skysight-inc/HackerNews huggingface dataset:
> There won’t be any surprises in the review.

There can always be surprises. Sometimes when you see something implemented you can get a « click » as to why another solution would be better. It happens to me regularly both on the receiving and giving end of this and it’s rarely a big deal. Most of the time it happened to me, I could reuse the functional tests I had written and parts of the code anyway.

Reworking on something so that it’s better is never a waste of time, and it’s always better to do it before it reaches Prod.
Related - others?

The ancient Roman secret to concrete resilience in seawater (2017) - https://news.ycombinator.com/item?id=36585331 - July 2023 (76 comments)

Making Concrete That Lasts 1k Years - https://news.ycombinator.com/item?id=34644295 - Feb 2023 (3 comments)

The Mystery Finally Solved: Why Has Roman Concrete Been So Durable? - https://news.ycombinator.com/item?id=34456323 - Jan 2023 (1 comment)

Mystery of Roman Concrete Unraveled - https://news.ycombinator.com/item?id=34353330 - Jan 2023 (1 comment)

The New Science of Strong Materials (1968) - https://news.ycombinator.com/item?id=34287101 - Jan 2023 (11 comments)

Why was Roman concrete so durable? - https://news.ycombinator.com/item?id=34280239 - Jan 2023 (270 comments)

Why Ancient Roman Concrete Outlasts Our Own (2017) - https://news.ycombinator.com/item?id=29366911 - Nov 2021 (67 comments)

2,050-year-old Roman tomb offers insights on ancient concrete resilience - https://news.ycombinator.com/item?id=28833525 - Oct 2021 (101 comments)

The problem with reinforced concrete (2016) - https://news.ycombinator.com/item?id=27282927 - May 2021 (186 comments)

Why Roman concrete is stronger than it ever was, while modern concrete decays - https://news.ycombinator.com/item?id=25690803 - Jan 2021 (7 comments)

A chemical reaction in ancient Roman concrete makes it stronger over time (2017) - https://news.ycombinator.com/item?id=22580920 - March 2020 (64 comments)

How Ancient Rome’s Concrete Has Survived 2,000 Years (2017) - https://news.ycombinator.com/item?id=20482050 - July 2019 (81 comments)

How Did the Romans Make Concrete That Lasts Longer Than Modern Concrete? - https://news.ycombinator.com/item?id=15544128 - Oct 2017 (3 comments)

The Rock Solid History of Concrete - https://news.ycombinator.com/item?id=15480165 - Oct 2017 (12 comments)

New studies of ancient concrete could teach us to do as the Romans did - https://news.ycombinator.com/item?id=14690329 - July 2017 (72 comments)

The problem with reinforced concrete - https://news.ycombinator.com/item?id=11975695 - June 2016 (147 comments)

Ancient Roman Concrete Is About to Revolutionize Modern Architecture - https://news.ycombinator.com/item?id=5883443 - June 2013 (23 comments)

How the pantheon has lasted 2000 years without steel in its concrete - https://news.ycombinator.com/item?id=1852000 - Oct 2010 (35 comments)
I had to click through to find out they're talking about VC's rather than Version Control Systems.

(Was there ever a VCS just called "vcs"?)
> Is it expensive or require their resources?

You have a major knowledge gap here. Other than for literal lab start up funds for brand-new professors universities typically don't grant much money, if any at all, to their professors for research. The professors are expected to seek outside funds, of which a good chunk then goes to the university for the university's costs.

This may not be the same at Harvard, I genuinely don't know. But it's typical at most research universities.
It makes sense. 'DROP TABLE users; is obviously not a real company name.

