skysight-inc/HackerNews huggingface dataset:
>you are struggling to see how this sounds logical to a vast number of people, including policymakers

I don't struggle to understand them. They're just machiavellian. Policy makers are bought by the capitalists, sorry, the lobbyists who benefit from billions in funding to the DEA and border control and prisons - and so they are not looking for the solution that helps constituents, they're looking for what enriches them personally thru super PAC donations or LE budgets.

It's the educated voters' positions, looking at the wealth of evidence showing prohibition is a failure at best, and a moral show put on for the puritanical more realistically, that baffles me.

People like you falling for something there's pretty much infinite evidence refuting the value of. Has the war on drugs helped ANYTHING? Anyone??? Stopped anything? It's never been easier to get drugs.

On the other hand, there's plenty of evidence that shows treatment centers safe injection sites and further, reductions in poverty do more to reduce addiction than moral policing.

It's most analogous to abortion policy. Abortion isn't reduced by banning it, it's reduced by better sex ed and access to contraceptives.

So counter intuitively to the simple minded, it may seem as if "pro choice" advocates don't also want to reduce the number of abortions. When in fact, they just use reason to solve the issue rather than a fkin harry potter book written 2k years ago they take as absolute truth.

>implementation will likely be very, very slow and difficult

Agreed, but the quicker we dispel the anti scientific notion that cartels + addicts > addicts... The quicker we may see progress.

I did time for shake I didn't even know was in my car, if I wasn't wealthy and white I would probably still be in jail rather than law school. So this is personal to me. Sorry for getting so heated
I had a chance to sleep on this and think it over.

I don't know who goes this deep in to these threads so this is mostly for myself.

My primary critique is from a lifelong love of mathematics. I actually hold a few fancy degrees in the subject.

I cannot stand however, power structures for the sake of power structures. The primary reason I left academia and broke away from the field is my, well, disgust really, with how, I believe willfully obtuse things are.

It's not so much how things are stated although there's problems there, it's the relationship dynamics, interactions, and style of expressions.

Before the rise of the term science, math was called a "natural philosophy" and I really have felt that the mathematics community, at least on the west coast, which is what I've experienced, has an accentuated form of the most off-putting characteristics of philosophy including a steadfast refusal and denial to acknowledge it.

I really think it makes what I consider a beautiful field of study to be hostile, insular and needlessly esoteric.

I still care a lot about it and I want it to be healthier and more open.
Yep the Hotspot JIT will absolutely allocate on the stack and reuse memory allocations inside loops. It also has escape analysis and it will detect you don't need the array of strings after the iteration. In that case it usually just allocates the strings directly at their final locations on the record object.
I completely agree. As an aside, for .gov domains, the DMARC offenders are primarily at the state, county, and local level. I would personally be in favor of extending CISA’s DMARC requirements to anyone with a .gov domain (and revoking domains that are non-compliant).

Another misconception among many CIO/CISOs is that securing your individual subdomain with DMARC is enough. For example, dmv.ca.gov might have DMARC on its subdomain but not on the root, allowing a scammer to make up their own subdomain like “vehicles.ca.gov” and scam people into paying for fake vehicle registration. Of course there are other mechanisms inbox providers use to protect recipients, but without a DMARC policy on the root domain the door is left open.

This is especially prevalent at the state level where no one wants to own DMARC centrally.
this was part of cyrus imap from cmu, which iirc was the first big imap server to support server side indexes. (i think they were bdbs, iirc)

believe it or not, but many hugely popular applications from 20+ years ago didn't even implement indexing. in this case if you had too much mail your imap client would just time out.

well through the mid-2000s you even had to use a third party plugin for outlook called "lookout" if you wanted searches to not take minutes.
As I mentioned, I haven't been in a McDonald's in years, don't they still need someone to initiate the refill and hand you the drink?
You're missing the point: It is possible fro multiple distinct groups to all fuzz the same code and find different non-overlapping bugs.

