skysight-inc/HackerNews huggingface dataset:
Looking at that django link, rather than creating a new role for every user ID, you can set a value in each transaction that can contain whatever you like, including a user ID [1] [2]. What I don't like about that django solution is that it's very django dependent. If you ever had another system that can create users, the django signal wouldn't fire and the new role wouldn't be created. Apart from that, you'll have a lot of unnecessary roles in postgres itself.

[1] https://news.ycombinator.com/item?id=30706295

[2] https://news.ycombinator.com/item?id=30703881
I have a very different understanding of the situation; the best description of the situation I can find is https://utcc.utoronto.ca/~cks/space/blog/programming/Go116Op... (discussed at https://news.ycombinator.com/item?id=25997506 ) - from that article,

> The official API for Illumos and Solaris system calls requires you to use their C library, and OpenBSD wants you to do this as well for security reasons (for OpenBSD system call origin verification). Go has used the C library on Solaris and Illumos for a long time, but through Go 1.15 it made direct system calls on OpenBSD and so current released versions of OpenBSD had a special exemption from their system call origin verification because of it.
Photographers don't simply push buttons.
I dunno, the first bullet point of the article is:

Understand that there are no safety nets provided by the compiler or runtime while coding in C++.

I took the poster's comment to mean this bullet point is essentially saying "Don't use C++ if you really want to write secure software." If we've learned anything in the 35 or so years since C++ was introduced, it's that compilers and runtimes can do a great deal of good to help developers write secure software.

I mean, another reading of this article is that it's a list of the sharpest edges to watch out for in the C++ language, not a list of secure coding practices. The advice presented here boils down to "avoid these common bear traps and foot guns that are unhelpfully provided for you as part of you C++ starterpack." I think many reasonable people could easily conclude the same as the OP after reading this piece.
> it's not unreasonable behavior from all involved.

Isn't it? I understand OtherCo uses legal means to investigate more effectively, a judge might order ISP logs to be turned over or so, but CorpCo knows this person, knows they disclosed what they saw from the start. It sounds pretty unreasonable to fire someone over hearsay, especially when it's unlikely to be true (what dumbass does card fraud and tells their employer—a bank—and requests they disclose it to OtherCo?).

And even from OtherCo, they're acting like it's the 70s and they've never heard of responsible disclosure. I understand their logic a bit more for the aforementioned reason, but still, reasonable is not the first word that came to mind.
It's not a quirk of C; it's a failure of the vendors and their partners to appropriately coordinate. This outcome happened _despite_ the best efforts of toolchain developers to provide harmony.
Oh, if you want something practical, the approach that Linux's /dev/random takes is probably the one to go.

/dev/random being unbiased relies on some assumptions about cryptography; but in practice these assumptions are at least as well-founded as our assumption that our coin flips are independent.

Look at some of the papers mentioned in other comments on this submission. There are (near) optimal streaming methods.
The last time I saw a demo of one of these “citizen data scientist” tools, the sales guy driving it developed a model with .99 auc and “row number” in the data set as the most important feature.
Chainalysis Helps Compliance Teams Address Sanctions Red Flags
It is so obviously flawed. Misguided. It will be a spectacular failure.

This will make oil more expensive and does nothing for the cost of energy effects on food production and other parts of the economy reliant on oil.

It's like the administration is deliberately trying to destroy the country or just completely inept.
If you'd let me go 25 years... Titanic might make it.

Architecture? Might depend on what's still standing in 500 years.
Yet they can be accused of crimes and seized!
... or report the vulnerability anonymously?
I related pretty strongly to this. I've never tried to monetize, and the community I'm mostly working in (ROS) is populated almost exclusively with exactly the sort of kind, considerate people who will happily roll up their sleeves to take a crack at it themselves, given a little guidance.

Nonetheless, there are dozens of effectively abandonware ROS projects out there attached to my name— drivers for some sensor I shipped years ago and haven't touched since, interface libraries that aren't really relevant but don't have a clear alternative, stuff that was never out of the prototype phase and doesn't have anywhere close to the level of test coverage that would let me just merge much less release changes without extensive manual running of it.

I suppose I should go in and just mark them all as archived so that well-meaning people don't file issues (and even PRs) that will never be addressed or perhaps even acknowledged. And in some cases I've just granted PR authors write access and been like "there it's yours now." But none of these end states feel quite right; in all cases I end up feeling guilty and unsatisfied with how it turns out.
Shooting the messenger, seems to be a common practice when it comes to security issues. We only hear about those situations where someone has gotten nailed because they reported an issue but the fact that it happens at all is a problem.

