skysight-inc/HackerNews huggingface dataset:
> Too often, they're also product marketing documents, beginning and concluding with "overall assessments" of the target software that is almost invariably positive

We have some customers that clearly come to us to get reports they can share with investors, and not that many come back so either they weren't happy or (I like to think) they've checked that box and aren't doing further tests. But never did one of them ask us to rephrase something for overt marketing reasons or provide even a single sentence of marketing material to include. Perhaps we were clear that this is not something we do and that's why they don't come back, though since they also don't ask and still order a test, that doesn't seem logical.

I also can't say that I've seen a Cure53 report where this is the case, including this one. If anything, the statement about a critical vulnerability in the previous pentest could make one weary, so I applaud Mozilla for publishing this rather than silent fixing and keeping it under wraps.

> Vendors pay for public-facing reports, as an extra line item in the [statement of work]

This is the first I hear of that, though the public scrutiny does mean we spend quite a bit of extra review time on such reports (from spell checking to going over every substantial statement and rating) so I could understand if Cure53 has different practices from ours. That does not mean they were bought (assuming, for the sake of argument, that a premium was paid, which I don't think there was).

> that norm should be that public-facing reports can be provided only in the same dry, technical form they're presented to development teams in ordinary, non-public projects

That is exactly what we do, and I am quite sure Cure53 works the same way in this regard. We review more deeply if we know ahead of time it's going to be public, as I wrote above, to make sure things are correct (especially since English is none of our native languages), but we don't alter the contents.

> I think third-party assessment reports like these are a real problem in our industry.

I really don't understand where this comment is coming from unless you have very different experiences with customers or public reports where you are based. At a minimum it doesn't apply to the report at hand. Too often these things are kept secret and it's a rare opportunity that we don't have to swear silence on our work. I'd love to do that more.
I’ve thought about that as well. The only addition I can think of to your short list is Ada Palmer, I highly recommend her Terra Ignota series for social commentary and some refreshing optimism - and flying cars.
I would break it into small parts - I would decouple the storage of the batch request from it's processing. For example, let's say your requests originate in a CSV file. I'd have a CRUD API to upload the CSV and give it a handle. Then I'd have an API for setting up a job, using the handle of that resource file. You'd use another API to then start this job and check on its progress. This API might specify a webhook to call back when the job is done. A final API would allow you to query for successes and errors based on the job id.
> Passwords are 100% the weakest link in our beep boop chain of trust, of course - we know this. But maybe they should just be rethought from the ground up instead of randomly affecting your users all the time with security nonsense.

Github is not in a position to "rethink passwords from the ground up". They are however in a position where it's their responsibility to ensure the security of what they host.

These changes are good. That you're calling them "absurd" and "security nonsense" speaks volumes, to be honest.

And if one of your keys is about to expire (I'm guessing a GPG key since SSH keys traditionally have no expiration), that'd be because you put an expiration date on it. One you chose…
Primer | Data Engineer, Front/Back End Engineer, Technical Lead, Software Architect | REMOTE | https://www.sayprimer.com

We're building the "CircleCI of Growth Marketing" at Primer. Growth marketing has boomed in recent years and every B2B company needs a tailored, data-driven approach to their market in order to win business. Primer is enabling our customers to accomplish this much faster without having to engineer an expensive system.

Here are some reasons to work with us:

* We bootstrapped ourselves to $700k in revenue with a team of 4 in 2020 and just raised a small round to grow.

* We invest in our team and catapult careers. Many people end up at top-tiered companies like Dropbox, Facebook, and Tesla beyond working together.

* Our team is fully distributed, supports flexible schedules, and we spend 95% of our time outside of meetings. Many of us have young kids and we prioritize work/life balance.

* Our engineering ceremonies and technology are world-class, put engineers in the drivers' seat, and emphasize transparency.

* Our culture is high-achieving, genuinely kind, and collaborative.