You are erroneously saying "one group of people found a bug that could be found by fuzzing therefore apple is not fuzzing".

LibJPEG is decades old at this point and is still getting around 10 CVEs a year, despite being one of the projects I believe google constantly fuzzes.

zlib is getting a few a year despite being a vastly more constrained format than anything else imaginable, and again being a heavily fuzzed library.

If "do lots of fuzzing" caught every bug, then you'd get a big release that fixed all of them, and you'd never see any more.

> In this case, iMessage is particularly well suited for some smart fuzzing because all the attack vectors seem to involve smallish malicious attachment files.

I chose to include libjpeg above specifically to rebut this comment. That there are still CVEs coming in for libjpeg this year, despite years of fuzzing should be sufficient to show that even small attachments aren't magically invulnerable due to fuzzing.

Fuzzing is a useful tool but pretending that some project or software is going to be secure because it's been fuzzed a lot is nonsense, and pretending that fuzzing will find all the bugs is complete fiction.

Even software written in memory safe languages benefits from fuzzing: a memory safe language simply means your code will not continue if doing so would result in a memory safety violation, but for most memory safe languages that means at best an exception, but in most cases it means termination - that's what you get in Rust, Swift, or even functional languages like Haskell - and program termination can mean user data loss, or at least a bad user experience, so fuzzing is helpful even if bugs don't cause "security" issues.
Feel free to bookmark my post and come back to make fun of me if I’m wrong.

I don’t think that there is any “merely” anything. I think it’s a complicated process with tons of patents that you get a license to use when you pay for a developer membership.
> if you don't advertise for very specific roles, people are confused and don't apply.

As a candidate I have the opposite experience with companies that advertise a long list of roles, like Flexport's "200 open roles".

If I see a company with a large number of slightly different roles, for example each specialising in one of the company's numerous obscure products, or some slightly diferent aspect of the process, I have no idea which one(s) to apply for and I end up skipping that company entirely, even if I like the company.

Red Hat is like this. Before the IBM acquisition I was interested in working there but I couldn't figure out what to do with the enormous list of product-specific ad activitiy-specific roles I could theoretically apply for. A recruiter was unable to help; they just wanted to know which ones interested me. Well, about 50 of the roles look interesting and suitable, but... so I didn't apply.
It's "Hydrofoil Generation".[1] The only game on the "Released" page of the Rust gaming group that looks post-2000.

[1] https://arewegameyet.rs/games/released/
Whenever I see that it's always less than $x in a savings account which would include me. My net worth is high 6 figures and I have 50k ish of CC availability. So completely meaningless.

Edit: ok this one says it's a survey. But the results are that overall 58% don't have 500 in savings, but young people are actually doing better with only 39% of 18-24 year olds having less than 500. I'm not buying that.
That number doesn't really tell you anything. I mean, 23% of people admit to committing friendly fraud via credit card chargebacks.
I have never seen the Federal government pick up the tab for a railroad accident it did not cause or was not involved in.

Could you please go into more detail?
By being declarative instead of imperative:

- The dependencies of a module can be scraped without running the code

- The subset of declarations used in an import can be known

This allows modules to be loaded in parallel, and also allows for things like tree-shaking. The biggest benefits are for web browsers, but all around it's a more constrained way to express dependencies, which allows the bundler/runtime to take more liberties.
> OKRs are a good thing

Our company ditched OKRs and we are running much faster. It turned out that people already knew, at any given point in time and to 95% accuracy, what's the most critical work to focus on. We didn't actually need to spend 3 weeks every quarter hammering out OKRs with dozens and dozens of goal-lists across teams (and then another 2 weeks at the end of the quarter doing OKR progress reviews), when the real thing to do was just to fix the Top N things that are broken, and then keep that short-list of top issues fresh every week.

