skysight-inc/HackerNews huggingface dataset:
mostly copy-pasta from an earlier comment[0] of mine:

https://github.com/99designs/aws-vault/issues/578 was for an issue with remote servers accessing the localhost ec2 metadata service that aws-vault can run, that worked exactly by using DNS rebinding. It was fixed only months ago, so it seems like this is a developing area and if I were on a red team or pen testing, I would play around with more.

I visualize the "localhost hole" problem of blindly trusting localhost as an air gap in a pipe (like [0]); anybody could come along and either drop poison in the pipe, or redirect the water coming from the top to their own bucket, or both.

I appreciate that Boundary gives completely generic identity-aware-authenticated TCP sockets, but I don't know of a way, today, to make those not accessible to browsers through dns rebinding attacks.

This is probably much much too far in the weeds and this is unlikely to contribute to a major breach (unlike the aws-vault one where of course attackers would try to access the fake metadata service on the default port, because it's high-value and on a well-known port), but I'm interested in the space.

[0] https://news.ycombinator.com/item?id=23265509
[1] https://districtsales.ca/wp-content/uploads/2019/07/tru-gap-...
It kinda undermines the premise of General Grievous too imo. The reason that he was so powerful was because he was a cyborg, with machine precision but also organic strategy making that made him far stronger than any droid.
> if you believe that computing cannot scale without correctness. He was wrong about that one thing, and to be fair to him, it's still a little amazing in retrospect,

That is clearly wrong if one is willing to take a moment to stop gazing at the wonder of pure mathematics and look at the outside world. There is no notion of "correctness" for the pyramids of Egypt, the dykes of the Netherlands, Milan Cathedral, or the world economy and yet those huge-scale systems all function.

> Dijkstra's pessimism and his use of harsh, attention-getting language makes a lot of sense.

It makes sense in terms of Dijkstra's personality, but it makes no logical sense. If you believe mathematical correctness is such a valuable principle, then you should be able to leverage that same principle in one's own arguments. The fact that Dijkstra couldn't dispassionately prove that correctness was vital and had to resort to emotionally-loaded weasel words undermines his own claim.
I think you can courageously follow your heart even if you know you won't die for thousands of years.

Perhaps a world in which a 5000-year lifespan is common will be a world in which people are more socially courageous, more daring, as they know they'll have plenty of time to recover from a mistake.
Personally I’ve been a big fan of strongDM (https://www.strongdm.com/).

Lightyears ahead of teleport or any of the other solutions out there. Built for great auditing and zero trust.

Best of all it’s multi-protocol. So you can do SSH, SQL, K8s, HTTP all with one access system.

Had it in prod for almost two years. Gonna be a long time before hashicorp or anyone else can catch up with the level of depth.
It's also possible that we try to hard to generalise things and for a handful of lines of code it's just as valid to provide different implementations for each rather than spending time evaluating an abstraction that's as likely to only be identical in implementation due to incomplete use case or just the product of the sheer coincidences that appear in immature code.
> Blogging has probably moved to Medium, Substack, static sites, etc.

Where are you getting this information? WP is an order of magnitude larger than all of them combined for blogging. Matt Mullenweg's 50% market share goal isn't crazy hyperbole.
You seem to be confusing two things - system working and system being un-exploitable. Example - it's pretty easy to shoplift in any of the retail shops. In fact, shoplifting happens all the time. Still, nobody would claim retail model doesn't work because people would just come and shoplift everything and nobody would pay and the retailer would go bust. What actually happens is that vast majority of people do not shoplift, and the retail system works and produces massive profits.

> but cryptocurrencies have the advantage of being completely faceless and totally unaccountable

Advantage, but also disadvantage. If a bank cheats you, you have options to complain to regulators, to the police, to the FBI, to you Congress representative finally. It won't work in all cases, but it's an option that's available to you. If a crypto scammer cheats you, well, nobody is accountable. For some people, it's a big issue, because it greatly increases the friction in transactions.
Nope, but I see now why we're disagreeing. It's because the animation you linked to is misleading.

