skysight-inc/HackerNews huggingface dataset:
> Nowadays a "mainframe" is just a 1U server

No it isn't. But I grant that there are probably people who incorrectly call their 1U servers "mainframes".
I’ve worked for and consulted at several security places that have built “agents”. These tools are typically C, C++ or Objective-C so that they have the smallest footprint possible for the platform they’re deployed on. Some are for scanning and reporting binaries for viruses, worms etc. some have “remediation” features that let the agent execute commands sent to it remotely. Most of them can be updated in place remotely.

Most of these tools are janky, poorly tested and I’m sure contain dozens of vulnerabilities of their own.

Edit: also, it’s invariable one dude with poor hygiene working on the agent at these companies. He’s usually at the back, in the closet. Most of the engineering work is on he backend and reporting, so the agent gets no peer review or formal security review.
Thanks for the suggestion. I do like Anime so I’ll definitely be tracking this show down
Why is this crap on hackernews? Get over it, we're gonna keep eating sweet delicious cows.
If you actually read OP's link, the charges seem to have nothing to do with the fact that these individuals once worked for the US gov. Instead, the US federal government seems to be asserting that knowledge of offensive security tools and practices in Cybersecurity consultancy is somehow ITAR restricted in the same way that a weapon blueprint would be. That strikes me as absolutely preposterous and I'm disappointed the defendants settled rather than pushed back on obvious federal overreach into the lives and careers of private persons.
Summary: The Golang team is deciding what ranked order TLS cipher suites should be used in. You are not able to decide what cipher suites to use, the Golang team sets that in the code and will update it as they see fit.

My take on this is that Filippo is taking a heavy handed approach here. This works for the majority of "dev write code fast ship it over the wall" scenarios. But it also falls apart in a couple scenarios:

* Companies/govt agencies which mandate the use of certain algorithms, such as RSA, and both sides of the connection are running Golang code. Now you need to vendor the TLS library to allow for what the company wants.

* If an issue is discovered with an algorithm it would be really nice to be able to turn off the algorithm in production until the issue can be patched. I'm not sure if this is possible with the current set of changes.
You make Facebook a healthier place by reducing connection and reducing velocity. The things that Facebook will absolutely never be willing to do.

You reduce connection and velocity by ending feeds that show you most of everything, and switch to making people manually seek out what they want to get updates on. People will overwhelmingly be inclined to seek out updates and connections that they get enjoyment from, rather than having agitation/reaction/trigger porn shoveled on their heads all day long.

Tear down that wall.

This would ultimately be labeled as encouraging echo chambers / bubbles. People are typically happiest in their own bubbles, and certainly the majority of the time. That was true 20 years ago. It was true 50 years ago. It will always be true.

If you make a very far left liberal type watch nothing but FoxNews as their information source, they will not enjoy it. That person is going to be happiest, by a dramatic margin, in their own bubble, swimming in their own worldview. That isn't a defect of humanity, it's perfectly ok. It's healthy to enjoy swimming in your own beliefs. People will not all agree with each other, what matters is civility, not agreement.

Stop being psychotic authoritarians and trying to force people to exist in a way they do not want to, an unnatural way. People want to live in their echo chambers, whatever that chamber happens to be. It's healthy to prefer one's own echo chamber the majority of the time (and yes, it's occasionally also good to step outside of that echo chamber). Stop trying to control them, let them live as they see fit (so long as they are not attempting to harm others), as they are happiest.

