skysight-inc/HackerNews huggingface dataset:
On average, I believe most users benefit from an automated check for updates. It should be possible to disable it, but we should first worry about keeping users safe.

They should still ask first, at first run. I actually enable update checks for a lot of things, if I'm given the option up front. I'll submit crash reports and even periodic telemetry if I know that the crash reporting system doesn't download and run arbitrary code, shows me everything that will be submitted, and allows me to omit needlessly identifying details (e.g. custom kernel strings).

Some projects (KDE) make it really hard to submit crash reports, by requiring an account, etc. It must be optional, it must be easy, and it must be transparent. Then users will volunteer crash reports and stats. Respect breeds respect.
> and companies that address IT liability by getting a bunch of forms filled out that don't have anything to do with information security won't be secure.

So glad to not be at that job anymore , this is 100% the approach my previous employer took ( who had 99 out of the fortune 100 companies as customers ).
They're banned, probably due to submitting crackpot links.
> which /maybe/ causes student quality to drop.

Not maybe. Absolutely. Even paid-for online courses have a relatively high drop out rate.

But that's okay. It's the price to pay to achieve the volume needed to pay for great instruction. I can take a music theory class from an instructor who would never waste their time teaching someone like me. Even though I may not get much more than entertainment value from it. I'm effectively subsidizing the students who do learn something concrete from the course.

There might be an argument to be made that pandering to an "edutainment" crowd might reduce the quality of instruction, but a good instructor should be able to find the right balance.
The end result was that increasing the size of our thumbnail images raised our performance score by reducing our LCP score.
This works great, until some nation state adversary wants to shut down the entire US infrastructure. Or even better some script kiddy decides that it would be fun to feel powerful

And they won't care about if companies pay ransome or not.

Treat the cause of the sickness, not the symptoms.
The author links to one example at the top of the article ("CVE-2017-18188: opentmpfiles root privilege escalation via recursive chown"):
http://michael.orlitzky.com/cves/cve-2017-18188.xhtml

Apparently a user can create a hardlink to a sensitive root-owned file (like /etc/shadow) in a user-writable directory where they know a privileged process (in this case tmpfiles.d) will come along and chown it to the user, after which that user will own the sensitive file too.
Something like Wengen in Switzerland is probably about as close as you get to something like this: https://en.wikipedia.org/wiki/Wengen

But obviously a mountain resort town has to be somewhere that outsiders want to vacation in and everyone who lives there is either in or supporting in some way the tourist industry.
My favored analogy is piracy and privateering in the 17th, 18th centuries. Sure, the spoils of one attack enable the next.

An end to privateering comes with powerful institutional enforcement via the suppression of movement and committed retribution (an eventual monopoly on the exercise of force). I can only imagine what the analogy looks like - it's arguably more difficult than traditional privateers operating on the open seas if the actors in this case are safe on sovereign soil.

Perhaps the analogy to the open seas is the Internet itself. If the solution to privateering was denying bad actors the freedom to operate, the same applied solution on the Internet would be dramatic restriction of who can communicate on it.

Problem is, the supply chain attacks in this analogy are more akin to sailing under false colors. In this case sailing under false certificates. What do you do when a pirate captures a ship of your fleet, has your flag, your signal flags, and has your latest challenge/response codes? In the age of sail, it would probably mean accepting the loss of the incident, then ruthlessly hunting down the perpetrator directly with the goal of eliminating all actors capable of such sophisticated engagements - basically reducing the talent pool to near zero. If you aren't allowed in this day and age to address the actor directly, you probably have to deny the host nation itself the freedom of movement until they commit to delivering heads on plates. What does that mean? Cutting Russia off the Internet? Is that even doable these days? You could embargo the Internet for your own country like China tries to do - sad that we're having to consider that. I struggle to imagine other half-way realistic options. Kinetic war and assassination seem imprudent/impractical, to say the least.

I certainly don't think the answer is to "eliminate crypto", the equivalent to thinking "banish gold coins" in the age of sail would stop piracy. I also don't think the answer is to demand all companies "do better at security". While everyone needs to do security better, it will always be insufficient. A merchant ship in the age of sail was never expected to have the armaments of a national navy. Their solution was to convoy up and if lucky have state actors protect those convoys - a herd defense at worst. The equivalent to "convoying up" in this age would be some sort of massive crowd validation process before updates are released, slowing everything down to an impractical rate. So I struggle to see what's left other than a good offense, as much as I hate to think of what that means for the dream of the open Internet.

The merchants demanded their host nation deliver a safe operating environment, at a pretty steep collective cost.
> AccgemloitteBMizantPMGataBCS

hahaha

-----

I am trying to structure the contract to avoid this stuff, by making the deliverables include both the contractors running their own working deployment, and the government also running their own. For the latter, there should be a tech transfer period where the contracter needs to do training and promptly answer questions, and then a government independence period where the contractor is not allowed to intervene at all to prove the knowledge has actually been transferred, and government isn't entering an IT-support protection racket. Only then is full payout given.

