skysight-inc/HackerNews huggingface dataset:
> But you won't be more secure.

I respectfully disagree. A cloud has many more vectors for attack, and even the largest clouds have blind spots. For example, check out AWS's (lack of) response to a vuln report that I filed with their security team: https://github.com/aws/aws-codedeploy-agent/issues/30

Did you know that AWS does NOT pay for security vulns and does not operate a bug bounty program? It seems a common myth that AWS is more secure than any particular company. Your security inside or outside of a cloud has to do more with your internal security posture than what AWS brings to the table (and leaves behind).

The public cloud is not magic security pixie dust. It's a virtualization platform with extra services attached. You are still 100% responsible for securing your servers (meaning everything down to the network routing layer, and some beyond that, too). Obligatory reference to the AWS Shared Responsibility Model[0]

This is not a bad thing, but it's still a thing. Anyone who migrates to the cloud and magically expects their security posture to improve one iota is simply wrong unless they take active steps to integrate as tightly as they can into that cloud's security tools. As someone who has done a ton of AWS security audits, I can tell you that people take multiple approaches on that: either they don't integrate into it fully, or they submit to vendor lock-in.

This is perhaps too deep of an argument, since clearly intelligent and skilled people can reasonably disagree. FWIW, lapsed AWS SA, recovering Fortune 50 cloud security architect, and please don't take my argument about the cloud to indicate that I'm anti-cloud: my security-focused SSH key management company, https://userify.com, is strongly cloud focused: AWS Advanced Tier, GCP Partner, SOC-2, PCI, HIPAA. I'm very much pro-cloud, while recognizing that it enlarges your threat model but brings other security advantages.

Where you're hosted doesn't matter as much as whether you're paranoid and clueful, and perhaps have former blackhats on your team ;) So my point is simply that the cloud question isn't that relevant, and the thrust of the other questions should be used to determine security competency instead of where they're running their operations.

0. https://aws.amazon.com/compliance/shared-responsibility-mode...
Why? Youtube is trash now...

For example, I have never once received a "you should watch this as well" decent recommendation from Youtube, the sidebar is absolute garbage and cant even keep the concept of a topic-thread... Youtube is total trash.
Depends if your rom supports edxposed properly which is for android 9 onwards.
Please don't bring in someone's personal details as ammunition like this. We're trying to avoid the online callout/shaming culture here.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so...

https://hn.algolia.com/?sort=byDate&type=comment&dateRange=a...
This sort of negativity is misleading. Someone who has been to actual failed states will see how Spain turned out pretty successful, and only thinks of itself as inferior because of psychological reasons.

Corruption is of the same nature as in any other developed country, inside trusted circles of crooks. Try bribing any policeman in Spain and see how that goes. We regularly convict criminals for embezzlement and related crimes, including a relative of the last Spanish king (Iñaki Urdangarín).

Structural problems will need to be resolved (employment and entrepreneurship we can never foster enough). But we can't keep kicking ourselves down, that seems to be the national pastime.
I'd still argue to give the amount the service is worth to you, but if you're not willing to do that, then I'd say bilal4hmed is probably right - $1/mo is probably sufficient. Facebook, Twitter, etc. all have ARPUs at or below $12/yr.
Sounds like it none of your business. Speculating about the metal state of others and playing internet doctor is insulting.
Every 8 Years, Swarms of Millipedes Stop Trains in Japan
It would be more than that, a launch without any pre-existing escalation is unlikely, I’m not sure what the US or Russia for that matter would do in case a “rogue” launch.

We know from a few previous close calls that the Russians didn’t launch when they erroneously detected launches.

Quite likely any nuclear engagement would be preceded by an adversary trying to destroy or minimize your second strike capabilities first.

The US keeps its SLBM fleet in a rotation that would always be optimal for a second strike against Russia.

Russia increasing its anti submarine activity or even destroying US subs would likely be seen as a prelude to a first strike.

