skysight-inc/HackerNews huggingface dataset:
Wow. I knew that some folks really didn't want to be told that their pet language wasn't the end all be all, and I know people hold strong opinions about [insert language here], but the comments in this thread are somehow even more revealing than the usual fair of comments insisting that [insert language here] isn't used for anything despite its use in shipping (low-powered) embedded devices, end-user consumer-facing products, kernels, webservers, frontends, bootloaders, memeory allocators, etc, etc.

But to go on and assert that it "has" to be this way, or that its this way strictly out of necessity... I don't know how to describe it politely without saying "stockholm syndrome". What is it about C, or about a certain subset of C-fans that results in them asserting that 'it has to be this way' or tossing derision at those who strive for better? Do some of you realize that is born out of living in an ecosystem where we don't have to deal with this bullshit and thus don't see it as "normal" the same way you do?

It's okay. I've watched the exact same type of excitement faced with derision on countless technologies in the past. Oh how wrong I've been to bet on [insert cluster technology here] or [insert linux service manager here], surely those would never take off because hand-maintained bash scripts are fine right? Just like an undefined fragile ABI is fine, right?

It kind of makes me think of some long screed I read last night from someone making alls sorts of claims about Linux ond the Desktop while insisting that they use Xorg. Meanwhile, under Sway/wayland, I am driving 3 monitors at different resolutions and refresh rates and they all perform perfectly on testufo.com).

Your trauma doesn't make your choices better. Your supposed growth in the face of now-unnecessary pain doesn't make you smarter. I have contributed code that runs on thousands of peoples desktops every day, in both C and [insert language here] and I cannot believe this is still a fucking conversation. I mean, thankful for one side of it, but sad that in yet another facet of life there are folks insisting that the shit-we-have is the best possible. Sad.
Yes, in the EU he would simply be serving time, with little to no lawyer involvement from the companies - the government would have taken care of the whole thing.
Nobody says war with Russia would be easy, but a fairly plausible prediction is that it would be short.
You were very likely not the only one who found this security issue. But you were probably the only one who disclosed this issue to the bank.

This is ironic, but it is how business people deal with issues.
Perhaps https://www.google.com/search?q=covid+nitric+oxide Some are reporting this can be an effective preventative.
I copied and pasted the title from the article and HN capitalized all the words in the title.
Try searching for "brain cancer" on Amazon US. Then click on the Books category. The results actually make sense.

If you leave the filter on all, it will rank by the most popular items, and I can't imagine "brain cancer" being a common search term. Because the medical term for it is "brain tumor" and if you search the medical term you'll actually end up with book results that make sense.

This seems to be much ado about nothing.
Oh hey I built this!

It's inspired by Our Incredible Journey [1], which collects announcement posts from startups that have been acquired by mega tech companies. In each post the founders struggle to contain their excitement and express endless gratitude to their users.

But, inevitably stuffed into the last paragraph of the blog post is the announcement that the service is being shut down in like a week even though the founders are millionaires now on the back of their users’ loyalty.

The tone is totally inappropriate for the message, the posts are so formulaic and impersonal that they may as well be generated.

I wrote about how I built it here [2].

[1] https://ourincrediblejourney.tumblr.com/

[2] https://www.ajnisbet.com/blog/this-startup-acquisition-annou...
Honest question: do you not determine that during onboarding/account signup? Or do you do warm onboarding wherein essentially everyone is accepted and some vetted later on?
> Part of the stress is in interacting with so many people a single time, never having a solid relationship with any of them.

I found that working in the Linux distro space doesn't have this problem, especially in the pre-COVID times when there were annual in-person conferences and lots of socialising.
And of course he doesn’t name and shame them so they have no penalty for this despicable behavior.
Eh, quick DM to Wall Street Journal or Financial Times and if it's a decently large bank the PR fallout will quickly prevent any potential retaliation.
I feel that in so many cases as a developer, the best thing for me to do is to let things fail.

Scrum incentivizes waiting for bug reports from production.

Low tenures for employment mean there is no reason to care much about maintainability or security.

The pay difference between excellence and mediocrity is 2%.

What a world we live in.
The $1,250-an-hour tutor (2013)
They are going slow. It will take years to get back to pre-covid levels (2.5%-ish), which were low as it is. We haven't had a historically "normal" rate since the mid 2000's (4 to 5% ish.) There will no doubt be another crisis before we get anywhere near there.
> What evidence do you have for this claim

A tight job market

> now everyone's wages are going down

Not the people that just got jobs

> Inflation fundamentally increases inequality

Not nearly as much as unemployment does
If this description gets submitted as evidence, the case will be dismissed. The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found. If this is actually what happened the case will get thrown out.

Is it ethically wrong to check a public product to see if it follows basic security protocols? Especially if you’re an expert having created those security controls previously? Obviously not.

