skysight-inc/HackerNews huggingface dataset:
If your bank supports Oauth it won't share your credentials:

>Stripe generally defaults the authentication flow to OAuth if available at the financial institution....OAuth is an open standard authorization protocol that allows users to let applications (for example, Stripe) access their information within other applications (for example, bank apps) without having to share their login credentials.

But for banks without Oauth you DO give your credentials to Stripe:

> For these banks, end users provide credentials to Stripe or one of our trusted partners.
It's understandable that people might be stressed or upset, but if they take it out on people they consider beneath them that's not a good sign.
> were made with malicious intent

That's not what "actual malice" means. Actual malice means:

> with knowledge that it was false or with reckless disregard of whether it was false or not

So its not just that they wanted to harm the person, but that they took reckless disregard to whether it was true or not. Essentially, writing something without even doing a bit of fact finding to try and support it would be considered "actual malice". You don't need to prove the defendant wanted to harm the person being libeled, just that they didn't care whether or not what they were saying was true or not.
Many years ago when applying for a somewhat similar program at another big company I went through something similar. Bunch of us in a room with a difficult to solve problem, not enough time, and at the end we had to do a group presentation on our solution. I don't know if it was exactly an asshole test, it was also to see how people worked in a group generally. Even if it is somewhat artificial people's personalities quickly became apparent. I really enjoyed it :)
For all of its strengths as an instrument, piano has some drawbacks for learning to read traditional staff, as there isn't an (obvious-to-the-uninitiated) differentiation between notes or across octaves (you just sit in front of a wide line of keys). I think I learned to read first on a recorder, where you can develop a more intuitive link between fingerings and notes (especially as the first note you learn is the B dead in the center of the treble staff).

I'd suggest a few paths to learning the note positioning:

- If you're already comfortable with note locations on the keyboard, don't be afraid of the line/space mnemonics. If they get you to where you're making ID's faster in the parts of the staff where your hands normally live, it can make life much easier, and you can easily extend from there. There are really only ~26 note/staff associations to learn that will cover the majority of the music you'll see day to day (with octave shifts) and knowing a few will make the rest come more easily.

- Similarly (and I think this is the way piano is taught to beginners, but it's been a long time) you can make a lot of progress by starting your thumbs on middle C, which is dead between the staves and operating from there to play simple music. As you play and read more music, you'll find yourself starting to recognize the locations of more notes across the staff, until they all come to you intuitively.
Sure, just try to properly document what it does. There are some characters that are easily confused at first glance even for native speakers, so be sure to use some common sense.
Honestly, DPoP[1] is pretty horrible. It is a partial re-implementation of TLS client authentication deep inside the TLS connection. What's wrong:

- No mandatory liveliness check. That means you don't know whether the proof of possession was indeed issued right now or has been pre-issued by an attacker with past access. Quoting from the spec[2]: """Malicious XSS code executed in the context of the browser-based client application is also in a position to create DPoP proofs with timestamp values in the future and exfiltrate them in conjunction with a token. These stolen artifacts can later be used together independent of the client application to access protected resources. To prevent this, servers can optionally require clients to include a server-chosen value into the proof that cannot be predicted by an attacker (nonce).""" This is a solved problem in TLS.

- The proof of possession doesn't cover much of an HTTP request, just "The HTTP method of the request to which the JWT is attached" and "The HTTP request URI [...], without query and fragment parts." It doesn't even cover the query parameters or POST body. Given rational: """The idea is sign just enough of the HTTP data to provide reasonable proof-of-possession with respect to the HTTP request. But that it be a minimal subset of the HTTP data so as to avoid the substantial difficulties inherent in attempting to normalize HTTP messages.""" In short: Because it is so damn difficult to do it on this layer. Of course, TLS covers everything in the connection.

- Validating the proofs, i.e. implementing the server side of the spec, is super complicated, see [3]. And to do it right you also need to check the uniqueness of the provided nonce see [4] which brings its own potential attack vectors. And to actually provide liveliness checks (see above) you have to implement a whole extra machinery to provide server chosen nonces see [5]. I expect several years until implementations are sufficiently bug free. Again, TLS has battle tested implementations ready.

