skysight-inc/HackerNews huggingface dataset:
I worked for Real Networks in 2000. It was my first job out of college. I remember the recruiter probably thought she was clever telling me that "Your salary is low but you've got a lot of options." I had no idea what options really meant. I got 30000.

In six months those options were worth $5M. Wired wrote up a great article by this guy who played a great practical joke on everyone. The greed was so bad, people would check the stock every five minutes. This guy setup a proxy, and when people went to the bathroom he would switch their proxy settings to point to his proxy. His proxy did one thing: take any numeric values and half them when the page had our stock symbol. People would return to their desk and freak out that they just lost half their portfolio value.

I quit on my 1.5 year vesting date, and my options were still worth $150k. I waited a month and they went underwater.

Oh well.
This guy has a history of claiming to have performed every hack under the sun for the last fifteen years. He's probably not being prosecuted because this info is very public, he's a well documented bullshitter.

I saw it happen personally with a bunch of GNAA related hacks. He had befriended the people who actually did them, and within a year or two of finding out more details, was using them to claim he had either masterminded and planned them all or performed them all, alternating between the two based on whatever was 'cooler' in the situation.
The entire purpose of analytics is to tell you what you don't know. But go off.
Save those emails folks... Never take a hand shake or a voice confirmation on something that could get you in trouble.
Is this really a better workflow? I mean it works, but now you do not have a central list of all your external dependencies. Sure they recommend you just do all your imports in a single file and re-export them. But that sounds very tedious and at the end of the day to what advantage? I'm really struggling to see it.
Many Japanese fonts I'm aware of do have that many glyphs all manually hand-optimized for the full range of font weights all the way from UltraLight to Heavy. Yes, it's an enormous amount of work; yes, Asian type foundries is serious business.
Just another anecdote. The company I worked for had pretty severe restrictions on when you could sell your stock, it was disallowed for some fixed time period before and after a major announcement. The company seemed to engineer their announcements so there was never an opportune time to cash out.
Since you're already keeping a text file, have you considered using nix (the package manager) to declare all your software packages?

If you don't want a package cluttering up your system, but also don't want to forget about its existence you can just comment it out.
If I can trust https://en.wikipedia.org/wiki/LGM-30_Minuteman a Minuteman III (which is the current ICBM design used by the US) will land within 800ft (240m) of its intended target 50% of the time. And outside that circle the other 50%.

In other words, you can't really target a "building-size" target with these (with maybe exceptions like the Pentagon).

For nuclear payloads, a few hundred meters of error is much less of an issue, of course.
Better to reveal such things anonymously over tor or something similar.
> unprofitable "zombie companies" that operate by simply rolling over their promises

Many modern tech companies come to mind....
Can confirm. Dont see any IBM at all in any level.
This has zero chance of passing. It's completely pointless drama.
I've had it uninstall itself twice and then fail to reinstall on update. The second time it did it, I just left it be. Maybe you'll get lucky too if you decide to click.
> It's a pretty good way to increase technical debt. The microservices themselves might become small enough that it is easy to refactor some at a time, but then you have the actual deployment and communication infrastructure to contend with. And if you get that architecture wrong, oh boy you'll be begging to go back to a monolith in a day.

I remember at a previous job, the monolith was drowning in technical debt. Someone decided the solution was Go microservices.
Fast-forward 18 months and 95% of the functionality is still in the monolith, but there are now 25 microservices, and no environment (except production) where you can test everything together.
What do you mean by original?
Like the in the Diamond Age but for Youtube
It isn't that they have a free plan, but instead how they plan to keep it free (presumably forever), if that makes sense.

To compare, logistics was Amazon's main cost driver and yet Bezos mandated to not only make it free for Prime customers but deliver orders in 2 days! This forced Amazon on a path to optimize the hell out of fulfillment and logistics so much so that they now own airports and cargo planes, build electric vehicles for middle mile and last mile themselves, have a tremendous network of distribution centers across the US / world etc. In essence, sustaining Prime drew a proverbial moat around Amazon (though, companies like Facebook, Snap, Uber, Instacart, Klarna, Alibaba, Wish have inflicted damage, inspite that).

