skysight-inc/HackerNews huggingface dataset:
How much is that compared to the average for Poland? Here[0] I am seeing a figure of 1,234€/month gross or 890€ net (US$1075) for 2020.

[0]https://en.wikipedia.org/wiki/List_of_European_countries_by_...
I got an invitation recently.

I have been pleasantly surprised at the quality of what I have come across so far.

Basically it’s a bunch of facilitated discussion groups, with scheduling and directory services.

It feels like a bunch of radio phone ins. You can either listen or participate.

Will it scale? I really don’t know, and it is plausible to me that they need to rate limit scaling so that they can build the features that turn out to be necessary.
Care to educate those of us who are confused by this?
For me this depends on the application. For a REST API I'd probably open a Conn or Tx in an early middleware and carry it on a request context, or via explicit parameter, depending on the HTTP router's features. (In Go that usually means a request context, unfortunately - a more powerful type system would ideally get you some more featureful type-safe routing.) For a more RPC-like or compute-focused API that I might keep some handle to the DB (or other data source) on a method's reciever and route / dispatch to that method. (I think this is the same thing oppositelock suggests elsewhere in this thread - https://news.ycombinator.com/item?id=25807562)

> Would you have the bulk of your code be integration tests then?

I'm not sure if you mean the bulk of my code or just of my tests - for a REST API I would expect mostly functional tests. Do e.g. PUT+GET and make sure the result makes sense. This would be the case regardless of DB architecture.
Not that it's going to change anyone's mind, but to me nationalism of any kind is one of the most pernicious scourges on humanity, which has led to the murder of hundreds of millions throughout history and is likely to do so again.

---

In the comments multiple people are making the mistake of thinking that nationalism is the belief that nations should exist.

That's not nationalism.

People can be against nationalism and still believe that nations should exist. Gandhi was just such a person, and he was murdered by a Hindu nationalist.

Nationalism is the belief that the group you're part of (usually tied to some national identity myth) is superior to others, and usually goes hand-in-hand with xenophobia, racism, bigotry, and fascism.

From the article:

""Godse did the right thing by killing Gandhi," said Devendra Pandey, 53, national secretary of Hindu Mahasabha, the Hindu nationalist organisation behind the memorial
library. He was vocal in his belief that India should be declared "a country rightfully for Hindus" and that its 200 million Muslims should move to Pakistan."

Those 200 million Muslims who live in India and are part of the Indian nation, yet they're not Indian enough for the nationalists, just like German Jews were not German enough for the Nazis.

There are close parallels in other nationalist movements from all over the globe, in calls for "America for the Americans" where you have to "love it or leave it" and calls for English to be made the national language and Christianity the national religion... very much like Hindu nationalists in India calling for Hinduism (their own version) to be the national religion to the exclusion of Muslims and other minorities.

Violent repression of people outside the in-group is another feature of nationalism, and again it has nothing to do with believing that nations should exist, but has everything to do with feeling superior to the people being murdered, tortured, robbed, discriminated against and driven out of their homes.

This is why Neo-Nazis are "white nationalists", and you're more than a little confused if you think they are some sorts of defenders of the right of nations to exist and not bigoted, hateful, violent oppressors of everyone not exactly like them.

This is why nationalism is pernicious, whatever the flavor.
I'd imagine because for the vast majority of people they'd appreciate the trackpad size more and the webcams are already serviceable.
If all the interesting stuff happens on the client and the server "just" forwards encrypted messages, why would the server need frequent updates?
Agreed, it is wrong to describe this as a Bitlocker bypass. From what I can see it is actually a Windows lock screen bypass and also privilege escalation vulnerability.
I'd suggest you have a look at how policing is done outside of USA. A raid on someone's home is almost never justified - it would take highly exceptional circumstances to make a "normal" police force perform like that.
Exactly. Talk is cheap.
Boston Dynamics' Spot Robot Learns to Dance [video]
The best Go source code is the stdlib. When you read stdlib code, you can be confident that nothing is there by accident. Every decision was made for a reason. When you're learning, that's invaluable, because it means you can "dig" anywhere and be rewarded for it, whereas "digging" into most codebases will often be a waste of time.

Also, I would advise actively avoiding the big names you have heard of. A lot of products are successful despite having garbage code. And even more of them are successful despite having only decent code, full of stuff not worth emulating.

Try to identify people who have a lot of experience and a strong command of the language, then look at their most recent projects.
>go for "When the Isaevas moved" when writing about husband and wife.

