skysight-inc/HackerNews huggingface dataset:
Psychologically the enterprise software industry is actively discouraged from creating secure code. The most-heard mantra is to not do it because it’s difficult, making it a pointless exercise. Another is that security testing is too disruptive to production systems. The software industry is good at recommending specific design ciphers and algorithms, and ignoring symmetric and public key protocols (Alice and Bob).

Also, many attacks today target security protocols rather than, for example, cracking passwords.

Another huge impediment to creating secure systems is agile, which discourages up-front design. The average sprint duration of two weeks is too short for meaningful security testing. Testing is not feasible with nightly builds or pre-release sanity checks, either.

Product owners or customer representatives are too often non-technical stakeholders that have the authority to make technical design decisions. While never a good idea, this has bad consequences on architecture and particularly on security.
Not a solution, more a workaround, but on Windows I highly recommend developing using WSL, especially for Python. WSL + pyenv + poetry + VS Code with Remote WSL works amazingly well.
Style nits aside, I don't think it's a good idea to selectively pick the worst N things in a PR and let the rest go. If you're consistently finding 10+ things to request changes on in somebody's pull requests, you probably need to look at your engineering process. Was the high level approach discussed before it was fully coded and "ready for review"? This is something easily fixed by process changes.

Are you finding a lot of little things in the PR itself? Many of the usual suspects can and should be automated away (linting, codegen, test coverage reports, static analysis, etc). Others can easily be added to a checklist before PRs are submitted for review, eg "Have you updated the relevant documentation".

Usually newer employees will get more comments on their PRs, as they're not as familiar with the system and might fall into more traps that others know about from experience. This can be mitigated somewhat by pairing/mentoring.

Sure some people just aren't going to cut it on your team, but most engineers when corrected on an individual coding mistake won't repeatedly make the same mistake, in my experience. If you just never mention the mistake, they'll keep making it in every PR and be completely unaware. Sometimes it helps to communicate out of band (ie, not in "official" comments on the PR itself) if there are some low hanging gotchas you want to make the engineer aware of.
It reads to me as though Google blinked. I'm sure somewhere, Rupert Murdoch is popping champagne bottles paid for by his ever increasing media in the Australian media bubble.
That's not how things work at McKinsey (current employee speaking).
It's a partnership and partners take the hit when there is one to take.
As a recent example (2020), in response to the difficulties stemming from the COVID 19 crisis partners compensation was massively reduced, but no one else's comp at the firm was affected.

As for the consequences of the current opioid-related debacle, it has been communicated to the firm members today that any economical consequence would be borne out of Partner's comp, as is usual.
My 2cents: to lower the onboarding, would be great to set it to get notification about what /would/ be bought or sold; eventually users will trust the system and move some of their money to it.
Hello fellow old farts. I rememer browsing on Mosaic, Cello, Slipknot, Netscape, Arachne, Phoenix/Firefox. There were doubtless others I've forgotten.

Anybody remember the various 3D browsers that would visualize site relationships? Apple's Hotsauce was the first one I remember, though it was more of a text based meta browser. Then there were a few graphical windowing attmepts.

The first images I remember seeing on the internet were the Clementine lunar photos, slowly rendered line by line:

https://en.wikipedia.org/wiki/Clementine_(spacecraft)
What are you talking about? Are you in the right thread? None of this makes sense in regards to my parent comments. Yikes. And I'm not engaging in your "Muslims are bad" whataboutism deflection. What extreme actions do you see me advocating for here? What stereotypes am I propagating?

Weird stuff.
Using innocent sounding CNAMEs on abandoned domains is definitely a smart idea.

I’ve definitely got some old domains kicking about, I’ll see how far off they are from expiration and do something similar if they have at least a few months left in them.

The proxies themselves can also be hosted at normal sounding domains and subdomains like cdn.technology.memes or whatever.

