skysight-inc/HackerNews huggingface dataset:
Location: Eugene, Oregon, USA
Remote: Yes, please!
Willing to relocate: No. Sorry, kids in school.
Technologies: Web APIs in Rust (and the corresponding Linux stack)
Résumé/CV: https://www.linkedin.com/in/greg-parsons/
Email: hn202411@swimr.com

Front and backend web dev who also flies helicopters for fun and profit. I love writing code to affect the physical world.
> I first used Arch over ten years ago and nobody told me about archinstall until a few weeks ago!

It wasn't really an official option ten years ago;
https://archlinux.org/news/installation-medium-with-installe...
puts it in 2021 (though that's just when it was added to official install media; I assume it was available in some capacity before that)
They meet these metrics while they are under formal process just before termination. I used to work with a couple people clearly working multiple jobs who switched focus when they were PIPed.
Nope, consent cannot be a prerequisite of using the service/software, if it is available in the EU (or UK, since they grandfathered in GDPR after brexit) it must be usable with or without consent.

That is the reason many local non-EU ad-supported businesses (like local papers in the US) outright block all EU traffic. For example if I go to https://www.chicagotribune.com/ I get a blank page saying "This content is not available in your region".

Manjaro could do something similar by just blocking EU users from downloading it.
<crunch> see I fixed it!
OK, that's actually a pretty good reason for it to still count.
> Look at the countries that are generally regarded as happiest: are their economies the biggest?

Assuming when you say "biggest" you mean per capita... yes. Obviously it's not the only factor, but generally I think it's generally accepted that people in rich countries are better off than people in poor countries.
Advice Needed: interviewing.io refuses to delete recording of my interview
I received an email asking me if it was ok to include my behavioral interview in the upcoming cracking the coding interview book.

I was really shocked by the request. It's been several years since the recording, however, someone on their side must have watched it recently. The interview contains a lot of private and personally identifiable information.

I have asked interviewing.io to delete the recording of behavioral interview. (Yes, I paid for this interview.)

However, they have refused. I tried having back and forth with them, but they still refuse. They keep trying to push me to delete my account instead.

Am I screwed? Is there anything I can do to have a recording of me deleted?
If few people know Rust, then even fewer people know Elixir. That's a major concern for these types of projects, often.
More accurately: Cost cutting is having a comeback.

Rails was built for the last cost-cutting era, so it seems relevant again.
Day of election there is a big tally when votes come in and pictures of American Democracy In Action with a bunch of puff stories about people in lines. Huge time for viewership, not a huge time for important journalism.

There is no perfect time to strike, but I think other outlets can cover the typical:

- "huge lines in Pennsylvania!"

- "Polls close in [KEY SWING STATE] in 2 hours!"

- "Wow the whole west coast went blue, who would have thought!"

- "Shocker that one battleground is going into recount which will somehow last 4 weeks."
How are you going to accurately measure "your code is shit"? If it was that easy, it would be a standard git hook.
is this really true? With one side we can at least get something done and move on with are lives. Two extreme perspectives does not lead to finding a friendly middle ground, it just leaves us locked in a painful & unpleasant stasis.
No.

Ironically, a flip side of the complaints about how Go lacks power is that a lot of the "standard" security vulnerabilities actually become harder to write. The most obvious one is lacking the "eval" that a dynamic language has; more subtle ones include things like, there is no way to take a string and look up a type or a method in the runtime, so things like the Ruby YAML vuln are not assisted by the language level. To write something like that into Go, you'd have to actually write it in. Though you can, if you try hard enoough.