As a Russian I can't recall this convention ever being used
What is your objection to just leaving a yubikey plugged in? It eliminates most of the ways an attacker could impersonate me besides literally stealing my laptop, which is a high bar. Most people are valuable enough targets to phish or infect with malware or something, but not to plan a computer heist.
Hmmm, from my view, I wouldn't have thought Amazon would do so well. I guess I don't understand how their sentiment is calculated.
It’s hard enough getting random non tech friends and family to move to Signal. Going even further from mainstream means they will encounter usability issues and they will eventually revert back to WhatsApp. I don’t want any of this. And if “we can do better than Signal,” go make it then and get wide adoption instead of bitching in a blog post about how it’s not as good as some fringe products.
Bortle Scale
Summary: Apple, Amazon, Google getting worse; Microsoft getting better; Facebook is Satan. That chimes with my experience of the changes over the past few years....
If you just need Linux VM and a couple of other basic capabilities, DigitalOcean.
Ovh is the only one I can think of
Take the telecom companies (AT&T, Telefonica, Tata, China Unicom, and on and on and on and on (these companies have hundreds of data centers each)). Then take the wholesalers (Equinix, Digital Realty, etc) - some of who count some cloud vendors as customers. Then take tens of thousand of collocation and dedicated providers that own their own data centers (PhoenixNap, HE, OVH, Hetzner, Softlayer, ...). Then take the VPS providers (Linode, DO, Vultr, ....). Then take the shared hosting (GoDaddy, ..). Then take the government agencies and companies that have their own private data centers (e.g, banks).

Cloud vendors are growing, but it's still a very small part of the market. What they're really good at is sales and marketing (and making much better margins.)
The main reason I'm weary of recommending GCP is the support horror stories that keep coming up. I'm using it at work now since our massive Google Ad spend protects us from that. It's got some really good technologies although there's various rough edges.

One thing that really irks me is GCP requiring me to talk to sales people (not support, sales) to have a relatively small quota increase. Why would they make it harder for me to give them money?
One doesn't validate the credibility of a journal; one validates the credibility of the methodology in the research.

And it then turns out that most methodology even in reputable journals are rather wanting with many objections that can be leveled against it.

A large amount of scientific research can't even be reproduced, and of much that can, even though the cold data can be reproduced, the conclusions that follow from the data are rather dubious leaps of faith.

It doesn't take much for something to be called “science”; it certainly doesn't take reproducibility, despite various claims to the contrary.
Boeing and the FAA did a bang up job hiding the details of their unsafe system behind vague language such as this:

> Specifically, just before stall entry, and well below any normally encountered airspeed, control column pitch forces became lighter when they are required by certification rules to become heavier.

"[not] normally encountered" could mean, once every 10 flights. Maybe once every 1000 flights. 1 out of 10 scenarios for a given flight. Who knows? Certainly not the FAA, because they didn't collect or publish this data in their report. They used similarly vague language most likely provided by Boeing.

This report walks through the stall scenario with MCAS working, and it walks through an entirely different scenario with MCAS malfunctioning. It does not walk through the stall scenario with MCAS malfunctioning. Boeing and the FAA still have not released data on how often MCAS was operating (erroneously or otherwise) prior to grounding, and how safe it might be for pilots to operator aircraft with MCAS disabled.

It sounds like the pilot here is on the take. Such a glaring omission in the simulator is damning in my eyes, and I trust Boeing and the FAA less than I did after the crashes.
Digital Ocean is great, but my needs are fairly limited.
It's my understanding that the main concern about a compromised Signal server is that metadata of which phone numbers are registered as user IDs could be compromised.

Basically the same threat model the Signal people themselves address when talking about court orders and subpoeanas received by their corporation for "customer" data.
Keybase solves this problem.
Interesting point. I hadn't thought about that. Helps that access to my email is 2FA, but it does make for a single point of failure.
She probably made unrelated mistakes they can get her on... This is just to set an example to not go against the narrative.
Is this even that controversial of a take?
So in other words, that's what you want to believe, so you will believe it without any actual facts. Ignorant people like you worsen the division in America.
His marriages really were disastrous, and his second wife really did say that. She (and he) even really might have felt that way, despite the immense problems in their relationship.

Just to give you a sense of the problems in their famous relationship, Dostoevsky was once lost all of her belongings while gambling.

If you're interested further, Joseph Frank's five volume biography of Dostoevsky is a masterpiece in itself, and would give you a sense of how difficult, but also how strongly emotional their relationship was.
DigitalOcean, but they don't offer anywhere near as many services as the big 3.
I feel like Signal is held to a ridiculously high bar when it comes to anything. Is it perfect? No. But come on now; I see other threads on HN where people are debating/bashing their use of Intel SGX, really?

Assuming you trust the client builds (or use a verified build) and verify the public key, all of these arguments go out the window with the exception of exposing your phone number. This situation seems like a prime example of a company (Signal) being so transparent that people need to find fault.
Emacs can also install your packages/plugins automagically via the wonderfully designed use-package combined with MELPA. It's a game changer when it comes to managing an emacs configuration, especially if you work across a range of servers. Just copy the .emacs, install use-package manually and you're off to the races with anything and everything you need.