And when you point other domains to them as CNAMEs use equally regular looking subdomains no algorithm would pick up as a proxy like webmail.abandoned.tld.
> If they had a basic UBI of, say, $20k, would they quit their job, and not look for work, not work on personal projects, not look to go back to school, nothing, just do what they are assuming others will do, sit around, watch TV, that sort of thing? Rather than keep striving, keep working, and have both an extra $20k being paid to them currently, and that safety net in place in case they lose their job?

Depends on person and their situation.

Would I quit my job and go on UBI if I could?

Me before marriage and a kid: in my line of work and with my hobbies, sure! I'll fulfill my need of doing crazy hobby projects and after few years of doing just that (and social life) I'd probably get bored and get back to work somewhere. Or spin one of my projects into a business. Or start contracting half-time to have some more spending money.

Me now: I'd probably cut down work a bit, but I can use the extra cash to ensure good conditions and financial safety for my kid.

Me if I worked in just about any other field: fuck no, not if I knew the benefits would end. Software industry is special (and still will be for at least a couple of years) - a programmer with decent skills can just find a job or start a company. For every other field, the many years long gap in your CV will scream "not good worker material". Keeping the working history continuous is something on the minds of majority of westerners; failing to do that is likely to result in being hireable only for jobs not much better than the UBI.
Hi, we hear you loud and clear :-)

I've passed along your message to the engineering team.

(Timescale co-founder/CEO)
Why are Analog Devices and Maxim on this list?
In addition to skiing, Switzerland's fantastic public transit gives you a huge array of options. My favourite day for guests is:

- Train to Arth Goldau, optionally visit the zoo there

- Train to Rigi Kulm (literally the top of a mountain, with some beautiful views)

- Cable car or cogwheel railway to a ferry terminal on the Vierwaldstättersee

- Ferry across the Vierwaldstättersee to Luzern

- Train from Luzern back to Zürich HB

If you have a resident buy you a day pass in advance, all of this costs 44 CHF ($44).

There's really a lot to do though. You can do a day trip to pretty much anywhere in Switzerland. I've done it to Geneva a couple of times, also to towns out in the boonies.
> Also, what’s the ethical issue with pirating content that is not for sale?

The ethical issue with piracy is that you can't expect to change behaviors or the laws if you merely circumvent them, and circumvent them without substantial risk of punishment.

Take the Civil Rights movement, for example. They disobeyed unjust laws in protest, but they succeeded in their cause because they were often punished for the disobedience. Being punished is a sine qua non of non-violent protest methods as pioneered by MLK, Ghandi, and Mandela. (Notably, all of whom started out believing in the necessity for violent protest, AFAIU.) If there was never any serious threat of punishment, especially for protesters (as opposed to authorities just letting it slide, and then reintroducing enforcement later) then we might still have many of the laws and norms the Civil Rights movement was working to rescind and change. It's difficult to convince people to change unjust laws; much easier to convince them to change unjust consequences.

In a way it comes back to what Socrates taught: you can't reasonably expect to make effectual changes in the law or politics without subjecting yourself to the consequences. And if you're a citizen, making effectual changes is an obligation.

The self-righteous justification for surreptitiously violating copyright as some sort of protest really bothers me. I'm not going to claim that I haven't ever knowingly violated copyright, and I certainly am not going to defend our overbroad copyright protections, but I'm not going to delude myself about why I'm doing something--purely out of self-interest. Doing something out of self-interest isn't per se unethical, but there is something dissonant when you do it knowing that you're technically violating a law that should be changed, and would be more likely to be changed, if everybody felt the pain, either through strict adherence to the law or open violation and consequent punishment.
I agree with your general sentiment: there’s a lot of powerful features and de-duplication one gets with a single engine to analyze many languages, a-la IDEA.

At the same time, there’s quite a bit of synergy if you go in the other direction, and provide a unified language specific tooling, especially for languages for which it is meaningful to self-host.

It’s sort-of like an expression problem: no matter how you slice it, there’s NxM cells to fill.