Is it ethically wrong to ask your employer before submitting findings to a competitor? Maybe? But only because you have an obligation to disclose regardless of what your employer says, but a judge isn’t going to be mad about following chain of command. It probably helped the bug report get p0 attention from the security team.

The fact of the matter is if the vulnerabilities were real and it sounds like they were, it’s fantastic news that the vulnerable company was able to fix them before the errors were exploited widely.
I do find it unreasonable to assume that OP would have been the only one finding and exploiting such a blatant vulnerability.
And they say romance is dead lol
A few years back I was in a role where it was my job to maintain a small but non-trivial open source project (~1500 github stars, 5 core contributors). I burned out after about two years in that role. People repeatedly demanding help in the github issues without even providing repro steps. Hate mail to the project email list from users angry we didn't implement the feature they want in the latest release. We had people second-guessing all the time if we didn't ship the things they wanted or they disagreed with the decisions we made. Some people just like to get in touch to let you know your work sucks.

The worst was the CEO of a small competitor company repeatedly hassling me over slack DMs and in github issues threads shamelessly trying to get me to prioritize free work that he wanted for his clients. Separately, over a period of several weeks, this same person asked me a ton of support questions and then compiled my answers without edits or attribution into a "white paper" he used as a resource to get people into the marketing funnel for his consulting shop. I came to hate that guy, such an asshole, but I couldn't totally block him because his company was a member of the open source foundation governing the ecosystem of tools my project was under.

Honestly, it was hell. The most stress and irritation I've ever had in any job. When I started the job I thought it was a dream getting paid to do open source, but now I consider that an anti-goal for any future role.
It doesn't sound all that unlike if you were to be doing IT work for your company on your bosses computer, accidentally click on the folder, and woops, you just discovered a lot of photos of a particular sub-class of people. Do you not say anything, and potentially leave yourself liable, or do you say something, and risk the fallout from that?
If this (not infosec) person was doing this type of security probing during work hours using work equipment, I could see them being fired even if they are hacking on the company’s own product.

You’re not paid as a competitive intelligence analyst and security researcher, regardless of your “personal interests,” you’re paid to work on a product to make the company more money.

Furthermore, if you start unpacking the mobile app of a bank and doing actual pen testing analysis in the wild hitting their prod servers, even accidentally, you seriously need to understand the situation you are putting yourself in, regardless of where you work.
Wow, the author is very naive. Did you really think anything good would come out of you telling this to your employer? Your do not owe them anything you do in your spare time, unless there's some contractual obligation. Companies are just looking after themselves, and will quickly throw you under the bus. I am very paranoid with that.

I used to explore APIs and do this sort of digging for fun, even though I was employed. My approach was the following. If the company had a decent bug bounty program, I'd be happy to report it there, it's the safest way for anyone to do that. If there was not, I'd try to sell it to an "alternate buyer", which is less preferred. I never many things worthwhile reporting though.
I'm a big fan of lazygit. I would describe myself as highly competent in using the git cli, but lazygit just makes most common operations so much faster that I'd hate to go back to only using the cli.
Also the "PDP-11 facade" is needed so that the thing can be programmed in assembly language without the board support people doing bring-up tearing their hair out. A sane assembly language that you can read instruction by instruction to understand the abstract effect is necessary for more than serving as a C compiler target.
> If a user of the app deletes, it completely nukes their entire account, down to the last byte.

Edit: This comment is in response to the suggestion that all apple apps delete all local data which after rereading the parent they were only suggesting for their app.

Are you sure about that?

I'm not an iOS developer but as a user I noticed a few years ago that deleting google apps, even all google apps, off my phone and from icloud still resulted in a freshly installed google app suggesting I log in using the account I was last using.

My best guess after doing some searching is re-identification was done using a "Keychain Access Group"[1] which does not automatically get deleted on app uninstall. Though it is stated [2][3] that this is an implementation detail and not a guaranteed behavior. If I recall correctly the only way to reset the Keychain Access Group if the app doesn't do it is to wipe the phone.

It is also possible to persist data if an app is part of an "Application Group" and one of the apps in that group is still installed on your device then data shared via that approach will not be automatically deleted unless all apps in that group are uninstalled (from what I have read).

Apple does have the "DeviceCheck"[4] framework which significantly limits the amount of bits which can persist across app reinstalls which prevents / severely limits an app's ability to reidentify users but still enable some useful use cases. However until "Keychain Access Group" persistence is removed there is not a lot motivating a developer to use this framework.

1: https://developer.apple.com/documentation/security/keychain_...

2: https://developer.apple.com/forums/thread/36442?page=2 and for some prior history see https://developer.apple.com/forums/thread/72271?page=2

3: https://stackoverflow.com/questions/60485419/ios-keychain-da...

