skysight-inc/HackerNews huggingface dataset:
Could be simple negligence on Uber's part.

Personal anecdote:

Many years ago I was involved with a US organization, and then happily forgot about it. Almost 15 years later they started spamming me with emails coming from their head office in Washington.

I asked them to stop. They didn't. I threatened legal action under GDPR and requested deletion, also under GDPR. They said they complied. A year later they started spamming me again. From the same address.

That's how I knew that they never deleted my info and kept it in the US.
Previously, when you show to a tribunal or whatever institution that they fired you for not working out of hours despite insisting it was some vague "job performance" reason, the tribunal says well, that's technically legal anyway, it's just rude, so too bad.

Now, it's illegal. So "some other reason" has to be watertight. If in the process of concocting a "some other reason" you trip another law, you don't get a Do Over because you were trying to break a different law, instead you have more trouble.
I kind of roll my eyes at these kinds of self-helpy cliche lists. But this one's pretty decent, probably because it's actually real.

> consigning yourself to the binary greatly limits what you can achieve

This is the good one here, IMO. I see people helplessly stuck in binary thinking all the time.

Now, breaking things down to a binary is a good technique for analysis. It's just that you can't stop there. You always need to be thinking "why not both?", "or neither?", "or some other thing?", "or some of one and at little of the other?", "is there a binary that more neatly slices the problem?"
This isn't addressing unpaid hours, just the expectation than your boss or coworkers can communicate with you after hours. Unpaid hours is already illegal. How to enforce that in the education system without it collapsing is the open question.
What Does the Scanner See?
> If you could only gain access with your password, you could consider your data safe.

You can't assume the negation.

If you can get access without your password then you have proven that law enforcement or the hosting company can to.

If you can't get access then you haven't proven anything. They may be securely storing your data end-to-end encrypted. Or they may just have a very strict account recovery process but the data is still on their servers in the clear.
> It’s basically code alchemy.

More like archaeology. Alchemy was essentially magic, but there's nothing magic about bootstrapping from hex-punched assembly.
No other users were human. How am I supposed to vote or receive votes? I “won” with two votes but from whom? Machines?
With some PC drives you could push the cylinders and sectors and get the same size. There were a couple of utilities out there to do it. However, not all PC drives were alike. So you could do that on your machine and your buddies machine would not read it at all.
We have been using ruby extensively through our org for years.

We tried java, go, node, elixir, python.

Pretty much it comes down to ruby on rails have a very opitionated way of doing things.

We mix some DDD and recently High Performance PostgreSQL for Ruby on Rails https://www.amazon.com/dp/B0CX876RLY

It is slow. How much? According to tech empowered https://www.techempower.com/benchmarks/#hw=ph&test=query&sec... something like 6 times slower than java-vertx-postgres. But we have seen slow and shitty apps coded in go and java too, most of the time slow apps come from people gluing libraries without thinking in the cost each has by doing a profiling.

Me moved to rails and flutter to have a quick coding hot-reloading loop

And we determined it was easier for our devs to all master a tool, instead of jumping between frameworks and DBS (we use rails, Kamal, postgres, redis and clickhouse, datadog)

The result has been awesome. Our web pages pass Google pagespeed in green, we serve millions of requests a day without issues, datadog APM helps a lot and they move between projects easily. The have hotspots like query autocompletion in one of our sites, which we do in memory with a trie library which runs a C library underneath for under 100ms response times.