Work is the dot product of force and velocity. If the thrust is always orthogonal to the velocity, then the burn does no work on the rocket, and so it can't increase the magnitude of the velocity.

In the animation you linked, it's plotting out what would happen if you continue to burn due north for some period of time as your velocity vector changes. But you wouldn't do that--if you're trying to change your inclination, you burn perpendicular to your velocity, and as the direction of velocity changes, the direction of the burn changes too, such that it's always orthogonal.

It's easy to watch this happen in the game if you don't use the maneuver node, but just use SAS to burn in the normal direction. The direction of "normal" changes during the course of the burn, and (except for small errors), your apoapsis and periapsis stay constant.
I think the problem was that auto-unseal wasn't free (it is now, so kudos to HashiCorp for listening).
Woah, I’ve been looking for a comparison like this for quite some time. Thank you
There are 'certification' programs in many areas, but they're not universally viewed as positives. My experiences getting some certifications... gosh - 10 years ago now - I did it, but half the hiring folks I talked to didn't care at all. Given the time/price, I don't think it was a bad cost/benefit ratio. I needed it for a specific job, but outside that specific job it didn't help me much. With that said, I already had... 12 years of experience and had a moderate-sized network of experienced colleagues already. I think certs can help less-experienced folks get a foot in the door, but again, only at places that place any value on certs in the first place...
That's true but misses my point; people's perceptions of me haven't changed because nobody (should) be going close enough to me to smell me and because my mask conceals any stubble of mine.
The Devil Is in the Data: Overhauling the Educational Approach to Ethics in AI
I strongly suspect the parent is talking about Valve Index, because HTC Vive is pretty much an old-gen inferior version of Valve Index.
I have been researching into several testing approaches and so far in my experience yes fakes are better than mocks. But what is even better is not having to fake or mock stuff especially for testing business logic.

One of the problems we get ourselves into is abstracting service io code into functions and calling them from our business logic code. This forces us to mock all the io calls, instead we should be doing the opposite i.e abstracting business logic into discrete functions of pure data in and out and then calling those functions from our io code.
This way we can test the business logic independently of the io code. Testing the business logic now becomes quite simple and one can leverage property testing to further boost our confidence in such tests.

Many times the ramaining io code is just calling other functions and doesn't need to be tested.

Several other ideas that relate to this are hexagonal architecture, Domain Driver Design, clean architecture and functional core with an imperative shell.

Some resources to further explore these ideas:

Clean Architecture in Python - https://youtu.be/DJtef410XaM

Why integrated tests are a scam - https://youtu.be/VDfX44fZoMc

Boundaries - https://youtu.be/yTkzNHF6rMs
How about, no authentication to use the device and an open platform of app stores and/or sideloading?
Most kids don’t get into the colleges that require those things.
> And if you had originally stated your point that way, I would probably pointed out that there is equally no evidence that it will not be useful, if it turns out to be the case.

No objections, but isn't it a bit weird to argue that we should do that just in case it might be useful someday? We'll deal with it when it comes up.

> Clearly, I failed to get my point across

I'm sorry, I'm pretty sure there's an argument but I just don't get it. I'm not really following the train of thought anymore.

>> I'll take the seventh.
>? - I'm not familiar with this expression.

Play on words: https://en.wikipedia.org/wiki/Fifth_Amendment_to_the_United_...

https://en.wikipedia.org/wiki/Tractatus_Logico-Philosophicus
To be clear, I don't think the nomenclature is the sole driver of social stigma, just a contributor.

As an analogy, I doubt anybody thinks the social stigma around trisomy-21 is solely attributable to previous politically incorrect terminology but continued use of those former terms doesn't help alleviate that stigma.
Show HN: Remote Jobs Alert Tool (Works Like Google Alert)
How to Work and Manage a Team Remotely
That sounds like a very large version of https://en.wikipedia.org/wiki/Prince_Rupert's_drop.

