skysight-inc/HackerNews huggingface dataset:
Agree and Disagree. Sanitization has it's place, but from a user perspective it's better to just outright reject (through validation) inputs that aren't valid.

There are often unexpected ways that data gets into the system (IT manually adding data, internal support tool to help customers add data, etc.) You need to ensure that you're properly sanitizing your input at every single input faucet and your sanitization has to predict how, when, and where it will be used by sanitizing for dangerous characters in filenames, shell, spreadsheet formula vulns, and XSS attacks.

Instead, (Or In addition to) just make the assumption that data in the database is dangerous, and ensure that you properly escape for your use case when using that data.

Using a username to create a new file? Escape for filenames based on which OS/language your using.

Using birthdates in an excel file? Escape for excel formulas.

Using bio on an HTML page? HTML Escape.

Using username as part of a URL path? URL Escape.

And finally circle back to the fact that sanitization where you change user input without their knowledge (like the "O'brien" -> "Obrien" example in the article) creates for a frustrating user experience.
Agreed, and it doesn't really matter but for some reason I felt compelled to mention, this same mechanism (putting token in profile page) has been in widespread usage for years so isn't novel. Keybase is one example.
It depends, is the wafer passing or failing the manufacturing tests? This is an important consideration.
But there are so many good games that have none of this bullshit. Check out Hades. It is so fun. And it is self-contained. The dev doesn’t even have interest in making an expansion despite demand because they made a fun, complete game and they’re done.

There are lots of games outside the pay-to-play arena, even AAA ones. The Playstation Spider-Man games are another great example.

Unless those get support, they may actually disappear.
Dark Forests and moving castles. You can form a small group, leave big attention platforms and focus on small meaningful communities.

It's one of the reasons why games like Minecraft and Stardew still get tons of playtime.
I'd call that normalization rather than sanitization, but that's my own personal terminology, not necessarily terminology that's widely used.
Ask HN: What's Going on with YouTube Search?
Not sure if this a bug or feature.

I searched for pro wrestling videos (I know), and mixed in with my search results where:

- cryptocurrency videos

- stock picking videos

- teenage reaction videos about random subjects

- a video about white supremacists

I really don't know what's going on. These videos have nothing to do with my search query, subscriptions or previous searches on youtube or elsewhere on Google.

They're not marked as ads either, they're just presented as straight search results - and there is no way to hide or block them.

What is going on with Youtube, are they so intent on torpedoing this business...
In the physical world there are folks who design bridges, dams, buildings, telescopes, furniture, and a million other things. All of those have unique requirements and skill sets. In software, we also make a huge number of categorically different systems each with its own skill set, but we call all of it 'software engineering.'

There are folks who are great at their job (called "software engineering") and their work never invokes their knowledge of algorithms. There are also folks who spend day in and day out tuning and designing new systems and deep knowledge of algorithms is essential (we also call this "software engineering").
I agree with "It’s about parsing a value into a type with a narrower domain", but I don't see how you get to the first sentence.

In their example of a markdown renderer, the internal-representation node is the type with the narrower domain.
Games aren’t a monolith in this respect. There are loads that don’t do this sort of thing at all.
-j 4
Yeah, the only way this is remotely feasible without massive latency and compression is a 802.11ay link, if it works when you're moving around. And since it's mmWave you'd need a base station in every room and 100Gbit ethernet to connect to it.
Very seriously: no, that’s not an aberration. Sexual abuse is at a massive scale and the abuse is highly normalized. America still has child brides legalized such that there are services to look up states to travel to in order to perform a child marriage by age, documentation requirements, fees, etc.
>How does it work?

>[...]

>LoginWithHN generates a unique one-time-use code that the user must then put into their profile within 5 minutes

I like the implementation, but shouldn't the code be something more explicit? Otherwise it might be easy to social engineer someone into putting in the code. Currently it's

>Put the token below in your HackerNews Profile ↗

>[random letters]

I think Keybase does something more explicit, with something like "my keybase verification code is xyz"
I wonder how this compares to, say, a basket of European countries, which don't suffer from some of the cost problems that US universities do.
There was a good reason that early MMOs treated gold-sellers as persona non grata. Allowing the trade of real money for in-game advantage (pay-to-win) strips the value from in-game achievements. Spending $1000 on some gold/items/runs is not particularly impressive or notable. It's just a function of your real life social standing.

There's definitely an audience for games where you can perform conspicuous consumption in front of your peers (see any Gacha game), but to me it's far less interesting than the skill/time-based competition it replaces. My impression is that a lot of the competitive, intrinsically-motivated energy in gaming that made old MMOs so addictive to some has moved into e-sports and speed running. Spaces where time investment and skill are still differentiators.
What's EQ in this context?
Except that your fovea moves around with your eyes and this is glued to looking straight forward. You get PPD gain if you're looking at the same thing that your face is pointed toward, at the expense of when you look off to the side. Not exactly "free" but probably worth the tradeoff.

