skysight-inc/HackerNews huggingface dataset:
> The simplicity of the language isn't.

There’s a pretty strong consensus among people who have used Go professionally (irrespective of whether or not they liked the language on balance) that the ability to look at any project and immediately understand it is a Good Thing, and this property follows directly from the language’s simplicity.

That doesn’t mean it outweighs all other criteria—we can say that there is a tradeoff between readability and expressability or something like that—but it absolutely follows that simplicity is a merit.

To boot, some other things that I would prioritize well above any particular type system feature set (at least features in excess of what Go provides) include: ecosystem, reproducible build tooling, general tooling, performance, a solid standard library, friendly community, static compilation by default, easy learning curve. Note that “tooling” must also be simple to be a boon—I don’t want to have to learn a DSL to script my dependencies, wire up test targets, build static artifacts, etc.
The OS and App Store already control the code you download. If the App Store replaces one binary provided by the developer with another that isn’t, it already can. Whether it is signed by the developer or the store doesn’t change that.

Of course whoever controls the OS and app stores can already access all device data. They don’t need to fiddle with the apps to do that.

Who signs what doesn’t change the threat models.
Correction. There was no judgement. The case was settled, which is why they can continue to do so. I was clarified on the same here on HN too.
Reminds me of a Team Fortress 2 griefing video where they kept putting turrets underneath the map that couldn't be killed but could shoot players.

"If they didn't want you to do that then why did they put it in the game?"
Then they will never become mainstream
Because finding exploits is competitive. Many teams do both operations, exploit hunting and malware.
I find the cyber noir nature of this rekt.news to be really delightful
One view of smart contracts is that the code defines the intent/agreement, so if the code allows it, the it is, ipso facto, not theft.

Of course,
I cant wait for that slices package. If I have to write this one more time im going to have a breakdown

func inSlice(needle someType, haystack []someType) bool{}
Everyone seems kind of mad about this. Doesn't Debian do the same thing? The original developer doesn't build and sign Debian packages, the Debian project does that. Now Google does the exact same thing, and the conspiracy theories abound about how the NSA is making them do it or something. Is the NSA also making linux distributions sign packages?
I went to a conference years ago in NYC and was shocked that Etherium didn't have a security story at the application level.
Makes you wonder how many incidents are inside jobs. Probably more than one would assume.
Well, the app I tested — YouTube Vanced — is installed as a bundle, you can see Vanced Manager download its parts. I did check with jadx, that apk is validly signed with v1, v2, and v3 signatures.

Now, as far as my own knowledge of apk signing goes, v1 signature should definitely be fine because it operates on files inside the archive, so naturally merging multiple apks signed with the same certificate would keep it valid. But v2 signs the archive itself, which means merely repacking it would render the signature invalid. I don't have much of an idea about v3. Maybe there's some algorithm to merge multiple apks such that signatures remain valid.

Related question that needs research: how are bundle apps stored after installation? I know that installing a regular apk copies it into /data/app, extracts native libraries from it, and adds its metadata to some XML files I forgot names of. Again, it's been too much time since I did something serious for Android, so I'm not quite up to date on this stuff.

(are you the guy behind Cydia btw?)

edit again: apparently it doesn't back up the additional parts

$ pm path com.vanced.android.youtube
package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/base.apk
package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.arm64_v8a.apk
package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.en.apk
package:/data/app/~~JVhMJHpiRhB5U1ZM1MHNmw==/com.vanced.android.youtube-iqpVMVaXRD4XezgeqdjBHQ==/split_config.ru.apk

The apk I backed up earlier is base.apk, so that mystery is solved. It probably just adds them all to the classpath in runtime like regular JVM does with a bunch of jars.
Relevant article: https://everythreeweekly.com/2019/02/oh-youre-a-comedian-tel...
This makes me think that the next generation may have a new profession of hybrid lawyer-programmers that are engaged to ensure the validity of smart contracts, both negotiating and formally verifying these boilerplate transaction machines. While this was clearly a technical oversight, there are also legal frameworks and traditions that need to be programmed into future contracts. That along with insurance, escrow, title, and other professions will need to evolve with web 3 paradigms.
The difference in the ability to detect it and the fact that if Google Play locks your access to publishing, you can't update the app any more because you don't have the keys.
What do you mean it would "show up in everyones downloads"? Google Play Services are constantly being updated on peoples phones. Literally nothing besides Google's decision not to prevents these updates from containing a backdoor.
I think the question is: Why then deal with all those inefficiencies and cost of distributed computation, mining, and broadcast transactions, if you need courts to override decisions anyway, and insurance to cover yourself when something goes wrong? You can already "automate" without smart contracts.
> The attacker will approach a staff member, claiming that their main account got disabled for some (they may state which) terms of service or community guidelines violation.