4: https://developer.apple.com/documentation/devicecheck
My point was what are examples of normal C++ code where the language obviously deviates from the intention of the programmer and screws them over with undefined behavior. I don't see how any programmer can "intend" to use a data-type assuming an infinite range - or assuming specific wrapping behavior that was never guaranteed to them by the language. If a programmer is unaware that language data types have finite ranges and/or specific wrapping behavior then that is a problem that can be easily solved with training.
the big issues with C are that it doesn't specify the size of it's integer types.
Steely Dan
C's most infamous parsing difficulty is:

A * B;

Is it A multiplied by B, or B declared as a pointer to A? It can't be resolved without a symbol table. But there's another way that works very well: it's a declaration. The reason is simple. The multiply has no purpose, and so nobody would write that. C doesn't have metaprogramming, so it won't be generating such code as an edge case (unless using the preprocessor for metaprogramming, in which case you deserve what you get).

But there's a worse problem:

(A) - B

Is it A minus B, or casting negative B to type A? There's just no way to know without a symbol table. One might think who would write code that has a vacuous set of parentheses around an identifier? It turns out they don't, but they write macros that parenthesize the arguments, and the preprocessed result has those vacuous parentheses.

D resolves both issues with:

1. if it parses like a declaration, it's a declaration

2. a cast expression is preceded by the keyword `cast`

and D is easy to parse without a symbol table.
Around 15,000 people have been detained for protesting since the start of the war, despite facing 15 years prison sentences for simply calling that war a "war" and russian prisons having documented organized torture rings.

How many times have you faced decades in jail and possible torture?
I have heard that, in case of all-out war, the life expectancy of a carrier in the middle of a battle group was 21 minutes. (This was decades ago - it may be less with hypersonic missiles.) But they could launch all the planes in 19 minutes, so it could launch its entire attack before being killed. That was considered to be good enough.
What's "AA to get to fire at us" mean?

BTW that like sounds like the crazy pilot guy from A-team
> Given the technology mentioned by GP, the small number of Carriers in service and the utter impossibility of hiding them, it would appear that such a solution does exist for Carriers.

Strategic nuclear weapons, which one of the items you are referencing is, have been the “make it all go away” button for lots of things since they were created, but…MAD.

As for conventional anti-shipping missiles, people have been arguing that about carriers since weapons like the Exocet were available, but today, as then, remain at best highly speculative.

> So while it seems to be true that Aircraft Carriers are not obsolete in peacetime or in a conflict with minor powers, aren't they obsolete in the context for which they were created--namely, war with another great power?

Maybe, but so what? MAD has made war between great powers even more the exception among wars involving great powers than it was in the past, and it's almost always been the exception.
I’m really sorry about this situation and hope you are able to find resolution.

The problem with a lot of these platforms is they aren’t your funds until they hit your bank account.

Early vendors on eBay saw this shit all the time with PayPal and it hasnt really ever been fixed.

The answer is legislation protecting the users of these service and guaranteed due process in the event that the service provider suspects fraud.
FinTech really embraces the “move fast and break shit” mantra.

I’ve seen so many blatant violations in my short stint it would make your head spin.

Happy to never go back…
Congressional bills would ban tech mergers over $5B
Yes it does. You can't click on the URL bar and just navigate to a different site in chrome while an alert is displayed.
Yeah, and it's not like lawyers do this as a charity. This is already a financial burden.
The people being distracted by streaming video are the same people who would have been distracted by TV, before that radio, before that comics, before that chasing a hoop with a stick...
Doing unsolicited security research against a competitor of your employer just sounds hugely ill-advised to me regardless of the findings.
I wouldn't even restrict this to security matters; don't stick your neck out for your employer at all for any reason, unless the risk has already been taken or you're a shareholder. The nature of capitalism and employment is one of control and risk management. Unless you're guaranteed to be rewarded (very well), don't do anything beyond your basic responsibilities. More than that costs extra. You either have control, or you don't, and as a normal employee, you don't. This is how I learnt not to care about doing very high-quality work, because it costs me disproportionally more than it costs my employer, and it usually doesn't matter if they're big enough.
> Go's FFI performance cost

https://news.ycombinator.com/item?id=17165179
It should be noted that, unlike with patents, copyright registrations are not that significant. It's just a way to establish when you wrote a work, like getting it notarized. You have a de facto copyright on all works you create. In the end, it will be up to a court to decide if the copyright is valid.
Red Plenty's mathematically illiterate treatment of mutations makes me doubt the rest of the book.
It's not.

Germany is way worse.
Curiosity is very important, but it is not the most important quality a person can have in all contexts. Wisdom comes to mind as one that is more important sometimes.
I will preface this by saying I have immense respect for anyone who open-sources their work. I think the web as we know it today would not exist without such kind and hard-working individuals.

