skysight-inc/HackerNews huggingface dataset:
I am including all the latest items published on these two platforms, as of now:
1. ProductHunt(nearly 70K items)
2. Google Play Store(180K+ apps)

Though I have plans for including other platforms too & will decide after seeing response of this MVP launch.
It's always difficult to assess these kinds of decisions without all the information, though. There might have been very good business reasons for this.

Maybe to qualify for the insurance cover for intrusion, there was a specific list of algorithms that the insurance company said had to be used.

Maybe it costs the insurance company so much to update its actuarial model for the policy that it's only worth doing every 10 years even if that means it's less secure.

I'm not saying that this is true for this case. But it could be.
Many people need to fail, including the author, for such a situation to arise.

The author failed to understand the mission of the business and how non-compliant technology posed a risk to it.

The auditors failed to understand the developer, and educate them on the compromises needed to remain compliant. They
also failed to engage in a discussion around alternatives.

Everyone failed to actually care enough to solve this problem, but the author still found time for a snarky misinformed article.

The vast majority of grating security/compliance tales come from a similar place of ignorance, apathy and snark. The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides).
https://www.ncbi.nlm.nih.gov/pubmed/24386252 (from 2013) talks about LCD vs E-ink, and determines backlit LCD induces eyestrain (as measured by blinks per second and self reported visual fatigue) at a higher level, and that the E-ink Paperwhite has a profile similar to paper.
> If you have a choice between a comp sci and a software engineering career, go for comp sci. One prepares you for a wide swath of careers, the other gives you tools for today.

This advice probably depends heavily upon the school. At mine, a Software Engineering degree required the same classes as Computer Science, but with extra engineering ones on top.
As an engineer I think all you can do is respectfully and publicly (within org) raise your concerns. If shit hits the fan 5 years later you have a life jacket and they are the ones looking like idiots.
This is insane, and should be considered criminally negligent.

Linux is not a high assurance RTOS. It does not have adequate reliability nor can it provide any guarantee of hard realtime, and thus it should not be found anywhere near a "pedestrian detection algorithm" that's supposed to protect a car from hitting pedestrians.

There's proper operating systems[0] for this sort of scenario.

[0]: https://sel4.systems/About/seL4-whitepaper.pdf
Or people who don’t clip their nails as short/regularly as some of us do and type straight down, instead of with the pads of the finger (for instance if you say closer to the keyboard than they recommend).

Over the decades I’ve seen a lot of keyboards with this kind of wear (though not as bad perhaps) from people in one or both of those groups, even on old school real switch keyboards where the keys are thick as hell.
I'm going to spring for this one. I'm still using an old TFT CCFL LCD display here because anything else gives me a pounding headache and face twitching.
www.opendsu.com
Here in the UK Domino's have their own online ordering system and they deliver themselves. There are not on platforms like Deliveroo but their system works better.

They seem to have a pretty good strategy and team to execute on it.
You should try watching British Pathé on youtube. They have a series from the 50’s/60’s about how stuff is made and it’s wonderful. Great quality too.
I am succesfull with productive and semi-productive activities in a buses (at least when travel time is below 8 hours).
^^^^^^. This x1000.

Yes, it's bad when bureaucracy means that individual bad decisions are made. But casually saying "oh, well, this is idiocy, the government doesn't care about security" ignores the fact that organizing the regulation of human behavior is immensely costly, and the government needs to optimize on those costs.

A good dev analogy is using a library function vs rolling your own. The government's library is the list of things that its own engineers approved. The equivalent of rolling their own is for some individual auditor to make an independent decision to deviate from the list. Now, it might be that you can squeeze out an extra tiny bit of performance[/the government can squeeze out some extra security] by rolling your own sort function or whatever, but most wise devs will balance that off against the risk of introducing extra bugs, the extra writing and maintenance time involved, etc.

Reality is that this sucks. It would be amazing if it wasn't actually super-super costly to organize human beings to all point in the same direction and make sure that people don't cheat. Government would be a lot cheaper and more efficient. But, alas, reality does suck.
The lack of encryption has put some pressure on myself to delete all my icloud backups and not rely on it anymore, but holy hell it never even occurred to me what havoc would happen if you put a coding project in a directory that's monitored by iCloud!!
I think the 10 years is the key here. 15+ years ago the DevC++ was a gem, lightweight, fast usable IDE. But 10 years ago there was the free VSExpress out (not even the first, 2005 and 2008) which was far superior to DevC++ imho. (edit: on Windows)
Sabayon Is Rebranding Itself to MocaccinoOS with a Focus on Containerization
Or perhaps it could be a fixed duration per field, somehow, so that you know before filing what you will get.