Maybe it'd be better to deliberately include some Bobby Tables entries in every data set to make sure users think about these problems early-on, but it's probably too late for that.
Django; none of the new-hotness one compares. This is my no-bullshit answer that comparative articles and these frameworks' home pages dodge.
The ability to send SMSes or authenticate from your phone are both things you know.
Because if you try to depend on the US's nuclear umbrella you end up like Ukraine.
People using passkeys are the outlier too.
"More profitable" would include the cost of getting the zoning changed.
J was actually invented by the Romans and was orthographically distinct and present. It wasn't invented in the 1500, like some many people claim.

https://www.youtube.com/watch?app=desktop&v=lfB9mX5UUNU
(Why you should write "J" when writing in Latin)
The successful network call condition is particularly frustrating. However, I enjoy the feature on the whole.
Seriously such a buggy and undesirable feature. Smart shuffle replaced the default shuffle for me on all interfaces that didn't get updated to switch between the two shuffles, so on Android Auto, the only shuffle option was smart shuffle and I had to use my phone to switch to dumb shuffle.

Then it isn't even really smart or a shuffle. It just inserts the same 3 songs, in every playlist regardless of how well it would fit.
Google (top site for internet traffic) is defaulting to Passkeys: https://blog.google/technology/safety-security/passkeys-defa... (Gmail has over 1.8 billion active users as of 2023; 22.22% of the world's population uses Google's mail service, so this is material for Passkey uptake)

Amazon: https://www.aboutamazon.com/news/retail/amazon-passwordless-...

Uber: https://help.uber.com/riders/article/using-passkeys-to-sign-...

Ebay: https://www.ebay.com/help/account/signing-account/signing-ac...

Github: https://github.blog/2023-09-21-passkeys-are-generally-availa...

Link by Stripe: https://app.link.com/

Docusign: https://www.docusign.com/blog/docusign-customers-can-upgrade...

Tiktok: https://newsroom.tiktok.com/en-us/passkeys-fido-alliance (TikTok has over 1.677 billion users globally, out of which 1.1 billion are its monthly active users)

Google's Titan key now supports Passkeys if you need a secure hardware authenticator: https://www.wired.com/story/google-titan-security-key-passke... | https://store.google.com/us/product/titan_security_key?hl=en...
Uber – Migrating 2 Million CPU Cores to Kubernetes [video]
So, by making their collection more diverse, they are going to be challenging to a broader swath of visitors, no?

People steeped in Classicism need to have their horizons expanded too, right?
The name of this is a reference to the incredibly useful godbolt compiler explorer. If you are interested in this you will likely enjoy the other as well:

https://godbolt.org/
Yeah I'm finding film maker mode way too dark on my Samsung oled.

I can't find any explanation of how it actually works. Does a each movie get different settings set up by the director?! Doubt it.
Related: https://fredblog.stlouisfed.org/2022/06/buying-eggs-with-bit...
So for those not familiar, 2^^4 is not ((2^2)^2)^2, it's 2^(2^(2^2)). So 2^5 is 2^65536. 2^6 is 2^(2^65536).
Location: Poland
Remote: Yes
Willing to relocate: Probably no
Technologies:
- Backend: .NET (C#/F#), Python
- Frontend: Angular, React, Vue
Résumé/CV: https://www.linkedin.com/in/bartosz-sendek-729416124/ (Send me DM I
am happy to reply with PDF)
Email: sendek.bartosz@gmail.com

I am fullstack engineer experienced in building solutions in startup environments as well as scaling systems at the corporate level. Passionate about learning new architectures, experimenting with cutting edge technologies, and open‑source projects. While focused on technical challenges, fully understands the importance of domain coming first and the realities of trade‑offs in business decisions. While having most experience in .NET I am looking into diversifying my stack into python and node.
Dammit, I wasn't paying attention when formatting. I'm regrettably gonna need to repost another time
My usual line for encouraging people frustrated by something: “frustration is what learning feels like.”
> I think functions growing as fast as Ackermann's don't come up naturally, except on a Googology forum.

Apparently I spoke too soon. One problem where Ackermann naturally comes up is the Vector Addition Systems [1] just discussed today.

[1] https://news.ycombinator.com/item?id=38519944
Why is @darig's reply dead? It looks reasonable and interesting to me (although they could have perhaps made it clearer that it ties into this topic because of developing a programming language that does what the title asks).
Thanks! I've changed to that from https://www.sensible.so/history-of-the-pdf-pdf above.
> So I built without code inspections.

