skysight-inc/HackerNews huggingface dataset:
Even if you aren't running official debs or RPMs, you're still quite a bit above running a build script off the web. A deb or RPM will include a manifest with checksums, which you can at a minimum use to confirm whether some post-isntall script or process changes an included file (such as removing or cleaning a malicious script that was included). In the case of RPM (at least, I'm not implying debs don't do this, just that I'm not as familiar with them) you can actually query any pre/post install scripts that were shipped with it as well:

# rpm -q --scripts bash
postinstall scriptlet (using <lua>):
nl = '\n'
sh = '/bin/sh'..nl
bash = '/bin/bash'..nl
f = io.open('/etc/shells', 'a+')
if f then
local shells = nl..f:read('*all')..nl
if not shells:find(nl..sh) then f:write(sh) end
if not shells:find(nl..bash) then f:write(bash) end
f:close()
end
postuninstall scriptlet (using <lua>):
-- Run it only if we are uninstalling
if arg[2] == "0"
then
t={}
for line in io.lines("/etc/shells")
do
if line ~= "/bin/bash" and line ~= "/bin/sh"
then
table.insert(t,line)
end
end

f = io.open("/etc/shells", "w+")
for n,line in pairs(t)
do
f:write(line.."\n")
end
f:close()
end

Even a downloaded package that's not signed is far more auditable after the fact than executing arbitrary commands from a remote source.
That's interesting. I'll look at it. Thanks.
"It is important to note, however, that causality cannot be inferred from our study design."
If you accept that the law is ambiguous and that the current Secretary of Labor is effectively making law by choosing an interpretation, you must also accept that the existing regulatory structure also derives from a choice made by a previous Secretary of Labor who effectively made law by so doing so.

Your argument does not provide any basis for preferring one interpretation over another.
It's a lot easier to have few deaths for the flu, when nobody tests for the flu...and hospitals get paid $13k for every confirmed Sars patient. Duh...
I doubt that pre-diabetes caused my craving because I always loved sweets. As a kid I would sometimes eat raw sugar.

I was only diagnosed pre-diabetic (fasting glucose > 100) the last year before I blossomed into a full-blown diabetic.

My parents were pretty strict about sweets, but once I was on my own my diet quickly spiraled into an orgy of chocolate & sugar.
Gig working started with Uber as an extension of cab driving. Cab drivers do not get 401k and health insurance. So it makes no sense at all that gig working would only exist because companies didn't want to pay benefits. Your pizza delivery guy wasn't getting benefits either. Neither your waiter, or bartender.

However, Uber and other companies did start right after the dot-com recession, when people needed to both save money, and make extra money. It turns out a lot of people needed to do both. Sure, there were advantages over the previous incumbents (cabs suck), but that's not why there are so many drivers.

Ask your Uber or Lyft drivers sometime how often they work. Many of them, since the early years, told me they work as many hours as they can, for as many companies as they can, just to make ends meet. Of course they're paying for their car and all that themselves, too, so it's not like they're getting ahead. And they definitely would rather not be driving for 14 hours a day.

These companies exploit people in an unequal system in order to make profits.
The article mentioned that the blog itself is hosted on a replit, so I guess that's one example.

This seems like it would be great for rapid prototyping.
I think folks are missing a big part of their role: executive protection.

Accenture presents a deck that suits their client, which is generally executive. If the plan works, the executive (or team, or business group — the paradigm works at multiple levels) looks like a winner because they brought in the right people who aligned with their vision blah blah.

If the plan tanks, point fingers at Accenture and get away with it. I've seen it in action, and it works.
> I don't understand why you're blaming these platforms for teams having bad interviewing practices.

Never said that I did. I said they were the worst thing to happen to tech, and elaborated that it's because of their overuse and abuse in hiring. Many good things start with good intentions and are abused.
I lol-ed and also like your frank answer. well done.
Clustergam: Visualisation of Cluster Analysis
I guess I would follow that up by saying development of festishes is not the same thing as base sexual orientation.

