skysight-inc/HackerNews huggingface dataset:
Our company [0] was also hit by this too.

We receive email for our customers and a portion of that is spam (given the nature of email). Google decided out of the blue to mark our attachment S3 bucket as dangerous, because of one malicious file.

What's most interesting is that the bucket is private, so the only way they could identify that there is something malicious at a URL is if someone downloads it using Chrome. I'm assuming they make this decision based on some database of checksums.

To mitigate, we now operate a number of proxies in front of the bucket, so we can quickly replace any that get marked as dangerous. We also now programmatically monitor presence of our domains in Google's "dangerous site" database (they have APIs for this).

0: https://www.enchant.com - software for better customer service
I’m interested, do you have a blog?
You’ve hit on a strong point “independence”. Hypothetically if this was done via an app with advanced AI that could see and describe the world around you, would you feel more confortable using it? Knowing that it’s not powered by another human?
I hope not. archive.is doesn’t resolve on all DNS providers.
This was my thought as well. It sounds like a 24 hour DHCP lease expiring.
Navigator.clipboard API
Might have, judging from this story.
I agree in not using the language as this gentlemen did, but sadly more and more people use it. I also abhor "infosec rockstar" and "Rockstar Developer" etc.
You will save so, so much money switching away from clouds too.

No, you don't need to use a hundred different AWS/GCP/whatever services, and yes, managing your own infrastructure is a lot easier than you think (and sometimes easier/faster than AWS).

The Stack Exchange network, at least around 2018 or so, was hosted on 12 servers they own!
Alder Lake looks a lot like M1
So CI, automated tests, SCM, small patches, API docs, stand ups and the ability to take breaks.

This is not a “highly effective environment”, it’s the bare minimum to have a functional environment. Might have been good advice in the late 90s though.
> So, a few early adopters of the technology started developing an alternative implementation of [Valve's] OpenVR called “Open Source Virtual Reality (OSVR) which even had open-source hardware projects. Sadly, its development stalled and even today its main site is offline.

Ah, I didn't know that SteamVR could run without Steam. Can Alyx (once installed) ?

Still, this leaves the issue is that being theoretically Steam-free isn't enough, as the experience with AOSP/Google Play Store has shown.

Valve might be 'pretty good' with their own users, but still the result of Steam's dominance is that it's getting harder and harder to get mods and play multiplayer outside of Steam.
It's a very interesting question to what degree vaccine production and distribution is limited on money, and not on organizational and political issues, and if it is at what point it is. E.g. clearly manufacturing capacity is some limit, but if you started a program to build even more new factories now, how fast would that be, and how much does that depend on the money available? Same for distribution.

I have no clue what the answers to those questions are, but depending on how large/small the possible adjustments are, helping to fix other urgent issues that arose out of the current situation might very well be worthwhile or more viable to do.
It would make sense that Apple is exempt from some of the rules. After all, Apple co-founded ARM.
I would agree, but "apparently maliciously" is too subjective.

According to US conservatives this is what Twitter, Facebook, Amazon, Google, Apple, Twilio, Snapchat, etc all did to Parler for political reasons.

According to US progressives/liberals it was absolutely not malicious, but rather the polar opposite: protecting people.

These days there is no common agreement on that stuff, and given the recent events I see no reason to believe that they wouldn't do as GP asked.
Appearently the os can't differentiate between any USB devices.

I saw a great video years ago (which I haven't been able to locate for years) that went into detail as to how you can basically make a custom usb device arbitrarily malicious. The trick that sounded particularly good was that you can impersonate a usb device that requests a driver that has a known security vulnerability.

Fun times.
Of course we can and should scrutinize the claims of highly regarded people. For example, Michael Levitt has a Nobel Prize and I've publicly criticized him when I was convinced he was utterly wrong: https://twitter.com/raphlinus/status/1297182969514270721

The mask issue was a debacle from a scientific communications point of view. In the early days, there was legitimate debate among scientists regarding the value of masks. But I think the main thing that went wrong was a paternalistic attitude, trying to address supply chain issues of N95 mask usage by medical and other frontline workers by convincing people that masks weren't effective. That, I think most agree, was a huge mistake.