Ideally, one should have both. Incidentally, Rust has both :)

It’s also instructive to compare with LLVM: backhands is where all the languages are the same, frontends is where all the languages are different. It’s pretty hard to invent a “frontend IR”, which doesn’t make all the languages feel the same.
*Bigger apps load slowly as well.
Zoe starts at € 38.900 in Italy the 77KWh is € 48.900

You are probably not accounting for VAT

AFAIK self driving as in unattended driving is not big in Europe, given that most of the driving happens in crowded cities and country roads.

Self driving is welcome on highways, but almost any modern car have some kind of auto pilot system that works well enough.

> Traditional car companies have no expertise in software as they themselves admit.

That's simply not true anymore.

All manufacturers are working on it, Honda will release a level 3 at the end of March this year, Tesla is a level 2 (if I am not wrong)

p.s. I am from Italy
I think drug prohibition is the lower-hanging fruit here, but it's certainly important not to overlook the deeper causes. Spiritual malaise, a feeling of disenfranchisement and lack of buy-in to society, poverty, and desperation are all tightly intertwined root causes for so many big problems we face today.
Not really kept up with the latest with this, but chat over IMAP is a thing

https://archive.fosdem.org/2020/schedule/event/coi/
Yeah the human body is exquisitely designed to maintain a salt balance. Sweat, urine, even tears control excretion of excess. Unless your body is compromised, eat all the salt you want.
How do you define academic? Do you mean teaching, research, or the likes of academic IT?

From personal experience, it's relatively easy to move from industry to academia in a support role(1), but hard to get Principal Investigator/tenured prof roles.

(1)as long as one can accept the salary tradeoffs
It would be more interesting if instead of cash on a savings account, these were investments in index funds.

Imagine if every newborn in the US was an investor in the stock market. I wonder what effect this would have on the market and global economy.
Another awesome example:

https://en.wikipedia.org/wiki/Nylon-eating_bacteria
Keep believing demential Joe is the most popular politician in US history, don't question an election that triggered every red flag of a rigged election there is.
I am not defending what the firm did but we are talking about a study that took place in 2017, it has nothing to do with what happened before and certainly doesn't account for all deaths after 2017 either.
At the moment they are nowhere close to being ready for wide deployment or large scale commercial drawing (try to find some videos of modern fibre drawing the speed is absolutely insane).

Obviously the HFT crowd are very interested in these, but they are willing to pay the premiums. Also the next area is probably datacentres where latency is very important as well, and these fibres already provide similar losses to multi-mode fibres at ~900 nm wavelengths.
The link wasn’t even to an article! The link was to the lawsuit itself and I was paraphrasing the first couple of paragraphs of the lawsuit!

Don’t bother addressing them if you don’t like. Call it garbage instead of addressing points. Feel free.

Apparently you also failed to notice that Marin public schools are open with no outbreak either. It’s in the lawsuit.

Apparently evidence that there is no major issue isn’t enough. Only your fear rules.
Google’s PR on this whole thing is a mess. There’s no explanation of how this fits in to their previous ads and videos that threatened to pull search from Australia. And even that was badly explained. I wish they would pick a stance and clearly say what they mean.
If I want (which I don't in general!) Google to serve me location specific results I will just enter the desired location into Google Maps along with the keywords.

No need to be tracked for that all day and possibly get implicated into random crimes because I happened to be near them.

That's an insanely disproportionate cost compared to the effort it spares of having to enter a location into Maps once every few weeks.
What examples do you have of this? I also feel Wikipedia is a success, but I'd like any data points of failures as well.
>what's the concern?

I think the concern is there may not be enough “ambitious” people to maintain productivity to sustain the non-ambitious folks.

Thinking back to a previous job that most people would probably assume employees incredibly driven people, I can honestly say many were not. Hours wasted on long lunches/breakfasts/breaks, surfing the Internet for auctions, bouncing from office to office for hours to gossip, really anything to distract them from the work that needs done, all the while complaining there wasn’t enough time in the day to get it completed. If a “world class” organization is like this I don’t want to know what a “lesser” one is like.

