skysight-inc/HackerNews huggingface dataset:
> They're all unsafe, because you have no clue what context they're going to be used in.

That's correct, but it's the reverse thinking from the escaping one.

Because in the escaping one, when you need not to escape you will also not-escape at the last possible moment, and that's a sure-fire way to launder attacker-controlled data.

Instead you should escape everything, and opt-out as early as possible.

> But if you're writing a webapp, passing around escaped strings is a bad idea 99% of the time. It creates code highly coupled to one aspect of your system.

That's why you do the reverse: most strings are unsafe to everything, but the strings which are safe are generally safe to one specific subsystem. So you say that.

> Just imagine if you did this with networking. I'm glad we're not in a world where we're passing around TCPString or UDPString or IPString or EthernetString or TokenRingString or CarrierPigeonString because that happens to be a networking stack the app uses sometimes. It sounds like hell.

It sounds like hell because it makes no sense, there's no such thing as a TCPString because TCP is not string-based and TCP messages are not composed that way.
There have been repeated reports of negative outcomes as a result of TikTok trends. There have been investigations into the amount of information the app collects and it is far beyond what other apps do (all without user consent). The app is clearly highly addictive.

What sorts of proof would convince you that this is an addictive app that is causing harm?
The author of Turbopack is the creator and maintainer of Webpack.
If you are talking about yankee nationalism, you are right.
I think you should stop trying to justify racism on pseudoscientific grounds and just making up silly unfounded excuses for such behavior.
I’m not convinced there’s a difference.
> Congress cared that it met payload requirements and mission requirements.

This is just not correct if you mean that they only cared about payload and mission requirements. Congress mandated that certain technologies were to be used from non-competitive, single-source suppliers in order to prop up industry in particular congressional districts. Cost overruns are practically by-design because as long as it doesn’t raise too many eyebrows it’s just more money to their local industry and constituents.
SEEKING WORK | Remote Only | Senior Backend Developer

Technologies: Java, Kotlin, Spring Boot, Spark, Kafka, Flink, MongoDB, JavaScript / TypeScript

Hi! I'm Robert, a senior full stack developer with more than 10 years of contracting / startup experience. I usually prefer backend work, but have experience in a variety of projects and technologies.

Some of my recent development work includes:

- an API to provide customer facing shipping costs and transportation times for a consumer electronics retailer's E-Commerce division with multiple billions in revenue

- a low latency fraud detection system to enable instant payments use cases for a major European bank

Timezone: UTC+1 (Germany), 4 hrs overlap with EST possible

Availability: Part-time or Full-time

LinkedIn: https://linkedin.com/in/robertstauch1

Résumé/CV: https://drive.google.com/file/d/1lieLDKzOYQ44ODfi1q0NrD1v6qU...

Email: robert@ahsonline.de
when did that option appear? that is great info.

(I've been running openwrt on a pi just because it had an overlay filesystem - I could run raspbian now)
Fevo | New York City or Remote (NA/Europe) | Full time | https://fevo.com
Fevo is an ecommerce platform specializing in social selling. We help people buy things and enjoy them together. Come build things with us!

What we do: We've been changing the ticketing industry since 2016, and now we are expanding into hospitality, travel, insurance and luxury industries.

Things we love about Fevo

- We've been fully remote since before COVID, though we have an office in the meatpacking district.

- Excellent compensation; we work hard and Fevo takes good care of us financially. All employees have stock options.

- We welcome diversity, and are an inclusive workplace. We're excited to work with you.

- We create useful software using exciting technologies, with an established and talented global team.

Stack

- Backend: Golang (we've already upgraded to 1.19), some modern Java (via Quarkus), some Scala

- Frontend: Typescript, React, Redux

- DB: Postgres

We are looking for enthusastic engineers with 3+ years of experience. We are open to candidates in North America and Europe, and we require that your workday has some overlap with core-east coast hours (9-5 EST).

