skysight-inc/HackerNews huggingface dataset:
Just because you’re not a security expert doesn’t mean security experts don’t exist.

And it certainly doesn’t mean security review is useless. You don’t even need to be particularly good to catch some of the worst things I’ve seen. Soc2 doesn’t necessarily mean you are secure but it does require the organization to do quite a few things that it’s a good idea to do. Periodic internal security review, having a password policy. There are few things in soc2 that are actually useless. Real security requires more than the compliance checklist, but the checklist isn’t a bad place to start.

Honestly deciding to care about security is a good place to start. Look at Colonial Pipeline. If they’d cared about security at all they could have hired a security engineer or even promoted a capable internal IT person to security engineer. That person could have even been wildly under qualified. Imagine going to work your first day as a security engineer, knowing you don’t know shit. What’s the first thing you do? Google security best practices. One of the top ten things is don’t share passwords. Another is don’t reuse passwords, another is rotate passwords when employees leave. (So write a password policy for the first two, but 1password, create a checklist Telford the third) Those three things would have prevented the thing that actually got them breached. The rest of the list of top ten would have prevented them getting ransomwared.

None of the bad security I’ve seen has been particularly hard to identify or fix. The problem has always been insufficient will to fix it.

I have yet to see an organization that implemented all of what I would call the easy stuff. I’d be thrilled to see it because it would mean we could dig into the truly hard stuff.
Which they can host elsewhere.
So much noise here and ill-informed comments fail to give a broader understanding of what's going on. Elon bought up Twitter shares early in the year for a reason, because he wanted more control over Twitter. He bought up so much Twitter shares that when it was announced via the SEC, Twitter offered a board seat under the clause that he wouldn't acquire too much % control over the company. He obliged, but then left when he realized he couldn't make the changes he desired at the company. Plus, people on the board at the time, specifically Dorsey, was nudging him to buy out the company as a whole. So he did, hastingly. That was an ill-informed decision and obviously a mistake made with respect to doing due-diligence. In hindsight, before the market crash that price may have made sense. But fast forward today with looming recession talk, it's pretty clear he realized it's overvalued (we know this from tweets about twitter deal being repriced). And so he needed an escape hatch, hence the issue with bots and the unverifiable mDAU was a great talking point. In fact, he may as well be right on the issue as Twitter doesn't want to reveal how they calculate it. What he's trying to do right now is pretty clearly force the board to give a better deal. He's not sold any stock and likely won't unless he's actually out for good. But given the amount of effort and thought he's put into it and making it clear that he should pay a lower price depending on the bot issue, I don't think there's much doubt he's not actually leaving Twitter. Whether the courts will force an acquisition at the current price however, is a looming question. My bet is they settle at a lower price.
> there is an emerging consensus that the "new shiny thing" weapons haven't had nearly as much effect as anticipated

I don't think there's a consensus. The things are all different: some underperform, some others are awesome, and sometimes this even depends on the environment.

For instance, these high-tech anti-tank missiles (NLAW, Javelin, Stugna-P) were awesome around Kyiv (many places to hide in a forest or urban environment), less so in a prairie. South and East of Ukraine is a prairie: https://en.wikipedia.org/wiki/Pontic%E2%80%93Caspian_steppe
AWS Lambda Pitfalls Most Developers Don’t Know About
Avoiding Puppeteer Antipatterns
US South?
Two things: OP is SOC2'ing & also the mgmt of the firm seems inexperienced but trying to sell expert services.

Which is very different from pen testing, internal/external vulnerability assessments, PCI level 1/2, etc.

SOC2'ing is often like an auditor verifying that one does things according to a prescribed, or described process that the company attests to. I've often viewed it as 'accounting style firms' looking to get a bite of that 'juicy security scare fee pie'
Oh, that's pretty extreme. May I ask what job you do and why you need such fine grained history?
Many people routinely jay walk and speed and we've decided as a society that they shouldn't go to jail.
Almost like tech solutions don’t always scale to handle international growth. That can’t possibly be right though… Growth is the only thing I’ve ever known. What will I do now? Nobody’s going to let me play with hundreds of millions of dollars if I merely make something that “works correctly”.

