skysight-inc/HackerNews huggingface dataset:
Servers cost, but server cost in absolute terms hit few people before you're big enough that the cost of capital to address it is far lower. And almost any money you invest in trying to minimise server costs at an early stage will end up going out the window because the features you end up needing at scale and that end up costing money to scale will tend to look entirely different from what you started with.

So even if you need to switch languages down the line, I'd argue you should pick your initial tools based on what lets you iterate fastest early on, not based on what will keep your server costs down the line. Assuming of course what you pick is fast enough for whatever you want to do.

Put in more concrete terms, based on the actual VC deals I've been on one or the other side of the table for, the cost of capital drops to anything from 1/2 to 1/10 per early round if you're doing well. If you do well enough that your server cost is becoming a problem, by the time you need to address it paying to address it ought to not be a problem unless your decisions were truly pathological.

Most companies don't survive long enough for this to become a problem.

In other words, while performance matters, the value of performance now to an early stage startup is often really low compared to speed of delivery that might improve your odds of actually surviving to a point where performance becomes a problem, and you might easily be willing to trade 2x, 5x, even 10x the total dev cost in cash to deliver faster if you can defer a significant portion of that cost a few years down the line assuming you survive that long and your cost of capital in terms of proportion of equity is a tiny proportion of what it is at the start.

This is not an argument for Rails, btw. This is an argument for whichever tool is fastest for YOU and YOUR team to deliver with. If you have multiple alternatives you're equally productive with and one of them is more performant than others, of course pick that one.
This read, for some reason, reminded me of Farnam Street's “Why Life Can’t Be Simpler”[0].

[0] https://fs.blog/why-life-cant-be-simpler/
I have a bad feeling most of the oldies songs will end up as covers to appeal to TV audiences.
I acidentally mashed the flag button, sorry! I immediately unflagged, but its still marked.

I dunno what this is, but there are tons of older cars with a very similar body.
> ilegal stream let criminals in

Suggesting the stream operators will hack your bank account. Reminds me ot the "pirate media will ruin your VCR/CDDVD Player fake propaganda. Ironically... the virus came from a big reputable corporation https://en.wikipedia.org/wiki/Sony_BMG_copy_protection_rootk....

A lot of industries would be in for some criticism and bad PR after that. But not these guys. They don't give a shit about reputation.
Great question, i'm in a scandinavian country that is what is so surprising to me.

I have family both here in the US and the UK, and everywhere seems to be the same. It's almost like there's been some secret doctrine implemented.

As an example the "relatively" moderate labour parties of both Denmark and the UK as come out as pretty extreme militaristic hardliner supporters of Israel doubting the effectiveness of ceasefires, using vulgar language about the Palestinians and refusing to acknowledge any crimes committed by "their side".

This is very surprising to me as i have family who fled the London bombings in WW2 and have always talked about the extreme importance of thinking clearly in conflicts, being merciful, never being going "hardliner" and most importantly being sceptical of military industrial complexes.
They want to have the cake and eat it too with same instruction set fitting "small" (few hundred kB of flash/RAM at most) and "big" (Linux kernel running devices and up) ones.

IMO it's futile effort that unnecesarily taxes the big codes.
Governments took advantage of the extreme fear created after the 9/11 attacks to pass these absurd laws.

I don't think we can call them "laws", because are clearly against the most fundamental values of any democracy.

No country is free anymore. Not even the US, which enjoys bolstering itself as "the free world".

Any freedom you enjoy in a democratic state nowadays is merely circumstantial and can disappear instantly at any moment.
The missing tapes are definitely one of the saddest engineering stories for me. Such an important moment in history and we just threw it away.
There is no need for that sexism here.
That the West supports Israel has very deep, historical reasons. And I agree, jews (as an ethnicity / people) deserve and need an own state. Especially after the holocaust. The implementation could have been handled so much better, because the Palestinians also deserve a home. And having Israel and Palestinians sharing a home nation is no futher away than it was in decades. No easy solutions.
London has some of the highest dev salaries in Europe. But, you'd be lucky to get close to a US SWE salary here. Not that those jobs don't exist (I have one), but definitely the US SWE salary experience is not representative of the UK.
>That video and Casey Muratori's "The Thirty Million Line Problem" video

https://www.youtube.com/watch?v=kZRE7HIO3vk
Wouldn't it be interesting if the consumer could remotely disable the phone they gave Samsung, if the phone Samsung gave them in return was not up to spec? Shows you who holds the power. As if their legions of lawyers and coffers of gold weren't enough, they use technology on "your" devices to further their reach.
This analogy fails because it would require Poland to also close their border.