Of course, your actual statement that highly regarded virologists tweeting that masks were "stupid" and "couldn't be effective" is false, and you probably know that.
Likely Apple will still support USB-C charging even after adding back MagSafe.
One does not preclude the other. Your quick answers can come in form of sending them links to the relevant parts of the documentation you wrote earlier.

And if their question is not something that can be answered that way, you can improve your documentation so that next time the question is asked, you do not have that problem.
Nothing at all. Many people survive exposure to the internet without being protected by corporate firewalls, think-of-the-children filters and antivirus.

Or do we expect UK citizens to curl up in fetal position and start screaming as soon as they leave their country because they're no longer protected by their ISP filters?
Apple is effectively a co-founder of ARM. I am absolutely certain they have a 'do whatever the hell you want with it, and have most-favoured on licensing' agreement in a drawer somewhere in Cupertino.
Actually in this scenario an alliance server may be a poor asset to replicate specifically because of what you stated - if the attacker is watching the traffic it's easy to spot. The more powerful place would be to be interferring with in the lateral movement stage, since there's bound to be some of that in any given attack.

That being said, it's entirely possible large financial services has both resources & mandate to run something more effective, like build in-house detection suites or use other things that provide a better signal than honeypotting. As said in the original post, it's one way of doing it and depends on your use case whether it's a good one or not.
I think the switches are driven by recruiting just as much as the old thing being “dead” in itself.

There’s a sweet spot in the middle of a tech’s popularity where people are cheaper. Very late or early expertise is more expensive.

You also are getting people who might be more inclined to learn new things. And that may be a proxy for a good hire.
Gun-Rights Group Kicked Off Mailchimp over Unspecified ‘Serious Risks’
Hmmm my Spectrum Gig in OR doesn’t go out at 3:40p but it does pretty much every day at 1pm. I was similarly excited to see this post...
There goes my weekend in a mathematical whoosh.
Does anyone have any insights into how the railroad industry fared after it was broken up? I'm curious what the impact of the overall industry was as a result of the Sherman Act.

Do we think that had the railroad industry remained monopolized that the US today would have more high speed railways or more advanced rail services?

The author seems to draw a comparison between railroads and Big Tech, and I wonder if we can make the same guesses about what the outcome of the tech industry will be after more antitrust regulation?
One corporation must not have so much power over billions of citizens of many countries. A power like that must only come from a transparent non-profit organization with a publicly elected management board.

We will get to that point sooner or later. But the road there will be long and painful.
Author here. I'm not sure exactly how they actually decide to flag. Alternatively, Amazon might somehow be reporting files in S3 onto the Google blacklist.

It would seem surprising, but it's the other possibility.
What Red Hat’s Purchase of StackRox Means for OpenShift
They were designed to the same spec, and had to pass the same suite of compatibility tests. However, they handled the implementation details differently.

>Architectural licensees get a set of specs and a testing suite that they have to pass, the rest is up to them. If they want to make a processor that is faster, slower, more efficient, smaller, or anything else than the one ARM supplies, this is what they have to do.

https://semiaccurate.com/2013/08/07/a-long-look-at-how-arm-l...
I’ll stick with NextDNS which just launched their ultra low latency network and also features adblocking.
Because it's a stock photo :D

Also, I've been using .net core on my Macbook and it works great :)
Republic TV and Zee News are literally owned by BJP members of parliament.
New Malware Obfuscation Technique
If their claim is false, then is it, in any jurisdiction, libelous?