Yes, that means finishing the entire project will take quite a bit longer than doing all the dev work. Yes, that also means the project is riskier for the contractor and has less ongoing reward, and so they will need to be paid more initially. But it's worth it in the end.

If there is some gotcha here where the private sector can get out with too much proprietary IP or a weak and dependent customer in the government, do let me know, that is not my intent. I'm trying to envision a transitional project to get out of today's privatized world to one with better US state capacity.
He doesn't say "live there without A/C". He advocates for designs not being dependent upon it--a big difference.

"All buildings must be useful and livable even with the power cut. Hence, natural ventilation, strategically designed windows that open, etc. is necessary. Obviously you can add AC (Air conditioner) on top of that, but in no way should the town be dependent on AC."
> allowing any org to run data centers with a standardized interface. The state should then run their own data centers in-house with the stock design rather than outsourcing those operational costs

I was under the impression that not having to build and operate their own datacenters was the idea behind outsourcing cloud. Since commercial players are already doing it, the government could piggy-back on the economies of scale already being made. Plus, they can decide not to renew their contracts and not be stuck with a datacenter on the balance sheet.
Sorry, I said “flagged” but all I saw was the “dead” mark. I’m really not up on this HN minutiae; I don’t know the difference.
It seems like there are a lot of potential CEOs out there with ideas looking for a CTO to do the heavy lifting -- and the VCs are all over them -- met multiple in last few weeks with nothing more than an idea

And they want to treat them like poorly paid employees (which, often, they are poorly compensated). People see high compensation for FAANG types and think engineers are respected. Let me tell you, having been in management, nothing is further from the truth. ICs are still ICs, a lower social class, and thought of as such. Any “respect” is simply a temporary condition of the labor market: they’re placated and their egos tolerated until something less expensive comes along.
Alright, now explain why I should pay them $200 (or more) for a half-hour consultation where they parrot something google could have told me and fill out a form in Epic?

I'm with parent, unless you have a lot of time and money to spend, or an obvious problem like a broken leg, doctors aren't worth very much.
I don't know you. I don't know anything about you. I don't mean any disrespect to you, but...

I'll match you against somebody willing to take $150k for the exact same work. I'll match 4 of you against 8 of my hires. I'm willing to bet that my $1.2M team will outperform your $2M team. I'll very happily match 50 of your team against 75 of mine. You could poach 25 of mine who prove to be superstars, and I'll hire more.

That doesn't mean that you are dumb or incompetent or less skilled. I just think that there are some very smart and capable people willing to work for $150k. I think that many of them are as good as any AWS hire. And I think they could be motivated by something besides money to create something as good or better than anything from AWS. Indeed, less money could itself be a strong motivation to outperform.

Thankfully, we don't live in a world where there are only 10 geniuses to go around. The world is much much cooler than that!
Probably inadvertently click-bait title with “population” ambiguity
Human Domestication – A Tale of Modern Civilization
That's a gross oversimplification of the problem. I'm sure you wouldn't have to look far to find something you disagree with and work to prevent in order to better our society.

The damage to society from users ceding power over technology to companies cannot be underestimated.

I understand that literally I am being a self righteous asshole, and I'll own that. If I could hack wifis across the world to broadcast this SSID I would. This is a far far more serious problem than people think.
Looking for a co founder to make a open world game with complex and extensive use of procedural generation techniques.

Zoned game servers, generation of building interiors and cities, perlin noise with layers, erosion, etc. I was inspired by outerra and others, but outerra is not planning to make a game so I want to do it. I have demos to show my progress.

I'm based in France, but I'm fluent in English and C++.
Reminds me a little of this: https://www.vice.com/da/article/xd578z/i-ghostwrote-hundreds... [0]

I don't have much sympathy for the cheaters or those writing these essays rationalizing it via whatever excuse is most convenient (though at least in the essay linked above she feels bad about it).

For every one of them there are many dealing with difficult stuff and also not cheating.

There is a deeper issue here with admissions, selling prestige by enforcing scarcity. A lot of things become signaling rather than actually about learning.

Hopefully we'll see better options for a lot of this in the future.

---

[0]:

"Of course, I didn’t have time for moral quandaries. As my name became more popular, I found myself with more clients than I had time to help. I couldn’t interview all of them, so I needed to find a way to produce essays faster. My solution: writing about my own intimate experiences.