How big a "sweet spot" do you have in the center? Enough to read lines of small text without rotating your head back and forth?
What sort of games do you enjoy playing?
Potluck...are you serious? There's nothing efficient or inefficient about the concept of potluck. It's a cultural celebration, not a "I need this to provide sustenance to my being".
There is a similar social issue waiting to blow up regarding genetic screening. Estimates are that 10-15% of children are from infidelity
I like 'Sherlock' by Everett Kaser. It is the classic, a cat lives next to the blue house, a dog rides a bicycle, Who likes french fries.

Immensely configurable, I play with 6 x 6. If you get stuck it has a nice hint button.
This is similar to the new trend of gamified workouts. Liteboxer recently announced rhythm-based boxing workouts on the Quest store. https://www.google.com/amp/s/www.tomsguide.com/amp/news/i-ju...
I understand they take a strong stance, but this does feel quite limiting if the expectation excludes nearly all cloud service providers… not even talking about analytics but just VPS hosting, database, CDNs etc
Ever wanted to relive the past by playing Red Alert 2?

Get ready to relive the past by brushing up on the particulars of the IPX protocol...
God, I fucking hate the current color grading trend of killing every color except for two opposing ones (usually amber and blue) and then pushing almost everything else into a chiarscuro of inky shadows.

Watch a 90s movie sometime and it will make you weep for how beautiful today's movies could be.

For superhero movies in particular, I think a big part of this is a deliberate attempt to distance themselves from the stigma that comics are for kids. They want to sell to an adult audience but adults feel foolish if they consume something too clearly sanitized and kid friendly.

The last thing any Hollywood director wants to do is make their superhero movie look like 1990's "Dick Tracy", or something in the Spy Kids franchise because it will drive adult audiences away. So they slather the whole fucking thing in grimdark so it looks like serious grown-up stuff who are too insecure in their maturity to watch a silly movie about dudes in spandex doing magical acrobatics and punching each other.

(This is also why so much YA fiction which is heavily read by adults is dystopian. And it's why modern superhero movies so rarely have characters use their actual superhero titles, which sounds corny.)
Electric, prop-driven ekratoplans.
but soare isn't a word
Where did you read this? Just curious, I'd like to share with someone I know that works in this field.
Lifetime odds don’t work like that.

That’s just last showing years W-2. Someone that made that much but retired in 2019 doesn’t count. It also excludes anyone that will cross the threshold at some point in the future. It even excludes people that got stock options worth that much but can avoid calling them taxable income right now.

Lifetime odds for a random American might be ~1:10,000. But not everyone tries to make that much money from a W-2 either. Becoming a school teacher is hardly putting your hat in the ring for that kind of compensation. Which arguably drops lifetime odds closer to 1 in 1,000 if not better for people that make a real attempt. I am trying to avoid any kind of truss Scotsman argument, but IMO there is a meaningful difference between random chance and stuff people work for.
Twice I've seen Bastion Hosts compromised. Both times it practically gave the attackers the highest access. In one case it basically hid where the attack came from (compromised logs and all). In another it let them hijack an admin's password by reading his sudo.

IMHE, Bastion Hosts suck.

If you are forced to use one, send logs to a safer one-way storage encrypted and put tampering triggers everywhere you can in the Bastion Host. Also make sure you log outgoing connections. And make sure you can easily match incoming to outgoing.

If you absolutely have to use sudo on the Bastion Host force it to OTP only. Or if absolutely not possible, use 2FA, but this is a risk as something somewhere might not be properly protected and the password will leak. But the better way would be to have the bastion host run on some read-only image and not letting it upgrade or do any admin task at all. Maybe even remove admin users, SSH, the whole lot.

And related, do not have a single account with god-like access to everything. Isolate permissions. This is probably the hardest to get OK'd but it's the classic SPOF where they got you by the balls.
Or more competition from older workers for entry-level service jobs, after the 2008 recession.
> Now, games are filled with pay-items which I guess some people enjoy, but it leads to not a lot of fun in some cases. For example, some games sell tokens that you can convert to in-game money. That essentially translates into a boring grind for 100 hours or pay X amount to skip that by getting enough money to buy the items you need to skip that content.

You are not looking in the right places, there are more great games coming out now than ever. Try Inscryption or Outer Wilds.
If you're unable to work "in the field" as a trades(wo)man, you can always switch over to supervisory or inspection works or go the fully office job route (=planning, architectural offices).
I wish people would hire you based on your skill level, and not strictly match your skill level with years of experience. Maybe someone with 10+ years of experience wants to get hired as a SWE, not a Senior or Staff SWE.