I also don't think this would be easy to study at all. Furries might be a good candidate population to study.
In other words, a normal teenager. Exercise helps. So does writing (pen and paper best IMO). Edit: I don't mean to belittle. Best wishes,
If you're using Godot, there's Ink integration, but if you want VN- or character interaction-focused features you can also consider Dialogic[1] if you want a tool with a UI integrated into the Godot Editor.

[1] https://github.com/coppolaemilio/dialogic

12-minute tutorial: https://www.youtube.com/watch?v=sYjgDIgD7AY
I think the problem is that the drivers are "inside" the kernel. Many of the dubious commits are there:

> For those 42 patches, the reasoning behind the revert varies from one to the next. In some cases, the patches apply to old and presumably unused drivers and nobody can be bothered to properly review them.
If you are defined as an employee (under the current standard) it has do to with a number of factors, so if you are giving up all those factors to the employer but not receiving the employee benefits it by definition is against everyone's interest.

Basically imagine you have Job A all things being equal you can have the Job A and all the benefits of being an employee or you can have Job A and none of the benefits of being an employee. How is it possible it is in anyone's interest to take Job A and not receive the benefits they are legally entitled to?
I'm relatively familiar with .Net (been using it since late 2001), that said, it's changed dramatically, more so in the past 3 years than nearly a decade before that. The changes between Framework 4.x to Core 1, 2, 3 have been somewhat dramatic and painful trying to keep one application current (that needed portability, including rpi). Hopefully the move to .Net 5 will be less painful.

I'm mostly playing devils advocate as it's not been a smooth transition and the best way to do many things has changed since some things are in the box, that didn't used to be, but still rough around some edges.

Many libraries and patters for web api projects are a bit different, better but different.
I know category theory is popular in CS-land but over in math land it falls squarely in the "general nonsense" bucket for most working mathematicians.

E.g. most mathematicians learn the definitions of categories and the Yoneda Lemma perhaps as a chapter in some other text -- say a text on more modern algebraic geometry -- and that's about it.

The thing to understand is that mathematicians have jobs to do like everyone else -- they are not philosophers sitting in contemplation, but eager beavers trying to answer specific questions and solve open problems. So they are interested in picking up the tools that will help them solve unsolved problems more than picking up the tools that will help repackage the research of others. And the main feature of category theory is its ability to repackage the discoveries of others, rather than necessarily driving new research.

That's not to say that occasionally category theory can't be useful, but just not that many people are going to be working in those research fields where they find anything beyond the chapter's worth of Yoneda lemma plus some of the diagram formalism to be useful, and everyone's time and attention span is limited to what will help them make discoveries in their field.

Rarely is the answer to the question of how to solve some problem in differential geometry, pdes, number theory, symplectic geometry, combinatorics etc, -- "more category theory". The same is true for formal logic. Most people learn the incompleteness theorems and maybe even some things on computability, but they do not use formal logic to advance their research agenda, even though in theory proofs can be encoded in formal systems and so in some sense, these formal systems are a unifying framework to view mathematical proofs.

On the other hand, there have been some spectacular breakthroughs with physics/string theory, so a lot of people were trying to brush up on that. But here, too, progress is quite difficult, and most people aren't going to go out of their way to invest too much time in it beyond a summer school or so.
Would you mind providing a source for your assertions?
(2010)

But it's about Mozilla Thunderbird (email client,) which is cool because one doesn't hear much about Thunderbird any more.
Of course it falls into the category of social support system, but what the specific design choices are matter in terms of driving behavior.

If I (salaried) take a sick day, I get paid the same amount from the same source; there’s next-to-no economic incentive for me to risk the health of others by working when sick: problem is solved.