Stop pushing connections that should not exist. Not all people should be connected. Not all people will get along. Not all people will like each other. Not all people will agree on ideology/beliefs/whatever. That's perfectly ok, it's best that some people are apart, including friends from the distant past who may not like each other in the present. Facebook does the opposite and attempts to drive everyone to be connected, which was more or less their original mission. That's a mission that can only cause strife. A thousand friends? Bullshit. That's fake. That's 950 people that will just largely be annoying at best, with feeds you'll derive very little value from (or negative value). It's obvious what the outcome inherently has to be in quasi forcing so many fake connections.
If you want people to be fairly compensated for the work they do, forget salaries, look at the companies growth and profits. I think all employees should get a taste of any dispersal of profit, divided evenly, based on time served since the last payout. (Annually?)
Darknet Diaries [0] does an episode that involves DarkMatter

[0] https://darknetdiaries.com/episode/47/
It's a shame Chakra was abandoned with old-Edge. Time travel debugging was baked in, and I believe VS Code had UI support for it.
> 14 days out of 28

Out of 29 and a half actually.

I'm curious where the misconception that a lunar month is 28 days comes from. I believed it too but I can't find any good reason for doing so.
GitHub doesn't allow a "." or really an special characters besides "-" and "_" in usernames
Nikon's 2021 Photomicrography Competition Winners
Increasingly it seems like our elites look at The US as a resource to be mined, not a home, not a collaborative project.
More than just the accidents, you can keep up with all the random incidents that are reported (and could potentially have been worse).

Eg last month "Screwdriver tip left in engine during maintenance results in engine failure on take-off"

https://aviation-safety.net/
good news, Robin wasn't always a social scientist, he has a background in physics and statistics
It's common for aircraft and other heavy duty equipment's tires to be retreaded. Seems like a reasonable thing to do on passenger vehicles if it can be scaled.
And it's not something the untrained person is going to have any hope of pulling off. There is a grain of truth in the assertion--if the surface hit isn't too hard and the landing fall is executed perfectly survival is possible. Done correctly the energy is dissipated in breaking a whole bunch of bones but the truly vital areas aren't subjected to lethal force.
Support for this landed in Microsoft Edge v12, according to the table in the article. So it's supported across all major browsers, green across the board. But all that may be humorous lisense.
That was interesting game! Only regret it's too short by now
Follow a week later, via another HN link:

https://www.businessinsider.com/pay-transparency-salary-rang...

> That's all about to change. A growing number of states are enacting measures known as "pay transparency," which force companies to disclose their compensation levels. New laws set to take effect in Connecticut and Nevada next month, and in Rhode Island in 2023, require employers to provide applicants the salary range they pay for each position at some point in the hiring process. Four other states and two cities have enacted similar mandates, some of which also require employers to disclose their pay scales to existing employees.
Seems like one upside for tech workers is that this could finally inspire more companies to create decent tech tracks. It seems that many of the problems people have with transparency are related to people doing different/more/less work but who have the same job title when maybe they shouldn't. If 2 people contribute different orders of magnitude to a company they probably shouldn't have the same title. Different titles could then exist in different pay brackets (with different progression tracks, etc).
"Traditional hunting" generally implies "competent", "sustainable", and "only enough for the community's own needs".

Its sounds like the supposedly trained-and-certified "traditional" hunters here fell far short of such ideals.

If one wanted to end this particular tradition, that seems like the best angle to attack it from.
And see my response. It's not as conclusive as you think. https://news.ycombinator.com/item?id=28541687
Where is the proof?

Is the claim also that at an auction, when people bid on something and yell out a number, they are “secretly” telling other bidders to not bid more?

Markets all over the world for thousands of years work on the basis of buyers telling sellers what they are willing to pay, and sellers telling buyers what they are willing to sell for. The whole process of a buyer and seller coming to an agreement on price is central to determining movements of supply and demand curves.

If either buyers or sellers have sufficient control to dictate prices, then that is a separate issue of there not being sufficient buyers and sellers.

But price transparency always results in a better allocation of resources and a healthier marketplace.
You're arguing semantics now. Measles is effectively eradicated. Sure, if we all stopped getting the vaccine, there would be outbreaks. The important thing is that it can be controlled to an extent that it no longer poses a substantial burden on people's lives --- and the reason it isn't eradicated is less than full vaccination.