The best employees are always those who value the work itself. I think very few people find their work intrinsically motivating and are only doing it because of an extrinsic reward (status, money, whatever). Unfortunately, after talking to many in that former organization I don’t think they have a very good grasp on what is intrinsically motivating to themselves.
Woody Alan said in a movie "Think about it! All the things our grandparents said were good for us, are bad for us. Sunshine, red meat, college - all the things they said are good for us, are bad for us!"
Photonix Photos – January 2021 Update
For those that don't know yet, Photonix is a self-hosted photo management web app with machine learning image analysis (object detection, style recognition, color identification etc.). I've been working on it for a couple of years now but development pace has really picked up since I hired another developer work with me.

I'm aiming to give monthly progress from now on so this blog post details all the new features that have been added in the last month-and-a-bit. This time we have star ratings, range filtering, text search, performance optimisations, general tagging and more.

Please give it a try if you have time - we have a demo server which makes it very simple. I'd love to hear your thoughts. Thank you for your time, Damian.
I think the article nails it, they seem to be filtering out anything that might offend contemporary leftest values. A lot of the stuff from the 40s would never be produced today i.e. https://www.youtube.com/watch?v=TZkcsIb2l3A or even https://www.youtube.com/watch?v=sAELs42aZt4 but I'd say that censoring it is akin to denying the holocaust -- if you pretend it didn't happen then you don't learn the lesson.

Nobody seems to censor the leprechauns or gangster characters.
Disney seems to get a pass for an inventory of issues https://www.insider.com/moments-themes-in-disney-movies-that... - they would have nothing left if you filtered all their content for modern political correctness. What message does it send when Prince Charming always has to rescue the princess? And so on..
Not yet, we’re aiming for a “testnet” run in a week(ish) and beta by midmonth.
Doesn't that seem like a tautology? I think the metric needs to be "bugs per feature" rather than "bugs per release" - it seems obvious that more changes will be buggier than fewer changes.
https://news.ycombinator.com/formatdoc

"Urls become links, except in the text field of a submission"

Might also be a karma issue.
Australia is to blame for this whole saga.

You can fault Google in a hundred other places, but this is 100% on Murdoch and the Australian gov for forcing Google into a corner where they could not display neutral results.
A Movie Festival for One, on a Tiny Nordic Island
Why does this make you feel indignant? It seems like a very typical three-day conference schedule.
Sorry, that comment about a spark being a problem prompted my comment. I must have misunderstood.
I came here to extol the virtues of the German system. There's a lot more to it:

- It's priced according to income, not health condition

- You will never, ever be refused necessary healthcare, and you'll know it's covered before work begins

- You are not punished for using your insurance, and the premiums won't change

- There is no deductible, except a 5-10€/month co-pay for prescriptions

- Your employer/employment has no impact on your coverage, or the insurer you choose

This is for the public system. The private system is a bit more complicated, but generally, the same rules apply. The only difference is the pricing structure, and the possibility of having a deductible (usually ~1000€/year).

American expats tend to have trauma that affects their insurance choices. My job is to reassure them that our system is completely unlike the American system.

If you want a plain English overview of the system, you can have a look here: https://allaboutberlin.com/guides/german-health-insurance
The article mentions: "The paper also suggests the tool helped pinpoint people who slipped on medication adherence, as well as cases in which a person might benefit from a modified medication regimen."
copypasta from an answer to a similar comment above:

I am not defending what the firm did but we are talking about a study that took place in 2017, it has nothing to do with what happened before and certainly doesn't account for all deaths after 2017 either.
Show HN: I Managed to Automate Posting to My Ghost Blog
I've been a long-time in-browser slack user and yesterday Firefox refused to open any slack link, bookmark, or history entry I had. Closing all my tabs and relaunching FF did not help either.

