skysight-inc/HackerNews huggingface dataset:
>Blame always rises. Management knows that any product without extensive review is going to be bad. They push it out the door without that review because quality costs. Stockholders know. Software is bad because you can't sue the companies that made it.

I get that a variety of pressures are put on developers to add features and ship quickly.

But whether it's corporate development done internally (e.g., LOB applications), a web app or a SaaS offering, not designing security into the software is a disaster waiting to happen.

So many times I've seen businesses have their crown jewels ripped off due to poorly implemented/weak or non-existent security practices in application design/development.

Even when the infrastructure is reasonably well secured, with defense-in-depth, including strong authn/authz, separation of duties, as well as strong security processes and policies in place, software that lacks designed-in security can render all of it useless.

Whether that's because the software doesn't/can't integrate with the security tools in use (often requiring applications to run with much higher privilege than they should) or because little or no thought was given to secure coding mechanisms or access controls.

I absolutely understand that there are always security trade-offs, regardless of where in a multi-layered infrastructure/management/application environment.

And it's always important not to expend resources beyond what's appropriate for the assets being secured.

That said, application software is the most frequent culprit in enabling compromises (followed closely by poor security implementation in the infrastructure and a lack of policy/process in securing it -- usually through ignorance/incompetence).

My argument is not that developers are stupid or ignorant, but that security isn't baked-in to their design decisions as a guiding principle.

And that often leads to insecure software and/or sloppy/insecure integration of security after the fact.

If more developers thought about security as a feature rather than an inconvenience to be given little thought or just lip service, that would make a big difference.

Edit: Clarified verbiage and fixed typos.
IMHO the easier a language is to learn, setup, and mix with other languages in a project, the less important it is for the language to reach "critical mass". Especially the "mixing" part is important. There seems to be a common mindset that - eventually - one or few languages will "win", and all existing software will be rewritten in the handful "winning" languages. But old languages never die, they become part of the bedrock that other new languages will be built upon. A successful new language must integrate well with old code, not replace it.
Yes. I got ~30k in Sweden, but that's around 20 years ago.
Crypto Wars: EU states decide on resolution to decrypt
> fooling the naive into overpaying for instruction from teachers who barely make minimum wage.

Regular degrees are pretty much just like that as well

The problem with regular degrees is not their actual cost. It's that you're sold (and most people want to buy) the experience. That's where they compete (and what "drives costs" up).

Don't play that game. Though of course not studying in an Ivy League univ. means you don't get to be buddy buddy with the next Mark Z which might just offer you a job at a nice place because you were buddies and oh this "entry level job" starts at 200k and there's your student loans sorted. But that's if you're moderately lucky and are competent at either tech and/or some form of people skills.

(before I "something something public education something something it's cheaper to study somewhere else even considering relocation costs")
Distribution of Covid-19 Vaccines Is Under Way: Everything Has to Come Together
No way. So far there have been zero APT attacks traced back to inside jobs. That's not how modern spy agencies work anymore.

Code signing hardly means much. All you have to do is compromise CI to make an organisation sign a binary that isn't based on reviewed code.

How hard is that? I think for the vast majority of us we have to admit our CI would be very easy to compromise. Especially if you can get administrator credentials as easily as these guys apparently can. But even without that, CI executes and runs arbitrary code that's intended to only come from trusted individuals.

Step 1. Find a third party package or library that is being downloaded by a package manager onto a CI box.

Step 2. Compromise the open source dev's laptop by phishing them or something else really basic.

Step 3. Put a back door into that package.

Step 4. Wait for it to be downloaded to and executed on SolarWinds CI.

Step 5. Insert a rootkit into CI.

Now that rootkit can just systematically insert the final back door into any build of that file it sees using link time editing. Every build will have the back door and the owners will eventually sign the binary and push it out to production.

In many orgs CI can actually request signing of any binary it wants, so you don't even have to do that. You can just hack the CI machine, grab the credential used to authenticate to the HSM, sign your preferred binary and then ensure users are downloading it.
Looks not valid in terms of GDPR. What are my rights and in which paragraph are those rights stated? How long is data stored? Which log files of my visit arise (just my IP and date of visit? Who hosts that site, if it's not a machine you physically own? Do they store that data? More data, like browser or OS version?)
You are usually allowed to use that data for debugging and intrusion detection etc. but you still need to mention it, if that data is collected, even by a third party you hired.
I said they were concerned about the possible reputational loss. I am also skeptical of overblown arguments that Israel "controls the US media". These tend to shade into antisemitic conspiracy theories. The incident you link seems to be a good example: I see little to persuade me that the USS Liberty wasn't sunk by accident.
Do not think that's correct. The loan part is about 9300 USD per year (40 weeks full time study), which sums up to about 46500 over five years. On top of that is a grant of about 3900 USD that you don't have to pay back. Reference : https://www.csn.se/languages/english/student-grants-and-loan...
Food is absolutely the most important, foundational aspect of any nation. It is so fundamental, that countries will rather create stockpiles and let it rot rather than risk running even the remote chance that they will run out of food. When you run out of food... everything breaks down, quite literally. It is thus in every nations interest to be as self-sufficient in their food production as possible.

