skysight-inc/HackerNews huggingface dataset:
From the original blog post:

> After getting the decryption key, we now needed to know what decryption algorithm to use. We went back to Signal’s open-source code and found this:

> Seeing that told us that Signal uses AES encryption in CTR mode. We used our decryption key with the AES encryption in CTR mode and decrypted the attachment files.

Was this supposed to be satire?
A good chunk of that is unique to the swift part of xcode. Do the same things in an Objective-C codebase and you'll be surprised about how snappy and non-buggy everything is.

I maintain today you could've gotten %80-%90 of the benefits of swift with a syntax refresh and add a few new cheap to compile features to Objective-C itself, like stronger nullbables and the ADT enums.

I think the 'good enough software' stuff will stop happening when physical limits start limiting improvements in compute, because the only way to have a competitive advantage then is through better software.

I hope that day is far away although, because it means that something like 8k consumer VR is something that will never happen, where the software is written properly to take proper advantage of the hardware.
Here is this weird trick that makes german carmakers mad: buy electric.
Show HN: WebAssembly running on the Roku (C/C++/Rust)
I'm surprised that there's only one commenter that said they'd like to go back to change something personal to their own lives.
Relatedly, at the Midlands Grad School 2019 conference, John Hughes did an introductory course to QuickCheck in which one of the final exercises (meant to demonstrate the use of Haskell and QuickCheck to black-box test arbitrary binaries) was to model `fopen`, `fprintf`, `fclose` and friends in C. I never actually did it, but I guess that's one of the most comprehensive ways to find out how something behaves!
They filter for memorization. Most leetcode problems you will not be able to solve in the allotted time without first being familiar with the problem or one very similar to it. Because most of those problems (and many CS algorithms) hinge on a certain "trick" to solving them.

The way to pass a leetcode interview is to know exactly what the interviewer is asking and then pretend like you've never seen this problem before. Then you amaze them by pulling a rabbit out of a hat. We are all a bit dumber for putting up with this charade.
Opening up the database reveals more metadata than would be visible in the application's user interface.
Pretty good! I tried it with some random cross-genre combinations of stuff I like and it found a bunch of other fairly niche bands I like. Looking forward to trying out the other recommendations. Works fine for genres other than punk & metal btw.
Cookies also have domain restrictions. The client won't send a cookie from domain foo.bar.com to baz.bar.com, unless you set your cookie domain to *.bar.com, which may be bad for other reasons. Even if you get you cookie domains right, there has to be a single source of session truth across the system. This gets to be complex in distributed systems.

On the other hand, a client can usefully send a JWT to any other service that has the secret key to validate it, and once validated, the information the service needs can be in the JWT itself, so there's not session lookup needed.

It's the difference between giving a friend your parking stub so they can go pick up your keys from the attendant and bring your car back vs giving the friend a copy of your key and having him get the car from wherever it might be.
They're not really the same: you know that an async function may potentially suspend and have other code run before its completion, while a normal function (in the absence of threads and signals) is guaranteed to run atomically, at least as far as your process's memory space is concerned. You also know that the only points at which an async function may suspend are an 'await' statement, and so data invariants that don't cross await statements or other async function calls can be reasoned about as if you had purely sequential code.

That's precisely the coloring that makes async useful. Without it you need to explicitly protect all shared data with mutexes or other synchronization primitives. 40+ years of threaded programming has shown that programmers cannot generally be trusted to get this right, and this in an area ripe with bugs.
It would be impossible for me to explain things you've made up in your head
> If your work is done on a computer, get a second monitor. Less time navigating between windows means more time for thinking.

I don't agree. Use a virtual desktop instead and switch workspaces with a keyboard shortcut.

I'm currently using 9 workspaces, and monitors couldn't ever beat that UX.
I think (know for a fact) they were lies also. There was no huge list of demands.
I was quoting the parent comment by @akvadrako :)
Well, as it currently stands, there's really not much to see unless you have an account
> automated taking pictures of app content

There's a world of difference between taking screenshots of an application and extracting messages and metadata from a database. I should imagine that Cellebrite's audience of corporate and law enforcement investigators would be very keen on getting access to this breakthrough. OTOH, Cellebrite's competitors have been able to do that for a while!
Also worth noting that the entire stack isn't allocated at once so 1 million threads would be using 2TB/68GB of virtual address space, not 2TB/68GB of physical memory.
Evidence Only for Hysteria
Yes filesystems are another big important part when it comes to the topic of data consistency. I'm not aware of a project similar to Jepsen for filesystems but there have been research papers like the one presented in this page that explore the guarantees of popular local filesystems: https://danluu.com/file-consistency/

Of course distributed filesystems are even harder but we can see that even writing to a local file is surprisingly complex and in many (most?) apps probably not really guaranteeing proper data consistency.

