skysight-inc/HackerNews huggingface dataset:
I would never have someone else manage my passwords for me.

You have to trust the server. It could serve the user with malicious JS code or an app update at any time.

You can self host it though.
"But they are not solved, are they?"

You might have overseen

"and we implement ways to not reach high bug levels again"
No phone number required, decentralized network and third party apps allowed when? That's only information I care about Signal, until then Element (Matrix) FTW.
Your colleague doesn't understand relational databases, which, unfortunately, is fairly common - classes on RDBMSes are electives in most CS programs. It's scary/concerning this person is being allowed to operate like this - I'd suggest your company add design reviews and code reviews to reel this sort of rouge behavior in.

...Of course, if nobody understands relational databases at the company, then that won't help...

Even if data migration was difficult with foreign keys for some reason, they can be disabled at the time of migration - no need to put weird constraints on day-to-day operations.
Instant streaming APIs with built-in authorization for new or existing Postgres
Remarkable idea! I like the "Ask your parents" feature.
I moved from LastPass to Bitwarden a few years ago because of the nimbleness and simplicity of it, it felt so refreshing.

How much time do we have left before Bitwarden gradually becomes as bad as LastPass for the sake of high growth? 2-3 years? I’m not passing any judgement on this raise, entrepreneurs do what they gotta do.
Yes, but this is China that you're talking about where EVERYTHING is connected to a lying government. Nothing would happen except for a coverup as the Chinese government will never ever come clean.
Y'all remember how well Mozilla getting taken over by activists went? Witch hunt firings followed by years of failed product launches and loss of market share while leadership basically just checks out and collects their salary?
Well that’s annoying. I guess the clock is ticking on Bitwarden becoming user hostile. I can’t see how they’ll be able to produce a return on that investment at their current price points.

Having said that, I do think there is an opportunity for Bitwarden to expand into application secret management, and that could be a lucrative market with big enterprise customers if they get it right.

The announcement seems to be a generic “nothing will change” announcement though, which doesn’t inspire confidence as:

- These are almost always reneged on later

- Clearly something has changed (or why bother getting investment), they’re just not telling us what “we can deliver on our roadmap more quickly” could not possibly be more vague.
Host your own bitwarden instance then.
In many ways it's a shame when a useful tool turns into a high growth startup. They're going to hire a bunch of developers who will need to justify their existence by adding features, they'll probably eventually either fail or get purchased and shut down. And then all the overly complex applications will start to rot.

What's wrong with saying "this is a useful tool" and leaving it at that?
It’s the password manager of my choice. I hope they manage to survive. Maybe they should try increasing their annual fee. At $10/year it’s a steal
There is also no evidence that it came from animals directly.

Given that there are really only two plausible hypotheses, and nondirect evidence of either, we have to speculate based on circumstantial evidence.

And if one hypothesis is floated around the media, we need to raise the other one as well.

I'll also point out that some people don't like to believe that there can be global media conspiracies, even though there are (cf. "masks don't work unless you're a trained medical professional" propaganda at the beginning).
What I saw is that it started in SW Indonesia, in a jungle near the coast, in 2008. That was its first appearance:

covid-19 origin's

i see this coronavirus first originated in South West India

And first jumped to human in coastal Bengkulu/West Sumatra in Indonesia

I'll try to get time on these events

end of 2008: origination in SW india near Mangalore

1Q2013: first jumps to humans in BGK/WSU indonesia after an animal outbreak on the coast in late 2012

first substantial human outbreak: Mid 2013 slightly inland from outbreak location.

but of course there's no political capital to be made by blaming these poor places ....

feel kind of sad to consider how much of the crazy blame game is actually driven by knowledge, desire for truth and competence, and how much of it is just driven by political competition....i guess the motivation doesn't matter...the result matters. the output is not about truth it's about politics and narrative ... so sad....
De-clickbait quote: C is the lingua franca of programming. We must all speak C, and therefore C is not just a programming language anymore – it’s a protocol that every general-purpose programming language needs to speak.
Trivia related to the hyperbolic geometry - There was a game released recently that have a world set in hyperbolic space. https://store.steampowered.com/app/1256230/Hyperbolica/