Cloudflare's doing the same with bandwidth.
Will ‘open-source’ vaccines narrow the inequality gap exposed by Covid?
Fuchsia IDL Overview
Yes, it's those evil schools making all the lawyers greedy, when lawyers would otherwise just sit around hoping that no one would need their services.
Everything is an implementation detail then ?
It's being pushed up because we are not in a recession. We aren't even close to being in a recession. We need it to be raised in times like this so we actually have room to move it should things go south.
The post is archived at https://web.archive.org/web/20220317003600/https://accidhack...
Why not just keep a misc.txt file somewhere with notes on this if you don't have a regular note keep like Obsidian or emacs org mode.
It would be better if we weren't dragging this back onto the thread.
Again, I agree that prima facie it's highly improbable (though not impossible, and certainly not if the claim is that powerful people are angling for more power).

However, my problem with the post above is the dismissal, it's incredibly reductive. I have issue lists longer than 2 items for programs that aren't comparable with the complexity involved in taking over the world, the idea that the grandest of all plans can be made black and white in a clearly absurd fashion is, well, absurd.

Or perhaps I should ask those making such out of hand dismissals to help me with bug fixes and architectural decisions, they're clearly masters who would probably be better employed hatching evil plans to take over the world but are at a loose enough end to spend time shooting them down.
Would be more interested in sending it bogus data.

Strangling it to death with ad blockers isn't working (or at least is doing less than the self inflicted damage being caused by mismanagement over at Google).

How can we make its output completely wrong, instead of just incomplete?

I'll happily stick a "do not track” header (or the new one) on the bogus requests. In my book, they've been warned to back off at that point, so any bad outcomes from tracking the requests are on them.
Ask HN: Why is GPG so bloated?
(rant) Hello, I've been using GPG and I'm astonished at some of the defaults. When decrypting it does not require me to input the password for a key? The gpg-agent is running forever? Like anyone who thought this is a good idea must be on a government's payroll. Jeez. Why not have sane defaults? Why not have it do 1 thing and do it right?
This isn't happening because of a glut of lawyers. This is happening because some people wanted to make an end-run around settled precedent, SCOTUS decided to humor them for some reason, and now all manner of nonsense is being attempted, because why not? Apparently it's okay to make a law that completely nullifies people's constitutional rights, and SCOTUS will let that just sit on the books while they take their time with their review.

This is a huge loophole in the law and the justice system. Apparently there is some set of laws such that if written the right way, they can be completely and blatantly unconstitutional yet still remain in effect. This is effectively a backdoor around the constitution, and the question right now is: which laws will SCOTUS refuse to stay? And how much damage can we do in the interim period when the law has been challenged but neither overturned nor stayed? How much can we get away with?
Ah, yes. We’re regularly seeing those atheists out there hanging religious people. Such a shame.

Let’s not really act like the secular are anywhere near the way the religious are. Most of the secular just want everyone to have secularism be an option and not have religious choices forced upon anyone.
I don't use github so I'll just leave these here:

more HN clients:

https://github.com/ggerganov/hnterm

https://github.com/wtheisen/TerminusBrowser (also supports 4chan, reddit and others)

RSS reader: https://github.com/qw3rtty/neix

window manager for the console: https://gitlab.com/AutumnMeowMeow/xtermwm

lots of other top replacements out there as well: bpytop, vtop, gtop, bottom, zenith, tiptop, nmon etc.

