skysight-inc/HackerNews huggingface dataset:
Their staff says they have pushed out a fix:

https://www.reddit.com/r/backblaze/comments/madqug/backblaze...

I looked at my network requests and I no longer see the googletagmanager requests being made (which I think calls the FB pixel code).
This seems to be a known technology. Here's a paper: "THREE-DIMENSIONAL SIMULATION OF A VALVELESS PUMP" J. Shin and H.J.Sung", Kaist (2010) [1] It's not quite the same, though. Rather than using turbulence, it uses an impedance mismatch as an obstacle to flow. The idea is to have two impedance mismatches in opposite directions from the pinch point, but at different distances. You get some reflection from each impedance mismatch. So if you choose the right driving frequency, you get the reflections opposing movement in one direction and helping it in the other.

This is a lot like the way some antennas are driven. RF also has impedance mismatches. But not turbulence. (Fortunately, or RF engineering would be really hard.)

[1] flow.kaist.ac.kr/bbs/download2.php?bo_table=pro_domestic&wr_id=93&no=0
Not even sending an advertising id (or anything else) to a Facebook url when I visit a public non-Facebook page is ok. This is unbelievably far from ok.
> Also, what would you use to monitor user behavior to improve your product if third party tracking is frowned upon?

* user testing, user interviews

* (there's probably a fancy word for this) generate usage metrics from production data. If the product is e.g. a To Do app, you could measure "engagement" by counting how many To Do items each user has created

* first-party tracking – analyze access logs, self-hosted analytics
Not all of the various silos within evilCorp structure knows what the others are doing, if even the groups within the same silos know what is going on.
Can you fix all your security processes too? And make tech drive tech decisions not let marketing define security? Thanks.
As long as they don't have the car keys, they can go knock themselves out.

Re: the more substantive legal points - there are off-the-shelf solutions (CMPs, for example) and easy checklists for complying in the setting of a static public-facing website. The web designers and brand managers I've worked with are more than capable of meeting clear industry standards.

It's inside a web app, where customer data is on the page and in JS scopes, where the product team is essential in safeguarding customer data.
Geohot hops into the briar patch with Corey and Dixon
Exactly! OP could barely disguise the company shilling, I'm hardly going to trust his opinion on whether or not another startup CEO was a fraud or not.
Same boat here, rsync too pricy for me, though I used them in some startups (as CTO) and service was excellent from people who know what they do.
"Brazil" where? It's huge :)
in figure 4 there is a comparison between San Francisco, Los Angeles and 22 nations...

I'm italian, born and lived in Bari and now in Milan, and I assure you that the color of the sky is really different between the two cities (~800km apart each other)
Yes, but as the link states, they primarily focused on controlling the penal regiments.

And that's one example, from one particular culture.

Executions for desertion are very rare in western culture armies. Not that western culture armies couldn't be cruel. Field Punishment No. 1 is culturally engrained in my country: https://nzhistory.govt.nz/media/photo/field-punishment-no-1

That said, you seem to be implying that all armies ever have relied on force to recruit and retain members, which rings hollow.

If simply because my step-father, an Englishman touring the world, happily volunteered to fight the North Vietnamese as part of the RNZA, as did many others, all of NZ's troops in that war were volunteers. No conscription at the barrel of a gun.

Hell, during WW1 and WW2, people were faking their age to join up.

Reality is a lot more nuanced than you're making out.

I mean, we're social animals, for millennia we've lived or died by the group.
I agree with you 100%.
I’m baffled by this mentality but I guess it explains a lot. At which point are you concerned about what other services or even the company is doing? That’s a real slippery slope for me.
Other commonly classified neurodivergent diagnoses are ADHD and OCD (which along with ASD commonly overlap). They don’t have much overlap with personality disorders (which do have a lot of overlap among that category).
Collecting is fine, buying is fine - as long as the goal is not bragging. The problem is bragging.
>Every process, system, and best practice should be designed around helping people optimize for that 4 hours of really great work.

That's an accurate figure IMO. I have tried every which way to keep the quality and intensity up after the four-hour 'great work' mark, but I can't do it, and I think most people can't do it. There's some kind of daily mileage allowance we get, and most of us are running on fumes after 4 hours, it seems.
I love me some Emacs and the aspect of not having one's data rolled up into some inscrutable proprietary binary is certainly appealing.

