skysight-inc/HackerNews huggingface dataset:
Can you please give me advise on my early startup game plan?
I'm trying to start a company in the real estate tech space. Currently, I'm validating the problem, looking for the best customer-problem fit by being aware of its frequency and intensity. I'm using carrd.co to build quick prototypes to investigate the problem with potential customers. Up until now, life is good, and YC's advise is working amazingly.

But I have two obstacles that are really weighing me down. The first is that my job at a bank is making it hard to talk to users, as I can't talk to them after work or on weekends (they're just not there). The second, is my lack of coding skills. I can build quick, good looking prototypes just fine on Carrd, but I know that I'm going to need a co founder to launch something that works and improve it on a bi-weekly basis. Plus, there's a huge legal aspect with my idea, so do I need a third co-founder with a legal background? So here is my game plan to solve each, but I want your opinion, whoever you beautiful person are:

The Job:
I'm trying to secure fifteen minute talks with users during working hours to investigate the problem. That's pretty doable. But, that's not so useful when showcasing prototypes to see if whatever solution I have is actually helpful. I’m saving up money to go on an entrepreneurial break. But I need to save enough to afford a living for and my wife, and enough to pay off a loan I have. In the interim, I’m changing jobs to get a better salary and I’ll start using my annual leaves once a week to increase the time I can spend on my start-up. Whenever my leaves run out, I can just take unpaid ones. The problem here is that it’s going to take me more than a year (two more or less) to save enough money and payout the loan.

The skills:
I’m currently using website builders to make prototypes. But the options I’m working have some limitation. I am thinking about building a functional website as soon as I pinpoint the needs of my customers with the help of an IT development company, then outsource the work on iterations to freelancers. That's the most cost effective way I can think about, but it will still cost me. I just don’t know how much. I firmly believe that finding a technical co-founder is the way to go, but I need to double down on searching for one in my circle. In terms of the legal expertise, it's critical because the nature of our problem requires a solution with adequate agency cost mitigation. This might need big bucks to outsource.

Now the question is: what part of my plan is wrong, what is missing, and what is actually good?

Love to hear your guidance,

Thanks!!
Yes, ext2, before journaling was added to extfs was painful, powerloss, or simply switching off a computer without runnng shutdown often resulted in data loss and if you're unlucky enough, fsck threw you in to "please try to fix this, I can't" prompt on the next boot.
In my current role I work as a developer in the finance sector. We are interested in secure coding. Every year we have to complete a secure coding course and pass an assessment.

We have a team dedicated to performing security reviews for most code changes. Your change can't go to Production until it has been assessed by someone from the secure code team. They can request rework if they think you have introduced a vulnerability.

We have regular pen-testing performed.

There are various vulnerability scanners running against the code repos and blocking builds if a dependency is identified to contain a new CVE.

The project I mainly work on has been in active development for decades. It has well defined frameworks for many common actions. Most of the time we are working within those frameworks, which have been already been vetted thoroughly. Ironically, it is rare that we would need to touch code in a way that could introduce a vulnerability.

In a previous role I worked on desktop applications for engineering simulation. There was no requirement for secure coding for those projects as there was no central database. All the models were file based.

So it depends on the project and the risk and consequence of an malicious actor finding a vulnerability and exploiting it. The health and finance sectors have to take secure coding seriously. From experience, many Oil and Gas companies are also super strict on controlling data access and will often request proof that a software application has been security reviewed and pen-tested.
You missed a step there. It's actually closer to:

1. What your assets are.

2. Who is interested in those assets.

3. What attack vectors exist that are feasible/available to the interested parties for compromising those assets

4. What mitigations can be put in place for those attack vectors.

Otherwise, as I said elsewhere, there will always be an attack vector, right up to the point where the computers are turned off and in a locked room. The only way to explicitly choose not to take that extreme measure is to figure out who you are, and are not, defending against.
perhaps the question should be: why don’t investors allocate funds for secure software?
Sometimes there has to be a trade-off between user satisfaction and security.

If you make a process with too much friction, it might be secure but you'll get user churn. Plus a lot of end users are straight up idiots, making something too secure means a lot of them won't be able to use it.

But that said the only time I've seen insecure coding in the wild is the endless blog spam on sites like medium etc.
I would love the inverse of this. Just give me the fads, politics, mundane topics, business, and marketing.
In Norway, self plagiarism has been a hot topic. Should it be treated as "ordinary" plagiarism if a student re-uses parts of an earlier assignment they have written themselves?