and even more resources for this kind of stuff: https://old.reddit.com/r/commandline/
How NAT traversal works (2020)
The SSP Scenarios
Unique?
You need those symbols tables anyway though
I believe at least part of the answer is that many of the would be geniuses went into financial services. Ed Thorp and Jim Simons come to mind as examples of people who made important contributions in mathematics, but spent a substantial chunk of their lives figuring out how to take money from people who are dumber than they are.
Vladimir Putin Has Fallen into the Dictator Trap
I'm not saying I'd give them a chance to hack. I'm saying there's a chance I wouldn't have fired a star performer immediately on hearing they had been hacking. If it was someone I could afford to part with, I would, without a warning. The behavior in this blog post shows extremely poor judgment.
Darwin has always explicitly not had a stable kernel ABI (https://developer.apple.com/library/archive/qa/qa1118/_index...). Go tried to bypass the system libraries on macOS and it resulted in things breaking, so now they do use system libraries (https://github.com/golang/go/issues/17490).
Prgmr.com is now Tornado VPS
Has anyone had successes building smaller python images? I have always found it challenging to build it with Alpine as the base image. It just never finishes building. I end up pulling the python base image which uses debian. After installing pip packages the image pretty much comes to 250-300 mb at the minimum.

EDIT: I should add that I already have multi stage builds in place. My main dependencies are fastapi, gunicorn, redis, sqlalchemy, snowflake-sqlalchemy, snowflake-connector-python, fastapi-pagination, pymysql, fastapi-redis-cache, pandas. I'm willing to forego pandas if the size of the image reduces.
Where have all the great works gone?
I'm with WallyFunk, it's related to imposter syndrome. As a team leader, there is plenty for me to feel inadequate about already, so I try not to add "runs wasteful meetings" to that list of self-doubts. My "hack" is to live in my google calendar, adding time for my own work & projects, and even reminders. I only use a todo list to purge my brain & prioritise, not because I intend to actually work from it - things that make it in the calendar, are things that I am doing (or will be doing). This also makes good followup & stakeholder management much more possible. One of my guiding principles on this topic is being hyper-respectful of other people's time - this gives me enough of a kick up the arse to avoid being unprepared for meetings.
Was he tutored? I also thought of Ed Thorp. But he was NOT tutored. He was kind of an autodidact according to his memoir. He had good teachers too, but not aristocratic tutoring by any stretch.
What are the best approaches for teaching homeschooled children how to work together in groups? Or does that just come naturally as children enter society as adults?

I’d be curious to hear the experience of those who homeschool as parents as well as those who were homeschooled as children.
Resolving Zeno's Paradox
A non sequitir consider no one uses pure Python for numeric compute. People use numpy which is a wrapper around optimized BLAS code, which is usually running at the peak capacity of the CPU. So really this is a statement about how much faster GPUs are than CPUs for doing numeric compute.
CVE-2022-23812: node-ipc contains malicious code targeting Russia and Belarus
Then you make your software unusable for everyone who needs to use languages other than English. For example, I can't reliably type Devanagari (the script used by Hindi, Marathi, Nepali, and a bunch of other South Asian languages) into any terminal on any operating system.

You also make your software unusable for people who use assistive software. TUIs are not accessible by default, GUIs can be with only a tiny bit of effort.

TUIs are perfectly fine for internal tooling, but any piece of software intended for general distribution should ship with a proper GUI. Even a basic Electron UI beats TUI in terms of accessibility and internationalization support.
Node-ipc developers add malware which wipes Russian IP's
They could have tips that encourage breaks, or even have hard limits, they do not have to reduce quality necessarily. It could be an opportunity to introduce people to another product/site/app, 'now for something completely different'.
Fair point. I'm not sure what would be productive for them at this point though.

Years ago I read somewhere that the way Russia does cyberwarfare is less organized than most people suspect. I'm not sure if it's true, but the argument is that it's more of a lousy goosy free agent type deal. Some of these agents are very clever, but others not so much, so you have a range of competencies just trying stuff.

That could be wrong, or they may have evolved a lot since, but amateurish deep fakes could be a fit. Some random kid just trying stuff and hoping for a pay day / bounty? Pure speculation though.
I haven't written any ruby, but I've seen very short methods used in Erlang and it can be useful. If you write one or two line methods, they're mostly to help name a concept and make the place they're called look more sensible.