I think part of the problem is that fixing a security issue is expensive and usually involves company management that has very little experience with code development so they think the person that reported the issue is a black hat hacker. It also makes life difficult for everyone involved.

A solution is to have a neutral in-between organization that can better understand how to deal with the problem without having to blame the person that reported it.
I think a helpful guide is to ask myself: what would admired US and RU astronauts/cosmonauts do?

I imagine that they are scientists, engineers, and colleagues, and will treat each other with support, as people of goodwill.

There are other people who are active combatants right now, whether or not they want to be, and it is tragic beyond words.

I believe that one of the ways that we non-combatants can help is to set an example -- or to leave a door open -- to how we can treat each other when the current conflict is ended.

That doesn't include lashing out angrily and hurting our fellow open source community members, most of whom presumably want no part of the tragedy, and instead want the same things we do (e.g., to develop good software, collaborate and share with others, pursue careers and businesses, support families, etc.).
How are NoSQL databases "bad" and should in general? The term "NoSQL" in itself is very inclusive and might include databases such as redis, elasticsearch or apache cassandra.a

It's important to choose the right tool for the job and SQL/ relational DBs fit many usecases but are not always the right choice. Especially when handling massive amounts of data, that can fit into structures such as wide-column stores, databases like scylla or columnar storage with clickhouse, can help massively.
> we printed money and it helped.

I mean, did it? What evidence do you have for this claim?

Vaccines absolutely helped. But now everyone's wages are going down -- it was basically ~$3k stimulus checks that were actually loans with a 400% interest rate.

Real workers wages are falling. Inflation fundamentally increases inequality, i.e. people who own assets watch the value of those assets increase while people who work for income watch their income fall.
Shooting the messenger is cheaper and maintains the appearance of security which is apparently much more important. The emperor's clothes are particularly fine today, are they not?
Banks, credit card issuers, and many brokerages suck from a tech stack perspective.

During the y2k times I did a lot of contract work porting old COBOL code to be y2k compliant. The number of seriously spooky security things was mind boggling.

Having mocked API's like you found is not a surprise. The fact they even bothered to use API's was a step in the positive direction versus telnet and ssh tunnels to pipe data around with hard-coded ip's and accounts.
Extend WebAssembly via Host Function
Half stocks is a great example of diversification. If there’s a huge correction (say 20%) they’ll lose 10% — hardly something that would drop you from prosperous to poverty stricken.
Yes, definitely. I just didn't mention that, because I thought it was obvious that we agree on that.

And instead of computing the "effective index" as an abstract number and then extract bits from that, you can work out directly how to generate the unbiased bits.
To minimize DERP usage, does Tailscale implement "TCP" hole punching? Or not much worth?
I think it's fair to say that neither party had pure motives here. But a decision in favor of preserving what (in my view) amounts to a free speech issue seems like a win in this case. There are better ways to deal with assholes than setting what would have been a bad precedent for future cases if the ruling had gone the other way.
Very neat idiom. Is it really used and understood by people in real life?
A generation ago, progressive cycles of deficit spending and taxation had put the top tax bracket in the US at 90%. Still, there was persistent inflation - and worse high unemployment.

The belief was that the Federal Government had grown too large in the economy and needed to be "starved". To what extent government austerity vs. new monetary policy moved the needle for the US economy is unknowable. However many Americans of that generation feel that the starve the beast approach was correct.

If you talk to Americans opposed to new taxes, their opposition is usually based on the idea that the government will waste the money in one way or another. Even those on the left in favor of taxes are often in favor of taxes for redistribution purposes. It's rare that anyone pitches the government as competent outside of military spending, and even then there are many asterisks on 10k light bulbs in submarines.

If you want Americans to agree to taxes you'll need to change the perception of government competence.
That is very funny. We like to demo with the Titanic data. Performs decent. Top features are gender, age, fare, etc.
- "I wonder if the court considered all this past evidence."

I'm happy that a total asshole was treated evenly and equally by the court. This is literally the first principle of justice -- she is supposed to be blind!
That reveals a lot of the possible architecture bootable under macOS or apple arm hardware, not just linux. Is that really apple long term policy. Or thus the current technical group somehow work this out Luke the use of certain firmware in the past mac hardware? And compare with hypervisor approach (like windows) …. One wonder the long term implication.
Between architectures you'd indeed need quite a few differences, but for the same architecture it'd be nice if things more or less agreed on things.

