skysight-inc/HackerNews huggingface dataset:
All this code signing stuff is an admission of defeat. "Our OSes are insecure and we can't secure them, so fuck it."

Unix and VMS/NT, the two most popular kernel lineages, were both designed when computers were either isolated or connected to an Internet that was effectively an academic/government walled garden. They absolutely were not designed to deal with the present information war zone where everything is trying to spy/hack/ransomware you and every piece of code is guilty until proven innocent.

Since the Internet went mainstream we've been constantly stuffing wads of chewing gum into their many cracks, adding hack after hack to try to secure that which is not secure. Address layout randomization, pointer authentication hacks, stack canaries, clunky system call whitelisting solutions, trying to shoehorn BPF into a system call filtering role, leaky containers and sandboxes, and so on.

Code signing is an admission that none of those measures have worked.

A secure OS would be built from the ground up with security as a primary concern. It would be written in a safe language like Rust or perhaps even in a system that permits strong proofs of correctness. Every process would run with minimal required permissions. Everything everywhere would be authenticated. The user would have visibility into all this and would be able (if they desired) to control it, or they could rely on sets of sane defaults.

There'd be no need for code signing on such an OS. You could safely run anything and know it would not be able to access things you didn't grant it permission to access. The web JavaScript sandbox is the closest thing we have to that but it's extremely limited. By providing a Turing-complete sandbox that can be generally trusted to run code from anywhere, it does show that such a thing is possible.

(Mobile OSes look like they've kind of done this, but they haven't. They've just stuffed more chewing gum into the cracks in Unix and put a UI on top that hides it. They also "solve" the problem by nerfing everything.)
Ah, so this bill will tax gains from productive activities like investing in and building companies, while exempting gains from rent seeking activities like real estate.

Why am I not surprised?
It's easy to misunderstand this paper. This is not about breaking out of the wasm sandbox. You can't use these vulnerabilities to take over the browser, execute arbitrary code, install malware, etc. This is only about modifying memory inside the sandbox.

By modifying memory you could potentially cause the existing code in a wasm binary to do unexpected and potentially malicious things inside its sandbox. Which can be bad. But no more than that, unless you can chain it with other types of vulnerabilities. And using safe languages for your wasm code helps. The paper also points out that uses of wasm outside the browser, e.g. in node, may not be securely sandboxed.

I hope that wasm people are looking at adding mitigations for some of these attacks. Stack overflow in particular seems like something that can be protected against.
> Define easy?

See the definitions by iFixIt.
I think the best summary of this paper (discussed last year as well [1]) is:

Designers of the WebAssembly spec explicitly chose to scope its goal of a 'secure sandbox' to only include securing the host's memory from the WebAssembly VM. They have succeeded in this goal (modulo implementation deficiencies). However, they left open the question of how a developer might ensure the correctness of their program running in the sandbox. This paper explores the consequences of that original design goal for such a developer, and concludes that all the regular binary exploit mitigations may still be useful for ensuring program correctness.

I made a comment at the time:

> ... Notably, they don't appear to even try to break the WA-host memory barrier, which I actually find to be a validation of the core design goal of WebAssembly: isolate the damage a vulnerable program can inflict to the memory space (and thus also output) of that program. Protect the host from the program, but not the program from itself. Also, maybe don't dump WA output you can't validate directly into DOM.

To which the paper's author replied:

> ... I do agree with you, however, that our findings do not invalidate the overall design of WebAssembly. ... I also think "host security" (which we are not really looking into) is solid, with two qualifications: ...

[1]: https://news.ycombinator.com/item?id=24216764
Stratolaunch flies largest airplane on 2nd test flight
That's more an indictment of the sorry state of C/C++ dependencies and linkage paradigms (shared libs are an antipattern like 90% of the time, imho). If C/C++ had a standard package manager then it would be much more trivial to mix and match with other languages.