Notable roles:
Full stack developer (Golang Focus): https://jobs.lever.co/fevo/f5ab89f0-0462-4f6c-8128-7985a48b8...
Scala: Full stack developer (Scala Focus): https://jobs.lever.co/fevo/1ab8a8b4-8d7f-4d1e-900a-27fba91d8...
Senior Technical Product Manager: https://jobs.lever.co/fevo/1634cd7c-3379-4055-8a81-625f8921b...

Please reach out to hn@fevo.com to apply or discuss. A full list of roles we are hiring for is at https://jobs.lever.co/fevo
Good thing there's no tinkering mentioned in my comment, then.
A universal law of procrastination (2016)
It's an email client that looks like a messenger. It's like saying "I'm not giving Thunderbird my e-mail login".
Nice!

We use CalTopo.com (Works everywhere, not just California) and GaiaGPS.com for offline mapping and track recording. Both allow offline use after downloading map tiles.

CalTopo allows you to add lines and markers and polygons to your map beforehand in the web app or in the field on the mobile app. It does have a number of analysis features, but it's not as multi-day-hiking-specific.)
Docker is not just a container runner, it's also an API for interacting with them, a container creation language (Dockerfile), and more.

Being able to run Docker enables you to get access to all these tools and build the Docker containers from other projects.
This seems pretty cool. I've been using Handbrake [1] for conversions for similar purposes, though I've been manually adjusting settings to get the optimal quality for a target file size

[1] https://handbrake.fr/
But if I train my own neural network inside my skull using some artist's style, that's ok?

Either a style is copyrightable or it's not. If it's not, then I can't see any argument that you can't use it yourself or by proxy.
Fair enough, I'd naïvely thought of it as a ceiling.
Can the address and/or data also be 16 bit or would that violate RISC-V spec?
Seems like RHEL/Centos/Rocky < 9 aren't affected (OpenSSL is too old to be vulnerable ... makes a change). Not seeing any OpenSSL updates on any of my Rocky 9 boxen just yet.
Could this be used for GPU computation?
"What social media site could replace Twitter?"

Targeted ads by celebrities. That's mostly what it is these days.

Someone else mention journalists, but God do I hate "articles" fragmented as tweets.
Neither did I :-) I only learned about it about 20 years after the fact.
Disney Streaming | Sr. Software Engineers/Tech Leads| Remote (US Only), Hybrid Onsite in NY, Seattle, SF | Full-time

The Reliability Engineering team is looking for folks to help us improve reliability, performance, and user experience across Disney+, Hulu, Star+ and ESPN+.

You’ll excel at Disney Streaming if you’re a well-versed technologist and specialist in your field, interested in raising the bar by innovating and adopting new patterns and technologies to stay on the bleeding edge of development. We feel strongly that teams should own their own processes, decide their own technologies, and design solutions for the long term. If you're interested in working in a highly collaborative team environment like this, please get in touch (chris.vagenas@disneystreaming.com)- we'd love to hear from you!
True, we do have warnings about human level AI... but we never really cover the Machine Learning is gonna take all y'all's jobs.
> What they're doing with the second boost, they're not telling anyone.

This is a direct-to-GEO launch, and some of the payloads are public.
Je cherche exclusivement un free-lance et pas une agence.
Yup, my wife doesn't want to deal with such things. Total assets, yes, but the details of managing them are entirely my job. She doesn't want to deal with it and I don't want her to have online access because she would be way too easy to phish.
Yes, neoliberalism's failed economic model has set anti-nationalism back at least half a century. It threatens people's livelihoods by directly inhibiting the state's ability to improve the majority of their citizens' lives. Until the economic model is shifted, nationalism will continue to be seen as the antidote to neoliberalism, unfortunately. Neoliberalism and US hegemony are two sides of the same coin, so both of them are the biggest threat to human collaboration across borders.
It's such... odd behavior. For sure Stephen King who has a net worth of $500 million dollars does not mean "the price is too high".