In my opinion, I think most of these issues outlined in the article are caused by lack of communication combined with unclear expectations, to be honest.

The only thing I ask of open-source library authors/maintainers is this: be upfront and clear about the nature of your library, and your level of commitment.

Is it just a hobby app? Totally fine, just put in bold text "this is a hobby app, not recommended for production use". That way, everyone knows what to expect, and if they do decide to use it in production, they do it at their own risk.

Do you feel that it is feature-complete? Then just say so, and indicate you will not be doing any more work on it.

Do you want to work on bugs whenever you feel like it? Nothing wrong with that, it's your work, but again, please just put it somewhere in writing so that any developer or PM who comes across your library knows exactly what to expect.

You painstakingly supported a library for years, got burned out and want to quit? At least try to pass it to another maintainer.

IMO these are just some very, very basic things that open-source authors can do that would alleviate a LOT of the friction that occurs in this space between them and those who decide to rely on their work.

Be kind, be clear, be upfront. That's it!
The Marvel movie source material will be remembered (The original comic books from the 1960s). But in 500 years the movies will have repeated themselves so often I don't know if anyone will care about today's comic book adaptations. Nobody really cares about the 1910 Wizard of Oz film, for example, even if they love the 1939 later Wizard of Oz film.
Following up on doesn't necessarily mean suing. But that's the part I can somewhat understand, yes. What's more unreasonable is OP's employer in my opinion.
> and my employer would not fire me over such hearsay accusations from a competitor

So you think but you might be very wrong.
My favourite thing about that story is that it was on film reels, not videotape.
It's been eye opening to see how easily we
can normalize this type of stuff. Social
media is also full of deranged calls for full
on war against Russia (!!), war crime
apologia, and just a pervasive hysterical discourse. The slope is getting so slippery that
honestly it's got to stop. Let statesmen impose the sanctions that they deem necessary, they know better than random people.

What ukraine needs is advanced weaponry,
financial and political support. Not this
batshit insane vigilantism that will not end
well and do absolutely nothing to hurt the
Russian state. I cant even imagine if this
happened to a more visible minority, say if
China invaded taiwan? It's just scary.

I'm not saying this is on the same level at
all, but I'm starting to understand how it
got to the point where the internement of
Japanese Americans was supported by a
majority of Americans back in ww2. As a minority it just gives me this weird unsettling feeling that is a bit hard to explain, even if I'm not russian.
>This incident sets a dangerous precedent in breaking a chain of trust that today's software development heavily relies on

Such precedents should be set, we shouldn't be relying on that chain of trust (as clearly demonstrated here).

Updates should be vetted, signed, etc. Fetching stuff random people push to npm is a recipe for disaster.
Serious question: are internet cafes still a thing?

Admittedly this is from a small sample of Seattle-area coffee shops but most of my experiences with non-home non-work WiFi is at coffee shops that provide the WiFi but expect you to bring your own device (laptop, phone, etc).

Is it still common to go someplace and rent time on a computer provided by the owner (i.e., at an internet cafe?)
Yeah, next time report it to the feds/state.

Get protected status as a whistleblower.
Also, compounds that are fatal tend to be so to all life forms vs just humans with the variation being dosage. It goes without saying the odds of taking a compound and finding a drug that does one very specific thing without doing anything else.. and demonstrating that it's safe in people, is orders of magnitude less likely than finding a compound that is lethal.
Yeah aside from the hacking there are potential copyright issues if he’s digging too deep in reverse engineering the competitor’s app.
> a lot of people that just dumped their stimulus checks on memecoins or wasted it buying spurious goods

By contrast, when the Bush tax cuts were passed all that money was used for tasteful, ethical spending
MMT is a bunch of emergent identities that get dubbed gospel which depend on the US dollar being a reserve currency backed by global economic imperialism. MMT died the day the US and EU froze Russia's reserves.
Of course Stripe can refund. That money came from somewhere, it can be sent back to where it came from.

Also: you had your run when you posted this the first time:

https://news.ycombinator.com/item?id=30705500
Did they say why they can't support you?

Also curious how you accumulated these funds if there is nothing to refund? Where did that money come from.

I'm sure Patrick will be here soon to shed light.
I mean, it’s par for the course with someone who thinks it’s just a no-big-deal, “personal interest,” to MITM a bank’s mobile app in order to start poking around in their production servers, without prior consent from the bank.
Here is a screenshot of the top features of a model I just trained quickly on the Titanic data: https://www.loom.com/i/8c090a2431c34dcb88aa598b6cb0389d

Here are the metrics: https://www.loom.com/i/fd435e6e39e24db7bc630283bb044506
Sure, with X11 forwarding.