skysight-inc/HackerNews huggingface dataset:
Security Engineer (8 YOE), currently in Application Security (4 YOE)

Location: Portugal / EU

Remote: Remote only (Worldwide, also looking at LATAM opportunities)

Willing to relocate: Open

Technologies:

- Programming: Javascript (NodeJS / NextJS), Java, Python, C, C++
- Tooling: DefectDojo, Trufflehog, AWS, Terraform, Jenkins, Burp Suite, SAST, DAST, SCA
- Other: Network and Endpoint Protection (Trend Micro - IDS / IPS, AV, EDR), NGFW (Palo Alto & Checkpoint), Reverse Engineering (binary static & dynamic analysis), Incident Response, Secure Code Review, Threat Modelling (STRIDE)

CV: https://www.linkedin.com/in/renatopnascimento/

Languages: English, Spanish and Portuguese

Email: renasc.rpn [at] gmail.com

Blog: https://renato.boo

Interesting things I've done:

- Application Security engineering, integrating tools and automating vulnerability management processes and achieved 90% false positive reduction for SAST and 100% false positive reduction for secret scanning

- Contributed to improve AST and language detection for our SAST Engine, improved findings accuracy and also implemented custom frameworks detection

- Architected and implemented network and endpoint protection for Large enterprises across different sectors (Banking, Oil & Gas and IoT)

- Experienced with customer facing roles (sales engineering, threat modelling, technical training, security champion programs) in different countries and 3 different languages

I'm also looking to connect with different folks to discuss security and reverse engineering as well :)
My naive mind thought parc was short for parcel.
How many gallons of water can you desalinate and pump if you only operate during the magic lump? How much sewage can you treat?
It's because at one point, the subject of objectification was raised; films and TV shows having a usually female cast member appear only for eye candy.

But the other part is changing or tightening morals, in part due to a conservative morality police PrOtEcTiNg ThE cHiLdReN, in part due to cold, hard cash - that is, making a movie PG means more people will watch it.

Note that that's not only a US thing; media is multinational, and some countries are stricter when it comes to morality / decency / sexualization.

That said, it's not universal. At the same time, people of many age categories watch porn in public. Some people have no shame about these things. It's confusing times where both inclusion and sexualization / objectification exist in parallel.
This is a interesting website and I finished the test. But when I am in testing I relized that I am a daltonism and most of color that between green and blue is gray in my world :D (it just as same as my browser title bar)
You were making sense for a bit, then kind of went off the rails?

For instance, forced labor, pollution, etc. are factored into price. Or more specifically, the customers willingness to care about these things is factored into the price, on the buy side. And someone’s willingness and ability to do them (or hide them) is priced on the sell side.

Same with the customers willingness to gamble on quality (aka random no name branding), and a sellers willingness to deal with legal and reputational blowback.

People just don’t want to say it.

At the end of the day, as long as no one is going to shame them or punish them, most people will happily fund super polluting slave labor and gamble on quality for a cheap price.

Hell, as has been made clear over and over again, people will happily risk serious legal consequences and even murder people to supply/consume illegal goods that get them high, at a price. And that price is a lot lower than most people want to think about.

And this is where the EMH bears actual fruit - because the ultimate test is people’s willingness to part with their cash for a good. And both sides of the transaction are always trying to figure out ways to shift the line where they both meet in their favor.

It’s not about what they say, what they profess to believe, what is acceptable to admit, what is legal (per-se), etc. unless it actually matters.

Which is rarely as often as we’d all like to believe.
Analysis of CVE-2024-37084: Spring Cloud Remote Code Execution
Right, but again I think the emphasis on avoiding 3rd party libraries isn't really relevant to machine learning. The "from scratch" here is avoiding 3rd party implementations of the transformer model, building up from the math on paper and then letting the AD/computation framework do its thing.
You kid, but this is basically where I’m at now.
I assert that if the occupancy rate is 80%, they're charging exactly what they should be charging.