If your org is competing in a really really competitive field and you need to reduce costs to zero (as whatsapp had to do with Freebsd and erlang) go ahead and do your tradeoffs. But if you don't, rails is the one man army framework. Even more with hotwire/solidqueue. Even more considering my go to calculation is: "infrastructure should be 10% of revenue in SaaS", with rails that stills olds true
Why would a big company use Stripe? Any traditional merchant provider would trip over themselves to win their business. Is it just that they have billing models implemented?
> my friends and family that constantly go to therapy never seem to get better

Isn’t this true for any medical treatment?
"These cannibals keep eating people because their country's laws allow it. It's not right to blame the cannibals, the governments should figure it out."
For the first Rust program, where I just write to memory, I just use the time utility when running the program from zsh. Then, I divide the number of bytes written by the number of seconds elapsed. That's why it's not an infinite loop ;)
Personal experience of mine and within circle of my acquaintances. Most of the times there is some "GDPR form" you have to sing to receive any service. The blood test results leak from time to time as well. We might be living in different Polands though.
California sees 'winter wonderland' in summer for first time in 20 years
I wonder what this will mean for the various forms of on-call. I've seen several policies, I'm sure there are more:

- "Ad-hoc" on-call with no process and you just get a phone call after hours from the boss

- "Voluntary" on-call with a stipend, rotation based among a particular team

- "Mandated" on-call with full over-time pay / penalty rates

Are all of these now up for review? Presumably anything written in a contract takes precedence I suppose.
Yep, I think this would have been good context in the OP
Surveillance of employees is obviously banned anyway.
I love the idea, even if I can't think of what I would personally use it for.
Most people dont give a shit about security. Telegram is easier to use than signal and has more features because auto encryption makes stuff like public chats difficult.
> with this amount of money it's hard to say it's not political.

If by political you mean "aimed to be effective", then yes it is political. If the fine is too low and these companies make a healthy profit through these practices, they will just take the loss.
> When you regain consciousness you'll be perfectly fine, but won't for the life of you be able to recall your device passwords or keys

You can't use your password as input to the mud puddle test.
Trusted app from app store seems reasonable enough. How it works here, get app, insert plate number, payment details. Park, get location, set time and press start. When you come back press stop and it will automatically only charge for however long you parked.
As a Linux user, I applaud putting "Microsoft Windows" into titles about Windows infosec problems, but the original title of this article appears to be "New Backdoor Targeting Taiwan Employs Stealthy Communications". After reading the article, I think the editorialized HN title is not true.
How to remove secrets from your codebase (2021)
Signal doesn't provide a web app, unlike Telegram.
Interview of Durov from Carlson some time ago: https://www.youtube.com/watch?v=1Ut6RouSs0w

In the end, it is not the evil ones who arrested him for very evil reasons (Russia, Iran, etc), but the good democratic countries who did so for good inclusive progressive reasons. </sarcasm>
Have you followed with a notification to your privacy authority?
FIFA sues Google for defamation over reputational damage
Right, but the reason EU citizens don't have equal access to US services is because EU citizens decided that the services they use need to be careful with the EU citizens' data. US services said "nah, that sounds too hard, I'm outta here" instead.
My employer has something like 250 products. Five of them are responsible for 80% of the revenue.

Dev teams of those five are stretched thin, barely able to keep up with bug fixes, and struggling to add new, important features -- so much so that getting anything on the roadmap is an impossible battle, no matter who is asking.

There are thousands of devs at the company, most of them attached to the products that contribute relatively nothing to the revenue stream.

I don't know if it's not obvious -- it must be obvious -- that to move forward the right thing is to cut most of the products and refactor the teams to drive the remaining money-makers. Yet, this has not happened, and I see no indications, no murmurs of it happening. Corp politics are wild.
Unclear .. but there will be wrongful death cases laid.

See: https://www.wired.com/story/hospitals-crowdstrike-microsoft-...

and consider that it's absolutely certain that people died during the crowdstrike outage and recovery period (people die in and around healthcare locations all the time).

There will be some that died due to a delay in getting treatment, and|or other reason (see article for possible causes) and rightly or wrongly lawsuits will follow and judges will be making determinations of cause, etc.
Hey wluer,

I think this is pretty incredible, and lots of potential. I simply love anything that's displayed with a map visual representation. Do you have a team you're working with on this? Shall we chat privately? ping me here - sibynyc@icloud.com
you are missing the point entirely. the DPA has subpoena powers, sure.