When you hit one end the wire with a hammer, or drop something on it, the entire wire might explode.
Get your job search streamlined with this pack
Keep them away from both the image and the container! Getting env var values dumped for a process is trivial outside of the process and even easier within the container process space.
Got it, and I think yours closer to the real meaning than what the article says - based on having read that word in context multiple times.
> and not going around people because you don't know if you or whoever you around is infected

Is this truly the approach you are advocating?
It doesn't say if this works on the web client or not. I prefer to keep Zoom inside the sandbox of my web browser.

However since they claim that it is only the key acquisition that is changing it seems likely that it will work.
Very cool! Everything looks great. The first widget I'm actually going to use.

When iOS 14 came out, I was disappointed when ForeFlight didn't have something like this ready.

Riffing on ideas:

It'd be cool if the wind direction in the smart view was relative to your phone's orientation. I'm also imagining a little rendering of a runway and a windsock. TAFs would be a cool and challenging next step? A widget that'd some how give an idea of the latest surface analysis?
*it's clear its strategy is prioritizing quantity over quality

perfect! They a launching a movie per month with a famous actor and shallow stories. I think Netflix and Google make a good parallel. Google is infamous for cancelling products that many people use too, like the beloved Google Reader.
This is an odd finding to me. The CDC found that of 18-24 year olds surveyed June 24-30, one in four seriously considered suicide within the past thirty days.

https://www.cdc.gov/mmwr/volumes/69/wr/mm6932a1.htm

Discussion by Glenn Greenwald:
https://theintercept.com/2020/08/28/the-social-fabric-of-the...

I find it somewhat incredible that the results would be going essentially in opposite directions so close in age range.
They are not opening their source code, as far as I know, so who is auditing this supposed end-to-end encryption?
Exactly! :)

Besides inaccessible vehicles, broken elevators are among the most significant pain points for people who regularly use a wheelchair, rollator, or stroller in public transit. Such an elevator can add an hour to your commute.

If you have a mobile impairment, it can save your day to know in advance if ‘your’ elevators work.

Berlin’s transit network (VBB) already does this: When you request a wheelchair accessible route, its app lets you navigate around broken elevators – thanks to facility status APIs of its connected partners.

To my knowledge, it’s the first transit operator to do this.

For passengers, there is an overview webpage: https://brokenlifts.org

IMO Google Maps and Apple Maps should have this feature, too.
The US used to have pandemic planning... https://twitter.com/paulg/status/1244995102818304000
I guess we'll have to wait for another leak to get confirmation on the exact nature of the relationship.
Nokia snuggles up with Google Cloud as it aims to switch off on-prem servers
Please keep us updated
I sure hope there's not a server in the back of each branch holding account state...

(Now this reminds me of Katrina when local New Orleans banks lost their primary and backup data centers and took weeks to recover account balances.)
Consider: it's not that Linux users are hostile to criticism, it's that your criticism is of the laziest, least-intelligent part of the spectrum of criticism.
I think they would have, yes. Both effects are occurring at the same time - younger people are more liberal, but also older people are getting more liberal over their lifespans.

And, in any case, if the price of longevity is slower social change, I'll take it!
Do you have to provide ID when voting in Switzerland?
I read the beta and the final copy. Great to see it evolve based on real feedback from hiring managers and job seekers.

I used the advice to spruce up my resume a bit and tailor it to specific employers. But more importantly, it helped me know when I was “done”. I had spent a lot of time making small optimizations without knowing how effective they were. After reading the book, I knew when to stop.

Highly recommended!
I think it's worth noting that the examples in the article are the way they are for the sake of demonstration. In that context, I very much appreciated the explanations even as a fairly seasoned programmer; I knew more or less how to do these transformations, but not what they were called and how I might explain in words why I'm doing them.
This looks interesting, thanks for sharing! Most of the apps I work with run on Heroku, so I'd likely end up reaching for their [High Availability Postgres] feature, but nice to know of an alternative if I'm not on heroku.