If you own a hotel in the US, you are over the moon if you achieve a >70% occupancy rate. You are a hotel god. You are a master of the hospitality domain, Cornell will give you an honorary degree in Hotel Management, and you have made both supply and demand your bitch.

"Oh my! Why is this four bedroom luxury lodge with hot tub and pool table, very obviously meant to be split amongst four couples eight ways, an entire fourteen hundred bucks ($175 ea.) per night?"
<https://news.ycombinator.com/item?id=24313136>

Vote, flag, or vouch as you see appropriate instead.

The best way to improve thread quality is that, and leading by example as I've attempted with a top-level comment here.
During the 2022 energy crisis, it was the citizens of practically every country in EU that declared in unions that the market had failed and that government had to step it to fix it. Multiple elections around that time was defined by political discussion around who was willing to pay more of citizens energy bills and save companies that would have gone bankrupt. Estimated €200 billions in a single year went towards that single purpose of fixing what the market failed to do.

It was demonstrated beyond doubt that if governments let the market forces deal with instability in energy prices, then the citizens will vote to kick those politicians out and replace them with someone else.
It also had an antecedent; Wizardry was very much like a single-player version of Avatar, an early multiplayer dungeon game that ran on the University of Illinois PLATO system. The cube-like "rooms," displays, and game mechanics were very similar. I don't recall the controls being the same, though, and Avatar was written in PLATO's native TUTOR language, while Wizardry was UCSD Pascal.
kreinin spends a lot of time debugging things that don't run on linux or any cpu architecture linux or vtune supports. even on amd64 linux, perf is not so useful with python, lua, node.js, browser js, shell scripts, etc.
Some previous threads on the concept:

Leave work slightly unfinished for easier flow the next day

https://news.ycombinator.com/item?id=38658262

Someone in this thread referred to it as "park facing downhill" which resonated with me:

An On-Ramp to Flow - One Weird Trick: Leave Your Work Broken

https://news.ycombinator.com/item?id=35456059
>>I'm amazed by people who can simply just..decide to sleep with some crisis hanging over their head.

Not if crisis becomes routine. Then its just another working day.

There is a also a non-personal crisis situation to this. Many times, even during wars, there is little to lose personally. Business has similar situations, where the worst case scenario has little effects on one's own personal life.

Its a totally different situation when some one you love is in the hospital, or has died.
If they wanted to be ahead of the competition, they would offer "handcrafted human designs for premium customers"
PyDPainter 2.0.0 with Animation
There are staggered holidays, but it's uncoordinated, based around local council areas - i.e. areas with a population of a hundred-thousand to around a million people. One council may run mid-July to end-of-August, another council a week earlier, and a third a week later.

The UK summer vacation (summer holiday in British English) is significantly shorter than in other countries - only six weeks, where I understand eight or nine is common in other European countries. This probably significantly adds to the holiday congestion and higher surge pricing.
> Yubikey will never prevent your data from being leaked.

That depends on how your data is being leaked. Of course it does not stop the service provider from leaking your data (intentionally or unintentionally). It protects you from phishing attacks.

> Have random, unique passwords. Use a password manager.

Sure. These are still good practices even with a yubikey.
It's the weird irony of things; the more "sheltered" someone grows up, the more the sight of a boob or ankle will be seen as something outrageous. But get a lot of (real life, not porn) exposure to it and the mystery disappears.
You only get so many of those £0.99 offers before it goes up to £8 without making it clear.

I just did a checkout to test and it says "Click here to get your Prime eligible items with Premium Delivery for £4.99 no extra charge". Yet clicking that button costs anywhere between £0.99 and £8 without any obvious warning.
They were covering what happened every week as if the war was happening in real time. They also covered tactics and equipment, key events and people, spying, and war crimes in specials and side series, and followed D-Day and Pearl Harbor hour by hour.
Yeah but don't call it a relic because that'll make me feel old :(
the vast majority of embedded cpus cannot run yocto or indeed linux, even the arms

but they all support gdb
It's all about installation.. most folks just can't be bothered to install a different OS then the one their laptop came with. I liken it to the small community of people who tune their cars vs most of the the people who use cars.. just use what they get when they buy.

