skysight-inc/HackerNews huggingface dataset:
That's a misunderstanding of sockets and ports. A port alone is not sufficient for anything, to send traffic across an IP network you need a socket, a socket is tuple of a port and an IP address. When a SERVER "binds" a port, what it's doing is opening a socket for listening against the address specified for binding (generally 0.0.0.0 known as INADDR_ANY).

Sockets cannot collide, therefore you cannot bind more than one service running on a host to the same socket, which means if both are using INADDR_ANY, they cannot use the same port. Nothing prevents you from having multiple IPs on a host, each bound by IP to the same port (which would be separate sockets).

For CLIENT applications, they aren't just utilizing sockets, they're utilizing connections, and a connection is a tuple of two sockets. You can have many many many connections utilizing the same port, as long as they don't collide exactly with the socket on the other side in their signature. There are various ways to handle this, but a typical one is that servers do a hand-off during connection initialization to a temporary port assigned to that connection.

So, Flask (a server), is saying you can't bind it to listen on a socket which is previously bound because it would cause a collision and violate the no-collision rule for sockets. But it doesn't in any way mean that port can't be overloaded by different sockets being bound to the same port.
>FSF is actually worse than closed source vendors because they are promoting ancient laptops with poor isolation and no security mitigations

but they are promoting such devices on ethical concerns, not on security concerns. they are not deceiving anyone

>Apple has spent the past 15 years building a secure platform. You may not like some of their reasons (e.g. locking down iPhones)... but in the end it results in significantly better end-user security than a "Respects your Freedom" device

you mentioned FSF fanboys before. there are way more Apple fanboys who are convinced that their Apple products respect their privacy and that their devices are impenetrable. what is worse, Apple markets itself based on this grotesque misperception!

if security and privacy is a vital concern for people, Apple devices are NOT products that should handle their security concerns! you promoting Apple as secure makes you guilty of the very thing you accuse FSF of actually

i would absolutely love it if there is a public non-profit organisation like FSF that is security/privacy focused - eg Secure Software Foundation - that would employ security experts to analyse and audit security and privacy of all software, free and non-free, and of course always open their findings immediately. moreover, i would definitely hope that such an organisation would be as autistic and unwavering toward open security and privacy as FSF is toward software freedom :)

the fact of the matter is, while you can support both free and secure software seperately, they are seperate matters. it is possible to come to a conflict of interest type scenario. secure-software and free-software, although often sharing the same concerns, are simply not the same thing
> It lets you build very resistant patterns: if your message-senders overwhelm your message receivers in HTTP you can end up with connection failures, get stuck waiting, etc.

I think the biggest drawback to HTTP in this space is that there's typically no coordination between clients and the server. Clients send requests when they want and the server has to respond immediately.

That becomes a big issue when you have an outage and all your clients are in retry loops, spiking your requests per second to 3x what they would normally be, on top of whatever the actual issue is.

Most of the retry stuff seems largely shared; i.e. your code should still have handlers for when Kafka isn't responding right. Kafka will only preserve messages on the queue, it won't help if you lose network connectivity, or your ACLs get messed up, or etc, etc.

> Regarding application patterns, ideally you're writing applications that read data from one topic (or receive messages, parse a file, etc) and write to another topic. Treating it as a request that will somehow be responded to later in time scares me and I wouldn't do it. What if your application needs to be restarted while some things are in-flight?

The pattern I've seen is to make the processing itself idempotent, and only ack messages once they've been successfully processed. So if you restart the app while it's processing, the message will sit there in Kafka as claimed until it hits the ack timeout, and then Kafka will give it to a new node.

As far as RPC, I'm not advocating that it's a good idea, but you could implement timeouts and retries on top of an event bus. Edge cases will abound, and I wouldn't want to be in charge of it, but you could shove that square block into the round hole if you push hard enough.
I was asking for a direct quote, not a left wing magazine article that is biased.

You owe it to yourself to listen to him!
I'd agree with this. My first internship in my CS degree was doing Excel automation in VBA for a business unit. It quickly grew to "hey, this guy can automate your mundane tasks" and I became very popular very quickly. It taught me at what point automation is worth it [1], and many of my clients were performing hours-long tasks weekly that I automated in less time than 1 single week's work would take them. Needless to say I had some happy clients. The hardest parts are figuring out the problem they don't know they have because they think it's normal, and the unfortunate cases of "sorry I can't help you" because the solution is more complex than the problem.

[1]: https://xkcd.com/1205/
>is a higher-level of abstraction to display for humans

Am I missing something here? Who do you think is actually writing this stuff? Aliens?

I just want the first 5 characters of an input string, or to split a string by ":" or something.

