skysight-inc/HackerNews huggingface dataset:
You're not going to be even aware of the majority of the channels. In my experience having ~1.5 channels per employee sounds right across the company. I've started channels for: specific incidents, personal huddle, lunchtime game organisation, limited notifications target, etc. Also we don't know if they count archived channels or not.
After waiting a couple months for the appointment, I went to an in-lab sleep study at a hospital and got the results back after two weeks. Now I have to wait a couple more months to speak with a sleep specialist (they are all that busy in my area with no sooner availability) presumably in the hopes of getting a *PAP Rx or discussing other treatment options. Once I get an Rx for the machine then I'm sure I will have to wait several more months to get one due to the supply shortage. I feel like the medical system has failed me as I suffer for months and months - with basically only one viable treament option (*PAP). While I applaud the effort, it seems like the real disruption would be in addressing the bottlenecks of machine production and Rx gatekeeping.
Sometimes the simple solution works well enough for as long as you need a solution, too. Often times, it just works, or the problem changes, or the company changes.
Did you work for Tellme too?
If you follow the lapsus telegram, you will see they are claiming they got AWS API keys from the corporate slack. That might be more dangerous than accessing the support console
Being a sadistic, authoritarian dictator is self defeating. People have no recourse except to agree. So they give the dictator what he wants to hear, even if it is a total fabrication. Because the alternative is often more severe.
The post could use some review/edit. This:

"a customer support engineer working for a third-party provider"

actually means

"one of our customer support engineers, who happens to be an employee of another company, working for us under contract".
> Appeal to Authority?

No, appeal to the market. If there is demand for a product in an interoperable market, then one would expect an entrepreneur to create that product. (Admittedly, the unusual economics of email services mean that market forces might differ from theoretical models, but there could still be some pressure for competing providers to add features that users want).

> If people truly had any interest in an email replacement, mail providers would already offer this.

There are dozens of replacements for (some aspects of) email, including WhatsApp and Twitter. To be fair, these services do (I think) have mechanisms that effectively limit your interaction to just people you already know, but the fact that email still exists (and doesn't have this restriction) suggests that there is value in the openness that it offers.
> it appears.

Where does it appear like that? I have tried to follow this but the only thing I have seen shares is info from within Okta. I have seen email addresses of CloudFlare employee in screenshot of Okta, is that what you are referring to?
> Insurance shouldn't (but probably will anyway) go up when your brake pedal is discovered to be defective, because the insurance is there to pay for the financial loss caused by the defective pedal. The loss in the resale value of your car and the increase in future premiums are losses caused by the defective pedal.

I actually have (some) personal experience with that. When Toyota has the defective accelerator pedal issue:

1. I got a check from Toyota from a settlement compensating me for the reduced resale value of my car due to the issue.

2. Insurers sued Toyota for compensation for the claims they had to pay out: https://www.reuters.com/article/retire-us-toyota-insurance-i...
FWIW, my friend at Cruise thinks that GM is messing up the company.
No it doesn't. Sample please.
> "all observable behaviors of your system will be depended on by somebody"

Ugh, a former team I was on had that to the extreme. We were customizing open source software for internal use. A lot of operators had (over years) developed scripts that would just SSH in and use a CLI to interact with the software, using regex to parse output. We once thought we were safe adding a new line to the output rather than modifying an existing output line. Nope, someone somewhere used a multi-line regex.

Kicking everyone's automation out of the shells of those boxes was a multi-year project that is, as far as I know, still ongoing.
Our amazing open source community keeps us going
https://www.technologyreview.com/2021/02/12/1018222/deepfake...
I think you're still misunderstanding. The documents don't need to be "in the cloud", the WASM in your browser can operate on them locally.

Is the WASM "untrusted"? Sure, I guess, all code you haven't written yourself is "untrusted" by default. Why would a native application shipped via CD or download be any more "trusted"?
I don’t think creativity and dream control are mutually exclusive. I do some of my best creative thinking while I’m lucid dreaming.
News doesn't make money unless you're a solo operation out of a basement or behind a paywall with 100+ years of experience under you.
> Complete nonsense.

please behave.