So Russia spending 3 months pushing US subs into a kill box further and further form optimal launch positions and then the US detects a ground based launch no matter how small would likely invoke a ground based launch from the US before anything actually hits.
Great article "cryptoanonymous" (welcome to HN btw): really lots of information in there but...

Aren't you writing this because now that you could get out and got the (real) USD on your bank account, you actually want the price to crash very badly to buy much more coins?

If the price were to crash back to, say, 3K USD, wouldn't you be tempted to put a few millions back in and ride to 15K and more again?
Environmental protection - check
Public education - check
Research spending - check
Social security - check
NASA - check

There’s a lot I like about the state! Yes, I admit it has many problems and frustrations.

But given we moved *away from the gold-standard, what is different now that makes it wise to accept a fixed money supply?
no sorry. but the code I shared is really short and sweet. I don't even see the entries on the homepage on the blacklist so there's no temptation to "just remove it".

Try pasting my snippet into your JS console on the homepage to see what i mean (code is short, no HTTP calls)

Humans are tormented by choice/options. The hardest time for someone on a diet is when they have the option to choose junk food. My user script removes it from your HN homepage.
> If two consenting adults weigh their own personal risks and choose to go on a date, it isn't your business to judge their behavior.

That's fine if it was just a risk to them. But it's not, unless they decide to live together and never leave the house after their first date, or quarantine for 14 days after every date.
> You people who say that freedom of speech laws only apply to government restrictions, not to private companies: Do you realize that if this approach were taken to private restaurants we would still have whites-only lunch counters?

In the US, partisan political affiliation does not constitute a protected class, and incitements to violence are not protected speech.
There is no membership to buy dishwashers. And there is planned obsolescence which mimic this behavior. Compare that with clothes, the whole economy of fashion is built on people not wearing what they buy. Same with gym membership. There is nothing new.

And there is no monopoly in the dishwasher market. Match until 2019 owned almost all the popular dating apps.

This article for more info : https://marker.medium.com/what-i-learned-about-the-business-...
Where can I read about the signal server-side architecture? Is it open-source as well?
Gesh the amount of bad information in those replies.
I don’t understand how that will help you figure out the equivalent of a post mortem for a service outage.
"Run-only" AppleScript is compiled to a bytecode format that is very poorly documented. In 2017, I released a CTF reverse-engineering challenge called Scriptabble, in which contestants had to understand a compiled AppleScript file which very slowly computed a flag, then fix or reimplement the algorithm to compute it faster.

Teams generally solved it by reverse engineering the AppleScript runtime to understand the VM bytecode; one writeup is here: https://twitter.com/_niklasb/status/856594863294472193

So, I guess I can't be too surprised that run-only AppleScript ended up as a good malware vector - it's so poorly documented, and there are so few tools to understand it, that it could easily fly under the radar.
I always found it curious that Whitney would associate herself with Badoo, but I guess that's business as usual.

Pre-Tinder, Badoo was a fast growing dating app that was shady af, full of dark patterns on the site/app - https://www.wired.co.uk/article/sexual-network [2011]

Then this came out a while ago, and I can't say I was surprised how the founder is portrayed
https://www.forbes.com/sites/angelauyeung/2019/07/08/exclusi...

(and I would also not be surprised at all if I found out that Bumble's data was being sold to others - AFAIK no signs of that currently happening)
that sounds interesting do you have any links? or insights to why it did not work out?
Its not just about reserves, though I believe you about the stockpile. It's also states not administering fast enough.
In this case yes. From the headline I thought there was some kind of weird Apple permission thing where you could mark a binary as unreadable but somehow could still be run to evade malware detection, but it seems like this technical article author is just unfamiliar with the concept of compiling.
Biden-Harris Admin Proposes $10B in New IT and Cyber Funding
This is great, in my opinion there are some things that shouldn’t be sped up (and clojure has those very well managed), but there are quite a long list of topics on which Alex Miller needed more hands.

Will insideclojure remain a sort-of personal blog of Alex, or will it be an unofficial dev blog of core?
This was largely my experience too and always confused me about people saying AMD was better for Linux.