By the time I discovered use-package I couldn't believe that I had been tar-balling a mess of crap around all these years.
I have worked for a gigantic company that faced this exact license term and chose to simply use something else for free rather than pay for it. The capitalist priority is always to reduce cost and increase profit, after all. (Though they also happily pay to reinvent the wheel, because business doesn't understand yet that that actually results in lost value)

It would be better to incentivze companies to donate their engineers' time and work into improving the source code. Often they refuse to do that because they're petrified of patent, licensing, and intellectual property rights issues. Make that a no-brainer for them, and maybe suddenly they'd see the value in not only paying for it, but even contributing to it. I think the true value big companies can bring is an entire software development team and the 'test environment' of a big production use case.
Because you can never be sure that the other person's server or connection (or your connection) aren't being MitMed.
> Why is Apple even involved here? If people want a nasty app on their phone, then they should be able to have it.

Exactly. The real problem isn't that Apple has some policy about moderation for their app store -- it's their app store, some amount of curation is completely necessary, that they have policies to that end is completely fine. That's how stores work.

The real problem is that people don't have a choice to use any other app store, or independently install an app some other way (e.g. directly downloading it from a webpage or transferring it over a USB cable).

In Androidland, once Parler is back up on some web host, it will be technically possible to get their apk from somewhere else and install it, if you want it. Just like I can get NewPipe somewhere other than Google's app store.
You can go into my 250,000 loc project and randomly pick any variable name, method name, parameter name, etc., and put a typo in it or wrong type, and the compiler will catch it.

I have 100% type safety, and it's all done by TypeScript and my programming language IS TypeScript (not JS)

The the final output format generated by a compiler has absolutely nothing to do with whether the Language being compiled is typesafe or not. That would be like saying since Bytecode is not typesafe therefore Java is not a type safe language.
What object storage systems are using Cassandra for the metadata storage?
I have a backup U2F device. You can register multiple with any account.

If I somehow manage to lose both, I assume I’ll have to talk to a customer support rep or something.
It turns out that decentralization closes the door on top-down censorship, but at the same time, invites spam and abuse of the system for personal gain. It's very easy to do this in a decentralized model, and every single decentralized service suffers from this. IRC, Email, Mastodon, you name it. It's all bad.
on here, you'd be surprised
Copy pasting my comment:

Consider this paragraph from the Signal protocol

> ...For example, they may compare public key fingerprints manually, or by scanning a QR code. Methods for doing this are outside the scope of this document.

> If authentication is not performed, the parties receive no cryptographic guarantee as to who they are communicating with.

Nobody I know in practice does this authentication. If an active attack is carried out, I'm reasonably sure people would not notice.
It is far too common indeed for people to religiously belief any conclusion so long as it is published in a format that makes it seem scientific, or worse, popular news report on such science that doesn't even retain the numbers and proffers even more spectacular claims.
Entering the war while Germany and Russia were on the same side would have been fatal, and might even have prevented or delayed their fission.

Staying out long after the split, while Germany and Russia gored one another, was clearly the wiser course. Entering before the Soviets could subdue Germany and overrun western Europe was necessary. But any claim that the US had any sort of primary role in defeating Germany remains nonsense.
My sides are hurting.

And flying fish has higher bird-to-fish-appearance-ratio than barn swallow.
This is the same for any piece of crypto. If you've been provided someone else's encryption keys, and they're not either from the person themselves, or from a trustworthy intermediary, then your channel could be getting intercepted.

It's a philosophical/conceptual problem with encryption, not one restricted to signal.
Sure they set a precedent for war crimes. Spying on your own citizens? It's not even apparent that that is a crime, just abhorrent.
In some countries, a surprise raid of your home means “we think you have hostages in your basement” or something at that level.
>Another response I usually see is “But Signal is all we have!”. While that is somewhat true — at least by the metric of “secure messengers your granny can use”, there are some promising alternatives who are especially focused on decentralizing E2EE communications.

So the author readily admits that these alternatives aren't actually good enough for the average user.

Newsflash: This IS for the average user! This is for my grandma and my cousins overseas who don't know anything about the internet! They don't know anything about "cryptoshit" or what "E2EE" stands for. Once you actually have something worthwhile that my grandma can use, then maybe you can claim it's better!
Can you give an example of one of her idiotic arguments?
Access denied. Never heard of khou.com before either.
Not sure yet, but every weekend they do a "town hall" where the two founders are pretty open about their thinking about the future of the product, and invite users to discuss it.

I get the impression from hearing them that they'll be incredibly thoughtful about monetization.
Sarcasm aside, at $COMPANY we have AWS reps integrated into our Slack, and they work hand in hand with our engineers quite often. Even for things as low down as “why is this query so slow on AuroraDB?” They even hop into war rooms for big events in case we need immediate assistance during high visibility outages.

