skysight-inc/HackerNews huggingface dataset:
I'm sorry, but this just doesn't work in the real-world.

As the "security guy", you're seen as the troll under the bridge. Someone to get past via any means necessary, including lying.

But lets say you get your way.

"making sure you have all your ports locked down"

You can't imagine how much work this actually is on a network with 1,000+ servers running at least 10,000 distinct pieces of software. Most of which don't document their firewall requirements.

Oh, did you know that Active Directory domain controllers -- the single most valuable attack targets -- require essentially all ports open to all computers on the network?

What is your firewall going to do when all modern software communication is over HTTPS and "looks the same"?

How are you going to firewall off just one modern server with 200 Gbps Ethernet? Do you have any idea how much you'd have to spend with CheckPoint or Juniper or Cisco or whomever to do that?

"limit connectivity between all instances to only the bare minimum"

That lasts right up to the point that the shouty guy in finance that talks directly to the CxOs wants PowerBI on his desktop to be able to pull in data directly from all the databases. Did I say desktop? I meant a laptop on unencrypted airport WiFi.

"any public access is via protocols such as ssh which have zero-to-none vulnerabilities"

You don't get to choose the software. Windows doesn't use SSH for anything, and can't be made to.

Also, if you know anything about ransomware attacks, you would know that protocol encryption does nothing to even slow them down. If anything, it makes detecting attacks harder!

"routinely run employee training on how not to let themselves get hacked via social engineering"

Meet Mr Bell's Curve, and its unavoidable left hand side. Some people are just incorrigibly stupid and will routinely fall for phishing attacks, no matter how much training they receive. At any large corporation -- the type worth ransoming -- these people are inevitable. You, Mr Security Person, don't work in HR and don't make hiring and firing decisions.

"I'm sure I'm missing other stuff"

You're missing the fundamentals of the problem, which is that as a security guy:

- You must come up with security solutions that work in the face of morons.

- You must be able to secure software written by morons with no interest in, or ability to write secure code.

- You must do this without impacting the business in any material way, because if you stand in the way of anyone more senior than you -- even once -- you'll never be listened to again.

"Or are hackers so creative that even following these basic rules will still not make you a hard target?"

Currently, for any large org above about 1K staff, security against targetted attacks is basically impossible. Certainly not financially viable. Your competition will not spend the money, make more profit, pay out the ransom, and come out ahead of you.
Sending payloads reliably into orbit is incredibly difficult. Not sure if I missed some glaring joke/sarcasm here
ThinkPad?
Required reading for anyone who thinks otherwise:

https://elonmusk.today/
It's proprietary, but is built around open source tools. Can still use native TF and OPA. I'm using the free version and it gets the job done.
The large amount of comments of people playing this game imply "fun".
What's been interesting to me is that during tech interviews, we eagerly have applicants roll their own sorting, or searching, or caching. But you never have questions about crypto or auth. Why one and not the other? Are both not critical to get right?

And then I'm reminded of the bug that was hidden in plain sight for 20 years in Programming Pearls[1] in their implementation of a binary search. This same algorithm was copied in Java and elsewhere, near verbatim. So, yeah, maybe don't roll your own searching either. The experts have enough difficulty.

Frankly, I don't trust most programmers to get anything right. People toss around "battle-tested" libraries and we all just take it for granted that that's what they are. But I recently found out one incredibly popular package for one incredibly popular language is doing something fairly dumb. Not insecure (that I can tell). Just simply unnecessary. They are signing session cookies. For reasons I could not fathom. Signing doesn't prevent cookie theft. It's just another layer that someone thought would add security over just sending a random string (hopefully your system/language's random generator is actually random). And that's how a lot of these mistakes happen. Let's add sha512 on top of our crypto. Because more = better, right?

Speaking of random, there was another popular package out there for generating UUIDs that has a github issue where someone discovered the package was generating collisions. Yikes.

[1] https://ai.googleblog.com/2006/06/extra-extra-read-all-about...
I often wonder why startup devs earn such high salaries if apparently they outsource everything, and are very opinionated about it, and have the quotes from business gurus to support those opinions.
Why would you include pulling the container image as something that should be a part of the container launch time? It’s a one time event after a code push.
I think availability of diverse content is important. You need varying views of every situation and often times there is a bias that originates or caters to the country of origin.