That said, I don't think this would serve the intended purpose here. My specific use case was upgrading the postgres version I was using. To do that we introduced a follower, prevented writes to the primary (with the approach summarized in the post), upgraded the follower, and finally promoted the follower to be the new primary. Automatic failover to the follower during this process would likely confuse things.

[High Availability Postgres]: https://devcenter.heroku.com/articles/heroku-postgres-ha
In the last "doubling" scam I've seen a lot of people literally saying "I don't really believe it but the sum is low enough I'd send it anyway just to see what happens". Get a million of those, and you have some money. I personally don't understand what moves those people but I guess I have to recognize they exist.
The real prices of the iPhone 12 and iPhone 12 mini
I haven't heard about these Amazon leaks. Any links to share?
The author of the blog post is one of the founders of Keybase (and also a member of Hn, maxtaco).
Silent Witness ..
5G, iPhone 12, and HomePod at a Glance
Ask HN: Tech Based CV Reviewing Services?
I'm looking for a more tech focused CV review, beyond the more generic details (though those are appreciated). I've distributed my CV around my circle, but I feel my CV is a bit off and it's bugging me a bit.
> In a meeting with E2EE enabled, nobody except each participant – not even Zoom’s servers – has access to the encryption keys being used to encrypt the meeting.

> Zoom’s end-to-end encryption (E2EE) offering will be available as a technical preview, which means we’re proactively soliciting feedback from users for the first 30 days.

It is a commendable step forward, but I wonder what their concerns are about this feature with such a careful rollout schedule. The difference seems only about who generates/manages the key, so unless they were decrypting the packets in transit, they should not be concerned about this.
The specific criticism I think that generates the hostility you're experiencing is something like "Linux should be easier to use / easy to use for the everyday computer user". In general I think most people would agree with you, but it comes across as an ignorant comment given the well-known economics; and especially in the context of a conversation about someone who is unwilling to contribute or at least build their own software.
Ask HN: Why is Prime Day so hard?
I do 70+ orders with Amazon a year; I have 6 themed wishlists; many items I purchase repeatedly, or items like it; 75% of my purchases should be easily identifiable as belonging to a category + subcategory (Computers - Video Games; Music - Synthesizers; Books - SciFi; Baby Stuff - Male Toddler; etc).

And yet for 3-4 years running I have not bought a single thing on Prime day; going through pages of hundreds of assorted random items results in failure and frustration. If there IS a deal that appeals to me, it's well hidden and I cannot find it.

It feels like in this day and age, a 3rd year ComSci student with Python knowledge and few open source libraries should be able to fill up my cart :P

So why don't I (or any of my friends - they all seem to share the perspective) have more luck with Prime day? Is it a business decision of some sort?

More broadly, for all the incredible privacy-invading technologically-ingenious, morally-dubious tracking and advertising, why don't I get exposed to things I actually want - why does so much effort get put into something with so little seeming business value? What am I as a consumer missing in this whole analytics/advertising ecosystem? :-/
Show HN: HN Upvote Backup and JSONify
Boundary can be viewed as an implementation of some of these ideas!
Blind doesn't mean wrong.

It does mean that it did not fit into how they have traditionally computed value propositions.

A lot of the people who I know bought a Tesla, did it for other reasons. It was status symbol, a tool for virtue signalling, a luxury first and a car last. A ton of these friends were cross shopping the Tesla with a Civic, Corolla or a Prius. Because for these non-car enthusiasts, if not Tesla, they couldn't imagine spending that kind of money on a car.

It is similar to how Apple convinced non-traditional customers to buy a $500 watch or how Beats convinced your average person to splurge $300 on headphones that didn't even sound great. The first adopters ordered their cars 3 years out, before they'd even seen one reviewed.

The blind-ness comes from the numerous contradictions that Tesla represents.

The Tesla is fast, but it is bought by non-enthusiasts who never speed. The Tesla is green so it'd appeal to sustainability activists. But Manufacturing consists a bulk of carbon footprint, so if you cared you'd get a used car. Tesla also has toxic and exploitative work practices that someone who loves sustainability would generally disavow.

