skysight-inc/HackerNews huggingface dataset:
A large portion of my role at $DayJob is around improving supply chain security.

Some examples of how we do it:

- Devs can only use hardened (by us) Docker images hosted inside our infrastructure. Policies enforce this during CI and runtime on clusters.

- All Maven/PIP/NodeJS/etc. dependencies are pulled through via proxy and scanned before first use. All future CI jobs pull from this internal cache.

- Only a handful of CI runners have outbound connectivity to the public internet (via firewalls). These runners have specific tags for jobs needing connectivity. All other runners pull dependencies / push artefacts from within our network.

- The CI Runners with Internet connectivity have domains whitelisted at the firewall level, and so far very few requests have been made to add new domains.

- External assets, e.g an OpenJDK artefact, have their checksums validated during the build stage of our base images. This checksum is included in Docker image metadata should we wish to download the asset again and compare against the public one.
Ericsson’s book Peak is a great read on the topic
https://www.amazon.com/Peak-Secrets-New-Science-Expertise/dp...?
I don't think there's anything unscalable about Postgres, or RDBMS's in general. I've seen even poorly tuned Postgres with unnormalised table designs work fine at a decent scale, to the point where I'm convinced that Postgres with a decent table design gets you very far.

As in: far enough that if you outscaled it, you'd be able to afford a team of excellent engineers to write an appropriate database system.

Almost all companies don't need the hyper scaling NoSQL databases supposedly promise. What they do often eventually realise is that they want the querying power and additional ACID guarantees of a typical relational database, so they end up developing a shitty relational database on top of a NoSQL database.
And you'll be remembered by the way you treated them.
so now you’ve taken your savings from higher American income and lower taxes and are feeling and bidding up prices for European locals?

Yes, you can be layered off a lot easier in the USA, but you also can jump around and chase higher income that isn’t regulated by the government.

The problem with your perspective is that people in America still want to make 30-50% more than in Europe for the same job and they want to pay 20% less taxes, but they also want all kinds of services and protection.

So I will go out on a limb and guess you are so self-righteous because you have a large savings pool, so you tell yourself “I don’t mind paying higher taxes and making less money because I have security” … largely because you have your savings, which you are also using to make life for Europeans unaffordable but bidding up prices.
> I've never had a malware on Android like ever.

Unfortunately, it's somewhat common among the less tech-savvy.

In countries where Android is more popular, a lot of scam callers call to tell you that your phone has a virus and to install their "special app", of course the special app needs to check that there's no virus hiding in the camera so it needs camera permissions, of course it's safe if it has made-by-the-police in the name. People who don't know how tech works absolutely fall for this.
The project at one point started tracking files for potential rewrite to rid itself of GPL history. I used it many years ago and I quite enjoyed it (pre elastic search times) but unfortunately the license situation didn’t help the project to become popular.
You can always build a small search webservice that you open source and that your proprietary software calls out too, removing the need to open source everything.

Linux is GPL too, didn't hinder companies making trillions on top of it.
I don't think people often switch from Postgres to SQLite, it's probably more common (and much easier) to prototype with SQLite lite first and then switch.

If by referential integrity you just mean FK constraints, you can turn that on in sqlite3.

I think SQLite is pretty good for a lot of use cases. An Axum/sqlite CRUD app should be able to handle at least few hundred requests per second on a medium powered box, which is good enough for a lot of things.

Postgres is really powerful but I don't think it's actually that common to structure your app around it's unique features.
There is a difference between a 'viable future' and 400 million $.

The reality is the most proprietary software companies of that area didn't make. Specially companies with their own programming, language, compilers and so on.

First a devastating economic crisis and then the rise of open source.

So maybe they could have survived, but likely nowhere close to that value.
Thanks for the feedback!

Indeed, that payment section needs to be more clear :)
I got into nootropics to help me sleep and try to learn how to lucid dream.

I got out of nootropics because anything that can make you lucid dream must have some kind of impact on your brain, and the ENTIRE culture of nootropics is based on being more productive at work (at least the forums I was on).

It was kind of gross, to be honest. Put these chemicals in your body so you can focus x% more at your job. No thank you.
GMaps is usable from a web browser, although definitely less performant than the native app.
New LLM Pre-Training and Post-Training Paradigms: How Modern LLMs Are Trained
Its hard only because greedy corporation execs decided to milk its userbase dry, while giving them massive FU in the face coupled with a tasty spit. Technically, they already done it without breaking a sweat.

But amount of pass apple gets from mostly US folks even here on HN and elsewhere, despite all their intentional missteps and fuckups is staggering. Main reason for me to stay away from whole ecosystem, price wise they are just in upper middle tier, functionality wise it depends what you need/expect - from great to pretty much horrible proposition. If google would be chinese corp I would get it when crowds get into us-vs-them mindset, but this fanatism has no base in reality, its more like blind political support of candidate X despite massive character flaws, just because you already invested yourself heavily in given party direction for topic Y.