(Dead inside and being sarcastic, btw)
This is why we encourage WebAuthn by default (and why PyPI is giving out free security keys): it’s much more misuse-resistant.

Ultimately, PyPI cannot prevent TOTP secret misuse. But we expect the overwhelming majority of users to not misuse TOTP, and a corresponding security advantage therefrom.
What is here was dangerous and repulsive to us
Specifically, with a straddle or strangle strategy
Yes you’re definitely right - I’ve recently started using SeleniumBase for Python which includes a few extra niceties. I was more asking about the part where you compare between releases (or test suite runs) to see if anything changed. I suppose you can just use compare hashes, but I could imagine also having some feature that highlights changes on the screenshot.

SeleniumBase has a feature that looks at markup and which stores screenshots for visual comparison to a set baseline: https://seleniumbase.io/examples/visual_testing/ReadMe/

Found this blog describing use of SeleniumBase for that and OpenCV for screenshot comparison as another layer: https://blog.streamlit.io/testing-streamlit-apps-using-selen...
> Do you really believe this is equivalent? You can't see any distinction here?

I assume the distinction that you want me to draw is that I'm an independent adult, and the baby isn't. Consider instead, then, if the government saved a toddler's life. Unless the parents died, or were themselves trying to commit the murder and so are now in jail, responsibility for the child in the future will remain with them and not with the government.

> Do you know the percentage of fertilized eggs that make it to the uterine wall? That make it through the first week of pregnancy? That make it through the first trimester?

I know it's low. But the fact that natural deaths are common in a certain situation doesn't automatically make intentional killings in that situation okay. For example, even though the survival rate of Zaire ebolavirus is only 10-17%, it's still murder if you kill someone who has Ebola.

> Should couples register their fertilized eggs with the government so they can be tracked?

No, we don't need more government tracking, and the right to life shouldn't be conditional on being tracked by the government.
And yet highly logical people on HN will simultaneously argue that the government and its bureaucracy is a great thing and we should increase regulation and rules in all facets of the tech industry.

The security side is literally the only part of tech that is remotely “regulated”. Self-policing organizations created their own standards and private firms conduct the audits. Yet it’s obviously bullshit and box ticking.

Do you not realize this is how everything in society works? It’s endless make-work where highly credentialed know-nothings check boxes in order to fulfill some bureaucratic process they didn’t invent and don’t care / aren’t capable of improving.

This is the end result of bureaucracy.
It's the nature of the problem. In suburbia, station must be further away on average, the difference in density with a major inner city imposes that. A 15 main ride on each end is something that is nothing unusual here, and millions travel that way.
You're way too expensive for this sausage machine.
i wouldnt be surprised if ads paid much better given the ultra high income first world country user base, frequently on work laptops that might not have adblock installed too
Geez I'd just cross the street to avoid the situation rather than go to that kind of effort.
> a friend in Greece roaming with a Canadian Rogers SIM card was unable to use her phone

I've heard this from several individuals. It makes sense: Rogers, being totally dark, couldn't authenticate any roaming sessions.

I wonder how fast a roaming provider boots you off their network though. Roaming usually tunnels your traffic to your home provider, so I could see data halting immediately. Maybe local calls work for a while.

This effect sunk in when they said they couldn't receive any SMS 2FA. Even people with a local SIM SIM setup (highly recommended!) still need to slide in their home SIM to log into some things.
The whole cloud data collection, and the fact that their privacy policy is now veritably incorrect for over 2 years now certainly makes it plausible there's more they're keeping away from us.
I disagree. I believe culture drives law long term. For example: The abolishment of slavery began as a movement where people(in the north and overseas) were disgusted with it way before before it led to legal reforms. The south played the same tricks that they are doing today. THe difference was that the control of the narrative led to meaningful action(ie. Lincoln ignoring the supreme court/threatening to impeach, Civil war etc.)

