skysight-inc/HackerNews huggingface dataset:
Lying is not an embellishment or puffery, it's a lie. Engaging a company for a 3 day pen test that's totally insufficient, that would be an embellishment.

It doesn't matter if the client doesn't really care. That's just a rationalization, plain and simple. No different in kind from, "well the bank teller doesn't really care if I rob the bank because it's not their money, and the money is insured anyway, so is it really even robbery?" Only different in degree (to be fair, an enormous degree; just to illustrate).

A pen test is a real thing. "What is a pen test really?" is another rationalization. There may be many flavors of pen test, but fabrications are fabrications. One of the most important part of pen tests is that they are external. It's like saying, "what is an audit really? We have accountants and they check our books for anomalies." Just doing your job as an engineer and looking for bugs is not a pen test. In the same way that being careful and rereading your own changes is not a code review.

This reads up me like an engineer committed to their work. I think they should be proud of themselves for not going along with this. I think the problem is that management isn't doing their job properly. They're cutting corners because they fucked up and didn't make sure a pen test happened or listen to their technical people. This is a strategic necessity for the company that would have been so easy to accomplish and should have been foreseen. They're trying to rule by dictate and it could destroy their career if this ends up in court. Even now, they could get some kind of rush job done - but no, they choose to endanger the company and the people in it instead.

Imagine being a lawyer or a paralegal and getting your hands on those emails in discovery. They didn't only demand their engineer lie, they did it in writing. The engineer is not the problem here.
Haha, fair, thanks
https://archive.is/xQ4VZ
Please note that in this case the Bill refers to the "original" so no subsequent changes can be taken into account, which we agree is bad. This Bill was simply designed to be performatively cruel to a small out group, not actually solve any perceived issues, it seems. Or at worst was not prepared to accept any nuance about the reality of timing and genotype/phenotype of anyone not fitting the mythical binary.

You and I agree that there would be sensible things that could be done, eg making it clear that someone is able to use a toilet appropriate to their currently agreed/certified gender where appropriate without argument. (Some idiots would still make life unpleasant for them on occasions.) And indeed countries with gender recognition rules HAVE made things better for the people who need it, but this Bill was not any of that, it seems.

And in many cases these days toilets are simply safely ungendered, which often means shorter waits for women too.

One of the UK daily papers that makes the most clickbait cash out of this topic has (or had) entirely ungendered toilets at their London offices AFAIK. It's outrageous hypocrisy.
He could not resurrect himself. He needed someone in not-ghost form, to collect some special items and perform a magical ritual. Some of the special items were also one-time use iirc.

Perhaps, this tool needs to additionally encrypt some of the pieces with the dna of one's father or whatever.
>“Nintendo” wasn’t specific enough to referring to some of their Pokémon projects.

Nintendo does not develop the Pokemon games - Game Freak does.

Nintendo, however, does publish some of the Pokemon games and does partially own the Pokemon IP through The Pokemon Company.
I will try it! Thanks for the recommendation!
More generically, free from economic rent.
Oh yeah, I wouldn't mind learning F# either I suppose.

Not that this probably matters/holds any relevance, but I worked at a startup using C#, and I liked the language itself.
> however you could also just grab a new license under a different name

I'm pretty sure there's a term for that: fraud.
keeping a distance from customers/users is my preferred location as well. even designing UI is too close for my liking.
I would go with, "I was not involved with pen testing, but <director> has assured me that it was done."

But really the right thing to do is to have a conversation with the director where you tell him that you want to support the company as well as possible, but saying that a pen test happened is not something you can do. You want the director to feel that you are reasonable and supportive, but realize that they have to find someone else to claim that the pen test occurred.
Yeah, I think I really didn't like the "The server thinks it's crashed and will run a recovery" part, but they do go out of their way to call out "It's fine, just make sure the WAL is also backed up".

