skysight-inc/HackerNews huggingface dataset:
I may be too much of a simple "IT guy" to grok the deep meaning of BeyondCorp. I read thru some of the various papers when they came out and always came back to the thought "Yeah, that's nice if you have the resources to exert control over that much of your technology stack."

I don't have those resources, nor do my Customers. I've got the various mix of Windows, Linux, and embedded devices that the Customer has purchased to serve their business applications. They (and I) don't have the clout or purchasing power to demand application vendors bend to our desires, so I'm left with making the best out of sub-optimal architecture, protocols, etc.

Google says, in the BeyondCorp III paper under the heading "Third-Party Software"[1]:

Third-party software has frequently proved troublesome, as sometimes it can’t present TLS certificates, and sometimes it assumes direct connectivity. In order to support these tools, we developed a solution to automatically establish encrypted point-to-point tunnels (using a TUN device). The software is unaware of the tunnel, and behaves as if it’s directly connected to the server.

So, they just do what I do and throw a VPN at it, albeit a client-to-server VPN serving an individual application rather than a client-to-network VPN like I might.

I do my best to segment the networks at my Customer sites, to use default-deny policies between security zones, to authenticate traffic flows to users and devices where possible, and when unable (because of limitations of client software/devices, usually) restrict access by source address. Within each security zone I try to make a worst-case assumption of an attacker getting complete access to the zone (compromising a host within the zone and getting arbitrary network access, for example) with things like private VLANs and host-based firewalls. I have to declare "bankruptcy" in some security zones (usually where there are embedded devices) where I have to rely only on network segmentation because the devices (or vendors) are too "stupid" to have host-based firewall functionality, authentication, encryption, etc. (These are the devices that fall over and die when they get port-scanned, yet somehow end up in mission-critical roles.)

I think the harsh reality is that, operating at the scale of small to mid-sized companies, IT and infosec are forced into a lot of bad places by vendors who don't care, and management who are focused on the bottom-line and who don't see security as anything other than something to purchase insurance for.

To put it another way: I have to make all this crap work. If I make it too difficult for the end users to work or for the vendors to support I'll be kicked to the curb and they'll find somebody else who will be less "difficult".

[1] https://storage.googleapis.com/pub-tools-public-publication-...
Never let a tragedy go to waste.
[Author of the piece here]

Thanks for the comment.

You do make me wonder if you listened to the whole talk, or read the script (https://docs.google.com/document/d/1wM1-c7euvQaRaCL4hKCaE8VR...)

I specifically addressed and discussed Lisp, Symbolics, & OS/400 (which is still alive and well).

IBM i (as it's now called) seems to more or less treat everything as a single giant disk than as a single memory space, though. However, it's been hard to find solid info for non-IBM-specialists.

It is not at all focussed on GUIs, no. However, I needed something pretty to put on the slides.

The focus is explicitly, as discussed, on end-user general-purpose computers, not servers. Servers are very well-served (pun intended) already.

Yes, I _know_ that this is not all-new. Indeed, that was one of my core points. The reasons are:

[1] I think there is more significance to something obscure or niche that has survived for decades and is still actively maintained and used than almost any flashy new offering which could fizzle out again just as fast.

[2] Using existing tech means that there are people out there with experience in it. It is not all-new for everyone. That's helpful.

[3] I personally am not very interested in GPU tech, and I think the new Apple M1 ARM chips bear out why: the standalone super-powerful GPU with its own RAM is probably a temporary artifact of PC designs and the gaming market.
FYI the “checkout our guide to contributing” link is a 404 to non-existent CONTRIBUTING.md.
Robinhood is specifically targeting young, inexperienced investors as their market. Not having enough information as to how options work, not having an actual line to get support, sending out a flaming email demanding $170,000 erroneously... So many places where this could have been avoided, and should be expected considering the targeted clientele. They had this coming
This case was rather clear-cut, at least under UK law. As per the article the reviewer wrote that the firm was "another scam solicitor". That's not an opinion on the service received, that's a very serious accusation, not least bearing in mind that solicitors are highly regulated, including (obviously) in terms of ethics and honesty.
Descargar a MP3 Plan B Love Descargar 2019 Gratis – Simp3s
Questions like trading experience with different kinds of options, annual income, liquid net worth, total net worth are all pretty standard. Some brokers (not RH) also about about the source of your experience. Actual experience trading options may push you higher on the list than simply being instructed in what options are by an investment professional if you're otherwise on the border between two.