If someone wants to 'grasp' what hyperbolic space is about, this game is one of the fun and inspiring ways to do that.
I think a more accurate title for these sorts of things is "Synthetic embryos look like they complete gastrulation to neurulation and organogenesis".
Still impressive but with these sorts of things it's the unknown unknowns that are the problem.
> I create all fields as NOT NULL and use empty string in place of NULL.

...but why?
Bitwarden already does one thing well. It's everything I'm looking for - open source, costs money but not much ($10/yr), 2FA, clean interface. I'm happy for the new investment, but I hope they don't start adding new things just for the sake of growing.

Also - to the people who analyze funding rounds - $100M sounds like a huge amount to me. Why would a password manager need so much money?
> should be handled as a critical secret. Sadly, users may not know that.

Or find it inconvenient at some point and think "it doesn't matter that much, does it?"...

As is often the case, the human is the weakest link in the security chain.
Hey Andrew, thanks for checking it out. I think that the tradeoff between control and convenience is super important. We've tried to focus on convenience for Nitric, but also make the plugins and APIs transparent so you can regain that control when you need it. That said, it's hard to balance. Have you checked out Pulumi? They're another great option we like if you want control like CDK or Terraform.
If you self host, your server could still be compromised. I think the primary thing making that unlikely to happen with a self-hosted instance is being a very small target.
It is up to one's empathy, but mercy isn't something strictly directed towards humans. For some people it is universal, others have no mercy even for fellow humans.
Yeah, there is a cognitive cost to frameworks like this. Ruby on Rails is the same, where there are conventions to learn and pitfalls to avoid, but like DHH said "look what I don't have to do".

I've worked at companies that have had bare metal DX and they used it to stab themselves. I mean, anyone can be contrarian, and that's not what I'm trying to do here, but there is value in "idk what the queue is or how it's implemented, but I know how to call it". If you're not using an abstraction layer for everyday engineers (on a project that has 20+ engineers on it), then that means either your building one yourself, or you're forcing your teammates to engage with DevOps themselves.

If I were to start a company from scratch, I'd use something like encore.dev, because even though there's a framework to learn, it's a DevOps-less, or less-DevOps approach to building software fast without boilerplate.

And I'm not sure what it is about express.js, but everyone seems to have their own way of doing it. It's cool to see paradigms solidify, like tRPC and Nest.js, and now this.
The trend of open source spyware is really worrisome to me.

More often than not these corporate open source projects include spyware features (Bitwarden included) that phone home without user consent.

They claim selfhosting is a goal, yet their published client will report on your activity to Microsoft without your consent.
Bitwarden is just great! One of the few pieces of software I am really happy to pay for.
Ok I have been putting off for sometime now, but looks like it's time to learn to host Vaultwarden
UI from the past tried to solve false UX problem. How to present to user a big amount of information they can look (literally) through. At the end filters and search were the answer.
Not quite. He needs to communicate with everyone, even folks who don't have WhatsApp installed. Not many of them, but they do exist in Brazil.

Either way, it's not going to be an expensive iPhone with iMessages is it?
> there is insufficient evidence to define upstream events, and exact circumstances remain obscure

From the paper.
You might not, but the vast majority of people unfortunately already trust companies like Google with their passwords.

Likely though they will be stored and kept properly, and there won't be leaks. I only said 'unfortunately' because it hands dependence over to Google. Loss of access is the main concern.
I didn’t get it for a long time until it went gangbusters through this area and you’d pretty much need the agoraphobic lifestyle to avoid getting it.
"A million dollars isn't cool. You know what's cool? A billion dollars."
Yes. Though I'm not sure I see the connection to the OP...?