The point I was responding to was this idea that we should just settle for covid being endemic. So I'm really not sure why you are going on at about semantics.
GitHub doesn't allow a "." in usernames at all.
It’s not his job to fix a paid product.
I don't think calling China as a US general is in the same bucket as hacking for hire.
I did some of the same things back in the day, just because viruses seemed like such a neat idea. There was a book that came out, The Little Black Book Of Computer Viruses, that was very helpful in learning such things.

Text of the book here - https://web.archive.org/web/20090420151624/http://vx.netlux....
What's EDNS All About (and Why Should I Care)?
A couple of years ago the gas pumps at station nearest to my place were replaced by devices with screens that play ads with sound - so far just touting discounts with their supermarket loyalty cards. They start when someone picks up the nozzle, and were annoyingly loud initially; the sound has been turned down a bit lately.

(Well, there's another reason for me to be pleased with having traded one of the family cars for an electric that charges at home ...)
Session Replay records the DOM so it can be replayed like a video. Replay.io records the browser input so the browser session can be replayed again.

The biggest difference is that when you're viewing a replay, we're re-running the identical browser on our backend. This way you can debug the real thing.
Everyone in the comments is talking about using this for their own debugging, however I think the way to win with this as a business is in two places
QA and Automated QA.
If you have real human QA people in your org and they could run this while doing QA. If they hit a bug, and could then share a simple link to the dev team that captured their issue + the stack.

Same goes with automated QA. Record the UI tests using this, and if one fails, store the state + stack.

There are a LOT of hard problems in that workflow... Good luck!
Unfortunately, Firefox dropped support on PWA. As a result, only Chromium-based browsers are supported.

https://news.ycombinator.com/item?id=25972527
I hadn't thought of it this way, of the thing being sent to defend actually being the point of attack - makes sense as a strategy.
Zettlr does almost the same*; and it's markdown based so you can get non-technical users working with raw code without freaking out, thanks to its in-place preview.

* (as long as what you really need is technical writing, and you don't need that magical unicorn of a complex DTD componentized content reusing).

It's also open source, which helps with integrating it in any DevOps workflow you want to use for your documentation.

[1] https://www.zettlr.com/
It's not about money. It's about aristocracy. Aristocrats aren't necessarily richer than the middle or working class in monetary terms. Class is more about status and power than about money.

If it were up to me, I would abolish the aristocracy and dissolve aristocratic institutions such as McKinsey that don't appear to contribute anything to society.

But if we're going to have an elite, let's at least hope they have the decency to shut the fuck up about how hard it is being a member of the hereditary upper class.
Better than Bobby Tables.

https://xkcd.com/327/
Wow, that video is pretty low key about how rediculous that guy's plan was. He had a month to learn chess and instead played around with machine learning algorithms then got destroyed. Shaking my head.
There's a lot of stuff that's ITAR restricted. You can't be privy to classified information such as submarine prop design, or turbine blade design, and then branch off your own for other clients using said information.
Does anyone else remember when you could "finger" the Coke machine?
> It doesn’t help that there is no good, clear and complete guide on how to upgrade SOAP clients.

> I went through this recently and learned that because jakarta uses multi-release jars, we have to do the regular dependency changes and also change our fat-jar based build/release to Docker images. In other words, they decided to throw out decades of users’ investment in learning the ecosystem.

Could you clarify what you ran into? Why docker? I'll have to do this soon.
It isn't that they aren't handling technology well. It is that a large segment of the population consists of terrible people. Technology is just their latest way of being terrible.
Maybe not treason, but surely espionage?
Previous threads on articles in this series:

Facebook knows Instagram is toxic for teen girls, company documents show - https://news.ycombinator.com/item?id=28523688 - Sept 2021 (624 comments)