But, as sibling comments point out, nothing stops you from writing an SQL injection. Command injections are inhibited by the command only taking the "array of strings" form of a command, with no "just pass me a string and we'll do shell things to it" provided by the language, but I've dispatched multiple questions about how to run commands correctly in Go by programmers who managed to find []string{"bash", "-c", "my command with user input from the web here"}, so the evidence suggests this is still plenty easy enough to write. Putting the wrong perms or no perms on your resources is as easy as anything else; no special support for internal security (compare with E lang and capabilities languages). And the file access is still based on file names rather than inodes, so file-based TOCTOUs are the default in Go (just like pretty much everywhere else) if you aren't careful. It comes with no special DOS protection or integrated WAF or anything else. You can still store passwords directly in databases, or as their MD5 sums. The default HTML templating system is fairly safe but you can still concatenate strings outside of the template system and ship them out over an HTTP connection in bad ways. Not every race condition is automatically a security vulnerability, but you can certainly write race conditions in Go that could be security vulnerabilities.

I'd say Go largely lacks the footguns some other languages have, but it still provides you plenty of knives you can stab yourself with and it won't stop you.

I've been running govulncheck against my repos for a while, and I have seen some real vulnerabilities go by that could have affected my code, but rather than "get arbitrary execution" they tend to be "didn't correctly escape output in some particular edge case", which in the right circumstances can still be serious, but is still at least less concerning than "gets arbitrary execution".
I'm amazed when someone assumes others must eat out every meal if they don't have the ability to broil a roast in their home. Though I shouldn't be amazed - the inability of people to understand lives that work differently then their own seems widespread.
They were so busy inventing they forgot to do a basic Google search to see if it had already been done.
"Most of reasons for failure is that incentives in between contractors and hiring company is misaligned, leadership have no idea what they are doing, cultural differences, time zone differences"

No-one was referring to moving business and I'm still not sure where you are coming from with that. Moving a contained software business unit of a US based business to another country is not "moving the business", but is often how offshoring works. This doesn't involve moving the entire business, but just a mostly self-contained portion of it. I don't think surgical_fire misinterpreted anything. The quote above from surgical_fire explains their sentiment. Businesses in the US getting used to their onshore employees being remote doesn't solve any of these offshoring issues.
I love that my Ford Focus' HVAC system is entirely disconnected from the rest, and fully button/dial controlled. I can turn off the infotainment screen radio thing and the HVAC unit still does its job. I love knowing that some software or hardware fault in the clumsy infotainment mess that every car maker ends up with won't get in the way of temperature control. We had a Citroen before, and "make it warmer" was multiple menus deep down the terrible touch screen swamp. It was obscene.

I actually wanted that Mazda, which takes the same idea to the max, but I couldn't justify the cost difference just for the buttons (it also looks way cooler than the Ford of course, but ok). The Ford strikes a decent balance IMO - besides the 100% buttonized HVAC, it has a touch screen for all the touchy navigationy carplay-y stuff, but eg volume control and map zoom have physical dials and play/pause/skip all have physical buttons too.

My wife and me disqualified most other brands purely for this reason. We'd open marketing sites and skip through the promo photos until we saw a picture of the dashboard. No buttons? Close tab. I love that apparently more brands are now figuring out that "ipad on wheels" designs drive people away.
Defending Open Source: Protecting the Future of WordPress
I don't know anyone who doesn't say "I wrote X assembler" with complete understanding by all involved, and I definitely don't know anyone so pedantic they said "acksually, it's 'I wrote X assembly code'". I guess none of the dozens of assembly code makers or whatever I've know over the last 40 years was enough of a stickler. Or care one way or another.
I'd assume they meant a citizen ID card. Not an "I paid tuition" ID card, from a university which brags about having students from 60+ countries around the world.
Price's Law is "50% of the work is done by the square root of the total number of people who participate in the work."

https://dariusforoux.com/prices-law/

https://routine.co/blog/what-is-the-prices-law-and-why-is-it...
Cui bono? -- in both directions
Great post! I really enjoyed reading this, and can deeply relate to this on a personal level having worked in the developer security field for over a decade now (Stormpath -> Okta -> Snyk).

The only thing I have to add is that this same concept applies to just about everything -- it isn't just a cybersecurity industry problem.