Modern package management in a nutshell is "don't do what we do in C because we learned from those mistakes."
It depends on individual preferences. Individuals with a high preference for $ would still go to work, whereas others would play games at home. This could mean higher productivity at work and better customer and employer satisfaction, as people who hate working and hate their jobs and do their jobs poorly, would just play videos games instead.
How do you independently evaluate those costs?
The Deli Is a Weird SPAC
CryptoGravel
I remember traveling from Texas to Florida back in 1997 with my family to go to Disney World. We stayed in motels all the way and I remember the signs out front saying $25 per night.

I never stayed in a motel/hotel since then until 2010 when some friends and I were planning a road trip. Trying to figure a budget, I figured if I paid doubled the rate I was familiar with for a motel ($25), that we could live like kings. So I asked everyone if our daily motel/hotel budget was around $50 per night and got laughed at pretty bad. Then I did some research and was absolutely shocked.
You are right, but then let's make it mandatory for the end user to safely recycle all the components from their devices; they should not be allowed to sale or donate old devices, but have to recycle every piece of it. The purpose? Safe disposal. If you don't want to extend the life of the devices, keep it forever or safely dispose it.
QMK has a sequencer built in. That’s beautifully absurd.
I like offices too, but they are bad in many ways that ought to be acknowledged. To ask those who spend all day writing code to bookend that with an hour long commute each day, because other people enjoy “having a chat” is absurd.
Where do you think the employers get the money from?
I can't overstate how good Elixir + LiveView is, especially for prototyping. I have been experimenting with it ever since it first came out, mostly games, and I have to say that building even simple multiplayer games is a lot of fun.

An example:

https://dev.voppe.it/chess

(FYI there is no actual game here, just pick emojis, place them in the arena and watch them fight to the death via a poorly designed combat system. Yes, those placing emojis other than you are other players.)

This was a prototype that I built to see if real-time multiplayer games were feasible. Apparently LiveView manages high tickrates decently enough to be a valid solution for (quasi) real-time games. This game for example runs at a whopping 8 ticks/s! It can handle more, as I've tried developing with faster tickrates, I think as high as 24 t/s, but I want to avoid server strain. With enough HTML/CSS/SVG wizardry you can get away with quite a lot. But the most amazing thing was the fact that there was no need to fiddle around with state syncing. Everything just works! I have nothing but praise for it.

Try LiveView if you have the chance!
With a sufficiently generous interpretation it might have been a preview build. But then he wouldn't be entitled to complain, because of course a preview might break.

More probably you are right.
Let’s say I make stoves, and I become aware that somebody could maliciously alter the stove to turn it into an IED. Realizing this, I make some changes to make the stove harder to turn into an IED.

Is the argument really, “Are you aware that malicious actors can just go out and buy explosives, so there’s no point in making it difficult to turn a stove into an explosive device?”

Or maybe I make a device for the home. I work hard to secure it against malicious actors. Is anybody going to say, “Don’t bother, most people have insecure light bulbs in their home, so there’s no point securing this WiFi speaker you’re selling?”

I. Think. Not.

It’s always a good idea to reduce the threat area. Security for most people is not a simple binary “secure or not.”

---

Also, what’s with the phrase “domestic abuse activists?” Is that supposed to be some kind of slur? I’m baffled, it adds nothing to your argument, and in fact it hints at some kind of cultural bias on your part, which is irrelevant to the soundness of your reasoning.

All in all, my advice is to drop language like this unless you are specifically trying to make an argument about social activism. Sprinkling arguments with emotional devices like this subtracts from your message, it doesn’t add to it.
Can they actually go after any of these entities? Seems like at this point it's pretty trivial to set up a website which proxies manifest files and injects DRM keys directly...