In recent times, the law has either gone fully right wing or is left wing but on shaky ground(depending on the issue).

>There is a growing disconnect between the culture of both coasts and the law of the land, which tends to approximate the real balance of leftish/rightish viewpoints across the entire country.

This is a result of people in the coasts saying they believe in something but not fully meaning it. Therefore they will not fight for it with all their might. The coasts are more populous, generate all the major economic growth, and as you said, control the narrative. Yet the rural areas are known as "Real America™". How is it that the coasts are continuously losing? It cannot be a grand conspiracy. They just don't really want it. With that you can make the argument: Does the left 'really' control the narrative if the action behind that narrative does not really exist?
Interesting you'd say that in a thread about ISPs, considering we have regulation-enforced separation between the owners of our government-funded nation-wide FTTH network and the actual service providers. This means I have over a dozen ISPs to choose from, and they all over gigabit fibre and compete on price, customer service, and things like IPv6 or CG-NAT.
> and if the higher ups still need a rubber stamp from a third party, well, that’s up to them…

It is a borderline racket where everyone is insisting on this cert from everyone else they are doing business with at the enterprise level.
The post that you're all talking about was replying to someone who attacked everyone criticising Go and called advanced PL features "type system fidget spinners".

Addressing this kind of post doesn't require providing examples of how Go can grow. Also, I don't see why is the bar for criticising Golang's stagnation so much higher than the bar for people that want the language to never change.
To HN: Brazilian Video Based Recruiting Startup
The Always on Processor (AoP) and Secure Enclave Processor (SEP) aren't one and the same. The AoP is what's always listening on the mic for "Hey Siri" and then passes off the audio to the AP once triggered. The AP then runs a much larger neutral net over the audio to either confirm a false activation or start parsing the request.
Facebook is not PyPI’s “primary sponsor.” To the extent that any company could legitimately claim that, it would be the one that provides PyPI’s CDN for free.

Here is my first-hand account: the money that Facebook donated to PyPI was used to pay me to implement 2FA (and a whole bunch of other things). It wasn’t used for any of the current rollout, to the best of my knowledge.
Doesn't that just push the problem down a level? If they do that, then they just need a way to keep the vandal from making a new account every time his old one gets banned. What do you want them to do about that other than banning all of T-Mobile from registering new accounts? Require something onerous like phone number verification?
Sometimes loyal consumers fight back and win.

https://www.thebrandingjournal.com/2015/05/what-to-learn-fro...

Dropbox rebrand was panned as well.
https://www.dezeen.com/2017/10/11/dropbox-rebrand-logo-visua...
Yikes! That seems quite brittle if you don’t mind me saying ha.
Email Dang and he'll explain what happened. I've sent him similar (stupid) questions :)

hn@ycombinator.com
"SOC'ing"??
Those two are so different I don't see how you can conflate them.

One is ripping out a technical inner working from a website and using that to create your own.

The other is just making a directory of where to find things that are intentionally publicly available
I was put off by the fact that the author apparently has examples, but refuses to share any, because they're "infohazards". Instead they advance an argument by analogy.

If this effect, memetic inoculation, is so prevalent, we should be able to find some ideas that we recognize as good today, but which took far longer than they should have to gain traction because people in the past had memetic inoculation against their simplified variants. I fail to see how that would be an infohazard.
The point of these types of audits isn't so much to determine "security" its to leave a paper trail so that people aren't accidentally lying to customers. It proves that you are either doing what you claim to be doing or intentionally being decitful. It cuts out the murkey middle ground, of "we didnt do what we claimed, but its all a misunderstanding & accidental so you can't blame us".

