skysight-inc/HackerNews huggingface dataset:
Please keep in mind that your current "I have to x" may have been manufactured (or at least partially influenced) by the same attention-grabbing machinery you now want to escape from, so I suggest you keep some healthy wiggle room to accommodate new insights on what may or may not be essential for you in the future.
Banks tend to have terrible UX. A lot of that, is because they are so security-conscious that they can't move quickly or nimbly. I have known several developers that worked for banks, and their stories of their work environments have made banks a "No-How, No-Way," for me.

They did get paid well, though.

A lot of the Jurassic-scale security debacles that we read about, these days, seem to be of the "Why the HELL didn't anyone think this through?" variety.

Looks to me like impulsive "Ooh! Shiny!" programming.
Honestly at this point I’ve given in and am now advocating that we rewrite every damned widget from scratch in Rust, because by the time we’re mostly done, my career will be winding down, and seeing that shit still gets pwned like, exactly as much, will be “good TV”.

Rust is cool because it’s got a solid-if-slow build story that doesn’t really buy into the otherwise ubiquitous .so brain damage. Rust is cool because Haskell Lego Edition is better than no Haskell at all, and Rust is cool because now that it’s proven affine/linear typing can work, someone will probably get it right soon.

But if I can buy shares in: “shit still gets rocked constantly”, I’d like to know where.
Some microcontrollers used to have saturating arithmetic, which is basically the only other behavior that makes any sense.
Is anyone using Nix to standardize local development tool versions?

In our company — as in most companies, I suppose — apps rely on a specific toolchain, such as the Go compiler, Protobuf, linters, PostgreSQL, and so on.

Coordinating these is difficult. We have to maintain documents saying "install Go 1.17" and so on. Some people are on different architectures, though we are all on either macOS or Linux.

The other challenge is coordinating these versions with what's used to build and test. A developer might accidentally develop using different versions than what we build and run with.

Our solution for a subset of these tools is to use Docker. We have helper scripts to let you run some standard versions of some tools. But there is a lot of friction inherent to using Docker, especially on a Mac.

My idea would be to use Nix to specify the complete environment, and that thjs could also be leveraged to run exactly the same environment in automated builds and tests.

That would require running Nix locally as well as inside our Docker builds and CI runs (CircleCI, mostly). How difficult is this?

My concern is that it could be difficult to mix Nix with the parent OS if you don't adopt NixOS wholesale, which I think would be going too far. For example, imagine we want Go and the Protobuf compiler in our toolchain. If we used official Nix packages for these, they probably declare dependencies on things like libc and other libraries that Nix also provides. But we'd like to continue using our Debian Docker images. Maybe instead of using the NixOS packages, we could write our own package tree from scratch for just the limited subset of tools we need?
Science writing tip: Unlearn academic verbiage
The rise of "mindset" and "resilience" is just another chapter in the absurd poverty discourse.

Poverty is extremely simple to fix - just give people money. But rich people don't want that, so we can't do that, and it's largely taboo to even talk about it.

So instead of the real solution, we have to talk about all the fake solutions - education, marriage, mindset, resilience, learning to code. Andrew Yang even said that web3 was the most powerful anti-poverty tool we had.

Anybody who talks about any cure for poverty other than directly giving people in poverty more money is lying to you.
Memory safety is optional in Rust. It might not be obvious at the moment, because Rust is written by enthusiasts who enjoy fighting with the compiler until their code compiles, but once developers will be forced to use it on their jobs with tight deadlines, unsafe becomes the pass-the-borrow-checker cheat code.
I wish OSs would just can support for legacy stuff nobody uses and make it an explicit install for the 1% of people who need it.
I mean thats not really something any relevant to my comment, even if by profits it lags at 3rd place.
Yet its significantly ahead of Microsoft and Google.
And Apple doesn’t even have its own cloud business like Azure to take care of, so its very tough to believe Apple spent all its money on a novelty trick.
> After WWII Ukraine made a verbal agreement not to join NATO/EU.