American cinema is pretty bad about this too, almost every American movie based on a historical event or military engagement paints America in a favorable light and completely omits the efforts and cooperation of our allies.

If you only watched American entertainment you would come out of it thinking they are the only country fighting for the world.
Without Musk would that same group of people accomplished those things?
Because Microsoft products aren't "cool" (and some come with all kinds of EULAs that FOSS doesn't). Personally, I would never even consider running a Windows server.
What gives you this conviction? Have you considered how many processes and materials producing a power cable involves on Earth?
This is my first thought!
>Proof of stake lets players with the most money have the most say.

Okay, and what do you think the mining equipment is acquired with exactly?
It wasn't a case of no spam; but rather predictable spam.

After a while you'd start to recognize the Web rings. The "just link" pages became extremely obvious after a while, and you could generally reliably get the same results regardless of where you searched from or what you were doing when the time came to search. You had far fewer syndication mills, and you could even find resources reliably.

The net was a reasonably navigable thing even to children doing school research. Nowadays, I have to explain to kids all the myriad pitfalls that exist nowadays, when they look up something, ho back a bit later, and can't find their resource anymore.

And that's just the bloody legit stuff. When you talk malware, we're in a completely different world nowadays.
I don't really think this is true. I'm an American and most of my Youtube channels I'm subscribed are from foreign countries, and this isn't something I've actively tried and do.
If becoming billionaire and being elected president of the USA is "not accomplishing anything", then I'll start hoping I won't accomplish anything in my life.
SEC does regulate stocks of companies like Tesla whose dealings in Bitcoin could affect said stock price.
This extensive reddit post [0] was interesting, by a high risk biocontainment virus Phd person, documenting the reasons he was sure covid-19 was not created by, or accidentally released from, the Wuhan lab [0].

Question #4 in the table of contents for this reddit post directly addresses the accidental release scenario talked about in the article. He summarized his answer as follows:

- The WIV, and Dr. Zhengli-Li Shi’s lab group, are extremely well-respected in the virology community. As well respected as many US scientists.

- All the WIV’s sampling of bats and the genomes that they find in bats are publicly available information. Why isn’t SARS-CoV-2 on any of those lists? We would know.

- Dr. Shi's group also sends parallel samples to other labs. Why wouldn't those labs have had SARS-CoV-2 if Shi's lab had it? Because they didn't

- This doesn’t look anything like any laboratory accident that we’ve seen before.

- The evidence we have points to Patient Zero being nowhere near the City of Wuhan.

There's a lot of detail and follow-up conversation. It's the best source of info I've seen so far on questions around the Wuhan lab.

[0] https://www.reddit.com/r/science/comments/gk6y95/covid19_did...
According to URLProtocolView[1] the handlers are still registered despite the application (and MANY others) being uninstalled.

[1] https://www.nirsoft.net/utils/url_protocol_view.html
Well, not exactly, GTM makes it easy to slather your site (as much or little of it as you want) with 3rd party js / 1px image tracking pixels. Mostly I see it as a low-code tool to allow the dev team to wash their hands of having to add those manually, but it is certainly possible to hardcode the tags into your templates instead (but then it's a much bigger headache to add and remove them willy-nilly). For tracking your conversions etc. you will often see Google Analytics on a site (and it, in turn, may be installed on the site via GTM... turtles all the way).
This might be a particularly sensitive topic for Canadians right now as there's a lot of extremely negative culture leak up from the states including anti-mask/vax protestors that repeat conservative US talking points. It's extremely common to see people toting "Masks are against the 1st Amendment" up here so I imagine a fair amount of the pedantry you're perceiving here is actually just misdirected frustration over false information spreading through fringe groups we have to deal with.
> How does anyone justify these obscure tokens and coins being worth billions.

You might be misinterpreting market cap of coins.

Simple example:

- I create a new crypto called CRY

- I create 1 million CRY coins

- I have converted zero CRY coins to USD

- I sell 1 CRY coin for $1

- The market cap for all coins is now $1M
I'm in a pretty small niche (agtech), which I think definitely helps me standout from other devs.
Whose the target audience for fly?

I’m trying to understand the market they’re operating in. Big ol enterprises would probably want to run on AWS/GCP right? So would startups? What’s the long game? Genuine question.
In 50 years I hope to find out it was pulled off by the infrastructure teams who have been arguing for more security all along and that they did some good with the money.
> So many languages have matured battle-tested OS libraries for handling the especially sensitive parts like crypto.