Organizing all those small functions can be a challenge, though. Which is why I don't tend to have functions quite that small. But a lot of 10ish line functions tends to work ok. But then, Erlang doesn't have loops, and I don't like anonymous functions (unless they're so short and simple I don't expect to find them in a stack trace), so that tends to make things short by necessity.
Sorry if the title is bad, if anyone else can come up with a better one please help.

module in question:
https://github.com/RIAEvangelist/peacenotwar

news article for news people
https://securityboulevard.com/2022/03/supply-chain-attack-no...

deeper dive into the code:
https://github.com/RIAEvangelist/node-ipc/issues/233

@dang plz don't remove, think I am the first to post about this
This has nothing to do with SCOTUS or avoiding legal review. California has been doing this for over a decade, since they past the Private Attorneys General Act. It is a bad way to outsource bad policy to private citizens, and is a big handout to a powerful interest group, trial lawyers.

https://www.dir.ca.gov/Private-Attorneys-General-Act/Private...
That is not quite what I said. I said I would take a crashing bug over a logic bug. Logic bugs are hard to find because you can't easily test for them. IME, Security vulnerabilities are primarily about functions assuming the input is safe (logic bugs), or file format parsing bugs (logic bugs) or the function being buggy to the point where the caller can poison the stack and/or control EIP. (logic bugs)

For each of these types there are some mitigations available at both the OS and hardware level, but I was making a general point about logic vs crashing bugs.

> If it crashes there's a distinct possibility that the bug is exploitable.

What I mean by crashing is that the program stops executing. Are you saying that crashing bugs make it easier to plant resident code? I'm nota security expert, so I don't quite know what you're referring to.
There’s no such a thing as technical debt.

There’s sometimes bad code that one resolves by redesigning some part of it with eventually some glue code with the old system, documenting it and making a presentation for everyone on how should the new stuff be written, and distribute work for a slow migration of the old systems by the different parties.

I’ve seen also some systems designed to solve problem X while the company or industry moved on to problem Y. Again, act like a virus, infect the system with your brand new solution, glue it or bind somehow with the old system and let it spread.

The only mistake that you can do is to engage all of your resources to undertake a full redesign and rewrite everything from scratch.

And for processes or algorithms that don’t scale, it’s not a debt because you never really made the investment.
The Global Oil Market Is Based on a Fiction
C compilers still support old-style function argument syntax. They have to, for backwards compatibility. Plenty of actively-developed software being compiled on modern versions of the C standard still has some older functions whose signatures are written in K&R style.
https://www.youtube.com/watch?v=6-LRS9A-rW4
Glad to hear you’ve been happy with Amplitude. We’ve been doing a lot RE helping customers federate data to data lakes/warehouses. If I can ask- what data lake you using and what data from Amplitude are you looking to get into it? (Raw dump of analytics data or something else?)
Ask HN: Why are there no open-source printers?
I often hear people complaining of high ink prices. Specifically purchasing a printer such that when the time comes to replace the ink, buying a new printer is the cheaper option.

Not to mention the whackamole game wherein more affordable, aftermarket ink cartridges are made incompatible.

Why isn’t there a printer that is open source, and whose compatible cartridges are affordable? No investment required in taking security measures to exclude cartridges of a different manufacturer
Nicely said!
It’s atrocious. We are using OpenVPN with Okta LDAP and you have to type “password,totpcode” as your password. Alternatively you can type just your password and wait for it to send a push to your phone while OpenVPN is completely blocked waiting. You have a yubikey? That’s a damn shame.
Training and support for this for our entire company was a pain in the ass. I also felt embarrassed having my name on rolling out something so janky.
We are trialing Tailscale now and onboarding is two minutes and practically doesn’t need a guide (Download the app. Click login. Okta auth however you want). Our OpenVPN guide is like 8 pages.
>It was inevitable that the New World would eventually be contacted by the Old World, whether by Asia or Europe or perhaps Africa, and inevitable that when that happened, the isolated peoples of the new world would be devastated by pathogens they’d never been exposed to.