If Elon is successful, even I will read the business school case study on it, because it flies in the face of everything I understand about complex systems and... well just about everything. The only way this works is if Elon's internal processes are way different from his public persona.
Andrej Karpathy on Elon Musk
Ah but I use a personal TLD which does not really exist in the real internet. Can I still use letsencrypt with that?
I see. Seems rocket engine efficiency must have seriously improved while I was not looking, thanks.
“majority of the nodes” in BTC Lightning Network currently down due to bug
I am pretty sure that it is not established law, but I am pretty sure that that is how it will work out. US provisions for fair use make training models likely OK, and the EU is carving out exemptions for it. See https://valohai.com/blog/copyright-laws-and-machine-learning... for more.

The question of whether the output of the model itself counts as a derivative work, though, is rather more complex. In the case of Github Copilot it has proven very adept at spitting out large chunks of clearly copyrighted code with no warning that it has done so. And lawsuits are being filed over this.

But in the case of the visual artwork, I'm pretty sure that it is going to be ruled not derivative. Because while it is imitative, you cannot produce anything that anyone can say is a copy of X.

But as ML continues to operate, we'll get cases that are ever closer to the arbitrary line we are trying to maintain about what is and is not a copyright violation. And I'm sure that any criteria that the courts try to put down is not going to age well.
fyi some broken images on https://www.serverless.com/framework#monitoring
> A contemporary example is domain names. The current domain system is a monopoly, and it sucks. You pay companies a never-ending and ever-increasing rent to do literally less than nothing. A domain isn't much more than a key/value pair in a small database.

Is there any legal or technical reason why someone can't set up a DNS server that resolves domain names to different IP addresses than those traditionally used?
Does anyone have an ELI5 for what this, BASH, ZSH, Powershell etc do? It seems it's a conflation of #1: A CLI. #2: A specialized programming language that mainly does file-system operations. Is there a compelling reason to use something like this (or Powershell's scripting system, from the comments here), vice Python or Rust's etc standard library filesystem tools?

Context: I use Windows Terminal with embedded powershell on Windows, and Terminal on Linux. Useful for compiling programs, running Python scripts, and executing CLI-based programs (eg clippy, ipython, rust, various programming-language-specific formatters etc, some CLI-based text editors like VIM). Also, troubleshooting Linux problems.
SEEKING FREELANCER - Fullsend Solutions | Android Native | Full Remote | US Based | 32 hours a week | Through End of January
We are a small dev shop based in Los Angeles. Seeking a senior level Android dev to take a conference room booking app over the finish line.

Reach out to apply@fullsend.io and mention this post. We'll get a call on the books asap. Thanks!
Sure, statistically.

But there are far more important skills, like reflection, that trump that trait and an introvert will easily surpass an extrovert that is weak in learning from all those interactions.
You are allowed to say kilogram on the internet.
Calling an external too to list files is an anti-pattern; every programming language or shell language should have that built-in, so it's just doing that via the OS API (opendir/readdir/closedir).

The POSIX shell has that in the form of globbing. That only gives you names, and has quirks that are only adequately worked around with Bash options.

The fix is to use some real programming language for complex work.

I made a language for myself in this space, geared toward C and Unix people who are willing to try Lisp: TXR.

1> (stat "/usr/share/dict/words")
#S(stat dev 2306 ino 884986 mode 33188 nlink 1 uid 0 gid 0 rdev 0 size 931708
blksize 4096 blocks 1832 atime 1667315034 atime-nsec 0 mtime 1238396423
mtime-nsec 0 ctime 1405615444 ctime-nsec 0 path "/usr/share/dict/words")
2> (flow "/usr/share/dict/words"
stat
[callf list .path .size])
("/usr/share/dict/words" 931708)
3> (flow "/usr/share/dict/words"
stat
[callf list .path .size [chain .uid getpwuid .name]])
("/usr/share/dict/words" 931708 "root")
Qualified | San Francisco, CA or Remote (US/Canada) | Remote OK | https://www.qualified.com

Qualified is the pipeline generation platform for revenue teams that use Salesforce. To learn more about who we are, our engineering culture, and whether this is the right place for you, read our Key Values profile: https://www.keyvalues.com/qualified

Here are our open roles:
- Staff Software Engineer - Product: https://jobs.lever.co/qualified/349c7798-b137-4922-adef-b6ab...