There is the fact that gaming is a faff with Linux vs something like Microsoft.

It's amazing.. I am a Linux fanboy.. but it's just not a mainstream platform.. and I don't think it will ever be.. and that's OK!
Bloom Filters: The Unsung Heroes of Computer Science
https://brk-b.com/why-charlie-munger-despised-ebitda_240201....
But they're already a customer, just a customer without a subscription.
Seconded. Check out both books by the author, they’re great!

https://lets-go.alexedwards.net/
https://lets-go-further.alexedwards.net/
You can't revoke them if the paper is in the wrong hands, and you don't have a normal access to your account. (Well, they are much like a password in this regard.)

It's just different risk profiles. Your biggest risk might be to drop your phone and lose all the 2FAs in a Google Auth app. Or your biggest risk might be losing your wallet to a thief or robber who is going to hijack your accounts.
The Grossman-Stiglitz Paradox supports this. In fact, economist Grossman's hedge fund has delivered pretty good returns.
https://en.m.wikipedia.org/wiki/Grossman-Stiglitz_Paradox
I have to always add wildcards between func and the function name, because I can never know how the other developer has decided to specify the name of the receiver. This will always be a problem as far as grepping with primitive tools that don't parse the language.
sure. the reason i put a line break between return type and function name in c-likes is `grep ^fname`. but i seriously wish greppability wasn't important. the extensive line-orientedness of unix tools really puts a damper on the whole hose-of-bytes concept, and it's no wonder by the time of plan 9, there was a strong desire to do away with it—cf. "structural regular expressions", as deployed in sam(1), which, of all the places to put them, certainly has historical irony, as sam's (decidedly not line-oriented) editing language nonetheless descends from ed, the definitive line editor, and gave us such hits as "stream ed" and "simulate typing `g/regex/p` into ed".

just the other week i noticed a change in recommended formatting style in a project i contribute to regularly, and the result was source files got about 20% taller, 20% more of a pain in the ass to edit without some sort of syntax folding. the rationale? diff. making you reach for a syntax-aware editor to compensate for a deficiency in the syntax-awareness of a version control frontend is certainly a choice.

the business end of git as seen by most programmers is in fact diff city, sure, but deep down git is a bunch of snapshots. even deltas behave nothing like diffs. pull up the spec for the pack format and look for the word "line". you will not find it.

things could be so much better, but for now we live in a world where the headline is true.
All of those are great.. but let's be honest.. they services they are replacing are way way way slicker and easier to use.
Former manager at big tech here and this is my experience, not sure it really translates to other companies.

Usually higher ups constrain line managers of ICs with limited budget (most of the time you don't know what it even is). Moreover, the process is inherently flawed: I may help folks find opportunities for impact and it may even be great impact in my eyes, but eventually higher ups want to just promote the really really good people, which will inevitably result in comparing everyone with everyone. Most of the time I was not in these conversations.

It's unfair because most people work against some goal that's agreed upon, and later that year the criteria changes.

This is to say, no one is really in full control in some companies. In 12 years, I have yet to find a process and surrounding environment that promotes fairness. When there's limited money and a true meritocracy is enforced, there's loss of control. Yet, managers should own the message of why you don't get promoted, even though you should in their eyes and there's no clear reason for the outcome (EDIT: other than "someone, somewhere was better than you" in some way which is very disempowering).
> Your attitude seem to be that ... it is the woman who is the problem and should be covered up.

100% not. In fact it's the opposite: you're supposing that a woman in swimwear at a beach is giving implied consent for her image to be used in a radically different context. That would put the onus on the woman to cover up in a way that I wouldn't.