Building code and its associated inspections aren't, primarily, for you. They're for the people around you and the people who come after you.

You might be the greatest builder on the planet. I, as the tenant or owner who lives in the structure after you, have no way of knowing that absent you following the process that says a separate entity confirmed that you built a safe structure.

I, as your neighbor two parcels down, have no way of knowing that you did or didn't build a building that is likely to burn down and take half of the area with it.

To head off what I'm sure is the inevitable reply along the lines of "I will live in this house until I die" and/or "there is no one around me for the next 100 miles", that's fine, but those are situations that can change. Code, and having the inspection, confirms that you did what society asked of you to keep the rest of us safe.

(Is the building code and its associated inspections fallible? Absolutely. But deliberately flaunting them because you just didn't have time is similarly not an excuse.)
Shakuntala Devi
Blackmail scammers have been using pwned password databases to craft some pretty convincing phishing emails ("I have installed RAT on your system and have been watching you through your webcam, proof I hacked you: <old password from pwned passwords> -- send $1800 of BTC to this address and don't go to the police. Maybe use a password manager next time."). Do people get caught in these scams?

I assume most get blocked by spam filters. I've only noticed them when they get past SPI/DKIM filtering and I have to train more. They seem pretty clever.

I appreciate the service and enjoy Troy Hunt's posts. HIBP is great.
> It would be awesome if they were using some sort of macro system / templating engine to consistently expand {{html_prog}} and {{html_markup}} just to keep it straight while they're writing it.

You could use the <template> tag.

<template id="my-macro-name">
<!-- some operations -->
</template>

To use it:

<source src="my-macro-name"/>

Using source to look familiar to bash users because why not.
>Google, FB and such are such money machines that they never have to cut.

Not sure what you are trying to achieve by saying something so blatantly untrue that a two-word query into any search engine can debunk it as fast as your browser loads a web page.
That person seems to just think that so long as the JIT is kinda fast, it's good enough. But that's really not the world we live in most of the time, especially if using that JIT broke binary compatibility with existing fast libraries.
JavaScript, the Markup Language
How to duck type? – the psychology of static typing in Ruby (2004)
> Supporting half a billion constant users around the world

I am sure curl does too, with one guy running it. Spotify is not a telephone company. The engineering work hardly scale with the amount of users. There should be a need for some extra sales staff, lawyers and translators per market.

Their engineer staff numbers are just silly.
Do they? This would seem to suggest otherwise. https://www.statista.com/statistics/1022122/spotify-operatin...
It's complicated. A lot of money exited from Spotify after its IPO. The rightsholders (Warner, UMG...) got an outsized return on that investment. Smooth it out since then and it looks like a more routine profit. I'm not sure if basic financials are an adequate format for a backcatalogue monetization business.
> ... and then realize with a horrible feeling that some % of those hits are getting through the login page.

The alternative is the exact same scenario, except that the percentage is several orders of magnitude lower, right?

The small subset of your users that explicitly opted-out of 2-factor authentication (if you allow that) and who try to choose "Password1!" with a second exclamation point when your site said "Error, your password has seen 83,000 times in password dumps, please use a unique password" will still get hacked.

Or is your expectation that no one will attack every user on your webapp with a credential stuffing attempt if they see that the probability of success is 0.001% instead of 1%?
Zach Gage's Puzzmo gets acquired as the newspaper games space heats up
Can you be more specific (maybe point to a website)? I am trying to imagine the scenarios where a web developer would work with academics and does the data processing for the representation? Of the few scenarios that I could think about where an academic works directly with a web developer they would almost always provide the full figures.
Ask HN: Looking for thought provoking essays like Paul Graham's – any favorites?
For profit situations cause for profit problems. This should probably be re-titled, "I'd rather kill myself than be a mass commercial emailer again". Hosting your own SMTP is not a problem. Sending out tens of thousands of emails... yeah, that'll be a problem.
Damn, I missplaced an answer. On OpenBSD, I see no "plus.html" since the 7.3 release. What happened?
Tidal was sold to Block. The sale itself was somewhat controversial and there was a lawsuit filed as a result, albeit unsuccessful. See:

https://www.reuters.com/legal/judge-dismisses-lawsuit-over-b...

