Hacker News Reader

lwfon U.S. Postal Workers Were on the Front Lines Before. They Were Ignored

It's the other way around: bulk mail is incredibly cheap to sort, route, and transport, and it's that which subsidizes your hand-addressed letters.

The USPS literally has a service "deliver this flyer to every residential mailbox in this ZIP". It's cheaper per-item than a letter, yes, but the margins on "stuff a bunch of identical objects into N boxes" are much higher than "figure out which of N boxes this 1 unique mailpiece goes to".

lwfon Don't Make Students Use Eclipse

> what he wants students to learn early on

The author, Leonora Tindall, is a woman.

lwfon Apple and Google partner on Covid-19 contact tracing technology

Realistically, what does sub-metre accuracy help with "evil" (catch-all for all non-disease-related) surveillance that, say, a 5-10m is insufficient for?

lwfon Authors, Publishers Condemn the 'National Emergency Library' as 'Piracy'

Their online emulators are explicitly authorised via a DMCA exception granted by the Library of Congress, c.f. https://archive.org/about/dmca.php

> Following deliberation, the Copyright Office ruled in late October 2003 that four exemptions should be added to the anti-circumvention clause of the DMCA, to be valid until the next Copyright Office rulemaking in 2006, including two that are related to the Internet Archive's original comments: >

> Computer programs protected by dongles that prevent access due to malfunction or damage and which are obsolete. > Computer programs and video games distributed in formats that have become obsolete and which require the original media or hardware as a condition of access.

lwfon Zoom iOS app sends data to Facebook even if you don’t have a Facebook account

"Video Conferencing app", not venture capital.

lwfon MessagePack: like JSON, but fast and small

As long as you know the length of the entire buffer, you just ensure that:

  current_addr + message_len - start_addr < buffer_len

Or am I missing something?

lwfon Disney blocks John Oliver’s new episode critical of India’s PM Modi

Write up a "compendium of SF housing policy complexities" article and post it to HN, then :)

lwfon Google Fonts Analytics

To answer "track users across different websites", I think they pretty clearly say the opposite:

> The Google Fonts API is designed to limit the collection, storage, and use of end-user data to what is needed to serve fonts efficiently.

> When millions of websites all link to the same fonts, they are cached after visiting the first website and appear instantly on all other subsequently visited sites. [...] The result is that website visitors send very few requests to Google: We only see 1 CSS request per font family, per day, per browser.

I guess, what would you want to see that would assuage your concerns, beyond what is written in the FAQ?

lwfon FAA faces dilemma over 737 Max wiring flaw that Boeing missed

Sadly, at least in the US, we have lower safety standards for cargo than passenger aircraft.

For example, crew rest requirements adopted in 2010 don't apply to cargo: https://ttd.org/policy/ensure-one-level-of-safety-for-all-ai...

lwfon The Iowa Caucus, Pseudo-Events, and Hyperreality

There were also "app problems" and late results in the 2016 Iowa Caucuses.

Linked from the article:

https://www.wired.com/2016/01/the-low-tech-high-stakes-iowa-... https://www.politico.com/story/2016/02/how-iowa-democrats-co...

lwfon Pantone 448 C

For the lazy who want quick references to each:

https://www.google.com/search?q=color+picker+4A412A

https://www.google.com/search?q=color+picker+FF00FF

lwfon A Twitter app bug was used to match 17M phone numbers to user accounts

https://www.washingtonpost.com/national-security/former-twit...

In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."

lwfon Shopping Sucks Now

https://en.wikipedia.org/wiki/Cannabidiol

lwfon Privacy analysis of Tiktok’s app and website

Just because the bucket says "tiktok" in the name, doesn't mean it's in any way associated with them. This appears to be ~1000 videos, anything particularly interesting about it?

(My company gets many such reports; sadly researchers often strongly insist otherwise)

lwfon A Week in the Life of a McDonald’s Cashier

Yes, it's mentioned once, in the context of her not having affordable insurance options.

> At 29, Brown works approximately 40 hours a week, splitting her time between a McDonald’s in Durham, North Carolina, and a food-service gig a local hospital. “It’s still not enough,” she said. Both jobs are part-time, and she doesn’t receive health insurance through either employer. She can’t afford insurance on her own, either. That’s a problem since Brown is diabetic, and she has to pay for her medical expenses out of pocket. She’s trying to do all she can on her own—she receives no food stamps or other assistance, she notes—but it rarely feels like she’s doing enough.

lwfon Wikipedia Has Cancer (2017)

The latter two of your questions are answered in https://meta.wikimedia.org/wiki/Wikimedia_Foundation_reports... .

>"In-kind service revenue” includes goods and services that the Wikimedia Foundation would normally pay for, but have been donated to us at no charge, such as bandwidth and hosting services and pro-bono legal services. Further detail is available in ...

> "Other operating expenses” include expenses for facilities such as rent and office and non-office supplies, insurance, annual staff meeting, recruiting, staff development, property taxes and Wikidata project funding.

You can find a more detailed audit report at https://upload.wikimedia.org/wikipedia/foundation/6/60/FY17-...

lwfon Wikipedia Has Cancer (2017)

Technically, they could sell the domain & the new owner could maintain the site as-is, but I really don't think that'd happen.

The WMF is mission-driven. A large swath of their funds are spent as grants to other organisations, and they could par that back without affecting their ability to operate.