You have no idea what you're talking about. Just stop it, please.

Also, look at the map and try to guess where the border between Poland and Russia is located.
10 years from now:

“security researchers find a blank Animoji file that ended up being a security exploit wrapped around an OS written with image files”
You'd have to prove it with numbers. Leaving loopholes like this one open could lead to lowering of wages in many industries, leaving more people below minimum wage, whether more drivers are hired or not.

And that's ignoring the fact people get support when they don't have work. (Yes, Centrelink sucks in many ways, but it exists)

Given the extremely low unemployment that you referenced in another comment, it doesn't look like we have issues with fewer drivers required tbh.
Again, from the perspective of a cyber security expert, all that is great!

Or rather would be great if Pegasus was the only 0-day out there. It'd be even better if Pegasus were the only 0-click out there.

Here's the thing though, it's not.

That's the world we live in. So the question is, given that fact, how do we get to a world where we can have some level of security? My belief is that everyone from the users to the app devs have to adopt a security mindset.

Users should not download that free app that lets you see what you would look like as your favorite French pastry. They should not click on the link in that sms they got from that strange phone number. They should be careful about giving out their phone number. Give everyone your gmail google phone number instead and let them send texts to that. Then check those texts on your gmail google phone if you're a high profile target. (Or even just a guy/gal who has a few people out there who really don't like them.) Keep a buffer between the world and your phone. Etc etc etc.

Devs want access to the file system. Awesome, but they'd better make sure in using that filesystem they are not inadvertently allowing users to take any actions deleterious to the system. Devs want access to the GPU. Again, no problem. But you'd better know how to write secure GPU code. There is no way a browser, or .NET, or Python or an OS can provide you access to a GPU "safely". If they give you the gun, they expect you will use it responsibly.

Browsers and other platform providers should also act responsibly. I understand developers want features. At the same time, is it responsible to hand out access to these features without some kind of plan to keep irresponsible devs from compromising security at scale? Sometimes there just is no way to do that, and I understand. (Access to the GPU is an example. Devs just have to know what they're doing.) But sometimes it is possible to do things in a more secure fashion, or to just wait on delivering that feature altogether.

Point is, for a secure environment, everyone has to play their part. There are so many of these 0-clicks and 0-days out there in the wild. Everyone wants to make a better environment. Well, I'm not seeing how that happens without getting everyone's cooperation. Or, at a minimum, getting everyone to be a bit more careful with their behaviors.
> and if you want to collect _all_ the energy from a star,

For what? What are you doing with it? Not to forget the fact that all energy used eventually turns into heat. All of it (with the exception of electrochemical transformations). You're bringing all of that into Earth you're cooking everybody alive.

How are you bringing that energy from the sphere to (wherever place)?

Putting solar panels on Earth itself works much better. Heck, make a Dyson sphere on Earth (facing outside), that makes more sense.
"If we could just have one more layer of abstraction, THEN we would be secure".

You'll end up making a standard library so big that it will never be secure. And even more portantly, you'll strangle innovation by disallowing improvements to the standard library.
I haved lived in a major 3rd world megacity for over a decade. I know the public transportation system quite well but still rely on google maps for time calculation, routes to new places, and using their yellow pages listings.

That being said i noticed recently what i would consider unethical behavior in the app and a major breach in the public trust.

When you ask for routing options in public transport it gives you the option in-app to add a scheduled pickup by 99 Taxis or Uber to the final leg of your journey. No problem there.

The problem is for those who prefer walkinag that last leg. the public transport options suggested to us cheapskates can be as much as 40 minutes longer than those with in-app purchases bundled. I could not find a way to select the better option in the app.
The thing is that we're really talking about different types of developers.

One type of developer wants to get shit done as quickly and painlessly as possible, so they can clock out and do something else. That's the traditional MS crowd.