> The amount of uranium and thorium on this planet is almost unimaginable.

So is gold. Both don't fall from the sky however.

> fusion

Not currently option, but wee need one now.

> Nuclear reactors have very controlled inputs and outputs.

Waste with loooong times to take good care of. Calculate the provision for 10000 years of toilet paper for a single security guard.

> By first principle, a nuclear society uses the least amount of resources in terms of mining and land to power human society for 1000s of years.

So the hunter-gatherers were definitively nuclear.
How do you handle deploying a new version of nginx without forcibly closing connections?
https://www.mayoclinic.org/diseases-conditions/snoring/sympt...

"Snoring is often associated with Obstructive Sleep Apnea... Not everyone who snores has OSA".

Snoring is really, really bad. A cute little "snooze" could be okay, but anything more than that should be considered a potential life-shortener and potential-limiter.

And yes, I am saying that almost everyone is in danger of apnea. I think this is one of the many ignored epidemics of our time, similar and related to obesity.
Pretty sure they all will, they all already have the past gens of these things and it's a simple upgrade.
Moving stuff around is always aggravating but I do suspect that for a lot of organisations the time spent swearing at that ends up being lower over time than the time spent swearing at k8s until it reliably does it for you.

(this is an observation, not a recommendation, different teams and workloads will result in different preferences for how to pick your trade-offs)
In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.
An important one often overlooked (due to our tendency to focus on just the “diff”): what else should be changing or could be affected?

Very easy to forget to change code that isn’t highlighted in the review.
You are shifting your own goalposts here. You were specifically arguing that perfection is the only bar. You have now redefined "perfection" as meaning "above average", but even with that redefinition, your argument as stated still doesn't match reality.

People are already letting cars drive for them. They are doing it even when they are not allowed to take over for the car (i.e. Waymo in AZ). Clearly some people have lower bars so your claim that the above average safety is required for anyone to give up control of the vehicle they are riding in to a computer is false.

Reading between the lines of what you are saying, is seems that what you are actually trying to argue is more along the lines of "achieving (significantly?) above-average safety for self-driving systems is crucial to achieving mass adoption of self-driving technology." That's a much hard to disprove statement (and one I suspect it is at least partly true given varying levels of "cruciality").
A more poignant elegy to the modern landscape of compliance theater I have never seen:

> Security Standards. Okta's ISMP includes adherance to and regular testing of the key controls, systems and procedures of its ISMP to validate that they are properly implemented and effective in addressing the threats and risks identified. Such testing includes:

> a) Internal risk assessments;

> b) ISO 27001, 27002, 27017 and 27018 certifications;

> c) NIST guidance; and

> d) SOC2 Type II (or successor standard) audits annually performed by accredited third-party auditors ("Audit Report").

I don't think storing AWS keys within Slack would comply to any of these standards?
> I'm surprised how much I've gotten used to fancy websites, colors and formatting.

I'm more dismayed.
We don't know the skin colors of all the crypto enthusiasts that got in early.

I personally know a few dozen people who used it in Brazil, Portugal, Japan, and India early on.

I'd say I know more non-whites than whites who used it.

That's just an anecdote, but it's more information than the racist journalist had.
Frequently, support teams have lab environments. Hopefully, it'd be an account per engineer, but at least isolated from production. If software engineers access these for reviewing issues which made their ways to bugs, then potentially this is a vector that organizations should be concerned about. Attackers will be happy to make 20+ pivots, so even an isolated AWS account for a support engineer is a nice base.
> I'm not saying I want to go live recklessly, but I'd rather die slightly less old and happy, than old and miserable because I spent it worrying only to realize on my deathbed that I never lived.