In a pinch I installed the desktop app, and once I had a little bit of spare time I googled around and figured out the issue. Which was that Slack had used 2GB of Cookies/Site Data and Firefox neglected to notify me of that and that appears to be a hard limit and prevent Slack from loading. Clearing the data resolved the issue.
Gears: A look inside the Final Fantasy VII Engine [pdf]
You might be interested in this conference talk from a few years ago:

https://www.usenix.org/conference/lisa16/conference-program/...
Google had a reader app, in fact the market-dominant reader app. They could sell advertising next to it, like they do with everything else (probably did, I'm not sure). They also owned a publishing platform (Blogger) and an RSS metrics platform (FeedBurner) that had paid tiers. So they actually did monetize it. Just not enough to bother with.

Facebook for a while was trying to be the commenting system for blogs. Which is not exactly RSS, but they were in an adjacent space and using it to drive traffic.

And yet it still died, or rather has slowly faded away back to the niche market that I originally mentioned.
New report on Apple’s VR headset: 8K in each eye, potential $3k price tag
Como saber quem visitou meu perfil no Facebook pelo celular
ALSA already comes (or at least did in the past) with an optional daemon for dmix and dsnoop. Putting as much of what jack and pulse do as possible into libasound (which already handles a lot IIRC), with the minimal amount necessary into a shared daemon, could have allowed all existing ALSA applications to work with the dynamic switching that is now handled by PulseAudio, or the low latency that is now handled by Jackd. ALSA already had a signal graph that could have been evolved into the independent signal graphs that PulseAudio and Jackd can now build.
More details: https://www.mcafee.com/blogs/other-blogs/mcafee-labs/model-h...

And video demo: https://www.youtube.com/watch?v=4uGV_fRj0UA
I'm not seeing any Murdoch rags listed in the article though?
> According to the model, the likelihood of a security defect being identified during code review declines with the increase in the number of directories/files involved in that change.

I think most of us who understand code reviews know about this problem and push back against it.

> Surprisingly, the likelihood of missing a vulnerability during code review increased with a developer’s reviewing experience.

Hold up. I need more information about 'experience'

> reviewer’s coding experience and reviewer’s reviewing experience,

still no criteria...

> Another threat is the measure we take to calculate the developer’s experience. We can interpret the term “experience”in many ways. And in many ways, measuring of experience will be complex. For example, we cannot calculate the amount of contribution of a developer to other projects. Although a different experience measure may produce different results,we believe our interpretation of experience is reasonable as that reflects the amount of familiarity with current project.

Wrong "experience" and still no criteria. If I may proceed from a notion that they mean the same class of experience even though they didn't define either of them until almost the conclusions, experience is here measured as time on Google projects.

New people are trying to establish themselves. Finding a bug is 'counting coup' and raises their status. They also bring in outside notions of good code reviews that may be more diverse or rich than those inside the group.

An 'experienced' reviewer may be suffering from any or all of the following:

* under-training (outside experience/echo chamber)

* over-training (confirmation bias)

* over-extension (too many reviews, competing priorities)

* lack of familiarity

* lack of motivation

* burnout

* hubris
Probably malware using domain fronting techniques for C2 traffic played a role in that decision. E.g. https://threatpost.com/apt29-used-domain-fronting-tor-to-exe...
When I was in middle school they had the food guide pyramid which recommended 13 servings of grain, such as cereal, a day. It was just obviously absurd. I would lol thinking of someone trying to eat 13 bowls of cereal
> The big question in my mind is whether direct air capture is inherently expensive

Have a look at a tree...

I suppose it's possible that billon years of evolution has ended on a local optimum for low energy input (direct sunlight), and we might revolutionize it with high energy (eg: high voltage electricity, fusion etc) - but I doubt it.
We used to manage a remote branch over geo stationary satellite, it was an excersise in pain. We used to check the local weather forecast to see if it was raining before doing any work on the servers. Geo internet is awful, I think you are underestimating how much usability difference there would be between LEO and GEO latencies and bandwidth (because geo bandwidth was awful too)