"One December evening, I used one of my most embarrassing moments as the basis for an essay for a 17-year-old Chinese girl who had never desired something she could not afford. The event happened shortly after my father abandoned my family when I was a kid, leaving us broke. Our water and lights were turned off, and my mom was working multiple jobs to support us. Since we lacked utilities, my mother washed our laundry at the local Laundromat. One day, she left our laundry at the Laundromat while she went to finish errands. When she returned, she discovered that someone had stolen our clothes from the washer. The stolen laundry comprised most of the clothes we owned, so my mother took my sister and me to Goodwill to buy clothes. A classmate spotted me at the thrift store, and the next day at school, she pointed at me and called me poor in front of my entire English class.

"As a college admissions essay, this story was pure gold. You could wrap anything around the story, and it would work, especially since students love rags-to-riches tales.

"Except, my life was still made up of rags. Nothing exemplified my rags better than me sitting in front of the laptop, preparing to sell this still wounded part of myself for $400, but without any debate, I emailed the essay to my 17-year-old client.

"The loss hit me immediately. Looking at my closed computer, I felt like a stranger to myself. Every time I used my weaknesses and memorable moments in my clients’ essays, I felt a part of myself disappear. Already floundering in that directionless void of post-college life, I began to lose the one anchor I had: myself.

"I don’t know what I was expecting in return from the student. Would my client feel the pain of the story and then question the ethics of using another person’s life as an admissions essay? Would she call me and thank me for cutting out a personal part of my heart for her? Later, I received a one-word email from her: “Thanks.” The message stung. I thought about the itchy Goodwill sweater and how much itchier it had felt as I cried after my classmate mocked me. I had given up a private piece of myself for the bargain price of $400. I logged off and shut down my laptop."
> Based on reading an article about detailed work on making a model more accurate you’ve concluded that models are useless?

no—I, knowing basically nothing about climate science and having been taught to more or less blindly trust climate models as accurate predictors of the future, read an article that said we have no idea how to model clouds with anything resembling accuracy, because clouds by themselves are crazy complex things. this led me to realize that this should have been intuitive knowledge without even reading the article, which led me to truly consider the scope of the climate system w.r.t. how it could possibly be modeled by computers, which led me to realize that the idea that it's possible for a data-driven computer model to predict anything about the future with any kind of reliability is pretty silly to begin with.
Funnily similar wording to an old slashdot troll message about rewriting the Linux kernel in Visual Basic:

“I hope to see a switch from C to VB very soon. I've already spoken with various luminaries in the C coding world and most are eager to begin to transition. Having just gotten off the phone with Mr. Alan Cox, I can say that he is quite thrilled with the speed increases that will occur when the Linux kernel is completely rewritten in Visual
Basic. Richard Stallman plans to support this, and hopes that the great Swede himself, Linux Torvaldis, won't object to renaming Linux to VB/Linux. Although not a C coder himself, I'm told that Slashdot's very own Admiral Taco will support this on his web site. Finally,
Dennis Ritchie is excited about the switch!”
I've been semi trying to keep my work and personal computing separate

Like some recent HN article demanded

Its impossible
Gruber did the exact opposite than stepping down. Even now, he insists on controlling the name “Markdown”, despite having abandoned the project over 15 years ago.

It would be a bit like Tim Berners-Lee trying to police how people use “WWW” today. He might theoretically be within his legal rights, but he’d still be a jerk for doing so.
Well, we have to do something about that. I don't like designing policy within the constraints of "Actually, we cannot have good policy".
I love the work that represent.us does. This is exactly the kind of thing I was talking about.

I remember reading Republic, Lost years ago. it's good to see action plans around that material.
That's not the case here, and even then why bother when modern operating systems have ways to easily get you good quality entropy? If you use a decent random library you won't have to bother reinventing the wheel.

I had to generate a 20 char random key string in Rust the other day, I just wrote:

rand::thread_rng()
.sample_iter(&Alphanumeric)
.take(20)
.map(char::from)
.collect()

There. Uniform, decent entropy, explicit, simple.
And here we see the bad-faith rhetorical goalpost shift happening in real time. 1. deny that change is happening. -> 2. deny that we have anything to do with climate change. -> 3. deny that what we're doing to the climate is bad. -> 4. actually, amazingly, claim that what we're doing to the climate is good. (you are here)
Imagine a cloud provider run like the DMV.
I encountered this link on https://cheapskatesguide.org/articles/normals-free-speech.ht... that blog post is very critical of HN and the owner actually claims that his username was shadow banned here, I didn't believed it, but now I'm not so sure what to think of it.

edit: from domain to username
that's what happen when develop a bloat driven culture
It's not a big enough of a change for people to actually choose Linux distributions over it - those who know about the variable will set it themselves, those who don't will be stuck with a bad default.