Can't even claim that this is a recent addition, since it's documented like that since Postgresql 8, which was released in 2005.
Thanks lol, that's probably what will happen in the end, I suppose
"Crypto Custodian" Prime Trust just "lost" their keys[0] to customer money.

[0] https://news.ycombinator.com/item?id=37268750
Why be misleading? The directors are clearly wanting him to be a scapegoat. Just get on the zoom call and say you've never done pen testing, and your director lied to them. Also look for another job, this one has a short lifespan remaining one way or another
My understanding is that a small minority of a casino's users are responsible for the bulk of their revenue and if you take a small leap of faith and assume that many or most of that subset of users are gambling addicts, you can see how a casino might be heavily incentivized to need to be operational again quickly before their addicts seek a new source of gambling.
...No shit.

As a career QA with finance company pedigree, if you've done anything in the financial sector, you know well damned enough to stay the hell away from anything to do with cryptocurrency.

You will be held to account for whatever breaks, and any effort you put into correcting non-compliance or defects will ultimately be gaslit by the people responsible for scheduling the actial fix to be done. Odds are they are banking on that defect being there. Been there, left that job.
It’s not necessarily a lie unless they were more specific than the answer in the linked thread.

“We did pen testing at launch” could include some in house and very rudimentary validation of the correctness of any code related to security.
Unfair contract terms: https://europa.eu/youreurope/citizens/consumers/unfair-treat... IANAL, but in my view Unity violated points 3, 10, 11, 12, 14.
I think this is a form of boilerplate for acknowledging that no lawyer will want to give you legal advice without a more detailed phone call, and the acknowledgement that a non-lawyer can’t really offer legal advice.

The way I handle this is to ask “how strongly would you be encouraging me to get a lawyer right now?”
Exactly - mental, physical, and emotional work. IMO real pacing is extremely difficult, requiring a real transformation in life approach over the course of 3-5 years. And without certainty that making the sacrifices will pay off, most people take only half-measures, get poor results, and conclude it doesn’t work.
Ditto, not sure why everyone hates on plex so much. Sure they do some dumb stuff- but overall media handling capability has improved. I am still pissed about camera upload and podcast support. But not enough for all the reddit user rage I see.
So in about 7-8 years, Solar could theoretically have enough capacity to meet the needs of the world?! That's staggering, and incredible news if true!
I don’t agree with the article and its definitions, it seems poorly sourced and to be advocating for English towns as the apex of civilization. That said, the photos provided and the descriptions focus more on the style of the buildings than urban form: “monotonous straight lines of modernist architecture” vs “historical architecture such as ‘Church’, ‘Castle’, ‘Tower’ and ‘Cottage’ made places look more attractive and get better ratings for their beauty.”

Typical Tokyo streetscape is heavy on modern blocky buildings, like this: https://sanpoo.jp/upload/yutenji-sanpo/yutenji_106.jpg
This outage has been going on for 8 hours at this point, and we can’t actually fail over to a different region. I’m shocked at this from a company who has a product like SQL Server where you pay a premium for reliability.
It least your Slack channels didn't include employees pasting in porn GIFs to comment on the clients who were currently in meetings with the commenter.

I quit that job the second week.
Unfair contract terms apply: https://europa.eu/youreurope/citizens/consumers/unfair-treat...
I rented a Tesla for a month. It was a steep learning curve
Show HN: Gifter, an app I made to simplify gifting
So while working as a freelancer (self-employed) I wanted to create an app. The key incentive that drove me to create this app was that whenever it's time to gift stuff in my family we either buy funny but not useful stuff, things that you like (but maybe not the person you're gifting it to), or we just ask the other person what they want.

So my app does the following: allows you to add wishes, organize them with occasions (Christmas, Birthday, etc.) and share them with your family and friends.

It's completely free and monetized with ads and currently only available on Google Play. Now I'm wondering is this something that people would actually use like I do?

I found other apps on Google Play, but none of them really hit the core of the issue, or were just buggy and not really working.