Best of all? There is already a spec to do certificate based proof of possessions using mutual TLS! See [6]. We really should invest our time in fixing our software stack to use the latter (e.g. by adding JavaScript initiated mTLS in browsers) instead of yet another band aid in the wrong protocol layer.

[1] https://tools.ietf.org/id/draft-ietf-oauth-dpop-08.html

[2] https://tools.ietf.org/id/draft-ietf-oauth-dpop-08.html#sect...

[3] https://tools.ietf.org/id/draft-ietf-oauth-dpop-08.html#name...

[4] https://tools.ietf.org/id/draft-ietf-oauth-dpop-08.html#name...

[5] https://tools.ietf.org/id/draft-ietf-oauth-dpop-08.html#name...

[6] https://www.rfc-editor.org/rfc/rfc8705.html
Yes.

I remember reading that this latest approach is only really viable because of the use of HTTP2 for the requests and the adoption of that technology.

The swing towards frontend made sense before this step change in latency.
Solving hard problems isn't an inherently masculine thing, but basing a work culture's progression around being able to prove employees solved hard problems is a pretty good example of toxic masculinity. And the phrase "toxic masculinity" does not mean that all masculinity has problems, it's a separate (and pretty well-documented) concept.

https://en.wikipedia.org/wiki/Toxic_masculinity
I interviewed for a security position where they asked me an interesting question (I don't exactly remember what it was). After thinking a bit I told them "you don't" — as in there isn't a solution to the problem they posed.

They shook their heads and admitted that as best as they could tell there wasn't a solution but they wanted to see if they missed anything. I got the job.
The US has 10,000 financial institutions. Wherever you are from maybe has 20.
> I don't think it's ethical to evaluate a candidate on interactions that they weren't informed were being evaluated.

https://en.wikipedia.org/wiki/Hawthorne_effect

>I don't see how this behavior is relevant to the job; and evaluating it on a hiring committee invites all sorts of "cultural fit" biases that generally making the hiring process inconsistent and discriminatory.

I don't see how not doing this, really changes anything. The process is already inconsistent and discriminatory. The only thing this really tests is integrity.
Seems like a bad experiment. If the water brings something that I'd like equally or maybe more (having seen it in front of me)-- why argue?

Depending on what was brought I might not even be confident that they messed up the order-- e.g. if what they brought was also something that I credibly could have ordered.
To be fair backups are one of many things (like compiling, video conferencing, or even just looking at the laptop wrong) that makes x86-64 macs run their fans run out. My particular case is an i9 in a mbp 16". It throttles heavily while making impressive noise any just about any light workload that's not pure idle.
My dad worked for Boeing.
He got to take a ride in the company limo once. Driver started telling him all the dirty gossip. Which executives were having affairs. Which ones were scheming, etc.
Most Tor exits block SSH and SMTP. Look elsewhere.
Please tell me how I can make $10M per year (20 x $502k)
And I’ll quit my job right now.
> and the person blogging about how great everything was is long gone

Umm, she left CircleCI last year after a 6-year stint. That's not exactly 'long gone'.
In the military the E9/O1 issue is at least understood. Not so much in corporate life.

The parity between the two ladders is something of a myth. At most companies, you can see that clearly if you count heads.

A director might oversee 150 to 250 people. There will likely be five second level managers reporting to the director, and maybe twenty first level managers reporting to those second level managers. So 30 manager level people.

And there will be maybe four or five Staff and one Principal engineer in the same organization. Sometimes even fewer.