We use CSPRNG/SHA256/SHA512/AES/3DES/RSA primitives in .NET without any trouble. Microsoft made it pretty difficult to fuck things up as long as you don't sprinkle Math.Random in with your session token logic like a jackass.
I think the incentives are all wrong, how about the teachers just work for free?
> As a serial entrePAYneur

I don’t follow

> core foundational member of multiple payments companies

If you’re building a payments company, your product is literally doing the payments yourself!

> with each better than the last,

So, the first ones weren’t very good huh? Perhaps you could have outsourced them?

> Security will become paramount to everything and outsourcing for "cheap" will have a much greater cost than one realizes in the moment.

You’re conflating the use of a 3rd party for cost reduction with using a 3rd party due to efficacy and efficiency due to specialization. There’s zero chance you’re as good at Auth as a whole team of security engineers at an auth provider, period.
> Make more / better content that is worth watching

Or how about sovereign nations push back against the tidal wave of simplistic US cultural propaganda and limit it?
I love my PocketCHIP - but I wouldn't go with that form factor again - or at the very least, not with the type of physical keyboard they included. It was very unwieldy and generally not fun to use, I always connected an external keyboard.

The game controls were also garbage with that type of input sensor. It would have benefited greatly from a better keyboard, or a gamepad and doing away with the keyboard entirely.

Glad to see it coming back though!
That was also the situation in the late-90s when I was listening to the radio all day in Toronto. I would argue that it actually hurt the development of the Canadian music scene in many respects because it made everything so top heavy. You were either the Hip, BNL, or OLP or you weren't on the radio. A select few bands reaped all of the benefits. Ironically, these bands would have found success without the MAPL system, but with it they were incredibly over-exposed in Canadian markets. The scene was also quite stagnant because even a "New Rock" station like the Edge would play the same set of Canadian songs for years at a time.
You are the ultimate check on that. If the compensation package makes the startup not attractive compared to staying put, you should stay put.

It’s up to the startup to put the offer to you, but up to you whether to take it.
Makes sense. On the other hand, WCF was hands down one of the best and reliable frameworks out there. And if no startups are using Microsoft, how do they plan to survive in the future? Eventually enterprises will evolve as well, so they probably need to become "cool" again.
Agree. The govt need not provide the teams as they must compete for talent like anyone else and don't have much to spare.

The govt only has a relative abundance of talent [largely interspersed with its contractors] in highly regulated activites like making nuclear weapons, where private entities don't participate.
Do you have any references to back up these claims?
It's a private enterprise, not the government

Nobody wants your support, they just need crazy enough wealthy people
surprised that sense of entitlement is not listed. some people think that dishonesty can rectify a perceived wrong of imbalance
Many thanks. Updated!
> My understanding is that you ended up writing java code to extend keycloak. Is that wrong?

Depends what you mean by "extend". For many operations, there are REST APIs, e.g. to create a realm (somewhat equivalent to a tenant in the SaaS world - though see below), it's simply POST /auth/admin/realms. There are also more elaborate extensions such as login listeners that if I remember correctly, you would build in Java, but we don't need those.

> Is keycloak resource hungry or have I heard wrong? Have you tried keycloak X? Is that better?

We haven't found it to be disproportionally resource hungry at all. I'm sure there are scenarios we haven't exercised but resource usage not a problem for us. Not fond of the way vendors throw around allegations like that without hard facts.

> Is there a way to configure a dev environment? Is Terraform the preferred IaC solution?

Depends on your own preferences, we just bring it up in a docker container.

> How many realms do you use typically?

Everyone will skin this cat differently, but for us (SaaS):

- one big realm that most tenants use.

- one admin realm for trusted internal access (i.e. our support team).

- one big realm that candidates use (we are an HR platform)

- one realm per tenant that needs SSO. e.g. if they want to authorise login using their own GSuite account, they get their own realm with their own idp.

As someone else pointed out, having large numbers of realms is a weak point of Keycloak. I look forward to us having enough SSO clients that that becomes a problem for us :)
It's not illegal to sell a security after disclosing that you own that security.