"But, but... how can you make progress without quantitative quarterly goals?? That's outrageous!" Well, you know how those things that are always broken are now getting fixed? That's how.
X First Amendment lawsuit against California AB 587 [pdf]
If you're being an nuisance and causing the other patrons to have a less than ideal experience, absolutely, you should be asked to leave. If your site is constantly getting scraped and your service is affected due to it which causes other users to have slowed responses, you should absolutely be able to refuse requests from known knuckleheads.

To this day, bars have a list of "refuse entry". Sporting teams have life time bans to hooligans. Sure, the ban hammer should be slow to swing, but it shouldn't a never allowed to swing situation.
The leaf is actually a quite nice car. It sounds to me like you've never been in one.
The frequency that I've seen companies open positions that don't actually exist to "fill the hiring pipeline" is gross. Recruiters and those that lead them should be ashamed of this, and yet I see it all the time.
Nowadays sudo uses seccomp filtering for its noexec option, which is enforced by the kernel and does not allow the workarounds that userspace-based solutions (including LD_PRELOAD) have.
a decade or so ago, I ran into a problem where "yes" was already too fast, feeding it to apt-get install or something (in a context where we knew what the prompts were doing and if anything unusual happened we'd fail other checks immediately) and it had some clever input buffering going on... that wasn't clever enough and locked up on getting a megabyte of yes'es on the first read() call.
What? FBA is a key reason why Amazon.com is so dominant. It's the biggest part of their moat.
It's surprising that the paper doesn't even mention SRS (Sender Rewrite Scheme).
> I think it's a balance. For "emotional gardening" as I call it, disconnecting from tech / anti-social media and taking a walk is great. But if you still want to assess present reality and make good judgments about the future (or even just have some novel thing to talk about), these tools can still be great for absorbing information context.

I don't think Xitter is a good tool for assessing present reality and making good judgments about the future, either. (Actually, I took you to mean "directly obtain accurate information about the world and act on it," but maybe you meant "find out the worst of what people are currently doing and be prepared.")
Should we root for poverty?
figuring out how to iterate rapidly with our AI efforts was poking around in the dark until we got Rivet set up and could start to isolate variables. So this has been really exciting to see.
Even few degrees can mess with the environment. So yes, lukewarm water can totally mess with a lake ecosystem, if you happen to pour it in the right place. Will it kill the whole lake? No. But life that happens to be at the spot where you poured the water? Dumping chemicals is also fine, as long as they aren’t strong enough to kill everything in the lake?

And spacex launch site is literally surrounded by protected lands, that were there long before their site. Will spacex kill some protected life nearby? We don’t know. But let’s not pretend that dumping hot water is safe.

And that news is about parts near Florida reaching reef threatening levels. Based on your reasoning it’s fine, as only reefs near Florida were impacted, ocean is fine, so what’s the big deal, right?

It’s really stunning to me, that spacex fans, whose mission is to basically “safe humanity” care so little about the environment, that you know, humanity needs to live.
Thanks, but I don't think I know enough about this to speak about it on the pubic record. My experience is based on remembering what random customer service reps said a few years ago and a bunch of reddit and forum posts. For example, I don't know if Zelle is literally just direct deposit--if it was how did they freeze my transaction for 3 weeks?

But I do get the sense that of all the payment platforms, Zelle is uniquely risky because of the way it's set up. I do with a journalist would look at it from that angle rather just from the "wow there's a lot of fraud here". It seems to be that the banks are incentivized just to get have this product out here to undercut the competition from digital payment platforms, but have absolutely no incentive to make it a functional or safe platform.
Fun article! I bought this DVD back in college, when I was studying computer science then. I was a long time reader of Joel's blog, going back to high school. I was going to be working in NYC after college. Back then, there were no real "tech jobs" in NYC. It was after dotcom 1.0 crash, but before the post-Google boom. The main companies you could work for in NYC as a programmer were Wall St firms, unless you wanted to end up in a general "IT department" for a BigCo.