I have plenty of apps where none of my strings _ever_ touch a database and are purely used for UI. I'll ask this again: Why break strings _globally_ to solve some arcane <0.0001% edge case instead of fixing the interface at the edges for that use case?

All this mindset has done is cause countless hours of harm/frustration in the developer community.
Randall Munroes proposal was not in vain it seems:

https://xkcd.com/1813/

https://tikolu.net/emojimix/%F0%9F%A4%AE+%F0%9F%A4%A0
We wouldn't be having this conversation if the web tools were written that way. If the web tool is already running, Airplay will move to another port. The reverse is apparently not true.
Wasn't simulation done? https://github.com/Flowx08/Celegans-simulation
>This looks interesting, godaddy breach reported by sec, let me click:

>Wordpress

>Oh... nevermind
Designing Data-Intensive Applications: The Big Ideas Behind Reliable, Scalable, and Maintainable Systems
https://www.amazon.com/Designing-Data-Intensive-Applications...

I surprisingly really enjoyed it. Well written and it pulled back the veil on a lot of concepts that I thought were too complex for me to understand/enjoy.
It is one thing to be against a Mars settlement and another to be against space exploration.

E.g. it would serve the latter better if we would explore Venus, Europa, Titan, etc. than trying to live underground on a dead poisonous planet.
> For active customers, sFTP and database usernames and passwords were exposed. We reset both passwords.

> For a subset of active customers, the SSL private key was exposed. We are in the process of issuing and installing new certificates for those customers.

Wow.. That's quite severe.. From September 6th to November 17th.. I wonder will they do a full impact summary after they figure it out internally.
Lowest testing rate and sample size too… see no evil…
Sorry for the slow update, incident was triggered and analysis continues. You can follow at https://gitlab.com/gitlab-com/gl-infra/production/-/issues/5...

> Where else do people go for confirmation of problems?

You are using it already :) https://status.gitlab.com/ or if you prefer tweets, the updates are also posted to https://twitter.com/gitlabstatus

A more general approach I use - search on Twitter for the project name. If many users say that something does not work, it usually is not a "me" problem. Another strategy is to use websites which do connectivity tests from different locations (example: https://tools.keycdn.com/ping). You can use SSL scanning sites for that matter too.
I quit my job in May 2019... before the pandemic started.

I was working as a senior data analyst at an insurance company in Canada. The work was boring, thankless and pretty exhausting but I was paid well (for a data analyst, anyway). There were no opportunities on the data science team since I didn't have an MSc so I didn't have a clear next step. At the same time, I had started the OMSCS program that January and that was eating up my off time.

I was too busy just trying to stay on top of school and work that I just couldn't see myself having the time to prep for tech interviews or do some side projects to jump-start the tech side of my resume. I decided I just wanted a breather.

I resigned and cited wanting to get ahead on my degree. I figured this would be a reasonable narrative if the gap in my employment were to ever come up during an interview.

I spent 10 months focusing on school, enjoying my time and improving my development skills.

When I started looking, I applied to about 25 data scientist and a handful of ML engineer roles. I received no callbacks except for one ML Eng role which didn't go anywhere. Luckily an old manager was starting a data science team at another insurance company at the same time as I was looking. He basically handed me a data engineer role with a bump in compensation in early 2020.

If I reflect:

- It worked out extremely well for me. I left a non-technical job, had a nice 10 month break and ended up getting a development job where I get to write code all day. I actually enjoy my work now and I have learned so much since then. Zero regrets for me.

- At the same time, I underestimated how little my experience as a data analyst meant to data science teams. I would have had to apply to many more jobs to get something via the standard online application approach. I think that would have been really stressful.

- I ate through about 25% of my cash which was a little painful to watch.

I think if you have a strong skill set and experience profile, its probably just fine. If you were like me and trying to make a big switch (eg. data analyst to data scientist or some kind of eng), it was a risky move and I wouldn't recommend it without a plan. I lucked out. YMMV.
I wonder why Django seems to have a easier time in hiring, considering it should be a smaller market than Rails. Even on HN monthly hiring list Rails and Django open positions is roughly 3:1. And yet I rarely hear Django people ever complain about the lack of talent pool.
Fingerprint recognition has been mainstream in consumer tech/iPhones for 8 years. Surely it would have already happened?
There is this phenomenon

https://www.youtube.com/watch?v=oAatPPEaZDA

Specifically, online communities and communication tools tend to rot over time. Remember Paltalk? AOL Instant Messenger? Microsoft Messenger? ICQ? Skype? Lynq? Myspace? IRC? CU Seeme? WebEx?