I don't even have to point to any specific laws, just look at all the websites that talk about stocks operating without any SEC intervention.
Wow, I remember that one! :)
Salesforce went down the other day, our Salesforce based customer portal was down. So was the case management system customers use to lodge issues.
Ask HN: [Non-ISP] WiFi Router
Looking to get my household off the ISP [Verizon] WiFi router and onto something different. I'm not very much into networking, so looking for something that works out of the box and with good defaults. Thanks!
Decentralized consensus based authorization backed by the blockchain, instead of relying on some central authority to verify and enforce the validity of the contract?

At least, afaik that's the concept behind ethereum's "Smart Contracts"
FYI I tried to understand this comment and failed. It being one big sentence is probably part of the reason.
Bees and hoverflies gobble fake pollen, benefiting both insect and plant
> If you’re an Advent of Code kind of person and you haven’t already written a parser for this format, you’re probably starting to feel a twitch in your left eyelid. Go ahead and write the parser; it’ll take you 15 minutes and the world can’t have too many implementations of this exposition format. There's a lesson about virality among programmers buried in here somewhere.

Huh? Who gets excited about writing a parser?

What was wrong with "${key} ${value}" on separate lines?
Also Chrome on Linux. For me it says it detected 11 apps installed, but I don't have any of those apps installed. Strange.

Edit: With firefox it is able to correctly detect 3 installed desktop applications.
Your highly important specialist machine is probably remotely exploitable for as much damage as replacement cost if it also needs a web browser and an internet connection.

Also a browser that is years behind current has a trail of breadcrumbs in terms of fixed bugs for newer versions. It is probably nearly as bad as the built-in option.
There is ForgeRock and WSO2 which we have used in the past. Perhaps they have moved on but would not recommend vs Keycloak.
Hardware Store CEO: We're Rebranding (Satire)
If you get a big surprise bill, email me and we'll fix it. We're not interested in surprising people with bills.
Pretty much. Insurance industry can be helpful here. They can develop audits and make requirements same as they do for worker safety procedures.
Such humor is rare, usually put out to pasture. But this joke is well done. Hopefully it ages well.
Good question! There are a few things. First, you can’t make a table that doesn’t have specifically typed vertical columns, which means a bunch of layouts just aren’t possible (you can kind of fake it with all text columns, but it gets messy. You also can’t hide the column headers.

You’re forced to have a name column, and your table has to have a title (you can make the title a space but that feels like a hack).

There’s just lots of chrome. Even if you lock the table, you still have the lock icon and the new row button that will never go away.

These things may all seem minor, but they really do make tables not look or feel “simple”.

To be clear, I’m absolutely fine with the existing tables for certain purposes, and I don’t want them changed… I just wish there was a “Simple Table” block type as well.
>However it is my understanding that paying ransoms to save human lives is technically illegal to

You are wrong.
beyond the fact that farming & industry use most of our water in CA, shouldn't greywater/runoff recapture+storage (instead of using fresh water) help with water usage? and because it's a hobby, there is little wasted opportunity cost, in either land or labor.

and though it's unlikely to make any difference in the farming calculus, south LA is underserved by fresh grocery, so this seems a nice little intersection of empowerment and quality of life improvement in regards to that problem.
did he know that though? I'm not exactly ready to call Musk a smart person.
For not taking the effort to secure such important infrastructure, despite bringing in huge profits.

They have both the duty and the means to have first rate IT staff providing excellent tested back-ups as well as security.
The author says exactly that at the end of the article:

Its tempting to go “woah I just figured out how SpaceX lands their rockets!!”, but sadly, that’s not really true.

Once you have generated a physically possible trajectory that gets you where you want to go, there’s a whole host of things that you need to do to actually go follow that trajectory: state estimation, closed loop feedback control, dynamically updating that trajectory based on real time conditions… and many more that someone who is an actual aerospace engineer (which I am not) would know. Beyond that, these solvers take a long time to run, and online (real time) optimization is incredibly hard to pull off correctly and safely: one wrong input and your solver could just spit back “fail”, causing the thing to fall out of the sky.
How is this fair at all? It's not fair to consumers whose prevailing choices are regulatorily subverted. It's not fair to media producers who are now penalized for not being Canadian, nor is it fair for media platforms who now have to invent some special process for Canadian users. By what definition is it fair to force foreigners to fund your own nationalist political goals? Why should anyone care that the current Canadian government supposedly can't even muster enough democratic support to enact and maintain a lasting budget item to sponsor its own agenda?