I then got a job offer at Fog Creek when graduating college, incidentally for their Software Management Training Program. I turned down the offer, but one funny detail is that in the job offer package, which Fog Creek FedEx'ed to my NYC apartment, there was a printed copy of the Aardvark'd DVD in a DVD case.

As for the documentary itself, I remember liking it, but I watched it at that moment. The connection to YCombinator makes total sense to me. Joel was trying to get smart CS grads to stop taking boring internships with BigCo's outside of tech where they wouldn't actually get end-to-end software product build-and-launch experience. His primary competition in NYC? The Wall St firms (Goldman, Morgan, Lehman, etc.) whose summer internships involved apprenticing on a big internal software system for a couple of months while being marketed to by HR to join that Wall St firm full time after college. YCombinator was trying to convince this same cohort of ambitious CS grads to start startups instead (e.g. the reddit founders at UVa).

Today, the competitive landscape for startup summer talent is totally different. The tech companies are the BigCo's, in NYC or SV. It's probably the Wall St firms who need some help convincing summer interns to join today.

Ironically, I turned down the Fog Creek full-time job to work at Morgan Stanley. The latter felt like a more Linux-y job to me, and I was big into Linux and F/OSS -- also, student debt bills needed paying.

But then just a few years later I ended up quitting that Wall St job to start a startup that went all the way from seed through venture financing and eventually to exit. Fog Creek and Joel remained an inspiration in terms of how we built our engineering culture. See e.g. slides 11-13 here: https://speakerdeck.com/amontalenti/fully-distributed-and-as...
"if social media companies are forced to disclose what they do in this regard [i.e., how they moderate online content], it may pressure them to become better corporate citizens by doing more to eliminate hate speech and disinformation."

“[T]he Legislature also considered that, by requiring greater transparency about platforms’ content-moderation rules and decisions, AB 587 may result in public pressure on social media companies to ‘become better corporate citizens by doing more to eliminate hate speech and disinformation’ on their platforms. . . . This, too, is a substantial state interest."
For anyone extolling the virtues of credit cards as the ultimate payer-friendly solution, my "exhibit A" is a vendor who charged my card and then put a freeze on actually shipping the product. Then they tried calling me while my phone didn't have a signal. Then they sent me an email saying their "verification" department couldn't reach me and to let them know when they can call. I replied telling them when they could call. They didn't call.

So I called them and sat on hold until someone finally picked up and told me that my order was flagged for some reason. After I confirmed my address (?), they seemed to confirm my order and then hung up. I still haven't gotten any confirmation that my item shipped yet.

In general I try to avoid ordering from Amazon, but if I had done that instead, I would have my item in my hands right now. Instead I had to waste my time playing phone tag, and I'm still wondering whether or when they'll actually ship my item. All because the vendor is apparently super-averse to credit card fraud and would rather push me to Amazon for future purchases than take whatever chance they'd be taking by sending me what they've already charged me for.

I'll have to be calling them again after the weekend to see if they've actually sent it. If they haven't, I'll tell them to cancel my order. And then I'll have to wait for them to refund the charges. If they don't, then I'll have to make another call to my bank to reverse the charges.

All the while, I still don't have my item. So if you don't pay for fraud in lost cash, you're definitely paying the overhead of vendors trying to avoid being "stuck holding the bag" by throwing arbitrary verification processes in your face, introducing delays and possibly leading to you needing to make multiple phone calls to resolve problems while being left without the thing you need.
As if non-mainstream news outlets are objective.
This surely has to impact their ability to hire in the future. Like, personally I’ve never heard of Flexport before, and it doesn’t really sound like my sort of thing in any case, but… presumably at some point they will want to hire again, and this feels like it’ll put off anyone who has other options.