The example I'm most familiar with, because I work on it, is Shadow. We used ptrace for a bit but now use seccomp.

https://github.com/shadow/shadow/
This is Goodhart's law in action. People measure academic worth by publications, so people need to publish a lot.

In theory, if one were to switch to alternate measures, this form of pollution would cease overnight. I wonder if there are superior measures already in use?
Note that it wouldn’t be a strict aliasing violation, for example, if the argument to bind() were typed const sa_family_t *. The annoying cast would still be required, but very much legal (as long as the other side hasn’t screwed up).
The Twitter thread is the SparkNotes on the paper.
Yup. My first thought was “why does a messaging app need a board of directors?”. I guess I just don’t understand tech.
I agree. That’s a huge investment for a product with a currently very low individual user price.

I expect to see a rapid push to enterprise with individual users left behind and a lot of broken stuff along the way :/
I use Vaultwarden (formerly bitwarden_rs) just for myself.

I still use the Bitwarden extension in Firefox, which is a similar attack surface to what you describe, though probably a shade less vulnerable in practice. I’d like to replace it with something leaner and functionally superior (it’s pretty heavy, and has the major problem of mostly not working in Private Browsing windows, and some other timing/focus issues that I suspect stem from the same bad design), but I have too much other stuff I want to use.

I don’t serve the Bitwarden web interface on my server at all, but I could.
The cases were very heavily investigated around the wet market — particularly looking at adjacent hospitals. This is an obvious example of a biased sample.

If you were doing controversial research using controversial methods how transparent would you be?
> We are looking for Backend Engineers & SREs

Hi, can't see any backend positions. Only full-stack (which seems more for the frontend) and others (data engineer, head of product, etc.)..
> The Bitwarden business model will not change

Bitwarden remains committed to
A fully featured free version, forever
An open source architecture
The ability to self-host
Advanced business features

This is great!
Over in Japan, it's quite common in schools for the students to clean the classrooms, club rooms, hallways, and occasionally also the restrooms themselves. The schools mandate it as part of the curriculum, since it teaches vital life skills and builds character.

The schools have janitors on their payroll, of course.
My understanding is that APM became or always was a marketing term which is used rather freely. For that reason I try to avoid it, but search engines love it and I don't know a better alternative.

>Whether I can find out why that component is slow might not be as easy (not sure what granularity tracing happens inside a component).

It is true that you can't always guess what operation going to be slow and instrument it, but it is almost always a network or a database call. There is still no way to tell *why* it is slow, but the more data you have the more hints you get.

>What's the usual overhead of a single tracing

Depending on what is your base comparison point the answer can be very different.

Usually, you trace or instrument network/filesystem/database calls and in those cases the overhead is negligible (few percents at most).

>But does that mean taking a trace is very cheap?

What you've described is tail-based sampling and it only helps with reducing storage requirements. It does not reduce the sampling overhead. Check https://uptrace.dev/opentelemetry/sampling.html

But is taking a trace cheap? Definitely. Billions of traces? Not so.

>request sampling decision something that's common or that's a totally unique capability some have.

It is a common practice to reduce cost of sampling when you have billions of traces, but it is an advanced feature because it requires backends to buffer incoming spans in memory so you can decide if the trace is anomalous or not.

Besides, you can't store only anomalous traces because you will lose a lot of useful details and you can't really detect anomaly without knowing what is the norm.

Hopefully that helps.
Or, you know, you could just open a tab and type in USV, right?