Gaza is essentially half controlled by Egypt.
An incomplete tour of financial blowups, blind spots, and bamboozlement.
Isn't ruby strong and dynamic?
It is an epidemic in professional women's soccer. At any given time a third of the top players in the world are sidelined with an ACL.
Unlike the hidden USB sticker, this is a power supply that is sending high current through its wires/connectors... please be careful for your own sake

Edit: fixed a technical issue about current & voltage
Same here, but sertraline.
>but your formulation suggests that some faceless people at the British Establishment Country Club put down their whiskeys, ordained that mr Murray be bullied and so it went.

Whole departments are set up to work on internal "enemies of the state". Pressure from foreign governments (cough) also points to their undesirables.
People above a certain station can trivially tell what is the establishment political winds, short and long term, and which are the "annoying" people that go against them. They also know that furthering the cause against them looks good to their superiors. They can and do build organizational "vendettas" and keep tabs, harass, prosecute them, for years, or even decades.

This goes all the way. Judges and prosecutors making decisions on such cases know who can help their career and what can hurt it, and so on. No explicit coordination needed, though there's a lot of that too - e.g. some established enterpreneur calling their favorite politician and asking them to "do something about that person", special interest groups created ad hoc, and so on. Check a comment by someone called Scott in TFA.

>That’s the stuff of movies and dictatorships, right?

Oh, sweet summer child.
Product Description Generator: Generate SEO-compliant product descriptions
Great job! Suggestion: make the Pac-Man have a fill color, yellow by default in color mode.
It's comical to say that Rails heyday is over when Remix hasn't even had a heyday.

The half life of these backend frameworks is pretty short. Rails has built a lot of billion dollar businesses. Wake me up when Remix does that.
Show HN: DataDrift – Share metric update to you data consumers
I've released this yesterday but there was some bugs and unclear data.
Here is an example of a metric update and its impact.

The goal behind this is to build trust on metric by explaining why it has changed, and that its under control by the data team.
Using github stars and some kind of proxy for popularity/usage, Beego looks to be number 2. Seems like it could be production worthy and probably is being used somewhere.
>You have to imagine very hard to consider gaza to have been annexed

Israel didn't annex Gaza, it (via the UK) annexed Palestine upon its creation, with Gaza and the West Bank being the land that remains un-annexed.
King James Programming (2016)
Well I guess if Hamas doesn't care, that justifies war crimes from Israel.
I have 4 tickets in this 2 week sprint. I lose a couple of productive days for scrum ceremonies and meetings. The last 2 or 3 days must be spent scrambling for code reviews and QA sign off. With the time that’s left I can make the software as good as I want.
I grew up in Miami and met a great many nice people who came to the US on a boat from Cuba. But the process of coming on a boat does not in any way select for nice people.

The H1b program does have some method of selecting for qualification (i.e., you must have a bachelor's degree) but no method of selecting for the "best and brightest." The fact that some of the best and brightest may come in that way is true but irrelevant if the process itself doesn't select for it at all.
Why not actually run a mainframe and do a bit cobol programming.

https://news.ycombinator.com/item?id=37976082
This debate has been going in circle over and over. It's the same arguments than 10 years ago, and the answers are the same.

No it's not saying bad performance doesn't matter.

Yes Go can make application more responsible.

But you have to balance out a lot of compromises in a project, and Pareto tend to favor those languages in the majority of situations because of cost, skills, resources and constraints.

etc.
...and that's why we can't have nice things :(

No, seriously, there's a saying that if construction engineers built buildings the way software engineers do, thousands of people would die each day because of buildings collapsing without any reason. Even if you build on the ruins of an old city, you still have to dig a hole that's deep enough (securing archaeological remains if necessary), create a stable surface with concrete piles or similar, and then you build a new building. You don't just stack miscellaneous boxes one on top of each other like in this XKCD (https://xkcd.com/2347/) and hope that they don't fall down...
NASA are still Americans. I'm not arguing about metric or imperial being better.
Pretty much feudalism: the current middle class would have to rent housing and agricultural land, owned by corporations, where the heirs of the current upper class hold high-paying but undemanding positions.
Tracking Unauthorized Access to Okta's Support System
Any single Nx buyout results in N additional startups being funded. This is how VC culture operates and grows. It’s one of the main ingredients that build Silicon Valley’s success. Other countries are desperate to copy this model.
A bit off-topic but watching the linked video and the videos inside it, it's worth noting how in 2019 Elon Musk was still considered some kind of good reference in the tech and engineering world. This has changed dramatically in the last 4 years. And by the way, we are not going back to the moon in the next 12 months, unfortunately.
Also couple calculations would be good
Except (as I hear it) that's not even true in the US. Apparently, it's not enough to stay silent - you actually have to say that you are exercising the right to be silent, otherwise they are allowed to infer guilt from silence.