However, are there viable open-source programs to specifically meet this need (i.e. the daily operations of a small business)? I've seen a lot of startups around this (e.g. ipads at a lot of checkouts now for small businesses), but is there anything that allows the business to not have their data beholden to some 3rd party?
Maybe this is the case, but when we start judging what constitutes unnecessary usage of power, we get in the business of telling people what they can and cannot do with hardware they own. Last I checked, the HN crowd really doesn't like that kind of thing.
Toxic means dangerous.
We have to stop feeding the trolls. I think someone like Stallman probably made the choice to resign "for the good of the FSF". He probably reasoned, like so many people in this situation, that staying on would be detrimental to the goals of the organization at this point, and he cares more about free software than he does about personally leading it. I think that's admirable, but I think it's wrong-headed.

It may be true in a narrow sense that caving was what was best for the FSF in that moment, but it was bad for the larger world of free software, because of the precedent that it set. It was bad because it fed the trolls. These mobs feed on success. When they see themselves getting people fired, that is incredibly energizing, and that energy points only in one direction: more. Who are we going to cancel today? The trolls are hungry.

Internet communities have been dealing with trolls for decades now, and it is actually a fairly well understood problem. The only way to kill the trolls is to starve them. Don't engage with them, and most of all, do not cave to them. When they see that their tactics aren't working anymore, they'll stop doing it. Unfortunately that may mean a temporary rough period for your organization, if you are the victim of something like this, but it will pass, and it will probably pass more quickly and with less harm than you think.

Now, to be clear, I am not suggesting that organizations ignore serious abuse. If something is reported and your board actually believes a real transgression occurred, it should absolutely be dealt with. But I don't believe that's what happened in the Stallman case. I don't believe for one second that the FSF board wanted him to resign. I think they felt they had no choice, due to mob pressure. And that's the situation in which I implore people to resist. Do not give in to mob pressure that you don't agree with.
I am not saying that all art is like this. But I am saying that a large part of the fine arts world is like this.
This relies on inertia so probably not.
Honestly, I think the GNU software is a little like "giving a man a fish"

Meanwhile, the GPL License is more "teaching a man to fish", and I think the software written and protected by this license has grown, both in importance and coverage.

Lots of people are "getting it" as we clearly see how "our" phones and computers are really not living up to their promise.
Lawfirms often utilize automatic content-derived filenames, up to the maximum OS-supported limit. As a result you'll find all sorts of private information in the filenames within their backups.
What’s more traumatizing is the knowledge that so many people are willing to just throw the elderly under the bus because hey, they are going to die soon anyway. “I gotta eat my Olive Garden, so someone’s granny needs to die 10 years too soon from a preventable illness.”
I only listen to podcasts that are well-produced and edited. Very few actually are. There are way too many people who think podcasting is just turning on a microphone and babbling away with a friend or guest for however long they can do it.

I only have a few hours a day I can spend on podcasts and I'm not going to waste it listening to some inane meandering chitchat.

"Put it on the background then" ...yea, that's when FOMO hits. What if I miss the good part? You know, the one thing that they said in the description they talk about, but can't keep on subject and keep getting sidetracked.

This is why most podcasts I listen to are from the BBC or NPR, they've got one subject for the episode, it has a clear narrative through-line and the actually get to a point. Exceptions to the rule being 20kHz (audio production professionals) and 99 Percent Invisible.
In my country, pretty well.

Obviously it'll depend on your actual implementation.
The market economy I live in, where you imagine we spend our time worrying about our next meal, has fostered the largest cohort of morbidly obese people in the history of our species. And I am utterly incapable of imagining anything less in need of defense than criticism of capitalism.
Who's box is this anyway? Establishing asset ownership in vuln reporting
There is still so much science to do with simple systems. Even if fundamental physics gets solved, there will be plenty of new discoveries to make.
Please stop. You are using the modern “inexcusable” accusation that only serves as a tool to shut others' mouths and bend them to submission to authority (“Communist”, “Jew”, or “enemy of the people”).

See also: https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
As a neurodivergent person, intent is the most frequent source of conflict for me. Where I mean well but say the wrong thing almost always sits at the bottom of the well of what goes wrong between me and my people I care about. Intent isn’t enough. Listening, caring, and having intuition for what people need is a much larger task than abstract care and empathy.
That was my first thought but there are so many potential pitfalls & problems.

What about learning disabled, disadvantaged, just having no access or poor school/lack of opportunity etc.

And what if you fail!? we can't deny the right to vote because you can't pass a test. That's what we did to black Americans.

though to be honest I'm the type that judge people who don't vote. I get mad when people say 'but it doesn't do anything' but they don't vote!!!

