skysight-inc/HackerNews huggingface dataset:
So you already had Sign in with Apple implemented yet they told you to add it?

I had a similar experience for my Hacker News client. Apple rejected my app initially because they require developers to use SFSafariViewController instead of WKWebView when displaying third party websites from the app. I replied back to them that my app was already using SFSafariViewController and I didn't even have any WKWebView in the app so I wasn't sure what they were referring to.

Then it got rejected second time with: "- The layout does not take advantage of the full screen - When tapping on some of the content, the right part of the screen populates with a white page with no content."

To this I replied:

> My app did take advantage of the full screen iPad experience. In fact that was one of my selling points that my app supports the iOS UISplitViewController for iPads which lets you view 2 view controllers at the same Time size by side. From the screenshot the reviewer sent, it appears they clicked on "New" (I could tell because the number of points and comments in the screenshot are all zero). Now since they clicked on "New", obviously, it won't show any comments and is what the reviewer saw.

I had to ask the reviewer to try going to the main page and clicking on "Trending" or "Home" or "Best Stories" where they will see the full content? There is plenty of content and this takes advantage of the iOS native SDK for UISplitViewController. When you select a story on the left side, the detail story on the right shows the story discussion, threaded comments, ability to upvote/downvote, favoriting stories and comments (swipe left on a story or comment), view the full article by clicking on the link image on the right of a story, tap the reply button to reply to comments or stories, use the date picker to go to articles from a specific date, view leader boards of the top users, search for stories and comments etc. You can tap on comments to collapse the comment thread (not possible using a website). You can also swipe on a comment or post to upvote (left swipe), favorite (right swipe) which is also not possible using a website as these are only possible on touch screen devices. These are all implemented using native iOS SDK. UISplitViewController isn't even possible using a website.

It almost seems like the review team simply launches an app and rejects things without taking the purpose of the app in context.

Now to be fair to Apple, I develop for android too and good lord, they are even worse if your app happens to get caught by their "Artificial Unintelligence". You end up having to deal with a computer without any human on the other side unless you can make enough noise on social media and get some tech blogs to write about you as it happened recently with Droidscript:

https://news.ycombinator.com/item?id=26956077
Some more detail on the hospitalized people below:

"One vaccinated, hospitalized COVID-19 patient had received the Pfizer-BioNTech vaccine and three had received the Janssen vaccine."

"Four additional, fully vaccinated patients aged 20–70 years were also hospitalized, two of whom had underlying medical conditions."

Source: https://www.cdc.gov/mmwr/volumes/70/wr/mm7031e2.htm
Yet another negative side effect of SESTA+FOSTA legislation (and also the existence of app stores I suppose).

This is gonna be a bad time for Tinder users. Where do you think all those users are going to go?
Should have been deprecated around 1990 and removed by 2005.
(disclaimer: I work on the Sorbet team)

I think I understand GP's motivation: RBI files and RBS files are two different formats, and as a user of the language, people tend to want to use the officially blessed solution the language provides.

In case you weren't aware, parlour[1] is a popular open source project for working with RBI files. I believe it supports transparently converting between RBI files (Sorbet) and RBS files (Ruby 3).

There is also rbs_parser[2], a C++ parser for RBS files to convert them to RBI files, written by Shopify, a major user of Sorbet.

Stepping back: I haven't personally read many complaints from Sorbet users describing how the current state of RBI/RBS interop gets in the way of what they can actually do with Sorbet. Almost all the feature requests we get about Sorbet (both inside Stripe and outside) are for fixing bugs or implementing new language-level features. RBI files as implemented seem to work.

Sorbet already has an extensive set of RBI files covering the Ruby standard library (at least as good or better to my knowledge than any existing repository of types for RBS files), and there are plentiful tools for working with RBI files, listed here.[3]

If lack of first-party RBS support in Sorbet is holding you back from trying Sorbet, I'd strongly encourage you to give Sorbet a try anyways! Many people have shared great experiences adopting Sorbet in their Ruby codebases.

