skysight-inc/HackerNews huggingface dataset:
Tell HN: Codecov learned nothing from their security breach
See https://about.codecov.io/blog/introducing-codecovs-new-uploader/

I'm just stumped by the stupidity of Codecov.

Codecov's security breach involved someone gaining access to their repo, modifying the bash uploader script to -- apart from uploading code coverage reports -- also upload all (secret) environment variables set by the CI pipeline. This affected many people.

Apart from discovering this months too late, their initial "mitigation" was to do checksum validation on the bash upload script. However, they failed to understand how that works, as they downloaded the checksum from the same URL the bash script was downloaded from. [1]

Now they released a new "uploader" where the blog post mentions:

> A compiled binary makes it more difficult for code to be modified by a middle man.

which only proves their stupidity. Clearly you can replace the binary with a binary that calls the original binary and steals CI secrets too.

And their installation instructions from the blog post are as follows:

curl -Os https://uploader.codecov.io/latest/linux/codecov
chmod +x codecov
./codecov -t ${CODECOV_TOKEN}

That is: a non-versioned URL, and no checksum verification. No lessons learned.

How is this company still in business?

[1] https://github.com/codecov/codecov-action/pull/282#issuecomment-823195201
I think the author of that blog post prefers Mercurial.
https://en.m.wikipedia.org/wiki/The_Nature_of_the_Firm
You don't have to guess and wonder. What happens is that a small percentage stays dependent, but the majority becomes economically productive by getting education and jobs.

If you can afford to keep people afloat, you should do it. The less complicated and less strings attached the more effective and cheaper is your solution.

There are people who steer the discussion to those who stay dependent. They claim that some of those are "incentivized" to do so, in other words: they are lazy and greedy. Well that's true, and it's a problem. Primarily because they can be used as an excuse and as a scapegoat to distract from the fact that capital _owners_ are extracting power and value that is generated by workers and small businesses.

What would I do if I were in that position? Be Jeff? I don't know, I'd probably be just as full of myself to believe that I deserve to be treated like a monarch and be able to buy what ever I want, while cheating my business partners, exploiting and surveilling my workers, manipulating my customers and ignoring my responsibilities as a citizen.

Power should be somewhat proportional with responsibility. I'm pretty sure it isn't, not at that scale.
I hope you expect every single vaccine production lab to do control studies on vaccine effectiveness.

Otherwise you're just arguing with double standards trying to console insecurity.
domesticating dogs refers to multigenerational breeding and selecting for genetic traits.

in the sense of domesticating meaning training, I wouldn't call what you can do with a wolf "perfect". Don't leave the baby alone with them.
Top Waterloo Hottest Tech Companies
Looks like the booster had a much more graceful touchdown than the capsule did. (An impact at 10 mph is nothing to sneeze at.)

I think we are not far away from the 1950s sci fi image of a rocket ship landing as a whole.
I did not imply they should. I would always recommend cutting out as many middlemen as possible, and reading the source material.
Some names I recognize:

Jive Software
Engine Yard
Really? I actually read it fine as-is, and I’ve got the smallest iPhone (SE 2020) and a badly cracked screen.

I much prefer this plain HTML style, and it’s easy to change the font size, pinch to zoom, rotate to landscape, or use reader mode. I actually prefer this to the non-zoomable “mobile”-ified modern webpage. The larger view makes it easier to keep track of where I am in the text versus a contextless feed of huge font text.

Try holding your phone in landscape!
If it changes at most once in 30 days, that seems different from AWS.
Climate change contrarian gives us important reminder about science in general
I heard it’s the Qualcomm power management silicon that’s in short supply
First, a nitpick about a theme prevalent in psychological research: drawing sweeping conclusions from a single specific experiment.

Here the "broad conclusion drawn" is that depressed people see the world more realistically -- which if true could have sweeping implications in many areas of life (e.g. they would make better stock pickers, they should be put in command of armies).