How much it suceedes is debatable but auditers being security experts is irrelavent to those goals.
Ghostwriter has always been one of my favorite songs.
Rescue insurance isn't hard to come by or particularly expensive for the group of people who spend a lot of time outdoors. The American Alpine club, for instance, offers rescue insurance with a membership, dollar amounts vary with membership "type."
My whole career has been C++ and shader languages, so this really hasn't come up for me. I imagine it being a real word would improve readability greatly.
Dupe: https://news.ycombinator.com/item?id=31973894

(6 days ago; 38 points, 44 comments)
I ended up owning a credit card merchant service processor when a customer hired my company, and then immediately not paying the bill - right when PCI was getting rolling. I'll never forget my first audit, where I was the CEO and lead developer for the MSP and the 20 something auditor was trying to disapprove my company because I had access to both production and development data. It took four days for them to figure out that because I owned the company, it was both acceptable, and unavoidable.
but seriously job listings can pay much right? adblocks are serious threats to their ad model.
This is true for many many industries. McKinsey bills over $2k for small teams of 3 kids straight out of college. I was managing millions of dollars in advertising dollars while getting paid $12 as an intern.

Sometimes you pay for the resources, processes, and is intuitional knowledge put in place by a vendor rather than the warm body who is your point of contact.
Back in the day, people used to ask about learning Swift without bothering about Objective-C because of the same reasons as yours. But? Swift is still controlled by 90% of libraries written in Obj-C. So all of these frustrated had to learn itty bitty Obj-C. This is the story of almost every language and its evolution.

So, you will be fine using Kotlin for problem solving even upto algorithms of Competitive Programming. But if you want to build real world use cases and projects, you will have to go through the Java Libraries and other ecosystems because nobody will rewrite them just because a new language came by with hype. That includes Android even though Google officially supports Kotlin.

Ofcourse, Scala and clojure are exceptions.
https://youtu.be/31PtYw7WeLU
Century - Golem edition: grab gems, grab cards, use cards to combine gems into other gems, use gems to buy points or cards.

Azul, as others pointed out.

A lesser known game:

- Titans Tactics: a game without randomness, very deep and intense 1v1 combat

An expensive game that is very immersive:

- Nemesis (all kickstarter expansions): a game set in something similar to the alien universe. Rules are meant to be very immersive, so for example an alien doesn't have hp in the traditional sense, they change hp on every hit, to simulate the fact that little is known about their anatomy.

Finally a master piece that feels like clockwork:

- Vinhos: wineries and wine making, competitive

I stopped playing coop games because I turned into an alpha player and hated myself in the process.

Sadly I don't play anything anymore, my kids are too young and will destroy my precious games.

We do play a board game called Catapult Castle that's intended for kids but fun for adults too
Integral matrices with integral inverses with Julia code
I expect this Court would find it a violation of he 10th amendment, leaving the issue to be decided only at the state level.
The media is not at the whim of the Trudeau govt. There’s the National Post and Rebel media. CBC itself has been highly critical of the govt if you care to watch it. Then there’s CTV and Global News. And I recall a number of newspapers and radio stations are owned by conservative interests.
Interesting. I was thinking of the mechanics of what's going on and it always feels like there's gunk I can't cough out in the back of my throat. Tried some Mucinex today, going to take it tomorrow morning and see if it prevents my early morning puke (which is mostly dry heaving as there's nothing actually in my stomach). I never ever feel nausea while I'm laying down or sleeping.

I do worry that with Chloraseptic I'm treating the symptom but not identifying and mitigating whatever the cause is, but I might try it to help keep me from throwing up! My wife recommended it the other day but I dismissed her out of hand. I really should listen to her more.
I felt this deserved another reply, the information in the table is taken directly from the packaging/product and from the companies themselves. In some cases, info on how to interpret the label is provided (i believe this is valuable). Goal is to have more detailed ingredient sourcing info eg. individual countries per constituent ingredient, in the coming weeks. All the links are to iHerb products as of today.

I understand that it is vital to provide this information on the process. This will be on the website. Thank you
> That might actually hurt Musk's argument, because Google is incredibly lucrative despite the belief that ad clicks are overwhelmingly fake.