I also think that alot of those Tidal jobs were probably eliminated in Block's own layoffs. See:

https://sfstandard.com/2023/11/08/block-square-cashapp-layof...
Ask HN: Cloud security auditing for indie-grade projects?
Hi all,

I'm an indie dev and standing up some cloud infrastructure for side projects.

I'm wondering what tools/services exist for performing security audits for indie-grade projects.

I have a personal budget of 'some hundreds of dollars' versus an enterprise budget of 'some thousands of dollars'.

Also, I'm not handling, e.g., PCI data, so I don't expect that I require a particularly extensive security audit.

(And, yes, I'm aware 'security' is an ongoing process + multi-layered system. What I'm trying to identify here is a good sanity check before exposing a seemingly hardened host to the open internet.)

Thoughts?
Love this - I can almost imagine the convincing for other companies wasn't even needed when they realized a small binary size and comparison to competitors would net them more business. A perfect little solution for triaging issues between services and comparing solutions.
> So he's using the same bit of friction that this article is trying to solve, to fill his rice bowl.

You spelled out exactly what the attention economy is about. Friction. The money is made on friction. Waste - of time, of cognitive effort, of emotions good and bad.

I feel sorry for this guy, but at the same time, I wish people recognized that attention economy isn't about some nebulous attention you have too much of and don't feel when it's being taken. On the contrary, attention is stolen through friction, and the sum of everyone who "fills their rice bowls" this way is why the web and so many processes and activities on-line feel like shit and remain painfully wasteful.
I really wish a similar tool for exploring binary lifting to different IRs. Like Ghidra p-code with sleigh, LLVM Machine IR, Qemu TCG etc
Comments by banned accounts are killed by default.

When you see a comment that's [dead] but shouldn't be, you can vouch for it. This is in the FAQ: https://news.ycombinator.com/newsfaq.html#cvouch.
"at least in Detroit, they're looking to try it."

Is Detroit a place with a really tight housing market? It wasn't that long ago that neighbors were offering potential purchasers of near by houses dinner every week for a year to encourage them to go ahead and buy it because they didn't want more empty houses on their block.
i am baffled this article used a usb stick instead of a file where it could have saved a lot of unnecessary i/o, but a good writeup. i had to implement ext4 support in something back in like 2017 and wish something like this existed
Now do paper vs an environment like Emacs and not a passive device.
Here in NY, where housing is more expensive than Boston, we are drowning in uninhabited "investment properties". With a proper vacancy tax we could instead be referring to them as "homes".
Though that's a chilling thought, I am more worried about someone trying to produce such a bioweapon, but just doing an amateur job and killing us all with their buggy alpha release.
I've used it a bunch already, very useful for signing into my Apple ID on non-personal devices
I guess I don't really think of HTML as "sequential" but I definitely do think of it as "composed." Meaning I don't often consider siblings elements, but I often do consider parent/child elements. Anchor tags that link to other parts of the doc are relatively rare compared to links to other docs. The only exception is stuff like schema definitions or reusable shapes in SVGs.

Either way, fun project!
Before I forget:

The collector in me loves compilations like this and I would like to take the opportunity to remind everyone links rot with time so please archive them!

https://web.archive.org/save

https://archive.ph
Buying Eggs with Bitcoins (2022)
Have you ever ridden a bus? You can't decentralize public transit.

Also, do you know the impact of tearing up old cement and putting new cement somewhere else?

People are cray, man... we have to make do with what we have 9 times out of 10 rather than tear it up and replace it. "Strong Towns" and the like are full of it.
Hmm, I've seen old HDDs fail to spin up or otherwise have catastrophic malfunction, but never heard of them having real bit rot.

