skysight-inc/HackerNews huggingface dataset:
My website is hosted off a Hetzner dedicated server (Ryzen 5 3600, 64 GB of ram) in Helsinki. That costs about 70 EUR per month (though I use it for other things like my IRC bouncer, been considering moving that to my homelab, and innumerable side projects I've picked up and abandoned over the years) and also stores all of my random files I've accumulated over the years. It's on another continent so I have an easy to access live backup of some very important files in case my house gets destroyed.

The other expensive parts are AWS Route 53 for DNS after I dropped Cloudflare (cost varies based on popularity, but ranges between USD$7.50 and USD$12.50, this is still cheaper than Cloudflare because I paid them USD$20 per month) and the CDN I host on fly.io which costs about USD$5-7 per month including bandwidth overages.

My website gets more traffic than you are probably comfortable with imagining. I have to take performance and hardware efficiency seriously. I can easily do a few hundred gigabytes per month of egress bandwidth. More if I end up posting bangers. This is after doing things like hilariously optimizing images (the stickers can get down to about 10 KB each with avid files) and literally having my site load everything into ram on application boot.

I am told that these performance requirements are not needed for most websites, but I don't seem to be lucky enough to be able to do things the stupid way. I have to actually think about the performance impacts of everything I do because getting on the front page of Hacker News so often means that I need to focus on making things super efficient.

For a while my tower was also a Risen 5 3600, so I was doing the moral equivalent of compiling my website with -march=native to unlock _even more performance gains_, but now the machine I deploy from is a homelab node with an Intel Core i5 10600 so I can't do that trick anymore.

Subscribing to me on Patreon gives me infinitely more money than ads ever will, but having multiple income streams means that there's redundancy.

Of course I can afford to pay all of this out of pocket, but everything paying for itself is super fucking nice.
It’s somewhat sad to read that after 1430 years being family run the oldest company on this list went into liquidation in 2006 and was acquired
I'd prefer the error to be "invalid username" if the typed username is not registered, and "wrong username or password" if it is.
The system only knows if the username is valid or not; it doesn't know whether it's wrong (i.e. mistyped).
Cryptpad
Can you please share a source? This isn’t laziness. I know I can search — and I will —- but I cannot know what sources _you_ are intending, which provides context.
It doesn't seem like the author is arguing that just because you can instead validate if the email exists on a platform via the signup page instead of the login page, the vague message can be removed, but rather that the signup page should remove the information leakage as well, so there is no leakage anywhere.
>"At YC’s first batch dinner, we recognized that drinks were missing from the menu. Founder thirst became our opportunity. We showed up with a cooler full of sparkling waters and a makeshift sign that read “Benefits & Bubbles.”

In exchange for signing up with Savvy, we handed out drinks.

To this day, that lemon-sparkling-water stand remains our highest-ROI marketing tactic."

Brilliant, absolutely brilliant!

I always love it when somebody discovers a simple, elegant, grass-roots marketing method -- that works on a local level!

Well played!
Intuitive Solving
This was the only way so now we all can have expensive, oversized, slippery, scratch and crack attracting spy phones in our pockets.
Sneaky ways US cops could access data to prosecute women seeking healthcare
Also a really interesting read: http://jeebox.org/stuff/learn_more/
HTTP is still the best anywhere I want simplicity and resilience.

HTTPS has way too many failure modes for me to use it anywhere where accessibility and dependability are the priority.
If we can't manage to make password managers standard, we should try to make them required.
This is a nice game. What technology stack did you use to implement?
The data I looked at suggests without Android Java falls behind JavaScript. Also, Python is starting to take over at CS schools which is usually a sign it’s going to be even more popular in the future.

I suspect Python is going to take over from Java fairly soon, even if it might not reach Java’s mid 2000 dominance. That said, Java never reached the dominance of C, and C never reached the dominance of Fortran so I don’t think such arbitrary benchmarks mean much. In absolute numbers we have far more programmers so the next dominant language is likely to surpass past peaks by that metric.
When I don't have anything to add, ask or object, I don't engage.
Too many sleeping partners?
I think it is nice :)
Thanks
Not sure why you're attacking the viability. From the article:

>Yet no at-home flu tests are available for purchase in the U.S. That’s not for lack of technology — the rapid antigen flu tests at the doctor’s office are “virtually identical” to the Covid tests already in people’s homes
I remember at the time there was a lot of talk about how Amazon didn't have the costs of high street stores etc and was 'just' a web site.

That was never true - sure they didn't have high street stores, but they invested big time in warehousing. That's why you could get a book from Amazon in days, whereas a traditional seller it would take weeks if it needed to be ordered.