In any case, I think the bigger problem is actually for instead those people in the business environment where this appears. Is it really a surprise that a semi-nude image used for illustrating image processing software is of a woman? Do you honestly think it is just as a likely as a man? I know the term "micro aggression" is controversial but sexist choices like this are real and common and do have an impact on attitudes for both men and women.
Mapbox, Monday.com and CircleCI Use In-App Product AI Assistants
It looks to me like you can use -foptimize-sibling-calls to get it to happen on gcc below -O2.

There's also https://github.com/pietro/gcc-musttail-plugin to ensure it does happen (and clang has musttail support built in these days).
>Are lenders giving the ultra-rich great interest rates here as a loss-leader to try to attract other business from them?

Banks and investment firms are not allowed to loan money out privately for less than the AFS, which is 3.72% right now: https://www.investopedia.com/terms/a/applicablefederalrate.a...

The entire post reads like a LARP.
I think Mac’s would be totally fine, albeit a higher hardware cost. You might actually find Mac’s to be better. My macOS machines have far better (continuous) uptime than windows.

I’d say there is a stigma around Linux in North America, if I went into a shop and every machine was running Linux I’d either think they are dirt poor or some kind of underground Russian secret service operation. It just isn’t seen.
I'd invite you to give it a shot:

https://www.stavros.io/posts/george-i-made-a-keyboard/first-...
> In a for-profit organization, the optimal behavior for the company is to employ workers at the lowest pay that the worker is willing to accept.

I've been around the block enough times to know this, but I still hate it. Why do we give so much of our only lives to this system?

> So there is no incentive for a manager to promote you or give you a raise unless you ask for it.

Even if you do, theres still no incentive. The only incentive is threatening to leave when the cost to the org of your doing so is greater than the cost of promotion.

Couple of points:

1. The above are why (after 30 years as a dev) I'm trying to build something on my own. But its hard.

2. I'm not a woman, but the points above aren't really gender-specific. I do appreciate the substantial additional challenges faced by women in tech, though.
Documentation sucks. It doesn't explain what it is. Why open source Twitch?
Introduction doesn't explain anything.
Is it a Twitch competitor?
Is it a restream competitor?
... annoying
It can be done through carbon capture, using electricity alone. Question is how to do it in a way that makes money.
It's known colloquially as "Earnings before bad stuff" because you can use it to hide all the stuff in your accounts that doesn't make you look good. It's not a con, more like obfuscation.
The default state of regulars in technical IRC channels :D
Florida lawmakers stay quiet as corporations buy homes
This works. It also works fine for programming tasks. If you feel your struggling or making a slow progress on your current task, switch to a different task.

When you come back to the first one your subconscious has usually processed it quite a bit.
Radar Issue at Newark Airport
Wokeism doesn't mean anything. Your biases are showing.
that's going to find all the functions that take an argument named lart or of a lart type too, but it also sounds like a thing i really want to try
And if that service called an external system but failed before committing the transaction? I’m not sure you should be using db transactions in distributed systems as you can’t recover from partial failures.
> or the dealer won’t have one in stock or if they do have one in stock it won’t...

This bit of American instant-gratification-addiction has always felt weird to me, and I think most Europeans (at least those who even know of this difference). Like, a new car is a pretty huge purchase. Why would you ever buy one that isn't exactly the way you want it, when all you have to do is order it with the exact options you want and then wait a few weeks?

Weird. Again.
Hanlon's Razor: Do not assume bad intentions. Listen and understand
shocker.
List of films featuring miniature people
That’s exactly it. I view it almost like Newtonian physics. Sure, it’s inaccurate at some level, but until we find a superior model, it’s safer to make your investment decisions based on it.
MeshCommander 0.96 is available on its website again; from what ive read the dev has been settling into a new job
Yeah, sdf jkl is way harder for me to wrap my head around than 'none hunt out the one ton nun'.
> It's also way easier for a school to say "no early absences, that's the national policy", and not have to get into constant arguments with parents.

Also, if the teachers/school approved the holiday for someone who then underperformed in some exam or other assessment, and it could be seen that missing something in that week off, you can bet your last penny that many parents will blame the school for approving the request instead of telling them there might be a problem, and if the school deny a request because there might be a problem many parents will blame the school for there being a problem in the first place.