Tech Stack: Qualified is a modern web app with a React UI interfacing over GraphQL, REST, and WebSockets with a Ruby on Rails backend. The data and messaging layers are built on PostgreSQL, Redis, and ClickHouse.
nounset is Set-StrictMode, errexit/pipefail is $ErrorActionPreference = 'stop' with $PSNativeCommandUseErrorActionPreference = $true. With those you can try/catch, which is infinitely better than the $?-based approach, but you can also use $? without them. PSCore encoding is always UTF-8 without BOM; you can enforce that the script is running on Core with #Requires -Version 6, or pass ($content | Out-String) to New-Item's -Value parameter for a v5-compatible hack.
Location: NYC

Remote: Yes

Willing to relocate: No

Technologies: Salesforce, pipedrive, various martech/automation tools

Résumé/CV: I'm a business development & sales guy. I work with founders and executives to build a growth engine, connecting marketing, operations, and sales together into a plan that boards and investors can believe in. I've earned over $220M in revenue in the past 5 years.

I've worked for CEOs of Fortune 500 companies on the buy side, as well as for small and midsize startups on the sell side; I currently sit on several boards and am available for incremental or full time work for the right product.

I look forward to connecting

Email: chris@lrdg.llc
Yeah. My assumption was that you’d probably be hiking on trails. Bushwhacking or off trail travel generally require more skills. Though if you’ve just gotten turned around pulling out a compass can help a lot.
it's more just lowering the price of getting things to orbit, so there are certain thresholds that will probably make new businesses viable.
I think you're seriously overestimating Chinese economic capabilities. They are still constrained by the same economic realities as everybody else, and -- much as we wish it were possible -- they cannot afford to just do whatever.
Literally having this discussion at work now. The vulnerability ticket against my service won't close until the vendor database is updated to reflect the security patch backport to Jammy, even though everyone agrees that 3.0.2-0ubuntu1.7 is not vulnerable.

This is in any case notwithstanding the fact that the detection is in the base image of a Docker container from a vendor that confirms they don't use OpenSSL; and that said container runs in a context where the only TLS services it faces off to are run by AWS.
ONLY half the ads!!
I don't think you realize the scope of this part from the article linked, "In the end, Congress decided on a measure that will essentially ban the US government or anyone that wants to work with the US government from using components from Huawei, ZTE, or a number of other Chinese communications companies." The "anyone that wants to work with the US government" is incredibly broad and effectively banned them from our telecom industry and many others.

Here's another article
> On Sunday, May 19, 2019, Google publicly declared that it would be complying with Trump’s Huawei ban. Interpreting the language of the order, Google determined that the proper course of action would be to cut Huawei off from Google’s suite of digital products. [...] Not long after Google made its announcement, other US-based companies followed suit. This included Qualcomm, Intel, Arm, Microsoft, and many more.

https://www.androidauthority.com/huawei-google-android-ban-9...
Poaster in the house.
This is more dependent on parallelism of queries rather than parallelism of connections. Having a ton of relatively idle connections won't increase the query latency.

For the related topic, in https://planetscale.com/blog/one-million-queries-per-second-... we touched on saturating shards through increased parallelism resulting in latency, and then also being an indication of needing to scale more horizontally.
SEEKING WORK | Bay Area, CA/Remote | Fractional CTO/VP Eng/Product Lead/Problem Solver

hey, i'm Vineet. I'm an experienced engineer/product person/eng leader who loves working in the trenches of early stage startups. For the past 3 years, I've been working with founders and seed/A stage startups helping them build products and solve eng problems -- as a fractional engineering lead, IC engineer, eng consultant, and unofficial product manager.

Previously, I co-founded a venture-backed startup where I led product+eng. Prior to that, I led engineering at Crunchbase. I've led teams of up to 10 engineers.