The whole scam would have fallen apart if Discord (or Reddit, Twitter, Facebook, ...) would be more transparent with bans: publicly marking profiles as "banned", communicating with groups/subreddits/discords that one of their admins/mods got booted off...

The scam relies on arbitrary bans without explanation and communication by platforms.
> so where does one draw the line between theft and just doing what the code allows?

This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration.

Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.
Yes, a smart contract is not a legally-binding agreement, although it could be a component of a legally-binding agreement. That’s my point.

The smart contract in my hypothetical scenario might be something like a transaction with 3 parties: you (the customer), the construction company, and a third-party verification service, that executes your payment to the construction company when any 2 of the parties agree to execute. This theoretically prevents the possibility of any 1 party defecting and running away with a monetary benefit (including the third party verification service, which couldn’t run away with the cash like a traditional escrow service hypothetically could).

But my point is that even in this case, if the construction company and third-party verification service colluded to run away with the money without completing the work, you would still sue one or both of them, and my prediction is that the courts would treat this essentially identically to a scenario using traditional contracts.
It shows up as a PCI device. And anyone writing a driver would know the standard meaning.
Specific reasons go is more readable than your run of the mill language off the top of my head:

1. Culture of small api surfaces. The number one cause of complexity is having large apis with many arguments and knobs and whistles. Every time you interact with a large api you pay a decision/comprehension tax. Go culls this dramatically.

2. Small api in the language itself. When reading and writing the language itself you do not have to scratch your head at new creative constructs. This is the most commonly cited reason, and it’s a real reason.

3. No inheritance. The lack of immense hierarchies of data structures means it’s dead simple to find out where the implementation for a given function lives.

4. Gofmt

5. Simple error handling. Easy to wrap with all the contextual info you would need to fix a bug.

6. preference for short names. This visually lightens the page when you’re reading code, enhancing clarity.

7. Packages. You always know when code is being imported from somewhere else and precisely where it’s imported from, as you must reference the package every time you reference its code.

8. No constructors.

So no, it’s not a misconception, go actually is very readable and more so than most languages.
It's certainly an impressive story to start work in an entry level position and end your career as an executive. That's something to be proud of. However, I'd bet that a substantial portion of executives have similar stories. Starting at an entry level is pretty common.

As for the rest, it does all seem to be complete lies. He didn't invent the flavor, he didn't come up with the idea based on his Hispanic heritage, he didn't pitch the CEO as a janitor.

If someone is trying to sell you their strategy for amazing success it matters whether they are actually an amazing success or not. It also matters whether they succeeded by using their own strategy or not. His "take ownership" philosophy might be what drove his success at Fritos, but I'd bet it was more of the typical hard work, creativity, luck, and lying.
In what way are Metrocards flimsy?

After living in NYC for six years, it was actually nice to not have a full-sized, extra card just for transit but one that was super slim, flexible and barely takes up any room in a wallet.
Better tell your Jira admin that something is terribly borked with your company's install, then.
Well at least take a look around and see if it's interesting to you. I've been enjoying a playlist of blockchain lectures by Gary Gensler, current chair of the SEC. Lecture 6 is smart contracts with Lawrence Lessig guest speaking. [0]/[1]

I've been avoiding smart contracts since hearing about hacks like these (similar to the Multisig Parity Bug years ago, neglected to initialize, let someone else become the owner and kill the contract) - but I've been educating myself the past week and find that there are really cool things that can be done, maybe cooler a year or 15 in the future when ETH finally gets its fees under control.

As a programmer, you'd probably be interested to see the ethereum virtual machine's "assembly" language [2], I'm pretty impressed with how little code underlies all these ERC20 tokens.

[0] https://ocw.mit.edu/courses/sloan-school-of-management/15-s1...

[1] https://www.youtube.com/watch?v=EH6vE97qIP4&list=PLUl4u3cNGP...

[2] https://docs.soliditylang.org/en/v0.8.4/yul.html
Heh, I read it as "learn datadog today". Which would also be an interesting article, as it took me quite a while to understand how its supposed to work.
Interesting, I have a lot more faith in the alpine team implementing something like this than in RedHat. Even when RedHat made consumer OSes (before spinning them off to Fedora) I didn't like them.

What they're doing looks like a great alternative. I also hope they will not have any reliance on dbus as systemd does. Reliance on dbus is one of the main issues I have with systemd (besides its size and complexity).
Google Play Services is still bound by Android's own security mechanisms, it can't do everything but it can do a lot, yes.
Not every random reader of an article is in its intended audience. The audience the speaker is writing for understands the article fine.
The video (and even more the comments) suggests that there is something shady going on.