They're still charging advertisers for those clicks.
I don't quite get what is wrong with saying:

thing2 ...

That is shorter than adding a { and a }.

This feels almost like a solution in search of a problem?

Although I do agree it is nice to know that you can use blocks without 'if' or 'else' or 'while'. It feels like a curiosity though.
Emrah, who has provided me with an important hint - that this paper is not worth reading.
If only there were a service that provided such hints automatically :( sigh ....
Pentests are really different from soc2 type audits.

But quality of pentests do vary significantly depending on who you buy from.

Rubber stamps can be useful as an absolute minimum base line, because companies will lie through their teeth that their product is "secure", and at least with even a poor pentest you know you probably wont get easily hacked by a script kiddie, which may be a valuable assurance.
There's a mix of naming here. The original post was about soc which is more about organisation posture than specific apps. What you got was a crappy pen test. What you were advertised was an audit. I don't have a solution unfortunately apart from posting here to let more people know they're different things and they should do research and set expectations of what results they want before dropping big $$$.
The BSD socket API on many systems implements a raw socket type[1], so you can use the socket APIs to talk raw IP.

Some systems (Linux, Darwin) also implement a special icmp socket type which can allow unprivileged ping.

[1]: https://man7.org/linux/man-pages/man7/ip.7.html
That one guy in 1887 nailed it.
I don't find Nano very productive or very easy on my previously RSI-suffering hands and wrists. VIM is so much better for me along those two dimensions that it's not even much of a comparison.
The NSA is known to surveil people who are completely harmless, including spouses, loved ones, romantic interests, etc.
I think a lot of people don't understand what bipolar is. They hear it and think he is a moody guy whose actions are reasonable. They don't understand that manic episodes are characterized by unreasonable, illogical, destructive behavior. A grandiose vision of being Twitter's and free speech's savior, which turns out to be very poorly thought out, fits with that.
Used to use Qubes OS, quit because I could not figure out how to move files / share files between VMs securely / easily.

Want to try again, but a little concerned that AWS seems to have moved away from Xen.

One of the points that look like a plus to me, was that Qubes OS was based on a widely used, battle tested hypervisor, Xen.

The biggest cloud platforms looks like AWS, Google Cloud Platform (GCP), and Microsoft Azure. I should check if what hypervisors they are using.
I could see the EU being more self sufficient. But at the same time it will be difficult given that they have a serious population decline. You need that population to grow the GDP. Furthermore some essential industries seem to be completely abandoned by the EU. (Looking at competitors to the FAANG companies).

>The EU would probably try to find closer relations to countries with semi big military, totally guessing here India, South Korea, Japan, Australia, New Zealand, Turkey.

This is assuming they have the capability to project forces anywhere in the world which given these countries you listed, feels unlikely either now or in the distant future.
This is an interesting example showing how P&L evolve from a company's IPO to their annual report. As a shameless plug and as an alternative to the author's suggestions of using EDGAR search or individual company IR sites, you can use https://last10k.com/sec-filings/hcp to read Hashicorp's S-1 and 10-K more efficiently using our online tools.
Yes, it's scary.

I wonder if running ghostscript's pdf2pdf inside a properly jailed/locked-down/container/firecrackervm, possibly an ephemeral one, is sufficient to neuter it.
Some regulations are good, some are bad. Some just have purposes different from what people assume. Saying its impossible to regulate anything is just as stupid as saying its possible to regulate everything.
> until he won

He won. He prevailed. In court. Whatever you think he did that violated the SEC's order, is not correct, at least in the eyes of the judge or the jury who heard all the evidence and decided the case.

Rich people do have the benefit of hiring excellent lawyers and affording every available opportunity to appeal. But that is not being "above the law," that is the law. At the end of the day, if Musk won even on the 10th appeal or whatever, then you can't say that he committed a crime.
You left out Bell... does Rogers basically never lease lines from Bell? Or it depends a great deal on location? (everything you said is correct afaict btw)