It would be easy to discriminate between 20 years for drugs vs. 5 for anything software, but I guess it's tricky to decide whether something like e-paper should count as fast-moving consumer-facing tech or hard-won physics/chemistry knowledge.
I'm confused. What is this and why is it significant? It's not an emulator, it's a port (what does that mean?) - but it doesn't necessarily run N64 games?
1. No longer making such resolutions as I found them to be counter-productive for my personality type.
I do think the real circulating supply is lower (Lost wallet, Seized wallets) therefore the real market cap is lower. About valuation, you cannot compare a company which gives investors dividends/buyback vs a currency only used for holding and trading.
Similar tool is HNRSS: it's a wrapper for the Algolia API and allows to follow HN through best/new/etc. while filtering for queries, comments, and score.

https://github.com/hnrss/hnrss/
Once when I was setting up my mom's iPhone I couldn't get the app store working because whenever I tried to download something the app store went white.

Trial and error told me that some apple id page was supposed to come up, but wasn't. Just a blank screen.

Tried a couple hours later, it was fine. Meaning their server went down and they didn't even bother to code up an error page. Super lazy.
Impressive how professional negligence is the "fun part" for you. If it ever goes wrong, I hope someone goes to jail for that. (yes, stupid requirements suck. but if they actually impact things that matter, "fun" is not the appropriate response)
AIER is a libertarian think tank which exists solely to reduce any type of government "interference" in freedom. I don't trust them to be honest arbiters of science -- their sole angle is people and companies should be free to do whatever they want (including infecting other people apparently).

Yes, you provided a link to a site which has links to 24 other papers. Providing proof in this case required you to cut and past a URL; you are asking me to read and rebut 24 papers, and I'm not about to. However, I did look them up and the wikipedia article about them [1] said the scientific community has condemned their positions on COVID, which is herd immunity -- everyone should get sick, we should live with 3M deaths in the US, so businesses can get back to selling stuff like normal.

[1] https://en.wikipedia.org/wiki/American_Institute_for_Economi...
When you’re protecting someone else’s data you have no incentive to keep it secure beyond the minimum to cover your ass from regulators and lawsuits.

It’s not so sad so much as maligned incentives. Data breaches are common, companies aren’t really punished for them, and the harm to the user is vague and doesn’t typically materialize in any visible way so they’re little outrage outside our bubble.
https://www.fiverr.com/
SSI is still very useful today. I use it to have a single error page in nginx that displays useful information for each error. Have also used it for projects that are mostly static but need a few dynamic parts.
>> two-factor authentication with or without consent, is now more important than customer satisfaction and good-will.

I'm sorry, but what sort of pointless stupid rant is this ?

Its 2020, surely as a contributor here on ycombinator, you must be tech-savvy enough to know how much of an increasingly GOOD THING(TM) two-factor authentication is in this era of key-loggers, phishing etc. etc. ?

No doubt you would be the first person to start shouting from your rooftop with false claims about how bad Apple's security was when your account got hacked, carefully ignoring the fact you had not bothered to turn on 2FA.
It seems like you think that technical problems are solved automatically by money.

As far as I know, every major cloud service provider has had a major outage at one point or another.

Could it be that 100% uptime isn’t simply solved by paying for it?
> So, the toxic dose of Tylenol is only 2.5X the active dose

The effective dose starts at 500mg. Most people are likely going to be taking 1 or 2x 500mg tablets for acute issues - and I'd argue that's often enough for most cases where you want short-term analgesia. Both 500mg and 1000mg will improve SPRID6 scores (dental; https://www.cadth.ca/sites/default/files/pdf/htis/june-2016/...).

Where I've complained of medium term pain (expected duration: weeks to months) my GP has suggested NSAIDs instead. They're not without their own problems but I think I'd personally prefer their safety profile to long-term Paracetamol.
So we get rid of time zones... to make infinite more time zones. Now, instead of knowing that people eat lunch roughly around noon in a place, you need to familiarize yourself with whatever the local conventions for time are in every place you go to. It’s just worse time zones.

The argument that people and businesses can set custom hours is kind of moot because people can do that now, and still don’t.
One thing I found interesting was this list of media companies now owned by AT&T. I can imagine a motive scenario based on these names alone.

https://bgr.com/2018/06/16/att-time-warner-merger-brands-wha...
Not a groundbreaking strategy, guaranteed fulfilment of orders sufficiently warm and within appropriate time windows, refund if not satisfied.

Deliveroo, Uber Eats etc can not provide competing guarantees without vendor cooperation; for which they have no availablity.
People with breathing problems are already stressed about that; put one of these on their finger and it gives them a number to stress about. A very noisy instantaneous window onto a data point that integrates over minutes and matters over hours.

They are a great tool but they are not used well currently.
The people are the problem, and the misperception that they don't need to own these requirements for the business and are just in a hurry to check a box (on all sides).