I've been declined for top options levels before because my total net worth was too low even with years of actual options trading experience (including complicated multi-leg strategies).
The Future of Team Leadership Is Multimodal
Software? Mine would be the hardware equivalent. The M1 has slowed Android Studio tremendously.
If you want you can leave a review here: https://www.google.com/maps/place/Summerfield+Browne+Solicit...
Just fork it isn't useful if they believe this is putting people in danger right now.
If retarded is a slur, then so is moron, idiot, imbecile, cretin and other past accepted medical terminology for the cognitively disabled that were adopted by the public as slurs. If you look up the history, "mentally retarded" was itself coined to escape the negative connotations of those previous terms. It's unfortunate but inevitable that referents to the cognitively disabled will continue to be abused, no matter what they are.
I'd be more sympathetic to those who basically want to allow small retail investors to invest in anything they want to if there was really this big class of investments returning outsized risk-adjusted returns that "the little guy" isn't allowed to invest in.

Yes, there are gambles that can give great returns if you're lucky. And may even make sense as part of a diversified portfolio. That's the idea with VC of course. Though VC returns aren't actually that great in general.
I worked with Haskell for a few years and have a book on immutable data structures (Okasaki) in my book shelf here. From what I remember, with immutable data structures strict by default is actually a pretty bad default (please correct me if I remember wrong). I can only imagine this is one of the reasons Haskell is lazy by default (seriously, it's more than just that they wanted to try this crazy thing).

Just enabling strictness everywhere in Haskell isn't just inherently better. Laziness is actually quite good (and the OP even says this to an extent). It's more nuanced than it seems.
The tl;dr of that article: "It's not fair comparing Bitcoin to Visa because you forgot to account for the energy consumption of aircraft carriers in the latter" [1].

These kinds of takes don't help Bitcoin, or cryptocurrency in general. Bitcoin has an energy problem. Trying to hide that fact by demanding comparisons against the entire financial industry instead of just whatever you're trying to compete against for end-users (be it settlement or end-user financial transactions) isn't going to help, because that's even more scale that Bitcoin would have to struggle even harder to reach. And it raises the question of what value you actually get from avoiding the infrastructure (and the resulting economies of scale) that everyone else uses.

[1] Admittedly, that is a bit unfair, since the aircraft carriers aren't mentioned until the very last paragraph. But the article does repeatedly push for comparing against larger and larger segments of the financial system, giving the distinct impression that the author would complain about unfair comparisons should Bitcoin be found to use more energy than anything being compared.
> There are two kinds of pseudophilosophy, one mostly harmless and the other insidious. The first variety is usually found in popular scientific contexts. This is where writers, typically with a background in the natural sciences, walk self-confidently into philosophical territory without realising it, and without conscientious attention to relevant philosophical distinctions and arguments. Often implicit empiricist assumptions in epistemology, metaphysics and the philosophy of language are relied upon as if they were self-evident, and without awareness of the threat that those very assumptions pose to the author’s own reasoning. We can call this phenomenon scientistic pseudophilosophy.

This sounds similar to engineer's syndrome/engineer's disease: https://ask.metafilter.com/297591/Origin-of-the-term-Enginee... (which isn't limited to engineers, IIRC there's an equivalent term that I forget for medical doctors that overconfidently stray outside their area of competence).
Sharing my Home lab build
You need to buy support on a per-account basis and if you're doing something complex enough with AWS you'll end up with multiple accounts for each environment and for security segmentation etc.

They'll give you general information from your account with the support plan but can't investigate any resources or logs without you owning a support plan on the other account and opening a ticket there.

Also, many companies will have this set up on each account and hardly use it. I don't think it's a loss leader.
To take the second part first:

>You need a backup password or similar which kinda defeats the point of having the key.

So the main threat models HSMs address are 1) using keys with online systems without remote attackers being able to compromise those keys (and also potentially increasing the difficulty of performing remote hot attacks too), and 2) making it much harder to attackers in unsecure physical locations to get at original keys as well purely from theft.

Having a backup password that is kept in a safe or the like, or an airgapped system(s) in a secure room/building that all HSMs are loaded from, in no way defeats the point. The point of the token is to be able to then go out into the world and make use of those keys in places which aren't secure and on systems that are online and multiple use and thus vastly easier to compromise. The Yubikey (or any of a range of smartcards or heavier duty HSMs) ideally should mean that obtaining the original private keys at least requires physically finding and breaching the generation location (assuming the keys aren't generated on device and simply manually switched upon device breakage), and that even blackbox usage requires both physically obtaining the token and the PIN or other second factor (more sophisticated HSMs may require multiple person involvement as well). This radically shifts the economic costs for attackers.

>Yubikeys make me nervous, what happens when it breaks? or your house burns down.

If using it for on-key generation, presumably with systems that you have at least intermittent physical access to, then breakage merely means doing a manual shuffle of going around and updating certs with a new key. If that's a fairly infrequent and low probability event, there may be no further need to think about it than that. You had to setup the systems in the first place after all. Alternatively if you have keys stored offline in some manner, it's trivial to setup a new token, or to buy multiple tokens and have them all be the same (with a few kept around in a safe maybe) so that having one get destroyed involves no downtime at all, just scheduling to bring it back up to n+whatever at a future time.
This is probably just personal taste, but I found the Haskell Wikibook [1] the single most useful resource when first coming to the language from a typical OO background.

