skysight-inc/HackerNews huggingface dataset:
Let's assume that prior to acquisition, Heroku sec had set up a very secure posture using such tech. Then they lost most of their experienced people after acquisition.

Some questions:

1) Are these tech not enough to enable others - perhaps less experienced, or experienced but not on a particular product - to take over while maintaining the same posture?

2) What kind of additional (perhaps intangible) security does an experienced team add to the posture that gets lost when they leave?

3) As I understand them, things like risk frameworks, NIST CSF, security assessments are all supposed to anticipate people problems (resignations, malicious insiders, etc) and make the posture as independent of them as possible, probably relying on automated tools like XDR and SOAR to do their thing regardless of who's sitting at the console. Does it not work like that in reality?

Btw, thank you for your reply and insights (and to everyone else who replies)! Pardon my probably naive questions. I'm an outsider looking in and having trouble understanding this phenomenon of data breaches in the face of all the tech marketing.
Updated the post. It sounded like it was an ad for an UPS and it is not, so I rewrote parts of it. Sorry about that
If you're hosting _private_ git repos, why bother with a hosted solution at all? Why not just use ssh remotes?
I have no experience in organizations or IT systems that big, but, I can very much imagine that it's not only a matter of not having enough time to check everything, but over time, your systems become so big that it's hard to maintain an overview or, for that matter, control.

I mean, there's been numerous incidents of a random developer having copies of customer data on their systems, or accidentally opening up a database or an Elasticsearch instance to the world.

And I'm afraid the only way to help mitigate that is to restrict what an individual can access and do on the one hand, and bureaucracy on the other. And full-time staff whose only job is to maintain security and juggle access rights around.
Nokia 7650 was released in 2002 it had camera, though picture quality is not great.
anorexia could be viewed as part and parcel with the kind of body dysmorphia that is often displayed in weightlifters, not to mention anorexia is also seen at heightened rates among gays and mtf transgenders.
This is actually a travelling hack.

Airlines overbook and will try to get out of it by refunding your ticket. Refuse the refund. They'll up the price a few times. You can get up to an upgraded ticket on a later flight + hotel stay if the stars align.
USA. No idea that Canada has this same mentality. Good thing I didn't use "America" ;).
I appreciate you work on clarifying the situation. But my statement still stands, and you seem to back it up in your draft:

> The JavaScript application is then responsible for storing the access token (and optional refresh token) as securely as possible using appropriate browser APIs. As of the date of this publication there is no browser API that allows to store tokens in a completely secure way.

So with OAuth 2.0 + PKCE and no BE component, the tokens are directly exposed to the client, just as they were with the implicit flow. Also, if I'm not mistaken, PKCE extension is optional in OAuth 2.0, and without it you cannot securely use the code flow (as you would have to expose the client secret).
I grew up similarly and I think I have to disagree. When we had all the influence from the Tv, we would still se people that were really far away from us.

Right now a teenager that is spending their summer vacation at home can be bombarded with photos of classmates "having the best time of their lives" through social media.

You're right that parents should be more present but even if you explain to a teenager that what they're seeing on instagram/tiktok is not the full reality, it still has an effect on them. I know because even I feel it sometimes.
But this is surely non-standard OAuth 2.0, is it?
I'm not even in the US and I earn much less and pay more taxes. I'm a Data Scientist/Software Developer and I can barely afford to live in the city I work in.
Can't buy a house, can't expect work with reasonable pay in most places, will probably be impacted severely by climate change, food prices are quickly becoming extremely high. The future is shit.
I agree with you. In the interest of cohesion and to avoid conflict, every new user who posts their point of view and isn't a centrist-leaning-to-the-left progressive ends up banned in the end. Even if the new user is polite and well-meaning, after so many years the community is completely full of centrist progressives and every post that goes against that is a trigger for a flame war - in the interest of avoiding conflict it's easier to ban the new guy than it is to warn everybody involved.
Not all the data.

Women attempt more suicides, but men commit more suicides.

Some people say that this trend looks to be reversing in teens (girls committing more suicides) but not sure that’s already clear in the data.
FWIW, my initial interest in React had _nothing_ to do with Facebook at all :)

My first web app was built with Google Web Toolkit (GWT) back in 2011-12. GWT was a Java->JS compiler framework, and I used an additional library called SmartGWT that provided desktop-style widgets. It all did work, and let me use my existing desktop dev skills to build a web app. But, it also had a lot of pain points.

From 2013-15, I built a JS app using Backbone. Backbone's flexibility was great. On the other hand, it _also_ had a lot of weaknesses that I ran into over time. Nesting child views was really hard. There were a dozen ways to trigger events. You could use plugins to add functionality, but many were incompatible with each other. It had no rendering capability out of the box - you usually had to use something like Handlebars to generate HTML from templates (although in my case I used an addon called Epoxy for data binding). It had no lifecycle methods built in, although Marionette added that.