What are your thoughts on it? If the app is useful what's the best way to reach out to people that would use it?
Well, I think that's ostensible, as any reading of the author's biography can attest.
> What will it take to get my kid into Harvard or Yale?
His answer: $750,000.
That’s Rim’s going rate for advice on landing a coveted spot in the Ivy League for students who want to start college prep in the 7th grade. The price is more than twice what it can cost to actually attend one of those eight elite schools.

> Before the pandemic, Rim worked out of offices in the Beaux-Arts Bergdorf Goodman Building in Midtown Manhattan, not far from the Plaza Hotel. Today, he likes to court parent-clients at the sumptuous Aman Club (a members-only club, where the initiation fee runs $200,000). If that won’t do, Rim will discreetly drop by a client’s home — whether it’s a condo at 15 Central Park West or on Miami’s Fisher Island — for a modest $10,000 deposit.
This. And yes, I've walked that walk.
Calligraphy is a form of art, it’s not a “pretty smudges on dead trees” - what an awful way to put it really. Knowing any kind of art makes you think differently, probably “better” in a way. Not everything should be reduced to the functional level.
It's funny how racists assume everyone else is like them. Dude doesn't even feel the need to point out what he doesn't like. He thinks hand waving is all it takes.
I was just thinking about something like this problem.
At $work, we use multi-signature signing to move cryptocurrency around, so that at least N of M officers of the company need to sign, to prove that "the company" actually intends a movement of funds to happen. This ensures that no single officer can embezzle funds; and it also ensures that an attacker would have to do some kind of multi-target simultaneous coordinated rubber-hose attack (rather than just waiting to kidnap one of us when we go on vacation) to get access to the funds.

I was trying to think of a way to extend that kind of security to the encryption of data — specifically the encryption of low-level root-account passwords (like an AWS account's root password). Shamir's Secret Sharing is the obvious first step... but you'd also then want two additional properties:

1. the decrypted secret should not be held even temporarily by any of the parties, but rather should be held by — and used "through" — a neutral system, so that the secret is reusable rather than needing to be burned the first time it's revealed

2. the neutral system — despite being likely owned by a third party! — should have no ability to exfiltrate the password into the hands of the third party.

I think this can be workable in the specific case of wanting to use the root password as an HMAC, by doing SSS decryption inside a single-shot non-durable abstract machine with homomorphically-encrypted memory, wrapped in a network daemon: the network daemon spins up a copy of the abstract machine; receives each SSS key split from its owner, feeding each as it receives it directly into the abstract machine; the abstract machine, after receiving sufficient key splits, signals to the daemon that it is now "empowered" to sign; and the daemon can then use the abstract machine to HMAC arbitrary plaintexts sent to it, until it exits, and the abstract machine's state is lost.

The real trick, though, would be making this work for HTTP Basic Auth over TLS, by delegating the generation of exactly one TLS frame — the one containing the Authorization header — to the abstract machine; where the network daemon would then act as an HTTP proxy, inserting this Authentication header into requests made through it. Having something like this could really improve security around the use of a lot of sensitive control-plane APIs!

---

Of course, in a corporate context, you probably have a third party you can trust with the plaintext — e.g. an Enterprise Password Manager service — so you can relax property 2. In such a case, you don't need a fancy abstract machine; you can just ask said service to build a feature allowing secrets to be configured to require N-of-M confirmations by ACLed team-members to unlock them; and to build another feature for "opaque secrets" that are never revealed to anyone, but instead are injected into an HTTP Authorization Proxy that the Enterprise Password Manager service spin up themselves on their backend.

But it's still fun to think about the case where your secret is so secret that you need to hide the plaintext from literally everyone but your co-conspiriators,
Why would you target a high wealth individual who has the resources to hunt you down?
I think more than that, they wouldn't want to embarrass their whales by having data leak on them like the amount that they lose every year.
> Interesting to me how quickly casinos ponied up ransom money compared to refusal by hospitals etc.

