skysight-inc/HackerNews huggingface dataset:
To be fair, in my experience they almost always tell explain the reasoning for repeatedly asking this information "for security reasons I must confirm your information again". Maybe I was just lucky with good places and people, but I never had wondered why the heck they need the information they already have on file (or worse, that I have already told them some minutes ago), because from their brief explanations I understand that they have some form and they must type in my data in there for verification.
https://news.ycombinator.com/item?id=33912060
I've come to believe that all labor is skilled, all that matters is how much training and/or experience is required to make them able to do the job that differs.
Your Home is Insecure: Practical Attacks on Wireless Home Alarm Systems [pdf]
Someday people will learn about the difference between "bimodal" and "binary", and the critical importance of liminal spaces in real-world "binary" phenomena of all kinds.
Stop Stopping: Why stop word lists are problematic in search
The rise of neural retrieval systems has diminished the need to define stopword lists.
Ask HN: Can non-programmers learn what coding is like by asking ChatGPT to code?
Moreover, can non-programmers obtain intuition about how difficult a task is to code by asking ChatGPT to write code for various tasks?
02/12/2022 - 22:55 CST
Deep dive on Payment Cards and how they work
The payments and card issuing space is complex. I wrote the onboarding resource I wish I had when I first entered the industry. Hope it's helpful.
I'm not sure what your experience is, but mine is over multiple decades over multiple companies over multiple continents, and in general, corporate management, project management, and business analysts are not concerned about security.

Instead, they are interested in delivering buttons, fields, and streamlined workflows. Technical debt and library upgrades? Os upgrades? Forget about it. They need to deliver value back to the business in terms of faster business processes.

Only when the business is hacked or they fail compliance does the business leadership start to care.

Blaming the people with the hands on the tools is not fair when the business will not give the resources to do their work properly.
Okay we can use whatever language you wanna use, buddy.

The point is, if you self-custody your funds, no one can take them from you except by threatening you.

Everyone had their funds taken from them because they did NOT self-custody.

Everyone could have gotten all the utility of FTX (trading spot and derivatives) via a self-custody solution (a DEX).

Stop blaming self-custody solutions and stop trying to make self-custody solutions illegal. They literally mathematically prevent this type of theft and fraud.
Last time I was looking for a job I used Airtable to track all of the companies I was interested in, applications I made, interviews, and points of contact. It was a really nice experience.

If you worked at Airtable, thank you for making a cool product. I hope it helps you in your job searches too!
I think it might be dragon wings
Using public transport without the correct ticket is a criminal offense (Straftat) in Germany. It's not just a matter of paying an increased fee (that's the 5 Euro) when caught.

The current minister of justice is considering to analyze if the law can be changed to make it just a misdemeanor (Ordnungwidrigkeit).
I have also been using python a long time and i honestly can’t remember a time i used mixed type list.
> China not being capitalist enough.

did they came up with the gunpowder because they were capitalist enough but Europeans not?

Fusion energy R&D is mostly funded by governments, is it because the world is not capitalist enough?

the semiconductor industry is dominated by Asia, does that mean that EU/NA is not capitalist enough?

saying something "isn't capitalist enough" is disrespecting the people who actually dedicate their life to research
What would be your best app for learning a language?
Especially since the vuln was in a third-party system so the airline couldn't push a fix themselves.
First time I saw a computer was an early IBM at my dad's office. I was too young to read but I clearly remember the green cursor waiting for input. I pressed Space Bar and watched the blinking cursor run across the screen, line after line. I was fascinated by this mysterious machine and wanted to know more about it. Computers held my interest ever since.
IMO, the most effective way to make people commute by public transport is to make parking difficult and expensive.

People spend hundreds a month commuting by car so the issue is not the price of train tickets, it's that people prefer to drive as it's more comfortable and convenient. But now, if you cannot park or it will cost you a fortune you'll think 'fuck it, I will take the train'.
Their actual solution for disabling AWDL is running this script in the background:

while true; do
if ifconfig awdl0 |grep -q "<UP"; then
(set -x; ifconfig awdl0 down)
fi
sleep 1
done

That just checks the awld0 interface every second and turns it off if it's on. Apple really doesn't offer any other way to disable awdl?

Note that setting AirDrop to "No One" doesn't fully disable awdl. It's used for other things like screen sharing, AirPlay, bonjour device/service discovery, etc. Though perhaps disabling AirPlay is enough to stop the WiFi issues. You can sniff awdl traffic with `sudo tcpdump -i awdl0`
Yep. There's a reason why macOS and iOS have a giant (easily 1GB) "shared cache" that is most of the libraries that make up the OS in a giant file, mapped into every process's address space.