I still code (Rails, Node, React) so I can pitch in when needed, but am more interested in fractional/interim lead roles at companies that have gaps in their eng leadership, product velocity, or hiring.

I can help with: eng architecture/execution, managing teams, hiring and interviewing, product planning/roadmapping/strategy, working with founder/CEO on realizing vision.

Email and LinkedIn in my bio.
> Hypothetical Nation A allows democratic freedom of expression and respects human rights. Hypothetical Nation B has a tyrannical government that censors and imprisons anyone who questions it and constantly violates the rights of its people.

Both countries are, as you said, Hypothetical.

> Some nations are simply better places to live than others

Depends on the definition of "better".
Does anyone know to what extent China has advanced the state of the Soviet technology that they have (I assume) licensed? I have been to the Russian Star City training facility, Baikonur Cosmodrome and been in the full-size Mir training module and the Chinese station components look very similar. I am sure getting good information is difficult, but perhaps someone here has some more info.
It will change the landscape of the art market, but it won't destroy it. Digital art will be less valuable, canvases and sculptures will become more valuable.
You’re afraid china will beat the us to aesthetic space stations?
Don’t know if distribution has happened yet. But there were at least a few investors buying claims, so plenty of people were able to cash out.

You could say that’s actually a better outcome than losing your private key.
Yeah, I think you're 100% right. There is no "should we do this?" question here. Like every technology ever invented, it's now here.
Ok, I've changed the title to use your suggestion. Thanks!
I'm one of the Nushell developers, and one of the main reasons I joined the project was that I couldn't find a cross-platform shell I was happy with.

PowerShell has a _lot_ of baggage. I don't like a lot of their design decisions (ex: the super verbose naming, the continue-on-error default that makes scripting a pain), and it's unlikely that those decisions will ever be revisited.

I tried pretty seriously to use PowerShell as my daily driver on Linux and macOS 2 years ago and was disappointed. Too many rough edges and Windows-first features.

PowerShell's startup performance is also pretty rough; I was seeing startup times around 2s after some minor profile customization.

I think Nushell addresses all of those points well; it's got nice concise syntax, solid support for Mac/Windows/Linux, and instant startup times. On the other hand, Nushell's less polished+stable than PowerShell; we're still making breaking changes to the syntax+commands.
Nitpick. It's not "the devs" who decide these things. It's the bosses.

You can pick on the devs for choosing to work at Twitter or other social media companies, but let's be clear: the developers aren't the ones calling the shots.
$340 is a paltry sum to license a song in perpetuity, much less to make it public domain forever. You're welcome to do whatever you want, but the Digital Millennium Copyright Act does not rule in your favor on this one.
Wikipedia Mobile Hacked?
Did anyone else see on mobile wikipedia english yesterday that for several hours the featured article had a description that was hate speech (https://imgur.com/a/QahqKXU) before getting fixed back?

not a single source is seeming to report on it. The reason I think it might be a app hack of some type is this text did not appear on the featured article from the browser version of Wikipedia at the same time
Enter coupon code “CHIEFTWIT2022” during checkout.
How have you come up with this number?
Ok, we've switched to that from https://www.ryzencpu.com/2022/10/arm-will-prohibit-proximity.... Thanks!
This took a very long time.

I’m on Vuetify 2 for my project, but I’d almost given up on Vuetify in general because it took so long.
SpaceX would get considerably more than $10M in marketing / brand goodwill by donating to a museum. So for the first 1 or 2 decommissioned rockets, I think donation beats scrap ROI.
The executive branch is responsible for foreign policy and national security.

This issue is about a hostile foreign government being in a position to manipulate the internal communications and political debate in the US. So it's more in the realm of foreign policy and national security rather than US corporate law.

(Surprising to see this comment downvoted - why?)
pay $8 to still get ads... what dystopia is this.
I wish either would just release as a Debian repo with a desktop metapackage instead of a whole distro. What specifically do you like better about Crunchbang++?