And more generally, is it okay for institutions to provide commercial institutions copies of the work of students who cannot say no? To what degree should students be in control of what happens to their work (i.e., can they put some kind of license to it, to limit what it is used for)? Should the students be compensated when their papers are used to increase the value (i.e., database) of a third-party company?
To the risc-v folks: I am looking for a mini-board with a 64bits RISC-V core, USB-C (power+data), many(~30) available GPIOs, easy to flash or boot from a memory card. That for a keyboard firmware directly written in 64bits risc-v assembly.

The BL808 is actually a 32bits risc-v as a main core with a 64bits risc-v core on the side (convoluted hardware programming from the 64bits risc-v core).

The K210 does not seem to have a USB controller (only a UART<->USB dongle).

Then I am lurking on some mango boards, with a D1, the D1 being completely overkill.

Anything else?
> Apologies, if this comes off as patronising.

Thanks for checking; don't worry, it wasn't.
But now some of your requests resolve with undefined, rather than correctly reject (it's exceptional behaviour).

appendChapter(undefined) doesn't seem right to me. Feels like you'll have to do something like if (data === undefined) throw… which kinda shows how hacky this is.
What is the FAA’s NOTAM? An aviation expert explains how the system works
https://lapcatsoftware.com/articles/without-notarization.htm...

I don't know if this still works, but it used to be that when you right-click an app bundle in Finder and select "open" (as opposed to double clicking the bundle) you get an "open anyway" option in the OMG APPLE CORP JUST WANTS YOUR BEST warning dialog.
So does the Emacs one.
It's not survivorship bias when you do selection. ext2 was not the only FS type available on Linux. As always with Linux, there was this wide variety of more or less off-the-wall choices. ext2 and it's lineage stuck with us because people started thinking that it was the one least likely to eat your data. The fact that ext2 happened upon a technical decision that worked well with cheap hardware was luck, the fact that ext2 ended up as the "default" file system on Linux was not.
> it didn't take incoming requests from anything except the bank's internal physical network

I hope, it's still at least checking CORS headers, otherwise it might be vulnerable to a drive-by attack [1].

(At least if some device on the local network runs an older browser which does not implement CORS Private Network Access headers yet [2])

[1] https://wicg.github.io/private-network-access/#biblio-drive-...

[2] https://wicg.github.io/private-network-access/
This just looks like standard police work? What am I missing here?
The one thing that still annoys me about the iPhone keyboard that I think Android does better is correcting mistakes. Apple expects you to correct your mistake before you finish a word by selecting the right suggestion. On Android typing backspace after a word undoes the suggestion so you can quickly correct a wrong suggestion. Instead of having to erase the whole word and trying again.
I like the 2013 posts
I find most of your complaints incomprehensible.

> Well, alright, I don't see no CSV-mode to arrange everything into a pretty table and then let me filter/sort/edit the damn thing.

`csv-mode` is right there on ELPA, the default package source for Emacs. You went to MELPA, which only has packages from people who don’t want to license their code the same way as Emacs. Install `csv-mode`, then type `C-c C-a` to format it into columns, `C-c C-s` to sort by a field, and `C-c C-n` to sort numerically by a field.

> A table editor within emacs will be janky, it will be a slow heap of cowdung, outspreading and dispersing, channeling the fumes.

This is completely wrong. There are half a dozen Emacs packages that give you variations on the theme of a table, and none of them are slow or janky in my experience.

> Well, scrolling that thing was not fun, I will tell you that. Neither was getting spammed with:

All the errors you report look like they were caused by packages you have installed, not Emacs itself.

> Timed out waiting for property-notify event

This one is actually caused by your clipboard manager rather than an Emacs package.

Etc.
I'm not a fan of the books either and as an avid reader, science fiction is my overwhelmingly favorite genre.

Still, I think this is unfair. Lots of hard core scifi fans love them. I don't get it, either, but let's all be ok with people appreciating that which we do not without insulting or questioning their taste.
But you did buy it?

-Jack Sparrow, LG CEO
Thank you Google and MA for offering proof positive of what should have been obvious all along --- you don't really own your phone, Google does. And they can do what they want with it.
Is raspberry's throughput enough to handle the load?
I think the system is far too complex to claim “it’s cars” because it costs more to run infrastructure.

Infrastructure is often not even the #1 expense for sprawling suburban cities. The Police-per-person-ratio is less, pension funds are usually extremely high on the list of expenses. Similarly, education can also be exceedingly high on the list of expenses, depending on jurisdiction.

I’m not saying you’re completely off base, but I think it’s far more nuanced.
That only reveals a lack understanding how IE 5 took over the Web world.