[1] https://github.com/AaronC81/parlour

[2] https://github.com/Shopify/rbs_parser

[3] https://sorbet.org/en/community
I don't agree. Sounds like the right interested party could get the collection for just the cost of shipping, which seems reasonable to me.
This is poor reporting, because they don't say what the vaccinated vs unvaccinated ratio is in the exposed crowd. You can't tell anything about the underlying vaccine effectiveness without that information.
The Analogues are a good Beatles tribute band that plays the stuff live and tries to reproduce the sound (original equipment where possible, horn and string backup). There have been other acts that have done well at smaller scale (such as Beatlejuice), but you can see and hear the Analogues on-line quite easily. For me, if Covid had not occurred I would have jumped the puddle to see them.
https://www.psychologytoday.com/us/blog/insight-therapy/2018...
> Many unwittingly used a data set that contained chest scans of children who did not have covid as their examples of what non-covid cases looked like. But as a result, the AIs learned to identify kids, not covid.

> Driggs’s group trained its own model using a data set that contained a mix of scans taken when patients were lying down and standing up. Because patients scanned while lying down were more likely to be seriously ill, the AI learned wrongly to predict serious covid risk from a person’s position.

> Errors like these seem obvious in hindsight. They can also be fixed by adjusting the models, if researchers are aware of them.

I wouldn't trust any method of fixing errors in data collection. You need to redo data collection and perform a proper case-control study. You need to select your cases and controls such that the demographics look similar.

In general, your goal is not to pick cases out against a background of the general population. It's to pick cases out from an at risk group.

And if there's any difference in procedure used for data collection between cases and controls, your data is compromised. Researchers often suggest correcting the dataset (cropping out artifacts etc.). In my opinion this doesn't really work... artifacts (for example in image data) can often cause subtile global differences in illumination which ML will pick up on but not be obvious to someone inspecting the images.

The only solution when you have such artifacts (and only one that would be acceptable to me if I was doing DD, or evaluating the research) is to redo data collection in the context of a more reasonable case-control study.
mortgages are pretty much where money comes from in the global financial system. that and government debt. (when banks lend they create money).
What’s an OK Churn Rate
Well I just tried to make a repro by grabbing a random repo I had, but I get "Invalid authentication (as an anonymous user)" when trying to get a package from a GitHub registry, after configuring my scope with `yarn config set npmScopes.MYSCOPE.npmRegistryServer "https://npm.pkg.github.com"` and successfully logging in with `yarn npm login --scope MYSCOPE`.

Every single time I've tried Yarn 2 I end up frustrated.
Exactly this. Having worked such jobs in my youth; you don’t do it for the prospects…

As you say, it’s a matter of scale. Shitty jobs have always existed, they will continue to do so. Is a job in home removals - a gruelling, backbreaking task - truly better than that of an Amazon courier, engineer, or warehouse employee? If we want to be particularly extreme, we can swap removals for mining, farm work, or heavy manufacturing.

In the long run, damaged joints n’all, I expect that the average ‘shitty job’ of today - in developed nations - is still an improvement on what came before.

Yes, a lot of this comes down to outsourcing risk and danger (e.g. from manufacturing). I’m interested in hearing opinions on this - it’s a working idea.
Brightness is literally just a backlight power level (pretty much), so gamma and eco mode are a completely separate concept. Frankly I have no idea what eco mode means, but I wouldn't be surprised if it's just brightness * 0.75 + contrast * 1.25.
At the point where I/O is the performance bottleneck, that usually means it's not Ruby related!

Instead, I/O problems are frequently a language-agnostic set of problems, like:

- Oh jeez, I'm making a database roundtrip 2x more frequently than I'd like to! Maybe I should change my application to batch the database requests.

