerable to the various national firewalls and interconnects your traffic is traveling over that it wouldn't normally.

2) Threat: Phishing

Troy Hunt's Nord VPN only prevents this because the VPN is intercepting and changing DNS requests. It won't help with DNS over HTTPS, as an aside.

3) Threat: Privacy

As pointed out in 1 and 2, using the VPN doesn't increase your privacy; it actually decreases it. All a standard VPN does is change your source IP.

A couple of other threat models:

4) Rogue ISP

Now, if your ISP is truly rogue, a VPN might help lessen some of the problems, but no more than conscious awareness while browsing the web will. If it's not a secure page, it's not a secure page, whether it's been served over a VPN or the most hostile ISP known to man.

5) Government Wiretapping

A VPN, even an international VPN, will never stop a state level actor if they really want your traffic. International agreements (such as 5 eyes) exist to make these kinds of requests easy.

IMO, the only real use of a VPN is to bypass IP based region checks. But since VPN endpoints can be detected, that kind of fix is a cat and mouse fight at best.
Albeit a now invisible knob that must be searched for via a door scan. While I don’t personally switch my ssh port from default, I would imagine doing so would cut down on a ton of the noise from lowest common denominator ssh attempts.
Really, you should not be using passwords at all. We have key-based authentication for a reason.
> I think it's pretty universal and why it should probably be more common to switch industries a couple times at least through your career to keep things fun and not stay in a burned out mentality forever.

Isn't that years of education and work to start at the bottom again? If one has a family to support doesn't seem terribly feasible.
At some point, the experience becomes an endless pile of permissions dialogs. We already see this and see complaints about it.

I think this article is a bit alarmist and overstates the issue. So long as much of this data is limited to foreground apps and background activities are strictly limited, the issue is not nearly as bad as they suggest and as I mentioned previously, I find it unlikely some of the specific abuses they mention are even likely to happen.
I suppose covid is bad for quibi's content creation side. But from the demand side, it's probably the best it will ever be. The fact that they couldn't drive adoption during a nationwide lockdown says a lot. Although, they may have had very little content available, I am not sure.
"while money corrupts on an individual level, it purifies on an institutional level."

Adam Smith wrote both "The Wealth of Nations" and also "The Theory of Moral Sentiments." Your comment is deeply insightful, and it is a feature of markets that wasn't missed by him. So dismayed that I think a lot of people overlook this important effect.
I followed the three years of the so-called investigation that had to do with Trump's alleged links to Russia. That turned out to be a complete fraud perpetrated by the DNC and their cronies in the FBI and the CIA. Let that sink in. The DNC literally made up an accusation about a duly elected president, the Obama administration used that lie to conduct illegal spying activity on the president, and then worked up the whole nation about this lie for THREE YEARS. Then they wiped their phone records to cover their bullshit: https://www.washingtontimes.com/news/2020/sep/11/robert-muel...

There are few things more dangerous for democracy than using the police power of the government to go after your political opponents. That is corruption of the highest order. It's toxic, it's dangerous, and it will fucking destroy this country. And the number of people that are still completely ignorant of this travesty is astounding. Yet that's the world we live in. The media has devolved into a completely partisan shitshow.

You're sadly misinformed by yellow journalism. I will continue to proudly support President Trump. I'm pro-peace, pro-2A, pro free speech, pro law and order, pro life, pro-energy, pro-prosperity, etc. I don't very much like crime and anarchy and ruin and corruption and cronyism. Looking at Democrat run debacles like Portland, Seattle, Chicago, and NYC, you really still think they deserve power? I don't think so. And neither does the sane half of the country.

Biden has had 45 years in the highest offices in Washington. He was corrupt before he was senile.
Non paywalled link:
https://outline.com/K49CFh
Someone should come up with a site with specific regulatory-approved form to request ALL information from ALL tracking companies.

Let flood them with never ending, millions of requests and make sure they comply with the each of these according to regulation.
Reducing Bounded Ethicality:How to Help People Notice&Avoid Unethical Behavior [pdf]
John Regehr's integers in C quiz
Heck, some cloud providers have password logins by default. Since the instances are easy to setup I'd imagine many companies operating with a no-ops situation are vulnerable and don't even know it.

And then there are side projects. I remember being educated enough to know better, but doing it anyway as the server was a $5 digital ocean droplet, used to run a tiny minecraft server for some friends. Got brute forced and spent the next two weeks red-faced, trying to get DO to allow network access again so I could at least grab a backup before nerfing the droplet.

Now I use a basic ansible setup to automate changes to sshd so I don't have any excuse to be stupid again.
I’ve said this before, but I think people focus on the wrong thing with the Assange case. They 100% can do this, because the U.K. signed a treaty that let them do so without _even_ getting reciprocal rights.

