ksml

They're serving the wrong cert on pkg-containers.githubusercontent.com (it's for *.githubassets.com) and their support site also expired 3/21... https://support.github.com/ What is going on over there?

They're serving the wrong cert on pkg-containers.githubusercontent.com (it's for *.githubassets.com) and their support site also expired 3/21... https://support.github.com/ What is going on over there?

Go and Java can memory leak too. Furthermore, they are susceptible to data races that are not possible in safe Rust.

It's a silly exaggerated example. Point still stands, at least from my experience. Even with a rubric, people still (intentionally or unintentionally) find ways to do things that circumvent the learning goals/outcomes of the assignment

Meh. That sounds nice in theory, but there are many good practical reasons to keep answers private. The number one reason for me is it's very hard to build high quality exercises and assignments, and much easier for students to plagarize off answers on the internet. Reducing the temptation to cheat is pretty important for me.

Q: What has been your best investment?

A: My best investment has been a company that has been a good investment.

Very good.

Agreed. I think the lack of dedicated F-row is a dealbreaker for me, as I use the media control keys pretty often

Just want to mention that his email is on his blog, and he's surprisingly responsive for having such a big following. I once wrote him with some unrelated questions and he gave me a detailed response, which I really appreciated!

I don't think anyone is saying depression is your choice. No one chooses to be depressed, and I would never judge someone badly for being depressed. There's no shame in that. It's what you do about it that matters.

Therapy can take time to make a difference, but I would encourage you to give it a try!

I'd love to hear more

I agree with other comments saying that this is going to depend on what you're looking for and on your personal situation -- there is no job that is right for everyone.

That being said, I recently joined Coda as an SRE, and I have really enjoyed it so far. Company size is in my personal sweet spot: the team is small enough that it still has the startup aspects of having visibility into everything happening in the company and being able to work on anything you feel is important, but it's big enough that things are relatively stable, there are lots of resources, there aren't fires all the time. The team is incredible: everyone I have worked with is extremely capable but also extremely nice and humble. Many people joined from highly unconventional backgrounds but Coda hired them for their passion for their roles. I have also felt that the company prioritizes employees in ways both big and small, from little things (e.g. every interview started with checking in to make sure the time was still okay, nice gesture with the chaos of online/remote interviewing) to big things like comp/equity (instead of stock options, you have the option to receive the equity as a grant, or as a loan if you don't have capital to pay the taxes on a grant, and you have the option to sell some stock in every fundraising round even though we aren't public). Several of the founders had kids while starting the company, so there was a strong culture of work/life balance from the beginning. We have our share of tech debt, but so far I have thought the codebase and tooling have been really high quality too.

Email in my bio if you want to chat.

I think the bigger issue is with dishonesty in numbers. They're advertising a different set of numbers to students, and it does not seem like they're being very transparent with the process

That sounds like a pedagogy problem, not a language problem. From my experience [1], students learn JS just fine as a first language, as long as the learning process is structured well. Every practical language has its quirks, and no one learns a programming language by learning all the quirks at one time. You can be productive in JS without understanding all of the quirks, and then build up to that later.

When you're teaching, you should be enabling the student to do one more thing that they couldn't do before. If you're spending 30+ minutes trying to explain what an object is, you're trying to do way too much. You don't need to have a 100% complete and correct understanding of Javascript's object model to use objects.

> Contrast that with something like Java or even Rust where, despite the other complexities, it's pretty clear what the data is and how it is stored.

That's nonsense. Particularly with Rust, now you're deep in the weeds of pointers, stack vs heap vs other segments, and borrow checking rules.

[1] helped design a JS class at Stanford for first-time programmers. Also designed an intro Rust class.

No, parent comment isn't false, even if the wording could be more precise. It is true that M1 CPUs do not execute x86 instructions, but the machines do, in effect, execute x86 binaries. Also, M1 does have added instructions for TSO to improve performance of translated code.