The roles we'd like to fill are:

* Data Engineer (ETL/API)

* Technical Lead / Software Architect

* Senior Software Engineer (Back End)

* Software Engineer (Front End, Back End)

We welcome all applicants. The only requirement is having 1+ years of professional experience.

Our stack is React / Javascript / Node / Postgres, but we welcome polyglots. In general, we're looking for thought partners to help us architect a solution for the future so experience with other languages (e.g. Elixir, Go, Clojure, Kotlin, Haskell, Rust) is a plus.

Interested? Want to learn more? Feel free to contact me directly at juan [at] sayprimer.com
Is that because sociologists overwhelmingly lean left so emphasizing their political leanings highlights the biased nature of the field that's perpetuated by professionals like you who have a stake in the general public viewing the field as non-partisan?
Leap | https://leap.so | SF Bay Area | Full-time | Founding Engineer

Leap is a social learning platform for a traditionally underserved market — people 55+. We're building a platform for small group, synchronous events where older adults come to learn, grow, and connect.

Joining as a Founding Engineer is a chance to have a ton of ownership, agency, and impact on an important mission — building more meaningful connections.

More here: https://www.notion.so/foundingteamleap/Founding-Engineer-1a2...
kata is making a repetitive movement, so that you can make the movement naturally, without thinking.
While it is most well known as martial arts training, there are kata for most traditional Japanese arts, even tea ceremony. In the west it has gotten used for any sort of repetitive training used to reinforce a skill.
Im not super fond of the idea of having a brand lock-in to make it easier to work with the governments. This feels a bit like a world where Turbotax was the only game in town for softwares to file taxes. So you'd have either the manual way, or Intuit and that's it.

This isn't as bad, and I didn't look much into it so maybe there's stuff I don't know that lessens the negative, but seeing it being Apple specific doesn't make me feel so good.
The comment I replied to:

"Yea let’s go back to life when most citizens didn’t get a primary school education let alone high school. You think 100% of families will prioritize tuition for toddlers when it’s a discretionary expense? Or will the bid up rent costs?"

The fact that this above comment I genuinely replied to was not flagged nor rebuked by yourself, yet my genuine and upvoted response was flagged and rebuked, tells me all I need to know about what you're "trying for."
The gritty reality for Substack's middle class
You're quite right.

I'm very hopeful that this will get trough to people. Someday.
If there is limited space, why shouldn't it be first come first serve?

Anyways, it is my impression that space is kinda big..
Purdue Pharma Is Dissolved and Sacklers Pay $4.5B to Settle Opioid Claims
Sorry to be cliche, but have you tried changing your diet and exercising more? Letting them slip always ends up with me feeling like that. To be fair, the one time it ended up being cancer, but even then the cancer felt better when I was moving around and eating more vegetables. My checklist when I start feeling down: Water, Magnesium, vitamin D3, Fiber, squats, full nights sleep, no alchohol, wake up early every day, have sex, pet a dog, go into the woods.

It doesn't always work, but it's still good place to start. I hope you figure it out.
I can't count the number of times that I've come across a would-be useful comment that would solve exactly the issue I'm having, only for it to have been deleted.

Hating the site is fair, but honestly what you're doing is really shitty. Thank god Pushshift exists.
How I Use Blender with a Disability
For accounts without MFA enabled (which are the only ones who were able to use username/password via https in the first place), is the token granted after supplying just username and password, and if so, what's the real improvement?

I see here [0] a few benefits listed:

> Unique – tokens are specific to GitHub and can be generated per use or per device

> Revocable – tokens can can be individually revoked at any time without needing to update unaffected credentials

> Limited – tokens can be narrowly scoped to allow only the access necessary for the use case

> Random – tokens are not subject to the types of dictionary or brute force attempts that simpler passwords that you need to remember or enter regularly might be

...but if you can trivially obtain it by supplying username/password, then it's effectively equivalent anyway.