- Bad writing keeps Grammarly in business
- Developers doing a bad job at confirming to a codebase's style guidelines causes code linters and formatters to stick around pervasively
- Bad authentication and authorization practices keeps Okta/Auth0 in business
- ... <the list goes on and on>
> Does go have a bad security reputation?

Depends on who's behind the keyboard.
Actual example from my experience:

Trying to figure out the correct AD groups/permissions I needed to use an internal web app to schedule patching for some servers I managed.

After stepping through the app's js, I realized they were doing user group retrieval and validaton client-side (!!).

Wrote a quick POC that patched their check and gave me admin permissions, then sent it and a description over to a friend on the internal app security team.

Not my job, but apparently the service account backing that app had permissions to reschedule patches on any internal server. (including f.ex. domain controllers)

So probably something that it was worth having someone spend a couple hours figuring out and reporting, despite it not showing up in my OKRs.
> There's no reason why Rust can't have its own Django

I'd argue that the ability to do `python manage.py shell` and get an interactive ORM session for debugging is a fairly major reason why Rust can't have it's own Django.
Against Brute Forcing
That is brilliant, thank you - I added the Rota one as an addendum under the further reading at the end.
you added the ultimate captive portal to a website a black wall without any more info asking for people email and data from google login D:
I don't disagree, it should be opt-in.

> Also, as I understand, they don't collect framerate in current version.

That seems reasonable, I haven't used Manjaro for a couple years so I didn't take the time to see exactly what they want to track. That's just an example though, they wouldn't bother collecting the data if there is actually no value to them collecting it. I haven't seen anything about them selling data, so I'd expect the value is in improving the product.
Aw darn, it's just about this song recorded from German radio in the '80s:

[1] https://www.youtube.com/watch?v=N_OJ2iSTSZI

[1] https://en.wikipedia.org/wiki/The_Most_Mysterious_Song_on_th...

Here I thought it was going to be news about the Lego Primo camel song...

[2] https://www.youtube.com/watch?v=JKpD-KkaBHc

[2] https://news.ycombinator.com/item?id=41907873

[2] https://old.reddit.com/r/tipofmytongue/comments/1fvz9zo/tomt...
There is not some guaranteed power dynamic.

Business is not all huge companies with infinite redundancy. There are 30M small businesses in America that employ 60M people. For the vast majority of businesses and teams, losing an employee hurts, and employees have lots of leverage. These business owners have to do the work to ensure redundancy, to plan their budgets and products and systems to ensure they can weather inevitable employee turnover. Plenty of businesses fail to do this and have to close their doors. It happens with regularity.

On the flip side, unemployment is the US is super low. It's true that workers can only hold one job at a time, but they are not "trapped" at a job. In fact, they have more mobility than ever, which also gives them leverage to negotiate for higher salaries or to hop jobs. Not to mention more gig jobs, remote jobs, and contract jobs than ever, even for highly paid positions. Sure, losing a job hurts. But the employees who plan for this possibility, who maintain skills, maintain savings, and live within their means, can find new jobs, just as businesses who plan well can weather employee turnover.

It goes both ways.

So if you're in a position where your employer has some huge power dynamic hold on you, is that some universal truth for all employees resulting from the nature of the employer-employee dynamic? I don't think so. I think that's the result of poor personal decisions, or bad luck at best.

All that said, I'm 100% on board with legal protections that set a high standard for employers. We have plenty of those already. And I'm 100% on board with government stepping in to help take care of people who fall through the cracks. For example, I love that COBRA allowed me to stay on my previous employer-provided group healthcare plan for 18 months(!) after my last job ended.