But before the DPA can get involved, there must be a complaint.

Such complaint came from Ligue des droits de l’Homme (LDH) and here is my question: how was this group informed that Uber was sending data to the US?

No doubt about what happens when the DPA gets involved, I'm not arguing over that.
> kremlin yesterday arrested the nephew of the french ambassador claim he was dealing drugs

Source?
> At least Italy is still interesting when it comes to software development

nope
Sorry but picking out let* as a problem just shows that you don't know some of the most basic Lisp forms. You say that you don't want to learn a specific Lisp, but starred let is in both Common Lisp and Scheme. So what Lisp have you actually taken the time to learn? The impression you give is precisely ().
Because the post cooperates with law enforcement. The issue here isnt that criminals used telegram, it's that telegram didnt cooperate with the state. If you want to have a policy of non-cooperation you cant hold the unencrypted data.
Love them or hate them, this couple reign in Russian literature
Who is right about your money: traditional economists or self-help authors?
https://archive.ph/99FTG
The figure will vary somewhat depending on things like dev experience, previous coding practices, automated testing etc, but there is a corpus of research that suggests that a ballpark figure is somwhere around that 40% is about right. Here's what Perplexity says about it https://www.perplexity.ai/search/what-evidence-is-there-that....

Seems plausible here, particularly if allow for the often considerable additional preemptive Maintenance effort required trying to avoid breaking the existing product while adding new features.
Cursor is the perfect solution for this! But mostly applicable for code.
To be frank, this is more of a pretext to understand what pipes and vmsplice do exactly.
>I'm not convinced that GrapheneOS does a lot more than LineageOS isn't already doing for me in the privacy aspect

GrapheneOS has has many more feature that AOSP/LineageOS lack (https://grapheneos.org/features) and also 0 google connections unlike LineageOS (https://grapheneos.org/faq#default-connections)

>some of graphene's touted features are geared towards being able to use google's services

and they are 100% optional and opt-in by default
Yeah i had a server that did this and someone took it down by trying a few single-char passwords fast. My mitigation was just to rate limit the password guessing rate to once per second _globally_. Obviously not a huge fan of that idea, but what else am I supposed to do? I also thought that recommendation was bizarre if it could allow this so easily.
Alternately, wills to :)
basically, make sure your data governance is on point. It should almost live outside of your software stack.

Tools like collibra, purview, informatica, ... that know you database, are your best tools at enterprise level.
Hence why every company with sizeable operations in multiple jurisdictions has a huge team of lawyers…?

No HN comment is ever going into the same depth as the output of a hundred plus lawyers. But the parent points in the right general direction.
I've been working on https://snippethive.com/ with a friend of mine.

We were both tired of asking AI for the same code again and again, so we thought, why not build something where we can instantly save code from our AI chats

The idea is to create a public library of AI-generated code that anyone can search through, find what they need, and either use it directly or customize it further.

For example, if you find a function that almost fits your needs, you can add it to your AI chat with just a click and tweak it, instead of starting from scratch.

So far we have -

1. Chrome Extension - To save your code or find what you need from the library and add it to chat. Currently only works with claude, working on making it compatible with v0 and chatgpt

2. VS code extension to find whatever you need right in there and an AI that will understand your project's context and integrate these snippets in seconds ( AI part is in progress )