We could more or less force the same by law for scheduled hourly workers. It’s a little more difficult for gig. It’s basically impossible (as I see it) to put self-employed people at the same outcome as if they worked without substantial risks of under-comping some and over-comping others.
If you want to make vegan cheese that actually tastes like cheese, the best approach is going to be to use something like Perfect Day's milk, which synthesizes milk proteins using some sort of genetic engineering or other. This could, in the long-term, enable better cheese production than present techniques, since cheesemakers have greater control over the chemical composition of their dairy.

That said, I think there's potential for plant-based cheese-like products to be delicious in their own right, without trying to perfectly mimic existing cheese products. I don't think the techniques are there yet, but that's to be expected, conventional cheesemaking has been honed by millennia of experience.

As an appreciator of fine cheeses, I'm excited to try the delicious creations of food scientists working with cheese cultures and plant-derived materials. Unfortunately, the vegan cheeses on supermarket shelves are not aiming at the fine cheese market, and instead trying to compete with dirt-cheap sliced/shredded cheese, and that's not what interests me.
Hitchin moduli space, Mirror symmetry, and Geometric Langlands Conjecture
That just wrecked my ability to say the name of a prominent 15th century Italian dance master.

https://en.wikipedia.org/wiki/Guglielmo_Ebreo_da_Pesaro
How high do you want? I’ve been sketching out an idea for a monitor stand that could be adapted for this. Would be made from plywood, press fit together and flat packable.
Web browsers no longer offer key pinning because it's both a foot gun and subject to ransom attacks.

So what that means if, maybe the person in charge of the web site "cleverly" enables key pinning, then loses the keys, you fire them for incompetence but too bad your site is now unreachable for a long period, hope it wasn't important. But worse, maybe everybody you employ is smart or careful or both, but unfortunately bad guys break in, and they set up key pinning, then deliberately remove the keys. Now your site is unreachable... unless you pay them a ransom for the keys.

For non-browsers (e.g. a phone app) pinning is still very much possible, and I would say judging from what we see on community.letsencrypt.org that it does indeed function as a footgun - e.g. we had an outfit that does industrial IoT stuff and their things all believed they needed to see certificates from Let's Encrypt X3, which is a shame because X3 was retired in favour of R3 and so those things just broke until a human could reach them to perform a manual firmware update.

A DNS record to indicate which CAs may issue for a DNS name exists today, it's called CAA, and you are welcome to go set it up. However, CAA is about preventing a different issue than the one your parent was ranting about. CAA tells a trustworthy CA that you don't want them issuing, for example because their processes aren't suitable. But it does not prevent them from doing so, it would be a misissuance (policy forbids, they did anyway, that's a policy violation), but it wouldn't be impossible and is deliberately not detected by software like web browsers.

Let me give two examples, one where CAA fixes it and one where it's not applicable at all

1. [Yes this really happened] Facebook has a deal with a CA where Facebook pays them money and they have a bespoke process to issue certificates which includes ensuring the Facebook security team is happy. However, Facebook did not set CAA, and so when a contractor who didn't know any better just created a new web server something.something.fb.com and asked Let's Encrypt for a certificate, they got one. Facebook freaked out. Setting CAA would have prevented this, Let's Encrypt would say "Cannot issue, prohibited by CAA for fb.com" and the contractor asks his contact at FB, who then checks with security first and they either say "No" or get a certificate from their preferred CA. Today Facebook sets CAA.

2. Someone buys a domain example.com, and they're annoyed that the previous owner has a valid certificate for example.com which is still valid, from Entrust. So, they blacklist Entrust in CAA. This has no effect on that existing certificate, it only means the new owner can't get new certificates for that name from Entrust. The correct fix they should have done was to show Entrust that they, as the new owner, want this certificate revoked, in most cases that's just a matter of sending an email and doing what the reply says although the details vary by CA.
Well, the flu only used to kill like 34k people a year in the US. Covid killed over 10 times more, in a population where a significant portion of it was doing social isolation, wearing masks, etc. So yes, maybe you can call flu a pandemic, but don't compare it to Covid after everything the world as seen in the past year.
"Fifty-six subjects were recruited (32 CD and 24 NCD). One participant from the CD group was excluded due to imaging artifacts, rendering a final sample of 31 CD and 24 NCD."