Another type of developer likes to mess with stuff "just because". For him (because it's a him), excessive complexity is a value, since it provides "rep" once mastered. This is the unixy crowd, trained by a lifetime messing with Linux just to boot up - that's also where I come from, before people accuse me of disparaging people. MS steered hard towards that crowd with Nadella because they had lost them for a generation. That didn't necessarily result in a productivity increase for the first crowd, or even in general.

The thing is that really the "developers" mantras for these two crowds, are very different.
You could formally prove Unicode renderers are 100% correct. It's because they are 100% correct that they can be relied on to be exploited.

The weak spot when it comes to security is not the hardware or the software, it's the human mind.
Ask HN: Do you find working on large distributed systems exhausting?
Ive been working on large distributed system for the last 4-5 years with teams owning few services or have different responsibilities to keep the system up and running. We run into very interesting problems due to scale (billions of requests per month for our main public apis) and the large amount of data we deal with.

I think it has progressed my career and expanded my skills but I feel it's pretty damn exhausting to manage all this even when following a lot of the best-practices and working with other highly skilled engineers.

I've been wondering recently if others feel this kind of burnout (for lack of better word). Is the expectation is that your average engineer should now be able to handle all this?
> Is there any architecture that doesn't use twos complement (eg. uses separate sign bit + magnitude) and could run C code?

I think such machines are pretty much a thing of the past. This topic cropped up in a 2018 thread when C++ made the same change. [0]

[0] https://news.ycombinator.com/item?id=17190864
It doesn't say "remove from the atmosphere" but "remove from air".
> About 1,000 children have died of COVID-19 in the US

from your source:

> COVID-19 deaths are those with confirmed or presumed COVID-19

i.e. 1000 children have died with COVID, not of COVID. Big difference.
1000 FTEs thwart the world’s nation state hackers?
I don't think NSO is building & selling exploits. They're buying and renting them out. Exploit-as-a-service.
It's not like they have not tried. At few years back in time, the market was flooded with cheap x86 tablets because Intel was pretty much handing out pallets of Bay Trail SoC for free to any willing manufacturer in an attempt to kick start an mobile ecosystem. Suffice to say it never got any traction.
Wouldn't it be fun if its decided that they've had "fiduciary duties" like accountants etc, all this time.
As someone who wants to be an independant contractor who has to deal with all this crap I disagree.
Perhaps I'm missing something obvious, but isn't that orthogonal to representation? You could implement saturating arithmetic for any representation scheme, no?
A Linux system call in C without a standard library
I was under the impression that even in rust unsafe blocks, you still had massive safety advantages over C and it isn’t just instant Wild West.
BGP Hijacking results in $1,910,172 stolen
As long as people aren't put in jail for faulty software, it will never be fixed.

Remember Diginotar?

Who knows how many lives were affected in Iran...
You are using big words like "Impossible" such big word would need a proof.
There are languages that can produce programs proven to be correct as per the specifications. We don't have such programs because we prefer moving fast, breaking things, having fun while coding, making money etc.

Do you have a proof that it is impossible to have a secure calculator application?

About .Net and Python, they are using a lot of wrappers around old unsafe code, so we would need to put more work and eliminate that, MS failed because of their shity Windows first ideals and their FUD,
Yes, Russia will take whatever it wants within a week, calling it "humanitarian mission" to help poor separatist being murdered by bloodthirsty Ukrainian army.
More than accents are non-Latin scripts.
JetBrains Fleet Below Deck – Inside the Editor
Only Terraform uses a one-off poorly specified DSL.

Pulumi is based on real programming languages. The criticism might be that their libraries/API is poorly specified. But the languages it's based upon are standard with all the tooling one's used to.
Thanks for clarifying this for me. I'd gone through some of the specs of the File System API, but not nearly thoroughly enough to pick up on this distinction.
I’d love to red team the program that thinks Rust unsafe is easier to get right than tight ANSI C.
> There could be a parser bug somewhere in your web browser for example that allows a properly crafted input to hijack the browser process.

Bit of a caveat: Chromium and Firefox are probably some of the most hardened software programs in the world (for other browsers, all bets are off).

