skysight-inc/HackerNews huggingface dataset:
Two notable breaking changes are:

- Unhandled rejections now throw instead of warn

- npm 7 installs peer dependencies by default

---

https://nodejs.org/en/blog/release/v15.0.0/

https://github.blog/2020-10-13-presenting-v7-0-0-of-the-npm-...
I'm certain they did an analysis and realized that it's cheaper to cut their losses and close shop. If the law isn't likely to change, and the law enforcement isn't likely to step-up, then what's the point of hiring private security? Most private security is just there to look tough and hold you until the police arrive. And the police aren't effective right now, so why even bother?
If you run software directly from git clones (without any verification steps), calling yourself secure is just a joke.
True enough. It is sad that even marginal cost savings are enough for most countries to bow to the middle kingdom.
What are you referring to? Users are asked to grant access to contacts since iOS 6 (released 8 years ago).
Thank you for mentioning our lib! :)

I mostly agree with your comment. It's really hard to solve these issues without violating the visitors privacy and saving state on the client device. I think the approach is "good enough" if you want to know how well your website performs or to detect trends, but you will definitely need more invasive methods to gain more insight.
The various Walgreens I’ve been to in Oakland generally do have a uniformed security guard.
Most Occidental countries have higher health insurance coverage than USA... and much better health system
> My recollection of discussions on forums when it was starting to gain mindshare were arguments largely about the aesthetics of the syntax.

I remember dynamic languages people picking up on three things in particular: Python apparently being designed to be inherently inefficient, not having proper garbage collection, and having weird scoping. At least Python was something to point people at who rejected Lisp as an alternative to Tcl and Perl for scientific computing.
how much revenue is in the mobile messaging business?
> Now put yourself in the Apple's position where "an iOS app" or a "mac App" is about as trusted as a random website.

The mistake is in creating a category called "iOS app" or "mac app" and trying to fit every piece of third party code in the universe into that category.

What there should be is different categories of apps with different levels of trust. Then 95% of apps can go in the totally untrusted category because they don't actually need any special privileges. Which then makes asking for a trusted privilege a red flag rather than something the user clicks through because they see it for every app they install.

> Can you imagine if websites could control your firewall?

Realize that this has already happened. You wanted to block DNS to untrusted servers so everything would have to use your Pi-hole? Say hello to DoH. You could block AOL Instant Messenger by blocking port 5190, good luck doing that with Facebook.

The web made every protocol run over HTTPS to bypass your firewall, even if it has nothing to do with transferring hypertext.

Because that's what happens when you do security wrong. It has to be usable or it gets routed around. People started blocking unknown ports by default, or blocking/mangling protocols both of the endpoints didn't want blocked or mangled, so firewalls got displaced.

You don't actually want that to happen (again). You don't want the only options to be living in a cage or rooting your device with some unaudited 0-day code you got from some Russian hackers. There is value in the existence of the middle ground.
I don't think that is accurate. On my Pixel 3, when I type "fact" it suggests "factorio" which seems quite personalized.

Is there a setting somewhere that needs to be flipped to opt into this behavior?

EDIT: Yep, there is a setting in Signal for "Incognito Keyboard", I've never toggled it, and it was off when I went to settings.
They basically just force you to work within the pipeline of one-reply-per-person when following up on a customer in their CRM. Simple as that.
I agree with you here Data and measurement is the single most important part of the process.

From my experience working in an industrial plant which has been involved in several machine learning trials a lot of the time there are attempts made to use complex modeling techniques to make up for a lack of measurements.

Something I question is whether the outcome would have been better if the money which was invested into hiring AI consultants was spent on better plant instrumentation.

Industrial Instruments are not cheap something like a PGNAA analyser (https://en.wikipedia.org/wiki/Prompt_gamma_neutron_activatio...) is an expensive capital purchase and I suspect some people have unrealistic expectations that AI and machine learning can replace things like this.