Feels too small of a sample size to make any strong conclusions
> Now you have code that may or may not be buggy

Doesn't your solution of replacing the possibly buggy code with configuration leave you with configuration that may or may not be buggy?
Can someone translate this to lay terms?
I’d bet that anyone decrying imitation meat - or, at least, anyone who generally likes real meat decrying imitation meat - hasn’t had good imitation meat.

If you’ve never tried an Impossible burger, it’s an order of magnitude better than anything that came before. It’s a good burger. It does taste and feel like meat. It doesn’t taste like something that’s trying to be something it’s not.

Quorn I’d also put in the “doesn’t taste like something that’s trying to be something it’s not” category. It’s been around for a long time, but has been curiously unsuccessful in the US. Amazon Fresh sells it. The ground variety makes a good chili. The nuggets are a reasonable facsimile of white meat chicken nuggets.

Quorn’s no Impossible burger though. What Impossible has accomplished really is astounding.
Encryption is a bit different debate with different tradeoffs. With encryption, the government can try to use different encryption than everyone else, and many sectors of industry don't rely on encryption. But vulnerabilities on common software apply to everyone; there's pretty much the same pieces of software and electronics (e.g. mobile phones) used by every country, by civilians and businesses and governments alike.
I find twitter and Facebook very good ways to identify the family and friends with narcissistic tendencies, they're always showing how good things are.
Tina GraphQL Gateway: Query Markdown Content Using GraphQL
FPGA Pin Finder
The project goal is identify some missing pins from the Storey Peak Stratix V FPGA board, but can be used widely with other recycled FPGA boards!

The concept is very easy: build an FPGA image that periodically send a UART string with the respective pin name, in a way that a probe attached to a USB/serial converter can read the pin in the PCB and help map the end points to the respective FPGA pins!
More importantly is it possible to infect others with the vaccine?
Thnk you, yes, levels of abstraction is precisely what I'm being tedious about. These are very generous explanations and I respect your time on this, please ignore if I veer into a cranky Gish gallop.

This distinction between a bidirectional path in a graph vs. a functor between objects is a great clarification, and I can begin to comprehend how I would be confusing the representative directional arrow in a graph with the logical operation of mapping in CT is different - because I'm treating them both as just morphisms between objects.

The universality of CT implied a conjecture to me where, either there are theorems of CT that cannot be expressed as graphs, or there are graph theorems that cannot be expressed in CT.

"Expressed," is handwavy, but because we're on the edge of notation/encoding and representation vs. whether there a homology between graphs and categories, when I get into the question of a universal modelling languege, it raises the question of what the minimum necessary set of instructions to express theorems in that language (either CT or graphs), and whether the smallest program that can express CT will resolve to a graph.

If the Kolmolgorov complexity of the program that produces theorems in CT is greater than the one which produces theorems for graphs, and that program itself reduces to a graph, it implies to me that the less complex program is the more universal modelling language.

This was why in terms of modelling I thought that CT seemed more like an ornamented subset of graph theory. However, that's like if someone said math is a just subset of Godel numbering, which well, yes, but that's not very helpful. :)
Coffee is the best drink ever, but how do we get it to taste as good as it smells?
I used to pay for it back when it was printed and came in the mail.
Is This the Oldest Bottle of American Whiskey?
Hi, author here! tptacek is right on the money. The authority server is really small and simple, and writing it in Go meant we had access to our existing internal packages that had the logic to fetch the data we need for each DNS query. This seemed like the most straight-forward path.
It's their highest y/y growth in a decade, second highest since 2000, and fifth highest overall.