So the parity really isn't there.
"Pursued by the Employee’s sinister agile gibbons, Princess Lela races home aboard her starting pistol,"

I would pay to see that.
I am not sure how this can be even close to accurate with no representation of PostgreSQL.
Do you see this as being substantially different to evaluating a candidate's behavior while in a waiting room between interview sessions?
I thought I just heard that growth stage funding was dead? Doesn’t seem to be.
https://ciechanow.ski/archives/ - the blog archive is full of such marvels.
>should court delib­er­a­tions be confi­den­tial? Or should justices be required to post drafts of opin­ions to the judi­cial equiv­a­lent of Git­Hub?

I think they should. The court has been granted extreme power to decide the nuances of our rights.
All these approaches have plusses and minuses and their own risks. The risks with the approach you have described are that:

a) Unless very carefully managed, you can end up with contractors being incentivised to cut corners (i.e. We make more money if we buy the cheapest doors possible, regardless of if they only last a few weeks).

b) If contractors have fixed profits at their bid-price, they will have zero incentive to accept any change requests (unless they come with additional margin, in which case, overspends will magically turn into change requests).
With hindsight, yes. It is difficult to predict which field/researcher may become the 10x and which may not. Even an expert panel may have difficulty in judging the prospect of completely novel research. Giving funds only to 10x researchers is akin to investing in stocks that only go up; it sounds appealing, but in reality, how could a funder like NIH or NSF tell who is the 10x?
Why is "codes everything by hand" surprising? Is WebGL a really shitty API or something?
you could take a look at some other SBCs like the upcoming rockpi5 with rockchip rk3588, apparently it's very fast and has lots of pcie to spare
haha! glad somebody linked this! i love how the site presents itself just as any "framework" would :-) well-played vanilla-js
You could extend Spacex/Tesla to any other "Billionaire" passion projects, where there is a strong drive to achieve key milestones while being nimble/frugal by working incredible hours for paltry pay. The bigger the bet, the longer the hours and meager the wages. Its kinda the name of the game.
> One CTO I remember flat out getting angry that his reason for using React was because Facebook was doing it

Lol.

I find it ironic that from a developer standpoint, we're quick to jump with the latest FAANG libraries/cult thinking paradigms, but especially here on HN, we're equally quick to show the hate for those very same companies.
Personally, I've found that all FAANG software is generally a good reason to not use it! (My solutions are all bricks and mortar sized, rather than oligarchal/massive advertising globalist farms)
Realms are not necessarily equivalent to tenants in Keycloak.

You can run many tenants inside a single realm (we do). They can all log in to their account using Google, LI, etc., as well as email/password.

It's only if your tenant requires SSO, e.g. to their corporate idp, that their own realm is required.

Of course you may choose architecturally to put every tenant in their own realm but that is overkill IMO.
Every bit of both historical and contemporary data we have contradicts what you and GP say.
California Has Ruled It Illegal To Conceal A Company’s JIRA Subscription For The Purpose Of Attracting Engineers

(From @HackerNewsOnion)
The routing and account numbers are printed on every paper check in the US. Those are all that you need to process an ACH. The onus is on the ACH originator to make sure the numbers are not stolen.
Seems like a well intentioned product (certainly would have loved to have this tool prior to raising) but the level of data you're asking for that could get back to a founder will have a chilling effect on the negative reviews which will also happen to be the most valuable.

I get adding the verification steps to make sure the data is "real" but if founders want to leave any feedback online about investors they've worked with (already unlikely), they're more likely to leave it on a forum like vcguide.
Artificial Gamer: The story of how OpenAI beat the best Dota 2 team on earth
> between typing out the answer from Stack Overflow, v.s. copy pasting it

Thanks to co-pilot, these are approaching being one and the same (:
For offline access, you just need to configure that once with the CIDR of your local network(s), and then the next time you're offline the server will allow auth-less use: you'll still be you, but the server itself won't attempt to authenticate you through the internet.

Settings -> <server name> -> Network -> Show Advanced -> List of IP addresses and networks that are allowed without auth

You can also toggle off some of the extra crap they are pushing:

Settings -> <your username> -> Online Media Sources
> Is WebGL a really shitty API or something?

Yes. Almost no one uses it directly.
> (Why interviewers were all transcribing the whiteboard rather than taking photos I have no clue.)

