zawerf

People who get this should donate their excess bandwidth to a "worthy" cause.

For example e-hentai.org serve their images from a p2p system called hentai@home and their total network is only using ~4Gbit/sec:

https://e-hentai.org/hentaiathome.php

(or https://imgur.com/a/1H04buw if you don't want to login)

CAPTCHA isn't just a matter of protecting your site. One of the most evil attacks nowadays is "Distributed Spam Distraction", where you spam your victim with thousands of emails per second so an important email (e.g., fraudulent purchases) gets lost in the noise.

How do you do this in a world with decent spam filters? By using the victim's email to sign up for real services so they get hit with a welcome email. Because these are real services, spam filter won't catch it. This can only be done with services that have sign up forms that are easily automated.

The most evil thing here is your email is crippled even after the attack is over because these real companies will keep sending you newsletter and it's impossible to unsubscribe to them all.

Yea someone else also mentioned that generalization (called a tiered vector) in that thread: https://news.ycombinator.com/item?id=20873110

Express Helmet also turns it off by default and included a rationale for why (tldr: privacy leaks when there are random external links posted on a page): https://helmetjs.github.io/docs/dns-prefetch-control/

There was a really interesting post on this topic recently where you have a circular array of circular arrays of size sqrt(n). [1]

The result is you can do O(1) access, O(sqrt(N)) insert and delete at arbitrary indices, and O(1) insert at head and tail.

In terms of big O this is strictly better than:

- arrays: O(1) access, O(N) insert/delete in middle, O(1) insert/delete at tail.

- circular arrays: O(1) access, O(N) insert/delete in middle, O(1) insert/delete at head and tail.

- fixed page size chunked circular arrays such as the c++ implementation of std:deque which is still O(N) for insert and delete. [2]

[1] https://news.ycombinator.com/item?id=20872696

[2] https://stackoverflow.com/questions/6292332/what-really-is-a...

I think people are supposed to report their salary with the stock price at grant, not after appreciation (at least on levels.fyi). But yea it's a lot more because google stock is half their comp and it keeps doubling every 3-4 years.

It's no secret that content moderators moderate content. Most of the stuff on HN is shaped by a few people who gets to decide what's interesting enough to get a boost or not.

It definitely feels like gaslighting when you notice it happening. For example a few times I know I made a comment on an old article the day before but it didn't get traction. But then it would be on the frontpage again the next day with all the timestamps manipulated to seem fresher, including on my own comments! I know I was sleeping at that time so then I start questioning my sanity and whether I was sleepwalking or not!

It wouldn't help if new features extend the capabilities of existing stuff (which is done all the time). For example the CSS Shader example from before adds new syntax to the existing 'filter' css style, which you might've already whitelisted because it is safe today.

I am always irrationally(?) scared of using these sanitizers despite their successful history. As soon as new html/js/css syntax/features are introduced, won't your security model need to be reevaluated? Which seems like a lost cause at the rate new capabilities are introduced to the web. E.g., when CSS Shaders lands, you might be able to execute arbitrary gpu code with just css (hypothetically speaking, I don't actually know how it will work. I am sure it'll be sandboxed pretty well. But the problem remains that there are too many new possibilities to keep up with!).

(We're getting way off topic) but I think the problem with auto increment is that it can't be sharded easily since multiple shards can increment to the same value. If you then try to go back to random ids you're now stuck with 8 bytes which will conflict once every billion items or so. I guess it's pretty extreme premature optimization but I think UUID is nicer for future-proofing at the cost of some performance. (I would love to see benchmarks to know exactly how much performance I am giving up though)

By the way uuidv1 is already prefixed by a timestamp! But unfortunately it doesn't use a sortable version of the time so it doesn't work for clustering the ids into the same page. I think it was really designed for distributed systems where you would want evenly distributed ids anyway.

I am trying this out and I am still on the edge of whether I like it or not.

Create a table with a json column:

  CREATE TABLE Doc (
    id UUID PRIMARY KEY,
    val JSONB NOT NULL
  );

Then later it turns out all documents have user_ids so you add a check constraint and an index:

  ALTER TABLE Doc ADD CONSTRAINT check_doc_val CHECK (
    jsonb_typeof(val)='object' AND
    val ? 'user_id' AND
    jsonb_typeof(val->'user_id')='string'
  );
  CREATE INDEX doc_user_id ON Doc ((val->>'user_id'));

I think the postgres syntax for this is pretty ugly. And if you also want foreign key constraints you still have to move that part of the json out as a real column (or duplicate it as a column on Doc). I am not sure it's even worth it to have postgres check these constraints (vs just checking them in code).

I am also a little worried about performance (maybe prematurely). If that document is large, you will be rewriting the entire json blob each time you modify anything in it. A properly normalized schema can get away with a lot less rewriting?

Technical note: big oh isn't a useful measure here. Most databases use b-trees (yes, even mongo) so lookups are at best O(log(n)). That goes for you and the people replying too.

The constant factors are way more important here. It's a 1000x factor difference depending on how durable you need your data to be (whether you need to write to disk or a quorum of network nodes in multiple regions). That is basically the only thing that mattered in the recent mongo vs postgres benchmarks.