Good luck, but I'd assume these folks are all in non extradition countries, or have covered their tracks pretty well...
Great tip and way of phrasing it. This is basically what I do, except I cheat a bit by resting my elbows on my arm rest. My wrists hover, or gently graze the wrist rest, but most the pressure is closer to my elbows.
Yeah, my Roku Streaming Stick+ plays everything just fine. The only thing I use Kodi on my Pi for these days is anime with SSA/ASS formatted subtitles since the Roku can only handle SRT format, which means you don't get nice formatting for times when there's one subtitle for dialogue at the same time as a subtitle for a piece of text
Ask HN: How did you transition from FTE to self-employed/sole proprietor?
I would like to transition from my FTE position to a specialized consulting/contracting business that I have been operating for the past several years with annual revenues of $10-12k. Revenues are low because there is not enough time in the day to maintain both FTE and consulting. If you made a transition, how did you do it? I believe I could simply quit and then hold my nose and jump in feet first, expecting a ramp-up time where I draw from savings and hope for a reasonably quick recovery of income. But I suspect there are more strategic options.
Gigabit home internet with static IP is probably my main “luxury” tech spend at 60ish pm.

That plus ~1k once off home server stuff to go with said static IP. Again not strictly speaking necessary so also a luxury item.

And 50pm is sundry vps and domains etc

Edit. Plus Office365 to provide a TB backup storage and office apps for all fam. About 5 bucks pm which is crazy cheap for 6TB high quality storage
How many CEOs and "founders" on LinkedIn list a half-dozen active projects, businesses, and roles (boards, "advisor"), and then blog about the "challenge" of balancing all that with family life, which they still manage to do just fine (the actual secret that cuts to the heart of how they manage that, but which won't make their blog post? None of their jobs demand much time, and they have secretaries and assistants)

Getting bent out of shape when workers do it is just classist bullshit.
What's also hard to understand is that right to repair is not a new concept.

The auto industry has it.

I don't think anyone can argue that the auto industry or its customers have suffered from the fact that we have an entire ecosystem built around 3rd party repair and services that often provide better, quicker, and more easily accessible support and services.
Extended warranty or updates. Past a certain date I should be able to buy future updates for a reasonable fee.

Sounds fair, it takes work to keep software updated.
In this case, by "grass" I mean the combination of which subset of employers pay comparably to google, plus allow unrestricted WFH, plus have similar levels of infrastructure quality (such that your day to day doesn't involve dealing with broken infra or some such), number of meetings, levels of autonomy, etc.

I'm sure that there is a subset of jobs that ticks all those boxes, but what I don't believe is that they're in such abundance that one can simply quit google and stumble into one by simply waving around their xoogler status.

More likely than not, people following through w/ quitting will realize that work satisfaction does not solely depend on a single dimension (WFH-ness)
Blame the Phillips curve ;)
Neil Turok Public Lecture: The Astonishing Simplicity of Everything
You can replace that Honda engine with a different one (at your own risk) if that's what you want. Honda also doesn't force everyone to give them 30 or 15% of engine oil or washer fluid sales.

The only way to install an app on an iPhone is via Apple's store. You can't download it from the dev's website and install it. You also can't use a different app store because Apple doesn't let you. And you also can't buy something on an app (eg: a subscription) without using Apple's payment system or even link to a donation page (why?).

You can have a well integrated product and still give users and developers some freedom.

For example, Android phones usually come with Google's Play Store, which is what the vast majority of users use. It's no different from Apple and the App Store. Then, optionally, you can download the apk (the .dmg or .exe equivalent) from the dev's website and install it. You can also install a different app store, if that's what you want (almost no one does it, but the option is there). Apps are still only allowed to do what the OS let's them do (eg: you still need to give them permission to access your location, camera, etc), so you're only missing the privacy given by the review process. And when it comes to payments, you can use Google's payment system or something else. Not very different from what happens on your computer.

Some people say this is terrible because then Facebook can create their store to bypass Google's rules. In practice, Facebook knows most users won't sideload apps or install a different app store, so they follow Google's rules like everyone else.
720p is still technically HD. SD is 480.
> Marissa Maier had the unfortunate discovery that many of her remote workers were ghost workers.