Because they have to transcribe it anyways, and because it's hard to read blue on white, or green on white in a photo.

Also, if some part of your handwriting is illegible, or you've made some ambiguous errors, or whatever, the interviewer can ask you what you meant, instead of having to make an after-the-fact assumption, long after you've left.
That’s one way to look at it. The other way is to determine confidence. Either way, these are character traits and filtering for one or the other is unfortunate. Teams should mimic villages, everyone is there. Everyone. The shy, the arrogant, the nice, etc. There will be flawed people in a village, but that is a village. Not utopia.
I once walked into an interview where some code was already written on a whiteboard. It was presented to me as a "find the problem with the code" sort of puzzle, and I pointed out the one big logic problem with it's algorithm and wrote a quick fix.

The interviewer responded with "hold on", and grabbed a colleague, pointed at the whiteboard, and the colleague said "yes! that'll fix it!" and ran off.

I was offered the job that I was clearly qualified for, but I declined. I often wondered how many candidates it took them to fix their bug.
I do not know about other instance. Could you please share?
As "that guy" it's somewhat refreshing to hear this. I think the key is really self-awareness and understanding of group dynamics enough to help you get the balance of individuals right.
True, I feel like coupons are a way that a lot of these go. I remember my $14 Ticketmaster coupon (or something I don't remember the exact amount) that had an expiration date on it.

Some of the class action suits also require you to be the one to put in effort to receive your money, so the fact that TurboTax is just mailing everyone a check seems better than others. And "better" doesn't necessarily mean "good". Still not a fan of TurboTax or the US tax filing system.
> Calling Lightning centralized is something an ignorant precoiner would say. Really, rvz doesn’t know what they are talking about.

And somehow you do? Assuming you have read both the paper I linked to and this article? I know it's difficult to read the cold hard truth and evidence on what the Lightning Network has become and will tend towards to in the future via the analysis and inspection. But of course, why would anyone expect someone who calls themselves 'randomhodler' or a Bitcoin maximalist to understand that? Since to them, anyone critiquing anything related to 'Bitcoin' will be like attacking their identity, investment and the technology all in one?

So somehow according to you, it is not 'centralized by design' as the paper has clearly demonstrated, and Bitcoin has somehow 'succeeded' in on-chain peer-to-peer electronic payments as described in the white-paper, due to the Lightning Network which that is an off-chain L2 solution and doesn't directly use the blockchain?

The problem with using anecdotes is that it is not evidence or a concrete refutation against the paper. "I can run one myself" isn't the point. The actual reality has been outlined by the paper on what happens when the Lightning Network grows and it leads towards inevitable centralization of these hubs with the most liquidity (take a guess who runs those hubs) - creating a worse version of the current traditional system without directly using the blockchain for on-chain payments with a volatile ' store of value' as a 'currency' and altogether contradicting the point of Bitcoin.

The whole point of it is to be used for on-chain payments, a digital currency and a P2P electronic cash system and it is evident that in El Salvador, the paper I linked and the inevitability of the LN have clearly demonstrated that this experiment has failed in all of that.

If that's not a failure, then I don't know what is.
Over a third of the students at my middle school were in band, and lots of them had academic problems. By eighth grade, they were all ok enough at reading music to get through multi-page pieces together.

Only a few of us could have told you what a major third or the circle of fifths was, but frankly, even that meager level of theory was useless for the immediate task of playing the same note at the same time as all the other second clarinets.
> it reduces tolerance to other substances, like caffeine

Would this help at all with withdrawal symptoms as well? I don't know anything about biochemistry so that may be a very stupid question.
>"I don't think Intuit's total revenue is relevant to this discussion. The most relevant number is how much money did they make off this little scheme which seems to be much less than their total revenue."

So following this logic, unethical behavior, deceptive practices and bogus advertising is less important than the percentage of total revenue gotten from those practices? That sounds like a talking point straight out of the Intuit PR book. Without considering total revenue, a fine like this is just the cost of doing business for Intuit, a footnote on an otherwise wonderful corporate earnings statement.