Teslas are great cars and provide a very different value proposition. But, the reason Tesla is doing well is not because it beat the Germans at their own game (as the articles want to imply). It is because they played a different game all together.

Tesla - " Exploration and exploitation "
One of the problems with offshore wind in the US is the depth of the ocean off the coasts of areas that actually have high wind. It's like God gave the middle finger to the US in this regard but it's something technology could potentially solve for. Much of the eastern US coastline has huge drop offs not far off the coast of windy areas. You need a max depth of ~50 meters for a good sized turbine to be installed. Florida is one of the most viable places but alas, not very windy.

Compare this to Northwestern Europe in this map: https://www.britannica.com/place/Atlantic-Ocean
It makes England/Nordics/Benelux the Saudi Arabia of wind power!

I don't know much about the potential for California though. Has it not been invested in due to seismic risks? Or is it mainly a factor of coastal homeowners lobbying against it?
The study: https://arxiv.org/pdf/1909.00024.pdf

Yes, they control for poverty.
> error in marketing it that way...

There's an ashtonishing lack of ethics in our industry. A marketing error here, a software bug there [1], a misleading opt-out here [2], a preinstalled malware there [3][4][5], a little violation of privacy of here [6][7], a little lack of respect there [8][9]... It's all happening all at once. We shouldn't be lapping it up.

[1] https://news.ycombinator.com/item?id=24514433

[2] https://news.ycombinator.com/item?id=22531087

[3] https://news.ycombinator.com/item?id=9072424

[4] https://news.ycombinator.com/item?id=17145204

[5] https://news.ycombinator.com/item?id=3298205

[6] https://news.ycombinator.com/item?id=19031055

[7] https://news.ycombinator.com/item?id=23929044

[8] https://news.ycombinator.com/item?id=4936561

[9] https://news.ycombinator.com/item?id=14384187
> I'm happy to criticize each other group's wrongdoings; I needn't do so in a single breath.

You'll be the one-in-a-million exception then, in my experience. Most declare that they would, but never will, given the chance.

> It is an ugly perspective, to me, that we should concern ourselves with the Zionists' ethnic cleansing of Palestinians only after we have solved all other problems.

Meh, I don't even think ethnic cleansing actually applies (not least because Palestinians aren't an ethnic group, they're a cultural group). But even more so: that's not what I said. What I'm saying is that there's a suspicious focus on Israel that turns into willful ignorance and self-imposed blindness when it comes to other things. That heavily suggests it's not actually about what Israel does, but rather about the fact that it's Israel doing it.
I only like it because of Baby Yoda
Or have a look at https://frontaid.io/ if you want to store your content in a JSON file in your own Git repository.
I mean, it makes it obvious where the car is and they may sometimes need to stop somewhere that they technically are not supposed to be stopping, and the warning lights make it if not less illegal then less likely to be ticketed or cause a collision.

This is not a "course" really, it is like a 50 square mile normal suburban area and the cars go where requested. There are controlled courses for testing such as the former military base that is closed off and has fake scenarios thrown at it.

But this is a service operating in normal neighborhoods.
Why is it so popular to hate the US during a Republican administration, and love it during a Democratic one? Could we instead look at the policies and achievements of each administration with a non-partisan view? This article does a poor job of that. Despite all the badness cited in this article, I cannot imagine how much worse our world would be with respect to economies and human rights, without the United States of America.
MRI machines don't necessarily need helium even today. It just the common model family using Niobium-Tin wires you see in hospitals or media. There are permanent magnet MRI machines.

What do you mean by "fast batteries"? For regenerative breaking one can already use supercapacitors. Will room temp SMES cheaper than that?

Electric motors are pretty efficient and small already, there is 0.6mm motor from Namiki. Sure they can get smaller. How does room temp superconductor help that? Smaller motors have better cooling than big motors so ohmic heating is not a problem.