Maybe, legislation to bring consequences for false claims will help ensure algorithms, and the support teams that monitor them, do a better job. In an internet focused world, especially one with lock downs, wiping sites off of the internet with false claims is a heinously bad act.
If your systems have any number of nines in their SLA, drafting a letter to Google's legal department is not a viable strategy.
Seems there's a bit of love going around for deception lately, always good to see some implementation stories going mainstream.
Immersion coffee brewing is better than percolation brewing [video]
I wasnt able to find on their site how they use all the produced user data (and users waive any rights for it, if I got the user agreement right). While I like the idea of the service, I think some transparency on how it uses generated content would be useful.
>And even in "normal" applications -- where the majority of users are not knowledgable enough to know that their spelling could be to blame -- an error message that's too verbose is still problematic, because many, if not most, non-techy users won't bother reading it!

Assuming users are 'too dumb' or 'smart enough' sounds like a broad generalization that's highly dependent on the tool.

I'm glad we have verbose compiler errors, and I write C++ for a living. Am I too smart for verbose output?

My grandmother can't login in to Facebook, should we forego the error dialogs because she's not going to read them?

I believe that terse error messages have their place, but this article over generalizes and is full of personal preference rather than data driven conclusions.
This doesn’t account for the cost of dependencies (an import statement is only one line!), so this mindset would result in taking on big dependencies to limit “lines of code”.

You must be very careful about dependencies. I’d sooner take a rule to arbitrarily limit dependencies than lines of code.
A note on cat: on older Unixes (I remember it specifically in some old version of solaris), you can actually cat folders, and it will show a directory listing. Iirc in the orogonal unix, read() on a directory fd would just dump out some filesystem internal structs that detailed the folder's contents.
Maybe it’s my bubble but I’ve seen a slight retraction from typescript in the past year.
I've tried to use DuckDuckGo a few times now - I really wish that they would write their own indexer and maintain their own index, it frustrates me that they rely on the Bing Index - which frequently favours low quality SEO optimised content or doesn't have the result you are looking for on the first page...

Each time I find myself going back to Google as it frequently surfaces the result I'm looking for on the first page.
Prime numbers in 2 dimensions. I’ve never thought of this before, but I like the idea.

Interestingly, when plotting them, some patterns appear:
https://demonstrations.wolfram.com/GaussianPrimes/

I would have expected patterns due to symmetry around the axes, but there seems to be more than that.
To any lawyers or even well-read armchair legal analysts, could this be a case of libel?
chromium is an open source browser. Its development is closed enough already.
Fun with conversion-operator name lookup
5 years is sadly decent run.

Was in a big Javascript project, where any article over 3 months old was useless or wrong. The internals of the app constantly being rewritten to flavor of the month.
Exactly. No concrete details and examples so safe to assume the emails were not actual @harvard.edu ones. But I blame it on organizations and esp universities. Each school/lab get their own prefix which makes it harder for people to spot a fake address.
This is just misleading. Razdan claimed on Twitter that she was joining the Harvard Faculty of Arts, not the Harvard Extension School. Harvard FAS does not have any journalism professors or offer degrees in journalism, and if it did, you would certainly need a PhD.
I have yet to see a scam which would fool me. And I have seen many already.

All the scam and phishing mails I saw in my whole internet career were somewhere between totally obvious and embarrasingly blunt.

I can't agree with your assessment. If someone is naïve, they are at risk. Same applies for overconfidence. These are personality traits which are easily exploited. In real life as well as on the Internet. We cant protect everyone from everything. Neither in healthcare nor in VR.
Author here. The second time around, the review confirmation email took around 12 hours to get to us.
By all means, you should check it out.

I live independently in a household with two other blind people. We use Be My Eyes
alongside object recognition / OCR apps like Seeing AI. The two types
of app compliment one another quite nicely.

I'm introverted myself, but I feel a lot less anxious ringing up an
anonymous stranger and asking them for a few minutes of assistance than
I do about imposing on sighted friends / family.
I took some lessons about not being an imposition or a burden to heart very early in life.