They will keep doing it exactly and only to the point when users will start voting with their wallets, hoping for some apple moral auto-correction is a pipe dream with some serious stuff in that pipe. Or leave it up to regulators with some morals, but I struggle to imagine this working anywhere else outside of EU, and I am not positive about the future change (hoping to be wrong of course). Until apple does something both nasty and visible, they will continue to be uncritically celebrated.
At writing novels or creating games? I'm open to evidence of either...
I mean, there’s a lot of systems out there now that are so relied upon by other systems and people that you literally have to probably be bug for bug compatible with the existing system if you’re gonna have any chance of doing a rewrite of it in another language.

That kind of thing takes time. And all of that time spent is also time that you continuously will have to justify to the executives why exactly we are doing this rewrite again and why there have been 0 new features added to the system because everyone has been busy with the rewrite. Or you assign just part of the people to the rewrite and the rest of the teams continue adding features to the existing system, and now you have to constantly play catch-up. Or everyone is responsible for both rewriting and for adding features, and new features are added into the legacy code and then also written in the new language.

It’s possible. I’ve been on teams that successfully rewrote legacy software in Rust. But until it literally becomes something that directly impacts revenue in an indisputable way – say through fines imposed for security incidents and those incidents being due to memory safety – there’s still a lot of organizations that will completely refuse these kinds of rewrites no matter how good the evidence is that they should be doing so for many reasons.
I haven't used TinyGrad but I'm not really sure what its goal is. To be the best autograd framework? to be a minimal one?

I'm glad they've removed the (rather arbitrary, and admittedly stupid) loc cap. And from the little I know, geohot is focusing on having its own internal compiler stack.

As much as I admire geohot, I don't think rolling your own compiler is the best way. Its not that the TinyGrad team isn't smart enough, but a compiler is a huge undertaking and that you have to support and maintain for a long time. I'm sure he's well aware of this, but no big labs would touch TG seriously because of this limitation.

XLA on the other hand is under governance seperate from Google, and is far more mature - so people trust that.

That said, I don't know much about Tinygrad so I would appreciate if someone more knowledgable can jump in here and outline the differences and key features ¯\_(ツ)_/¯
Big issue here in Norway as well. Was driving home from vacation couple of weeks ago, and at a large gas station 90% of the chargers were out of order. In the app they said all was fine, but when you tried it just didn't work.

What I don't get is how they're so unreliable. My buddy has been making his own EVSE and there's really not much to it. Anyone know what's their primary mode of failure? Is it just crappy software written by lowest bidder or?
This doesn't necessarily mean they're not net-profitable, or that they never were, or that they didn't ever have a profitable year.

Also - profits of the company aren't necessarily equal to profits of the investors/shareholders.
Rebuilding existing features tends to be deprioritised against building new. In that sense, the process for rebuilding might indeed take longer, even if the new approach is faster to deliver (which in the case discussed probably is not) as it does not happen in vacuum but in parallel with other developments.
Building a Strong Ownership Culture in a Team
that's true, wonder if there is alternative that is not gpl
Unlike the developer agreement, the law didn't require the consent pop up to have any specific wording, and the wording that Apple requires is far scarier than it should be.
I suppose the question is: at what cost?

eg on RDS, they'll give you instances with 1TB of RAM, eg a `db.r6idn.32xlarge`, at the nice price of $75/hr ($54k/mo). Not to mention that, in a microservices architecture, assuming you're not sharing a database, you might be multiplying that figure out a few times.

So just because it's possible for it to fit in RAM doesn't mean it's economical. RAM isn't exactly getting exponentially cheaper or more spacious anymore. The hope was flash memory would be the solution, but not sure how far that's getting these days.
I hope one of them is of-site
> I do not miss the US; moving to the EU was the best decision I ever made.

I agree. I work for a FAANG and could ask for a transfer, but I'm worried about the risks that come with the US labor law and the lack of paid holiday too. Also the waves of lay off were much harsher in the US. That being said, it's fun to live in a different country (I lived in the US in the past) and there are more opportunities in tech in the US so I'm still contemplating it.
(Last reply I’ll post here): I guess just to be ultra clear so there’s no ambiguity.

At our company no candidate talks to anyone at our company before talking to our 3rd party recruiter who screens all candidates before they make it to us. The recruiter has short 15-20 min pre-screening calls with candidates and she’s responsible for weeding out candidates who are likely to not be a fit.

A major category to evaluate is mutual compensation expectations (what are they expecting to be paid, what are we expecting to pay).