I think it should be mandatory it's the least you can do for our country. You don't have to vote for anyone can always write sponge bob or black it out as an F you to the system. Or better yet, work to elect people & pass measures that change the system!
I'm a long term B2 customer and left FB a long time ago and block trackers.

The major point to me is: If marketing at Backblaze drives decisions that influence security and tech has either no say in this or is not competent enough, it's not a company for me to trust my data with.
All they say is they don't learn anything new about your customers. I would take that statement with a lot of caution. For one, they should know that I am a bb customer now. Having a graph of all the companies and products I use is huge PI.

> They claim it is hashed before use so they never see the raw data

If they can match hash data with real data, they can know more than they did before. Depending on what algorithm they use for hashing (no mention of it), they could be using a similarity hash so that will minimize changes if there are minor differences in the dataset.

Let's say I find a profile through comparing hash of email to email in Facebook's database. I can then compare additional information to see if a customer has provided incorrect information to Facebook as a user. Facebook could check if my address is similar to online shopping sites I use and if not, flag the account.
Now you're inventing more personality for Mr X. He doesn't like Microsoft and doesn't hide it. He thinks Santa Claus is for children and doesn't hide it. He's not the problem here.
In a static website, where there are standard tools and checklists and web designers to walk them through it, marketing's lack of technical understanding is less of an issue. And in a B2B web app like Backblaze's and my own, the data exposed to the public web site is just not all that sensitive.

And I'm not talking as a prospective employee who "just wants to be a cog in the machine"; I'm talking as a founder and CTO who sets company goals. I'm worried about data leaks caused by poor implementation and short-sightedness, not those caused by company policy that I disagree with. If I disagree with company policy, I change it.
This is a good illustration of why a general strike would be the most impactful form of protest. The government relies on the work of these citizens every single day to maintain power.
At least some of the tests were with water, so, yes?
Thanks for participating in this thread. As a longtime paying customer, I consider this a monumental security breach and I will be leaving the service. It’s clear that Backblaze have prioritized growth hacking or whatever over the security and privacy of me as a paying customer, and that your security processes are woefully inadequate.
It matters a lot.

Like I said, it's definitely a problem regardless.

But this is like saying it that if you misplace your cell phone, it doesn't matter whether you left it in your friend's car or a taxi. Of course it matters whether or not data is being (mis)used.
Yes, messages keep piling up and memory usage keeps increasing until the Erlang VM goes out of memory.

To debug, there's a max_heap_size parameter which can be configured to log an error message when heap size of any process goes beyond a threshold, or it can even kill the process[0]. Although I don't know if this takes the "off-heap" messages into account.

Also, there are lots of libraries which can provide a "top" like view of the running system.

[0] - http://erlang.2086793.n4.nabble.com/Max-heap-size-td4716974....
The thing that concerns me about the FB Pixel (and GTM) is that the host is completely free to do anything and everything to the page. Even if they don't do anything "evil" today, tomorrow is a different story completely. This scares the pants off of me and makes me want to rip out any "tracking" that I've ever installed on any site anywhere. Actually, that's probably not a bad idea.

Are there no browser level protections for this type of thing? I thought CORS was supposed to prevent these activities from happening.
Some have suggested that, but I never minded general takes on a given language when the thread is about a specific feature. I think the majority would be with me on this, maybe not, but he did receive upvotes again. There are few enough language version release threads that there's nowhere else for people to share their opinions, for me it's appropriate.
Hi, author of the article here. Back in the 80s most assemblers and disassemblers were abbreviated with "Ass" or "Disass" and I'm pretty sure there was more than one pun intended for that naming scheme. As for the "booty" pic, I honestly didn't think about it as I just loved the show (Parks and Recreation), where Amy Poehler plays a strong and feminist lead role. Having said that I do agree with what you said and I do think it is extremely important to not even imply anything that could hurt somebody's feelings. Except for mom jokes. Mom jokes are still allowed. I have removed the repo name from the title and replaced the gif with a different one. Thank you for your comment :)
> It doesn't require complete agreement - it does require same level of agreement and cooperation that allows us to have common language, common culture, common laws, Open Source projects, charities, etc....

> Yes, there will always be those who do not abide for the societal convention for one reason or another.

I mean, as far as I can tell, the "societal convention" you're advocating for doesn't exist as such, so you lack even the minimal "some level of agreement" that your tactic requires.
I honestly don't know where the power is better spent. There are quite a few industries I personally find superfluous in the world according to my personal set of values. Ironically for this context, I consider bitcoin to be among them.