What I'm against is any cultural or legal change that begins to suggest that its employers' responsibility to keep their people employed. It's not. Financially, the system can't work that way. Employers are not our parents or our nannies or our caretakers, and we should not try to make them into that.
Is it really that bad software is bad, or that just like building a house, you need a team of different specialists to make your software? If you hire one person to build you an entire house from scratch, you're probably going to have issues somehow somewhere.
Location: Toronto
Remote: yes
Willing to relocate: yes
Technologies: react,vue,svelte,node.js,python,firebase,gcp,figma,postgres,nosql
Résumé/CV: https://olsz.me/docs/marcel-olszewski-technical-resume.pdf
Email: in my resume above
> I was hoping to like django more since I'm a professional python dev

This is my issue too!
Controlled with DECCOLM, mode ?3. Curious how many terminals besides xterm choose to support that one.
You mean a citizenship ID card, or ID cards that include citizenship status. Driver's licenses, etc are obviously not currently good enough, though maybe a Real ID is.
I couldn’t help but notice that he was working with two extremes, ruby and rust. A nice middle ground could have been nodejs with TS, with the advantage of using a single language throughout the project. While nodejs doesn’t have something like rails, its ecosystem is largely centered around building web applications.
>Your statement relies on two assumptions: (1) employers are reliable at determining "underperforming", (2) employers are making choices based of performance.

1. You could make similar arguments about consumers being qualified to determine product quality. Are retailers dumbasses for wasting money accepting returns?

2. When it comes to hiring/firing decisions, perception of competence is as important (if not more so), as actual competence (if you can even define that). No manager is going to be assuaged by "well actually, you're pretty bad at determining competence, so you should be glad that we're requiring you to file a bunch of paperwork before you can fire someone".

>There's no evidence that it makes "finding a job more difficult". There are entire swaths of this earth that have the framework that we're talking about and their job markets are just fine.

New hires rate in Europe (with famously stronger labor protections) is around 10% per year in 2022. US meanwhile is more than 4% per month.

https://www.cedefop.europa.eu/en/tools/skills-intelligence/r...

https://data.bls.gov/timeseries/JTS000000000000000HIR
Netflix is removing nearly all of its interactive titles
I hate these and hope they are heading out also. Our hands and fingers are built to receive touch feedback, and these specific kind of buttons negate all of that.
I don't know, I always thought it sounded simplistic, cheap and dated, even at the time. Placing stuff in the stereo field has been bog standard music production since the 70s. Q sound adds a _little_ bit to it, but somewhat importantly if you are actually listening to this song in a dance club it's all completely lost, a lot of clubs don't have any kind of stereo separation.

Just compare it to stuff that was coming out of the acid house scene at the same time (yes i know this song isn't really acid house -- but it does have a lot of fun stereo effects):

https://www.youtube.com/watch?v=qexS5hBB1C0
I agree, that's the european approach.
https://archive.is/VSIrF
I see how you could think that based on my phrasing, but presumably they have jobs because they do important work.

I didn't meant to imply they would or should sabotage anything.
I like your article, a big thing I think you miss though is 'database migrations' which I think Django does brilliantly well at managing for you.
Every year rails has a comeback and the next year it needs another one
Earlier today I said “after Jan 6th, nothing short of Putin invading to help sway the outcome of the election could shock me”

Maybe I’m in for a shock
> That sounds like rich apartments

I've lived in apartments most of my life, my guy. Literally every apartment I've lived in has had assigned parking or covered parking. That includes some crappy 70s-era housing with paper thin walls, lead paint, and no washer-dryer in the unit. Apartment buildings are generally required to have adequate parking for all residents. That's one of the building codes dense housing advocates want relaxed.

> You're talking about installing megawatts worth of cabling for EVs that nobody wants

They'd want it if it existed. I think we both agree it's a chicken and egg problem.

> Who are we to tell them that they are wrong about the risks?

Maybe they just gave a plausible-sounding excuse for ending an employee benefit?

> synthetic chemical power such as hydrogen

Hydrogen is a lower fire risk than Li batteries? Interesting...

> EVs are at present luxury items that only work for people who can shape their lives around charging requirements.

For people in single family homes who already own 2 cars, trading one out for an EV is a no brainer. I'm not describing particularly rich households.
>I just take a 1-US-cup measuring cup and fill it 3/4 full for each "cup" that the Zojirushi wants.