But how else would the phone detect that there is a face? It's the same with Siri, Amazon Echo etc constantly listening (you can't hear the trigger word without listening).

The real test if something shady is going on is monitoring the network traffic if any of these data is transmitted to an Apple server.

I suspect the 5s interval picture has to do with figuring out if anyone is looking at the phone and get a better sense of when to turn off the screen.
How would those bugs have been compile errors in Glow? I'm unfamiliar with it, but that sounds interesting.
> This query can’t be represented in Diesel’s DSL (a sample of the DSL is demonstrated in Diesel’s getting started).

I feel like most of the time, SQL DSLs end up being bad. SQL is already a very high level language. There are a ton of examples of how to do stuff with SQL queries. DSLs, even if they have a way to express the SQL, are not nearly as widespread as SQL and then you will have to spend time figuring out how to translate the SQL into the DSL.

In addition, with libraries like sqlx for Rust, you can also get the type safety of a DSL using regular SQL.

I would say that as a developer, the time spent getting familiar with SQL is a good investment that will likely pay off across many projects and programming languages.
Sorry for the typo: correct is of course "Mä[g]dchen".
But the human world is not exact and full of context. Even mathematical.proofs exist within a context of an axiomatic system, known proofs, and various domain assumptions.

I remember that in my computability theory class, defining the right proof was by far the most difficult task. And this was in very small, closed systems.
This is the same thing as the Chinese government forcing everyone to install an HTTPS Certificate Authority (CA) so they can backdoor HTTPS traffic.
Are you saying that the act of observation decreases entropy of the observed system?

Or are you saying that entropy is fully in the "eye of the beholder"? If I observe something and you observe the same thing but longer, you reduce the entropy further (for yourself) than I do?
IIRC the movable type printing press was imported from the continent when printing in England started, and by importing that includes the typesets and staff to operate the printing presses. French printers typesetting English text were not very motivated to establish extra characters.

Random related anecdote: For years the Mormons would distribute their Book of Mormon in German translations but these were printed overseas and they didn't have the 'ß' character, so they used the greek letter β to substitute 'daβ' instead of 'daß', etc. We tend to forget living in the digital publishing age how limiting mechanical workflows can be.
No, they don't maintain the peg at all.
Yes. But they could conceivably already modify Apps at install time or run time, so this is only a new vector for an existing attack.
Holy wat? I had to look it up to make sure you weren't joking, but yes, PowerShell has telemetry [0]. I hadn't ever looked into it when developing on Windows because it hadn't even crossed my mind that that would be something that was done. I think I'd insert "Silently enables telemetry without telling you and with no indication that telemetry can be disabled" just below the mandatory telemetry stage, and would extend the "spyware" description to include it.

[0] https://docs.microsoft.com/en-us/powershell/module/microsoft...
Nothing. It's refuting the GGP (?) who said they were ultra processed unhealthy junk.
College and I came to an agreement. I agreed to leave, they agreed to not kick me out.
The GP's point was precisely that some can use the tool right.
How to Transpose a Matrix In-Place
Ha ha yeah!
I didn't read the article, but I think this is a sizable audience.
It's a rapidly growing, and fun, market. Anyone interested, feel free to contact me about working in this field.
You can very often guess the gender of a word in german using some heuristics. For instance, anything ending in -heit is feminine, and -chen neutral.
I wrote an elaborate analysis os these heuristics (if someone is into this kind of thing) https://mejuto.co/statistical-grammar-guessing-a-german-noun...
Founder offers bounty for names of Apple employees who got Martinez fired
- promnesia: a Memex-like tool to enhance my web browsing experience with more context and connections https://github.com/karlicoss/promnesia#readme

- cachew: library that allows to cache python function calls in an sqlite database with just a single decorator (leveraging on type annotations) https://github.com/karlicoss/cachew#readme

- dron: a friendlier 'frontend' for systemd which allows me to declare jobs as python code living in the same file -- combines best bits of systemd and cron https://github.com/karlicoss/dron#readme. I elaborate a bit more on motivation for it on my blog https://beepb00p.xyz/scheduler.html
Firefox has an option for this in the right-click menu after selecting text (e.g. by double-clicking).
there seem to be edge cases where the bundle isn't extractable back into an apks but despite packaging my apps as bundles and downloading from the play store they still end up as useable apks in the end.

as far as I've gathered bundles are a way of adding multiple ABI's into a smaller shared apk that then is split into per abi by google but I may be entirely off base here
>It's hard to imagine some state law that prohibits a town (or neighborhood for that matter) from building out some kind of internet access.

That seems more like a failure of imagination, since ALEC[0] has been writing bills for state legislators to do just that for many years.

cf. https://www.prwatch.org/news/2014/02/12385/how-alec-helps-bi...