Agreed. I think the framing of compliance in most companies helps reinforce this mindset. It comes from a place of compliance as "avoiding downside in the form of fines or gov't censure", not compliance as "a set of standards we abide by, that provides upsides to all of our customers by virtue of our following them".
Compliance is important when you are selling stuff to customers. As they also often want compliance. So less secure, but compliant solution is sometimes needed from business perspective... Which I think is likely be better than just telling customers "trust us".

Fault is really with standards moving too slowly, though this might not really be negative thing as sufficient time for researches to reach conclusions is also needed.
Yes, there are many possible issues, but most of them can't be identified without real use.

One way to create a sandbox for finding edge cases would be to create a general petition site using voteflux, or convince change.org to implement it.

I think such a site would also help with adoption, because it will gradually introduce people to the idea, and for issues with large enough support politicians will have to follow petition results, even if they were not elected on flux platform.
Yeah - utterly agree. The point raised in the article is valid - but the correct thing to do isn't to persuade the auditor they are wrong, it's to push FIPS to include bcrypt instead of SHA2 (although as below, this isn't the right answer either - it should use PBKDF2 or similar).
I empathize with the author, but definitely they are missing the Big Picture. Just because everyone’s using SolarWinds, does that make it safe to use? No. Now replace “SolarWinds” in that previous sentence with “bcrypt”. Author’s sole argument for security is that ‘everyone’s doing it’.

Auditors also can’t just allow any Tom, Dick, or Harry to write their own cryptography hashing algorithm and call it secure.
Latin Phrases You Should Know
I thought it was an AI generated paper.
One reason is that it made a great case study for modernizing an app from Delphi 7 to the latest version.

https://blogs.embarcadero.com/embarcadero-dev-c-successfully...
True, but competent company management / security professional would see version x+2 and go ahead and tick the x+1 item off the list.
Oddly, a version of this is also happening in my wife’s world, but with music composers instead of authors.

The scheme is a little less sophisticated, but the themes are the same. The phisher knows the parties involved and their relationships, they know the lingo and the process of commissioning a composition, it isn’t limited to famous/well known people/groups (e.g. they target grad students), and it’s very unclear what they’re attempting to achieve (or how they might monetize it).
I find as a developer there are very very few things I need windows for. Every year I need to start up windows less than the last.

High end PCB design is probably the last on the list. If I had to do ddr with bga SoC I'd probably pony up for Altium, windows only. For the 4 layer hobbies I've actually designed kicad works great!
Confessions of a Con Artist
And there are some companies want both Compsci + Software Engineering when looking for candidates.
Adam Savage – Car Company Double-Checked a Mythbusters Result
Frankly, focusing on the absolute security of the communication medium isn't a real issue for 99% of business purposes.

Phone calls are secure enough for most purposes. At the upper levels of business, e-mail is used for quick notes and corrections, but the heavy lifting is going to happen in phone calls and other real-time communications.

Techies some times put too much emphasis on things like cryptographic security of the communication channel or strength of encryption, when in reality it doesn't matter for phishing attacks like these. You could go to great lengths to get your customers set up on Signal or Telegram, but it doesn't matter the second they get an e-mail phishing attack that says "Hey, I got a new phone, locked out of my account, can you just attach the document here?"
Sha-2 isn’t appropriate as a password hashing algorithm so there’s something wrong with the compliance team and the engineers not correcting them that they need a KDF. Apparently NIST even calls out regular hash functions as being unsuitable for hashing passwords [1]. You’d need to use PBKDF2 although maybe this advice has been updated since?
Maybe they were being recommended PBKDF2 because that too is more susceptible to GPU attacks? Really should be using scrypt rather than bcrypt anyway.

All that being said, using sha2 isn’t necessarily “wrong” if you can force your users to use longer passwords. My understanding (could be wrong - I’m not a security algorithms expert) is that all these “hard” hashing algorithms are trying to provide guarantees even if your user has poor security hygiene. If you can force your user to use a randomly generated 20 digit password then you can significantly reduce your server load and reduce latency by using a faster hashing algorithm.

[1] https://stackoverflow.com/questions/11624372/best-practice-f...
> they are on unemployment benefits (or similar.)

Unemployment runs out in a few months and requires you to be actively looking for work. It isn't a stable position where you'd be able to be creative.
Computer Science is more a pure science, Software Engineering has more leanings to an art form.
I've used my Lenovo warranty to get my x220 main board replaced. I've had that laptop for probably close to a decade now and it still works well.
My 2 least favorite things about computers: Printing and Fonts.
The game begins
I agree that this is definitely a trend, so I feel like highlighting a great example of educational content that is very dense, concise, and with just a touch of whimsy: 3Blue1Brown on Youtube[0]. He has been doing math education videos on YouTube for years. I just watched his latest video on the medical test paradox and redesigning the Bayes rule to address it[1].