It slowed down when it won, same will happen to Chrome after Google is done turning it into ChromeOS.

Safari is the only relevant browser preventing Google to achieve that goal.
There are very few public health interventions that are deleterious to even a fraction of the population, because the prime directive is "first, do no harm" and that's a very much entrenched principle of public health.

Regarding vaccines, I chose the whooping cough example on purpose. This vaccine is only 60% efficient. The risk of newborns being killed or gravely ill would be highly increased if used only at the individual level, including for a particular person choosing to vaccinate.

Your view of risks and benefits involved is very much skewed by your overconfidence in individual medicine. It is widely known that poulation-level interventions aka public health are the most effective (e.g. the Cuban system).
RAID does not really protect you from bit rot that tends to happen from time to time.
ZFS might because it checksums the blocks.
But if the corruption happens in memory and then it is transferred to disk and replicated, then from a disk perspective the data was valid.
OWASP in not really targeted at developers and a lot of in it is just not actionable or useful for Tommy implementing new basket. The parts useful for developers are known by developers

OWASP is for security professionals which is why you heard about it from them.
For #3, how did you change that mapping in macOS? That'd definitely work for me... And I can probably get used to delete, although it'd be neat to have it at the top of the row above Home.

And yes, the keycaps do seem to be translucent to some degree. I almost say too much because when the light is on bright it's like the sides of the caps themselves glow, but the letters do as well.

I bought mine from the Keychron store on Amazon, and when I got it I noticed a greasy fingerprint on the bottom of the box, but all seemed good. I'm now realizing that it's missing both the keycap and switch puller, and the keycaps on my (white) model match the colors that the RGB should have.

I'm wondering if maybe I should return it and order the pro directly from Keychron? I guess I could sort out pretty much everything that way...
Pretty sure this is just a racist comment. A quick look at the demographics data for Australia shows it to be overwhelmingly white european - even if we restrict ourselves to the White Australia Policy definitions.
I see what you're saying, perhaps it was only overrated compared to my expectations given their front page marketing.

Do you have personal experience with Gumroad to share? That would be interesting.
> The vaccines were never tested to prevent transmission

Because it's an inevitable thing when people are less ill. It's dishonest to demand testing something like "people coughing less spread less" and then use that to pad the rest of your weak arguments with that - like the last sentence about efficacy (straight after the anecdotal).

> Sweden never locked down, and their outcomes were better than most of the rest of Europe

Emphasis on the "were".

> Scarecly anyone wore the kind of mask that could possibly make any difference. It was security theatre to calm the masses. All a cloth mask does is redirect your breathe out the sides. It doesn't filter anything.

Whose fault is that when the good practices could have been followed but were not? Should have beaten them with a baton? Damned if you do, damned if you don't.

> I hope they have, because it help further fortify their natural immunity.

Yikes. The old adage about "what doesn't kill you" should end with "leaves scars" as it's definitely not so cut and dry to only "make you stronger".

> Over and over the claims of the expert class have been proven wrong. They claimed to know things that they couldn't possibly have known, and continue to lie and deflect to this day.

They have been far less wrong than the rest. That is how the process is supposed to work - new evidence comes to light, opinion changes. It's not an ancient belief system based on a book. It's a fundamental misunderstanding of science to expect random sentences (where most nuance has been filtered out from) to be irrevocably true.

There are going to be improvements, better ways to apply the same principles, changes in the underlying assessments, things change. Framing it as the reason why some opposing stance is correct is extremely dishonest and grossly wrong.
But the only reason there is no monetisation via ads and other “innovations” in these apps is because Twitter have deliberately degraded the APIs and not kept them current with the official site/app for a decade now.

Twitter could also start charging app devs for API licenses, or restrict 3rd party apps to Twitter blue users if they want to change things up.
But they’re glitchy and sometimes slow to open (I presume because they’re trying to access the network)
Actually, Fibonacci results can be fairly precisely tested with the golden ratio ratio.
Enlace Hacktivista – Cellebrite and MSAB Leak
It’s slapdash, and maybe just based on cutting off the top N most used ones.

Fenix is blocked on Android, but not on iOS, explain that!
> This is such a frustrating comment to read. There is plenty of debate in public health about what is and isn’t appropriate.

Ordinarily. My dad and most of his friends are in the field, and they’re all smart, thoughtful people who tackle incredibly complex things like how to get third world villagers to use maternal health services when all they’ve ever known is midwives with no formal medical training. But they all somehow turned their brains off when COVID happened and started acting like parrots. And now they’re paying the price for that in terms of public trust.