[0] https://en.wikipedia.org/wiki/American_Legislative_Exchange_...
>Portions of the SDK are open source, portions are not. Android also does not have reproducible builds, so you cannot audit that the open source you are viewing relates to the binaries on your phone. Android also widely depends on binary blob firmwares which also cannot be audited.

1. you still need way more parties involved (eg. OEMs, chipset makers), unlike google which probably has acesss 95+% of the non-chinese android phones.

2. backdoors involving the SDK/OS are far less discriminate and therefore has higher risk of detection by third party researchers. (eg. https://www.xda-developers.com/mediatek-su-rootkit-exploit/)
Motivational speakers need some sort of a hook to get people listen to them. "The Janitor who invented Flamin' Hot Cheetos" is a pretty good hook, something that people will click on. "The Plant Worker who Climbed the Corporate Ladder at Frito" would probably get far fewer clicks.

Without that embellishment, he may not have had any success as a motivational speaker.
I remember reading about it and thought it seemed wrong, but presumably the author did his research and knew what he was doing. Oh well. His attitude and the readability of Upstart code were very good, though.

The Upstart design was probably easier to implement. With the systemd design, the dependency tree needs to be traversed bottom up (figure out what needs to be started to start the targeted set of services), then top down (start dependees when dependencies are ready). With Upstart, top down was enough. Or so it seems.
This chart is nice, but you need to include the difficulty of the algorithm (difficulty to attack), the size of the blockchain (hard for anyone except rich people to participate if you need a server farm just to verify a transaction), developer activity, and each coin should have a collapsable subset of “layer-2” options (eg. Lightning and liquid for Bitcoin), and their statistics as well.

Most importantly, A “transaction” on a blockchain is not a “transaction” in the colloquial sense.
You can still listen to Cosby. He is still funny. Just don't dope your dates with quaaludes.
Sorry, but I don't believe you. You said "HN relationship bingo card" and you play Bingo in one sitting, on one day and not across multiple threads. Perhaps it's just a bad analogy.

If you think you're doing well [0] with these kinds of comments, then I'm fine with that :) Have a good one!

> Be kind. Don't be snarky. Have curious conversation; don't cross-examine. Please don't fulminate. Please don't sneer, including at the rest of the community.

[0] https://news.ycombinator.com/newsguidelines.html
The is pretty much the main stated reason for this approach - you'll get a customized bundle for your device which only carries native libs, languages and resources for your current configuration. It's explicitly stated as the main goal for this resigning.

Apple calls this approach "app thinning".

Also remember that Google Play Store could serve whichever APK it liked right now - the signing keys aren't surfaced in UI on Android (or iOS for that matter).
> their initial content should be included in the payload with the initial page load

The problem with that is that it pretty much requires you be running node on the back end too. If your back end is built with say PHP or Ruby, you’d need to call out to a node process, which is potentially a lot of additional complexity, time, and expertise.
Its funny how sometimes 'antiquated' English text uses word order that is so similar to German ('When I Was One-and-Twenty'... etc). Sometimes when I read such stuff, I get the feeling that my English teacher might have marked the sentence as incorrect or 'sounding to German'.
Username queer and branch mistress. Funnest repo I’ve seen for a while!
What a pile of jargon and zero explanation. Shit article.
This still represents a foundational change to the android model, and there are better ways of doing so. The simplest (which requires no changes) of Google to asking you to sign a few dozen different versions of your app for different models. That idea is easy to reject because it would be "too cumbersome" and require re-uploading the same app package repeatedly, but it would work.

There are other models that Google could adopt to allow this functionality. Google could come up with a new app format whereupon there were a signed manifest of files, and Google could selectively leave some out (Git does something very similar: The commit includes a map of filenames to cryptographically-secure object IDs, which may be in one of many different packfiles). This would allow Google to strip the assets that are unnecessary for your device, while still giving the Developer control over what's shipped.

But more importantly: This is about control. Currently there's a nice check-and-balance system. The developer signs the package, and Google inspects and can choose not to distribute it. The new system gives all the control to Google; They sign, they distribute. This may have been effectively where the system was before, because only a sparse minority of users checked the developer keys directly, but there's a big leap between the trust being defacto with Google (because people trust them and don't check), and that trust being completely with Google (because there's no way to check, Google holds all the keys).

I do trust Google to distribute my app. I trust them where I can check their work. I trust them because I can check their work. I know there would be outrage if they started distributing things that were not what I signed. This is that outrage.
This has been my experience. I love the fact that the standard library itself is written in Go, so it's easy to see what exactly is going on and even learn some idioms that way. It's refreshing for me personally as I had a JavaScript background before learning Go
LaTeX doesn't do any of that and the end result is beautiful. It's even better than what human editors produce.