[0] https://github.blog/2020-12-15-token-authentication-requirem...
I think it's a bigger category: the egos of the powerful. The rich are a subset.
Arbitration clauses aren't binding. It's a perfect example of something that is very common and abused in the US, yet has zero bearing in the rest of the world. ^^

A clause that tries to define particular types of torts/defenses is a prime example of clause that is immediately void across the world, because it tries to redefine the law. Contrary to what you think, the judge cares little what is written in the contract, the judge mainly applies the law.

P.S. The GPL is not a blanket license. It's a contract in the US too. I shall make a follow up article on contract vs license because there is a lot more to cover about that.
Biking to the spaceport was in the promotional video released a few days before the flight (where they announced "astronauts"), obviously it couldn't be filmed on the flight day.
You fail to make a distinction between following a process and abusing a process.

Amazon is clearly abusing the process.

It's clear to everyone and their mothers that Amazon is abusing the process.

Find me one comment that says "yeah, Amazon is totally right about that and SpaceX should not get the permits they are asking for".

Abusing a process warrants a bit different response than "oh well, the rules can be abused so it's just fine for Amazon to abuse them".

What makes it even worse is that Bezos publicly complained that this kind of abuse of process is delaying progress in space. It's on tape. You can watch it.

To me this is evil: knowing that some things are bad and doing them anyway when it benefits you.
Funny. I'm working on a specific issue with GCP GKE Autopilot. I'm running a bunch of workloads every day with 1 pod per client. Each pod has various running time and I wanted to know the pod cost per client.

I tried to use Kubecost but could not find any option at all to do what I wanted. My labels never appeared on the Kubecost UI. It's funny now to see an article about labels knowing that Kubecost itself doesn't seem to support them.
Sorry I'd tell you how I do it but for OPSEC reasons I cannot...

Haha just kidding, here what's up - this is what a friend of mine does that has nothing to do with my own operations of course. Probably violating many contractual arrangements bigly but honestly the whole security side of this stuff is so anal retentive that I will, for the greater good of my boy generationP.

You just go into your dev settings on GitHub. (Top right when youre on GitHub.com, dev profile pic, click on Settings then on Developer Settings, then you'll be confused because it asks you to register a dumbass GitHub app - ignore this)

Then click on "Personal access tokens" on the lower left of the left most menu.

Then generate with the desired permissions (wow, guess what most people will select in a rush...? shocking, unimaginable...)

Anyways once you have the token, which will only be generated once, so save it down - I just make a environment variable and export it because I have a finite amount of time in my life and this stuff beyond annoys me.

The just repoint your local repo clones to an instance with the following convention:

git://<username>:<personal_access_token>@github.com/<username OR orgname>/<repo name>

Good luck, old sport. Post on here if you have any problems.
You can also modify all the crap in your .git subdirectory within a repo but that's deep in the danger zone.
Their nimbyism is silly. Nothing is going to hold back this next period. The entire planet will be connected soon and that's when the internet moves out of alpha and into beta. Complaining about a few thousand satellites will seem quant in ten years :P
there are still people bitching about things that don't matter like this? They have the same semantics and choosing between them is arbitrary. Json can be enforced with a schema but I doubt this is your concern.
Cancel 'Cancel Culture' Articles: Please, No More
Are you saying god is working in two-week sprints and has no control over the backlog? That would explain a lot.
I remember a discussion about a set of changes introducing a null check which was technically redundant and Linus criticizing said change for it. However, in my opinion redundant checks are often not a bad idea since while a check might be redundant now, software is ever changing and these "redundant" checks often help catch mistakes so long as they can be afforded from a performance perspective. I pretty much never view a check as redundant unless the check is in the same function or if it is in the same _small_ module.

Something I'd also really like to see more often in various systems is a better config for enabling/disabling various checks sort of like how log levels can be adjusted. i.e., checks divided into something like expensive, noticeable, and minor overhead as well as by software module so you could enable/disable all checks related to some particular subsystem without enabling expensive checks globally or having to individually enable each check.