I don’t have full visibility into how our recruiter articulates this part of the screening call. She says some candidates don’t have a salary in mind, in which case she shares the lower bound of our range to feel them out.

All roles have a salary range, e.g. could be $130-160k. We don’t just come out and say that, otherwise everyone will want the top end of the range, even if (in our opinion) their experience matches closer to the bottom or middle of the range.

It’s an art, not a science. My goal is to not overpay for a role if we don’t have to. (Important: overpay doesn’t mean underpay!) more importantly, I want the person we’re hiring to be happy with the compensation. I don’t want to hire someone who’s going to quit in 6 months for a higher paying role.

It’s a negotiation and both sides are trying to find the “market rate” through the process. You can be bitter about this fact, but it’s a simple reality in business. That’s just how things work.
I personally use copilot for coding and find I code about 2-3 times faster.

It’s become second nature… I get upset when I don’t have it, instead of happy when I do.
I worked with a guy who introduced himself by saying "Hi, I'm firstName and I'm the world's best Java programmer." He would say that while shaking your hand and looking you in the eye like an otherwise normal person. I gather he had won some international Java programming competition.

Luckily I didn't work with him very much. He was a technical consultant for a customer of ours. He was brought in to hold us to account so he wasn't going to be fun to work with even without the ego...
No, I agree that "float" exists, I just don't see any numbers backed by anything. Gut feeling isn't data, unfortunately.
>The most effective solution in my experience has been when working remote, and having a culture where a team has open discussions on their own Slack channel, with threads for particular conversations.

IME a lot of the really useful "in earshot range" conversations are those that were intended privately but were overheard by someone that has an idea.

Engineer A might go to engineer B to ask B on how to do X. B is being asked because they are usually knowledgeable about similar topics. In this case they don't know.

In slack A would message B directly. B answers that they don't know.

In the office C might overhear it and have an idea and chime in.

I think this unintentional broadcasting can be really helpful to productivity and spreading ideas. It just doesn't work so well in a messaging app.
Journey of a Mobile App Newbie
you mean, don't compile it and link it within my application, instead wrap it as a separate program then call it via rpc remotely or locally?
Online dating apps struggle as people swear off swiping
> If you have accrued vacation, you "earned" your vacation and they can't take it away from you without compensation... If they fire you, they should even have to pay you your salary for those vacation days.

This is the law in California but not most other states.

In most states, vacation time is a benefit that can expire, evaporate, or be rescinded. The company is just deciding not to assign you job duties during your time off. How generous of them! But it's totally their right to decide not to do that, or to put a bunch of boxes around how they will do that. So it's legal, and common, that unused vacation time will actually be lost.

In CA, accrued vacation time is classified as "deferred compensation." It is legally money that is owed to you. It will be paid at a later date, but it must be paid.

It strikes me as no coincidence that the "unlimited vacation" fad started in tech companies with a large chunk of their workforce in California.
> We successfully scaled MongoDB from a few users a day to millions of queries an hour.

Uh, 1 query per second is 60x60x60=216000... Soo, 1 million queries per hour equals 4-5 queries per second.

Soo, that's not even at toy project level. That's extremely low scale, like the smallest possible instance small.

A consumer laptop does 20+k queries/seconds on postgres, mysql etc. a raspberry pi usually still gets 1-3k read queries/s, depending on the used SD card
(Or 432 million queries per second).

You're not instilling any kind of confidence quoting numbers like that
Profit is the whole point of owning a company, unless it's run by an oligarch, like is the case with Twitter. Not too dissimilar from Abramovich or another Sheriff from Moldova owning a sports club.
Something like that would be awesome.
I suspect that it won't happen until someone makes a DECT NR+ moduke with eady to use API exposed by it's firmware.
So, something with Nordic in it.
> Aren't humans also prone to this?

Actually, no. We can do 'real' reasoning and come up with novel conclusions. In fact, we have such an example going all the way back to Plato in Meno, about 2300 years ago. It's the doubling of the square dialog of Socrates and the slave boy.

https://classics.mit.edu/Plato/meno.html (Crtl+F for 'square')

Really, the whole dialog is relevant to this discussion with LLMs knowing things.
He can afford it as long as the stock market remains convinced Tesla deserve to be the most valuable car company in the world while being outside the top ten in sales ...
Having read the article, he is (wait for it) just like all humans, a mixture of good and bad. It would be most remarkable if he wasn't.

So neither.
This might be driven by the cost per computation being vastly lower while the benefit having remained mostly constant. There is little incentive for making a text editor that runs in 10k of memory because there is no benefit compared to one that runs in 10 megabytes or, soon, 10 gigabytes.