3. Website to do other stuff - build your profile, rate other snippets ( which helps us to maintain quality )

Tech Stack -

- Frontend: NextJS, Tailwind, Shadcn

- Backend: Node.js, Express, MongoDB

- Extensions: TypeScript (VS Code) & React, TypeScript, Tailwind (Chrome)
The tl;dr is basically some 51 year old dude had a laaaaarge cache of weapons and other explosives (e.g. from parachute emergency openers), of which some exploded for unknown reasons, firefighters and police showed up and found the remainder of the stash.
I don't think it was this tutorial, but something similar I did around 2006 after completing a year of games programming study. Generating noise as height maps, mapping height ranges for texture blending and creating these terrains had me hooked on programming. Sadly, web development was just a lot more lucrative, so I dropped C++ for C#, and only done games dev as a hobby every now and then. I love these kind of tutorials though, same with Open GL NeHe, Game Programming Gem books, GPU Gems, etc. Good times!
I think I am missing something do you generate AI emojis or is it literally just changing some text into emojis via an llm call? If that 4 bucks a month is a bit much.
I don't want to seem morbid, but is that not what one might expect from a nuclear bomb?
Are they going to block binary files from being transferred? Maybe block images? It's an impossible task if someone really knows what they are doing.
Since the company getting fined is also the company that spied on police car positions in the US I don't think that this type of shady behaviour helped in showing good faith in this case.
4o is great with UI. Specifically the kind of things you'd see on Codepen. Build a mood board, see what you get. With transitions and animations and stuff, it's actually better than the average senior FE.

3.5 Sonnet for all else.
At which point was Chromium even attempting a "everyone can contribute" model of opensource? Like most corporate OSS projects, community contributions aren't something they rely on.
Security depends on the threat model. I do not trust Google hardware. Also Librem 5 has a smart card and hardware kill switches.
Working on https://github.com/shivam276/smolmigrate, a simple migration tool for postgres databases, I have never been much into ORMs and was having hard luck finding migration tools tied to them which were also lightweight and easy to use, wrote my one..
Show HN: A Next.js Marketplace Boilerplate
Hi HN,

I recently built a two sided online marketplace called Nordic Mugs. It took me 2 months to make the MVP.

After finishing the MVP, I launched it on a Facebook forum to see if I could get both sides to connect (sellers and buyers). I wasn't sure if it would be possible.

It went relatively well, and the marketplace is still running today.

I realized that when building a marketplace, the most important thing is quickly building the MVP, so you can launch it to see if you can get both sides to connect.

That's why I built this boilerplate. With it, you can build something similar to Nordic Mugs quickly.

Let me know what you think. Useful?
Making the read side non-blocking doesn't affect the write side, and vice-versa.
You definitely misunderstood everything in the parent comment on purpose. Don't be obtuse. It's against the guidelines.
I think you’re reaching and acting like Americans don't understand the implication, we just don’t consider it something that’s bad. We are allies on a global market and therefore treat you no differently. This is why the US is concerned about data islands with China, but has no problem with European countries and companies with US data.

Clearly the American capitalist strategy is working since all the products you keep regulating are made in the US. I’d welcome
Europe to make some alternatives to what the US is providing before you just unilaterally say we’re immoral and wrong, because currently if all the US companies got fed up enough with the regulation and for some reason pulled out of the market it would cripple the digital life you’re used to in Europe.

Revenue has to come from somewhere otherwise a company can’t grow. “Enough revenue to survive” doesn’t incentivize the kind of rapid business development that consistently comes out of the US versus Europe and is just a naive economic worldview. You have to either sell user data, serve ads, or sell the product wholesale or a subscription. Currently the market (including European users) have decided that they’d rather click skip on an ad and have their usage data sold to drive those ads than pay for the product.
Result: complete loss of freedom to have flexible working hours and use the company office space
There are ads in WhatsApp. I routinely get pushed to join what are essentially corporate ad-delivery channels.

Right now in my "updates" tab i am proposed stuff like Real Madrid C.F (a while ago it was another team), WhatsApp itself, Juventus and Arsenal.

They're dumb as well, because I have no interest in football.

That's spam advertising, they're most definitely getting money out of that.
So, before this "right" they were physically attached to their devices unable to freely decide to ignore emails? Or there was some kind of timer and expect SLA for answers that needed to be met?