Imho the whole Posix filesystem API is flawed to begin with and it would be great if a modern replacement would emerge.
I would expect the toolsets to converge over time. That is, I can't imagine a tool that a LEO would have access to that I would not. Nor can I imagine a tool they might have that I would not want to use myself.

That said, I think law enforcement has an intrinsic advantage in practical terms. They have the money to pay for a subscription to known exploits packaged and made easy to attempt, and b) lots of experience using that tool (as well as just ordinary persuasion and coercion) to crack into peoples phones in the real world.
Biggest slowdown source was iframes in onlod handlers. Would be interesting to see what those iframes were for, or at least what proportion are ads and trackers.
Undefined value. :)
MAPS.ME allowed me and my girlfriend to do a 16-day hike to the Everest Base Camp without a guide.

It had more off-road trails than I had ever seen on Google Maps, along with altitude information, lodge reviews, checkpoints, etc.

I vividly remember turning my phone on a couple of times a day to look at MAPS.ME before immediately turning it off to save battery (you can't easily charge your phone up there). Except for the camera, I basically haven't used any other app for a whole 16 days. I haven't experienced such digital minimalism in adulthood until and since this trip.
By writing code you can do virtually anything these days. Cryptocurrency, though filled with a lot of scandalous projects, is still one of the cheapest ways to do remittance (currency transfer.) The initial founders of Bitcoin and Ethereum have profited immensely and have been able to raise money through their development foundations without any real socialite stuff. Vitalik Buterin is a stellar example of "want it? build it" programmer mentality.

For a more concrete `startup` example, which is what I think you were asking, just look at Gumroad:

https://www.indiehackers.com/interview/i-started-gumroad-as-...

Your question is rather vague and some may see it as innocuous but given your reputation, I sense that it is a leading question meant to be followed up with bad intention. You already know this: there are a myriad of Show HN projects posted all the time that are netting in good sums of money, that simply started as utilities built by programmers who were fulfilling a need they had noticed. Any of them can be capitalized at any time but most of these developers know that any path involving drinking parties and bosh hooey is likely to be a deal with the devil. To each his own.
Many other microcomputers of the era used BASIC as their shell Apple II, TI 99-4a, and the Commodore 64 are all examples of this. So the machine would boot to BASIC, and then you would call something like this (Commodore 64) from the BASIC prompt:

LOAD "FILE",8

Computers with MS-DOS and CPM were different in that you would load a proper shell and launch basic from there. I seem to recall (I was 9 years old at the time) the original IBM PC having a less capable BASIC that could use a cassette tape for storage built in that would boot if you did not have a floppy drive or disk in the boot drive when the machine started.
The growing peril of war with China over Taiwan
Sure it's not including Edge tabs in the alt tab screen? You can turn that off.
The key takeaways.

iOS:

The evidence above indicates the availability of current and historic bypass mechanisms for iOS protection measures. This strongly indicates is that, with sufficient time, money, and fortunate circumstance (e.g. capturing a phone in an AFU state), law enforcement agents can typically extract significant (if not all) personal data from modern iOS devices, despite Apple’s claims around user privacy . This is exacerbated by Apple’s failure to widely deploy Complete Protection over user data, and its failure to more broadly secure cloud services (particularly, the decision to store cloud authentication tokens in AFU). These facts combine to offer extensive access to law enforcement agents, rogue governments, and criminals.

Android:

The primary takeaway from this discussion is that there are many techniques to bypass user data protections on Android. Lacking an analogue to iOS Complete Protection, decryption keys for user data remain available in memory at all time after the first unlock of the device; live extraction then becomes a question of breaking security controls instead of breaking cryptography or hardware. Additionally, the extent of Google’s data collection affords law enforcement and rogue actors alike considerable user data, acquirable either through the legal system or through a device bypass.
Oracle’s Hidden Hand Is Behind the Google Antitrust Lawsuits
PredictIt, IIRC, also has limitations on total bettors on an issue, and amount an individual can bet in total and per issue.

Those constraints can produce odd results. Say, if the market was “full” of investors so no one new could enter, and also had reached a point where the people who weren't irrationally holding out expectations of Trump has already maxed out their positions, the only available trades would be between relative dead-enders.