In a very similar way, if I were ever detained in this manner in the UK, I'd be very likely to say "I am not refusing right now to answer your questions. However, since I cannot trust you to tell me the truth about my rights and responsibilities, and because of the power imbalance, I will wait until I have independent legal advice before participating any further in this interview".
Yes it is, especially at scale. This is most obvious in the cloud where zero interest rate era companies blow ludicrous amounts of money running comically inefficient code. The cloud bills at some of these companies are hilarious.

Even on the desktop hardware is a constraint if you are trying to do anything that pushes the boundaries of the medium, which is why endpoint-first AI is only possible thanks to hyper-optimized code like llama.cpp.
RISC-V has a lot of potential to eat ARM's lunch and adoption by companies like Qualcomm signal a future industry shift to it. The problem for SiFive is none of that requires them to be around to see it happen. The success of the startup and ISA are not inextricably linked. They did a lot of important work early on to cheerlead for RISC-V and to build much needed support and infrastructure for it. But this feels to me like the end of the beginning for RISC-V and a transition to a stage where the industry will drive it from here.

The other day Qualcomm announced a RSIC-V based Android wearable SoC. Expect to see full smartphone SoCs in shipping devices in a few years. ARM's attempts to extract more value after going public and lawsuit with Qualcomm is souring their relationships and driving customers to RISC-V.
> it seems you have to go with a JS framework for view layer and write APIs in Go

Yes. Unless you are builing a static site.
Generally politics, specifically state mandated school curriculum.

Right after we moved out, Oregon passed laws decriminalizing hard drugs and removed graduation requirements (and they are considering continuing waiving graduation requirements I hear). The Oregon teacher's association (and gov in general) got a sweet retirement deal in the 90's, that they "realized" that deal is draining the state of money it needs. The teachers association is trying to teach fewer hours each day (for the kids) and have more half days (once a week) for teacher prep (for the kids). One of my kids was directly saying teachers would talk up direct action activism the the like in class. Then the new curriculum came out that had sex ed starting in Kindergarten and had massive ideological components to them. This was in 2020 and it has continued unabated from there. These were state level activities; districts can't meaningfully push back; teachers could be fired for not adhering to them. I have family who are teachers so I don't speak from ignorance here.

Texas ISDs (independent school districts) also get funding from the state, but they get much more funding locally. Practically speaking, Texas ISDs vary much more. So do your research. Then support what is good and seek to improve to make it even better.
Not targeted, but a random attack and data leak is very likely. Much more likely than if they used the service. That's why 99.999% of people should stick with the services.
I feel like it will converge to just having RV + FPGA chips rather than people wasting precious FPGA space on softcores. Zynq's are plenty popular already
What is an "average person?"

There is probably a half way decent chance that the vast majority of participants here, in singular, that would be economically gold mines for compromise.
Would need a world government to enforce, else China would dominate with huge firms.
Civilian infrastructure and housing are decidedly no legitimate milotary targets. Never have been, and this makes air power such a bad choice when fighting insurgencies, it is to indiscriminate.
More discussion over here: https://news.ycombinator.com/item?id=37985630
Elephants have very sensitive ears. The buzzing of a hive is what drives them away.
Nice tool for experimenting with a couple of hypothetical cases, like what if I save a bit more or spend a bit less. It was quite surprising how much delaying retirement by one extra year makes to the outcome!

I noticed that it doesn't seem to take into account the state pension, which could be a considerable chunk for some people. You can kind of simulate this by reducing your spendings, but the state pension age might be later than your retirement age, so this isn't a perfect work around.

Also the link seems to use standard query parameters, which makes sense, but as it's all running in Javascript, it'd maybe be nice to get the parameters after # instead so that they aren't sent to your server when re-loading from a link. Coupled with an IP address, there's a chance you might be accidentally logging PII information otherwise.
When Is Damascus Steel Not from Damascus?
Most of the time when someone says 'we don't know' they really are talking about themselves.

People do know. There has been 100 years of cryptography and there are billions at stake. Hand waving and saying 'anything can happen in the future' with no plan, no details, no facts and no evidence is basically tech astrology.

Here's a challenge - find a cryptography expert that agrees with you.
I suppose in that sense hanging out with a rich friend would mean you're very unlikely to be kidnapped.

While probably true most of the time. It does give you a false sense of security, which makes you a very easy and potentially profitable catch. If you fail to update and a scripted bot catches you, the actor notified will certainly see what's in there.

And if anything you're more likely never to find out. Which means they can just come after a few months later. Maybe they stole your first CC and then your second CC. I think there is possibilities there that make sense.
abbyy finereader 8.0(!!!)

good luck finding it
> it's worth noting how in 2019 Elon Musk was still considered some kind of good reference in the tech and engineering world

Is that so? Elon has always been promising much, but rarely delivering.
Yep. The Steam Deck is great and it's all about usecase. Like I said it's a different category of device. Myself, I was unaware there were other options out there and figured folks might be interested in things like the G Cloud and the Odin. Cloud-based gaming has gotten pretty nice.
> If women really wanted better pockets, they would magically become widely available at reasonable prices!

