I'm divided on this one. On one hand, I can see a lot of good in this, because, well, I'm on HN.
On the other hand, I think people would find it weird that anybody would be allowed to do that IRL with physical building, so why allow it on the internet?
Given that the consequences of probing a website are less than cracking on an office, and the surface of attack bigger on a website, with potentially a larger cascade, I think I can find more arguments for than against.
The physical world and the Internet are completely different environments, and analogies don't transfer. In the physical world attackers are resource constrained, create evidence that allows for attribution, post-facto enforcement is mostly successful, attacks are mostly destructive, and security can only ever be "good enough" bar.
Meanwhile in the electronic word, many attacks can be easily scaled/automated so they're always happening, attribution is very hard, there's little post-facto enforcement especially across borders, most attacks don't do much damage in and of themselves, and most security problems are logic bugs which are yes/no affairs.
It's not particularly interesting if a "white hat" physical attacker demonstrated they could get into a safe with a drill over the course of a week. And one probably can walk down a street testing businesses' doors after hours without too many repercussions if you're dressed nice and don't fit the cops' stereotype of "criminal".
Also there's a huge tendency in the digital security world for system owners to play up damages from minor break ins or even mostly innocuous actions (eg port scans), to distract from the humiliation of themselves having failed. And if we did want to make punishment more in line with real world analogs, then the penalty for most unauthorized accesses should be akin to misdemeanor trespassing.
Like with physical business, if you can't guarantee proper security - you should not be in this business.
Companies cut costs on cyber security whenever they can. And if you try to expose it you can get sued. It's about time this ends. Hopefully everywhere soon.
There are millions of small businesses that have an online presence and no way to protect themselves against a physical building penetration.
Heck, most administrations can't. A small town city council cannot be expected to have the budget or expertise to deal with someone trying to break in.
> Like with physical business, if you can't guarantee proper security - you should not be in this business.
What's an example of a business that can guarantee proper physical or computer security? I can't think of any. All I know about managing security is that you first acknowledge that you can't ever be completely safe. I'll assume you mean they guarantee that they have done due diligence to reduce their threat profile — which isn't really saying much either.
I find this weird also. The explanation I've been able to come up with is that there isn't prosecution on the internet the way that there is IRL. You're just screwed if you got hacked by someone whose VPN provider didn't already have a tap order in place on this customer. Without deterrence, the only remaining thing you can do is make it impossible to perform in the first place.
No, it's a straightforward legal hack to preserve the "full faith and credit" of the United States in the event that the political party that markets themselves with "fiscal responsibility" kayfabe forgets they've only been acting.
The reality is if the people managing the massive funds that run the stock and bond markets don't think it's different than the government doing what they normally do, then they'll be find.
This loophole keeps getting brought up, so I just wish someone would do it so we get an answer either way.
(If they are smart, they will mint $1m coins, or $500m or $1 billion; some of those would get snapped up by collectors immediately)
If a million $1M coins were minted, they would be too plentiful to be collectors items. If a thousand $1B coins were minted, there aren't enough billionaires to afford collecting them.
I suspect the markets will simply be thrilled that US debt that is constitutionally sacrosanct, is no longer held hostage to the whims of a few legislative terrorists.
If the govt mints a $1Tn platinum coin and the SC does not intervene to overturn it, it would boost markets significantly because it would permanently eliminate 1 class of financial terrorists in the legislature.
If you read the article you'll see they mention that this is only possible with platinum coins. So I think their motivation for using a coin is because it's only possible with a coin.
Django comes with a lot: auth, caching, csrf protection, an orm, the admin, form workflow, templating, migrations, i18n, and yet doesn't come with thousands of deps.
I know of a 15 years django project that runs on 2.7 that is still making money. It got reinstalled this month on brand new Ubuntu servers out of a rubbish requirements.txt, and it worked.
Django can also serve a boatload of concurrent users, way more than one would think. It is a boring, old-fashioned, but stable and very functional framework.
Maybe django is less so a dependency bloat than most other frameworks. Just called out the common consequences of getting more. You get more.
Npm projects are likely the most bloated by far, but also are java based projects, just look at Spring.
Calling out a python framework or some Go lean solution being the exception of the rule is fair enough, my point is developers expect everything and have little to do but rapid painless developement
I would love to hear about those asked to migrate their python 2.7 django ecommerce app to python3 since v2 is totally dead and unmaintained posing serious security risks. But sure if we forgo these things, and don't ever need to touch the code again, some frameworks have no downside. Makes a certain kind of developers finally be right.
If there is liquid water, it means it's not colder than the antarctic sea, which holds a lot of life. Unless there is some weird pressure + salt shenanigans I don't know about.
I haven't checked for PyQt/PySide but the Linux wheels are more-or-less distro-specific, they're not manylinux wheels. I don't think a compliant manylinux wheel (i.e. one that includes all libraries beyond those of the manylinux2014 reference platform) is even desirable, because gtk doesn't really like being shipped with applications, it wants to load plugins and themes from the system etc. Qt is similar - a Qt app that ships its own version of Qt will always have issues fitting in with the system Qt LAF.
It of course depends on what the target is, exactly. If you don't care about looking "native", for whatever little meaning that has had for the past decade, you can just use whatever theme you fancy with Ttk. The theming engine might not be as powerful as Qt's, but it's certainly good enough for emulating a modern flat-look UI: https://github.com/israel-dryer/ttkbootstrap
There should be a fee, but a fee equal to how much storage and access cost, so a very small one.
If you put no fee, some big actors will create non optimize crawlers and call the service in a loop, wasting your tax money.
A small fee means people will take care of only get exactly the data they need, cache what they need to cache, and refresh only if they really need to, and what they really need to.
Whisper is pretty good honestly. It gets my french accent in english and french slang, without having to tell it what language I'm going to speak first. That's impressive.
I'd love to do this in Python, but unfortunately we can't.
assert is supposed to be cheap in production because you remove them there.
In python, this is done python passing the "-oo" flag to the interpreted.
Unfortunately, the community never got the memo:
- if you put it in a lib, nobody is going to use "-oo" in prod, and they will think your lib is very slow
- if you using it in prod, some of your 3rd party deps may very well be using "assert" to make required production sanity checks. So using "-oo" would suddenly break your system.
Python is a great glue language, so you will do most of the expensive call outside of Python. However, things you typically put in assert are usually pure Python you call repeatedly, putting you in the worse of both worlds.
On the other hand, I think people would find it weird that anybody would be allowed to do that IRL with physical building, so why allow it on the internet?
Given that the consequences of probing a website are less than cracking on an office, and the surface of attack bigger on a website, with potentially a larger cascade, I think I can find more arguments for than against.
But it's not so easy to answer.