skysight-inc/HackerNews huggingface dataset:
Ask HN: Where to ask for feedback about a cryptography related tool
First of all I know that "implementing your own cryptography is bad". However, at some point, one does stumble upon a use-case that is not (well) covered by existing tools.

Now, assuming one has already done his due-diligence and has read (and hopefully understood at least the main ideas of) cryptography related RFC's / papers / articles / posts / etc. (especially in the area pertaining to what one wants to build), and thus we can assume one is not a complete newbie in this mater, however, nor is he an expert. Basically we can assume he is an "amateur".

Where would one go with his design to ask for feedback about it, in the hope to at least eliminate some weaknesses that one (as a non expert) might have overlooked. (I'm not speaking here about "proofs" or "audits".)

----

More specifically ---- but please let's not get into this right now, this being just an example ---- I'm trying to implement something similar to `scrypt` (the encryption utility, that uses the `scrypt` PBKDF, <https://github.com/Tarsnap/scrypt>) or `age` (<https://github.com/FiloSottile/age>), as a replacement to my current solution that relies on GnuPG.
Chinese titan lavished Hunter Biden with 3-carat gem, offer of $30M
The turkey industry is automating the front end of the plant
Go has an unsafe package.

Is there an example of even "bad" go code that gets you from a overflow to an exploit? I'm curious, folks (usually rust folks) do keep making this claim, is there a quick example?
This is an interesting idea, but it seems really impractical to me. As you point out, people enjoy some benefits from certainty in compensation. Outlawing a compensation arrangement far in excess of minimum wage seems questionable.

And how far does this extend? Can I not pay a contractor a fixed rate for a project? Or a fixed rate to handle _____ for me for a week? It would seem to encourage arm's-length contracting arrangement for services and coverage, which isn't ideal.
Probably got too close to "victim blaming" for the crowd here.

Being able to trust your hardware/software is important, but also knowing why you can't (for now, maybe not ever) trust your hardware is also important - maybe more important.
Valora Digital | Fullstack Senior Software Engineer, Senior iOS Engineer | Full-time | Zurich, Switzerland | ONSITE or REMOTE (within EU) Valora Digital is the product development unit of Valora, a European retailer with 2700 stores across 5 countries. We are tackling interesting challenges in areas such as Autonomous Stores, Ecommerce & Delivery, Loyalty, Payments and Process Improvement.

We're looking to strengthen our development team with the following roles:

- Senior Software Engineer, Backend/Fullstack (mainly F#, some C#, GCP, Terraform) - https://en.valora.career/job/zurich/senior-software-engineer...

- Senior Software Engineer, iOS (Swift) - https://en.valora.career/job/zurich/senior-software-engineer...

https://valora.digital/en/
Am I misunderstanding something here? This just seems like a bad suggestion from the get go. I have a hard enough time paying attention to a single meeting sometimes and forgetting some of the information. If there were two going simultaneously, I feel that my absorption of the relevant info would be close to 0.
I don't know about everyone else, but my evenings are far from entirely "personal time." Chores take up most of my evenings, so really I get maybe 1-2hr of personal time on work nights. People with kids who do sports probably get next to zero personal time, beyond maybe vegging out on YT/FB for an hour before bed.

Weekends are the only days where I generally "plan" to do things, and even then, Sundays are half reserved for chores like mowing/shopping. Having an additional weekend day that I can plan for hobbies would be amazing. For me, it's honestly akin to doubling my free time.
Hi op,

Based on some other comments I think the elitist remark is uncalled for in this situation. Looking again, you were neutral on it. I just assumed it was meant negatively.
Somebody help me discern the data table on page 7.

Relevant cases = 42,086

Fatal outcomes = 1,223

This can't possibly be right, or I am seriously misinterpreting the table.
Actually, we are talking the creators of rust here. The same guys who were owning it with the idea to rewrite the entire browser in it. The more plausible reason might be that the rewrite to rust haven't advanced to this component yet.
Seems like something similar happened to Google Pay[1] as well. With a few exceptions Google seems to suck at discerning between good and bad products. It'll shelve the likes of Reader or neuter Google Play Music, but insist on pushing garbage like G+.