I have 10+ years of experience working at non-tech companies. Nominally I was a Senior SWE. However I am certain I am not at the same caliber as a Senior SWE who has spent his/her career working in Silicon Valley tech companies. I'd love to join a tech company as a midlevel engineer and work my way up again despite both my age (30s) and years of experience (10+). I've noticed there are some companies that outright disallow this. It can go like:

"You have 10+ yoe, you either interview and qualify as a senior/staff SWE, or we don't want you at all regardless of whether you'd make a great midlevel SWE"

That said, my suggestion is the current best way around this is to probably become a Leetcode Master. Not all companies make or break you over leetcode, but I'd say the majority still do, so you will have breadth of scope covered. Utterly wow them with your leetcode skills (which admittedly can be a completely different skillset from your day to day SWE work), and that seems like it can overcome many other perceived cons.
Realistic Resumé Tips for Tech Job Interviews
Nope not affiliated at all! I thought "unofficially" was enough but I'll make it a bit more clear

[EDIT] I added another disclaimer
EverQuest, sorry for the undefined acronym.
Everquest.
Apparently this is where most of the tuition cost is going
shudder

Imagine a president reading GPT-4-generated text from a teleprompter.
Exploring System76's New Rust Based Desktop Environment
There aren't many mentions of international students, many of whom are struggling very hard to get visa appointments abroad. US Embassies are still barely functioning and are not able to provide even the minimum of services they did before covid, if they're even open to the public at all.
I once had a recruiter tell me: “Elon Musk is one of the easiest people on earth to poach senior leadership out from under.” After eighteen months in the gulag of rocketry/EVs, many managers are ready to cry “Uncle”.

As a non-native speaker, I have the hardest time parsing this sentence, could anyone help me out?

What does it mean when someone poaches “leadership out from under” — does it mean that leadership grows internally, rather than sourced externally? Or that they’re fleeing away (assuming “poaching out” mean the reverse of “poaching”)

And I assume that the “uncle” in this case is Elon?
That's a really cool idea in a lot of ways, thanks for sharing it.

I do wonder if it could be parameterized for customization, kind of like CC-etc-etc licensing, but a bit more detailed. IOW, let's say you cross the barrier from small to big, could the resulting license effects be more gradual in that transitional zone? Just curious.
Amazon is important due to the widespread use of AWS
> Colleges assumed the trend of charging $25k to $50k per year would be sustainable.

It's worth noting that the vast majority of students don't pay the sticker price because financial aid is provided early and often (beyond just loans). Very few students are actually paying $50k.* [0]

The average net price at a public college last year is $19,230 and the average net price at a private college is $33,720. Note that this doesn't just include tuition, but also room and board. So if you're going to public college you're probably paying $20k to eat, sleep, and learn. Plus you generally get some kind of health insurance too.

These averages can be significantly lower still for in-state public colleges and community colleges.

No doubt the massive inflation in college prices is driven by the government loans, and the federal government's policy around them should be modified at best. But we should speak in reality instead of the hyperbolic articles that often just look at tuition which is what most people are familiar with. Colleges below the top tier compete on their "discount rate" which is what percentage of the sticker price does the average student actually pay because almost no students pay the sticker price.

* "The average grant aid awarded per student was $8,100 at public colleges and $23,080 at private schools."

0: https://www.collegedata.com/resources/pay-your-way/whats-the...
Can you tell which company this is? I would like to know.
Likely to be EverQuest
Lol. Get your house or car broken into, car stolen, etc. in the US and see how it goes for you. My last dealing with the police was waiting about 12 hours with my back window broken, unable to clean up, so someone could come by and "dust for prints" on the glass for 10 seconds.

There were 3 or 4 eyewitnesses who they never talked to and of course I never heard back.

Someone else I know had surveillance video of an unmarked tow truck with no plates picking her car up out of a garage. She had a hell of a time even getting a cop to watch the video, multiple phone calls to multiple layers of police over the course of a week or so. Never heard back.
I'd actually argue against this - I've been using my Quest recently to stream steam games over wifi on it, and I've been impressed with the capabilities. Overall the experience is seamless 95% of the time, and I don't notice any major differences between it and my HTC Vive. There are hiccups though - wifi will cut out briefly whenever there's any interference on that frequency, and you'll drop a few frames and quality will degrade for a couple seconds. Overall though I highly expect a stream over wifi 6 to be 100% usable for VR.
Again, FuturesUnordered cannot know the difference between a task wanting to yield and a task that wants to be polled immediately. The waker does not get this information, either. It cannot distinguish.
Reminds me of fuel injectors of funny cars. Watch it go from just idling, to full throttle. Then remember there's 8 of them on the engine. https://www.youtube.com/watch?v=xGTbQuhhluY
Fast Font Loading Techniques (2015)
see also, Cannabidiol Inhibits SARS-CoV-2 Replication and Promotes the Host Innate Immune Response

Preprint. 2021 Mar 10.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7987002/
I agree though I'd argue it's not a single axis of "bulkiness/easy of use", and more a balance between "bulkiness/ease of use" and "functionality".