Without shared linking, in your example you end up with a copy of glibc and whatever else in every process. Without some fancy page deduplication scheme (that would come with its own set of problems), the kernel cannot know that all these pages in all these processes are the same. And they might not even be, because different versions and just the process of static linking itself might make an arbitrary number of them look slightly different.

Not every program needs all of glibc, so not all of it will be paged in, but still, it looks like you will pollute your CPU caches with many copies of essentially the same thing.
Interesting, we are trying to wrangle with the nondeterminism but sometimes it can't be helped as Bing itself can produce different results. Always actively working on the model though.

The citing sources feature can definitely be improved - right now it works at a sentence granularity and insists on finding the best source when sometimes not appropriate. Thanks for pointing all of this out
I wouldn't expect them to remember it, but I think there's a non zero chance the average US citizen/juror has heard of FTX/SBF, given how heavily they advertised. MLB umpires wore a FTX logo for example, and was to replace American Airlines as the sponsor (FTX Arena) of the Miami heat's stadium.

https://www.forbes.com/sites/dereksaul/2022/11/17/mlb-latest...
I own a Tesla. I could close my eyes on the highway for tens of miles and would probably be ok. Same thing will be true for those in the FSD beta when driving city to city. But it would be a stupid thing to do.
I'm not sure I understand what you mean, could you clarify?
Read Philosophy – A Curation Website
Why we’ll never see back to the beginning of the Universe
Exactly this. Usually they even say just take the money back and keep the product (when livechat is used).
Interesting!
When did you join YC?
At what stage of the development of the language were you then?
we had a good experience with https://www.praetorian.com/services/penetration-testing/ earlier this year
They are so modern, catching up with ML in 1976....
They don't measure "goodness", they merely check that the person actually knows how to write code. I disagree with them (I believe they are unnecessarily complex when it comes to the actual algorithms, and rarely mimic the real-world requirements of the job), but at least they do weed out idiots who can't even write a for loop.
And then goes on to mention Starfield, a game that, according to rumors, Sony tried to get an exclusivity deal, Redfall that wasn't even announced nor an existing IP and cloud gaming which only has Nvidia as the other player while Sony forgot that they even had a service like that and only started complaining when Microsoft actually put effort in their service
This should have been blocked way earlier, you are blind or corrupted if you don't see a monopoly in the making

This part is important:

"In a complaint issued today, the FTC pointed to Microsoft’s record of acquiring and using valuable gaming content to suppress competition from rival consoles, including its acquisition of ZeniMax, parent company of Bethesda Softworks (a well-known game developer). Microsoft decided to make several of Bethesda's titles including Starfield and Redfall Microsoft exclusives despite assurances it had given to European antitrust authorities that it had no incentive to withhold games from rival consoles."
In our case, it's a bit more state than just a transaction ID, but the same concept applies.

And yeah, to mirror the other comment, this isn't particularly something I'd consider a security issue. If an attacker has access to your transaction (session) state, this is a similar risk vector on any web service that utilizes browser cookies or sessions. If someone hijacks your browser cookies, they can do anything they want into your account typically, ignoring 2FA and extra layers.

Same risk here. If someone were to intercept your request, which is strictly over HTTPS, and hijack your session, or you erroneously were logging the session and authentication credentials publicly, then you're exposing yourself to a lot bigger risk than someone adding a sleep() into your session. They could just dump everything from the database, because they are you.

A direct connection only changes this because it's a stateful protocol, and if the connection is severed, everything is lost/rolled back and nobody can intercept that.

But anyways, I'd hardly call a well established security model of HTTP sessions flawed in this regard.

If anything, it's possible for a client to do some dumb things, like, parallel queries within a single transaction, which you cannot do with a direct connection, which ultimately is just... going to be undefined behavior since they fundamentally get serialized into the database, just in an undeterministic order relative to the client.
Probably because it was a bunch of nonsense. Wittgenstein has no place in the same sentence as Bertrand Russell.
So it isn’t done in Utah because..? Because it isn’t metered, I guess.
Building a Now Playing Display (2021, updated)
It's a weird game theory thing.

In a market with any amount of stickiness (arguable most tech markets), losing share is a permanent problem. Every customer your competitor acquires is theirs for as long as the stickiness holds, and if you want to woo them, not only do you have to convince them you're worth trying, but that you're worth switching for.

So under the all my competitors big and small are being aggressive and fighting for share framework, most companies bit the bullet and decided to accelerate hiring (especially since, as we are seeing now, it's so easy to reverse that decision for top management).

It's an argument for why the overall economy has become less volatile as growth has slowed, but the high growth pockets (like tech) are more volatile than ever.
Yep, both are fantastic.
I would be worried that the German public transit would be strained further; I remember crowded and massively delayed trains this summer.