The single specific experiment is a 1979 study on correlation between a light bulb and a button. Has this study been replicated? Is the result robust to trivial variations, like predicting a biased random walk, or a continuous correlation (like how hard someone hits a pad versus how many lights light up)? Where's the literature review article for the broad conclusion? (Oh right, this is Vice!)

Now that the nitpick is out of the way, suppose the conclusion is true. A thought experiment would be would a person who estimates light-button correlation accurately be the best at a particular job?

If you wanted to get the best statistical estimate of a correlation, then the more realistic estimator is best for the job. But imagine a situation where you press a button and a green light would light up 10% more often if you press the button versus not. If your goal instead is to get the maximum amount of green light, you'd actually want the person to be pressing the button as often as possible. You'd actually want the person who overestimates his own effectiveness because he'll put in more effort and yield better results!

Generally speaking, it's possible that someone who moderately overestimates her own effectiveness in the world will be better at getting things done in the world, versus the realistic estimate.

Partially related, but I'm reminded of Elon's quote:
> I’d Rather Be Optimistic and Wrong Than Pessimistic and Right
Until your program is run in a emacs window (lint-staged’s progress bars mess up magit’s output buffer, making it really difficult to figure out what the problem is) or is piped through grep.

tput will do the right thing because of terminfo, hand-coded escape sequences will make someone curse you.
GP told about "a government". You rephrased to "The people running our society". If we accept the fact that this people is, simply put, the rich and the giant corporations... they have a lot to gain from some kind of fascist society. That's the heart of fascism: a strong government serving the rich. They do have to gain a lot from the masses ignorance, irrationality and short sight. Not that I'm saying they all adhere to fascism, people may have principles that contradict their most direct interest.
> how hard it is to buy your way into a top school.

Just to add dimension here, I think this is a pretty hard claim to prove. I think it would be safer to say that these types of situations are most likely the exception and not the rule. Even if that's not true, we should address that rather than cutting off our nose to spite our face. Otherwise, I think you make a lot of great, succinct points and I agree with everything you said here.
The reason these statistics are hate speech is that they conflict with the mantra "trans women are women", and the view that goes with it: that men should be allowed to compete against women in sporting events that have until recently been organized so that woman could compete against each other.

We are living in ugly times, when the most popular social media platforms, with an outsized influence on young people, enforce this misogynistic ideology with a militaristic fervor.
Ah fun, a baseless ad hominem attack.

The feds sets the prime rate which then works its way down into the corporate markets. Corporations right now are borrowing at 1 or 2% interest rates, but if the fed rate goes to 5% then those corporations will have to roll over their existing debt at 5 or 6%.

BTW, I majored in finance in college and worked at Merrill Lynch. 12 years ago I started my own company and have 200 full-time employees. I think I know a little bit about how the economy works.
Now try a merge.
> Even though i'm no fan, i think that capitalism is a matches better with our genes.

Capitalism can be great for all. Unfortunately, in the US at least, we only have crony capitalism.
Many brands do not want to sell branded products at a discount, so they see the store brand as a positive.

Some stores manage to get their brands recognized as high-quality, but not nearly as many as you probably think. The usual consumer recognition is that they are knock-offs. So the more known brands don't see them as direct competition.
Pope Francis and the Pursuit of an Alternative Hedonism
2020: https://www.wsj.com/articles/apple-delays-mass-production-of...

2019: https://asia.nikkei.com/Business/Companies/Exclusive-Apple-c...

2018: https://www.theverge.com/2018/11/19/18102562/apple-productio...

2017: https://www.techspot.com/news/71509-apple-slashes-iphone-8-p...