Chromium distributes its logic over multiple processes per tab, so that even if you eg find a zero-day in V8, you still can't use it to get arbitrary file access without a sandbox escape. Last I checked, Firefox was getting there. Also, Firefox compiles some parsing and image processing libraries to WebAssembly for another layer of sandboxing (and to protect against ROP exploits), and increasingly uses Rust for sensitive tasks.

That's not to say they're safe, but I don't think they're the biggest source of exploits.
and people can counter comment complaining about complaining...

It's allowed but you need more than that to justify it.
That's absolutely spot on. The fact that 'stuff is free' doesn't mean that you can have an attitude of 'well you got it for free, so you have no right to support or to complain'. And that attitude seems to be extremely pervasive. Even free users have rights, including the right of having support and not having the rug pulled out from under them in some bait-and-switch to give just two examples. Failure to understand this is a major problem for many of the large brands.

And if your business model does not work long term then don't start like that in the first place so that your external capital funded company doesn't ruin the world for the rest because that's a form of temporal unfair competition. But this is screaming into the wind: plenty of companies see these tricks as valid strategies because they are not technically illegal.
How to Overcome Uncertainty About Your Business' Future
Heard of Flatpak?
Concurrency in Java – I came up with a design I feel comfortable with
Each feature has a different 1% who use it
The Image Descriptions Making the Internet Accessible
All of this sounds really familiar. Isn't this exactly what Facebook used to do ~15 years ago with their "friends collector"?

I remember that at one time, Facebook had a big screen where you could enter your credentials for a variety of email providers. Facebook would then login with your credentials via IMAP, scrape all email addresses in your mailbox and match them with Facebook contacts. (Note that this was an official feature back then).

Apparently people were perfectly fine with giving Facebook all their contacts and also the full credentials to their mailbox.

Who wasn't fine with it though were the mail providers - which in the end led to the creation of OAuth, I believe.
Well designed software with attack surface within the bounds of human understanding does not have these problems.

OpenSSH has been exposed to the public Internet for over two decades, with nothing resembling this type of security problem. OpenSSH runs the protocol parser without permissions on the local filesystem, yet Apple thinks an ancient tiff library with scripting abilitites can be run with full permissions. Of course there is a discussion of financial incentives and customer expectations to be had here.

URL previews are an anti feature for a many users. We could not care less. But it gets shoved upon users by product feature teams for whom a continous stream of new features are their reason for being. That's how we develop commercial software, but that's not the only way.
Will this result in an illegal number situation once the keys are found?

Also, to steel man Intel’s position, reducing hardware skus can improve yield and increase quality (due to the known silicon lottery phenomenon), that is one abstract benefit to consumers.

This is basically taking the tiered SAAS and trying to manifest that business model ability into hardware.
It doesn’t seem all that unrealistic. These companies buy and research every single bug they can get for iOS and eventually you have enough that you can glue them together in to full exploits. When you have enough funding, this stuff becomes realistic.
Terrifyingly smart folks there.
Performance is usually the upside. The downside is subtle bugs that can happen due to side effects of the statements being reordered between sequence points.
And I'd be happy to get your feedback on how to improve on it.
I haven’t tried, but I think a minimal polyfill of exactly this atop IndexedDB might take 300–400 hundred lines of code (and I’d be interested in the difference in performance characteristics, especially on large “files”, and with different types of edit strategies). A mildly simplified but close enough to feature-complete form of it could probably be done in under 200 lines, though I doubt 100 is attainable honestly (IndexedDB is comparatively verbose).

It’s not that this is nothing, but I think it is and will be being fairly heavily oversold by some people.
It's only the longest immersed tunnel, nowhere near the longest overall. It's only 18km. Though the Tokyo Bay Aqua Line tunnel is only 10km long, the Channel Tunnel is 50km, but then again, that one doesn't have car traffic.
At some point I think this is system 1 vs system 2 thinking in that Daniel Kahneman Thinking Fast Slow context.