All his videos are absolutely phenomenal - the best educational content I've seen on YouTube. I cannot recommend them highly enough. In my experience it is more akin to reading a (very engaging) textbook than watching a video. I often find myself pausing to think things through and can _feel_ myself grasping at new ideas and learning while watching.

[0] https://www.youtube.com/channel/UCYO_jab_esuFRV4b17AJtAw
[1] https://www.youtube.com/watch?v=lG4VkPoG3ko
>“They want us to be compliant, not secure.”

No they just want to do their job & go home to their family.

Arguing about every variance and merits of crypto with the counterparty is not their job, especially when there is central team - FIPS - specifically set up to centralize this and avoid the exact thing the authors team did: Every department freestyling it.
The key touch is mostly irrelevant, much bigger win is that the protocol actually verifies the domain it’s authenticating against.

A key touch on fakegoogle.com can’t be proxied to authenticate on google.com
Interesting! Deno's official module registry stores immutable tagged versions of open-source projects, but there's a project called Nest.land[1] that takes the immutability one step further by putting modules on the arweave[2] blockchain.

I'm not sure where the JS standardization process is at with import integrity checks for non-script-tag imports, but Deno has lock files and integrity checking built in.[3]

I like the idea of a language that's built with content addressing from the ground up. I dream of being able to import IPFS urls (or something like that) directly within JS. Although that wouldn't be as good as a language that forced usage of content-addressed imports, since that way you don't have to scour the code for any sneaky dynamic imports (especially since in JavaScript there's `eval` and the like, and they can be obscured).

I guess this is partially solved by Deno's ability to limit the network requests to specific domains like:

deno run foo.js --allow-net=deno.land,foo.com

I'll definitely be keeping an eye on this project - thanks for sharing!

[0] https://deno.land/x

[1] https://nest.land/

[2] https://www.arweave.org/

[3] https://deno.land/manual/linking_to_external_code/integrity_...
I've never heard of a pizzeria outsourcing delivery, none of this is remarkable. Maybe it's different in the UK.
Ask HN: What did you accomplish in 2020 outside of work?
Little Known History of India's Wootz Steel
The second to last paragraph on page 420 sums it up:

> My investigations now lead me to confirm Syrski's data almost throughout. However, the histological examination of the organ does not make it possible for me to agree decisively with the opinion that this is the testis of the eel or to refute it with certain reasons.
To me this is a non-example though because in this context 2 = 0. So 1 + 1 = 2 = 0.
There is a Python IDE built in Delphi called PyScripter. Doubt it has anything specific for phone apps though.

https://github.com/pyscripter/pyscripter
In another timeline:

Auditor: This internet-connected device has no floppy drive. No antivirus needed.
Software Engineering is badly named. Real engineers build artifacts that are designed to meet performance requirements as efficiently as possible. Software people can't even effectively specify the performance requirements of the artifacts that they produce.
I find it an insightful comparison. Probably the closest to UBI today.

How do we know receiving UBI will not be stigmatized? It can also vary from place to place (it is cultural).

At least in one country I know unemployment is 60% of your previous salary. This could be enough to survive or to live a very comfortable life, depending on your income.

I agree with you, though, with unemployment benefits being conditional on finding a job, plus the limited time they can be provided in full.
I tried looking up if there are any previous examples of FIPS 140 that allow bcrypt. I can find 37 matches when searching for "bcrypt" here: https://web.archive.org/web/20141226152243/http://csrc.nist.... . Seems that BitLocker in Windows used BCrypt at one point. Author doesn't mention how old this is, but BCrypt seems to have been approved for FIPS 140-2 compliance since 2008. If the event described was after 2008, I would not hire those same auditors again...
> Supplied no visual feedback of progress

That's kind of a trademark of Apple, they absolutely hate showing progress and detailed information about what's going on (maybe for design reasons? Who knows). When it does not work, there's generally no way to know what's happening and why.
https://www.wired.com/story/why-do-printers-still-suck/
Great analogy.

It is a frustrating end result in this case. I wonder if there's any possibility for escalating this to a regulator's technical resources? I wonder if this kind of thing is typically left to the auditor discretion.
Two-factor is fine as long as SMS isn’t the only way for the second factor.

Not to mention, many times, SMS becomes the only factor.
It's also pretty decent for embedded!

Sometimes I feel they should rebrand it, because many people are blocked by the Qt name.
If that story is true, then I hope that at least some of involved in this will have substantial loses and company will go out of a business.

Before you will kill or maim someone innocent.

If you must comply with this scanner then buy 16 GB RAM and SSD (or more hardware, depending on bottleneck) rather than plan to kill people.

Also, who made self-driving car not operating as a real-time system?