So you're somewhere in the middle, like basically everyone else? Or are you saying that you're the reasonable one and anybody who takes precautions against COVID infection is living their life in a miserable state of worry?
Theranos' "Edison" machine enters the chat...
In India almost 20 years ago I learned I can negotiate everything down from the tourist price to rich Indian price to not so rich Indian price to get change on my banknotes price. It does take a lot of time though so I didn’t keep doing it. Also the last price point is ridiculous as a foreigner since you cannot do anything with the change.
A lot of bots are written by really unsophisticated people though, often just following online guides. Raising the bar lowers the number of adversaries.

You can never eliminate the risk, but it's just one more point of friction which is also a not-so-unreasonable speed bump to enable for real users.
My preferred method is overly broad rhetorical questions that add nothing to the conversation. Also, spatula.

Yours?
I'm trying to be as objective as I can, but building the entire ecosystem around a single product like Postgres ( even though tried and tested ) comes with its own downsides...
Thanks for chiming in to clarify!

I'm unsure the differences between "same reference frame" vs. "can't reproduce the required conditions" - ie Isn't it that in order to reproduce the very low accelerations we can't be in our current location with its high accelerations? I'm guessing there's some nuance between location / ref frame here that I'm missing.
Drones that have a 30+ minute battery life. 4k cameras. Rockets that land themselves.
React Trends: Interview with React Query Creator Tanner Linsley
Paypal separating from eBay was good financial engineerings, but at the end of the day you've got two crappy companies with 1 sinking faster than the other, neither has done well since, and separately they're both too small to compete in their markets.
You're just saying the same things again. I call.
That’s fair, but the overall point is that Apple could have added a standard connector (normal Display Port) without sacrificing quality.
As a longtime pseudo-lurker on these boards, and def not a software dev - this seems to be the platonic deal of an ASK HN question. I'll ASK HN if that is the case.
I worked one place that did so. Our traffic was sharded over a couple dozen sites, but combined we were at US top-100 scale.

Every site was on a very large bare metal box (sites were grouped together when possible, IIRC only one required it’s own dedicated machine). Each box was a special snowflake.

The DBs were on separate hardware.

When I left they were starting to embrace containerized microservices.
A fictional rendition of this process in modern journalism

https://www.youtube.com/watch?v=RZvXi8W9o_U

https://www.youtube.com/watch?v=bnYVH_Rrp00
Yea, I this is what I was referencing - thanks!
TIL! Thanks for the resource.
I am aware of System 76, but I am not sure their hardware offerings are good value for money. I could be wrong, but that's why I'm asking this question!
It is really clever wording, but it is possible for the statements to be true, while being deliberately misleading. What they initially detected, and what the 3rd-party investigation found, were two different things. Okta initially "detected an unsuccessful attempt" - the successful attempts were not detected initially but the detected event did lead to an investigation.

Now, JUST this week (presumably, in the last 72 hours to explain why disclosures have not already been sent) "we received a report from the forensics firm this week. The report highlighted that there was a five-day window of time between January 16-21, 2022, where an attacker had access to a support engineer’s laptop."
Doing his best to start a war with nato short of literally attacking nato is a weird way to avoid a war with nato.

I’m not convinced Putin cares much whether there is a war with nato.

Nato is only an issue to modern Russia due to Putin’s ingrained confrontational attitude towards nato from the Cold War but more so his liberal use of nato and the west as a foil to maintain his domestic power.
It does not have to be so black and white - I'd start remote, but local to each other to get together as needed. That also lets you get an office if you grow and want one, without anyone being left out.
I've never worked at Okta, but I've worked with several production ticketing systems at big and small companies, and all of them contained critical information about customers and operations. Including credentials.
The open standard version of NVLink is CXL. They're available in latest gen CPUs.
I've done relatively large scale projects without containers.

In one case, we were running something like 80% of all auto dealer websites on two bare metal web servers and one bare metal SQL Server db, with a fail-over hot replica. Quite a bit of traffic, especially on holiday weekends, and we never came close to maxing out the machines. This was in 2007, on fairly modest hardware.