The key word is "discovery" not "remote." Measure and reward good workers, identify and help (or fire) bad workers. Is physically watching where the bodies are still the best we can do here?
This is the crux of the argument to me - if I own the device, why do some companies act like I am just renting it?
Humans make up just 0.01% of Earth’s life – what’s the rest?
Modern landfills are safe disposal sites. Recycling can be economically incentivized where it makes sense.
Reminiscent of the dot com boom. People said "this internet thing really looks like it's on the up and up" and they were right. What they didn't understand is that investing in 'pets.com' didn't mean they were investing in the internet.

Yes the solar industry could probably go up 100x. No, the companies we're investing in today won't track that.
It is the Secretary's job to (have their department) write regulations. Regulations are the implementation of the specification laid out in law. When the law is ambiguous, regulators have to choose an interpretation.

Congressional paralysis is definitely a problem, but until we have a major change in either Senate rules or political paradigm, we not see any improvement on that front.
It is a problem with teaching. If you are taught to imagine yourself as an OO programmer using an OO language to produce OO designs, you will shoehorn in OO mechanisms even where they fit poorly. C++ has other organizational tools for these cases, so that there is little natural temptation to abuse OO for them.

People coming to C++ from impoverished languages like Java often fail to recognize bad habits they have internalized.
TSMC Builds a $19B Fab
Here’s another angle:

An iPhone 4 with the “last supported OS” is significantly slower than when it had the OS it launched with.

This is true across the board, which leads to this very convenient “they can buy used iPhones, but we don’t want them to use them, so we’ll gently guide them to new devices by making it inconvenient and annoying”

And before someone argues: Yes, much of the slowdown is because of new features, BUT Apple could simply allow users to disable most of them (such as ML-processing photos in the background, or deep-indexing file contents for spotlight. Those are not required for the phone to function as a phone).

If someone wanted to use the iPhone 3GS with the original iOS, not sync to the cloud, replace the battery every couple years, and install a firewall to prevent intrusion via known attack vectors, they could realistically have a perfectly snappy and solid experience in any future decade. Doubly so if they kept a 2.4Ghz AP when the industry is on some unknown future frequency.

However: Apple has taken many steps to prevent exactly that sort of thing, and they will continue to make as many as they can get away with.
Google gave us maps, Gmail, Google, android...

Facebook is probably a net negative for the whole world. If fb would evaporate tomorrow no one would care.
As somebody who has lived in a lot of places that aren't San Francisco, I can tell you that San Francisco is an outlier WRT how much illegal activity "law enforcement" puts up with.
You misunderstood me. The point is it is already happening:

Linux is already so mainstream at work that I've seen a sales guy(!) using Ubuntu.

And I see people sharing screen on Teams and it is Linux!
As in today?
How does this compare to Dokku?[1] I've been using that for a few years now with minimal lift/maintenance. I'm wondering what the trade-offs are of something like this?

[1]: https://dokku.com/
After “upgrading” to Big Sur the first thing I searched for was disabling font smoothing. The default looks ridiculously ugly. I was shocked that they removed the toggle from the system preferences. Apple is all about design and then they double down on something this ugly?
Does that service not require an ongoing data connection with the device? (Cellular service or wifi)

The AirTags use a distributed bluetooth connection I think.
Imagine what kind of person regularly posts on a subreddit about a physical tool that doesn't require much maintanence. Of course it's going to be the people that take it up as a personal hobby that are going to post - that isn't going to give you a representative sample of the average users. I've been using a mechanical keyboard for years now, and I've visited the sub maybe half a dozen times, and yet I enjoy the feel of my keyboards and they'll continue to make a small but significant improvement to my interactions with computers.
There's a Japanese novel on the topic, which has a great English translation: "Shipwrecks" by Akira Yoshimura.

https://www.japantimes.co.jp/culture/1999/06/08/books/the-da...
Probably means a dedicated server not a VPS. Sometimes they’re called root servers cause you have root on the metal. 70 sounds about right for that
Vive la Commune? The working-class insurrection that shook the world
The K360 is a great board. I only wish it had a backlight.
Ask HN: What's your keyboard and what you love and hate about it?
I spent two month looking for a keyboard I would really love, every evening I would watch and read reviews, visit maker sites, browse endlessly Amazon, Aliexpress, Ebay, often until almost morning, it was almost an obsession. Finally I settled on something and now using it for a year, but I was super frustrated by lack of quality keyboards on the market and narrow range of offers in terms of layouts, colors and many other things. Especially membrane keyboards, they are all the same, and not what I like.