Do you also suppose that $30 was always the true cost to the victims? There's no shortage of people that live hand to mouth who would have been negatively impacted by being duped out of that $30.

And just for historical perspective this is a company that signed an agreement with the IRS back in 2002 to provide "Free File" to American tax payers in exchange for the IRS not creating a competing free file platform.[1]. Not only did they fail to honor their agreement but they actively engaged in subverting it. What's the fair price for abusing the public trust? It's not unreasonable to think that some of that $30 was actually used by Intuit to pay lobbyists to ensure those same duped people continued to have no viable free filing option available to them.

[1] https://www.irs.gov/pub/irs-utl/2002-free-online-electronic-...
Do you not burn up your stomach from the acidity of that diet?
I use watchtower to update my containers
"I believe you need a specific bank authorization to do ACH withdrawal using only routing and Account#"

No. All you need is an account number and routing number (which are printed on paper checks). The ACH originator is responsible for ensuring the numbers are owned by the payer.
Assuming you're aware of the plural "you", you (singular) is doing the gaslighting here.
Thanks for the info about photoprism. How does it handle videos, I have tonnes of home videos that I have no idea how to organise or manage.
Here's another way to do it:

>>> def foo():
... import __main__
... a = __main__.a
... print(a)
...
>>> foo()
1
There's a lesson there too about how solving problems is often easier once you know it can be solved.
Hah! This reminded me of a similar story:

"In 1951, David A. Huffman and his MIT information theory classmates were given the choice of a term paper or a final exam. The professor, Robert M. Fano, assigned a term paper on the problem of finding the most efficient binary code. Huffman, unable to prove any codes were the most efficient, was about to give up and start studying for the final when he hit upon the idea of using a frequency-sorted binary tree and quickly proved this method the most efficient.[5]

In doing so, Huffman outdid Fano, who had worked with Claude Shannon to develop a similar code. Building the tree from the bottom up guaranteed optimality, unlike the top-down approach of Shannon–Fano coding."

https://en.wikipedia.org/wiki/Huffman_coding#History
But repo https://github.com/postgres/postgres in the list
Authorization is often very complex and depends quite a bit on the project domain. It's hard to see how any one size fits all solution could work.
I agree - this appears to be very sensitive to the polling resolution.

If you only run a task for 0.5 seconds, and you only check power usage every 0.25 seconds, you'll get an artificially high value.

They need to run this for much longer, and with no breaks (moments of low power usage).
Elon Musk Has a Fascinating Idea to Make Money on Twitter
It's obvious why these mid-century SF authors like Pournelle and Heinlein wrote all these cool-sounding aphorisms - that's their job - but it's not clear why anyone listens to what a grumpy old conservative SF author thinks.
When I started reading my brain went straight to Von Neumann. Now I really want to read a fanfic about a story where John Von Neumann is invited to a Google interview.
What? Did you not read the parent of this thread?

> strongly agree with readability in my opinion its cause Academia people live in "bubbles" and they assume everyone knew what a domain specific terms and greek letters means

In any case, I program HPC stuff myself with pytorch and no - I don't know the Greek alphabet and probably don't understand "non trivial math". The assumption that these people can't contribute is pretty off-putting honestly. More engineers would join such efforts if there wasn't so much gatekeeping.
I've heard of airline companies doing similar when interviewing flight attendants - United will fly you to Newark to interview, but often there will be people shadowing candidates to see how they behave during their travels and that feedback is taken into account when evaluating candidates.
That is on the library developers to settle out. Keeping your library API stable requires the mind of a genious and discipline of a monk.

Now, keeping your language design stable and backward-compatible is a no brainer. Given that, it's possible to handle "dependency hells" simply by building from source.

Hare is designed to be ultra conservative, so you don't have to worry about dependency hells. Features are in code, not builtin into the language.

It is a win-win situation.