Specifically, I think it'd be very reasonable & possible to have an ABI that has various floats & integers (specified width of course), and pointers & structures, that has consistent conservative padding on all architectures and precisely one way any given structure is laid out in memory (ok, maybe two, with LSB & MSB integers; but I think that's literally all the variation there is (and MSB is nearly dead too)).

Not the most efficient thing on all architectures, but for language inter-communication it shouldn't be too bad to lose a couple nanoseconds here and there, and I'd guess it'd outweigh the alternative of needing more generic (and thus, less optimized) code handling each individually.
If some scientific discoveries were already made with of LSD, would you know? Its not like the scientists would admit to how they made the discovery in the methods section.
OK, but source?

Australian population in 2016 born in China was ~500k. If you assume that the majority of this was happening within that population, if it's 50k "informants", that would mean it's 1 in every 10 people. If you further limited it to students, it would be even more than that.

If this were actually known to be happening at such high frequency, I would expect that Australia would know about it & do something about it.

https://quickstats.censusdata.abs.gov.au/census_services/get...
How long would an all-out war with Russia last? Couple hours?
can you post links? hard for learning layperson to identify the right sources
Or simply offer to make the lawsuit go away for his silence.
If you’ve paid off part of a mortgage you can do something like a cash-out refinance, or more obviously, you can sell and downsize to meet your needs.
Let's make everybody happy and use Standard Time, but make up for it by mandating that the work day is one hour shorter.

Sound good?
Yeah but that wasn't the situation. Twas a bit late for that by the point OP discovered there existed a security issue in the first place and they had even already "exploited" it.
From what little I know of the world, this kind of litigiousness is more peculiar to the US than the rest of the world (or maybe at least the ones who usually speak English?).
Well... his man-in-the-middle was a false attestation of identity to gain unauthorized access. That is pretty much the definition of hacking. The app would have otherwise encrypted the traffic and they wouldn't have been able to 'poke around'.
The more important causation is the raising of rates. The Fed raises rates which leads to a recession. Then they lower the rates in response.
Vancouver has a pretty big Latino community, I'm Latino and I live here. Lots of Mexicans and Brazilians. It's the warmer place in Canada.
Did you mean this one? https://github.com/bazelbuild/rules_docker

I was very interested in this Bazel-based way of building containers but its README page says "it is on minimal life support," which does not inspire confidence. How's your experience using it?
Irrelevant onion: https://en.m.wikipedia.org/wiki/Red_onion
just post your findings from an internet cafe on 4chan and watch the competitor burn
This is a pretty cool book. It does use MongoDB for persistent storage (not so modern?) but the material is interesting and useful.
After you enter the email, you'll see "View Content" button on the web page itself. You'll also get an email having the same "View Content" button. From there, you can download PDF/EPUB versions.
> "raise taxes in the good times..."

Oh, I know which party he's talking about!

> "...and pay down that debt"

Huh, nevermind.
Any opinions on lazygit vs. tig vs. gitui?
I really want to use Nova for my Rails projects but keep going back to RubyMine because the code completion/jumping just isn’t even close, imo.
A Beholder? [0] good thing I've got a D20 with me. Get ready for some initiative...

[0] https://en.m.wikipedia.org/wiki/Beholder_(Dungeons_%26_Drago...
I disagree. We’re burned out because in the last 14 years we’ve seen two gigantic recessions. They’re not always catastrophes!
Bandon Dunes Golf Resort
You're probably correct from a liability perspective, but from a hiring perspective in that space, you probably want the kind of personality that is driven to do such things working for you.
There is a reason he shouldn't be able to have a snoop around: it's a violation of federal law. Don't test other people's websites without permission (and even then, be careful).

I worry that people read a lot about vulnerability research conducted on iPhones or Chrome or whatever and assume that it's open season on any kind of application, but the rules for apps running on other people's servers are very different.
> Also, if true, you likely have enough evidence for a stellar lawsuit against the company once all is said and done.

To what end? If your adversary has attorneys on staff it will be a bigger gamble for you to bring a suit against them.
Shinkansen moves fast enough it's difficult to fully stop in time unless it gets a decent amount more warning. Probably slowed down enough it was pretty minor though.
A resistor is a stripy electronic component. A resister is an entity that resists - probably a person.

Mr Google doesn't seem to recognise the difference between resistor and resister, judging by the grey wiggly underline in Chrome. That's quite awful, especially now.
> And will migration to smaller cities/towns continue unabated, (if you haven't moved to Austin/Vegas/Idaho/Montana yet, when do you plan to??) or will that reverse as companies want a physical presence again?