"easy come, easy go"
Always nice to get an upgrade.
The complaint isn't on the tool. It's on OpenAI censoring and "aligning" the model to have politically correct views, which in turn lowers the "IQ" of the tool.

GPT has become demonstrably worse at answering questions and providing examples.
Since your comment references sueing, I’m going to assume you’re in the US, where almost all employment is “at will”. They can dismiss you for any reason as long at it’s not a protected one. Telling the truth and being a jerk is not a protected status, so you won’t be getting anywhere with that lawsuit.
What happened? Were you fired?
We do know that if we trust the poster, they said very clearly it could have been done but they didn't consider the value to outweigh the downsides.
Remember that the goal of most security/procurement questionnaires isn’t _security_ … it’s _conpliance_

Compliance is not security.

For buyers, they often just need to check a box so that they can maintain their own compliance obligations. They probably don’t care all that much about your security if you can check all the boxes.

Pen tests are a joke. You can get perfectly acceptable pen tests (from compliance perspective) done for $2k in less than a week and the testers will try to find a couple things but their goal isn’t to evaluate your app’s security. Their goal is to make you happy with the report you’re paying for (and you won’t be happy if it has a list of 100 security bugs)

Note: I don’t like that this is how compliance works. I wish compliance were more closely tied to security. But that’s simply not reality.
It is mostly a communication issue.

Seattle took relatively minor steps that have had a huge impact on building more housing:

- eliminate parking requirements. Developers are still allowed to build as much parking as they want, but they are no longer required to. The impact on existing residents can be blunted by making the street parking timed and zoned unless you have an exemption permit, which is granted to all existing residents and doesn’t expire, but decreased over time to new ones.

- mandate separating parking from rent. Renters only pay for parking if they use it. In practice, people will debate if having a car is worth it every time they change a lease.

- employers over 100 employees are required to have commute management plans, and are incentivized/required to achieve lower single-person car commutes. Notably, how they do it doesn’t really matter, but it can help mitigate a large portion of car dependency which is the suburbanization of jobs into areas only accessible by car.

The last one I actually think is the most important, and it’s also the easiest because it doesn’t impact residents and if anything mitigates the most common complaints about new jobs.
This suffers from the same low-vector movement requirements as EbSynth.
Do Not Track header was used by the ads industry to track people.
Thanks what a great idea! Using Yandex for to see the things that are hidden by goooooogle!
I really hate when these sorts of topics come up on HN because even though we fancy ourselves a group of evidence-driven, logical people we have a real blind spot for history. We in the west have spent the better part of the last 500 years finding deeply creative ways to keep the rest of the world under our rule. The world today is essentially the one we created.

And then a tragedy like this dam failure happens and we ask ourselves "How can the Libyans be so careless?" Indeed it must be their fault because they are less intelligent or more irresponsible or lazier than us. It's not because we have systematically made them poor and undermined any attempt of theirs to have some self determination. After all they've been free to do what they wanted since 2011! Before that even but they chose tyranny because they're stupid, not because the DGSE and CIA were in there creating dissident movements loyal to us.
So was the Solvay Conference. Everything important starts in small groups.
Time to start planning your exit.

The larger problem:

The boss doesn't have technical expertise and will not defer to the judgment of the person who does, lacks ethics and is not going to stop their crap. It will only stop if someone else stops them, probably via tossing them in jail at some point.
I should have stayed in the trenches in the 2000s and waited until Satoshi releases Bitcoin which makes all of this possible. But I didn’t.