- Oh jeez, I'm running on cheaper EC2 instances without SSDs, maybe I should upgrade!

etc.
Don't worry, I'm upset for you.
Is it just me or Sgt. Pepper always sounded a bit "muffled" to me?
That sounds like House of Cards.
Stuff like that always happens. Remember all the outcry against the Grand Theft Auto video games inciting children to commit crimes? People still blame "The Warriors" for teaching teens to jump turnstiles in the subway and get involved in gangs. There is an entire chapter of Mein Kampf dedicated to how the youth play their music too loud and spend too much time partying. I'm sure vaudeville was the work of the devil before that.
> I used to be a pretty ardent defender of Apple's right to control their platform. Then I submitted an app to the App Store and experienced the process first hand. Kafkaesque is an overused term, but I've not been able to think of a better description.

One of the main reasons I use against censorship of "offensive" content and why I have become a free speech absolutist.

In fact, this whole Apple rejection thread applies to free speech too:

https://twitter.com/thomasareed/status/1420831606227488772

> My last experience with a rejection that required appeal didn’t go so nicely. We ended up having to spend a couple months ripping a feature out and replacing it with something lesser… when other apps were already doing the thing we wanted to do. This was a few years ago, tho.

> I feel you. We’ve had similar experiences. Really not fun and definitely not cheap for a small business. The worst thing is that you don’t always get the confidence that “fixing” what annoys apple will secure an approval. Definitely kills you inside.

> Yeah, very true. Sometimes the rejection is very vague on exactly what needs to be fixed. That’s very frustrating. Have to say, though, I’m impressed with the outcome in this case, given how badly it started.

> And the “ptsd” lingers a long time after experiencing that type of rejection from the app review. It’s definitely something tough as a business or even a dev to feel that powerlessness. You tend to self limit yourself which is not good for the product or the users in the end.

The "PTSD" referred to here is what happens with censorship too where people self-censor because they don't want to get caught in the big tech "community guidelines" trap.
Even with the vaccines there are many antibodies for other parts of the virus than have mutated , they're just not very effective.

There are also inactivated whole virus vaccines, they're not very effective either.
That it works at all is a major improvement, and the Raspberry Pi method is worth having as well; I've been working on something very similar since I got my M1 Mini and found ddcctl and Lunar unable to work there, but got little further than building the light sensor before other projects took priority - I expect I'll probably finish this one around the equinox.

My work laptop, an Intel Mac, displays to and controls brightness on the same monitor, but I've been using ddcctl with a trivial wrapper script much more than Lunar of late. (Kinda feel a little bad about that, what with the author of Lunar having taken the time to give me tech support on a weird corner case here on HN a while back.) Still going to buy a license and, if I can find a way, set up a recurring donation. This kind of work deserves support.
It's quite interesting because conservatives in the U.S. are simultaneously attempting to compel tech companies to host content against their will but at the same time they are trying to argue that these cake / flower / website makers don't need to make content against their will.
Stealing Impl from Rust
I'm curious what people find is more likely given this evidence:

- 100s of models were done incorrectly, and none even remotely correctly

- there is no phenomenon to correctly model

Both seem extremely unlikely. Not sure what the alternatives are.
Starch, protein, total carbohydrate and vitamin C levels did not seem to be affected in the crops in the study.
I think on a budget it’s hard to beat Cloudflare workers.

I’ve never been a fan of the serverless model, building on AWS Lambda etc, wiring up API gateways, slow cold starts, the hidden extra costs, EGRESS, gateway pricing etc.

Recently trying Cloudflare workers has been a pleasant experience. It’s still early, a few rough edges and limits to work within etc but I’m pretty convinced they are going to disrupt the serverless market. Fastly’s C@E is even more exciting being WASI but although Fastly advertise it as available you cannot go to their website give them your credit card number and use C@E. Likewise when C@E is generally available if the pricing is like the CDN it’ll be a non starter outside of business use.

Back to Cloudflare workers. Generous free tier, good non free tier pricing, static hosting, globally distributed workers by default, fast cold starts, WASM support, KV persistence, hook in to the cache easily, distributed objects for persistence if you can work around limitations. No need wiring up API gateways etc, write a traditional monolithic api with a router.