[1] https://arstechnica.com/gadgets/2021/03/the-new-google-pay-r...
Same here, except I went the Plex/Plexamp route. Terrific experience.
That's what I'm trying to understand.

Let's ignore idiomatic code, people do crazy stuff all the time.

What's the go example that gets you from for example an overflow to exploit? That's what I'm trying to follow (not being an expert).
2021 Web Almanac – HTTP Archive’s annual state of the web report
C on the 6502 is pretty painful.
Yes they’ve received funding from DARPA. I realized I forgot that after I posted. Good catch. To my knowledge, that funding is for new anti-censorship transports to sneak traffic in and out of censored countries.
Running a single instance doesn’t mean not having a backup.
I don't personally click through on web search results from Spotlight (usually I just use Spotlight to search for an app or shortcut on my phone), but I think Siri is the biggest unlock here.
"just move to another area of the world"

This idea should have a name at this point. It's trotted out as a fix for some otherwise intractable problem without any hint of irony that practically nobody has the means to accomplish this. I see it brought up as a solution to so many problems its hilarious.
On the other hand I can easily imagine lot of applications that don't care about full posix compliance, and are perfectly happy to trade handling of some obscure feature for improved performance.
In my early 20s, I posted a video to YouTube showing how to replace sound effects in video games. A few months later, I was contacted about it by someone working for a small hardware company. They were making a haptics feedback controller for games and needed someone to help drive their product with some demos. They sent over a prototype PC-XBox controller that was wired up so that any audio signal would be split into mono: one channel would be heard by the player while the other channel would rumble the controller at set frequencies or with certain "textures". I ended up modding Half-Life 2 and Rayman: Origins to suit their demos. So for example, picking up items, attacking, or taking damage would all have their own sensations that they would trigger in the player's hands. They had a spot for a booth reserved at E3 and said that if I could make my way over there, they could get me into the expo. Long story short, I had my highest-paying gig at the time and was able to go to E3 for a couple of days just because of some fun I was having online. It was certainly one of the coolest experiences I've ever had.
The worst is people that ping you with a generic hello message and don't continue on with their actual question. Fortunately this get trained out slowly if you refuse to return a "hello" until they ask the question.
I tried the windows calculator app in my browser[1]. My experience was similar to many webasm apps in the browser; it took a large fraction of a second for input to cause a response in the app.

I'd like to try the linux version, but the only linux binaries are for snap, and my distro doesn't support snapd, so can't do that. Anyone know if Uno is married to snap, or if I'd be able to build non-snap binaries on my own?

1: https://calculator.platform.uno/
You clearly do not know what feudalism actually is if you are asking that question.

Feudalism is about a structure of hierarchical allegiences. You swear fealty to your count who swears it to his duke, etc.

The conflation is basically a shibboleth for Marxists in the same way that creationists pluralize evidence as evidences, and holocaust deniers ask if a conclusively documented and damning event happened.
I agree with you. But I think it's a relatively niche position (by niche, I mean less than 1% of the population).
Synthstrom make the Deluge, a popular groovebox (music creator) and have recently stopped all advertising and promotions because their staff were overworked trying to fulfill orders and they have enough money coming in to sustain themselves.
TL;DR:

* Uno is a vendor-led Windows/WinUI inspired and based UI platform that was originally concieved as a way to port modern Windows Apps to other platforms. Since then, it's evolved a lot of different capabilities and paradigms, but ultimately is basically cross-plat WinUI with extensions.
* Avalonia is a OSS platform concieved as WPF with some of the warts removed, and cross platform. It uses a lookless theming and drawing primites instead of native APIs/Controls to render it's UI.
* Maui is a .NET/Msft-blessed platform that is basically a rebranding of Xamarin.Forms with some improvements and renewed investment. It also largely uses native APIs/controls, and has a contruction style that is kind of a mix between WPF and WinForms.
The "Y" logo at the top makes it look too official. I'm not sure what is the standard way to show the logo to ensure that the data is from HN but it's not an official site.
Oh, and CUDA's "cooperative groups" are a nice abstraction for this "Execution-mask" handling.