This is a very welcome development. Currently, only countries blessed with large sizes and specifically large arable lands are even capable of being self sufficient in their food production. This kind of hyper localized food production might just be the answer for nations of the future that don't want their population or geo-political influence to be limited by their size.

Additionally, climate change has the possibility of severely disrupting both the production and supply chains for food. Being able to grow food anywhere, without worrying about soil fertility, is incredible.
I agree, but then you wouldnt start new programs with Delphi these days, would you? (To me Delphi is the Cobol of GUI, will be still around forever, but less and less new projects)
> but the real soil somehow must add a lot of flavor

Correlation ≠ causation.

I did some experiments years ago growing food under various conditions. The difference in taste is dominated by two factors: variety and time of harvest.

Most industrial fruit is harvested long before it's ripe and ripens artificially in warehouses.

This is the main factor that determines taste as this is the process in which taste develops. The longer the process, the more time the produce has to collect and store the relevant substances. Artificial ripening only takes a day or two compared to weeks for naturally grown food.
https://github.com/sentriz/gonic is a very lightweight implementation of Subsonic (so you can use any Subsonic client with it, ie. there are native and browser apps). I use it with DSub on Android.

There's still https://bandcamp.com/ for buying music, but there are many artists I can no longer buy mp3's from now that Google Play Music is gone :-/
That last part is a big plus. Most of us are so used to cotton shirts and synthetics that pick up odors and need to have the funk washed out all the time. A wool shirt can be aired out overnight, given a quick shake and be completely odor-free the next morning.

I've worn merino wool underpants on trips where - for various reasons - I took barely anything except the clothes I wore. Hanging the underpants in the steamy bathroom while taking a shower will almost completely refresh them. Heck, even keeping them on in circumstances where showers weren't available didn't seem to pick up any odors, at least for a couple of days.

Not that I would normally recommend regularly wearing underwear for several days or even a week, but wool is clearly superior to cotton or synthetic fabrics.
Relevant thread: https://news.ycombinator.com/item?id=21971223
I have followed an academic path so far, so none to little formal training and lots of room to try out my own ideas. Often ten lines of Python can already be a significant improvement over using some convoluted 'easy-to-use' GUI tool (looking at you, Origin...).

I started exactly like this, and the pattern I wanted to use/learn was 'classes'. After struggling for a while, I realized that what I wanted to do was much easier to solve with a 'table' (list of lists) and creating functions that return the resulting table modified. It taught me that there is value in simplicity, in particular at the level you understand right now, or are at least not too far outside of your knowledge-zone. If you want to get things done, that is ;) Note that this was a few years before scientific Python and its ecosystem came into full-swing, I'd probably have discovered and uses Pandas right now.

Later I learned that this was called functional programming, I learned how classes work and what they are useful for (far larger programs than I was writing at the start of my career). C++ is a fixture in the scientific community (I'm now into Monte Carlo and solvers), and while I'm happy C++11 happened, the functionality of the C++ stdlib enables so many different styles that it is really hard to get a team to stick to a subset, and not get too distracted with all the nice new tools. Sure, much of it is nice, but how we can write C++20 is pretty much another language from C++03.

I guess I rambled a bit there. What I'm saying is that I'm generally critical of using new features, unless I've seen a convincing and for me personally concrete demonstration of how it saves mental CPU-cycles or boiler plate. This makes it easy for me (in the end, I'm not here for the code but for what you can do with it) and onboarding others (who, in science, might barely know that C++ has versions).

KISS KISS KISS. Nothing will convince me of the opposite :)
Not sure that elixir fits into that comparison...

Maybe Crystal, Free Pascal even.
> The only solution I can think of is something like a libel law

Let's bring things a little bit back into perspective, because on the whole nobody's getting hurt here.

It's just Google Chrome. It's not a person. A thread like this isn't going to hurt its dominance of the browser ecosystem. And if it did, it would even be good for the diversity.

I don't think it would make a really big dent in people's bias against Google, because slowing your computer down is way way WAY less bad than the things that people biased against Google are worried about (being a gigantic faceless corporation with power equal to nation states that is controlled by something that is not, does not care for democracy).

It's like badmouthing Thanos because he has bad breath.

If true then Chrome has some bad code, and what else is new. If false then ... then what. At worst somebody deinstalls Chrome, and then?