They also invested in the wider distribution network.
Probably just that he doesnt want to waste time on it. He's been shown to be a powerhouse problem solver. Since we're posting tweets:

SpaceX Dragon: https://twitter.com/ashleevance/status/1593133313484787713

Optimism: https://twitter.com/jinglejamOP/status/1310718738417811459
> Absolutely no way is this a fine way to solve the problem. That is crazy talk.

I disagree. I see this in a similar way I see Electron and actually you can make the same arguments against using Electron.

But guess what, Electron wins on practicality. It makes creating GUI apps much easier. That wins over any problems associated with the extra baggage of shipping a whole browser. It doesn't win it for everyone, but it does for the majority of people who just want to get shit done.
There is an accent that is typically called "standard American" or something along those lines, which is what you'll hear on things like national news programs. I'm not sure how many Americans actually speak with this accent, but it's usually the one that all of these devices target initially.
The best thing you can do to minimise corruption is to make it necessary to bribe so many people for the corrupt to achieve their goals that doing so would be uneconomical. The reason Qatar is hosting the world cup right now is because FIFA has a very small selectorate, and therefore it's only necessary to bribe a relatively small number of people to swing the vote.
I wasn’t judging anyone. I was just saying Rust isn’t exactly flying under the radar.
As someone who written countless of this authentication mechanisms or led teams that have, there has been 0 times the vague message have been by accident like you described and 100% on purpose to prevent information leakage. But that's just one (20+) anecdote(s).
Thug A: "Let's force them to give us the password!"

Thug B: "No need to, just cut of their finger!"

Thug A: "But which one?"

Thug B: "Let's take all of them!"
I think the point here is that the CEO clearly values security, if they were willing to pay you $2m do find issues, isn't it?
I'm brutally honest, often to my detriment in commercial activities. But as far as BS goes, "I have an urgent thing on Friday so we need to close today" is not too terrible IMO. His urgent thing on Friday might have been getting the fuck out of the country to celebrate the sale in the midst of an economic downturn. Almost legit?
Memory Hole: How Amnesia Became Part of the Internet
That wasn't a law.

The fairness doctrine meant that when they aired something considered controversial, they had to give equal time to the opposing viewpoint. That didn't mean they had to be fair, since everybody got latitude on what was considered controversial i.e. if they ban you for something on twitter now, it wouldn't have been "controversial" then, it would have been settled, so you'd get no time without at least going to court over it. Also, they could just give some objector 2 minutes to make their case into a camera and play it during the news.

The things that would end up being "controversial" are things that your local Chamber of Commerce or an international fossil fuel lobbying group would find controversial.

Its scary how easy you think it is to dictate actual fairness and impartiality in law, though. The only places that have laws like that are extremely authoritarian and corrupt, like Zimbabwe.
There is a finite amount of (usable) land in the world. If it is all for sale, what is there to stop the rich from buying all of it, and then collecting rent for eternity, becoming ever richer in the process? How is a return to feudalism your dream?
Ozric Tentacles. Never any lyrics and huge back catalog on YouTube.
NYTimes article about the authors, written in 2011: https://archive.nytimes.com/6thfloor.blogs.nytimes.com/2011/...
We do ban a lot of rent seeking, though. For example, theft and fraud are rent-seeking activities. So the sorts of rent seeking that you still see are the ones that are hardest to ban.
Yes, it is a tradition (see other comments here).

> What is the name of that wine?

Sorry, I just don't remember after all this time. Although IIRC the label's picture had a peasant sort of character who appeared to be holding a glass at arm's length (or at least that's how we interpreted it)
>Curious, what happens if people lose their arm or eye? How do you recover the account? Let me guess, email? Lol.

On iOS you can enroll additional fingers to touchid if you know the passcode.

>So all this and you're still a phish away from pwnage!

Not possible with 2uf.
I don't get it. People tell you to shut up in many different scenarios, but they are always wrong, for different reasons in each scenario?

You jump in fetish porn channels telling them they are gross, but you have moral responsibility to do that. You shittalk Star Wars while watching together, but you are just bonding with the people on the internet that gave bad review. You comment under official channels on twitter, but this doesn't matter, they are rich anyway.

You never dislike indie, or even if you do you never comment it, because that would be bad. Except you do because feedback is important, and artists always thank you for your negative feedback.

..

I kinda think that it is good if groups can create spaces to themselves where random people don't show up, and shit there. (Not taking to the extreme, and also not groups bonding against vulnerable minorities.)

While your 5th point is valid, you have every right to talk, even after they told you to shut up (and they have every right to tell you to shut up over and over again), also this is a very important right that is worth preserving in general, you still can be considerate. It's just you hurt people for a moment of satisfaction. (((And they choose to be hurt also for a moment of satisfaction.))) If you have better things where you can feel good, why not do those instead. E.g. where are your arts?

..

> When you release your work, as an artist, you are tacitly agreeing to those terms.