[disc: Wikipedian since 2004, many friends who are WMF employees]

lwfon List of Fictional Microsoft Companies

Egads? It's a standard term, https://en.wikipedia.org/wiki/Back_office

lwfon Lines of code that changed everything

Is "roomba routing" an industry term? I couldn't find it from a Google search, but I like it.

lwfon Microsoft REST API Guidelines

POST is effectively the catch-all verb. There's nothing that violates HTTP spec in having a site that only has one endpoint, `POST /`, that specifies the actual JTBD somewhere in the request body. It's simply nasty and unidomatic.

c.f. https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html

User agents still don't support PUT et all in forms without JavaScript -- you're limited to GET/POST, c.f. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/fo...

lwfon Uber Hit with $650M Employment Tax Bill in New Jersey

Both, although it's possible it's only "Raiser" in some locales[1] as a typo — Uber's liability insurance paperwork[2] and site[3] refer exclusively to "Rasier".

[1]: http://tsa1.nv.gov/ActiveCertificatesDetail.asp?cCertNum=TNC...

[2]: https://ubernewsroomapi.10upcdn.com/wp-content/uploads/2019/...

[3]: https://www.uber.com/global/en/cities/washington-dc/

There's at least one document[4] where Rasier LLC forms a subsidieary `Raiser-CA, LLC`.

[4]: https://www.vice.com/en_us/article/9kwjz5/unicorn-trank-and-... , specifically https://video-images.vice.com/_uncategorized/1500911986571-S...

lwfon Truckers sue California, say new gig economy law would kill 70k jobs

Increasing mail volume by one newspaper per household will not result in a comparable increase in mail carriers -- they're making the trips anyways.

lwfon Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional

Unless they claim to be acting in "Good faith", that is, didn't think at the time that the search was improper and it wasn't clearly settled law.

https://en.wikipedia.org/wiki/Carpenter_v._United_States#Sub...

You can win a Supreme Court case about a search being illegal, and still have that evidence be used to nail you on the original charge.

lwfon Court: Suspicionless Searches of Travelers’ Phones and Laptops Unconstitutional

Unless they claim to be acting in "Good faith", that is, didn't think at the time that the search was improper and it wasn't clearly settled law.

https://en.wikipedia.org/wiki/Carpenter_v._United_States#Sub...

You can win a Supreme Court case about a search being illegal, and still have that evidence be used to nail you on the original charge.

lwfon Thank You, Guido

Go's the other best-supported infra language, Rust is used for things like block storage (Magic Pocket). There's some amount of Java and C++, but those are all considered legacy.

Yet, most application engineers are still writing Python on the backend and TypeScript for the frontend.

[I work at Dropbox]

lwfon Vulnerabilities exploited in VPN products used worldwide

I agree — band-aids aren't per-se a bad thing. However, a VPN isn't the ideal end state. Even if you can't modify the underlying application, the goal should be "wrap in a reverse-proxy that handles authn / some-amount-of-authz so you can minimise the risk".

VPNs handle network security, but don't protect you against an attacker able to compromise an endpoint in your corporate environment.

lwfon Vulnerabilities exploited in VPN products used worldwide

Of course they're used for security -- VPNs are a hassle for users and admins, it'd be easier for everyone (except security!) if all internal apps were just public on the internet.

VPNs are a band-aid / work-around for "we don't have strong authentication and authorization on all services". That's fine, not everyone can do the latter, and they can provide some safety v.s. the anonymous attacker case. But too often they lure IT environments into a false sense of security.

lwfon A patent lawsuit against GNOME

For clarity, though, this case was dismissed without prejudice on the basis of an improper venue.

The patent still looks bogus, but don't draw any premature conclusions from the above-cited case.

lwfon 9th Circuit holds that scraping a public website does not violate the CFAA [pdf]

Even if the case was tried today, 9th Cir. isn't binding on other regions of the US, and there's a bit of a split, as detailed in the opinion[1]:

> In recognizing that the CFAA is best understood as an anti-intrusion statute and not as a “misappropriation statute,” we rejected the contract-based interpretation of the CFAA’s “without authorization” provision adopted by some of our sister circuits. Compare Facebook, Inc. v. Power Ventures, Inc., 844 F.3d 1058, 1067 (9th Cir. 2016), cert. denied, 138 S. Ct. 313 (2017) (“[A] violation of the terms of use of a website—without more— cannot establish liability under the CFAA.”); Nosal I, 676 F.3d at 862 (“We remain unpersuaded by the decisions of our sister circuits that interpret the CFAA broadly to cover violations of corporate computer use restrictions or violations of a duty of loyalty.”), with EF Cultural Travel BV v. Explorica, Inc., 274 F.3d 577, 583–84 (1st Cir. 2001) (holding that violations of a confidentiality agreement or other contractual restraints could give rise to a claim for unauthorized access under the CFAA); United States v. Rodriguez, 628 F.3d 1258, 1263 (11th Cir. 2010) (holding that a defendant “exceeds authorized access” when violating policies governing authorized use of databases).

weev was tried in an area under the 3rd Cir. jurisdiction. Somewhat interestingly, his conviction was thrown out in 2014 on venue grounds (e.g. being tried in NJ), without addressing the statutory question.[2]

[1]: pp. 27-28 [2]: https://en.wikipedia.org/wiki/Weev?oldid=912921723#cite_ref-...

lwfon Old Technologies Never Die, They Just Don’t Get Updated (2010)

You can also just scroll down to read the entire article.