But I also don't think judging the industry on power consumption is particularly fruitful, unless we want to look industry-by-industry and weigh utility vs energy, which we do not do. We do this for blockchain because calculating this is easy. We don't even have these numbers for, say, the stock market, so we don't even know how good or bad that is. We can't answer the first questions that arise from this kind of analysis.
What kind of failures lead to such critical data leak getting released?

Who thought that Facebook tracking should be forced on paying customers?
Wouldn't it be nice if OpenAI were like .. actually open? :P
This may well be true, but it wasn't the centerpiece of his cancellation. And if it is true, it hasn't been publicly articulated in any coherent way, as far as I can tell. I'm not saying that it isn't the case, it's well known that RMS can be abrasive. But if he was actually forced out for that reason, it seems like someone familiar with it should have written that up in some way.

I've seen a few off-hand accusations that he made women uncomfortable in non-specific ways. I can certainly believe that might be true, and may indicate some greater transgression lurking behind the scenes. But to my knowledge nobody has actually said what that is.
Governments should just close the loopholes.

In some cases, the loopholes people talk about are less loopholes and more the intentional way the law works. Those in particular are the govs fault.
Agreed.

I've spent a lifetime learning a rulebook by trial and error that everyone else just seems to know.

It's absolutely maddening then the rules suddenly change for no discernible reason, often with little warning and grave consequences with no second chances for screwing it up.
I don't necessarily disagree with you, and whether a pixel should be there at all is definitely a discussion in itself.

But for those who are implementing FB Pixels, I wanted to put out some potentially useful information that can help protect against unintended data disclosure, after mentioning the auto-listener behavior in a reply to another comment and being met with surprise[1].

[1] https://news.ycombinator.com/item?id=26537078
Not a lawyer.

I was surprised that it was possible to prosecute faking admissions to colleges as a crime, but apparently you can.

https://en.wikipedia.org/wiki/2019_college_admissions_briber...

This would seem to be similar. Perhaps it can be prosecuted.
That's one of the things I was looking into too actually. Though if I want to go with Minio, I would also want to do that on my own physical servers instead of cloud to completely cut out third parties. Do you have experience in that? I guess I would need a proper dedicated high speed internet for it too for any decent traffic?
I’m a marketer, can’t argue with the above.
ÆHN – A hackable, dark Hacker News user stylesheet
This is a controversial opinion, but I believe someone who turns any space he's in into an unsafe place for women should not be leading the FSF. No matter who or their accomplishments. I never saw him being kicked out as unfounded, there were years and years of people being solicited sexually even after explicit non-consent by this man. He just seems to be unwilling to be professional towards women.
Why I would believe what FB publishes?

FB used 2FA phone numbers for spying, after repeatedly promising that they will be not used in this way.

See also FB promises about WhatsApp during merger.

Is there a truly independent confirmation?
Java done wrong? I've always been a Java/C# person, that's the general programming abstraction layer I've spent most of my education and career in and prefer it. I greatly prefer C# (and all that comes with it) over Java. But if C# didn't exist, I would probably prefer Java over all other alternatives. The only reason I'd fall onto Javascript upon C#'s disappearance would be because most of my experience is in web, but definitely not due to the ecosystem or language. So from a language/ecosystem perspective, Java is my 2nd choice, I never hated Java, it's popular for good reasons.
Thanks. However, it is just not excusable and a breach of trust. The Backblaze Twitter communication making pretty clear that they don't see a problem with tracking paying customers. We are moving somewhere else.
Yes, a 100% this.

Even better if you can get the interviewee to record audio on their computer too, this way you can get proper audio without compression issues for editing.

Doesn't work for "video podcasts" because sound sync is a bitch, but for audio only it can enhance the quality immensely.
I built ÆHN, an easily customizable user stylesheet for Hacker News. I built this to scratch my own itch. The stylesheet has the following features:

- It's dark, meaning my eyes won't burn when I switch to the HN tab in my browser

- It removes the elements I never use so I don't have to hunt the HN UI for a way to unhide a comment I accidentally hid

- It makes the header sticky so I don't have to scroll back to top when I want to navigate somewhere else

- It provides comment indentation guides so I don't have to guess if a comment is a top level comment or a reply

The stylesheet is hosted on GitHub: https://github.com/Kimitri/aehn
When I say sound card I’m talking about an “audio interface” which is indeed digitally connected via usb or similar (see focusrite, zoom, tascam, behringer for lower cost interfaces) and provides a balanced TRS output for a powered monitor.

Also have a look at “class compliant” audio interfaces. I haven't needed drivers in the better part of a decade, and most interfaces now are even compatible with iOS using a camera connection kit.