Nvidia proprietary drivers existed and worked, the AMD stuff was worse.

It makes more sense if it's about open vs. proprietary rather than what works better.

Though sounds like things may have changed since then.
Lua is a bit weird and I think it's actually the strong point in favour of Lua (besides the obvious: nice performance and great portability). We need more variability to explore different ways to achieve our goals and to suit widest range of preferences. I'd love to see a big and strong standard library for the language to see it used for wider variety of tasks.

In my extremely limited experience with Lua, the only thing that I definitely didn't like was its weak-ish dynamic typing, so I'd been keeping my eye on tl[1] and wu-lan[2] which both transpile to Lua for a while.

1. https://github.com/teal-language/tl

2. https://github.com/wu-lang/wu
"Ultimately, Keybase's 'future' is in Zoom's hands." [0] That is what the parent comment is talking about.

[0] https://keybase.io/blog/keybase-joins-zoom
Establishment of a closed artificial ecosystem to ensure human survival on moon
And yet he came up with sodomy. Freud would say there are no accidents.
Some industries have already matured and standardized this concept. The HECVAT is one example.

https://library.educause.edu/resources/2020/4/higher-educati...

The benefit of this is that if you (as a vendor) wish to sell in this industry, you probably only need to complete this once, rather than one for each potential customer.
I thought that it just sends push notifications without content which then wake up the app so that the app itself can fetch the message from your homeserver with encryption
Having used Lua a fair bit in the past year (in order to write custom plugins for Kong), the main draw (and in some cases, drawback) for me with Lua is its integration of coroutines. Draw as it makes writing event-driven code dead simple, with coroutines managed behind the scenes as you write code serially. Drawback as if you pull in the wrong library, one that does something in a blocking fashion (such as with a c module that doesn’t “get” Lua), you can get into some trouble.

In terms of syntax it’s basically JavaScript with stupid array indexing, which is enough to turn people off I’m sure.
I sympathize with your argument, but I disagree. Here's why.

If you choose to raise your risk of catching COVID, a few things can happen:

(1) You don't catch COVID

(2) You catch COVID, and recover safely in the privacy of your own home

(3) You catch COVID, and accidentally spread it someone else while pre-symptomatic

(4) You catch COVID, get very unlucky and have to be hospitalized. The hospital's ICU beds are full, and they prioritize your young life over someone else's old life, and that old person dies.

If the only possible outcomes were (1) or (2), I would agree with you that it's a private decision that no one should scold you for.

But as the likelihood of (3) and (4) rise, your actions increasingly impact others. At a low likelihood, it's not a big deal and we can probably round down to zero in our moral calculus, just for convenience. But when R is above 1, and the average person is likely to pass on the disease, it's very possible that your infection on average leads to dozens or hundreds of infections over the next year. The expected value of quality adjusted life years lost at this point is not negligible. Tens of thousands of people are dying every day, and it's only going up[1]. ICUs are full in a non-negligible fraction of US hospitals [2].

I get that all of our actions impact other people, and it would be hassle to constrain your freedoms by that fact alone. But when it comes to COVID, your actions affect others by a much larger degree than other everyday choices.

Incidentally, this is why we as a society have made speeding a crime and not a 'personal choice.' Driving very fast is usually safe but occasionally hurts others, and we've decided that that risk is large enough to be worth restricting your freedoms over. Not all externalities meet that threshold, but some do.

So if one unnecessarily risks catching COVID and passing it along, then scolding seems ok to me. People who recklessly pass on COVID are why millions are dead and dying. Countries with much better adherence have much lower death tolls.

I personally have curtailed my dating life this year to try and save lives. I encourage others to do so as well.

[1] https://ourworldindata.org/covid-deaths?country=~USA

[2] https://www.nytimes.com/interactive/2020/us/covid-hospitals-...
While I will say congratulations, I hope you also appreciate how lucky you are. I cringe at some of the decisions that were made and how close you may have came to absolute ruin not just for yourself but your family as well. I hope the lesson people take from this isn’t “Never give up” but rather that startups are harder than you think and posting on forums is more of a crap shoot than a guarantee of any useful traction. Calculate that risk carefully to yourself and dependents and see if it’s really worth it.