They choose to be vulnerable, not because they want to be hurt, but despite of it. They want to please people even if some assholes will jump in and insult them only because they can. It just hurts people and makes them to create and share less value, for no benefits?
> You can provide a more helpful error message by explicitly informing the user that the username they typed exists but they haven't offered the correct password for it.

The parent poster already addressed that though:

“If you mistype your username, you might have entered another, existing username. Just telling the user 'wrong password' will mean they are less likely to check that the username was correct.”

If you inform the user the username they typed exists, the chance of them not thinking about double-checking they didn’t mistype their own username increases.
Lidl opens first cut-price EV charging station in France
Calling it a burden is an assumption that ignores and belittles the end user. Sure, there are people who won't want to train their personal ai.

But I imagine there are significantly more who would appreciate clarifying requests by a teachable assistant capable of interacting with the entire digital world on their behalf, efficiently and intelligently.
Drone works best for me.
Stuff like Phill Niblock https://www.youtube.com/watch?v=UcdcWWcjBKg
A perfect API would consist of a few parts:

1. A request type and an associated response type

2. Impls for converting an HTTP request into the request type, and the reverse for response

3. A server type with an impl for handling the request

4. A client type with an impl for sending the request

The remaining challenge is making all this ergonomic for the simple cases.
On this topic, I've noticed a lot of sites have split their sign-in forms into a two step process (submit username, then submit password). Does anyone know what this achieves? It seems like it would be trivial for an automated script to submit the form twice, but as a human I often have to open 1Password multiple times to navigate the process.

For example: https://myaccount.nytimes.com/auth/login
Excellent link!

I had not heard of blosc before -- but that looks pretty cool!
> Yes, but signing up is a more cumbersome process and usually has a CAPTCHA attached to it, unlike logging in.

My guess of what is most common is that the actual trying to create a user in the backend/database is protected by a captcha, but checking if the email/username already exists is a separate endpoint that the frontend hits while filling out the signup form, before trying to create the actual user.

But it's just a guess, and I can already think of many examples where that doesn't happen, which is for good reasons.
That was presented as an option, but explicitly not recommended.

> …you can make the signup process email based.…I don't recommend this, because of the context switches, though you can implement it.
During the app gold rush I would use Yahoo pipes to build 'backends' for apps that were nothing more than screen scrapers.

For example, you want to make an Android app that presents a home screen widget to show the current lottery jackpot or winning numbers. You could build a Yahoo Pipes thing to scrape and parse that, and format it into an RSS feed. The best part is anti-scraping measures allowed it because they thought it was a Yahoo crawler.
This is effectively just an agreement to _stop_ redefining UTC every couple of years.
Loved Pipes. When I was at Yahoo!, folks kept showing such clever uses for it, all with minimal coding. It just worked. I miss it even today.
It’s probably a lesser of two evil things. Do you want to stick it to the man, or prevent religious fascists from being elected?

There’s a reason Godwin repealed his law.
Speed as the Wrong Criteria
So you were a massive supporter of Julian Assange, but at the same time you believe the US Government's story about him to be 100% truth? There's not much overlap between people who support Julian Assange and people who trust the government.
It wasn't elaborated on because it wasn't part of the core point of the comment, which was someone claiming falsely that to write Common Lisp you needed to use CLOS, which you absolutely don't.

You wouldn't go into why JavaScript is bad to point out that you don't need to write JavaScript to make a web page. You would just note that JavaScript was a late addition to the web and wasn't the first language usable on it.

Plenty of people were writing CL before CLOS existed.
Filecoin might be a good solution for this. Basically pay other people to host it for you
I use tree-sitter in neovim and the syntax highlighting is on par with VSCode
Kind of reminds me of playing the 4D Rubik’s cube
Automatic forwarding solves this problem for you :)

Personally I have my email setup so everything mentioning Netflix/HBO/Disney/$streaming-service/$shared-service gets automatically forwarded to our family inbox that everyone in the household has access to, in case they need to reset the password or do something related to those services

Edit: added "automatic" to "forwarding" as that's the vital piece here
What do you mean by developing world? I live in Argentina, developing world afaik, and I have all of that. Majority of people here does.
Russia invaded Ukraine. They have committed war crime after war crime. The people have a right to not want Russian puppets like Yakunovych
Yes, depending on the platform.

See apple passkey page: https://support.apple.com/en-in/HT213305
You have to put it in context, though. This was back in 1999. Plenty of people even today push for semantic HTML. HTML is said to represent a document, and documents have structure.
So I'm sure it wasn't all that uncommon to take it to mean that this structure was machine readable.
Rubbish, not when DDOS hacked GoFundMe, exposing Freedom Convoy donors in order to help Justin Turdeau's irresponsible government shut down public dissent in Canada.
That put them squarely in the far-left, antidemocratic, not to mention criminal activist category. As if we didn't know that already
Depends on how well supported those stacks are. WASM is very well supported and likely to be getting tested/used/improved extensively as the years go.