It semms like an odd policy to split public transport into a cheap, crowded and unreliable part while you have nice modern trains running half empty.
Minecraft is the exception that proves the rule. There have been perhaps 5 indie games in the last 10 years that made it big money wise.
There're shocking number of people who can't write simplest code.

Here's simple task that I ask on interviews: write JavaScript function which works like setTimeout and uses setTimeout internally but provides a Promise result so it can be awaited. Very few people can write that kind of code. They actually have no idea what Promise is. They want to get in frontend position. How can you write frontend code if you have no idea what Promise is.
> Assuming you're a black hat exploiting this bug, what can you do, if the target is using a VPN?

Going by the same logic, what can a black hat exploiting this bug do if the target ISN'T using a VPN?

Using or not using a VPN in the context of this bug is totally irrelevant.
I can't think of a time I ever needed to do such a thing, and I've written many thousand lines of python. Python supports OOP, so classes will get you quite far in this regard.
The one time I've tried to use this in anger, it said my script was running when it was supposed to and exiting cleanly, everything green, but nothing was happening.

Put it in cron, worked first try, and forgot about it.
I really really really wish that Apple would always use DHCP and get an open IP instead of assuming their last one is still good just so they can say they connect to WiFi 100 ms faster than anyone else. It is so infuriating and causes all the devices in my house to fight for their rightful slot.
https://archive.ph/EIQ3A
Few of the comments so far seem to take into account the main point of the article, which is about savings interest rates and how stingy the big banks are.

I keep just the minimum average balances in my checking and savings to avoid monthly fees. (for example, $3K combined check/savings at Citi, $1.5K checking at Chase). All my excess cash/emergency fund is either in CDs or I-bonds at higher interest rates.

As to the bigger question of why I would open accounts at these large banks in the first place (when I also have a local credit union that has served me well for over 30 years with savings and several loans), none of the banks where I am now are the ones I opened the account with. Every single one started at a smaller local or regional bank and then got taken over by some other out of state/big bank, sometimes more than once. Even Wells Fargo is no longer the original bank I started with, even though they kept the name, it was taken over by some out of state bank several decades ago as I recall.

As a result, I have simply drifted into a relationship with these big banks because I was passively transferred.
$300M compared to WoW printing $7B per year in profit in its heyday is almost a rounding error.

To put things into perspective - in its heyday - WoW was half as profitable as Tesla is now...

It's hard to catch lightning in a bottle twice.

They made WoW. It was insanely profitable. Their valuation soared. They sold. They declined.

It's hard to say if its reversion to the mean or the Activision acquisition - but it's hard to argue Blizzard hasn't declined by every metric.
I think squat pots are anatomically better than simply sitting.
I distinctly remembering this happening when I was learning to program and learned what a "function" was. My brain was telling me it must be some other more complicated thing.
In my experience, the majority of the time, all you want to do with an error is to pass it on to the function above, while adding some amount of context to be able to later tell where it appeared in this function. Exceptions with stack traces (Java, C#, Python, Common Lisp - really anything except C++) give you both things for free: control flow stops, the function calling you gets the error, and information about where the error occurred is passed on.

At component boundaries you typically catch the error and perhaps convert it into a different type; and somewhere close to the user interface level you typically actually handle it in some meaningful way (retry operation, show error to user, cancel other work etc). Here by user interface I don't mean just GUI, but things like HTTP request handlers, terminal UI, RPC etc.

In most codebases that I've seen, error handling (as opposed to bubbling the error up with a bit of added context) is perhaps 1% of cases - whether in Java or Go or C. And in Java, this just means that 99% of cases will "handle" an error by simply calling a function, or perhaps the try-with-resources statement.
> This style of if err != nil error-checking is, laughably in my opinion, celebrated as an example of the “simplicity” of go programming.

Literally nobody ever celebrated having to write 3 lines to return error.

The "simplicity" part is "return error at point of happening, each function have error as last argument so you handle error here and now"

The inept syntax was never liked from the beginning, despise stubborness of Go authors to not provide better alternatives

Rust's Result<T,E> does wholly better job with same context, altho tendency for people to just .unwrap() with no context often puts it back into "bad error messages" territory
C yes, Standard ML was already a thing when Java and Go came to be, and even plenty of other ML derived languages.
I agree, but it's also important to notice that C++ changes by 4.21%!
You got a citation for that?

I’m a part of the 20% who enjoys going into the office a few times a week. There are three other folks who show up regularly; the rest rarely — if ever — make an appearance. I’m fine with this arrangement and I don’t see a need to force everyone else back in.