I started looking at React in 2015 because I wanted to rewrite that GWT app's client (no one else on my team by then knew GWT). I heard about React, started going through the docs and some blog posts... and saw something that solved basically all the Backbone pain points I was experienced. Natural composition of any components by passing props to children, children notifying parents via callbacks, automatic UI updates just by re-rendering, lifecycle methods... it was clearly just an infinitely better UI development paradigm than Backbone or GWT, and switching was a blindingly obvious choice to make.

For me at least, Facebook never even entered into it.
> therefore, it is possible that people ate about the same calories/perhaps regulated by homeostasis.

Are you testing for the effects of fasting or calorie consumption?
> afford owning a house sometimes

Good one. Maybe somewhere in rural Saxony, but not close to a larger city where I work.
Omega has watches that are METAS certified, so they resist up to 15000 gauss. They use silicon balance and silicon escapement.
Why wouldn't they be accurate? You have a fairly precise 44kHz sampling rate, the only issue might be identifying the ticks.
Having a quick look at their site, they provide translations to German and Dutch, where it is 'hallo', not 'hello'. More a quirk...
> They can always fix it after they take control.

The oil cannot be unburnt. The glaciers cannot be refrozen. The species cannot be made unextinct. At least not in any human lifespan.
This seems like a terrible idea.

Canada did this with 40-year mortgages (effectively lowering the monthly payment) and what happened? House prices shot up.

This is just feeding more and more money into the housing machine.
I agree that the quality of life is currently better than it has even been. Though the future is looming because of climate change. Last year, a heat dome destroyed a tow in Canada, yet we are just at the beginning of the consequences. This year, we are seeing intense droughts in India as well as on the west coast. Scientists predicted that it would happen and it does, but this is just the start.
We should be all on-board to prevent it and lower our fossil fuel consumption quickly to limit consequences. If you live in a rich country, just talk about energy sobriety around you and see how people react...
> Today’s IPCC Working Group 1 Report is a code red for humanity.
Sadly, even after the IPCC alarms, I have yet to see governments properly act. Young people know that, and they understand that their quality of life could be at its maximum at the moment, before decreasing due to climate change.

[0] https://www.un.org/sg/en/content/secretary-generals-statemen...
Based on media interviews with experts it doesn’t seem like the West has any legitimate claim on the money/assets and there’s a lot to untangle to make it legally possible to touch them. Even if that were to happen, the consequences would be significant.

The EU and the US could casually and arbitrarily claim the assets of any country which is involved in a random conflict not associated with either the EU or US. Nobody will like that, the former two included.

Hard to see why you keep talking about victory and which country will survive or not when the war is not over and nobody knows when or how it will end. You’re presenting personal preferences as facts.
Show HN: A system that helps you build ecommerce apps for online shops
Hi everybody,

Today it is my pleasure to introduce this tech oriented cohort to Goaddon (https://goaddon.com), a platform that I truly believe can change the landscape of ecommerce and raise the ceiling of possibilities for ecommerce businesses.

Let me briefly describe what Goaddon is.

Goaddon enables you to build ecommerce apps much faster than previously. Orders of magnitude faster. By ecommerce apps I mean apps that are able to integrate and exchange data with online shops. Goaddon provides you with the infrastructure to host the app and the tools to build it. Goaddon-enabled apps are instantly compatible with many different e-commerce platforms, such as Magento, Prestashop, WooCommerce and Shopify.

Goaddon removes the barrier of entry to such a degree that even individual merchants can spin up apps for internal use.

For example, if you regularly need to update your prices you could extract your own product data (using Goaddon), apply your custom algorithm and update your shop (using Goaddon) with the re-calculated prices.

Or if you are sick of spending all day processing orders you can extract your order data (using Goaddon), apply your own order processing logic end close the orders in your shop (using Goaddon).

Goaddon can also be used by systems and services that are already in business. For example chat-software and chatbots, customer service platforms, payment processors and ERP solutions. You only need to embed our interface into your website and start collecting data from clients shops.

Those are just a few use cases. If you have one in mind you should visit https://goaddon.com/competition and enroll yourself into our case competition, where we are offering to spend 1 week of free coding on your idea.

Let me know what you think. In fact, I have been coding non-stop for the last 5 years in order to get to this point of asking what you think. So give me your worst and best :-)

Btw, also just launched on https://www.producthunt.com/posts/goaddon.

Regards, Christoffer Dahl-Jørgensen
CEO of Goaddon
Merlin: Context sensitive completion for OCaml in Vim and Emacs
> Nests & Insects is "Roguelike" because it borrows elements from Roguelike Computer RPGs (CRPGs): hack-and-slash, dungeon-crawling gameplay, with procedurally generated Nest environments, lethal combat, and a hunger mechanic.