For fiercely self-reliant blind people, the smartphone is a gift from the gods.
Ask HN: Help with career change from teaching to tech, on the Autism Spectrum
A close friend of mine is pursuing a career change from teaching elementary/middle school mathematics to either software development or software infrastructure. Me and a few others are mentoring him throughout the process. Below is a recent message he sent us (and gave me permission to post here). We've told him that both software dev and infra require knowing a little about a lot (and sometimes a lot about a lot), and he's concerned about his ability to excel in that. I thought the fine denizens of HN would be able to weigh in and provide more input than what we already have. I don't think any of us are terribly concerned with his ability to become successful at software dev or infra--though we all acknowledge it's difficult to do well--and it may be slightly more challenging for him, but then again it may be slightly easier for him.

If it matters, he is high functioning and some of us were surprised when he received that diagnosis, but not very surprised. He is the sole provider for his family so he will be making this transition over 2-3 years while he continues to work.

>>> Due to my being on the spectrum, I have a narrow skill set. I think it may be true that I am a guy who is better at studying one thing hard than I am with getting into a position where I have to learn a little about everything. I want to accept the realities of the job market but try to strongly consider where I would be strong and where I would be weak very seriously. Currently, I do not know enough about DevOps to know for sure if it is a bad fit for me but I wanted to see if ya'll have any feedback regarding my being a person who is better at going deeper rather than going broader.
If people see a wall of text, they (from my observation) tend to skip it and conclude that the thing "just doesn't work". Even if the error is explained. So in that, they have a point. A little related are overly elaborate efforts to be cute and cheer up the user on error. (This of course happens more in Web GUI than in command line.) These can be infuriating and make one wish someone expended all this effort and money to actually make the thing work, instead of lecturing me not to get mad, with pictures.

But I think terseness is an imperfect proxy for clarity. In the Google search example, repeating the search query to the user may be actually useful. They may have pasted something by accident and/or heavily mistyped and not even have noticed. Do include important information, so the user can go directly to the place of fault. State what is wrong and try not to have the same message for many unrelated errors.

By the way, I'm still waiting for an "Unreasonable effectiveness of X considered harmful" article.
Signal apps DDoS'ed their own server
Make is still popular (not necessarily loved), because it still largely adheres to the Unix philosophy of doing one thing and one thing only. Anything more complex, make it executable and put it on the path and then call it from make.

Gradle. It's a full programming language. And let's not forget there's a ray tracer in pure cmake doing the rounds.

Being cross-platform without having to drop out of the main build tool isn't necessarily a benefit, and that's part of the reason for it's complexity.
I largely agree with everything you said.

I thought the point of the article is it just interesting that sql seems well suited for lists, and has primitives for ordering but that within sql alone a performant ordered list is more complicated than one would expect before thinking.

Why the constraint on sql alone? In many reporting systems you can generate reports based on an sql query, so a query that pulls out the data in order can be useful in a real world use case.
Thank you!

I was reading through the article waiting for the connection to eloquence and was disappointed when minimalism was in its place.
I don't think we should halt investigations. But the Baker article is not a serious investigation, it's a piece of pop-sci that is quite careless about scientific details. It is not helpful to those trying to understand the truth, but it might be an entertaining read or useful for other purposes.
Not only that, but sometimes you issue search then go to another tab, to issue another search... remembering your previous search exactly for N tabs isn't that nice.
DNS probably has nothing to do with disconnects, this kind of random suggestion unrelated to the problem always makes me think of the Futurama Robot Judge: https://www.youtube.com/watch?v=Jqn8HB2w2Fs (skip to 0:15 for the punchline)

Or maybe it is related, in which case I'll eat at a hat.
In my neighborhood it’s shortly after midnight. Or so I’ve heard from my kids and neighbors. I’m never awake to notice.

Also Spectrum, but no gigabit here.
I've used it as well on a MacBook - no major issues. But does the .net nanoframework work on a MacBook?