But if you read older PRAM stuff from the 1980s or 1990s, they talk about "execution-masks" and manipulating it directly like this. So its helpful to know how this older technique relates to modern APIs like cooperative groups.
I wonder if we'll see a comeback of hand-curated directories of content? I feel like the "awesome list" trend is maybe the start of something there.

I would be willing to pay an annual fee to have access to well-curated search results with all the clickbait, blogspam, etc. filtered out.

Until then, I recommend uBlacklist[0], which allows you to hide sites by domain in the search results page for common search engines.

0 - https://github.com/iorate/uBlacklist
> > I am all for unions as long as they aren't mandated.

> Unions are not allowed to negotiate benefits and wages exclusively for their members.

Parent is talking about "closed shops" where a union uses its bargaining power to ensure the employer will only employ people represented by the union. On the one hand this prevents the free-rider problem you mention. On the other, this is coercive and can erode employees' ability to negotiate about things important to them.

It can also be inefficient-- I've been in workplaces where I got in trouble for moving a desk in my office a few feet, because moving furniture was a closed-shop union job, and I wasn't a member.
This hardly works at all for me. Spotify will happily shuffle the most recent 75-100 songs on my Liked Songs list, but something from 2012? Forget about it.
This one feature may get me to switch to Apple Music
This is not true. Lots of people are putting Rust on microcontrollers now - just have to stick to no_std.
Yes, it's a sound rule in general.
A different kind of Covid vaccine is about ready to roll
"If Spotify intends to dominate the industry, then the industry is in trouble."

Funny to suggest that Spotify may NOT intend to dominate the industry? Surely that's their goal.
Are there any [e]books focusing on ImageMagick? I use it a good deal, but it's one of those things where you _know_ you're under-utilizing it, and I'd like to take a deep dive with examples and sage wisdom attached.
SeedFi [www.seedfi.com] builds financial products for the 100M Americans who live paycheck to paycheck. Our customers are the most vulnerable members of society and our products tangibly improve their financial health. We're backed by A16Z and our founders have decades of experience in the lending industry.

There are many fintech startups trying to differentiate themselves, capture customers, and then figure out how to make a profit later. We're proudly starting from the other side... we’re adding the banking after getting the unit economics to work!

Many of the products we're building don't have any existing analogues in the market, so we're looking for engineers with an entrepreneurial bent. Our team experiments frequently, iterates quickly, and we use both data and customer feedback to measure our success.

We've purposefully kept a low profile, so we'll tell you much more about our products during the interview process!

To apply, please email your resume to jobs [at] seedfi [dot] com

OR

Apply on our careers page --> https://www.seedfi.com/jobs

*HYBRID REMOTE/ONSITE 1-2 days/week*
Ideally looking for people in SF or NYC areas.

Roles we are hiring for

Sr. Security Engineer [Super interesting work!]

Sr. Frontend Engineer

Sr. Full Stack Software Engineer [TypeScript/React]

Sr. Backend Engineer [Node/Express/GraphQL]

Staff Software Engineers

Head of Analytics
> With a library.

I don't know what that library is right now. Meanwhile I could set up the separate repos/microservices by the end of the day.

> That sounds like you need at most two different services, not microservices

It is unfortunate that the "micro" in "microservice" is often misunderstood to expect that these are very small and granular components. In practice by and large it ends up being separate services with separate repo, code review, ownership, deploy or CI/CD etc. pipelines. It doesn't have to mean they are actually very small. I know people like to joke about npm components and the leftpad thing but in my experience microservices have not turned out like that.
SEEKING WORK | US | Remote

Software Engineer with 10+ years of experience. Looking for fractional CTO type role or lead developer. Ideally part time hours but we can discuss longer hours if needed.

Have experience in Rails, JS, React, Vue, Python, Node.js, etc.