A lot of what was happening back then compared to today is just such a stark difference. The kind of attack vectors I was chasing myself are now so obsolete that most of these gangs will just give you that info for free… I mean holy shit… you can just load up Tor and go download terabytes of information in any industry imaginable. Free of charge. No need to spend endless weeks or months planning out the perfect attack (although that process is rewarding in its own way) …

This year has been huge for ransomware attacks, how long until one of the major FAANG companies get toppled over?
> lots of evidence of deliberate data destruction

But evidence of deliberate data destruction is evidence. It might be an open question of what it is evidence of -- for example, maybe someone is just clearing out old records. But if someone is trying to destroy -- oh, I dunno, just spitballing here -- surveillance footage of someone moving boxes of classified materials after a subpoena has been issued for those materials, it's hard to explain that as anything other than a cover-up.
I've broken my habit of retreating from customers. After all, if you don't know their pain, how are you to be an effective yardstick of Quality? If people try to keep you away from the customers/users, you beeline to the customers
Marblepunk – Fictional Programming Language
> "we did pen testing when we launched, but haven't done it since".

Well… was it before you joined the company?

You tell them in that case that was before your time and you quote your boss.

I’m not sure why you replied no to begin with, if you didn’t know. You should have asked your boss about it first and take his word.

During the zoom call, you can simply reply that your boss told you so and ask him to produce the old report if it’s still in his possession.

Anyways I think these tests (iso 27001) should be held regularly to mean anything.
Being compliant in 2021 doesn’t hold the same “level of guarantee” in 2023.

And that last part is up to your client’s policy.

Do they need a recent third party audit or whatever… you should ask them questions and check with your boss if it’s worth the spending.
But I think the author's paper trail will show #3 is not the case. He doesn't appear to want to deceive the client OR his boss. He's being pressured.
The inflation crisis is fraying Europe’s climate consensus
> he said "we didn't do any pen testing" and when asked he said the opposite

I conjecture they _did_ do something that could reasonably be called pen testing and didn’t realize it.

GP even gives some examples: testing authentication code, checking security group configurations, and testing API calls all counts as rudimentary pen testing.
Probably Ernő Goldfinger is the most obvious person to blame, along with the smithsons, Basil Spence and Leslie Martin.

People think of brutalism as some weird 'means to an end' from the communist countries, but brutalism was an explict choice in the UK that the soviets copied.
Your advice is to lie by omission after lying by commission?

That’s blatantly unethical, if not illegal.
> At that point, I was confident in my personal ethical position.

Eh, what? OP knew what sales was going to do with that email. Having sales wordsmith an answer is fine, but if you think it's factually inaccurate, don't send it back to them filled out in the form.
The second point, yeah that's relevant.

On the first point, just give each person n-1 shards, each missing a different one. Then any 2 can decrypt. Or configure it for however many participants there are and they minimum number needed to encrypt.
Sounds like a "winning move" did not exist from the start for this poor fellow. Either your director fires you for speaking the truth or you possibly become accomplice in fraud. All you can do is cut your losses. If they go into that zoom meeting I hope they won't toe the company line. Getting fired, or losing the customer seems like the least worst option.

It's actually not clear to me if the director is also their boss. It's written as if they are but not spelled out anywhere I can see.
Experience and cynicism are closely related.
It’s neither snobbery nor silly. Do you slavishly adhere to the etymological definitions of all the terms that you use?

If so, the OP is still not an engineer unless he’s writing software for weapons.

In the end, anyone lying to their client about the standards their software adheres to is not undertaking engineering.
"Safety razor" sounds like the right analogy to me.
Magit stopped using the git-wip script ten years ago.
Telling the truth isn’t misleading.

If you’ve read questionnaires from Jira, AWS, etc, you’ll notice their answers rarely answer the questions directly.

Google Jira’s public CAIQ for an example.
greed and pursuit of increased profits is a good reason
Here’s what I don’t get, how do both of these groups exist?

1. Academic superstars with charity work, awards from science competitions, perfect SAT and 4.0/5.0 GPA/QPA but are rejected from every Ivy

2. People who got more than a couple B or lower grades in school, participated lightly in a scouts org or similar but get accepted to one or more Ivy.

All my friends at the ‘elite’ university I transferred to fit into the second group, so it always seemed bewildering at how hard you could try and still not get in.