In some cases the problem would be with the school, but it wouldn't be just those cases that get the full-on compo-face-in-the-national-press treatment. Teachers jobs are hard enough as it is, especially given the level of remuneration and other conditions, without asking them to take on this responsibility.

Skipping school can have a significantly detrimental effect on a child, it doesn't always, maybe it doesn't most of the time, but it does often enough that it is a significant concern. If people don't like how the school system works, perhaps they should try homeschooling?

To be blunt: I don't pay my taxes to fund an education system¹ so someone's offspring can wag off…

----

[1] I don't begrudge funding the education system generally, despite not having (and not planning to have) kids myself² because I'm well aware that good education for all is a huge benefit for society as a whole

[2] Before anyone says “you don't have kids, you don't know how hard it can be”: I know full well how hard it can be and that is one of the reasons for my intention to never breed, I can't speak for anyone else's but my decision on the matter is not the one taken from a position of inadequate awareness
I can unlock and drive my car with my phone and the house has smart locks. What is this keychain you keep mentioning? I know the app but I don't think that's what you mean.
Feeling Seen, Feeling Known
Even during an exam, having a micro-nap or going for a walk is beneficial
Absolutely.

It's what I like about Rails when it comes to file names too. Having controllers/users_controller.rb as a path might sound wasteful because "you're already in the controllers directory, you don't need _controllers in the path".

But when you want to fuzzy find that file, it's really nice to type "users con" and get that file instead of also picking up views, models and other user related files with just a "users" search.
> The most promising model, Meta’s open source model Llama2-70B

This is an old model that was not dominant even when released. This study must be fairly old or I question the qualification of the group running it.
Yes, and it's great!

But seriously, do you want your mind to live in a monoculture or do you want it to be challenged and open to new idea?
That was fairly standard startup behaviour across all makers. The comment you're replying to talks about the heatsink suddenly falling off - a very specific testcase seemingly chosen to make a company look bad.
True, but the investors want to AI all things things. Just read the blog of the formerly thoughtful Tyler Cowen to get a sense of this.
I second trafilatura greatly. This will save a huge amount of money to just send the text to the LLM.
I used it on this recent project (shameless plug): https://github.com/philippe2803/contentmap. It's a simple python library that creates a vector store for any website, using a domain XML sitemap as a starting point. The challenge was that each domain has its own HTML structure, and to create a vector store, we need the actual content, removing HTML tags, etc. Trafilatura basically does that for any url, in just a few lines of code.
> It's not a con, more like obfuscation.

Which is a very subtle and complex distinction, like the difference between tax evasion and tax avoidance.
I remember going to Center Parks maybe 25-30 years ago with my parents and another family (all in one lodge). I also remember humping in bags and bags of food and drink and getting the bikes off the car roofs.

Perhaps it's just a return to the ancient British Dad tradition of not paying for the optional extras after briefly convincing we millennials that every worthwhile experience has an uplift fee. Even, perhaps especially, if it means organising the stocking of the cars like Captain Scott preparing for a zombie apocalypse.

See also NT picnicing: https://www.theguardian.com/lifeandstyle/ng-interactive/2023...

Of course, the best bit of the holiday was never going to be a manky old restaurant, you can have those anywhere. It was the forest, the cycling without threat of being turned into chunky salsa on an A-road, the unusual accomodation, the pool, the lodge bubble baths and most of all the fact that blocky-cushioned sofas disassembled into amazing fortress construction materials.
Do they have an article that explains their approach? I couldn't get through the marketing-speak.
FR, FF, RR... WT, TF?
The problem with Supermicro isn't the short report, the problem is the secure boot keys were leaked so a huge amount of their hardware is impossible to secure because the root of trust is broken.

https://arstechnica.com/security/2024/07/secure-boot-is-comp...
How the Summer 2024 Box Office Got Moviegoing Back on Track