Their replacements didn't win by being technologically better (you have to work hard to tell the difference between Facebook Messenger and AOL Instant Messenger) but because they deteriorated and people could get a fresh start elsewhere.
And see, that's a fear when I finish this degree in 2.5-3 years. I'll almost be 40, with no experience in a field other than my current one, and a degree competing with 20-22 year old competition that is likely willing to work for less, and work much more, to get experience.
Digital Markets Act – The FSFE Calls for Device Neutrality
> Running user input on a server would definitely be a security risk

What is lower than container/vms? I was curious about those online sandboxes that are great, can fire code in there/runs it. I imagine they clean out the user input but if you were to assume the container/thing would fail... can it still be considered secure/separate like a glove.
OK, so here goes fingerprint scanner on phones that some thought is more secure than Face Unlock and similar.
I have no expectations anymore with Unicode, so I’m not surprised at all.
But they said :

> We, GoDaddy leadership and employees, take our responsibility to protect our customers’ data very seriously

So that makes it okay right ?
NixOS is declarative in a comprehensive way OOTB, so that there's no other way to do it

Nix the standalone package manager offers some imperative ways of doing things, plus you can declare a package that depends on all your needs. Then there are a couple of optional declarative systems that you can use with standalone Nix which add extra functionality, like configuring services in a NixOS-like way or managing your dotfiles
HN is always the fastest to report downtime for vital development services, otherwise Twitter is relatively fast.

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu... is the query I use normally, replace `query=gitlab` with the service you're wondering about.

Maybe the best status page we could have would be a status page that just queries the HN Algolia API for "$SERVICE + DOWN" and checks if there is any hits in the last hour.
It's kind of funny that we are on the verge of having too much launch capacity. Right now, SpaceX fills their launch schedule with Starlink satellites, as nobody can produce satellites for launch fast enough to fill their launch vehicles at the cadence they can be operated. And that's only for Falcon. Starship, if it works, will give us so much launch capacity that we'll be unable to fully utilize a handful of vehicles for more than a decade.

Every satellite today is at the end of a long production chain with lots of bottlenecks, finding funding for launch being only one of them. We'll need assembly lines of them to feed this rocket.
That was one of the functions of the abandoned Nokia touchscreen project, maybe 2003. Instead of capacitance or resistance, it had pressure sensor on all 4 corners and rigid display panel. With those sensors the location and force of the finger could be accurately calculated. Likewise the panel could be moved up and down, giving the impression the finger is sliding on uneven surface.

I say one day this touchscreen technique will rise again, because it does not rely on electric properties of the "finger". You can have gloves on or use fingernails or hand prosthesis.
A good moment is in the offer/counter-offer phase. If you're talking numbers, when the person across the table says, "We'd like to offer you $x to join our team", don't instantly reply, but sit and mull it over.

(If this is happening over email, turn a few seconds into an hour or so. Similar practice.)

If you immediately say "no" it could give the impression you aren't interested or even considering them.

By giving a few seconds of silence, it telegraphs, "I'm interested in this job. I'm considering this carefully."

Then, give a counter-offer*. After your initial silence, you can say something like, "That is an interesting offer. I really like $Company, and I want to work here. Could we (don't use I/you, use "we") consider $x+n? I think that reflects my skills and experience well."

And don't say anything else, wait for the other party to break silence. Don't elaborate on your skills, no "What I mean is..." -- they've seen your resume, your code challenge, etc.

It is hard to do, but it can be very effective. Just make sure you keep a polite but firm stance. If they won't move on base pay, move to looking at signing bonuses, equity, etc.

---

* You almost always should do this, by the way. If you are at the point where a job offer is extended, any place worth working at is not going to instantly rescind the offer because you had the audacity to ask. Its letting the sunk cost fallacy work in your favor.
This is called the Expression Problem because, as you allude to in your example, it comes up all the time in compilers and interpreters when dealing with expressions.

If you're looking for an elegant solution (the first I've ever seen), check out the work by Kiselyov on tagless final encodings.

The core idea is to invert the interface. Instead of the expression types being objects that implement an interface consist ing of operations, or the expression types being enum values and the operations being total functions of those enums, the interface is the abstract logic of the operation, and the interface methods are the expression types.

Adding new operations is easy, it's a new interface implementation. Adding new expression types is easy, too. You create a new interface for the new type, and implement that interface for each compatible operation.