Here's the guy he said he got inspiration from: https://jakealbaugh.com/

I think if liked those you would also like:

http://acko.net/

http://worrydream.com

I think we're way past that point already. Everyone with a phone already has their location tracked at least by their phone company. You might've even given it away to other companies willingly: https://www.google.com/maps/timeline.

I don't think there were that many unintended consequences from this tech. We got better traffic jam maps. And maybe a handful of criminals who forgot to leave their phone at home got caught.

I think this is one of those things that people growing up with the tech won't think anything of it (mom wants to always know your location) but old geezers will reminisce of a time where we still had to call a landline and talk a friend's parents first to see if they are home.

I didn't believe that number but it seems like it's true if you restrict it to just north america monthly active users: https://thespring.io/investing/facebook-makes-more-revenue-p...

Average revenue per user is around $25 for global users.

This brings up a related issue that not all users are equal. Even in non-data mining business models, you still have some segment of the users subsidizing another.

The two communities have surprisingly different cultures (despite having high content overlap).

I have recently been struggling with versioning(and learning devops in general) myself so I would love to hear more on this topic. For example if you rollback a deployment (or if you just have browsers who haven't refreshed yet), how do you make sure browser clients are talking to the right api backend version? How do you force them to upgrade or rollback? Will they even be routed to the same api server on multiple calls?

This is especially bad with long-lived single page apps.

(I already use immutable static files auto generated/hashed by create react app. I rely on cloudflare to cache them forever rather than never deleting from the build though)

It's sad that you're getting downvoted.

I was trying this out on my phone and although I had to switch to landscape to make the UI fit, it was buttery smooth!

I was really impressed with the sheer amount of features included, many of which I have never seen implemented in any other web based editor.

Figma is pretty successful and is written in C++ compiled to webassembly:

https://www.figma.com/blog/building-a-professional-design-to...

https://www.figma.com/blog/webassembly-cut-figmas-load-time-...

I don't work with webgl much but I remember there being a max texture size of around 2048 or 4096 on many devices. Wouldn't you end up needing to tile the texture and stuff?

Machine learning researchers aren't working on language modeling because they want to enable fake news.

They are working on it because it improves all downstream NLP tasks. See: http://ruder.io/nlp-imagenet/. BERT, Elmo and XLNet all fall under this use case.

For example if you're trying to recognize speech or translate some text, it helps a lot if you can start off producing something that is statistically grammatical even if the content is nonsense.

I was expecting this to be about fractional cascading which is a really clever trick: http://blog.ezyang.com/2012/03/you-could-have-invented-fract...

I upvoted for Terry's very insightful meta-commentary on when partial results can or cannot help with the full proof: https://terrytao.wordpress.com/2019/09/10/almost-all-collatz...

I thought it was interesting how mathematician have techniques to easily prove something for the 99% case but still have the general problem be completely unapproachable.

(and because collatz is famous, terry is a fields medalist, etc)

This is a pretty tame use of the 2012 Linkedin breach. The breach also contained unsalted hashes which has mostly been cracked by now.

They all ended up in a huge collection (773 million records) containing email/password pairs from many different sources: https://www.troyhunt.com/the-773-million-record-collection-1...

With so many password variations for a user, you can do credential stuffing to crawl all the private accounts of an email to build a pretty complete profile of the person (not just correlate some linkedin profile like in this post). I am sure someone out there is already doing this for profit.

Can you describe how you can exploit this?

It's good for defense in depth, but you have to pwned the user in another way to set the cookie in the first place right? If you're using httpOnly cookies you should be fine?

(Not an expert and genuinely want to know because it seems like the node.js ecosystem doesn't consider it a problem worth fixing either: https://github.com/jaredhanson/passport/issues/192 )

> know which modules are well supported, and will be for the years coming

Doesn't matter if you're coming from outside or not, no one can predict the future.

For example winston was probably the most recommended logging library (14k stars) and was a good recommendation at one point. But then they decided to do a rewrite for v3 which introduced a ton of bugs and incompatibilities. I spent several days trying to get it to log in the old format and failed and ended up downgrading back to v2.

This is a recurring theme in the js ecosystem (another example is react-router which is just a huge piece of shit and no one should depend on it despite its 37k stars).

They are the same people behind the javascript port of the tesseract OCR engine: https://github.com/naptha/tesseract.js

Here's an online notebook for trying it: https://observablehq.com/@tmcw/tesseract-js-v2-alpha

I remember uninstalling this due to malware reasons. I guess it has been resolved for a long time now?

"Our Copyfish extension was stolen and adware-infested": https://news.ycombinator.com/item?id=14888010

The Count of Monte Cristo

I felt like racism against asians did get a little worse this year. A lot of it is probably due to china coming up a lot more in the news so I start noticing the stereotyping/generalizations surfacing in the comment threads. Usually we get all the good stereotypes (e.g., harvard needs affirmative action to keep us out). But more recently the highly upvoted news were about how you shouldn't trust someone chinese because they are here to spy on you or steal your intellectual property for china.