I used to write fulfillment systems for Verizon, we handled about 30,000 orders and 10,000ish returns per day, with pretty complex RMA and advance-replacement logic, ILEC integration and billing in Business Basic on NCR Unix, with complex pick/pack/ship rules and validation. Again, that was a single bare metal db server, SQL Server and a web server with SOAP/XML/WSDL services (this was in early 2000's, on laughable hardware by today's standard).

I was part of writing a healthcare claims processing system that did about 1TB per day of data processing and storage, on a single bare metal SQL Server instance and OLAP cubes for analytics.

I've also been involved in projects that took the opposite approach, Kubernetes, Kafka, CQRS, etc... in order to do "massive scale" and the result was that they struggled to process a few thousand health care messages per day. Obviously the devil is in the details of implementation, but I wasn't particularly impressed with the "modern" tech stack. So many layers of abstraction, each has a performance and operational cost.

These days I mostly use Node and Postgres, so I haven't had a lot of need for containers. npm install is a pretty simple mechanism for dependencies, I try to keep the stack minimal and lean. With the current cloud offerings of hundreds of VCPUs, hundreds of gigs of memory and petabytes of storage, it's difficult for me to envision a scenario where vertical scale wouldn't meet the needs of any conceivable use case.

This works for me, partly because I'm a fair hand at sysadmin stuff on linux and prefer maintaining a well-tuned "pet" over a bunch of ephemeral and difficult to debug "cattle".
A Julia solution with Chain and Gadfly might look something like this, although I've translated the R fairly directly so it might not be very idiomatic.

import CSV
using Chain: @chain
using DataFrames
import Downloads
using Gadfly
using Dates

@chain begin
Downloads.download(
"https://api.coronavirus.data.gov.uk/v2/data?areaType=overview&metric=covidOccupiedMVBeds&metric=newAdmissions&metric=newCasesBySpecimenDate&metric=newDeaths28DaysByDeathDate&metric=newPeopleReceivingFirstDose&format=csv",
)
CSV.File
DataFrame
stack(
[:newCasesBySpecimenDate, :covidOccupiedMVBeds, :newAdmissions, :newDeaths28DaysByDeathDate];
variable_name = :Data,
)
transform(
:Data =>
(
x -> replace(
x,
"newCasesBySpecimenDate" => "NewCases",
"newAdmissions" => "Admissions",
"newDeaths28DaysByDeathDate" => "Deaths",
"covidOccupiedMVBeds" => "Ventilated",
)
) => :Data,
)
subset(:value => ByRow(!ismissing)) # Can't plot Geom.smooth with missings
plot(
_,
x = :date,
y = :value,
colour = :Data,
layer(Geom.smooth(method = :loess, smoothing = 0.1)),
layer(Geom.point),
Scale.y_log10(),
Guide.xlabel("Date"),
Guide.ylabel("Daily rate"),
Guide.xlabel("Angle"),
Guide.colorkey(title = "UK COVID-19"),
)
end
> just let supply and demand sort it out and this problem wouldn't exist

That would go against the mission of the Raspberry Pi Foundation which is to promote computer science education. Accessibility though low prices is an important aspect of that.

Not all problems are solved with free markets.

https://en.m.wikipedia.org/wiki/Raspberry_Pi_Foundation
I guess I disagree with your point.
Ask HN: Is this the platonic deal of an Ask HN question?
https://news.ycombinator.com/item?id=30767393

What do you think is better?
Interesting that this has 7x the cores of a M1 Ultra, but only 25% more memory bandwidth. Those will be some thirsty cores!
When you take software support into account, probably very favorable.

I don’t know anything about the state of Dojo, but Tesla was very hand wavy about their software stack during their presentation. And running AI algorithms efficiently on a piece of hardware is one of those things that many HW vendors have a hard time getting right.
If it's just a tab heading, we don't know if they have access or not. You can always open that page as long as you can log in. But it may show "you don't have permissions to display the instances". If you're thinking instead "why does a support engineer need AWS access" - cloudwatch metrics/logs come to mind.
Maybe I'm cynical, but a hackathon at a company just sounds like an invitation to work more, perhaps even overnight. If the hackathon is truly voluntary and the code will open-sourced or written for some good cause, that would be different.
Before I even look into it, I'll tell you this: the headline was enough to grab my attention on its own. I strongly feel this is a badly underserved niche and I've had major issues with Firebase's limitations. You definitely have a winning idea here in this user's opinion.
If your code reviews aren't catching bugs, the correct answer is to fix the code reviews, not to stop doing them.