It does require typeclasses or traits or something like that, and if you want the full power you need language support for higher-kinded types. Look at the papers for full examples, but here's a teaser in pseudocode:

interface BoolLogic {
fn bool(bool) -> Self;
fn if(Self, Self, Self) -> Self;
}
struct Eval {
value: Anything
}
implement BoolLogic for Eval {
fn bool(value) -> Eval {
Eval { value }
}
fn if(condition, consequent, alternate) -> Eval {
if (conditon.value)
consequent
else
alternate
}
}
struct Print {
text: String
}
implement BoolLogic for Print {
fn bool(value) -> Print {
let text = value.toString()
Print { text }
}
fn if(condition, consequent, alternate) Print {
let text = "if (" +
condition.text +
") {" +
consequent.text +
"} else {" +
alternate.text +
"}"
Print { text }
}
}
interface NumLogic {
fn num(int) -> Self
fn add(Self, Self) -> Self
fn eq(Self, Self) -> Self
}
implement NumLogic for Eval {
fn num(value) -> {
Eval { value }
}
fn add(left, right) -> Self {
let value = left.value + right.value
Eval { value }
}
fn eq(left, right) -> Self {
let value = left.value == right.value
Eval { value }
}
}
fn munge<T: BoolLogic + NumLogic>() -> T {
T.if(T.eq(T.add(T.nu.(2), T.num(2)), T.num(4)), T.num(42), T.num(0))
}

If you're curious I'd highly recommend reading and implementing the papers yourself. Have fun writing a typechecker, it's surprisingly easy! (with HKTs...)
Because the perfect is the enemy of the good: https://news.ycombinator.com/item?id=27897975.
Just a clumsy way of saying "not within my threat matrix"
Idea Legos
>It should be fine for people who have nothing to hide.

If I'm a company, would I want my employees to give up proprietary data they hold just because they personally "have nothing to hide?" Anyone who thinks that's acceptable is someone who isn't worthy of trust.
I encourage everyone eligible to get vaccinated, but vaccinated people are also vectors. The vaccines don't reliably prevent infection or transmission.

https://www.businessinsider.com/delta-variant-made-herd-immu...
As someone who mostly has worked with minimal web frameworks (no ORM, admin site, etc), Django seems appealing. My only concern is that the ORM seems to be pretty coupled with different pieces of the framework, and I'd prefer to write SQL and wrapper it on a function on the model. Is my observation on the coupling off? Does anyone here have a good bit of experience using the raw SQL option for queries most of the time? I've seen people do it once and a while in situations they needed it, but no one who uses it as heavily as I'd plan to use it.
Dozens of looters rush California Nordstrom store
On the other hand I've done lots of work that directly helps a lot of people, from educational apps to philanthropic projects to programs with significant utility for global trade, but nonetheless after all that I don't actually think the positive impact on people is what motivates me or makes me feel good about my work—more the craft and the thrill of the chase I guess. It's been an interesting realization to me.
> You are using it already :) https://status.gitlab.com

Any reason why "Google Compute Engine" is highlighted in red on that page? Other entries seems fine that are also using it, but not the one where the service is currently broken. Makes it seem like the problem is Google Compute Engine is at fault, when that's obviously not true.
It is a nice idea (ASP.NET is a great platform), but it is not really ready for broad use.

I gave it a try, because I'm a .NET dev and nginx configuration always confuses me. There are a lot of things still missing from YARP:

- Configuration/API still has some rough edges
- For a lot of things (funky header stuff), you still need to write your own Middlewares
- Missing documentation for a lot of features
- No good Letsencrypt support
- Caching and cache conrol is also very limited
I agree it's well written but for me that's way more on the side of required reading.

I'm thinking about books you don't _need_ to read but that are just really neat or advanced discussions.
One thing that helps with not having a boss is getting customers paying for your product as quickly as possible. They become a type of "boss", but one you can easily "fire" if needed. This means scoping down your grand vision to what's essential for someone to pay. It's hard, but it's worth it.
I quit my full time job as a Software Engineer in 2019 without a solid plan. I had some money saved up and knew I wanted to work on a startup, and had a laundry list of ideas I wanted to explore. But none were built or had any traction.

I've tried working on side projects and startups while fully employed in the past and never made any serious progress. It was always too easy for things to drag on for months. For my personality type, I needed the pressure and continuous blocks of focus time to make any meaningful progress.

During 2020 I went through a few ideas and eventually landed on one that has since found some traction. I found a cofounder, went through YC and am now finding our place in a competitive market.

All-in-all, it was a great decision, and one I would do again in a heartbeat.
>Example, I invent a medicine for a rare illness that kills 1000 people/year. It costs me 1$ for treatment but when I want to sell this the money dudes make this calculations:

This analysis has a fundamental flaw because medical inventions aren't a one time thing, it's a iterated over multiple times. I'm sure the government expropriating the drug and selling it for $1 would produce the best outcomes for this iteration, but what about future iterations? In other words, what about all the drugs that won't be discovered in the future because there's no expectation of returns?