If you can design around utilising cloudflare it’d likely scale better than any cheap vps. I got a very long way for free with cloudflare then had to pay all of $5 to upgrade my plan as a worker needed 12ms cpu time instead of 10ms as was connecting to an Azure CosmosDb database and I think request signing eat in to my cpu budget.
That sounds like the lecture I was at. Thanks for sharing that, fun times. There were some really great lectures back then. I remember when Exponential gave their talk right after Apple moved away from the PowerPC architecture. Everyone knew their processor was a dud in every commercial way (super high-power BiCMOS PowerPC chip), but almost felt sorry for the guy and were amazingly polite.
> Well, define "unreasonably low wages"

You go inspect the life of an delivery driver. If they are struggling to pay rent, eat healthy, or get a reasonable amount of legally-mandated family time and sleep because they are having to work excess hours, their wages are too low. Have a judge mandate an increase in their wages by some value. PID feedback loop on that legally-mandated bonus until their lifestyle becomes acceptable.

Do this for a random sample of people and establish a per-county minimum wage.

If the judge doesn't understand how to deal with a simple feedback loop, fire them and replace them with an engineer. A backend engineer who has to regularly deal with actually solving problems around allocating resources and making sure processes don't die is probably a perfect fit.
It's kind of bullshit too though that you are required to add an apple login.
It's impressive to me that you can build a project on something (here Ruby), and if you get big enough that the initial decision is a problem for some reason (here performance), you can just improve on it like that.

How does one generally get to work on compilers? Is it mostly through academia? Through open source contributions to compilers?
I disagree with you there. There's definitely a way to do it right.

Copy-pasted templates are never appreciated, but hand-written, personalised outreach that considers the recipient's situation can go down well.
You have a good set of skills which is your software engineering background depending what type of AppSec role you are looking for. My background is very similar to yours.

It is the same way I entered the space to start building application security testing tooling automation into software delivery pipelines, shift left, if you like buzzwords, and learned (still am...) security along the way.

My best piece of advice for you is to be an advocate for application security on your team or in your area if possible. I am not sure the size of your company but if a Security Champion Program exists, that is a great way to get involved and start learning. Understanding risk management is another I would stress, as at the end of the day, you manage risk.

Here are questions to think about. Some may not be feasible depending how your company is setup to handle them but I will share for awareness.

- Do you threat model your application/s and/or new features?

- Do you consider security requirements when you are grooming features/stories? How would you help a team define them?

- Do you compose a SECURITY.md file in your codebase that takes about security requirements, mechanisms, implications, etc..?

- When you do code reviews, are you eyeing for security bugs? e.g., missing input validation/sanitization, broken authentication, etc...

- Are you automating security testing tooling (SAST, SCA) in your software delivery pipeline?

- Do you evaluate the OSS your application/s use with an SCA tool? (Be prepared for a lot of "false alarms", but the experience of triaging a CVE and understanding if risk of exposure exists is a good exercise).

I could probably add more but then we are going down a rabbit hole.

References

SAST = static application security testing

SCA = source composition analysis

Relevant links for learning

- Understanding OWASP Top 10 is table stakes

- MITRE ATT&CK Framework

- OWASP Web Security Testing Guide (https://owasp.org/www-project-web-security-testing-guide/)

- OWASP Application Security Verification Standard (https://owasp.org/www-project-application-security-verificat...)

- OWASP Software Component Verification Standard https://owasp-scvs.gitbook.io/scvs/

- OWASP Threat Modeling Cheat Sheet - https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeli...