Facebook has exempted high-profile users from some or all of its rules - https://news.ycombinator.com/item?id=28512121 - Sept 2021 (502 comments)
We haven't done too many comparisons with BioJulia since that paper, although we did address the (valid) issues they raised such as data validation (i.e. Seq now validates input data by default, but this can be optionally disabled). We did compare against them in our last paper in a sequence alignment benchmark: https://www.nature.com/articles/s41587-021-00985-6 (check the supplement).
At Glide we've set up Replay for a few power users who report a lot of bugs. It works when you can onboard them and explain what's important in a usable replay, in particular that they have to do as little as possible to show the bug, and make it clear what the bug is. My guess is that the replays we'd get from regular users would be much less helpful, though I'd love to try.
We make our finances 100% transparent, including pay, at https://bank.hackclub.com/hq/. I think other nonprofits should do the same. We also open source almost everything we do at https://github.com/hackclub.
Or at least partially mitigate one of Java's biggest performance weaknesses.
Automatic Image Background Removal Tool
so its true....hexagons are the bestagons

https://youtu.be/thOifuHs6eY
Not affiliated, I just thought this was interesting. And wishing this was available in GIMP :)
Honestly, this sounds like a terrible decision. Preventing bad decisions by ensuring that no dev ever needs to set the cipher order in the first place would be a good idea, but ignoring flags and removing developer control because Google Knows Best is a terrible idea.
It should also be noted that the positive effect rose to 35% for people over the age of 60, who make up the overwhelming majority of serious Covid-19 cases. The omission of this important fact from the article leads me to question the motivation of the author.
People like to use the term treason a lot, but as it is defined under Article III, Section 3 of the US Constitution, their actions are not treasonous. If you can prove otherwise, I am all for it though!

Specifically, the were charged with:

Violations of U.S. export control, computer fraud and access device fraud laws. The Department filed the DPA today, along with a criminal information alleging that the defendants conspired to violate such laws.

I think they are losers, scumbags and unethical and I hope that no one who reads HN ever hires them and that they never work in any capacity that comes into contact with IT, Infosec or any other hi-tech industry.
Yay! Free money for everyone!
At the time, what he wrote was state of the art.

Today, you could do pretty much all of this with a python script driving inkscape and LaserGRBL driving a GRBL-based home-built laser cutter for a few thousand dollars (I do basically that in my garage for fun)
Pizza-box sized omnidirectional antennas was the plan, I think. A couple of them spread out over a large area like a crater floor. And yes, they were looking at robotic deployment.
>so what are you asking for? and what are you asking me for

anything to substantiate your claim (eg. some rich guy's autobiography that says "yep, I work otherwise I feel bad about leeching off people's work"), otherwise it's an unfalsifiable statement and should be dismissed as such.
I miss old internet so much.
Their step 6: reward those who won in the prediction.

And is there a predictable step 7: one dollar one vote.

What if "billionairs" already feel they they have won up to step 6, and feel legitimated in that step 7.
Brute-Shark Tool New Version Released
I'm pretty excited about this version, after a significant refactor, implementation of a new network model and GUI improvements, BruteShark users can now get a full view of their networks including open-ports, DNS records and more with just few clicks! As always I would love to get your feedback :-)
Death rate from covid, or death rate from heart problems and blood clots in their lungs?

As someone (aged 42 years) with grandfathers on both sides that died from heart issues in their late 40s, early 50s, the side effects of the vaccines are more worrisome to me than the virus itself. I'm preparing myself to be excluded from society and yet I've already had covid and recovered from it, because that's not an acceptable form of prevention.

Oh well, back to my hillbilly roots I guess.
Seatbelts are highly effective at preventing car crash deaths, but if everyone wears seatbelts then 100% of people who die in car crashes will be seatbelt users.