I thought 3/4 was one of the 'normal' measuring cups in a set, but just googled it and I guess it's not.
Fantastic Builders and Where to Find Them
> I just read that as "management has no idea how to evaluate the quality of work of their employees".

You probably couldn't explain how you walk, or how you cook an egg, or how you speak English, at the level of detail that would be required for something like this. Yet you do know how to do all those things.

Just because you can't write down detailed objective instructions for how to do something does not at all mean you have no idea how to do it.
Also Seymor gets into trouble because of his fascination with vintage racist carricature.
C# stands out a bit as it provides first-class manual memory management APIs, zero-cost abstractions and tools to do RAII like many other systems programming languages do. It's quite unlike most other GC-based languages once you look at it closely.

If anything, it allows you to go way more low-level than Go.
I had the same reaction. I first thought, well it's not that difficult to write an assembler for a simple 8-bit instruction set, but then upon reading the article it looks like it's instead writing programs in assembly language. Totally different.
Not sure how risky this really is for the Union. Their software engineers are taking a pay cut for the prestige of working for the most influential newspaper on earth. When your BATNA is getting a 50% pay bump somewhere else then strike away. God forbid if the servers crash while reporting on the second hand recount in Georgia next month.
I went to a record store a few months ago, with a full speakers, connected with actual wires.

I hadn't realized how much I missed that sound quality over the laptop and headset sound I've been listening to for years.
> You don’t think it’s reasonable to tell your employees that as a condition of employment they have to be at a specific location at specific times?

You think it's reasonable to hire someone remotely, then later forcibly relocate them to another, more expensive city, with no compensation? Because that's what's happened here.

In jurisdictions with stronger labor laws, that is not only not reasonable, but outright illegal (constructive termination).
I don't get this read, or your analogy really. Seems more like "former bible editor here; the author of the psalm about bible editor unions is also a member of a bible editor's union, so is probably not super anti-union. They're unlikely to be just presenting the pope's narrative."

Like I said, I don't get your analogy.
Only in tech do people get so aggravated by employee count.

Legacy companies have armies of consultants building pretty decks with little end-product to show for it. Never questioned. Every industry has a certain amount of slack built in. Large institutions (big Hollywood, govt, defense, medical services) have oodles of bureaucracy. Tech looks like a paradise in comparison. Yes, tech workers should seek to be more efficient. But, when viewed from comparative lens, tech is in the top tier of efficient industries.

Personally, I am not sold on tech unions. But, tech workers have uniquely low leverage within their profession. Tech lacks paid overtime or paid on-calls. Engineers are routinely expected to work evenings for meetings with off-shore teams. There is limited mobility because unlike doctors or lawyers/ engineers/ hard-tech engineers.... SWEs are frequently managed by non-SWEs. The manner in which remote work was revoked is a canary for the lack of lobbying power among tech workers.

Yes, tech workers are paid upper-middle class wages. But, the quality of life afforded by the profession has gone for a plunge since the 2022 layoffs. Companies have revoked all the pros of covid (flexible & remote work replaced with mandatory in office days and 9-5 hours). But, they've kept all the negatives of covid (work never ends, notification on all devices, global teams, smaller offices, fewer in-office perks). It's like companies want to have their cake and eat it too.

To that end, I empathize with any tech coalition that wants to lobby for better 'worker rights'. Union strikes may be a suboptimal way of doing this. But, it's better than nothing.
Exactly why I'm not planning to read or watch any news this week.

I see we share the same strategy. My new policy is that I shut the news off once the polls open on election day and don't turn it back on until the following morning. Over the course of my life, I'll accrue enough saved hours to have achieved something minor, yet meaningful.
Practical Betterments
I've worked with Rails, I've worked with Phoenix, I've also built with Rust and Svelte. I'd choose Rust+Svelte every time. Much better experience. Rust's async is not nearly as bad as people make it out to be.

Building new Rails apps is a blast, but dealing with old Rails apps is a pain, they're difficult to refactor.
New Rust apps are great, and dealing with old Rust apps is a much better experience as they're easier to refactor.