- https://github.com/devsecops/awesome-devsecops
I think having a simple global cache is fine, but otherwise I much prefer NPM's approach where all dependencies are contained in the project directory over Python's where everything is tangled up in your global system environment
Anyone want to ping Jason Scott on Twitter?
Daniel Hale Receives 45-Month Sentence for Releasing Drone Documents
Controlling external displays via DDC was never supported, and only works even on Intel Macs via a "private," undocumented API. It's neither appalling nor even surprising that this wasn't prioritized for the M1 kernel, and it is likewise reasonable that some more reverse engineering would be required.
I recognize the name, or it's someone in tech. It's not always a 100% certain thing.
I think one of the most profound intellectual insights I've had is that the myth of Prometheus was in a sense true, but described events so old--that we wouldn't event consider the "people" in the myth (the ones who received the gift of fire) as human.

It made me realize just how much of everything I have and know is inherited, and why traditional cultures revere their elders so. Especially when the world changes as slow as it used to, your elder taught you everything that mattered, and everything that mattered was handed down across millennia.
Isn't Mongolia the rightful owner of mainland China? If we're going back 100 yrs, why not 800?
As a user I love it. More privacy for me.
The British shipwreck that changed the world
Use s3, case closed.
Fuck All Branch Covidians.

You are fucked. Your ass is dead - you don't even know it yet.
Fair enough, though the main impression I got from this article was that she does not wish to be associated with these kinds of movies at all, so I'm not sure if (another) movie about "the real Amanda Knox story" is really the right take away from the article.
I think so, but I did let them know on Twitter.
I don’t see how they would get that information.
Branch covidians are a fucking cult.

You know what happened last time fascism was tried?

Oh yeh, we MURDERED their fucking asses.
(I work on the Sorbet team)

I've been meaning to write a blog post about this because I get asked about my personal journey to working on the team a bunch.

The makeup of the current team is a split of:

- people who worked on programming languages & compilers in academia

- people who worked on developer productivity/product infrastructure at large tech companies

- people who just really like types (me)

Which is to say: there's a deal of luck involved, but there are also some fairly straightforward ways to inch closer to PLs/compilers job in industry.

That all being said, the piece of advice I always give people who bring this up: there's nothing stopping you from working on PLs/compilers right now! Find a ticket labeled "good first bug," show up in the #internals channel on the Sorbet Slack[1], and someone would love to help you get started.

Don't care about Sorbet? That's fine! Pick your programming language of choice, find where the developers hang out, and repeat the process. Oftentimes, there's nothing holding you back from working on PLs and compilers except yourself.

[1] https://sorbet.org/slack
Does this mean retirement?
The Rust compiler is a great example of one that is very beginner friendly. Diagnostic (error message) issues, of which there are many, are a relatively easy way to get started and learn the codebase. The community is also very friendly to new contributors, and you can learn your way around the compiler and choose to work and learn things that interest you. There are certain things you'll need to know for certain parts of the compiler, such as some graph theory if you're working on Rust's MIR, and you should read a high level overview of how compilers work. Compilers are a huge, never-ending field of study/work. Start small and work your way up from there.
> The "just stop buying amazon" arguments never made sense to me in the first place, because most people who use it are the ones budget-stretched in the first place. A lot of rural communities have no other viable options for some items as well.

This is all bullshit. Walmart is still the cheaper price for groceries and most general goods (at least in my experience living somewhere rural). Amazon is purely convenience at an OK price.
Srsly Risky Biz: Thursday, July 29
I'm on Linux, using subpixel antialiasing (very similar to Mac) and I've had the same experience. I do appreciate the thickness, but sometimes I switch it to the light/mediumlight to match it with my system font (Inter)
Musk and Trump are conceptually almost identical. Buffoons that had some luck and some bluster that got them percieved in some circles as shrewd businessmen, but generally only coming up with simplistic and populist ideas, basically in line with what a kid might think of because of lack of experience.
I think the real answer here in terms of long term career "scaling" and upward mobility is to work in product with prior experience in engineering. Clearly unless you're brilliant or credentialed enough to eventually be a principal engineer, the engineering side is a never ending treadmill with a glass ceiling that emerges way earlier than most would think.