I mean, congratulations to the US negotiators but the UK 100% should not have agreed to it.
> According to the indictment, Assange was running a whole operation where he was recruiting hackers to get sensitive data from protected computer systems.

This is an accusation, and is not fact. You'd be wise not to treat it as such until it's proven.

The main issue with the course that you seem to suggest is that by the time he might obtain a jury trial in the US, he will already be subject to US imprisonment, and thus, torture (which is precisely what happened to Manning). Countries that purport to be free (such as the UK) should prevent extradition to countries that torture suspects prior to trial, such as the US.
FWIW I don't care for the title as I don't think it's a good article summary. In short, the article describes:

1. The history of redlining and how many urban areas became structurally disadvantaged when the FDR administration introduced heavy home mortgage subsidies and specifically excluded low-income and minority areas. This quickly led to a shift to the nationalized home mortgage market we have to day, and basically ended the ability to finance homes in redlined areas.

2. A path for reinvestment in these communities and the people who live there that cities could take today which would help close the wealth gap they created by redlining in the past.

It's a sensitive subject, but worth thoughtful consideration. While the HN crowd tends to be aware of such things, most Americans don't realize that (by design) local government wields most of the power in the US, and that most of the government impacts on our daily lives come from that level of Government.

Consequently most of us also don't realize how damaging the local policy changes kicked off in the FDR era have been - or even realize that the daily life most of us live (driving everywhere in the suburbs, 50' suburban lots, shopping centers with huge parking lots in front) are not organic creations of the free market, but strictly regulated creations of the local government.

To really get a handle on how this relates to racial justice issues, it's worth exploring the original redlining maps themselves, and reading how they describe the rationale for prohibiting investment in certain areas, eg: https://dsl.richmond.edu/panorama/redlining/#loc=13/37.772/-...
“I am going to a commune in Vermont and will deal with no unit of time shorter than a season.”

— Josh Rosen in The Soul of a New Machine
The COBOL codebase I have seen I'd rather not have ported.
Is there anyone notable using it in production?
In Poland people switched to Facebook due to network effect and because it's super hard to compete with preinstalled application. Local competitor had 10M users (same as Google usage, 40M country) and lost due to preinstalled FB apps on mobile.

We still have local competition to Amazon but I guess days are numbered as they just filled for IPO.
The Fight Against Words That Sound Like, but Are Not, Slurs
In practice, yeah, "an average person" wouldn't know where to begin. And a brilliant high schooler who hasn't studied maths beyond the high-school curriculum won't ace the test. Though he could get a medal, particularly if the geometry and combinatorics questions are friendly.

But the conceit of the IMO has always been that the problems are drawn from a very limited selection of fields, which are/were commonly taught in high schools around the world. No need for complex numbers, calculus, abstract algebra, or trigonometry (though any of these may end up used in an alternative solution).
Useful Functions for Game Development
In most scenarios, high-touch saas is harder to bootstrap. Your network will smooth out the friction of getting in the door, but there are other factors that make this hard to bootstrap:

* Expensive headcount - high-touch sales requires sales, marketing and other GTM teams. Sales, especially, is very expensive.
* Customizations - enterprise customers will want additional features above and beyond what your MVP offers. This will require additional engineering/product/design resources
* Security audits - IT of the enterprise customer will want to see recent security audits which can range from $20K and up
* Stability guarantees - enterprise customers are wary of offloading their workflow to small startups that might go belly up. Having guarantees, such as VC funding, will acquiesce them.

A common path in B2B is to start with low-touch SaaS business (which is easier to bootstrap) & then move up-market.
That isn't how our democracy works. Congress doesn't get to decide who gets to be president, the voters do. We don't have a prime minister.

An executive order can literally declare anything it wants. If it goes against the law, that is where the courts come in. Congress can't tell the president what he can and cannot write, if the president writes an order that goes against the law, that is where the courts come in (and that is what is happening).
I have a question, How do you make a web browser with no coding?
?
>The whole 'Nintendo is a thing unto itself' narrative is fading quickly.

I fully agree with you, but that narrative has started changing only in recent times. Not that long ago, I would have mostly agreed with the premise that "Nintendo is a thing unto itself."

If my memory serves right, Nintendo was dipping feet into it since at least GameCube/Wii era, but only with Switch they started seriously being, in my eyes, a not "unto itself" kind of an entity.
For the JVM it's worth noting that Project Loom[1], while so far focused mainly on concurrency features like virtual threads and continuations also includes a proposal to implement better tail calls in the JVM:

> it is also the goal of this project to add an even lighter-weight construct that will allow unwinding the stack to some point and then invoke a method with given arguments (basically, a generalization of efficient tail-calls). We will call that feature unwind-and-invoke, or UAI. It is not the goal of this project to add an automatic tail-call optimization to the JVM.