Email: myhnusername @ protonmail.com

Serious inquiries only. My rate is north of $100/hr fyi.
Everything is worse under Youtube Music. Embarrassing product.
BoringSSL started as a stripped down OpenSSL. That's very different from a ground-up replacement. The closest attempt here is https://github.com/briansmith/ring but even that borrows heavily the cryptographic operations from BoringSSL. Those algorithms themselves are generally considered to be more thoroughly vetted than the pieces like ASN.1 validation.
Is it considered cheating if I use another program (such as wc) to know the number of lines in the input file?
I am skeptical that you could do it without either using the assembler or the unsafe package, but we will see what Julian says.
I always found it fascinating the grade-A executable names which imagemagick was able to claim in the global namespace:

imagemagick /usr/bin/animate
imagemagick /usr/bin/compare
imagemagick /usr/bin/composite
imagemagick /usr/bin/conjure
imagemagick /usr/bin/convert
imagemagick /usr/bin/display
imagemagick /usr/bin/identify
imagemagick /usr/bin/import
imagemagick /usr/bin/mogrify
imagemagick /usr/bin/montage
imagemagick /usr/bin/stream
> Your logic would suggest that workers in tradable industries get paid less than those in non-tradeable goods and services, wouldn't it?

Not necessarily, as the laborers displaced by off-shoring are now competing in the labor pool for many other non-tradeable industries. That's what I meant when I said, "suppressing wages in industries with low costs of entry--remaining manufacturing but especially non-professional services." An increase in supply relative to demand usually will mean a lower clearing price (i.e. more people for fewer jobs usually means lower accepted wages).
> The brilliant ones are so driven that they will often succeed without assistance.

but brilliance for truly novel things is usually only revealed in retrospect. Might as well say "the ones who succeeded are driven and brilliant because they succeeded"

also, you are implying lazyness is a vice (because work is virtue?) however lazyness is also whence the value of comfort (i.e. of making things eaiser) comes. I'm saying there's a positive side to lazyness. (similar to "drive" or ambition, there's pros and cons to it).
Thanks for sharing this tip! Are there any guides you recommend?

Edit: Here’s one guide for the legacy Imagemagick (may not work for the latest release), https://legacy.imagemagick.org/Usage/compare/

I’m trying to encourage my front end developers to use visual diffs to validate rendering rather than use Protractor to test HTML/CSS.

I’ve known about BackstopJS, https://garris.github.io/BackstopJS/ and am on the lookout for alternatives.
Niche is fair. Basically, I'm trying to describe "not mainstream".
Location: Tennessee, United States

Remote: Yes

Willing to relocate: No

Technologies: Responsive HTML & CSS, Sass, Vanilla JavaScript, Vue.js, Nuxt.js, Vuetify, Shopify, Liquid, Firebase, Node.js

Résumé/CV: https://derick.work/

Email: derick.realwebdev+hnhired@gmail.com

Hi, I'm a remote front-end JavaScript developer with 6+ years experience, especially with UIs.

I look forward to your email.
I had a large enough digital music library pre-streaming services that I've elected to (mostly) keep maintaining my own library/playlists/etc. But I'm honestly not sure what I'd do if I were starting from Square 1. Would I really spend thousands of dollars to purchase songs/albums? Well I'd almost certainly pirate a lot--and TBH a fair bit of my library is Napster copies of previously owned vinyl--but there's still all the organizational effort.

And also TBH for files (and email) in general I used to spend a fair amount of effort filing into hierarchical structures. These days I do a bit of rudimentary sending to an archive folder or tag, delete older stuff (or not), and figure I can find something with search if I really need it. And, if I can't, it probably wasn't worth the effort to do the upfront librarian work anyway.
Expanding on #2, when thinking of things like Spectre & Meltdown ie CISC HW flaws, offloading or running a variety of services/daemons on physically separate machines can also improve security. We all get told to reduce the attack vector and this is one way to do that. The organisational hierarchy best exemplifies this security isolation point for an entity, like businesses, govts, etc etc.
It's not that simple though. Single-variable integer overflows can be checked like that, but when the critical byte in a buffer might be at positions 1 through {bufferlength}, you have to do a shotgun approach and see if anything sticks, and at some point the number of possible combinations grows too big even for that.