Plus it costs money to withdraw funds from the market (5%, from another comment), so it looks like even if you could get in, you could actually only by 95¢ for 96¢.
I use Comic Sans for all my messaging apps. It’s the most readable font around. People make fun of me when they see it but whatever.
You clearly have zero idea what it is to be a true "alpha" male. The societal stigma you alluded to is levied on toxic assholes.
Programmers cannot get threading right, but Rust can.
“Hate” is a very strong word. I assume the author read the jibe of Playboy magazine calling the “Hite report” the “Hate report”. Perhaps an insider joke since Hite had been a Playboy model.

Made a real splash at the time. Not to top-tier academic standards, but still very fact-based, impactful and (I assume) honest.

Not a fan of trying to make every supporter of a cause to be a martyr. A better take is

https://www.independent.co.uk/news/obituaries/shere-hite-dea...
This blog post is the hipster version of those IG/FB click bait posts on the same subject. Very shallow content, disappointed this made to first page on HN
DeepMind seems to be building the Wintermute to OpenAI’s Neuromancer. Where’s Turing?
Wait, what? What happened to "fearless concurrency"? I thought this was supposed to be one of the borrow checker's selling points!

https://blog.rust-lang.org/2015/04/10/Fearless-Concurrency.h...
"...that can be locked down and monitored by experts."

In my homelab? I guess I should also kerberize my NFS mounts, after I solve the SPOF problem for kerberos's dependent pieces. I might have a little time after doing all this for working on my homelab projects. How much time could this configuration, maintenance and monitoring possibly take? (Just between you and me I resolve that on January 1st I will again start reading all daily/weekly/monthly logs, and this year I WILL NOT FAIL. It's only dozen give or take few boxen.)

If the security infrastructure needs to designed, configured, monitored, and maintained by "experts" in an unfunded environment, the security infrastructure is doomed to fail. IOW, it's security theatre.
> certain Robinhood orders lost a total of approximately $34.1 million in price improvement compared to the price improvement they would have received had they been placed at competing retail broker-dealers, even after netting the approximately $5 per-order commission costs those broker-dealers were charging at the time.

https://www.sec.gov/litigation/admin/2020/33-10906.pdf
Our Digital Lives Drive a Brick-and-Mortar Boom in Data Centers
> The types of people that use Cellebrite will never understand the nuance here.

Au contraire, I would imagine a law enforcement or corporate investigator would knows the difference between encryption in transit and encryption at endpoints, and therefore be in the market for what Cellebrite has achieved (if they aren't using a competitor[1] already).

[1] https://blog.oxygen-forensic.com/115-2/
One of the issues I have with the rust async story is that colored functions require (at least the way they’re handled in rust and similar languages) a separate standard library (Microsoft really outdid themselves providing a synchronous and asynchronous version of the BCL when they shipped async support, but that was also largely made possible by the fact that the underlying OS APIs were all fairly asynchronous at the lowest levels and had that asynchronocity exposed/available all the way through the BCL for C# devs already).

One problem with this is that an api like tokio’s might appear to be asynchronous but in reality portions of it are “just” synchronous API calls marshaled to a thread pool - i.e. none of the real benefits of async for now, but positioned so that the library can be switched over to real async code and automatically take all the consumers with “it in the future.”

I’m glad to hear mention of io_uring because it means that IOCP on Windows might get some love. For those that don’t know, on Linux there is^H^H was really no such thing as properly async file system access (eg libc faked it in a similar fashion for aio) so libraries like mio didn’t bother with true async for non-network parts of the library (and also partially because the biggest motivation for async development was the web world which doesn’t particularly care about asynchronously listing the contents of a directory or writing a “highest” performance backup product) - even though at least some platforms (like Windows) had very compelling async options available across the board.
It’s disgusting that you literally have two Google employees providing you the truth and you just keep saying “No, you must be mistaken.” I have eyes, I can read. I have a brain that functions very well. A lie is a lie is a lie. And even if lawyers some how manage to button this up, it’s still a lie in the court of public opinion...

EDIT: Sorry, I understand that you don’t have as much information as us and you’re just going off based on tweets and stuff. But come on. It’s insulting to be lied to like that. I hope you can understand that feeling at least.
Engineers of the Human Soul
If you could make a virtual environment that was that good, you would have already solved the self driving problem.

I wonder if Google would be willing to pay people to add cameras to their cars to collect real world data in far larger scale.
> If you trust that the policeman is a well trained professional there to serve you

They're not. In any country, that is fundamentally not the purpose of police.
"become Catholic to end the despair" - could you elaborate?
> Insert is a destructive operation by design. In fact, writing any collection literal (e.g. {} or (1, 2)) is internally implemented by writing a deletion tombstone followed by the new values.