Perhaps excepting procedural generation, all aspects are those Roguelikes took from TTRPGs… we’ve gone full circle

But ADnD was clearly best DnD, and roguelikes are clearly best CRPG (because they draw from best DnD) so you can’t go wrong with that
It all depends on what you're trying to do.

These cases work flawlessly in Go, in my experience:

* Batch 10 tasks and run them concurrently (using WaitGroups).

* Locking resources while reading and writing with a mutex like sync.RWMutex, using .Lock() and .Unlock(), often together with defer.

* Locking resources while only reading with a sync.RWMutex, using .RLock() and .RUnlock(), often together with defer.

* Running code "in the background" with goroutines, ie. go func() { <code goes here> }().

* Detecting race conditions by building with go build -race and then running the program.

However, when using channels, select, closing channels, waiting on channels in a for loop etc, things can easily become more subtle.

On a general basis, I disagree that concurrency bugs are easy to introduce and hard to find in Go. However, pure functional programming languages like Haskell, with little state, will always have the upper hand when it comes to concurrency.

See also:

https://gobyexample.com/waitgroups

https://gobyexample.com/mutexes

https://gobyexample.com/defer

https://gobyexample.com/goroutines

https://gobyexample.com/non-blocking-channel-operations
exFAT has no journal, so you feel the difference when it's already to late ;)

>I’ve never noticed any difference

Well, i don't know what to say, but you can read some of them:

https://en.wikipedia.org/wiki/Unix_File_System

https://en.wikipedia.org/wiki/Unix_File_System#Bibliography

https://en.wikipedia.org/wiki/ZFS

UFS SoftUpdates are a bit like journals and UFS has something like policies so you can change the "behavior" of the filesystem on the fly. With SU, UFS gained the ability to make snapshots (a feature ~normally just COW filesystems support)

>A Brief History of the BSD Fast Filesystem by Marshall Kirk McKusick

https://www.youtube.com/watch?v=1BbMBdGPoHM

ZFS has just too many feature's to write them down, but data integrity, compression, snapshots and an integrated volume-manager are surely some high-lights.

And speaking about Linux Filesystems, there are some points that RHEL uses XFS and not EXT3/4:

https://en.wikipedia.org/wiki/XFS
Anyone know any good tools for uniformly setting aliasing, hinting etc... for fonts on Linux?

Text looks distinctly different between KDE and i3 and aren't as out-of-the-box ready.

Are there tools used by everyone here that aren't as well known to smooth out these issues?
Good to know, thanks! It does seem to have more packages and such for sure, and more traction among Haskell crowd I think from the bit I've seen.

Either way, I am more inclined currently to use packages on top of a base Linux distro, so suspect I can mess around more without committing to either for now.
V86: x86 virtualization in the browser, recompiling x86 to WASM on the fly
Jacobin is an absolutely junk media source. It is left wing Breitbart.
Currently playing The Mana World, a 2D MMORPG that has GBA graphics
Here's a screenshot: https://wiki.themanaworld.org/images/thumb/5/52/Caution_Avoi...
Really curious to learn how you perceive emotions. Maybe I'm reading into this too much, but this feels like the start of discussing an aphantasia analog.
There have been many. Acrobat CVEs were a dime a dozen in the 2010s
I'm surprised how many hardware issues they were having.

I am oncall for a ~10k node system, and this log looks pretty similar to my workload... Yet Facebook only had 1% of the number of machines I look after for this! With far fewer machines, they should have far fewer failures!

I suspect they are doing a bad job of root causing failures to make sure they never happen again. For example, that Nvidia infoROM message should have ended up with all the logs and a couple of troublesome boards sent to Nvidia engineering to find out why the corruption happens, how to make it never happen again, how to scan to find out if it has happened, how to auto-undo the corruption, etc.

The same with the infiniband bandwidth issues - get that stuff sent to someone who can hook up a logic analyzer or look at traces to find out exactly why it's happening, and adjust the design of the hardware, firmware or software to make sure it can't happen again and that you have good visibility of any future similar issues beyond just 'its kinda slow, shrug.'.
Shots fired, good on Stripe for immediately clapping back to set the record straight…
It’s time to move away from Gmail
> the only way you can write merge sort is if you memorize it

Nah. You only have to remember the central idea (if you have two sorted "runs", you can merge them into a single sorted run). You draw a quick diagram to explain the idea, you go ahead and write code that does it.

Then you apply recursion, and write down the overall algorithm (subdivide into runs until you can use some other method to sort it, then merge recursively).

Bonus points if you can explain the circumstances when this is useful (when you want to sort data that is a lot larger than your main memory, but you can write it on disk or tape). Which is kind of obsolete today, unless you are again dealing with BIG data (everything old is new again...)
When I was living with my parents in the 90s my elderly neighbors had (the wife's sister I think?) come to visit once or twice a month and it was always the same taxi driver, so I don't see how this would have been a problem.
Wouldn't it be nice if Postgresql could gain a native new storage engine which serializes columnar data as parquet files? Does this even make sense?