I recently booted up some portable PCs from around 1990 to review their HDD content and scrub the disk state before handing them over as e-waste. Easily 25 years on the shelf. I would think you'd have to do something very wrong like storing the HDD near a degausser to lose the magnetic recording.

I do think that SSDs and particularly cheap flash "thumb drives" are capable of having bit rot when left on the shelf for many years.
Solar has become so cheap that the bottleneck is the interconnection queue - utilites are overwhelmed by the amount of modelling that they have to do to ensure the stability and capacity of the grid with the addition of more renewables. (There are a number of ways that they make this harder for themselves. These processes are very much not built for intermittency.)

Hydropower plants are already permitted and connected generators. They are allowed to produce energy for sale onto the grid. From the utility's perspective, adding solar to a hydropower plant is the same as if there was a year with extra rainfall - the maximum (and reserve) power limits will still be adhered to, but more total energy will come from that single source.

(Note that solar on the ground right next to the hydropower plant would have the same benefits without the additional costs of floating, but often hydropower plants are built in geographies that are more challenging for ground-mounted solar - they're either extremely hilly or built out.)
What is this post ranting about? Pushing your keys to big tech? There is no difference if you use Chrome’s password manager for passwords or passkeys.

You can save passkeys on your own network if you use Bitwarden or if you want, write your own solution.

For 99% of the internet users, passkeys are much better than passwords.
Yeah the query count monitoring is the main focus as N+1 queries are super common in Django.

I don't really have a pitch but here is why this was made:

1. we had a production DRF app with ~1000 endpoints but the react app consuming it was dead slow because the api's had slowed down massively.

2. we knew N+1 was a big problem but the codebase was large and we didn't even know where to start.

3. we enabled this middleware on production and added a small callback function to write endpoint=>query_count, endpoint=>query_time metrics to datadog.

4. once this was done it was quite trivial to find the hot endpoints sorted by num of queries and total time spent on queries.

5. pick the most hot endpoint with large number of queries, enable debug mode locally, fix N+1 code, add assertNumQueries assertions to integration tests to make sure this doesn't happen again and push to prod.

6. monitor production metrics dashboard just to double check.

7. rinse and repeat.

For me this ability to continuously run on prod -> find issues and send to your monitoring stack -> alert -> fix locally workflow is the main selling point. Or of course you can just have it running locally on debug mode and check your console before pushing your changes but sometimes its just hard to expect that from every single engineer at your company. Then again your local data might not cause an issue so production N+1 monitoring is always nice.
I've never heard of headaches from 24fps video , must be rare
My community voted we would rather risk we all die in a fire than be homeless. My county is poor and people do their own work.

I live here specifically to get away from people with your concerns.
Not to mention them killing playlist radio functionality, which was a great way to have a custom Pandora-like experience whose seed you could control.
Location:Turkey

Remote:Yes

Willing to relocate:Yes

Technologies:React.js, Vue.js, TypeScript, JavaScript, Next.js, Vuex, Redux Toolkit, Zustand, Webpack, Vite.js, Tailwind CSS, SCSS, CSS3, HTML5, Pinia

Résumé/CV:https://mustafadalga.github.io/cv - https://www.linkedin.com/in/mustafadalga/

Email:mustafadalgaa <at> gmail <dot> com
The owner system is kind of a necessary evil to enforce reviews from the domain experts. I've seen lots of junior engineers who just want to submit their code and move on and I appreciate their productivity, but there have been so many cases where a seemingly innocuous change eventually led to a million dollars incident and only those domain experts could've detected it. And I've still gotten lots of pagers exactly due to this reason even with this enforcement thanks to someone able to find a relatively lenient reviewer on the codebase with broad ownership.

> There was no way to update every call site of your library in an efficient way.

There are global approvers. It's not super easy to get their approval (you need to go through the large scale change process), but getting each owner's approval will be exempted if you can get the one.