I think there is some middle ground where AI complements better sensors (maybe instrument companies should be pushing this). I've yet to see any of the data experts push back and say something like "actually you need to measure this better first before we can model it."
Open source stimulates reuse. People are typically bound by a MIT or GPL license. But let's get back to the issue at hand here. Innovation loans should be given to people who have innovative ideas AND take part of the risk.
The problem I see is that building a prism scanner isn't that innovative seen the information available AND the business developer in the entity doesn't take a reasonable amount of risk (state is major shareholder). The developer can however freely reallocate the money. You can't do this within the government because you typically need 3 competing offers via tender law. So you can't redirect the money to another company. In this case you can and the business developer redirects the money to a company of his choosing. This company builds the prism scanner. If it works, they invest money in it. They do however not take risk but have quite some opportunities for profit. There is also a high risk they pay a kickback to the business developer or someone more higher up.
My main issue here is the people who get the benefits don't have any risk exposure.
My personal issue here is that I want that money and a risk free opportunity with my pet project!
I would have no issues, is they would simply invest their own money.
I think the convergence here is toward 'automatically discoverable types'. For python et al this means type annotation (because it's extremely difficult for discover types otherwise).

For C++ et al this is things like the 'auto' keyword that allow skipping the type specification where the compiler can work it out.

The end-game is specifying just enough type information that it's still understandable to both humans and compilers.
Is your heart telling you that you should get people to buy the product you've got professional experience with?
the one that closed near me had a security guard at all times. I suspect not only did he feel that he wasn't paid enough to try, there wouldn't be much point in trying to detain all of hunter's point.

I stopped shopping there before they closed, because it always took 30 minutes to find the right key to unlock the shampoo.

I don't know why SF stores in bad neighborhoods don't just adopt the east coast shitty neighborhood corner store model. full wall of 2" lexan, and a turnstile to pick up your fifth and cigs.
NASA mission will ‘fist bump’ an asteroid to reveal the Solar System’s secrets
This seems to be getting a lot of downvotes, but I think it's correct, strictly speaking. There are a lot of business practices that are legal up until the point where you've acquired sufficient market power. After that, antitrust law applies. Similarly, regulators don't care if two companies with negligible market share want to merge, but they may care a lot if the two dominant players in a market want to merge.
Hypothetically they only eat that loss once,though. The subsequent rentals/loaners would have much, much lower depreciation.

It would have to come with the understanding that you aren't meant to purchase the exact car you rented, though. I'm not sure if that would reduce how invested people feel in it.
Very pretty/interesting. looking forward too experimenting.
Snapshots in the Life of a Criminal-Data Analyst
Show HN: Virtual Corn Maze
Or the slightly deeper Palo Tenor.
This is already the case for Mastodon instances. There's a list of servers that are not federated into many servers [1] because of hateful or plain illegal content.

I think Matrix is more akin to email than it is to Twitter and Facebook like Mastodon is, though. If you wish to contact someone on another server then that's an active decision by you. If someone wants to force themselves into your server, the most they can do is spam chat invites. There's no illegal content or filtering policy on the server that can prevent that from happening in most cases. The fact that Matrix is e2ee helps; server moderators cannot see what you're discussing, let alone censor you.

The core problem is that one of the ways we as a species prevent bad behaviour from spreading is ostracising groups of people who exhibit such behaviour. I strongly believe that any chat client that is used by humans will eventually exhibit similar behaviour, splitting and ostracising groups that exhibit behaviour other groups of people object to.

[1]: https://github.com/Gargron/mastodon.social-misc
A fine criticism but I always see people cite "The Tyranny of Structurelessness" and not Reinventing Organizations, a book documenting 12 >50 people companies that run successfully in non-hierarchical ways: https://www.reinventingorganizations.com/pay-what-feels-righ...
I’m sure there will be negative comments in here regarding this move.

As someone who has administered Jira, I wouldn’t wish that task on anyone.