It's kind of amazing how many people have the option to do that and find something new out, but will instead make up shit.

https://en.wikipedia.org/wiki/Unmanned_surface_vehicle
This is so unethical and sadly not rare. I have had people reach out to me (twice, recently) on LinkedIn to interview for them (using names and credentials of people who have work authorization for USA) and the offer is usually a fixed rate + commission per job per month for the lifetime of the job. They hire skilled engineers to secure the jobs for them while outsourcing the actual work. So the scam can go further than just outsourcing the work to people with potentially far lower skills.
How about something much simpler, throw your used paper towels INTO the garbage can in the bathroom. I am amazed by the number of supposed professionals that leave them on the counter or just on the floor. It boggles my mind how hard this is for some people.
Avalon (2001) - https://www.imdb.com/title/tt0267287/
The tyranny of the wagon equation
How much they chase growth and how much further investment there is will probably be one of the big concerns. Also how much ROI the investors expect.

The market does seem to have space, 1password has an estimated ~235m revenue, and lastpass and dashlane ~70m. And all of them are quite a bit larger than the latest headcount I saw for bitwarden (reap. 800, 400, and 400, versus <100 for BW).

But it is worrying, especially with bitwarden having low TCOs currently, especially for the free-er side of the offering.
Can a non-colorblind see the numbers in dim light, when color vision is "turned off"?
I think your link (or rather the reference in your link) refutes your statement. If I'm reading correctly, beyond age, you also have to subgroup by sex and by the particular vaccine type to find a subgroup where myocarditis risk of vaccine exceeds that of the disease.
As someone else has already pointed out, the provenance of the virus, and its emergence/release location are two distinct matters.

There appears to be consensus on the latter: the wet market (although some do wonder about the mystery illness in Summer of 2019, in US).

https://www.acsh.org/news/2019/07/11/2-dead-unknown-respirat...

"A news report from Virginia says that two people are dead and 18 have been hospitalized following an outbreak of an unknown respiratory infection at a retirement community. What could it possibly be?"

https://en.wikipedia.org/wiki/Fort_Detrick#2019_closure_and_...

So, were these "mystery illnesses" caused by vaccinated US military personnel who work in F.D. cranking around Washington DC metro area?
Shopping, Planes and Khloé Kardashian: How Private Debt Helps Power the Economy
Mhhhh... probably not. Is "impossible" (for common people) to reproduce it in captivity and they are very expensive to keep and bread in aquariums. Pelagic larvae would not survive. No bounty would pay for their feeding and energy bills. This is why we can't breed lobsters in captivity.

But deliberate capture in nature and releasing in another ocean can be still a problem. And new groups lobbying against its total eradication would surely be created.

Killing invasive species for sport is in the origin of most invasions of alien species of fish in Europe. Probably the same in America also.
I worked at a small company where a vendor poached the team member that worked closely with the vendor.

The company was pretty bitter about it and switched vendors, and the CEO would often bad-mouth the vendor at speaking events with other small company teams.

Nobody was really nasty to the former colleague, although there was some light shade thrown their way as well.

You don't mention company size but if these are boutique shops or startups with sub 20 employees, and you aren't a role they regularly hire for, expect reputational damage to your new employer, you, or both in whatever sphere of influence your former employer has.
They are connected, and defaut gw is set so you can have internet without problem, but maybe I'm just missing additional routes to specific devices, didn't spend much time looking into it since I usually am connected to the right network when close to my TV.
Either way, it's an use case for dumb access points so I should set this up.
I only have 3 GB of data in my data plan, which is always more than enough for me, unless I'm working over my cell connection. I could get more data, but doing that just to stream music (when I already have a working solution for such) seems silly. I think in the US people often have much more expensive and large data plans than elsewhere. (My entire cell phone bill is €12/month, including 3 GB data, and unlimited calls and texts.)

I also very regularly go places with mediocre cell service: country side, airplanes, boats, and festivals.
Indeed, the 68k ISA is comparatively clean for a traditional CISC architecture, but early RISC were regarded as even simpler and easier to understand.
The statement is still true though. A over engineered react app built in 2022 should still work perfectly fine in 2032.
I go for constraints every time. Data Integrity is king as long as you can reasonably afford it.

Your data migration aborted on an unexpected error? Well in my view that's a problem and you need to figure out why that is happening and fix it.