So what is your keyboard and what you like and hate about it?
As for me I settled on Keychron K1 because even though it is mechanical it is as close to membrane as possible, super thin and silent. Also it has the IBM M1 but without a numeric layout which I personally prefer.
> 'It's your device, ...

Sadly, while that /should/ be true, I'm not sure that on any practical level it is anymore. There's about a 1000 ways the manufacturer, carrier, os developer, etc., can make your device entirely useless without you having much of any recourse, because while they can't physically take the device from you, they can stop providing you service.
Is this really worth a post? These test launches get scrubbed all the time.
> $37k a year in Texas

Where in Texas? On average for the state, that's only a living wage for a single person with no kids. https://livingwage.mit.edu/states/48
That why I always prefer to share the image, not the imgur link:

https://i.imgur.com/Dwd5Dzg.png - much better!
> farms unwilling to pay a fair wage

Half the blame has to go to consumers and a lack of desire for fair-wage strawberries that cost 2x as much.
> Can't you rule a lot of those candidate (other than CV liars) out algorithmically?

I think all companies do this, but it's really easy to game the metrics. People do it unconsciously, even.

> This seems especially difficult when hiring graduates/junior roles due to the lack of unknowns.

Yep, so it takes hours of interviewing per candidate, across dozens of candidates just to hire to minimise the risk for one role. At a global level, FAANGs are hiring loads, but at a team/local level there's never enough people due to specific team needs or turnover.
It's likely because Apple doesn't want to be in the news when something like this happens. If that had been Apple, that would have been a bunch of news articles rather than an obscure blog post.
Most cell phones are leased already today
> overdue

The margins of 'overdue' are hundreds of years.
We went through this when people first started calling quadcopters "drones".

It's just a term used to describe a server configuration that has different billing/operational characteristics than traditional always-on.

And like the quadcopter-drone, I hope everyone losing their shit over this can either accept "serverless" or submit and market a new term that conveys this difference soon.
FYI, Steve Jobs originally wanted everything on the iPhone to be web apps. He changed course a little later.
America: "Japanese culture is just so weird! ...Here are the top 9 weirdest Japan things!"

I think its become a meme at this point, perpetuated by blogs that lack original content.
Sam Stephenson Quits Basecamp and Related OSS Projects
Agreed, though the same could be argued for credit card payment processors like Visa and Mastercard taking a 2-2.5% cut of every transaction.

Shouldn't they also just be regulated to only accept a fixed amount instead? I'm genuinely curious why this example isn't brought up more often and is just assumed to be the norm.

The irony in this % discussion is that Apple tried to use the same rationale against Qualcomm in their radio modem feud - Qualcomm wanted to charge a % on device price for using their radio modems whereas Apple pushed for a fixed amount. I'm sure AWS would love to bill % of revenue but perhaps due to competition, they can't do that.
This is possibly the best post in this thread
FYI, this post about weaponized abuse reports is being downvoted/flagged. It very quickly disappeared from the front page of HN.

And I'm well aware it's against guidelines to even comment about this on HN, but it's directly relevant to the content of the post and the health of HN as a whole.
The trend for lack of reparability in smartphones is because of consumer preferences. Consumers are consistently choosing devices that are smaller, lighter, higher durability, waterproof, cheaper etc. vs. devices that are more repairable that do not have those features.
Yeah I think the play is to work for FANG for 1-2 years and then skedaddle really no reason to stay not like they're going to promote anyone to something meaningful unless you are truly a superstar.