The public trust of lay people in experts of all stripes rests on following established processes and norms. When experts deviate from those, such as by concededly lying to the public about mask effectiveness, public trust evaporates. There is never any excuse that justifies that. When judges and prosecutors and police cut corners on process “because lives are at stake” large swaths of the public rightfully come to distrust the system. The same is true for public health or any other field.
I used it 3 times yesterday (usually for re.match).

But I've been coding 15 years without it.
> Watch until the end for the AA man’s brilliant anecdote…

> At one point, I threw petrol[gasoline] across the motorway and lit it to try and warn them [of the accident ahead in the fog].

> But still, people still drove through it, and you could hear in the fog, bangs of more people crashing.

> [Comentator]. But nonetheless, a carnival atmosphere prevailed.

These were happier times... When even as people crash, burn, and die, people have a happy outlook on life. What happened?
extfs isn't a thing, and I say that because ext3 or 4 or even 2, matters here.

That spake, I wonder, are your bad experiences here with VMs, or with a raspberry pi?

Pis, especially the 2, had faulty hardware, and would report a successful write to an sd card before it was done. To "help" with speed.

This cause the sort of issues you are mentioning. And similarly, any situation where a write complete is a lie, can result in this behaviour too.

EG, a raid card with hard power off, no battery backed up cache, etc.

Because your experiences do not jive here, with ext4, and thousands upon thousands of servers and desktops I maintain.
Ask HN: Can files on IPFS be “deleted”
I know that if all nodes just stop serving the file, then it gets "deleted". But what are the real chances that files accessed infrequently get deleted?
> As someone who works in compliance, I have observed that many developers do not have a strong interest in secure coding.

This is just selection bias. Your job is to make people comply, most likely with something that hasn't been a priority until something happened to make it a priority. If you have a team built around shipping lots of functionality quickly, well, you are going to get a lot of blank stares when you start slowing things down. So, compliance is a hard job. And people who haven't made security a priority over time are not going to have much awareness of best practices, or OWASP.

> It appears to me that the development of secure software is primarily led by cybersecurity folks rather than developers themselves. Whats HN's view on this?

If you want to shift from "move fast and break things" to quality + security (which are peas in the same pod), it will often take new leadership. The processes, people, systems, and culture will need to change a lot. An observation: being good at finding problems is not the same as being good at fixing and preventing problems, and this where you have to be careful when you are changing leadership. It's not as simple as hiring a certification. It's actually a big organizational challenge.
Pure MDMA is most certainly hallucinogenic...
I lived in Beckenham right next to such a road and it was absolutely ridiculous. Cabs refused to drive on it because the potholes were so bad.
"Security" is not an atomic property of software. And while there are a lot of difficult tradeoffs between security and usability there are also a lot of low hanging fruit where entire classes of threat can be mitigated with zero tradeoff for user experience (and sometimes zero tradeoff for developer productivity if the system is built from the start with security in mind). To take a trivial example, hashing (with an appropriately secure algorithm) and salting passwords stored in your database. Or using prepared statements instead of manually building SQL queries. These are things that can effectively eliminate entire classes of vulnerability and are basically free to do.
I forgot to mention that the reason I use 80/20 is because of the famous Pareto Principle [0] which interestingly shows up over and over again in all kinds of human systems, thus making for a reasonable assumption in such analyses.

[0] https://en.wikipedia.org/wiki/Pareto_principle
Something like ... "CAVOK :)"
My background is in engineering physics and I like to think from first principles. I make a strong distinction between the possible and the impossible. In my experience the cybersecurity folks tend to think very differently, in a more fuzzy / pragmatic way, and it’s very hard to translate their thinking into sound engineering. They are typically very focused on trivial aspects, which goes poorly together with good engineering culture.
Essentially you are filtering hacker news content based on the type. Why not simply allow the user to choose what kind of articles they want to see? For example I'm only interested in the latest trends so I should be able to see just that and no other content at all. This could increase the number of users interested in your app
Stop spamming public forums with C&C messages for your bots... There must be some other venue you can use for this?
Do you have an example of one that doesn't have one?
Walk through the potential accommodations and what the parents should look for as evidence that they are helpful. If there’s an opportunity to take a low risk step like having the parents meet with a specialist at the school up front, it would help them become more comfortable.
Not sure how to do it on that device but with iptables you would do a DNAT rule with masquerade, so it NATs both src and dst IP and src becomes the IP of your router.
Are there any good analysis on what makes it slow?