Since this paragraph is explicit about the feature not being "automatic", it'll be interesting to see what form this takes.

[1] https://cr.openjdk.java.net/~rpressler/loom/Loom-Proposal.ht...
Show HN: Get things done with daily accountability
My least favorite Rust type
Yes, client will notice that server fingerprint changed. So the question is, how many people will ignore that notice and still enter their password? SSH is a good software in that regard, as it allows clients to notice that server changed, but still it's an attack vector, one you should not just dismiss.
as a mediocre programmer who is now old let me tell you that you still do not need me.
Grot did it first, and they did it Worse!
http://www.leonardrossiter.com/reginaldperrin/Grot.html
How do you get your cookie ID?
Or alternatively, hide the popup prompt from showing up at the first place as I found myself clicking "Consent". That tends to be a quicker path to getting things done than figuring out whatever wordings the designer came up with decline.
Modern COBOL would have a DDL which makes using JSON-like and XML-like nested data structures as easy as its existing DDL makes using record-oriented data structures.
> The problem is when you only use security by obscurity.

He literally says this exact thing in his comment.
Is it the same wheel? It sounds like you wanted a Honda Civic, but you used the wheels from an Abrams tank. So obviously the solution is to invent a tank wheel <> Civic chassis adapter layer?
Building a house and putting the front door on the side or back of the house doesn't change the security of the door. Whether it has a weak lock or not doesn't depend on its location.
> Every paying software job I've ever had was in some way involved getting people to click on ads.

That's an amazing fact.

May I ask how old you are?

I've been designing SOCs, DSPs, Control Systems and a lot of software for various systems since 1985, and I can only recall one that might have been close to "clicking on ads" (it was a personalized "on hold" system for dial-in to major retailers (like JCP), to replace Muzak with offers and information and stuff). I was the VOIP-to-Enterprise-Telecom integration guy, so not directly tied to the ad-part, but the company pushed couponing to their clients pretty hard.
This only makes sense if it's the only form of security, which would be stupid.

I had my personal server on p22, and got thousands of attempted attacks a day. I don't allow password authentication, only a key. I moved the default port not to reduce my risk too much, but to reduce the total number of attempts. Just by moving the default port, unsuccessful attempt dropped by 100x.
Wasn't at least the idea that it'd be short-form stuff people watch on their commute and other short breaks, whereas in the lockdown long-form stuff probably wins? (especially since as you mention their backlog likely wasn't that long - 20x 15 minute bits are 4 weeks of one per workday - or two afternoons)
.. because you sold it to us to use?
Thank you for the clear, comprehensive response. This definitely tickled my brain into considering a few more angles. Risk management wasn't actively on my mind so thanks for the reminder. While I did mention that the goal of the project is to bring down the software cost for these businesses, I considered it to be implied that there should be a significant improvement to existing systems. I say this because focusing on a single version after listening to prospects of multiple potential customers, should generally produce a system superior to those maintained individually by each customer. At least I am inclined to believe this at the moment. But you're right that I should be careful in framing my pitch.

PS, I think many many people have said something along the similar lines. "Your product has to be 10x better than the customers' next best alternative."
The trace isn't repeating. Those are individual call stack records. It is just printing the trace as it is.
Yeah, you may be right. This may be the "sleight of hand" happening here.
The most relevant problem right now is not to produce (clean) energy, but to store energy.

Hydrogen could be produced in areas which could not be used otherwise, as long as water exists - making the worse energy conversion efficiency a bit moot. Large-scale hydrogen production could both desalinate water, making it useful to surrounding areas, as well as produce hydrogen by solar power in areas currently uninhabitable.

Hydrogen has to be kept at around 20K to be liquid. It could be transferred though in gaseous form in existing pipelines (see e.g. https://www.energy.gov/eere/fuelcells/hydrogen-pipelines), cooled down only at the receiving ends.

It could make use of tanker ships, equipped with insulating tanks. In aircraft, hydrogen based fuel needs to be stored as a liquid, requiring expensive (both in terms of weight and of actual cost, see https://en.wikipedia.org/wiki/Hydrogen-powered_aircraft for references) insulation, but still it'd be about one order of magnitude more effective in terms of volume/energy than existing batteries.

It is hard to achieve similar results with plain energy. It is a bit comparable to this: https://what-if.xkcd.com/31/ - latency is much lower with energy lines, but volume could be much higher with bulk transports, like container ships.
It depends on the project.

I'm a manual tester who's worked on many different projects. The larger ones have had a separate automation QA team.