Please stop being so hostile to other users. It really doesn't add anything. You have made some factually questionable comments yourself, and I say this as someone who has worked on JIT aarch64 translation very similar to Rosetta 2.

I really don't get why you're so hung up on this server thing. Yes, a phone is not a server. But it still runs a lot of complicated software. Software has bugs. We haven't found all the bugs yet. Hence, it's important to keep all of the software as up-to-date as possible for when people find some of the bugs.

> Your car has pieces that run linux too. Guess an attacker can make you crash.

Actually, yes... https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... http://www.autosec.org/pubs/cars-usenixsec2011.pdf

> the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine.

Just because the kernel is getting updated does not mean the drivers and firmware are also getting updated. Drivers are specific to hardware, and if a vendor stops shipping updates for some chip that is no longer used in newer phones, then you aren't going to get updates for that chip.

> since this is about iphone and android comparison

This isn't about iphone and android comparison, not for me. You made naive claims about kernels not having attack surface and unimportance of staying updated, and I am responding to those claims.

I think you're terribly naive if you think a phone kernel has no attack surface. It is absolutely a security risk to run an outdated kernel. It has nothing to do with whether there are services running for a hacker to connect to; it's about whether it's possible for an attacker to trigger buggy behavior somehow, whether that's sending malformed packets or Bluetooth frames or invoking patterns of syscalls that cause bad things to happen. Heck, here's an obscure bug in Linux on the front page of HN right now, which Android is based on: https://googleprojectzero.blogspot.com/2021/10/how-simple-li... Also, I know GP was specifically talking about upgrading the kernel, but keeping drivers patched is much harder without vendor support, and there's likely to be more attack surface there.

Based on your phrasing of the SEC definition, the real estate market also feels like it fits the bill :-/

Edit: parent comment was edited, originally said:

> It actually matches the SEC definition of a Ponzi scheme haha, which happens to be a little bit less restrictive than a traditional definition.

> It's a negative sum wealth redistribution scheme the takes money from new entrants and gives it to miners and to old entrants. The miner portion is what makes it negative-sum.

A zero day is a zero day, regardless of whether it's been exploited in the wild. There's a decent chance that well-funded bad actors have already found these, and you have no idea whether they've been used or not.

They seemed like strong iterative updates to me? I also appreciate all speech recognition being done on-device

It's taken directly from the source press release title, following HN guidelines

But the entire premise of decentralized finance is to have no central authority, is it not?

Can you give an example?

Whoa. Do you have any links I can read about this? That sounds incredible

The WD response to the original bug report (from https://www.wizcase.com/blog/hack-2018/):

> The vulnerability report CVE-2018-18472 affects My Book Live devices originally introduced to the market between 2010 and 2012. These products have been discontinued since 2014 and are no longer covered under our device software support lifecycle.

So support can be discontinued after two years after introducing a product??? That's ridiculous. It's not even like this was a one-off product and they're no longer supporting that line of work. WD still sells MyBooks.

In bernal heights, someone smashed my window and stole my camera out of the back seat of my car while I was in the car. It was quite traumatizing, and I don't really like going to San Francisco anymore. (They knew we were in the car, but went for it anyways. Pretty brazen, and they got away with it.)

This is really interesting. Prior to this, Firefox's isolation model was much weaker than Chrome's due to only having a pool of 8 content processes. If I'm reading the technical blog correctly [1], this will move to a process-per-site model without also doing process-per-tab as Chrome does, i.e. if you have several tabs open on the same site, they'd be in the same process. This seems much less resource intensive than Chrome's model while still delivering similar security properties.

[1] https://hacks.mozilla.org/2021/05/introducing-firefox-new-si...

I think there were two main reasons: choosing a popular language (JS and python happen to be among the most popular, accessible languages) and pedagogical simplicity (it's nice to avoid burdening beginners with extra syntax when they're already struggling to learn other things). Some unscientific evaluation showed that students picked up static types just fine in our second programming class (which is in C++)

Personally, I think we should be teaching static types and I pushed for Typescript, but it didn't happen.