2016: https://www.theguardian.com/technology/2016/jan/06/apple-sha...
Biden works to expand Port of L.A. to 24/7 operations
Hey thanks for the reply, it's always a little less worse when there is someone out there sharing the same struggle! It's a shame we can't bring back the Craftsman company we once knew. An acquaintance had a household fire that melted a set of drivers and craftsman replaced with a full set no questions asked through the local Sears. I wish more companies were like this in 2021, but I understand why some can't- surely these policies have seen some level of abuse. Take care, I hope you find your grips. (Try estate sales)
Labeling people as part of some group of undesirables seems to be a very popular way of not having to meet legitimate criticism these days. I wish we would be better at calling it out.
I'm less familiar with downtown but the whole area around where the Lincoln Tunnel access is in Midtown is a snarled mess. You have the Port Authority, aka one of the world's worst bus terminals, and more generally just a bunch of intersections that are such a mess that you need cops directing traffic because otherwise you just get gridlock between cars trying to make turns and pedestrians trying to get across streets.
It's important feature, makes a real trade-off between fighting back and fleeing. Otherwise you could do both.

Dota also has many mechanics around where you're facing, getting damage reduction from certain angles, or even getting stunned when facing towards someone. If it was instant these things won't work.
I honestly think the vendor lock-in argument is overdone. I don't really care that I cannot move from GCP to AWS. I picked my vendor and don't see myself moving. Some companies are looking at hybrid solutions, still using vendor tech and relying on that is not something that is outright avoided, rather often embraced due to decrease in operational overhead.

The VPS "cloud" is the more cost optimizing, DIY group, which I know less about the motivations and market for.
Follow the money. I'm sure that they're revenue dropped since not producing new numbered versions of Windows. Now would be about the time a new version would be coming out. Windows 11 even if it's the same as what you'd get via updates would still mean that they can sell more new licenses and a bunch of upgrades, especially corporate ones down the line.
Is that not what sales tax is?
Intellectualization
Current state of A.I. in a few words.

I drew a closed fist, it says moon / alarm clock.
Oh yea, it was the cholesterol bogeyman.

It's interesting to see the snap back over the last 10-15 as fat has become more acceptable again as sugar is now the enemy. The one food that seems to be holding strong is yogurt where nonfat yogurt is still king.

The turning point for me came when I started drinking whole milk again and realized that I consumed fewer calories with whole milk and felt more full.
Is there a way to avoid paying that fee, if you don't need a public IP address? E.g. can you get NAT for free?
It's the best system that ever was, and still the best, but ruined by crony capitalism in a lot of places.
Depends. Some Atari 8 bit games used the display interrupts for timing, so those could run as fast as possible so long a the display interrupt happened at a consistent 60hz. (now that I think of it, I think some games has issues in countries with 50hz updates)
We show temperature fingerprints for all the weather stations in our network, you can find links to the data sources here: https://weatherspark.com/y/147186/Average-Weather-at-John-F....
They're taking on financial risk but I wouldn't call it entrepreneurial risk. They can list any number of products at time, risking nothing but money. There's nothing innovative or novel being added to the world.

The closest thing to entrepreneurial risk is the "creating demand" claim but that seems unlikely to be very true in most cases. In most cases, they're likely capturing demand on Amazon itself by being among the first to list a product.

It seems pretty clear that they're arbitraging and Amazon is taking advantage of its position to out-arbitrage them. In many cases, it seems reasonable to assume Amazon would've tried selling the product themselves regardless.

These arbitragers probably just have to accept that the reward for finding new products to arbitrage is very time-limited, because if Amazon doesn't start competing with them, someone else will.

This is a great example of a ruthlessness, but highly functional, capitalist market. It seems to work out great for consumers, all things considered.
> Jeff Bezos is a billionaire because the company he created and led for the past 20 years is an insanely productive business. People want to own shares in his company and that is why his holdings are worth so much.

Ah yes, like any other warehouse that has kept stagnate wages for decades, but still manages to squeeze even more efficiency out of its workers, i.e. underpay, overwork, and exploit its workforce (70% of its workforce are, essentially for all intents and purposes, warehouse workers)[1].