Moved to Alaska last year. Not going back to city life - remote forever :)
Imagine not wanting curious people on your staff.
Upvoted, but genetics are a huge confounder here.
>> Most software engineers I know who have a background in EE love C, simply because it maps very well to what a processor actually does during execution.

>lol. no it absolutely does not. i have a B.S. CpE and have actually built simple processors. the C execution model has nothing to do with how silicon operates, and modern silicon in particular goes to absurd lengths to put up a façade that c programs can use to pretend they're still on a pdp-11 while the processor goes and does other things.

I'm an EE who's been writing bare-metal firmware for over ten years, and who's helped develop memory subsystems for microcontrollers. What you're saying is certainly true for PC CPUs, but the C execution model works just fine for a Cortex-M or other low-end CPU. No "absurd lengths" are needed; there's a clear relationship between:

MOV R2, #0x400
LDR R1, [R2, #5]

and:

volatile uint32_t *b = (volatile uint32_t *)0x400;
uint32_t a = b[5];

>easy example: here's a memory address. what happens when you try to read from it

The CPU puts the address on the address lines and sets some control signals appropriately, and the SRAM returns the value at that address on the data lines. (Simplifying, obviously; I'm not going to go dig up an AHB spec.)

Cache? What cache? SRAM reads are single-cycle. The flash memory probably has some caching, but that's in the flash subsystem, not the CPU. And a lot of your most important reads and writes will be to memory-mapped registers, which had better not be cached!

No, C does not express the details of the instruction pipeline or complex memory subsystems directly in the language. Neither does assembly. C also does not cover every CPU instruction -- that wouldn't be portable at all. That's what inline assembly and compiler intrinsics are for.

C strikes a balance between portability and closeness to the hardware while remaining a small language. It does this very well, which is why it has historically been so popular, and still is for some purposes. Not all software is CPU-limited data processing on a 64-bit server.
And that is just for western text. Welcome to Chinese/Japanese/Korean/Vietnamese -- Over 50,000 kanji glyphs, hangul, hiragana/katakana/kanji mixed script, language-specific glyph variants with identical codepoints, Left-to-Right, vertical text where some glyphs must rotate but some must not, ruby text, language-specific word wrapping rules, language-specific ligatures that exist but mostly shouldn't be used save for very few occasions, terrible software implementations based on non-understanding of all of the above, ARRRRRGH!
The bank that fired them? Or the not-bank that is presumably taking legal action? I can only speculate that Whistlr means a hip company we all know about that has been doing all sorts of things in the paying-for-things space. This hip company has rather recently started doing card issuance.
Not sure why this is (edit: was) downvoted. I do security for a living, this is exactly how I'd have handled it and how responsible disclosure is supposed to work. With perhaps the substantial difference that I don't work for a bank and my employer would not fire me over such hearsay accusations from a competitor. We find security problems all the time, not always on purpose. I'd disclose it myself if I found it during non-work time, but it doesn't really matter either way. Since OP doesn't do security professionally, involving the CISO sounds like a good call honestly.

Using anonymisation proxies just makes it all the more suspicious, by using a normal connection and disclosing any findings it's quite clear you're using your real name, have no malintent, nobody needs to try and dig for your identity...
Eh it's worth looking into, it's not a stretch to think that someone could find a bug without trying to conceal themselves.. then return later from a more anonymous client to exploit the bug further

it's not proof of guilt but a reasonable trail to follow up on
The analysis here is actually really frustrating. The initial code snippet is only partially analyzed. It makes a HTTP request to a third party geoip service to detect location, then recursively overwrites files if the location is Russia or Belarus. I can't understand why the article doesn't talk about this, but the code is there (albeit obfuscated).
Prices are not determined by cost of production, but by what the market is willing to pay.

Figure out what the market is willing to pay and then decide if you can get your production costs far enough below that to justify the enterprise. Yes, being handmade by locals adds to what people will pay, but only so much.
> Russia has the largest nuclear stockpile in the world

Not by much, not per capita (of the obvious target), and both sides are treaty-limited to the same number of 'ready' weapons.

> Poseidon is a 100 megaton nuclear torpedo

You're getting your information from Russian propaganda sources. Credible estimates put it at more like perhaps 2MT.
At one of my jobs, we integrate with a lot of APIs. There are background check companies out there that just have a single API for all user data with no restrictions. If you want to check a person's past employment, you get their social security number.

Shit like this is why we keep such outrageous behavior quiet.
Yeah started on Slackware 3 on 80386s myself. The package installation process was very good for stimulating curiosity for new 'nixers about system packages. I particularly loved seeing bison: a parser generator in the style of yacc pop up. Cracked me up every time!
And in that vein, JS has some().