It keeps things simple and practical, how to solve typical problems, etc, without getting overrun by theory.

Eg, it talks about 2 types of code, normal declarative and the imperative-like 'do' style, when to use them and how you can make them interact. Just accepting and working with that without having to understand monads etc reduces the cognitive load a lot. Once you're comfortable with it, it then goes through the underlying theory. I appreciated that. YMMV

[1] https://en.wikibooks.org/wiki/Haskell
I don't think this framing of the issue is helpful in this case. The people who have installed a custom keyboard likely did so for a tangible benefit, they may not have understood the warning from the phone at installation time or they may have forgotten about the warning entirely. I think it is unreasonable to characterize these phones as "compromised" or these keyboard applications as "malicious". While some keyboard apps are truly out to get people, this isn't the case for all of these applications and they meet a real need (i.e. foreign language keyboards).

As you say, a blanket warning that the customer's phone may be compromised is unhelpful. Warning customers who have a custom keyboard of the risks those keyboards pose (similar to the warning Android displays at custom keyboard install time)[0] could go a long way towards educating customers.

Signal markets itself as a one stop solution to privacy issues. I think it makes sense that they should outline the areas where they cannot, in fact, assure the customer's privacy.

[0]: https://support.swiftkey.com/hc/article_attachments/11501105...
> If you lose a bunch of money investing in a scam startup, you might lose your money and be sad. If you buy a gun, you can use that to kill me and my family.

The negative externalies of investment losses are costs to the public safety net, political distraction and the risk of a public bail out if the losses hit critical voting blocks.
The Under-Utilization of Women’s Talent: Academic Achievement, Future Leadership
It looks more and more like it.

I even wonder now if they don’t have ulterior motives.
You could say the same for any pejorative, imagine if xyz was a treated as a slur, we’d have lost the forest for the trees.

And yes, if you said “don’t be a cripple” to your friend and a guy physical disability overheard it, how do you think that would make them feel? Why would you want to arbitrarily hurt someone, twisting a verbal knife, just to razz your friend.
Possibly, or at least make it very clear to users that they can still be detected.
Just watch out: lots of the low end box providers end up shutting down, and may take your servers and data with it.

I now stick to reputable “value” providers like BuyVM. Having an operator I can discord and get frank answers, as well as a commitment to privacy (Tor exit nodes welcomed), is nice.
"Partial function" is an overloaded term. In this context it means "a function which does not map its entire domain to an output". This means that there are some inputs which return "Bottom", which happily gets propagated through the system until it is needed as input to some function and then your application explodes.

The downside here is that rather than blowing up your application immediately upon a bug it blows up your application somewhere else depending on your logic.

This can be a useful thing. You can write powerful and elegant algorithms that avoid error management because the bottom values never actually get used. But most people aren't doing that and instead these are time bombs.
Agreed. But while BTC consumes a lot, so do hundreds of other kinds of activities that are also by themselves insignificant. The pain of CO2 production should be felt by every consumer proportionally to what they consume.

We need to fix overall energy policy, make everyone pay for their consumption just amount, and keep fixing the damn production to get carbon neutral.
Good thing Bitcoin mining hasn’t been done with GPUs in several years. You can blame cryptocurrency mining for the high GPU prices but not Bitcoin mining.
Deep Dive into Kubernetes Network Policies
With specifications in First Order Logic (TLA+ syntax)
In fairness, yes, you DO have to give the company a chance to address your complaint first.
Fox News asks for Smartmatic suit over election-rigging claims to be dismissed
> So, what it actually comes down to is that they didn’t bother to write tests. There was no time pressure, there was no urgency or requirement, they just couldn’t be bothered to do that prior to release.

Kindly go to the source repository.

> If there’s a note somewhere saying “I know it’s not quite done...” then I’ll let it slide. Have you seen something along those lines?

That's what a TODO file is for. There is one you can browse to here: https://www.sudo.ws/repos/sudo/file/tip/TODO

There is also literally a dozen lines in the LICENSE file saying that the software is not quite production ready (THE SOFTWARE IS PROVIDED "AS IS") and should not be relied upon (THE AUTHOR DISCLAIMS ALL WARRANTIES
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS).

It's all spelled black on white, not sure what you would want more from the author?
You clearly have a pragmatic mind so perhaps you’ll find this of interest. The problem of clarity has been recognized for a while. CS Peirce took a pretty good stab at it with How to Make Our Ideas Clear[1] and even that is a little dense. Partly due to 19th century prose though.