Have you worked in a warehouse before? Have you worked at an Amazon warehouse before? Have you atleast read any of the, some may say shakey, news coverage on Amazon warehouses?

It's immoral. It's inhumane. It kills the soul, and keeps poor people with no other options in a tragic 10+ hour death march 5 days a week. There's little time or energy to find a better job, you're too exhausted from working all day to even think. Even if you could, when would you find time for an interview? There's an obvious unwritten rule within this type of work that: 1). You're not getting a day off 2). If you take a day off, management will start looking to replace you for someone more "reliable."

> This is an impossible standard to meet. In a system as massively complex and chaotic as an economy there is no way for any business to pay/charge the "right amount". Not only is the fair amount an unknown value, anything resembling a fair price is only discovered through overpaying/underpaying until prices regress to some middle ground. And then something inevitably happens in the world that necessitates finding a new value and the process begins again.

These are a very handy-wavey 3 sentences. It's not impossible to figure out whether or not you're underpaying workers. It's pretty simple: who makes up the bulk of your workforce? Are they people with options or people without? People without options will take anything.

[1] https://assets.aboutamazon.com/01/fb/29cebd144ec59269fe8ffda...
Why do we need regulation? Then it just becomes a thing managed by the powers that be the way they want? If we have properly shepherded data then we need no regulation. If a Remarkable tablet knows you only by a token and encrypts all of your data with your key then the Remarkable company has no access to your data by default even if they host it.
>They're less motivated to work and often just don't.

This is most impactful if you think money is the sole motivation for working. The fact that the U.S. has the highest volunteer/charity rate while one of the highest average work week rates for industrial countries seems to indicate otherwise.
I’m struggling to understand why the busiest port in the US doesn’t operate 24/7 by default.
This is a long play by Windows 3.1 developers who introduced hidden code which would execute mid-2021 to release automated marketing messages for "Windows 11" and force update the code base with small time UI changes.

During the development of Windows 8 this code was discovered by a select and secret group of people. However, it was impossible to stop the scripts, silently executing on servers which are running in inaccessible concrete enclosures in Redmond since the 90s.

Cutting power supply or opening the enclosure to get to these servers would severely damage other critical hardware so they started soft countermeasures. Unaware developers would spread Windows 10 as the "last" Windows release but the operation to mitigate the Windows 11 terror could not be endangered by exposing this information.

To avoid global customer confusion, they chose their own strategy to deal with the sudden upgrade to "Windows 11" in 2021. They took the narrative into their own hands and jumped from Windows 8 directly to Windows 10, inventing some plausible story about why Windows 9 was missing. This way, the automated upgrade to Windows 11 could be masqueraded as their own choice
The fact that people "bought" stuff that is nonetheless still stuck off the coast waiting to be unloaded suggests that the listed price paid is not the actual market price (if you had any expectations of receiving things quickly like you would have in 2019.) Likewise for anyone who had a plumber come to their house do work, paying 30% more and waiting a week for service.

Prices seem to be sticky, so it's not that surprising that it takes some time for higher prices to work their way into all facets of economic life.
NYSE’s new investment vehicle –‘natural asset companies’– tap into ESG fever
Codecs are algorithms how to generate B and P frames. I frames are just jpegs. Yes, codecs can split video differently, but in case of the same split the same frame will be encoded the same way. In most cases key frame frequency is just a number. Some formats like HLS cannot work with variable key frame frequency at all.
Why it matters, because different version of the same codec can replay the same video differently for B and P (no guarantee), but not I frames. So I frames are the most stable.
It's a dump of the state of the run-time environment, including data. Probably the easiest use case is using it as a savegame feature when you're working in the REPL.

It's not necessarily portable. Some lisps will use machine-independent bytecode, others use native code. I'm not sure which one Janet does.
https://youtu.be/QtgVxGkrX1Y?t=102

I mean, we can all wonder what was going through the man's head, but there you have it.