Some people say if the check is worth doing at all, it should always be enabled, but I think that overlooks the reality that some checks can be useful but expensive. For an example of such a check, whenever I implement a custom data structure, I find it useful to have assertions before and after each operation checking that all conditions hold such as an order of elements being preserved. That check is O(n) though so you definitely don't want it running in production or even in most debug builds.
Meanwhile the Dallas municipal IT technician who deleted 15TB is saying “pfft, amateur.”

https://www.dallasnews.com/news/2021/08/31/dallas-it-worker-...
Or Data while playing poker, although synth. https://www.youtube.com/watch?v=I9851-SsDBc
I switched from a MBP to a Razor Blade 14, with their 4k screen option. I forget what I paid but it was on par with a similarly specced MBP.

The only real compromise that I've noticed is that the battery life isn't as good. But part of the reason for that is that it has an actual graphics card (albeit not a great one). So it's more of a trade-off than a compromise, the ability to do light gaming is worth it for me.
That was not the only fakery :-)

At correct time:
https://youtu.be/H6EbDCxotdg?t=488
There are so many great Linux versions now which are end-user friendly. I've been impressed by Linux Mint and of course Ubuntu. The hardest part is just picking one and sticking to it.
I think it's all right. You could even accept csv's to do this thing. For the post or update it would be resource/import
Has one political party in India got a long history of using voting qualification mechanisms to exclude large groups of the population from voting at all?

Because the US does: these mechanisms replay the old literacy tests which were used to disenfranchise immigrants and Blacks in the US until the voting rights act was passed.
I zipped a five-year undergrad program into three while maintaining a better-than-perfect GPA, while still balancing extracurriculars and a decent social life.

I don't think I ever nailed down a particular study habit, and did many things this article says not to do. I was/am a night owl and often stayed in the engineering buildings late enough to greet the night-shift janitors. I could cruise through weeks on 4.5 hours of sleep/night and kept tabs on which gas stations had the best energy drink promos. The handful of times I started homework or projects or exam review early ended up backfiring, so I stuck to cramming and my tests would still turn into the answer key.

I did follow some of the advice here, particularly between different but related topics (e.g. heat transfer and fluids, Java and data structures), but even there, I found looking for the relationship between two seemingly disparate topics to still be useful (e.g. electronic circuits as thermal circuits in heat transfer). I think what I'd like to emphasize is that everyone just needs to find whatever works for them, which may or may not be what works for a majority of others. I fortunately went through undergrad right before the deluge of productivity porn, and could definitely have fallen into the trap of worrying too much about how to study instead of just studying.
PBS Spacetime episode from a couple years ago about private space travel with a big focus on Branson's approach [1].

[1] https://www.youtube.com/watch?v=dWk9d_YCQOk
A funny thought.

Given
- how easy it supposedly would be to find someone to bribe with the inheritance one would get from someone like Bezos and Branson,
- how many people work on getting these rockets into space and those men back
- how complex and fragile rockets are
- how dangerous the whole endeavour is commonly believed to be
- that they both came back alive

Can we assume that all these murder mystery tv shows and movies have lied to us all along?

Unless falling victim to convoluted plots to murder rich relatives for the inheritance only happens to the rich but not the ultra-rich?
Spring removes math geek t-shirt because it included the trademarked word 'zeta'
Thank you so much for sharing!