DuckDB already has fine Parquet support and I find it really helpful.
"Perception is reality". Musk is a master manipulator of mass media.
I was better at Web Stuff, I would love to have one of those single-purpose sites that tried to show at a glance the status of the semiconductor industry.

I mean everybody knows it's really bad, but it's so hard to get a feel for and to see if anything is changing, unless (I guess) you're seriously In The Trenches doing e.g. component sourcing for some boards.

I imagine something like https://dowehavechipsyet.com/ (made-up domain) with current inventory across western and eastern suppliers, price with price trends, manufacturer's stated wait time for orders, and so on. Like an aid in quickly seeing the state of the industry, perhaps for uh I don't know, either some varied selection of components (micros, transistors, power parts, etc) or deeper with perhaps 5-10 chips from each category.

Does that exist and nobody told me? :)
You must be fun in taxis.
Yes, this has been dramatically improved. Servers scale up in 15 mins or less nowadays. (I do some work with Cloud 66 and they are dedicated and passionate about their product)
Image caption from the article: “No escape for you, target human. Image Credits: Zhou et al”
I've seen one case at Google where a Manager was going for promotion, in part based on some metrics claiming the product usage increased a lot. Someone found that the metric was broken and was overcounting, but the report chain was explicitly told NOT to fix the bug until the manager gets promoted. This was kept broken for months. He did get promoted to L7 (senior staff), since the metrics were very positive, even though it was not deserved and the product was worsened in the process.

Make a huge incentive of promotion, behind well defined rules, and smart competitive engineers will tlgame the system. Even if it's an actual negative value for the product and company. You can always change teams after promo and start fresh with your increased total compensation.
>Even now two years into it, the low quantities available retail are still selling at double or triple MSRP.

BestBuy had fine stock when I went in a week ago. Next gen is dropping soonish so miners are holding off.

I got my 3090 from a miner who was hooked in to the scalpers. They weren't so over priced, a lot of people just look at the cheapest possible 3090 and compare to that, not realizing there are different levels.
Maybe they can make income for the payments by living in the garage and renting out the living areas.
Both for you and the person you are replying to, I would caution that “Europe” isn’t one country like the USA, even just the EU is 27 smaller countries in a trenchcoat — the average may be lower, but bits are higher.

University tuition is wildly variable and not directly proportional to income: https://en.wikipedia.org/wiki/Tuition_payments

(Housing costs are also wildly variable, but I don’t know where to get enough data to tell if that’s proportional to incomes or not).
My claims:

- the rise of Electron means that:

1. a lot of native applications got killed off

2. those that remain have fewer features (native applications generally tended to be feature-rich). For example the web version of Outlook is nowhere near as feature-ful as the true native version for Windows.

3. Electron apps have worse UX due to much slower response times to every single click (which is both perceptible and infuriating, if you are one of the people that can see it), consume much more RAM (no, RAM is not cheap - maybe for you it is, but is it cheap for the end user?), and do not use native controls a lot of the time. The former two points can be verified by loading Microsoft Teams.

4. Even if the user has enough RAM for an Electron application, they may not have enough RAM for five. Lighter-weight alternatives aren't always available, and sometimes you just have to run that many side by side if required by your work.

- due to this, many machines that could have otherwise been useful for a few more years (anything with <=4 GB of RAM in my experience, YMMV) became e-waste prematurely because of the accelerated obsolescence, which not only imposes unfair cost on the consumer, but is also bad for the planet.

- the JavaScript ecosystem largely relies on NPM for dependencies. NPM is very far from the level of maturity achieved by comparable ecosystems for other programming languages. This means that somewhere down in your dependency chain, your application relies on something ridiculous like left-pad. This results in a technically inferior product, and more pragmatically speaking, introduces many more opportunities for third parties to break your dependency chain (intentionally or not), or to slip in extra code (I think it was node-gyp, a common dependency, that selectively ran in destructive mode in case the current machine's geoip was Russian or Belarusian).

A lot of the points I raised about Electron apply to JavaScript as well.

TL;DR: the JavaScript ecosystem is not very conducive to good (stable and performant) engineering, short of heroic efforts like those undertaken by the VS Code team. Most teams don't actually care as much, so the resultant Electron applications are slow and unnecessarily huge. The result is a worse user experience.
Three words:

Get. An. Electrician.
I have an app which was built 10-ish years ago using C# and which I rewrote using rust - in almost no-JS, fully server-side style. (I somewhat factored out the web framework that I ended up with - https://github.com/ayourtch/rsp10)

After reading this article I sent it to a coworker “hey if I wait for another couple years the style this app is written in will be all the rage again :-)