Imagine if you were trying to launch right around the beginning of 2020. The HN of the 2020s is becoming a much less forgiving crowd than that of 2013.
WhatsApp delays privacy changes amid a backlash and user exodus
To be fair i grew up thinking bill gates owned skype
They could easily add an optional badge to avatars showing that you donated $1 that year via an optional in-app purchase. The subtle social pressure in a lot of group chats would be pretty effective, and it would help raise awareness that it is run by a non-profit foundation.
Except that in doing this, you are increasing the likelihood of spreading the virus to other people you interact with. So you are evaluating risks for yourself, but the impact is on society as a whole. It's like that superspreader wedding in Maine, where the people who ended up dying were people who didn't attend the wedding. Instead, they spread the virus to each other, and then to others they interacted with.

It's more like drunk driving. I may evaluate that after 4 beers I'd still be comfortable with the risk of driving. It's my life to lose after all. Except I'm not the only one affected by it.
No. You can send a data push notification type with an encrypted payload, decrypt it on device and display it. Same on Android.
Real regex would be nice. I understand not going full beans with the batteries, but surely a few more wouldn't go amiss? Perhaps a 'battery' for formatting a Lua table as a string, since tables are such a big deal in Lua? This would help immensely when debugging scripts during development.
TSMC to Produce Intel CPUs
As much as I'm cheering for Signal, yes this was absolutely foreseeable.
Ask HN: What are some papers on distributed computing?
Hi HN, I'm looking to get a 30,000-foot view of the distributed computing landscape, from both the theoretical and technical side of things. I want to make sure I haven't overlooked anything, so I'm keeping the subject purposefully broad. Generally speaking, some of my questions are:

- What are the general laws that apply to all distributed computations?

- What are the major programming models for distributed computation?
- What are the major distributed computing paradigms in the industry?

- What are the theoretical and practical limits of trustless computing?

- Other than 'blockchain' (and related concepts), what are the most exciting developments in the field of distributed computing? (e.g. session types)

What are some of the must-read papers that would shed light onto these questions?

I think of 'must-read' in terms of:

1. Seminal/foundational papers

2. Papers that do a good job of reviewing the literature, and help get oneself oriented

3. Papers that represent significant advancements on important problems in the field

Many thanks in advance!
Lua is a great language, but the fragmentation between versions makes it difficult to be adopted outside of niche embedded areas. On a side note, we maintain a Lua newsletter but haven't had time to update it. This article looks perfect for a new edition.

https://luadigest.netlify.app
There's always people who do not know that and download it anyway.
Wrong side of the spectrum. The lower limit of human hearing is 20Hz. It is not possible to hear <20Hz noise. It is, however, possible to feel it, if the sound pressure is loud enough and you actually have a subwoofer capable of reproducing those frequencies, but that is rather unlikely unless your subwoofer is a cut-out in your room's wall with a fan in it.

https://en.wikipedia.org/wiki/Rotary_woofer

If you feed a 20Hz signal to a typical home subwoofer (or even most club systems) and hear something, you aren't hearing 20Hz. You are hearing a bunch of high frequency rubbing noises as the speaker cone moves at 20Hz, trying and utterly failing to couple any amount of energy at that frequency into the air. This is why many songs these days are produced with "bass maximizers" and why modern laptops can sometimes have "decent bass". It's not bass, it's a filter that purposely distorts the bass, which your speakers can't reproduce, into higher frequencies, which it can and which we've learned to associate with heavy bass played through systems that can't reproduce it but distort instead.