I am really not sure though if any of my thought is something other than lookup tables and types of joins.
I thought this was spot on so I quoted it, with credit, at the /r/hardware discussion.

https://www.reddit.com/r/hardware/comments/svk7m4/dr_ian_cut...
> Plaid wants to throw out all of those years of hard work and ask users to enter their freaking bank credentials into a third-party form.

I interviewed with them and was told the opposite of this. They want to use OAUTH or something akin. They don’t want to be in the business of handling actual passwords. I think for Chase they actually do use a form of OAUTH.

Of course, they could’ve been lying to my face but my impression was that they were being straightforward.

The banks need to provide a secure way to offer third-party access. I don’t see this as Plaid’s fault.
> Flatpak. Sandboxing taken to it's (il)logical extremes. If you like random data loss, confusing package manifests, low-performance and generally broken software, this is the way to go.

Talk about FUD and taking to logical extremes. Your constant trolling on Linux threads is not appreciated.
Only the standards people care about standards. We (programmers) want to just get things done. We don't care about the standards. No one reads the standards. Also no one cares about portability. All computers have been the same for the last 20 years.
ERPNext is a really excellent but mysteriously unknown system for accounting, CRM, and project management.
A lot, but they're still only used for high-value targets. They're way too valuable to waste on some random person who happens to click a link.
It's trolling of the "everything new in Linux is crap" type, just check their post history. Random data loss because one uses Flatpak, seriously?
I'd say lack of QA. Apple Music (especially on macOS) is EXTREMELY buggy, unresponsive, slow, and feels like a mess to use. Same for iMessage.

Other apps are also written using the same stack with almost no bugs. I wouldn't blame the language here, but the teams working on them (or more likely their managers trying to hit unrealistic deadlines).
Aha you mean the interest cannot exceed 1/3 of salary, not the principal? That makes more sense.
This is linked to in the second paragraph of the post
Nothing too spectacular, I’m afraid. I had to consolidate some physical machines, all running Gentoo Linux. For each, I simply created a Gentoo LXC container and then replaced the rootfs (in /var/lib/lxc/NAME/rootfs) with the one from the physical server.

The significant changes from the physical systems were:

* rc_provide="net" in rc.conf because base networking is controlled externally

* rc_sys="lxc" may or may not be necessary

* Disable various net setup services

On the host OS (Debian) I have interfaces like this:

auto ipvl-main
iface ipvl-main inet manual
pre-up ip link add link eth0 name ipvl-main type ipvlan mode l2
post-down ip link delete ipvl-main

In the container config, they are referenced this way:

lxc.net.2.type = phys
lxc.net.2.link = ipvl-main
lxc.net.2.ipv4.address = 1.2.3.4/29
lxc.net.2.ipv4.gateway = 1.2.3.1
lxc.net.2.ipv6.address = abcd::2/128
lxc.net.2.ipv6.gateway = fe80::1
lxc.net.2.flags = up

Later on, I removed the dedicated IP address and set up a reverse proxy instead.

Oh yeah, all containers are of course privileged containers. With unprivileged containers, various things may not work as expected.
The Uno has a _giant_ ecosystem behind it going back over a decade and it's more than enough for most beginner mcu projects. That's the appeal. Other than that, it's a pretty weak chip.
Also, don't forget https://en.wikipedia.org/wiki/Nimda ... all of these were a horror show to deal with on networks of the era..
yeah, sure, enough time to GO everywhere but not enough time to BE everywhere, which is a different thing entirely, even if all the other things I brought up as to why the aliens weren't everywhere were not things to take into consideration.

So again, still haven't heard any argument why an alien civilization achieving the ability to build Dyson spheres, even if they did so far enough in the past that they would then have adequate time to traverse the galaxy afterwards, would then have to be everywhere?
optimizing last mile travel is pretty difficult and this kind kf results are more likely a side effect of focusing on car modalities and not deliberately. Neglect of use case.