I'm wondering if you'd like the app to prompt you to record specific sorts of things? Or if you would remember to use the app whenever there's something you'd like to play to yourself in the future, and just focus on the voice recording part.
I'm thinking the prompts could be set up sort of like this: https://ibb.co/f9WHzYC

And then every morning, you could get a notification to listen to a random selection of previous recordings.
6. Teach others and fill the gaps in their knowledge.
Your comparison between vehicular homicide and commercial copyright infringement would work better if the perpetrator of the former were not protected by diplomatic immunity.
Let's hope Elon Musk gets cold feet and doesn't fly on that ship. SpaceShipTwo is a pretty atrocious design, safety-wise, compared to what you can accomplish with a capsule and vertical rocket for suborbital spaceflight.

https://www.space.com/elon-musk-will-fly-on-virgin-galactic
Mozilla VPN is just Mullvad rebranded, and there's no geo restriction to joining Mullvad. https://mullvad.net/
Being able to pay to bypass TSA or cut the line for TSA has always been a thing. Private jets, Precheck, and this monstrosity where you pay a private company to become a more equal member of US society:

https://www.clearme.com/support/tsa-precheck/how-does-clear-...
> I'm a big fan of talking to people. The outcome of that talking may turn into documentation,

For any nontrivial design, it must. I expect that many people in this thread are coming from the Google (or Amazon?) perspective where a "design doc" is a formalization of a collaborative conversation. For small designs, it may be just a mild reformation of a set of meeting notes (you should take notes when you talk to people!). For larger projects, there's an iterative process where you start with a proposal that may be that, and get it reviewed and ensure you cover all the aspects that it will impact.

I've been on both he giving and receiving end of the "oh hey you may need to rethink this due to XYZ" at what was assumed to be late in the design process. THat's annoying, but much less annoying than spending 2 weeks or 2 months building a thing only to have to throw that effort away.
This is very useful in hard to reach areas, examples: Prudhoe Bay in Alaska or Uyuni salt flats in Bolivia. You can go there yourself, no one is stopping you, but there's no infrastructure and basically no people for hundreds of miles. And I doubt it will ever change unless the infrastructure gets developed in those areas.
>Was the whole password to SSH key switch annoying at all for anyone else?

Never was an issue for me because I'd always been using keys in the first place. I imagine it's less common for folks who don't manage servers, but all of my prior ssh usage had switched to keys over a decade ago.

>Like procedurally its simple but I have a bunch of accounts, a bunch of different repos.

Definitely recommend looking into creating a ssh config if you're using different keys per account. (Notably you can set your IdentityFile (key to use) per host (which can also be set as something arbitrary like "gh-username")

There's a pretty friendly post here:
https://nerderati.com/2011/03/17/simplify-your-life-with-an-...

>Let me use a password if I want, these security requirements are becoming increasing absurd

I don't want my software dependencies to be compromised just because someone reused a password.

>Passwords are 100% the weakest link in our beep boop chain of trust, of course - we know this. But maybe they should just be rethought from the ground up instead of randomly affecting your users all the time with security nonsense.

Keys are rethinking it from the ground up (which seems to be the complaint), though there certainly are challenges in managing keys as well.
If something has positive side-effects, can it be called toxic?
The video which you all came for is here: https://osf.io/6amrp/
Some Facts About Viruses
We should start thinking about how to ensure that physical IDs will always be available

Or

Create a user controlled devices to store critical documentation like this (something like a crypto wallet but with an easier setup/interface)
> take legible notes by hand on everything that goes on the chalkboard

Disagree. Only take notes on what you don't understand.
You're probably right, I was speaking about authentication on the whole from an industry perspective. I'm allowed to be annoyed with something that disrupts me from Innovating™ so I used my post as an outlet to do just that.

P.S. no the email that came is was related to a personal access token for my own special projects account. Maybe they defaulted to some expiration period, don't care enough to go out of my way to find out right now.
Is that what you were saying? Because I'm trying to disagree with you. You seem to say that banks are not magically creating 10x money, that it only lends out money that was previously deposited. This is not the case.
Conduit Beta – Matrix chat server
Moderation isn't censorship, and moderating out 5% of a userbase that makes 95% of the noise doesn't really say anything about society. I don't expect this comment to get much love in a thread linking to patriots.win, a clone of one of the most heavily moderated and hateful subs in Reddit history.