It’s a nightmare of undocumented quirks and issues.

I don’t know if any business of any size can justify self-hosting it.

If you think this is some sort of big loss for small businesses and bootstrappers...not really. You don’t need nearly any of the Atlassian suite until you’ve become big enough to have middle management breathing down your neck about story points.
> Block TOR, proxies, bad user-agents, countries

Does this really help? Especially blocking TOR and whole countries seems bad. As for blocking user-agents: why? Sorta seems like when cisco "fixed" a vuln by blocking the curl user agent.
I'd consider that a minor semantic point if the overall spirit of brutalism was honored in these sites... but honestly, that would be pretty boring!
As gundmc implied[1] it's probably best to wait unto after the election when looking for signals of credibility from the other party.

It's be foolish to just the merits of the case merely on that now.

[1]https://news.ycombinator.com/item?id=24842390
Right. UTF-8 was intentionally created while UTF-16 was a known hack to deal with the mistake of UCS-2. Ideally neither should exist. There's at least some argument for the existence of UCS-4.
Correlating my memory to actual events, anyone else remember the "Deathstar" issue back when the IBM Deskstar drives had that head-drop failure? I'm fairly sure that the Ultrastar line is a successor of that lineage (in marketing terms at least).

https://en.wikipedia.org/wiki/Deskstar

https://en.wikipedia.org/wiki/History_of_hard_disk_drives#Ma...
The approach here can be used to process strings in chunks without too much added complexity, and it has low setup/teardown costs. The lookup tables fit in three 128-bit SIMD registers so there's minimal cache pollution, which is my usual worry with clever table-driven schemes for accelerating things.
A 1/200 chance of dying in a free and open society, meeting like-minded friends in the pub, the restaurant. Or two years (if you're lucky) masked, being barked at by Covid wardens, locked down at home for a month in three. If I had the choice I know which I'd take. That's rather the point, the lockdown advocates will not give me that choice.
Can you share what those resume features tend to look like?
> That tweet is a big deal if true.

One thing you can independently verify is that the backdoor string is still in their client. The installer starts transmitting data during the installation process, so I would not recommend installing it outside of a VM—just look at the files directly. The macOS installer has it in `Backblaze Installer.app/Contents/Resources/instfiles.zip/bztransmit`. The Windows installer is a self-extracting ZIP file, so just use unzip and look in `bztransmit.exe` and `bztransmit64.exe`.

$ strings bztransmit |grep BACKDOOR
DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file exists:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file could not be read:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file existed but less than 10 chars or could not be read:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file did not contain bz_cvt:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file contained bz_cvt but wrong num digits:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file did not contain bz_upload_url:
ERROR DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file contained bz_upload_url but did not start with http:
DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml file exists and is valid and bz_cvt=
DoHttpPostSyncHostInfo - BACKDOOR_prefer.xml SUCCESSFULLY_swapped_in new_bz_cvt=

What does the corresponding code do? I genuinely don’t know. My goal was to find backup software, not to do a security analysis. An easy-to-exploit root code execution vulnerability was enough for me to uninstall the software, submit a report as a professional courtesy, and go do something else.

Clearly it’s dumb to put the word BACKDOOR in your code if your goal is to plant a secret backdoor, but it’s also pretty dumb to use world-writable directories, disable host certificate verification, use magic hard-coded strings to “sign” updates, and implement data encryption in a way which requires the ‘private’ password to be sent to the server, so who knows. As I said in the tweet, even if it turns out to be innocuous, the optics are terrible and show a serious lack of good judgement on their part, especially given how much they claim to be security experts who care about their reputation[0].

> Were there any follow-ups from Backblaze?

No. The only “follow-up”, as it were, was to cancel their HackerOne public bug bounty programme. (Though this was a month ago, their web site still tells people to “visit our public bug bounty program managed through Hacker One”[2].) They have not communicated with me at all except for one tweet about that change[1]. I have seen no public statement from them acknowledging that this happened, or that they made mistakes, or that they have steps they plan to take to improve their internal software development practices.