These range tombstones are also evil. If you keep doing it to the same partition, even at a rather low QPS, you can easily bring down some nodes by keeping their CPU at 100%. Only tested this with Cassandra though, not Scylla.
Even if you click the ads, you're probably fine. Google isn't telling the advertiser what data they used to serve the ad.
They are for now, but if they have removed the export button you can guarantee the RSS will be killed off soon.
And once you get to a limit, the alternative to rewriting everything in non-blocking code might be to put multiple instances of your blocking app on multiple VMs/k8s/whatever behind a load balancer.
The authors conclusion is not reflective of the SEC findings.

>certain Robinhood orders lost a total of approximately $34.1 million in price improvement compared to the price improvement they would have received had they been placed at competing retail broker-dealers, even after netting the approximately $5 per-order commission costs those broker-dealers were charging at the time.

https://www.sec.gov/litigation/admin/2020/33-10906.pdf
Meh. I'm getting a sense that the author's grasp of authentication and authorization protocols is incomplete. I don't mean in the sense that the author left out some popular protocols, which is true, but in the sense that there's details wrong. For example, oauth and OpenID are mentioned only in the context of social login, and the differences between oauth, oauth2, OpenID and OIDC aren't covered (and OIDC is almost entirely unrelated to the original OpenID). Also, the author has a section at the end "GitHub social auth" as if it were somehow different from regular oauth used all over the internet.

https://www.wikiwand.com/en/List_of_OAuth_providers
Sure, or your token issuer could implement https://tools.ietf.org/html/rfc7009 (if the JWTs are generated using OAuth) or you could build a revocation system.

But at that point you've negated one of the two benefits of such tokens. (The other one being you can verify that the contents haven't been modified, since they are signed.)

Why not just use session cookies then?
I mean, it is, yes. That post is talking about threads. And the “fearless” name meant that it solves a lot of issues at compile time, which it still does in an async context.

Like any static analysis, it’s a give and take between making sure your analysis is sound, while still allowing useful programs.
Why won't you simply tell us your hypothesis?
No, it turns that if you optimize for immediate watch time, people watch a lot at once and then didn’t return. It’s more profitable if people watch a little bit everyday for the rest of their life.
Pascal's low-level semantics are comparable to C's. That's why I dispute that it doesn't have the same traps.

I agree that if you program C by emulating higher-level object systems, it becomes unmanageable and a lot of bugs around object lifetimes appear, and they're very hard to fix.

I personally don't have a great interest in such object systems, but fail to see how C++ should be any worse than Pascal in terms of perceived safety resulting from the higher level of abstraction.
>If you don't purchase insurance by clicking on ads, then you're fine?

not if insurers make the default more expensive, then make advertisments for a "secret" cheaper plan targeted at fit people.
> volunteering as a firefighter

This seems like exactly the case where I would apply the "There's a professional for that" maxim.
I prefer the Mac App Store over any other alternative, as a consumer.

I understand 30% is a large cut and I wish they'd cut it down to 15% across the board [it could be a competitive advantage, too].
The comparison of cloud platforms truly is heavily distorted at a startup. Most companies aren't comparing AWS and MS in a vacuum when presented with the decision. How much of the world's software runs on dotnet? Windows, Office, and Active Directory command their own predominant shares, not to mention other tools like CRM. MS earned a reputation for the battleship; relatively stable, plays nicely with their other products, LTS, backward compatibility, etc. Suppose the CTO for an insurance claims company is presented with the decision of migrating a legacy platform which already runs on a fat stack of MS products. They don't even need a salesperson to convince them Azure is the obvious first choice, because to them it's just another cannon on the battleship.

In my experience the tribal evangelism for AWS is... intense... and they've somehow convinced people to proselytize unpaid on their behalf. Having worked with both I'll occasionally mention Azure if only to revel at the spicy takes. Honestly though, I worked at that claims company I mentioned. Likewise the startup I work at today threw their hats in with AWS. Both were respectively good decisions, both bad in their own right. As ever, try to do everything and something is going to give.
Always found these APIs a little hard to work with. For instance, if I tried to use `actix-web`, then using `reqwest` and `tokio` felt like pulling teeth.

If anyone's got minimal code lining up a web framework (any one, not stuck to actix) with some reqwest, I'd be thankful to look over it. Just some trivial stuff so I can add an API gateway that proxies a specific API.
The full Atari game list (Appendix I) is interesting. It's not better at every game, and scores a zero on Pitfall and Montezuma's Revenge.
Seems like a nice victory in a single battle. But in the context of a much larger war in the TLD space it doesn’t seem like domain registrants are winning:

https://domainnamewire.com/2020/11/19/donuts-is-acquiring-af...

EDIT to add: http://domainincite.com/26107-westerdal-offloads-two-more-gt...