Just for reference, I believe these are the subs we use at Euskal Encounter. I can vouch for the fact that they can make the floor shake in a massive event hall venue. Low end response: down to 28Hz. No more.

https://jblpro.com/en/products/vtx-b18

It is indeed better to modulate data in ultrasound since you have a lot more bandwidth - except for the fact that any lossy compression applied to your file is going to completely destroy your data. This is one thing the author got absolutely right.
Needs a (2020) - this article is a year old
Good, but too late. I'm leaving anyway.
'its gmail' is matrix.org. It is the default server when you start up Element.
Clojure has come up a lot more frequently on HN than in the past.

I'm curious if there is a particular larger project that is using clojure that's driving a lot of this?

Or particular JVM application like Kafka?
Thanks for trying. Respect
I think this is just poorly written, and what they are trying to say is the bad actors would add their malware to an LOL distro and the redistribute it as "official".
The issue as I understand it is neutron stars would form black holes in some reference frames. It really breaks relativity for all forms of energy to produce gravity.

Which is completely ok as long as there is some experimental support.
Countless studies have shown coffee consumption to be beneficial to human health, often topping out at some ridiculous amount of consumption (i.e. benefits go right up to 6-8 cups/day), including the many studies that look at what I myself really care about, all cause mortality.

At some point "skepticism" becomes denial.

Here is an example study: https://pubmed.ncbi.nlm.nih.gov/31055709/. I could link them all day.

Key except: "An inverse association between coffee consumption and all-cause mortality was maintained irrespective of age, overweight status, alcohol drinking, smoking status, and caffeine content of coffee."

Most studies do in fact attempt to control for the types of factors you mention.
How to Publish Artifacts on Maven Central
I agree with speeder in that Lua and C are probably two of my most favorite languages. I think developers come away with that feeling for the same ideological reasons.

Lua is also hands down the easiest programming language to embed. There's just no comparison. LuaJIT's C FFI also makes embedded work ludicrous.
You said you asked them about their "tech stack and ability to scale". A tech stack consists of frameworks and languages used, which can be found on GitHub, so there's part of your answer.

Indeed I'd be interested in the post mortem here and I also don't expect anything from them (depending on how large this turns out to be, though, and so far it's actually a rather huge outage so maybe we'll get some info after all).
I use macfan control to force a lower fan rate which throttles the cpu. Battery is significantly better (feels like 2x at least) for mundane tasks. I can still watch videos, browse and do light work without feeling any slowdown.
> The big clouds have security research security ops teams larger than many companies.

That’s like claiming that a company is on safe legal basis beause of the army of lawyers they employ. It might be true, but the inverse correlation also holds.
Congrats, and thanks for sharing!
I like how you put it. You convinced me to throw a donation at them :)
Hiring fogus to work on Clojure sounds great to me. Two thoughts:

- I'd love to know if this was enabled by Nubank's purchase of Cognitect. It's none of my business; I'm just curious.

- As an enjoyer of the history of programming languages, I'm always going to be glad when anyone who has read their lisp joins the Clojure team. I bought Kogge off fogus's (and Stanislav's) recommendation. http://blog.fogus.me/2012/07/25/some-lisp-books-and-then-som...
That was the purpose of comparing to cows and milk. For all the same reasons you should worry about cows being expensive (even if milk is still cheap), you should worry about real estate being expensive (even if rents are low).

In the case of a household, those mean that you can't take some of your production, and save it for the future in capital goods -- the same kind of thing that happens when more of your income has to go to the same necessities.

In the case of a central bank, those mean that the injections of money aren't (currently) effective for stimulating economic activity, but are simply causing a wealth transfer and rallies in whatever stores of value remain. That is the same signal it needs to get back as when consumer goods become more expensive: you are not relaxing a limiting factor on economic growth.

Edit: toned down
How big was the bounty for disclosing the encryption was broken?
I think that you miss the context of the thread
Thanks I just gave 50 bucks, well worth it, that makes me happy!
It may be different between an individual and a business, but for gift between individuals it is the donor who pays the tax:

https://www.irs.gov/businesses/small-businesses-self-employe...
But the Signal Foundation is a 501(c)(3), so their donors don't owe taxes on the donations, right?