The Quest (and self-contained VR devices generally) has done a lot to move the ball forward on bulkiness/easy of use, but IMO has not done a lot on the functionality part. Most VR experiences are toys that don't have lasting power. It is revealing that FB's marketing for the devices is overwhelmingly about a single game (Beat Saber).

I have a Quest 2 that has been sitting in the closet collecting dust for close to a year now. The experience is pretty mind-blowing the first few times, but there isn't anything there to keep me coming back. Once in a blue moon some novel (and usually rather short) VR experience will draw me back in for a day or two, but then the device goes back into the closet again.

The breakthrough hinges on the combination of easy of use and what the heck there is even to do with the device that is compelling.

[edit] Seeing some other folks opine about the lack of content elsewhere in the thread - yes it's true, but I think framing the issue as one about content leans heavily into the local maxima (which is a very low local maxima) we are in right now, where VR is really only about gaming. I remain unconvinced that gaming is the best use of this technology - and if we implicitly/explicitly define this as a "content problem" rather than a more general "things to do" problem I think we're missing something key.
Remember that we were in a similar situation in 2014. And at that point it was about the EU, not NATO.

Since then Russia has invaded annexed part of Ukraine.

So no one observing this should be fooled to think that NATO is really relevant at all. The NATO talk from Russia now is chosen as an impossible demand because they know it’s impossible. It’s used to be able to point fingers and say “look, they are being unreasonable”. The audience is domestic.

Whether NATO should be disbanded or not isn’t exactly a point on the agenda, nor is it fair to say that Ukraine (not a NATO member) has any responsibility in it.

What should Ukraine do here? promise to never join NATO? At gunpoint? In what way does that respect the sovereignty of Ukraine? (The same way it’s borders are respected apparently).
This seems a bit disingenuous, listing the max/center PPD for your product, and the average PPD for the Quest.
I'm sorry that it's difficult to discuss these issues reasonably based only on simplified analogies. Again, these are real issues with potentially real police or courts involved if it got serious enough, so there is only so far it's sensible for me to go with any examples.

Yes, the situation absolutely was a practical way of preventing fraud. It saved us a significant amount of money with no apparent downside except for a little time to implement the security measures and the slight GDPR concern we've been discussing. The pattern we were looking for in that case wasn't quite as simple as the name example, but perhaps you'll take my word that it really was almost as obvious but it did also have personal data/identification implications. As I wrote in another comment, it's amazing how dumb people are sometimes but even dumb people can still cause damage. I have a few other examples in mind where similar principles apply and those have also prevented material damage to the business and/or other customers.

Just to explain one detail that might look implausible, the grace period being exploited wasn't for new customers, who do have to pay up front. It was for existing customers who pay late (or, as it turns out, sometimes not at all) when further payments are due. Ironically part of the reason we allow that period beyond wanting excellent customer service is for GDPR compliance. We have an obligation to protect any personal data we hold properly and there is at least a plausible argument that deleting everything the moment an account goes overdue on a bill would not meet the standard.

As you have perhaps guessed, this is a smaller business and we do try to be a "nicer" one. Most of the time I think that is a good thing. However it does mean we don't have dedicated staff or budget for any issues like this. When someone on the far side of the world is trying to rip us off, one of us doesn't get to sleep that night until we've fixed the problem, if we can. Every time we have to spend time and money on compliance changes or taking professional advice and every time the business loses money to fraud, that has rather direct consequences for the personal finances of the people who are doing the work to run the business. We do take security and privacy seriously and we try extremely hard to stay on the right side of any relevant rules (far more than most professionals we talk to expect for a business of our size, and I'm told far more than a lot of much larger businesses with dedicated staff for this stuff).

But it really does boil my blood when people say things like GDPR compliance is easy unless you're doing dodgy things or they assume that because I don't agree it means we haven't thought about it or run a business professionally. If the issues were so simple and obvious, there wouldn't be 16 comments under my original one as I write this without a single citation of either the GDPR or any regulatory or court authority to back up any of the answers given or claims made.
Education is also expensive, arguably what the hell are we paying for then?
The gaming industry with all those tricks that help grow an addiction is way out of control nowadays. The worst type of it, gacha games, are essentially casinos for kids. I think there should be much more regulation of it. A society doesn't need hordes of useless addicts.