I'm not an expert on fuzzing myself, but generally I do see the point of having a limit here. Why, then, that limit was not chosen to be the max size for each of the length-checked inputs, I don't know. That does seem a bit more obvious, but also I just read this article so I can't prove that I wouldn't have made the same mistake.
The 6502 is a CPU, not a full machine - and the OS really is about interacting with the whole machine. You need to learn about a specific 6502-based system - the C64, the Apple II, the NES...

Moreover, usually when you’re writing a 6502 program, you’re writing a program targeted towards an individual machine, with no OS in the way - the program you’re writing is written against a particular machine; it effectively is the OS.

So the answer is: learn how to write programs for a 6502-based machine first. Then, make your program an OS. Your ability to make it anything like a modern OS is going to be limited, though.
chess.com/jobs
I understand Spotify actually has an advanced search (including range queries, lyric match and metadata like labels) but it's not documented well and the app itself doesn't present any options to the user.

https://support.spotify.com/us/article/search/
Totally agree with this. The documentation is very mid-1990's, and every now and then I'll see a fork to it doing something bonkers that I didn't know was in there.
Oh wow… If it is, I will probably rethink my subscription. I have uploaded a lot of music I bought in other services or ripped legally from CDs I physically own, adding DRM to things I own feels immoral to me.

Wish there were more alternative mobile OSs and platforms. Apple is getting on my nerves too much lately.
Ask HN: Why do people watch other peoples streaming gameplay
I have never understood this. Why are people watching other people play computer games? And especially seeing the often "stupid" behavior some streamers (a lot) do with all the screaming and shouting and acting really immature, etc. I honestly don't get it.
https://oskarstalberg.com/Townscaper/#MzJODmOgd6TMNh6DKtk6nH...
I had a friend who worked in a place like this and he admitted that they regularly went through people's albums specifically to look for nudes/videos. Especially if it seemed to belong to a young woman. It was routine - to the point that looking for nudes became boring.
Hi,

Website: https://rugpullindex.com

We're a async & remote only project. No offices, interview or incorporation.

No reoccurring salaries. We only pay USDC.

To get started follow our handbook [1] or write me an email.

- 1: https://github.com/rugpullindex/documents/blob/master/handbo...
Not from Apple Music though? I thought it's rent only. iTunes sells files, yes.

I still prefer stores that sell FLAC. Apple's aversion to common open audio formats always irritated me.
This is something I always preferred about the graphicsmagick fork, was the `gm` base command.
Isn't that a bit narcissistic to think that your one problem in particular out of millions is a sign that they aren't doing anything at all?
This is effectively the justification that was used to repeatedly confiscate land from the indigenous peoples of the current US: "They aren't building visible improvements on the land in the way that settlers will, so move them off and give it to settlers".
To be fair, Reader and Google Play Music did both outlast G+, so it's not like the garbage fairs any better.
I know what advent is, as I said I and my fellow countrymen do loads of advent stuff.

Why does that make this offensive?
SEEKING FREELANCER | $8,000USD (negotiable)

I'm developing software to autogenerate lyric music videos with alignment models. Currently we're using Kaldi under the hood and need some help on training new Kaldi models especially with sung english words. Additionally, we have on-going work afterward for multi-lingual and many-language support in the same song. The first project is to develop a relationship and then work on bigger milestones.

Email: praful@aionthebeach.com with subject: "Kaldi Project Freelance Work"
AWS Security Profiles: Megan O’Neil, Senior Security Solutions Architect
import is the most fun, when you forgot the `#!/usr/bin/env python` at the start of the script and of course the first instruction is import and you get an ImageMagik error
A lot of smaller companies are open to it once you've worked there and proven yourself.

My current and prior jobs have people in 3-4 day a week roles. But the people in those roles are senior contributors whose value to the company is as much knowledge as it is contributions.