(I’m always baffled at these really poorly handled layoffs - most companies doing layoffs will need to hire again at some point, potentially in a competitive environment. The internet exists; people will look it up.)
In vi (which apparently is vim by default I was told?) I know open, save, quit, go to line, go to begin/end of line, find, insert, delete line.

We used emacs in college and that was the last time I used any text editor serverside besides vi. Am I missing out?
> what do you do about the 33 engines that literally blasted the floor off

Worry about it when that’s the priority problem. Tackling that now is like designing blast pads before you have commercial jet liners.
>It can be handled safely and radioactivity can be used for medical treatments! Besides there is radioactivity in lots of things

I'm describing a subsection of radioactivity in that sentence, not the entire scientific notion of radioactivity as dangerous....

I don't know the laws on radioactive materials well enough to speak to specifics about if too much is banned in the name of safety.
McDonalds did have them for a few years. Allegedly they went back to the tried and true because the maintenance costs were too high.
I saw this talk live but was disappointed the app is $10 to give it a shot. Seems a little steep.
Wait wait wait.

By this logic the US Economy is held up by a thread of revenue produced by monetizing all of human behavior for the sake of selling more stuff?

And privacy laws (which somehow don't include the 4th amendment because surveillance) would threaten this economy?

To paraphrase Immanuel Kant, "If privacy will kill it, let it die."
Apart from the occasional overtaking which you might need the extra speed, the odds you get a ticket from a hidden camera are very low if you just respect the speed limits. Or am I missing some point?
I’m looking forward to your defcon talk next year then
My guess is what they meant was there is a policy prohibiting retaliation and the legal department never condones retaliation and it tries to prevent it.

Unfortunately, employees outside of the legal department may retaliate anyway because they did not get their way (i.e. they are angry someone reported a problem they wanted to cover up).
You're arguing in bad faith.
> If I had to do this in C++, I'd be fighting crashes all the time.

Why? I'd take modern C++ over Rust every day of the week.
There's probably a reason their hiring posts here have comments disabled
CJS does not work in browsers. Bundlers fake it well enough you might not feel that pain regularly, but ESM was designed for use in browsers and CJS wasn't.
Any one who considers ~arithmetical methods of producing random digits~ parsing HTML with a regex is, of course, in a state of sin.

— John Von Neumann
tldr; cop equipment uses BLE and you can detect this at a distance.

I always wondered if there was a particular RF signature to LE vehicles(say, the radiated IF from their radios). This seems more reliable and easier to setup.
The problem here is that Department of State has set their DMARC policy correctly to reject and the victim is using a server that correctly checks the policy, so sender spoofing should not be possible.

However, the Outlook server in between launders the email by 1) not honoring the DMARC policy and 2) rewriting the email headers to originate from Department of State.

As DMARC requires that either SPF or DKIM alignment passes, the laundered email will pass the DMARC check on the victim's side who expects to be protected from this kind of spoofing.

Really the solution here should be an extension to DMARC where you can set a policy that BOTH SPF and DKIM checks need to pass and be aligned in order for the email to be delivered, rather than just one.
So she sent $1800 to someone without first seeing a pending transaction of any kind for a $1800 credit? Some things have to be learned the hard way if that's all it takes.
LogoScale – A method for vectorizing small, crappy logos
tbf.. all YC hiring posts have their comments disabled..
I've not much confidence that a company known for not getting permits and not paying rent or severance will carry through and pay out my own money when I want them to.
Rust still isn't the language I'm looking for.

It's too complex.

Something simpler is needed with the benefits of memory safety.
This exactly. And this is the reason that Venmo or Paypal need to charge fees for commercial transactions, because they're providing a service. What bugs me is that Zelle seems to be marketed as equivalent to those other digital payment platforms, but in reality it's very different.
This is a very good comment because it shows how pervasive the problem is. In this case, the tax investigator was punished for doing a very good job.
> Same problem on the moon

You need a lot less thrust to get off the Moon’s surface. That probably puts the problem back into a familiar envelope.