I spend a lot of my day in VScode and PyCharm and the compute resources I consume in an hour are more than what the Apollo program consumed over its full existence. Our collective consumption at any given decade is most likely larger than the sum of computing resources consumed up until that point in our history.
I guess the point of the parent is that if more people were contributing information, then you would get it from OSM.
Totally agree. I see a similar thing in debates about technical stuff. A lot of times I realize that something I'm pretty sure is important is not going to be compelling to someone else unless or until they run into it personally.
Are there any published scientific studies indicating such? If so, i have missed them so far.
Linux Helps Bring Titanic to Life (1999)
"at least part of the time" tends to mean every week so you still have to relocate your family or only visit them infrequently
Wonder if they're coming from recycled phones?
> I always ask what their salary expectations are...

My reply is pretty much always "What's your budget?". If they tell me the budget, I say the top of what they said or sometimes a bit above it (because it's pretty much a guarantee that they're lying about the real budget), if they don't or try weasel out of it, I tell them I'm not comfortable answering without knowing what I should realistically be looking at (and they get negative points from my POV, because why be sneaky with this kind of info?)

It's a shitty question born out of the company trying to screw candidates if they say the wrong number unknowingly. Too high of an expectation? That's a negative mark. Too low? Great, we can fuck them over by underpaying them 20% below what we would've if we'd just posted the salary.

Same with all the other similar ones. Where am I in the process with others? None of your business, I just say I'm not interviewing with anyone else.
macOS firewall slows DNS queries
Hacking with PDF (2022)
The data is sitting in northern Virginia in a data center. It's no longer in Europe's jurisdiction.
> Can't decide if it's sad or funny that Epic's greed clashed with Apple's greed

I think it's amusing, it's extremely rare for incentives of a big corporation to align with ours to the point where they'd go to war against giants like Apple.

Epic is equally bad in other areas but I'm glad they fought for this.
We've used https://www.linen.dev/ to preserve history for our community. It's nice because it makes the contents searchable and let's us not worry about slack deleting data.
> The industry predominately rewards writing code, not designing software.

This also stems from most of the code being written at any given moment being to solve problems we already solved before and doing or supporting mundane tasks that are completely uninteresting from the software design point of view.
> I like waze, but sometimes it just fails to find me a certain place.

Doesn't Waze belong to Google?
Incompetence at scale is malice.
Sorry about that. Next time I’ll do more research.
Linux is not a good example because of the syscall exemption. The licensing situation is not at all comparable as xapian’s original point of existence was embedding.
Azure domains and Google abused to spread disinformation and malware
In my experience (nearly 20yr in tech now) may Devs AND Ops struggle with implementing observability.

The sheer amount of "things" that can be monitored and logged on modern SaaS applications can be overwhelming and people seem to default to the "switch everything on and then decide" mentality.

As you can probably guess... this leads to even more confusion... and has a negative impact on their original goal.

My recommendation would be to learn how to create useful observability that benefits both Devs and Ops. The greater the overlap in a Venn diagram, the greater the success at resolving issues together - and NOT pointing the finger at the other party.

Over the years I have done a few gigs which focused on observability and they have been the most lucrative too.

It turns out companies are more than willing to pay top dollar if it means their teams work _together_ much better.
> trigger-based system

You read my mind. Yes, this is possible. I haven’t done it in prod, but I made a PoC. As to table inheritance, yes, you can also do that, and yes, in PG anyway it automatically propagates schema changes.

There are quite a few gotchas [0], though, so think carefully before doing so.

The below assumes you have a user/customer table named customer, and another copy named inactive_customer. One other note: if you use an IDENTITY for the PK in the main table, you’ll want to drop that first in the inactive_customer table, so the ids match. Example below.

ALTER TABLE inactive_customer ALTER COLUMN id DROP IDENTITY;

CREATE FUNCTION move_inactive_customer()
RETURNS TRIGGER
LANGUAGE plpgsql
AS $function$
BEGIN
INSERT INTO inactive_customer(<schema>) —-replace schema with yours
VALUES (OLD.<col> for col in cols) —-replace this pseudo-loop with your schema
ON CONFLICT (id) DO NOTHING —-modify for your table constraints
RETURN OLD;
END;
$function$;

CREATE TRIGGER redirect_customer
BEFORE DELETE
ON customer
FOR EACH ROW
EXECUTE PROCEDURE move_inactive_customer();

[0]: https://www.postgresql.org/docs/current/ddl-inherit.html
These are all trash questions. Find a way to ask them about deadlines. Deadlines should be estimates defined by the engineer. Estimates mean estimates.
Hanlon's razor applies well to situations where social power is relatively even.

Once power is sufficiently uneven, the stupidity of the powerful is no different than their malice, for with that power comes the greater responsibility to avoid doing harm with it.