But hey, you can always drop the constraint when you decide it's not worth it, and you can always add it back again after. Depends on the application too, sometimes it just doesn't matter if you make a mess.
No, we're not. Some of us are activists but most people are conformists who care more about being accepted by their peers than they care about leading those peers towards some goal. A conformist may join the parade when this is required to be accepted but it does not matter much what the parade is for since the reason for joining it is not activism but conformism.
You are confusing or conflating the lab-leak and lab-made theories.
There isn’t enough evidence to convict, so to speak, but the one place that could easily disprove the lab leak claim is the same place desperately stonewalling and destroying evidence. Acting guilty doesn’t mean your guilty, but something nefarious went on in that lab. To the point where they would rather fire bomb the entire lab than answer questions or provide documents.

>On the other hand, many people would like it to be true, because it feeds into a conspiracy narrative.

I wonder how many such people would exist if there wasn’t such a massive media and big tech push to silence anyone discussing lab leak. At peak manipulation you were labeled a racist for discussing lab leak and permanently banned from most (all?) big tech platforms.
The evidence certainly seems to point in that direction and the absence of an official conclusion seems to support this... It should be easy to rule out the leak hypothesis. The fact that those who are implicated appear to be unable to clear their names by providing counter-evidence suggests foul play.
It uses Google’s Material Design UI kit, pretty much out of the box with no tweaks. Hence looking very “Googley”.
Changing a prior after the fact is the opposite of reasonable.

It's called a prior for a reason.
The CfD strike prices actually bring us closer to that. After the "stupid market mechanism" runs its course the operator is left with a fairly predictable budget. Which is exactly what you would want in a state run monopoly. By using the market we can set a budget based on competition and encourage cost reduction.
Why should we only count slurs for these groups?
Test Driven Development vs. Behavior Driven Development
>How much time do we have left before Bitwarden gradually becomes as bad as LastPass? 2-3 years? I’m not passing any judgement on this raise, entrepreneur do what they gotta do.

Bitwarden though actually has an API, and in turn interesting community implementation potential such as the Rust-based Vaultwarden [0]. While I agree seeing them get a huge round does raise some concern in terms of the revenue generation pressure (1Password sticks in my mind as a worse example though with their switch to forced subs-only, no local/non-1P vaults, abandonment of native apps etc), to me the real sign would be if they broke self-hosting. But even so, of course with self-hosting one could simply stop there. Doesn't feel like quite the same situation as 1P or LastPass where one was really in a fully vs partially proprietary system.

I'd be OK with paying for updates to quality clients though so long as it was a regular payment system (not paying means staying on that version vs having it stop working).

----

0: https://github.com/dani-garcia/vaultwarden
> Why would a password manager need so much money?

The announcement suggests they are looking to also launch their own authentication service and tools for managing application secrets.
It generated the spreadsheet as Python code, as you entered the formulae. Then You could add functions of your own design and call those from the cells too.
Let's see if she can get rid of this ridiculous MobileCoin that has somehow embedded itself into my Signal app. I won't hold my breath.
If you can trust that will stay at the end of the honeymoon, which is very much not a given in these cases.

At least vaultwarden is independent and someone can fork the clients when needed.
> Once you move beyond trivial cases you really need to spend time understanding the principles behind the ORM you're using. They are always a very leaky abstraction, there is not really a way around that.

This is why I avoid ORMs in favor of writing SQL queries manually: I only need to understand one complex system for non-trivial cases instead of two.

(To be fair, I haven’t done any database programming for a few years. ORMs may have significantly improved since I last looked at them.)
I could see that. I would also HOPE that it might make people realize what they're buying. Then again, plenty(most?) people already happily defend publishers with the "I got x hours per $ from this game; I will gladly pay $y per year to keep playing it" meme, so it would probably be unremarkable to them.
Spoiler...

It's very carefully calibrated. At 2x speed you see things change; at 0.5x you see them in transition.