Yeah, it's stock photo. I get it. I guess I would have expected a .net-oriented project may have at least chosen a stock photo with, say, C# code on the screen... :)
it seems that as a man, online dating just doesn't work well unless you're very attractive and/or good at putting together an attractive set of photos (not the same thing!).

don't let that put you off talking to new people IRL though. dating sites tend to give you an unrealistically low impression of your attractiveness. before the pandemic, I used to go out to local bars a few times a month for dinner and a drink. I was mostly focused on eating, but more often than not whoever was sitting nearby would start a conversation with me, some of them very attractive women who I'm sure would have swiped left on me without a moment's hesitation.

keep in mind, all dating failures stem from one or both of the following: unreasonable expectations and simply not talking to enough new people. both are within your power to change.
One problem with that is that if one of the participating processes exits uncleanly while holding a lock (crash, OOM killer, ...), everything is deadlocked forever.

Instead, file locks would be released by the kernel, and if you use a separate process as described in the post it is isolated enough that the chance of crashing/being killed by the kernel is low, and if that happens you can detect it and crash everything.

In general, there is no robust solution for inter-process synchronization in Linux, except file locks which have very limited functionality. It's quite sad, this is the kind of functionality that you'd expect the kernel to provide, instead we have to resort to workarounds like the one described here, which add operational complexity.
Yeah, I saw this in action when I was a grad student at UCSF. In one of the labs I rotated in, the PI (pre-tenure professor) still had a lab bay filled with the most impressive display of reagents I've ever seen (he was a physical chemist). He would go over, look at it sadly, and then disappear into his office to write grants all day. What a waste of talent.
Of particular note:

"Don't host any customer generated data in your main domains. A lot of the cases of blacklisting that I found while researching this issue were caused by SaaS customers unknowingly uploading malicious files onto servers. Those files are harmless to the systems themselves, but their very existence can cause the whole domain to be blacklisted. Anything that your users upload onto your apps should be hosted outside your main domains. For example: use companyusercontent.com to store files uploaded by customers."
Server Sent Events with Spring Boot and ReactJS
Maybe they have your email but not your mobile number? Or they want a written record of when and how they contacted you?
EUPL – Software license for the sharing and reuse by public administrations
If you like that, then you'll love this: https://en.wikipedia.org/wiki/Ulam_spiral
And 4 dimensions: See Hurwitz quaternions.
So then the trick is to forgo internet by disconnecting power from a few minutes before that time to the middle of the night and get power back? I do feel for the ISP's with this setup because the right thing to do would be to write in the installation manual: "Only install in the deep of night".
Is this a better link?

http://www.jagregory.com/abrash-black-book/#chapter-16-there...
Many scientists citing two scandalous Covid-19 papers ignore their retractions
Cybersecurity Trends for Enterprises in 2020
In December:

1. Google (82.75%)
2. Direct (6.33%)
3. Bing (3.63%)
4. DuckDuckGo (1.85%)
6. Yahoo (0.94%)

Kind of upsetting that as of January 1st my website was delisted from Bing + DuckDuckGo for no apparent reason meaning that my traffic is down by 5%. If anyone has any contacts within the Bing team I'd be really interested to know why my site was removed.
I forgot that Google was blocked in China.
In case the author sees this: This article is unreadable on mobile.
All I know is what she wrote in the post: "Contrary to what many are tweeting, Harvard has a school called the Extension School offering a Journalism Degree Programme. The actual programme is called the Master of Liberal Arts, Journalism degree. The Extension School lists 500 faculty of whom 17 are categorised as journalism faculty. A number of these people are working journalists. I believed I fit this profile."

ADDED: It certainly seems as if the story has changed from something implausible to something vaguely understandable.
Visited your github page. Still not sure, what makes yours faster than vanilla nodejs? do u use standard nodejs api or binding with code written in others? enlighten me :-) can i use it for standard json rest api?
Wrt HN topics, I don't think I ever gone from "Don't understand" to "WTF" in such a short time.