It was always expected that vaccination would be less effective in elderly patients. Some research is underway now to see if that can be improved by administering rapalogs.
Amiga viruses (especially earlier ones) had a much easier time of resisting reboot, as they could simply hook the CoolCapture vector to remain running. This was an otherwise officially supported mechanism - Commodore’s own “recoverable ramdisk” (RAD:) hooked CoolCapture to allow the OS to even boot from RAD: (useful on floppy-only, high-RAM systems to enhance system performance by literally diskcopying the boot disk onto RAD:, as it was usually set up to be the exact same size as a floppy, although this could be changed). Popular virus scanners like VirusX and VirusZ quickly became able to detect these hooks and optionally restore the vector to the OS default (which would kill RAD: on the next reboot if one was using it, but as hard drives became more common, fewer people used RAD: in this fashion, so it was less of a problem).
> name an amount that would make you happy

This doesn't really exist. What people want is the most they can get, and this will make them as happy as is possible in the market. They would be as happy as anyone could possibly be about wages if they were offered an infinite wage.

"The amount that would make you happy" is a pragmatic minimum amount that would tempt you away from your current employment (or from further looking for other employment.) It's a buyer's price, not a seller's price.

> Why does their happiness amount affect your happiness? Would you be happier if they were paid less? Maybe they should be paid the amount that would make you happy instead of what would make them happy? Why? Their circumstances are different, they are different people, whose requirement for happiness is different than yours.

This is the problem with reifying the concept of an "amount that would make you happy." You've fallen into abstraction and spiritual condemnation. It's not illogical or irrational to not be happy with being paid less than you could be paid doing the same job, and it's insulting to treat employees like fools with this backwards logic.

If the employer is happy paying that other employee twice as much as you, why wouldn't they be happy paying you just as much? If they're happy with the deal with the other employee enough to continue it, why wouldn't they be happy with giving you that same deal? Really silly reasoning.
I tend to agree. No two candidates are exactly the same. Just like there's no pay transparency, there is no candidate transparency. With things I buy off the Web, I have option of returning if they were misrepresented or do not perform. With job applicants, you can't do that.
Anti-patterns in event modelling – State Obsession
I assume because the country is an ally they don't get in as much trouble.
Ask HN: What are good sites to post proposals for small software projects?
Small jobs, for example a stub project that scrapes a list of sites for readable content. Or a shell iphone application that draws financial graphs. Random developer stuff that could be typically done by a solo developer.

Or can anyone speak to their experience hiring from:

Upwork

Gun.io

Fiverr

Coding ninjas

PeoplePerHour
There is an incredibly well produced podcast episode on these ex-NSA engineers working for the UAE that came out a couple of years ago. Check out Darknet Diaries Ep47: Project Raven [1].

Synopsis is that the UAE hires ex-NSA employees as "penetration testers" and when they enter the country for cybersecurity work, some are pulled aside to be briefed to an opportunity called "Project Raven" to assist Emirati intelligence with targeting, allegedly in the interest of counter-terrorism. The thing is, only Emiratis have "hands on keyboard" while the US engineers sit beside them and guide them, which supposedly dodges any legal concerns. Those who Jack interviewed decided to leave Project Raven when it became clear they were targeting dissidents, human rights activists, and later, Americans. As you might imagine, ex-NSA employees who target US citizens for a foreign government are breaking the law. I do wonder if it's these ex-Project Raven engineers that have led prosecutors down the road to where we are now.

[1] https://darknetdiaries.com/episode/47/
These are fake internet points, I don't think that warrants potentially misleading future developers.
ScriptServer – A Minecraft server wrapper, allows for simple plugins in vanilla
Same way you work out how much your house is worth, you get two or more companies in a bidding war for your time.
I'm a complete dork in terms of cloud infrastructure and hosting, so I'm heavily drawn to providers with great UX/DX, documentation, simple interfaces, and predictable cost such as Linode, Cloudflare, railway.app, Vercel to name a few examples.

Whenever I have to work with Azure I get uneasy... (SAML...)

This is not great. In terms of ethical concerns I would rather use Azure than AWS for example.
Hmm, fat jars still work OK in latest Javas. What is the issue is with Jakarta multi-release JARs? A MR JAR is just a regular JAR with files in different directories. They should fat-jar together OK.

There's certainly no requirement to start using Docker images!
Firefox Suggest is part of an ambitious plan to change how we search