[0] “We stand by our reputation as trustworthy, careful programmers who have worked in the security field for over a decade. […] we have LOTS of interest in keeping our reputations rock solid and utterly clean.” https://help.backblaze.com/hc/en-us/articles/217664798-Secur...

[1] https://twitter.com/backblaze/status/1308157606368882688

[2] https://www.backblaze.com/security.html
Reminds me of the official interest rate. I don't think it even goes by original CPI calculations anymore.
I've mostly seen it done in situations that are roughly analogous to IoC containers. So, custom serde libraries that use reflection, testing utility code, object mapping tools, magic validators, stuff like that. Which, any sufficiently venerable enterprise Java application seems to have at least one or two of those knocking around the codebase.

FWIW, Java is also where I see stringly typed designs, too. I'm increasingly coming to fear that languages with more safety-oriented features aren't associated with safer practices because those features encourage safer design, so much as because they tend not to attract programmers with a swashbuckling attitude in the first place.
Would you personally volunteer to have your family die in the future to save 1 person now?
This is very true.

This is why conferences are important. A lot of knowledge is sociological in nature. Failures and tricks of the trade are discussed at the bar after 5. I've experienced this first hand.

Academic publications and lectures, in their (rightful) pursuit of rigor, aren't usually the right space for conversations around hunches and experiences. Reputations are at stake, and most people are doing impression management. When experienced readers read a journal publication, they read it with the implicit understanding that it is a highly curated view of the messiness behind the scenes.
The problem is that safety means, by definition, ruling out unsafe code at compile time or run time. If you don't prioritise safety early then you run a high risk of discovering when you try to retrofit safety later that you need to rule out a lot of existing code. Even if you haven't promised stability, breaking existing code hurts the ecosystem.

Therefore when setting priorities for language evolution it seems better to identify work that is less likely to result in breaking code, and prioritise safety over that.
Queen Kristina and René Descartes
> I think it's a slap to the face of a lot of teachers doing their best, as well as their students, to say that kids in disadvantaged districts learn nothing other than how to sit still and listen to authority

I have to agree. In fact, I was explicitly told as much by my high school Physics teacher after I openly said that I thought the school's "Excellence Program" wasn't particularly challenging.

His take was that he realized that it was easy for me, but there were some teachers who were trying as hard as they could to give the students a good education while the rest dismissed us as being a bunch of unreachable ghetto kids that they were wasting their time on. Sure, I was a 17 year-old punk kid but he was right: I was basically crapping on the people who were trying to make a difference and at the same time putting down a lot of my classmates who were working as hard as they could to get good grades, many of them in very difficult life circumstances.

I guess I don't have a point other than to say I agree with yours :-)
> Can you imagine if you tried to open up something in UTF8 in a text editor, and it just refused to open it, telling you nothing but "Bad UTF8" or maybe "Bad UTF8 at byte 19734"? Not super helpful.

I think text editor is a good example where you need to be lenient. Furthermore, in that use case, any unnecessary modification of the data in any way is a bad idea. This includes replacing invalid code points with something else, unless they're edited by the user. The data might not even be UTF-8 in the first place.
My friends and I have a tradition of visiting a corn maze every Halloween season, but can't this year due to quarantine, so I made this. Now that we've all had our corn maze gathering, I'm sharing it with the rest of the world. I recommend picking a specific time and going with a bunch of friends while also on voice/video chat.

Also happy to answer questions about the implementation here.
Gitlab can replace nearly all of it, and it’s open source.

Bitbucket is absolutely terrible.

Jira is over-complicated and a server administration nightmare.

I probably like Confluence the most, ironically I didn’t like it until we switched to the cloud version and actually started getting new features and fixes (since nobody has time to actually maintain and upgrade it on-premise).
Wow seeing Virtualdub bring back a lot of memories!

http://www.virtualdub.org/
> How can you know that such an impulse is part of some country’s national culture?