It's not the pathogens people object to, so much as the slavery and genocide. Particularly, celebrating the originator and perpetrator of those crimes on the land where they were perpetrated.

By all means, write about Christopher Columbus in the history books (after Leif Erikson, who unlike Columbus actually set foot in America) but let's stop normalizing erecting statues to villains.
It was a false attestation of identity to his own device. Surely you can't be accused of hacking your own phone?
I wonder how these laws would play out against a decentralized protocol instead of a centralized company.
I would guess that it is accurate at the continent level.
Not a useful comment, a better one /might/ be "don't write new software in c++."

But that said, C++ is safer than C.

This is a result of large and complex software developing features that require a large amount of manual and error prone code, whereas C++ can do the work for the developer, and will do it correctly everytime. Are there bad things in C++? of course. But you can avoid the known "bad" features - we can acknowledge things we originally thought would be good were in fact bad, and also recognize they need to remain due to old code - without throwing out all the good features.

Hence you get the "modern C++" subset that all serious large c++ projects use, which is not some horrific wasteland of bad code. Most security bugs that have been in C++ have been as a result of errors inherited from C and, unlike C, can be engineered out.

My suspicion is that the over-representation of C++ in vulnerability statistics is a product of the size of the major C++ codebases, the value of those targets, and the complexity of the products.
The US military hasn't won a war in about 20 years.
The term Genius is a marketing term, there is no value in discussing geniuses as a separate group of people.

A lot of the biggest breakthroughs were a combination of luck and intuition.

Everyone who stands the chance of making a breakthrough has to have access to state of the art or at least enough training to get to the frontier.

Even Ramanujan had to learn math from a book.

If you could tutor someone to make a world changing breakthrough it would be so much more common.

There is nothing else that needs to be said on this topic.
If a company has a endpoint that is not secured by a password then it's public.

You ask the server permission to access the data, just like you knock on someone's door to come inside.

If they open it up, or return you data then you can only assume they are allowing you access.

When you start guessing passwords or reusing tokens or trying to access something with a different token, that's a bit different.

Lock your door if you want to keep the things inside safe.
Check out Operation Freakout:

https://en.m.wikipedia.org/wiki/Operation_Freakout
Result #2 in your example has that problem
> Is France a small country now?

Frances’s GDP is 15% smaller than the single US state of California, and its population is only about 1.67x that of California.
Your response is one-sided and not historically accurate. Yes, there were Ukrainian Nazis, just like there were (and still are) American Nazis, British Nazis - in fact Nazis in most-all nations of Europe. That some Ukrainians fought against the Russians in the Second World War was because the Russians (who controlled the USSR) had caused the death (by starvation or murder) of approximately 5 million Ukrainians.[0] To many Ukrainians, the Russians were the enemy as much as the Nazis eventually become the enemy.

"With the outbreak of war between Nazi Germany and the Soviet Union in 1941, many nationalists in Ukraine thought that they would have an opportunity to create an independent country once again. An entire Ukrainian volunteer division of the SS had been created. Many of the fighters who had originally looked to the Nazis as liberators, quickly became disillusioned and formed the Ukrainian Insurgent Army (UPA) (Ukrainian: Українська Повстанська Армія), which waged military campaign against Germans and later Soviet forces as well against Polish civilians."[1]

[0] https://en.wikipedia.org/wiki/Holodomor
https://spectator.org/remembering-stalins-atrocities-against...

[1] https://en.wikipedia.org/wiki/Ukrainian_nationalism
This made me think of “Head First Design Patterns”, a book whose content has aged fairly well, but whose cover and typesetting have not.

https://www.amazon.com/Head-First-Design-Patterns-Brain-Frie...
The perception is created by billionaires buying "news" media to spread propaganda to get people to vote against their own interests, leading to "hurts itself in its confusion" attitudes like "keep the government out of my Medicare".

The Kochs, leaders of the "small government" movement are the heirs of a billionaire whoade his fortune building oil refinery for communist USSR government. They only dislike government when it helps the people instead of the oligarchs.