With the the exception of misguided upper management, I suspect most people take a more nuanced view of remote work.
Again, did those last after the emergency?

About the cultists repeating "trust the science" or even better, the attack "you don't believe on the science!", yeah, those are about as stupid as the people doubting the main vaccines are safe up to now.
Ew yeah the more you look at it the weirder it gets. Like what's between his fingers, or what is that keyboard layout? Is that supposed to be cash sitting on the armrest, or like a plane ticket?
And how much they were compensated is also interesting...
I can't get it how Steam can make an app store for Windows that works unlike Microsoft. It's not at all unique, because Dropbox was able to make a cloud storage product that works, unlike Microsoft. It seems like having access to the OS internals is a bug, not a feature.

It is unsolicited advice but I'd suggest that Microsoft get the Windows store working right before it spends billions on a source of games for it that as it is people won't be able to play. (... for that matter, am I the only one who sees links to unwholesome "Youtube shorts" on the Youtube home page that don't actually play? I have the problem both on Windows/Firefox and my iPad)
Probably a good idea. Instead of confirming Playstation/Nintendo releases for the rest of time, they seek to make all Activision games XBox only. That's the real goal. This would kill playstation and nintendo.
I installed an offline gallery and disabled Google Photos. For years and years Samsung android phones didn't have the option of cloud backups.

There's a very clear distinction between local and cloud, every single photo taken using any camera app is local only. Galleries, like Google Photos, and backup services like Dropbox have an explicit setting to enable cloud backup. Google Photo backup is very distinctly different from Google Drive and phone backups in general.

I use FolderSync to sync it with a self hosted NextCloud instance. If I am travelling, I prefer using Syncthing, a wifi file server running off the phone, or a physical wire to transfer photos. I know exactly what pictures are sent where and backed up with what method. I am not sure why you believe Android treats photo and file management like a black box, I don't believe Apple does either. Apple iOS devices are much more difficult to manually backup as they only allow background photo sync to iCloud, if the screen is turned off syncing to a third party will most likely fail. But there is a straightforward toggle to disable Photos backup to iCloud.

Android file management is superior to any other mobile OS. Android is file privacy first by design, as long as you are comfortable managing backup and syncing with self-hosted and self-managed solutions. I have gone the additional step of rooting my phone as well to get around any Android limitations on what folders certain apps have access to.

No one is arguing against the last point you made. No one was conflating the two.
Where do I say "oh but the data leak isn't really that bad of a vulnerability"?

I tried to summarize what the vulnerability is. Why are you so upset about that?
The fraud that occurred is SBF said users retain the title to their deposits and, quote,

"we do not invest user deposits, not even in bonds"

and yet he _did_ take user deposits. He defrauded them by taking their funds. This is also known as theft.

This type of fraud, which also counts as theft, is not possible with self-custodied funds.
> "Rock climbing" ... [is] effectively solo

I disagree with this one, though. It depends on how you look at it. Rock climbing CAN be an activity you go to, put earbuds in, and block out the rest of the world, and sure, many do... but if you approach it with an open mindset, talk to others at the gym, make friends, then you are already ahead of the game, because those friends already share your same hobby (vs. finding a friend at a social event).

Anecdata:

- My cousin started rock climbing because of her fiance. His entire wedding party was made up of rock climbing friends

- Another two friends I know from the gym met at said gym and got hitched

- Dissatisfied with the "phone number whiteboard", I started a local discord group which now spans two gyms, we chat online but meet up when convenient. I found one of my very good friends from that group.
But it lets you do things that are absolutely wild without weird syntax or setting up reflection. $obj->$dynamic_var. Or $$dynamic_obj->$dynamic_fun().

Whether or not you should be doing that is another matter… but it’s useful in some cases and easier to grok than using reflection or using array syntax on an object (like JavaScript).

After awhile, you don’t even notice the $ to be honest.
That is at the 'edge' of your code where you are calling some function and needing to translate to your code's error type. At all the intermediate layers of functions in languages with exceptions you write no code and just let it bubble up, while in Rust you just use `?` to send the error back up a level, while in Go you have to be verbosely explicit around every function call at every level.
An Interview with Olaf, the Founder of MetaCPAN (2020)
Binary log files is another example of something that could have advantages in theory but never seems to work well in practice. What used to be "tail /var/log/nginx.log" is now

man journalctl
journalctl -u nginx
<G to skip to latest, ctrl+C because it's taking too long>
journalctl | grep nginx
<wait...>
go back to man page to look for more options to search

etc
If it's a good result I'm sure there are many people that would pay 1c per search. I've made 16 searches today, far less for stuff I didn't find with ddg. If I was after something specific I could charge my account with $5 and search away.