It’s hard to overstate how important this level of close support is for an enterprise that is literally betting the farm on a cloud provider. The idea of counting on Google’s historical level of support is an absolute non-starter for us.
I know it's easy for me to say, but shouldn't nobody be building their business to be critically dependent on some other business, regardless of whether cloud provider or other class of service? Especially when the balance of power clearly favours one of the parties, this seams like a bad idea if it can be avoided. I don't know how hard it is to develop architectures which run on several cloud services. If it is possible, shouldn't this be standard practice?
PICSimLab: Realtime emulator of PIC/AVR development boards
It is easy for people who love Emacs to believe that most people (or most programmers) would come to love (or prefer) Emacs if they would only put in the time to ascend the initial learning curve. But this belief is an instance of what is sometimes called the "typical-mind fallacy": an underestimation of how different people's minds are.

GNU Emacs was my daily driver from 1991 to late last year, when I switched to vscode. I wrote many lines of Emacs Lisp code -- 20,000 lines of which I "kept": I arranged for those lines to get loaded into Emacs every time Emacs starts, and since the code was almost all "UI" code, any particular function or piece of the code ran on average at least several times for every hour I spent using Emacs.

Although I do not regret choosing Emacs in 1991, vscode suits my particular mental make-up better than GNU Emacs did.

To take one example, I spent hours configuring Emacs to be less chatty. I turned off the bell that sounds every time the user makes an error (where for example asking Emacs to scroll down when the bottom of the document is already visible in the window is considered an "error" -- in contrast to vscode's not feeling the need to send a message to the user or get the user's attention when that happens). I tried (and mostly succeeded) in turning off the repetitive messages Emacs displays in the echo area, e.g., displaying "Wrote foo.c" any time Emacs writes to file foo.c and, e.g., (particularly distracting to my train of thought) the "Autosaving..." message that regularly appears in the Echo area X seconds after I stop typing. In contrast, vscode is silent (non-chatty) enough to suit me in its default configuration -- like most GUI apps since the introduction of the Macintosh in 1984 are.

P.S. The way I got rid of the "Autosaving..." message was to turn off Emacs's autosaving functionality altogether and add my own autosaving functionality, which consisted of a call to save-buffers every time the user switches buffers.
There are impact factors and top lists, and you can check out the Wikipedia page of the journal if it exists. You can google what are the "top journals for <field in question>". You can check the publisher. IEEE and Springer for example tend to be genuine.

But you still have to look at the individual paper and can't believe it just based on a single article. Research articles are for sharing results among experts (and for advancing the careers of researchers), they are not aimed at laypeople. It's easy to misinterpret them if you lack the background knowledge.

Even in non-predatory journals many results fail to replicate and are produced due to a publish or perish pressure. You're better off learning from textbooks so you get info that has been verified, digested and distilled and represent consensus. Cutting edge research proposes new ideas by one group of authors, it's not a consensus yet.
Yeah, if the attacker has the right to replace arbitrary system executables, we're not really talking about privilege escalation any more. The solution is not to give people root access to your machine.

Not sure what the "don't have USB ports" aside was about: plugging in arbitrary USB peripherals shouldn't give you that kind of access, though they certainly are an attack vector.
For the longest time, Signal wouldn’t work without Google Play Services, but Moxie (the founder of Open Whisper Systems and maintainer of Signal) finally fixed this in 2017. There was also a long time when Signal was only available on the Google Play Store.

Why do I make a big deal out of Google Play and Google Play Services? Well, some people might trust Google, the company. But up against nation states, it’s no contest - Google has ties to the NSA, has been served secret subpoenas, and is literally the world’s largest machine designed for harvesting and analyzing private information about their users. Here’s what Google Play Services actually is: a rootkit. Google Play Services lets Google do silent background updates on apps on your phone and give them any permission they want. Having Google Play Services on your phone means your phone is not secure.

Moxie, why haven’t you put Signal on F-Droid yet?

Truly secure systems do not require you to trust the service provider. This is the point of end-to-end encryption. But we have to trust that Moxie is running the server software he says he is. We have to trust that he isn’t writing down a list of people we’ve talked to, when, and how often. We have to trust not only that Moxie is trustworthy, but given that Open Whisper Systems is based in San Francisco we have to trust that he hasn’t received a national security letter, too (by the way, Signal doesn’t have a warrant canary). Moxie can tell us he doesn’t store these things, but he could. Truly secure systems don’t require trust.
Imagine living in a monastery with no technology besides bolt, chord, and sphere
Scaleway maybe ? They have the basic building blocks (compute, storage, networking, db, Kubernetes master).
Doesn't the protocol detect device changes?