Let's not bring libel law into this, or in fact even compare it to biased and false political news stories.
On Using Apple Silicon Mac Mini for Continuous Integration
> I've been playing A LOT of card game named Cheat

A difference with this research would be whether it's credible to the liar that you already have, or can later access, unspoken information from an outside source.

Your goal as a liar is in general to construct a credible, consistent story.

In the controlled laboratory conditions, the liars can easily believe that the interviewers might have access to some unstated outside information, so constructing a story that remains consistent with that information is immediately more difficult. You've at least got to weigh up how you might incriminate yourself, before saying anything.

In Cheat, a liar knows you won't have access to any other outside information than what they can also see. (Unless you have two aces, in which case they are already incriminated and story telling will do no further harm.) That means their lengthy story-telling can, with sufficient experience of the game, remain safely consistent with the information you have.
The pagerank algorithm is public and there exist a lot of implementations, for instance https://networkx.org/documentation/networkx-1.10/reference/g...
> Twitter

I find it really funny when Twitter is lumped in with the rest of these countries. It is almost like an order or magnitude smaller than all the others, and makes considerably less money.

Twitter is a small niche social network with people who control the news, which vastly overstates it's size.
AFAIK the compounds that make up the flavor are mostly known.

The problem is more that if you optimize plant growth for weight per time (because weight is what you are payed for) and leave flavor out of the equation, you'll end up with fruit that has a lot of weight with little flavor. If you switch to a growth regimen that gives the plants a bit more time, you will generally get a better flavor, even under hydroponic settings.

Given that you can sense a lot of compounds that make up a fruit non-destructively, I'm pretty optimistic that you could optimize for flavor too in a robotic/vertical farming setting.
I would recommend to start with a mature search engine such as Lucene or ElasticSearch.
AFAIU, the main problem is that hydroponic growers maximize for volume/color not taste. They could use richer nutrients, but decide not to.
This on the browser itself is not useful if other web-apps cannot take it as an input. Would love for a good native tool which creates a virtual webcam(not full blown OBS) with whatever effect one wants & even better would be something to use your damn phone as a fast webcam with effects.
I recall reading an article on HN the other day which revealed there's even an insurance policy against ransom kidnappings, and that there are companies specializing in dealing with them - particularly, in business settings, they'd pay off the kidnappers and then bill your company for "consulting" (this is so that your company doesn't look like it's supporting organized crime by paying ransom).
I wonder, how would the world be different if a major government was to completely ban user tracking? Ad companies would be forced to use contextual advertising. How would that play out?
Depending on your hardware, your NAS software might be a good replacement. Pretty much all of them offer decent music apps. (e.g. Synology DS Audio).
> I'm just saying that Gawker is just about the worst possible example to use.

Gawker is like a Rorschach test for how you think about these types of things.
That's why good news organisations
a) fact check and
b) are careful to differentiate between fact and opinion

As both of these protect you from defamation claims.
Ask HN: How do I trust/sandbox apps on Android?
I have been shy to install applications on Android, and am generally shy of closed source applications.

I'm trying to remove unwanted applications from an Android. I do want a File Manager, Gallery App, and Music Player. Most of these require read/write access to the file system/memory card.

If you dig through Google Play, to try and find the permissions, many have network access. So in theory could read your file system, and upload files.

So the question is, how do we trust these applications?

Do the gatekeepers to the applications stores test these applications for these kind of exploits?

Beyond uploading my Photos, and Music, and Downloaded Files, is there any other risk of an application having access to the file system. Or rather, are things like a Contacts database encrypted and only accessible by trusted applications?

Can you sandbox applications? With native Android tools, or possibly other applications?

I'm not overtly paranoid but don't have trust on these platforms enough to use them for phone calls and messaging at this point.

Any pointers welcome, and thank you in advance.
Thanks a lot @jiva <3
If you have a chance to listen to / watch some of the interviews with Michael Collins that have been recorded over the years, you owe it to yourself to do so. The man is an absolute class act.
Don't click "No" LOL
No, just hacked. Code signing keys get abused all the time. It's why Microsoft now insist they're held in hardware devices whereas they used to allow them to be free-standing files, but it hardly helps.

If you think about it for even a moment you'll see that for code signing to be meaningful requires a completely locked down software supply chain, including controls that trace through developer laptops and third party open source code that's pulled in to your application. The typical app developer combines components from a huge number of sources of unknown reputability and security strength, which are then all executed on laptops that have permission to push arbitrary jobs to CI clusters.
Is it? Ghost.org seems to have much higher prices:

https://ghost.org/pricing/
My friend did his Masters from Finland and said his monthly expenses were about 200-300 Euros in his first year. I think he spent a bit more in subsequent years after getting a part-time job. That's 18000+ euros if extended to 5 years.