On the smaller projects, I'll fetch the code base and suggest missing unit testcases to the developers.

Without writing a wall of text, I feel that dismissing the value of manual QA is like dismissing the value of a business analyst or project manager who doesn't write code.

My value comes from helping make sure the customer got what they wanted and it works - and I can do that without writing much code. But that's not to say I don't use tools and scripts to automate some of my work.
I read a good portion of the FAA's preliminary report that came out a couple months ago. They are completely incompetent. The report didn't include ANY data about rate of failure of AoA sensors, number of engagements of MCAS in the field, or number of flights where the plane was landed without MCAS enabled.

It contained vague statements like 'rare set of circumstances' with ZERO data on the expected probability. As we know in the software world, a 1 in a billion chance could happen many times per interval given the scale of any particular problem.

I'm never stepping foot on a MAX.
Did I miss it or did the author also discuss the strokes created with the Apple pencil?
The problem with this is the terrible analogies. Frequency hopping is just that - hopping. Not picking a single frequency. Hiding a tank works for a while, and you'll move it pretty soon so there's no time to find it.

Setting your SSH port to be something unusual, and leaving it forever, is not the same as those.
not working from Portugal either
Because I didn't see a link to it in the article, a brief explaining why the decision was made: https://www.justice.gov/opa/pr/department-justice-identifies...

If you govern a people and willfully allow them to become endangered through, eg. defunding the police, permitting lawless zones throughout your jurisdiction, and so on, and the end result is innocent lives under your power are harmed or destroyed, then you should be held accountable.
Do GitHub Stars Matter?
> why did they have to mess with the program for andromeda?

Obviously everyone has their opinions, but I thought Andromeda the strongest sequel to ME1 story content wise. Andromeda's failings weren't in the story or the content (ME "B-Team" or not, thanks to Anthem's black hole, they wrote most of the strongest story content in all four games), they were technical. EA absolutely should not have pushed BioWare to Frostbite without properly productionizing Frostbite as if it were Unreal/Unity with a dedicated team and possibly an honest attempt to sell it as a product outside of EA's walls, instead of leaving it as DICE's in house with BioWare struggling to keep up with forked changes. Almost all of the technical problems in DAI, MEA, and especially Anthem seem clearly the fault of this broken engine relationship between DICE and BioWare. If EA wants Frostbite to be the next Unreal (or even just an okay competitor to Unreal) it needs to learn (five years ago) the lessons from Unreal that you treat even first and second party games as if they were third party customers to get the best results.
Local Scientist Leads Team Fighting Covid-19
> This is an accusation, and is not fact. You'd be wise not to treat it as such until it's proven.

Sure. But extradition hearings necessarily operate on allegations because they come before a jury trial that will determine the facts.
I tried that (I've done this many times because of local development of APIs), but Thunderbird doesn't seem to use this. Or: it is another problem, but Thunderbird doesn't give any helpful message.
It would be great if we stop adding features now. Are there any pieces of software that has started doing this? Why are we perpetually in this loop of feature creep?

Like a painter, you must know when to stop painting. This is a real dilemma all painters face, especially when dealing with watercolor. If anyone has tried painting here, you know exactly the problem - how do you know you're done? It applies to writing and music as well, but it is more evident in visual arts than any other field.

I wish there was a Postgres branch that took previous version and then just applied optimizations and bugfixes. No more.
>> If an EU user sends the US user a message it cannot leave the EU.

I think you got this wrong. That's how mail, email, chat, phone calls and pretty much all the "standard" communication services are working. The message can surely leave the EU. It's user's data (i.e profile info) that shouldn't leave the EU.

>> To claim that this is about monetization is laughable, this ruling doesn't prevent monetization it just prevents data flowing out of the EU.

This is about data protection which includes privacy rules among other things. Nothing stops US corporation from operating datacenters in the EU. They developed datacenters in the EU before all this anyway.

The "issue" is that the data stored within the EU is subject to EU law so legally the foreign corporations cannot share/resell the data with 3rd parties(e.g adv publishers, gov agencies such NSA etc) in a way that breaks EU law.

The EU just tries(nicely) to tighten the screw a bit... just look at the US-China-Tick-Tock-Oracle saga. Governments want exclusive access/ownership/control of theier citiens's data for obvious reasons.

>> This pretty much breaks any data driven business model you have into two distinct ones, and if your EU and US datasets are too small individually when then though luck.

How could EU and US dataset be too small individually? Too small for an inter-planetary marketplace? Here on earth they are quite big and valuable if not the most valuable.

If your concern is user's privacy/data protection you shouldn't be worried. You will try to store less data on your servers and give more power/ownership to the user anyway. In the end the data should be owned by the users.