mattkopecki

Consider something like a Whoop or Oura Ring which monitors health metrics but doesn’t rely on a watch? That’s what I’ve settled on so that I have the best of both worlds.

This is the problem my company solves. I won’t plug it here, but my email is in my HN profile if you want to reach out

Rezilion works at runtime when the Gitlab runner spins up a container for testing the app. Rezilion observes the contents of memory and can reverse-engineer back to the filesystem to see where everything was loaded from.

In the CI pipeline this depends on your tests exercising the app, but when you deploy Rezilion into a longer-lived environment like Stage or Prod then you may get some new code pathways that are used, although most find that the results aren't surprisingly different between all of the environments.

There are definitely other approaches that don't require code to be uploaded anywhere. For example, we (https://rezilion.com) work with your package managers to understand what dependencies your program has, and then analyze that metadata on the back end. Net result is still to be able to see what vulnerabilities are truly exploitable and which are not.

Gitlab Ultimate uses Rezilion to accomplish a similar aim. Rather than using the principle of "reachability", Rezilion analyzes at runtime what functions and classes are loaded to memory. Much more deterministic and less of a guess about what code will be called.

https://about.gitlab.com/blog/2022/03/23/gitlab-rezilion-int...

Here is a good writeup of some of the pros and cons of using a "reachability" approach.

https://blog.sonatype.com/prioritizing-open-source-vulnerabi...

>Unfortunately, no technology currently exists that can tell you whether a method is definitively not called, and even if it is not called currently, it’s just one code change away from being called. This means that reachability should never be used as an excuse to completely ignore a vulnerability, but rather reachability of a vulnerability should be just one component of a more holistic approach to assessing risk that also takes into account the application context and severity of the vulnerability.

Shameless plug: my company has launched an alternative authentication modality that eliminates this issue, yet is also app-less and requires no download. It is also not limited in the ways FIDO authenticators are today, yet provides the same level of security because it can actually leverage FIDO authenticators if needed. Soft launch was last week. Email in my profile if this piques your interest and I can send more info directly.

It's really unclear to me what your product is. I would have given up trying to figure out if you hadn't implied that it's somehow related to what this cool blog post accomplishes.

From the FAQ, my best guess is that you offer businesses bank accounts that come bundled with the reporting you'd get with something like Mint/Quickbooks?

It's OK to basically be two services glued together, but why are you better than just the two existing services, were they to be glued together?

I clicked thinking it was a sci-fi piece about a future where historians inspect the remains of our current society. Amazon had grown to be so significant that the future generations regarded this whole period and all our cities as Amazon

This just means that you need to add that script kiddie scenario to your threat model and prioritize it accordingly.

So, in any case, the FCC has set limits for acceptable amounts of radiation exposure from certain classes of the electronics that we find all around us every day, and I guess I was just wondering how those limits would compare to the radiation dosage of these vans.

It might not be approved by the FCC, but if it's equivalent to something that the FCC would allow you to carry around in your pocket anyway, it's hard to justify being upset these vans driving around from the perspective of being exposed unawares to their radiation.

There are a number of other reasons to be upset about such vans, though.

> If I shine my high beams on your car, or have a cellular phone call next to well - too bad. I'm entitled to bombard you with radiation if I want to.

I think this is a really good point, actually. Do all these electronic devices need to be FCC approved? And if so, how do these vans' dosage gybe with any FCC regulations?

> 4) Alternate company, takes lower margin, pays drivers well and offer better customer experience.

It doesn't seem to me that your crucial step will work. Uber is worth >$50bn, but more importantly has a substantial amount of cash on hand. I can't imagine anyone could out last them in a price war.

> Doing some back of the envelope calculations I can't see any scale where they are profitable given their current fee structure.

“We lose money on every sale, but make it up on volume”

> All the logical advice (exercise, go to sleep on time, live a healthy lifestyle) are things that I struggle to find the motivation for.

In my experience, that is largely the point. Take "cold showers", for example, as this is something that is regularly suggested in cases like this. Is there a benefit to actually being in a cold shower? Tough to say. But really, the benefit is that it's a small-bit-slightly-unpleasant task that's easy to avoid, and if you make yourself not avoid it, you build some small momentum for other things in your life that you lack motivation for. If you can muster the courage to stare into the shower head and turn it to cold, it doesn't really matter how long you wait until you turn it to hot after that.

I work in a huge enterprise that will not allow any company data on third party servers. I also am constantly in need of ways to collaborate with team members on multiple different projects. But, I can't use any hosted webapps and have no way to set up my own instance within our company.

If there was an on-premise whitelabel version of this, and my colleagues and I could create new shared task lists for each project without having to install anything, that would be amazing.

I recognize that this is just the MVP, but consider this a suggestion for later if you want to scale this up and add an Enterprise tier.

Actually, FWIW I think lala's technology (matching songs based on the audio waveform instead of the file's metadata) was used to underpin iTunes Match. It is the component where you match your local library to Apple's library in the cloud, and then only upload anything that Apple doesn't already have.

> But is looking bad in the media worth human dignity?

Of course not. But, is you looking bad in the media worth someone else's human dignity? That's a much easier sell.

Based on your experience, would it be difficult to decouple the assessment of an instructor from the test results of his/her students? If the assessment of a student's learning comes from somewhere else, what other mechanisms could we use to evaluate the effectiveness and (or) competence of their instructors?

I've had similar results while in school when submitting plain old lab reports, writeups, research papers, etc.

Except I cut out the middle step and just downloaded the standard / most recognizable TeX font, and used it in Word: http://en.wikipedia.org/wiki/Computer_Modern