[1] https://wps.prenhall.com/wps/media/objects/5396/5525631/docu...
‘Multiplying’ light could be key to ultra-powerful optical computers
Hi there! Totally agree! We have currently tried google forms, website fb widgets. The feedbacks were usually generic. How do you think we can go about positioning the tech to maximise feedback?
>Aren't partial functions just curried? One or more arguments are bound, but not all?

No; a partial function is one that isn't well-defined for the whole of its domain. So, as per the article, head is a partial function because its type signature of [a] -> a implies that all arrays have a head value. But head [] does not. It's a partial function.
Buying options really isn't a problem. Your losses are capped at your premium if the options expire worthless.

Selling options is where it gets _very_ dicey afaik. It seems like the person in question was selling covered options which is the safer way afaik.

But yeah, you shouldn't be super scared of buying options. Selling options, in my opinion, requires more understanding.
I have a https://github.com/ghc-proposals/ghc-proposals/pull/351 in the works for the stupid partiality issue.

As for the library ones:

1. Rust's std is better now, but will eventually sink to the level of base as ideoms improve because neither language has a good process for making breaking changes to the standard library

2. Rust has the core---std split, which Haskell desperately needs. Vector absolutely should be a separate package, but just the way alloc and hashbrown are separate packages in Rust land.

Trying to work on that too.

Now that Michael Snoyman thinks that exceptions in pure code are bad, and likes Rust, I wish he would think that exceptions in IO code are also bad, and we should use more EitherT like Rust.
But even in ancient Greek culture there was still something akin to homophobia. While err... screwing a guy as a guy was just fine, being screwed by a guy is not. I.E. being the receptive partner as a male was heavily socially stigmatized. It seems this was viewed as being basically being effeminate, and unsurprisingly that was viewed negatively.

It seems to be extremely common over the ages that women acting like men is more accepted than men acting like women. Even during times when women acting like men in some respect was highly taboo, the reverse almost always seems to be viewed as worse. (I.E. back in the days when a woman wearing pants was scandalous, it generally seems like a guy wearing a woman's dress was even more scandalous).

This dislike of men acting like women definitely seems to be one factor in modern homophobia (although it is not the only factor). It also seems to factor a lot into transphobia (which seems to be much more focused on trans women than on trans men). Of course I suspect that transphobia in men is frequently intertwined with homophobia. The idea being the revulsion found in the idea of finding out that the woman you are dating "is really a man" (in the bigot's mind), making them effectively gay.
[Author of the piece here]

Those are not things of central concern to me currently, but another project that has some similar central axioms is looking at just that.

This talk is long but goes into quite a lot of depth. You might enjoy it.

https://www.youtube.com/watch?v=bSNda9EzNOI
Fundamentally, this is just the legal system defending its own reputation by using its monopoly on law.

Basically corruption.
Either fork the code, or fork a new effort that implements the things you want, and then share it with people who also want it.

That these people think it is more viable to co-opt an existing product using organizing pressure for their ends than to build one someone actually wants and share it is indicative of their strategy and attitude. Project leaders need to recognize this tactic coming from afar and then exercise their prerogative to reject meta- and political ploys. Sure, talk to users, get features, but pressure? Treat it like a weed.
> oh no, no, no, we’re not locking this page for censorship and manipulation reasons! We’re locking this page for “integrity“.

Thing is, in this case the can be doing exactly the right and wrong thing for the same reasons. There doesn’t seem to be a win here except to not be a publisher of reviews that will (intentionally) upset unpaying and please your paying customers.

I liked the old internet.
It’s an echo chamber too. On /r/investing people parrot “time in the market beats timing the market”, while this may be true for most, I read a post the other day where someone wrote “I really want to buy the dip but I know that would be childish”. While it may be riskier than the strategy they parrot it’s hardly “childish”.

On /r/personalfinance people say you must payoff a 2% mortgage before you can consider investing. Advice on there is hit or miss because of herd mentality

There’s also entire subs dedicated to illegal activity like sharing pirated content or sourcing scheduled substances, or discussing conspiracy theories or discussing violence, and Apple is ok with this while shutting down other apps like parlor which arguably didn’t do anything different
As someone who uses a phone for a tool, I found this article incredibly arrogant. I actually went for the dumbest smartwatch I could get. It doesn't have a speaker or mic, it doesn't have a touch screen (or even colour for that matter), and you can't install apps on it, but it does show the time, date, notifications from my phone, and physical buttons so you don't fat finger and press everything you weren't meaning to touch. It does exactly what I need, lets me see if the call, email, or message my phone received is important at just a quick glance.

My phone I use for geo-recording points for ArcGIS, reading server status and data in realtime, testing network connections, thermal camera, and more. Not everyone lives in the land of sitting in an office all day and going to meetings, some people physically work for a living.

Good for the person in the article loving their tech, but it's not the future for everyone.