Top y/y Q1 growth (according to numbers from op):

1998: 443.8%
1999: 237.9%
2000: 95.2%
2010: 44.9%
2021: 43.7%
2018: 42.9%
2011: 39.4%

Median overall is %29

That's a pretty good year, especially considering growth usually gets harder as you grow.
The big difference is that config files are, at some point after interpolation and templating, static data structures composed of primitive data types.

Further, these configs usually act as declarative languages, giving directives to pipelines, controllers, etc., typically with idempotent side-effects.

This is just good software engineering. You have some static data structure which describes some result you want to exist in the world, and your pipeline/program makes that outcome manifest. This is the essence of boundary programming/hexagonal architecture.

https://www.destroyallsoftware.com/talks/boundaries
Reading this feels a bit unfortunate, I was looking forward to making a post on next week's 'Who's Hiring May 2021' thread having finished their data science curriculum recently then polishing up my resume & personal site over the weekend. Going through a fully remote bootcamp backed by YC seemed like an excellent fit to be done in 6 months right around when second wave covid was about to hit, having been doing Advent of Code & Hackerrank challenges in Python for the better part of a year and was excited at the opportunity to formalize in-demand skills combining data analysis and programming.

While I think Lambda is doing a fairly decent job with the curriculum on the data science side (having been condensed from 9 -> 6 months); the job market has doubled down on being competitive through hard skills while the school has doubled down on training students in soft skills, and isn't providing enough resources to upskill before reaching the ceiling of becoming a mid-level software engineer within a few years of landing their first job. Some of the curriculum especially unit 3 felt like a chore where I had a lot of trouble with how quickly material was being crammed in, with almost no regard to ensure understanding of the previous day's. The forced mentor/mentee relationships and track teams also felt like I'd gotten zero value-add from, and Lambda continues to have the pitfall of no student accountability whilst passing forward multiple students who didn't contribute a single line of code to our build week projects that will need to be fully redone if showing them off as portfolio pieces.

This lack of being thorough and due diligence coupled with seeing recent posts in the #hired channel receive lower salary offers seems to have confirmed that not enough is being done to address the skills gap between college grads and the lousy reputation bootcamp grads have been getting as of lately. Having maxed out the amount I'm able to borrow in student loans & exceeding the max number of credits taken during my time at university to be eligible for a degree, a non-traditional education approach like Lambda really appealed to me and I wish the staff and school the best of success going forwards. Hopefully the Amazon partnership will be a stepping stone for big tech to tell Lambda and the broader hiring market what they want from junior developers in an ever-tightening labor market. The CS and labs units felt like an excellent experience and the students in our labs project have been valuable to work directly with on a real-world software engineering application.

Disclosure: I have no contractual agreements with an ISA.
Let them play video games! By exiting the labour market, they force employers to pay more for the people actually willing to work. This is the main idea behind UBI: instead of forcing people to work undesirable jobs just to feed themselves and then forcing employers to pay a minimum wage for those jobs, we feed people directly and let the market decide how much to pay for those shitty jobs.
Yes, PIR.
I think that they're pretty directly related, though maybe that's because I associate the smell with the resultant feeling of being caffeinated. However, I do recall smelling coffee brewing that both did not smell good and then did not taste good either.
At GitLab we take the 'Release notes' section of each issue and use it to automatically generate the release post. For an example of a release post see https://about.gitlab.com/releases/2021/04/22/gitlab-13-11-re...
Can you elaborate on what exactly do you mean by " software should be expected to provide some basic level of protection." ?

In some sense security is binary - if your software happens to have even a single mistake that results in RCE or authentication failure, then it's totally exploitable and does not provide any level of protection whatsoever. And as experience shows, we seem unable to write any software without such mistakes, even if we try really, really hard by skilled people with security in mind, as far as I recall every popular piece of software that needed to be secure has had vulnerabilities.
Professor Berates Student for Calling Police ‘Heroes’