Don't overestimate living expenses in a 500 year old walkable town with a small university in a --socialist democracy-- country that cares about its citizens.
I thought about that point when constructing that list, but despite Twitter's small size as a business, it has outsized power in the media environment.

For complementary reasons, I excluded Microsoft, despite its large size.

I'm sure one could debate the exact composition of that list, but it's not too important to the larger point.
"I signed up for 18 months of programming... They suddenly reduced it to 12 months. As of yesterday, I've withdrawn after 4 months as this is not the program that was sold to me. I completed 22% of the program...but under their new reduction, they said I owe 37%"

Seems like they would have a good case for getting their money back, but might need to consult a lawyer.
What people don't seem to understand is that the market for EV is fundamentally limited by batteries. We know about how many batteries will be produced in the next 5-10 years.

The EV market will grow as fast as the battery market can support it, and Tesla is by far the largest current buyer of batteries and they will continue to expand that. While at the same time also attempting to be one of the biggest battery companies in the world.

The Tesla 'pilot plant' they have in California, is targeted to be the 15 biggest battery factory in the world by end of next year. Its the same size as the plant VW and Northvolt have planned in Germany by 2026.

Tesla will in start building multiple huge battery factories next year, in Berlin and in Austin, Giga Nevada (biggest battery factory in the world, with Panasonic cooperation) will continue to grow and they will also continue to be one of the biggest costumers for LG and CATL.

We are quickly at the point where the raw material inputs will have a seriously hard time keeping up. Massive amounts of new nickel, lithium, cobalt and battery grade graphite need to be minded and refined. Nickel is the best investment, as there is basically no way around massively increasing nickel in the next 10 years.

This is before we even consider grid batteries. Li-Ion grid batteries, even when not able to be a backup for the cities are seriously useful for basically every grid operator in the world. While other storage mechanism exists, li-ion batteries are arguable the best in the market and will be for a long time.

Tesla is already a serious contender in that market (largest market share by far) both in terms of home and grid batteries. They already have all the software and electronics required, and already are in contact with utilities around the world.

People are very fast to claim 'bubble bubble bubble' but I would push people to seriously consider the market dynamics at play and how the transition EV and renewable energy will play out in the next 15 years. Tesla if you like them or not, is well positioned, in terms of EV, Grid Batteries and Solar installation, all of these will grow globally and exponentially over the next 10-15 years.
Cobalt Flux pads actually have the simplest sensors imaginable: on the bottom of the pad is a large steel plate, connected to the control box. Under each arrow is another steel plate, also connected to the control box using a wire and separated from the base plate by 4 velcro patches, one on each corner. Step on an arrow and the plates make electrical contact.

The reason these pads worked so well compared to other home pads is that they used more robust materials: steel instead of aluminum and polycarbonate instead of acrylic. It still had issues though, the wiring and wood screws in particular.

Arcade pads use rubber sensors: press the arrow and the sensor get squished, connecting two carbon tracks inside it. These were notably finicky, at least for the early models. They progressively became more sensitive as they wear out, before they fail and get stuck.

The linked pad uses load cells, which allow to adjust the sensitivity. I don't know how it works in practice but in theory that should be great for high level play.

As for the "TX" series of pad, they come from a long line of questionable quality pads. Some were great, other not so much, but it was mostly due to the build quality and materials rather than sensor design.
http://www.cadhistory.net/13%20IBM,%20Lockheed%20and%20Dassa...

another likely inflexion point was the introduction of CADAM around the period
I know the incentives are there to have exponential Silicon Valley hyper growth. But there are also incentives to be a company that still exists and it is big 20 years from now. And there are ethical decisions that could be made despite of the incentives.

Even being a YC company, I believe it didn’t have to be that way.

Edit: thanks for the link, great article. ”Land grab” is a great term for what I currently think about Lambda School. Except the “land” is people’s life and hopes.
You’ve made valid points but have failed to see who the target market is for a service like this: people who are not technical enough to stand up a Ghost server by themselves AND are too price sensitive to pay for the lowest tier of $29/mo [1] from the makers of Ghost.

Essentially, the maker thinks their product will fill an unmet need for such customers, many of whom can be found in developing countries [2].

[1] https://ghost.org/pricing/

[2] https://news.ycombinator.com/item?id=25415538
Sadly there are far more characters to keep track of than those three recognizable ones.

And you think it's odd to say that people of varying nationalities are easier to distinguish than those of the same?
Oh really? That is indeed a shame. I thought they were closed for now due to the pandemic and may reopen "soon".
It's likely only genetics that determine taste. Abiotic Soil contents probably have no contribution.
Nah, Google would close it after two years.