You can literally watch him come up with the idea all on his own in real time.
Both Firefox and Chrome on Android render it readably without reader mode though, it's fair to wonder why Safari can't do the same.
You can tell that it's not utopian because of all the definitely constructable and not at all unrealistic or impractical architectural renders made of a definitely extant white material of infinite strength and malleability.
This is the kind of post I would expect to see on Reddit, not here.

It's up there with "Porn viewers are more likely to be respectful of women" on the science sub-reddit, I didn't even bother to read the article because come. on.
There's a lot going on with restaurants in the US, and unfortunately the end result is going to be even more small businesses closing while the McDonalds and Applebees persevere and contniue to spread like the plague.

I don't see a way out of it either. Raise wages? Small businesses have to raise their (already elevated because they can't compete with Chipotle on scale) prices to compensate, people will look elsewhere. Eliminate tipping? Still have to raise prices, which leads to customers leaving.

Starting a restaurant is just plain fucked in the US.
Tour of a B-52 Stratofortress
Saqib Shaikh, a blind developer at Microsoft, gave this short talk on using Visual Studio: https://www.youtube.com/watch?v=94swlF55tVc

I realize this isn't a console, but I think it is a good demonstration of an expert doing typical developer activities.
Depends. ZFS mirrors are very snappy.

Single disks were never a recommended option for ZFS, it's a filesystem designed for arrays.
In the real-world world between almost always implies open boundary. Ask a hundred people to draw a point between two lines. I think none will draw a point on the line. When I enter the programming world, I carry over real-world concepts with me, and this where BETWEEN being closed gets confusing to me. Since I'm not a special snowflake, there must be other people like me who could be confused. Hence why I prefer not to use BETWEEN.
I'd prefer a "Double Debian" distro that does the following:

1. When I run an apt command, it goes ahead and runs an automated version of the command on a "shadow" apt on the same machine.

2. It measures the time it took to do that operation on the shadow apt.

3. By the time I respond "y" to the command, it uses the duration from step 2 to display a time-based progress bar that animates smoothly over said duration.

4. If the shadow apt command hasn't finished by the time I respond "y" to the command, it brings up Ms. Pacman for me to play for a bit.

I bet I'd be a much more satisfied user!
> by no means is this different from the store branded products you find at Safeway or Walgreens

It is different because Amazon controls exposure to products. In the store if I want ketchup, Heinz and the store brand are right next to each other and easily distinguishable. Amazon can bury the original product on page 2 of the search results. Also, its not always obvious in Amazon's search results that there is a viable option other than the Amazon branded product.
This is really unfortunate. For a while Firefox was really differentiating itself via the privacy space. If it's just going to be another Chrome, I might as well just use Chrome.
> The amount of waste and craziness, inequity, and straight out maliciousness that I've personally witnessed at the upper and upper-middle layers of large companies

interestingly places that are not controlled by democratic means, i wonder if these places were electable and up for challenge by everyone in the company if those behaviors you associate with non-democratic states would become less.
They sued the federal government decades ago for illegally collecting Social Security taxes and won. It's not fraud.
I really hope they add a keyboard with better arrow key/home/end/pgup/pgdn keys at some point. This is literally one of the most important factors for me in a laptop because I hate the way most laptops do them.
> Home is mounted as noexec.

Dude we just had a whole conversation about why this does fuck-all if you allow users to run commands like tcpdump as root. Your "properly locked down UNIX servers" are just placebo.

I gotta wonder if I'm responding to an elaborate reenactment of the 90s. In what universe are "plain users" running commands on a unix server, let alone a server run by a BOFH that blocks +x, but is totally fine with root escalation?
Multinational corporations don't like nationalism. I think the idea that big corporations benefit from fascism is an interesting one, but it doesn't square with capitalism's need to keep borders open to trade and capital flow. If you're proposing that someone is going to invent a non-nationalist version of fascism, that's again an interesting idea, but I'm having a hard time imagining it.