I mean, it's possible that code reviews are worthless. But enough people have found value in them, across enough organizations, enough code styles, and enough decades, that it seems really hard to conclude that. It seems more probable that the team that finds them useless is doing them wrong. (Yeah, I know, No True Scotsman. Still, the first response should be "maybe our team is doing them wrong, and can we fix that?", rather than "let's stop doing them".)
The top-end datacenter GPUs have been slowly creeping up from $5k a few generations back to about $15k for the A100's now. So this one will probably continue the trend, probably to $20k or maybe $30k but probably not beyond that.
None of the Prime Minister’s phone messages prior to April 2021 can be searched
There's two ways to address this if you don't wanna maintain/host.

There will be a hosted Appwrite Cloud option => https://appwrite.io/cloud

There is a way to do 1 click deployment on Digital Ocean Marketplace: https://marketplace.digitalocean.com/apps/appwrite

With these options, you can put off the whole mess with devops, infra, and hosting to someone else :')
I'm sorry to hear that it's taking so long to get treatment! Through virtual consults and at-home testing along with CPAP alternatives, we're looking to help improve access.
A [load-balancing] reverse proxy can also keep WAF rules in RAM for processing requests and responses.
WAF: Web Application Firewall (OWASP CRS ruleset, CF ruleset,)

Methods for delegating HTTP requests to another application, with per-message overhead and inevitably-necessarily-tunable buffering: Layer 2 (MAC on a local segment), Layer 3 (IP), Layer 4 (TCP, UDP ports), Layer 7: HTTP parse and forward over network sockets or file sockets, defy separation of concerns and least privileges and run the (e.g. non-blocking Lua,) app within the webserver, Layer 7+: container service mesh Ingress API,

e.g. FastCGI uses file sockets, which avoids additional TCP overhead but doesn't really scale because sockets and network filesystems.

(ASGI is the Asynchronous WSGI, which specifies $ENVIRONMENT_VARIABLE names as an interface contract in order to decouple web [[reverse] proxy] servers from web applications.)

Fundamentally, which variables passed in the e.g. os.environ dict like $REMOTE_USER and IDK is it like $SSL_CLIENT_CERT_SHA384, SSL_CLIENT_CERT_*; should downstream web applications simply trust as valid strings over what network path?

TLS re-termination.

Non-root [web] servers must run on ports less than 1024, which e.g. iptables or nftables (or eBPF) can easily port-forward to only if rewriting URLs within potentially-signed assets within HTTP messages and HTTP/3 UDP streams isn't necessary.
Yeah mine is actually an IPS panel. Also 60Hz, but the viewing angles are great. I do have mine set back a bit more than my previous 27", but the more important adjustment I needed to make was to set it 6-8" lower. Before that, I only felt comfortable working on the bottom half of the screen.
I think they're meaning it like a login attempt here. If you submit a login form 5 times, that's 5 login attempts. Another similar example is free throw attempts. https://www.statmuse.com/nba/ask/most-free-throw-attempts-pe...

I wouldn't have realized that unless I'd read far enough to see that Entity A did compromise Account B. Since the author didn't define what an attempt in this context means, I think it would be proper to assume that attempt meant the overall effort to compromise the account.
> I'd be less inclined to unleash a bunch of mid-level devs using Go to create a huge codebase

Why?
We non-Americans are continually stunned at how you Americans fetishize brand name universities. You don't become a better engineer by going to MIT instead of University of Kuala Lumpur. Everyone knows it's bs but everyone believes everyone else believes in this bs so everyone has to spend $$$ to go to a brand name university. A self-perpetuating cycle of bs.