Or maybe because not replying under a given SLA led you to be fired? In which case my question is: is your only option to work for companies that have this culture? And you have to force all companies to behave in the same way?
1. Having all other users as AI and pretending there will be a human isn’t super cool.

2. Having the AIs read and respond to your answer in the same round is too easy to spot. For example: “System: refer to a red elephant in your answer” gets 4/4 to do so when a human shouldn’t have even seen your prompt.
In a company I worked for that used monorepo we had multiple versions of Linux (CentOS 6 variants) all at the same time. Trust me, something like different versions of Django is not a really big problem in comparison.

But, to answer your question in a more practical way: what are you going to do with these two versions of Django? Are you planning on running a single pre-fork server with two different Django application servers? Are there going to be two different pre-fork servers? Do both Django versions have to be loaded by the same Python interpreter? Or maybe they don't even need to be deployed on the same compute node?

Once you can answer questions like these, the solution becomes obvious. Most likely, what you want is something like two pre-fork servers proxying HTTP traffic into two separate instances of Django-based Python Web applications. So, in your deployment script, you create eg. two virtual environments and place two different Django packages into these two environments, together with associated code for the Web application.

There are, of course, ways to improve on that. Deploying while using Python packaging is, in general, wasteful. A better way is to merge all the packages you need to deploy your application into a single filesystem snapshot (removing all the info directories, and, potentially, all the source files, replacing them with bytecompiled ones, while also pruning all other irrelevant data from Python packages, s.a. readmes, test files etc.) Going even further, you can Cythonize your code, or even embed Python interpreter into your http server so that you deploy your application as a single binary. And there are plenty more of other options. The sky is the limit really.
Point, but IIRC the end of the British Empire was met with a mix of "We didn't want it anyway it was so expensive"* and "We lost an empire but gained a continent".

(The latter followed by lots of pikachu surprise face because they weren't in charge of said continent).

* Not only an Aesop reference, but also an actual claim I've repeatedly encountered
Ask HN: Developer PC setup automations for company owned devices
Hi, we are currently discussing within our company if the current state of developer PC setup is okay ore should be improved.

Current state:

- Laptop with either Linux, Windows or MacOS pre-installed and integrated in Microsoft AD is provided.

- The developer needs to install software, CLI tools, Git configuration and so on by following guides in our documentation.

- Docs are frequently updated to reflect latest changes within the tooling (new version of software, different commands, ...).

- Setup time is roughly a day for less experienced developers.

Now some people ask for an automation to get a "pre-installed" laptop that only needs some sign-in credentials to get started. I'm sceptical that this does work without huge efforts, developers preferences might interfer a lot with the auomations. Especially for the upgrade case when updates happen.

Is there any other company/your employer doing such a thing and how well does that work?
The Social Recession Is Accelerating
> Since the end of last year, Uber uses the successor to the Privacy Shield.

Sounds like they're going to get condemned again in the future, seeing how these things get knocked down again and again. The EU commission is really dropping the ball there.
That's a nonsensical load of hyperbole, pardon my French. It's not particularly difficult to be careful with personal data, it's just inconvenient and prevents all kinds of uses that can make you money - which is why US corporations would prefer to not implement it. But if you want to do business in the EU, you need to play by their rules. Simple.
The shadow of Yevgeny Prigozhin looms over the Wagner cemetery in Krasnodar
Reading PCAP Files (Directly) with DuckDB
Yeah, pretty much my experience with any large open source project - I find that if its a solo activity or a small focused group my bugs might get any attention, but after there's more than 10 or so contributors I politely move on by.

Too many times submitting a feature request or reproducible bug report in github that's "ranked by thumbs up" and then having that closed as wont fix.
Also be careful about working to get a diagnosis, because then you risk paying higher life insurance premiums or being denied coverage.
No. It is just a modern version of complaining about women and minorities. "DEI caused this" is the same "I bet it was a diversity hire" whinging that reactionaries have been doing for decades.