Singaporean here. I've seen this "crabs in a bucket" mentality since the days of formal education. It's often known as being "kiasu" (afraid of losing to others, in Hokkien dialect) [1] in the 90's.

These days, it's sometimes known as the "sinkie pwn sinkie" phenomenon [2].

[1] https://www.straitstimes.com/singapore/kiasu-is-oxford-engli...

[2] http://asingaporeanson.blogspot.com/2015/01/the-sinkie-pwn-s...
Although you might have needed the distinction between an electronic computer and a human one then.
It violates a lot of principles of using containers. There's no separation of concerns here, builds aren't reproducible, it hijacks logging for its own setup, appears to allow RCE of php files on another host in the event it is compromised (does it make sense to store/bundle php files in this container if it's not meant to handle php?)... Etc
Any building can become blighted. Any architectural trend can be misused. Not all brutalist buildings are cheaply constructed.
I guess I still see Julia as a quick and dirty prototyping language akin to Python and some others. Clearly, Julia has ambitions for greater capabilities.

Apparently, Julia now supports some more complicated forms of parallelism: Async, @Spawn (aka: Tasks), and others. But @Thread based for loops are just easier to grok.

Overall, Julia is one of the few high-level languages that is explicitly adding in highly-threaded concepts like Fork-join, SIMD, or even GPUs to the language.

Yeah, some Python libraries extend these concepts to Python. But something like @Threads for ... end really demonstrates how the fork-join parallelism is a first-class member of the Julia language.
Check out https://github.com/metabase/metabase . I'm not clear on their open source vs paid model, but I'm pretty sure you can host it yourself and their core is open source.
How would anyone ever know that Facebook hasn't designed it's algorithms for spreading misinformation and disinformation? How would anyone ever know that Apple doesn't use your photos to train an AI? How would anyone ever know that the Amazon doesn't peek into your RDS database?

https://www.nytimes.com/interactive/2019/06/08/technology/yo...

>> Several current and former YouTube employees, who would speak only on the condition of anonymity because they had signed confidentiality agreements, said company leaders were obsessed with increasing engagement during those years.

>> One problem, according to several of the current and former YouTube employees, is that the A.I. tended to pigeonhole users into specific niches, recommending videos that were similar to ones they had already watched.

There are real human beings working on those systems. That's how everyone would know if Google does as it says
Some of it is due to bigger data, but the majority is definitely ML. For constant data, the error rate dropped dramatically due to much improved algorithms.

15 years ago, voice recognition was all hidden markov model based. The data sets were limited, in part due to the cost of collection, but mostly because larger datasets didn't significantly improve accuracy.

As algorithms improved, larger datasets became more important as more data did actually improve accuracy.
> Be liberal in what you accept, and conservative in what you send

Terrible advice, with a long history proving why it's terrible, starting with IE6.
China accounts for only about 5% of global semi sales, according to SIAC's 2019 annual report. The US still dominates in logic and analog sub-product categories by a wide margin.

> Back in the day as much as about 40%...

40% sounds too high -- I think 18% at max is more realistic. Apple's A chip cost was estimated between $12-$20 or about 7%-8% of total BOM. Aside from Apple's A chips fabbed by Samsung and baseband/RF/sensors by Qualcomm/Skyworks, I can't think of any other significant US components in Apple's mobile product. The most valuable components in the iPhones in those days were DRAM/NAND flash storage (about 30% of BOM) and displays and they came from either Japan or South Korea. Micron wasn't an significant supplier until Apple's relationship with Samsung soured.

Sure, who can forget Tim Apple's rare CBS interview where he proudly declared the engines of their portable devices were made in the US, after which Apple promptly outsourced it to TSMC in Taiwan. I suspect that that was a calculated move to make the final defense of their outsourcing practices before moving that out of the US as well.