My issue isn't with the point of control - it's with the default. Telemetry of all kinds should be opt-in. People shouldn't have to worry that they're constantly being watched. They shouldn't have to hope that every single telemetry stream is operated by competent and careful software engineers, guided by honest and law-abiding managers. You know how this industry works; it's a rare case where a data collection scheme doesn't overreach, accidentally ingest too much, leak data, or turn malicious and pass it to bad actors.
Right.

Knowing the extant nomenclature is useful in researching ideas / literature further. I'm often stymied because I don't know what things are called in certain domains. Psychology seems to be especially prone to this for me.
It looks like this account is trying to engage the community in good faith and every post and comment seems to go quickly dead?

I've only seen this on brand new accounts, but this person has been shouting into the void for at least 7 years.
Thinking of Mortimer Adler's How To Read A Book...

Self Help is either a How To book or Philosophy?

Both have quite a bit of value to the individual. Even as the author describes this as feeding the business machine, both self help and philosophy can make you aware when this is happening.

I read these genres and can see clearly why my boss was told to repeat company statements. I sit back and witness corporate propaganda/marketing and am aware they are coming for my brain.

Without self help and philosophy, would I be hacked into mindless compliance?
If the planet isn't bound to a star and is behind the lensing object, what is illuminating the planet that it appears optically?

Wouldn't be completely dark?
You're still fighting them one at a time, just with very small timeslices.
HFS+ is still only somewhat extended HFS and the filesystem itself does not support hardlinks to anything. The support for hardlinks is simulated in upper layers which while being questionable design on its own somewhat alleviates the usual problems with directory hardlinks.
Code Complete is a self-help book? I never imagined that book would be categorized as self-help. With a definition of "self-help" broad enough to include it the question in my mind is "What isn't self-help?"
Is the second section “when would I use this” sufficient to provide a “why you should care statement”? Or is there a more common way to call this out in technical writing? Perhaps an “intended audience” or “necessary prerequisites”?
Ask HN: Easy to learn front end development
I'm a sysadmin who has moved into DevOps over the years. As such I've written tons of Bash, Python, and PowerShell scripts. I've got a couple of product ideas, and I can whip up a serviceable backend with the skills I have. Where I get stuck is on the front end.

Last year I started looking into React as it seems popular. However the learning curve is too steep and for my needs is like killing a rabbit with a howitzer.

I'm looking for something, where I can create a few editable tables and a few forms. Nothing too fancy, as I'm just focused on creating a demo of my ideas to show to potential cofounders.

Can anyone suggest a front end framework that is straight forward to pick up? It would also be nice if there is a book on it in O'Reilly books online as I have a subscription.
are there documented cases of these cli tools abusing their telemetry? are they entirely used to pinpoint performance issues and bugs within the tools that implement this telemetry tracking?

if it is the former, i can see there being cause for concern. if it is the latter, this is just pure fear-mongering.
GCP has some good bits. They're just running into the same problem everyone had catching Windows: it's really hard to compete from a fresh start with something that's been incrementally improved over years of significant use.

Especially when you're Google (our customers aren't as smart as us) competing with Amazon.
I mean, Texas is home to the largest unzoned city in the country. It’s also the most successful red state in the country, so it’s favorable amongst some groups, especially those with business leanings. I don’t think they’d enforce parking minimums, but we do have municipal broadband restrictions.

As a resident, I also found it an odd choice. I’d build an experiment city (especially one that wants to be walkable with less reliance on a/c) somewhere with more amenable weather. Water is also more of an issue. West Texas land isn’t just cheap because it’s flat and brown, it also is a crapshoot if your wells pull up brine vs fresh water, or if you have to dig absurdly deep wells that you have to replace every 5 years.
I'm really happy to have another open-source 3D game engine out there, that's good for everyone.

Also, you should know Amazon's Lumberyard was basically just a copy of CryEngine that they purchased and began to modify. They must have spent a lot of money to be able to get full rights to that and now be able to make it OSS.

My bet, though? Amazon is axing the entire Amazon Game Studios, or at least radically changing how they operate - and part of that is hoping they can dump development of the engine on the OSS community and get momentum behind it.

One need only look at the titles[0] Amazon Game Studios has been developing to find they haven't been doing too well, given they started and cancelled the following titles after several years of development put into each one:

* Breakaway
* Crucible
* Lord of the Rings MMO
* Intensity
* Nova

And plenty more..

[0] https://en.wikipedia.org/wiki/Amazon_Games
In this particular case the developer had wondered if chasing Lighthouse was a good idea, but realized that they had already made a similar change on another site for different reasons. Better Lighthouse scores were just a bonus.
Comes to mind polar functions who represent animals or plants...
Says a lot that his other company Amazon is using ULA/Boeing for Kuiper satellites to compete with spacex.
Apparently you couldn’t make a Mel Brooks film back when Mel Brooks was active either because hate mobs[1].

1: https://www.youtube.com/watch?v=62cPPSyoQkE