This is not accurate. There are multiple variables in play. Price, functionality, desirability (to others), etc.

The claim is that across all those variables, what major retailers sell for the lowest prices available is what the broader population of women are able and willing to pay for. Note that the lowest prices require economies of scale, which means the type of clothing that a broad population will accept, even with features they do not like.

It is publicly known that selling clothes is a very low profit margin business, so it stands to reason that unless you know what you are doing, you are not going to survive.

The thing with clothes is that many are not able or willing to pay for the customizations they seek. Because clothes are “easy” to make, the only question is how much are you willing to pay.

I hope that the above website and other discussions around this issue spur clothes makers to make clothes with bigger and more pockets for women at lower prices. Perhaps times are changing and bigger/more pockets is a more profitable market that has not yet been tapped.
Maybe that's true, but the examples you picked are pretty bad.

* Isaac Newton lost his dad before he was born and his parents gave him up to live with relatives. He had a very rough childhood.

* Andre Carnegie's family went broke when he was a child, they had no money and had to restart their lives moving to the United States with basically nothing.

* Steve Jobs was adopted, though maybe not exactly poverty it still doesn't sound like a great way to grow up.

That's about 3/7 having rough childhoods and 4/7 having good or average.
Typical senior software engineer salaries in the UK are around £60-90k outside of London (and you see adverts for as low as £45k!), a bit more in London / Fintech, up to around £120k.

For a regular SWE, $200k (~£160k) is ludicrous for the UK market, but please feel free to offer me a job for that or point me toward the job postings that offer that.

Going contract may be better, but keep in mind you spend time between jobs and chasing leads, and you're unlikely to get a stable years-long contract, especially post IR35 when HMRC will determine you to be a hidden employee (and rightfully so).
From the picture it seems it covers only a small part of the colorspace, mostly low saturation.
"You know how many bosses I have, Bob?

"How many?"

"Eight. I have eight bosses, Bob!"
She'll be back.
If not all, much of it can be done within VSCode's preview pane on Markdown files with right extensions (and probably out of the box as well) so not sure what's the value here or maybe I am not the right target audience for this.

What could be interesting is a full featured Open API workbench from JetBrains that has full autocomplete, lets you split files with JSON pointers, allows visually adding documentation, examples, schema and such and not only that, generates a mock server based on API specs all the time from examples and if not from examples then using something like faker or LLM so your API is always GET /api/myendpoint ready, there's no need to "click that button, start a server" thing. It is always on the given endpoint.

Swagger Editor and friends are not quite there. Commercial web based offerings are also... not that easy to use.

Would love some suggestions if something exists already.
[Citation needed]

I bought a phone without a 3.5mm jack once because I didn't think to check. I may have to buy one again when my Pixel dies due to lack of options.

Clearly I don't care about 3.5mm jacks /s
your last sentence I think puts the 2nd pillar into the problem, which is not only technological (i.e. the abstraction problem mentioned in the original article) but also cultural
Ask HN: Should I build a REST API security scanner?
Hi friends, I think this is the time I need your advice and would greatly appreciate your thoughts and hints.

The problem.

I have spent the last 20 years building enterprise software in different sectors, also taking part in presales and technical due dilligence activities during M&A processes both on the buyer and the seller side.

Observing the landscape of application security tools and practices across multiple companies I have noticed a recurring pattern.

The application security sector appears primarily focused on two objectives:
a) Independent researchers and boutique firms working hard to uncover new vulnerabilities and provide best practices.
b) Large corporations producing web security tools that, to me, seem somewhat outdated. These tools often approach web applications as if they're server-side rendering apps or front-end applications tightly coupled with their back-end being developed by the same team. Basically, these tools identify potential user actions in your web application and attempt to target the corresponding endpoints with malicious content.

This would be fine, however modern applications are typically written with a single back-end serving multiple front-ends (think: web, mobile, thirt-party integrations) and there are even REST API applications out there with no front-end at all.

To my understanding, most popular web security tools struggle to detect endpoints not explicitly utilized by the web front-end. This includes service endpoints intended to remain private. Ensuring the security of such endpoints often requires, for example, submitting a Swagger definition upfront (that can be outdated itself).

There are tools which try to do something similar like kiterunner (last updated two years ago) but these are not packaged and complete solutions.

The hypothesis.

Is it possible there are no modern REST API security scanners which could validate e.g. mobile apps REST API back-ends without providing a Swagger file or intercepting the network traffic?

How do you reliably test the security of your REST API apps?

Is there a market for such security tool dedicated to REST API testing, e.g. targeting mobile app developers?

My ask

I would be super thankful for your input on how do you approach this subject, whether I am blind or is there really a gap that you see as well and would like to be filled.