I'd rather work on software that depends on three different tech stacks that are well understood and used by many, than software that depends on a single niche tech stack.
Is noise really the reason? You can have firearms with subsonic bullet that are almost completely silent.
I'd agree get rid of any competitive features so that its relaxing but if you want to make it competitive toggle it on.
Forwarding assumes I am checking email every time they want to login.

The auto-setup is a cool idea though.
Yep. One site I infrequently visit moved from their own account system to the "check your email for a pass code".

This just made me to visit and login even more infrequently.
If you did it as clockwise by default instead of listing the ideal turn count you could list the minimum number of “counter” turns. Then have a button to do the next turn as a counter turn.
merely a form extreme debugging
I've been exploring CLOS for the past couple of weeks.

From what I can tell, it seems especially nice for a system that needs extreme flexibility. I like to program MUDs and rougelikes as side projects, and after initial exploration, CLOS seems perfect for that - it can enable certain interactions that I would otherwise have to spend a lot of work and design achieving in other languages. It turns what feels like a chore in other languages into something fun.

I would imagine that how much this is a pro or con depends upon the work you do. Some might see such potential flexibility as error prone and overly complex because the domains they work in don't require such complexity. But others might see it as the building blocks for a domain with complex interactions that they have to build regardless of the language they use.
They have their debts forgiven on the basis of adopting certain policies (free market reform) that allows corporations from wealthy countries to set up shop and extract raw materials from the counter while avoiding giving back to the country via taxes. The profits get booked in Singapore or the Bahamas, and the stock price keeps going up.
“If you’re trying to prevent this information leakage, you also need to consider the following things” would be a much better conclusion to arrive at. Services that considered that problem just let you sign up twice and send you an email saying “you already seem to have an account.” As a positive side effect, this also notifies the account owner.
I do "Hey Siri set a timer for Foo for 5 minutes" I get a timer named Foo, and I can then set concurrent timers named Bar, Baz, etc. without replacement.
Bolsonaro contests Brazil election loss, wants votes voided
Not really. The points the author makes are only valid if you presuppose they are correct in that "account e-mails for a site are already public elsewhere", and that isn't a problem on its own.

Many best practices are already what the author suggests: If a user signs up and doesn't already exist, send them an e-mail to confirm they own the e-mail. If that user already has an account, send their e-mail a message to the effect of "Someone tried to sign up to our service as you, is this you? If not, it's safe to ignore this message. Here's how to reset your password in case you lost that: ..."

The thing the author is missing here is the same failure I see at a lot of companies: they take the approach that they're only there to protect their application, rather than doing what they can to protect the users of the application. Something as simple as knowing a user uses a service can become an easy spearphishing attack, for example, which the author doesn't mention.

The general recommendations are good but defense in depth is key.
> The main thrust in this article is that scraping HTML display markup is a terrible form of data interchange between systems.

Agree. Many of the comments seem to come from reading "Why HTML Is a Strategic Dead End" leaving off "for Business Transactions and E-Commerce." Screen scraping 3270 protocol blocks was a thing for integrating IBM applications (and not a good thing IMO).

I don't think Wayne was really focused on behavior outside of using HTML for integration purposes. This is partly from reading the article. It's also from knowing Wayne Duquaine, the author. We met in the mid-1990s at Sybase, where he made all the IBM system integrations work. Wayne viewed most problems through a mainframe lens. His note seems pretty typical of his point of view.
That was my first thought as well. The application that I maintain is invitation-only, so I think the rest of the argument is irrelevant to me.
Robi
I was surprised that I did find this relaxing - thanks OP. To other commenters point toggle on/off competitive features would be great otherwise it produces tiny amounts of competitive anxiety.
It's not really destructive, though! That's not really the main difference.

The main difference is that a merge sticks around in your repo forever, a commit that people assume has no real code changes in it but actually sometimes it does. A rebase is done once, and then your git history doesn't have to deal with it ever again.

Yes, you raise a fair point that if you've dug yourself into a deep pit already with long-lived branches and overlapping work, it might be slightly easier to extract yourself from the pit with a merge. But then you're leaving that fetid pit in your repository forever.
I have thought about adding a bathroom style vent fan to the closet that houses the network gear for the house. Exhaust near the top and have a cool air intake near the floor.
I like DDD quickly, which is a mini book with a lot of similar concepts around microservices ( but in a monolith)

https://www.infoq.com/minibooks/domain-driven-design-quickly...
Indeed, this type of threads always remind me that HN is not the same as it used to be. If you wish to learn about something (including about its worth), it's not the right place. Read books; read and write code; form your own opinions.
What a thrilling tale! It's clear why he was ultimately successful. He deftly juked through each challenge AND he's a great storyteller.