Like what you see? Subscribe here and get it every week in your inbox!
Issue #288 - September 15, 2024
Here are the top threads of the week, happy reading!
Top comment by atrettel
I have never heard of Pave before, but this just sounds like yet another copy of Equifax's "The Work Number" [1]. Basically, HR at many companies gives your salary and employment history data to Equifax, who then sells access to the information to certain parties with supposed need to access it, including potential and current employers and creditors. This report is likely one of the most invasive consumer files out there for many people.
I cannot comment on the legality of this kind of data sharing, but as I and others have pointed out, it has existed for a while. I do agree that it is concerning. You can freeze your Equifax The Work Number report at least, just like other credit reports.
[1] https://theworknumber.com/
2. Ask HN: What have you built with LLMs?
Top comment by hopfog
I built a multiplayer chatroom where all messages are transformed by an LLM (e.g. into pirate speak or corporate jargon):
https://impersona.chat/
I also built this incremental clicker game where you split words ad infinitum (like Infinite Craft but in reverse):
https://lantto.github.io/hypersplit/
3. Ask HN: Is the Job Market That Bad?
Top comment by scelerat
Been looking for a year and a half for something full-time and permanent. No luck so far. Chopped about fifteen years off my resume, and that seemed to help get more interviews, but I think that backfired because then they were surprised by my wrinkles and bald spot and figured if I was lying about my experience, I was lying about other things too.
One thing that does not help was a string of startups I worked for which all eventually ran out of funding, so I have like four companies in four years. Also, no thanks to Patreon, who hired me to do one thing, went through a bunch of managers and could never get the ball rolling, then laid off a bunch of people nine months later. really hard to explain to a hiring manager without sounding like I'm mad and resentful. Because I'm mad and resentful.
Picking up odd jobs here and there. Small part time gigs, some substitute teaching, bar-backing and construction work.
4. Ask HN: How can I monetise an open source app of mine that has become popular?
Top comment by benwerd
I've built two open source startups, totaling a decade of my life. Take it from me: the only way to do this sustainably is open core.
That means you make the core software open, but you sell the features that businesses will pay for or that allow other people to make money. Think of it as two distinct products for two distinct userbases.
In effect, the open source software becomes lead gen; the closed software is your actual business. They're both integral, and obviously feed into each other, but most of your open source users will never, ever be customers.
5. Ask HN: How do you share and sync .env files and secrets with your team
Top comment by jpc0
Since nobody else asked. If your team isn't infra/acting as infra then you don't.
Least required access, set up a dev environment with CI/CD and if they need to do any local dev(frontend contacting your API etc) then implement auth you are in control of.
If your team needs to make actual API calls to external services for dev, change that, you codebase is likely not testable. Integration tests should run on CI.
Much of this is likely a few days work if your codebase isn't massive and if your codebase is massive then put that in the next sprint.
6. Ask HN: What is the most expensive off-the-shelf software you have seen?
Top comment by tikhonj
Before Microsoft released the Z3 SMT solver under an MIT license, you could buy a commercial license for it for $9999 from the Microsoft online store, just like you'd buy a copy of Windows or Office, or, for that matter, an XBox.
Of course, that's nowhere near as expensive as lots of other enterprise software, but it was as "off-the-shelf" as you could get short of your local Fry's or Best Buy. No "call us for details" pricing, per-core licensing, recurring subscriptions and support contracts... just old-fashioned software sold directly as a product.
Unfortunately, I can't find screenshots now, so I'm just going off my hazy memories and the details might be a bit off :P
7. Ask HN: Why no transflective LCD portables?
Top comment by WillAdams
As a person who still wishes he could really replace his Fujitsu Stylistic ST-4110, it pains me to note that:
- they're dim (in comparison to an otherwise equivalent display)
- they don't showroom well (because they're dim)
- marketing them is difficult --- not many folks are willing to pay a premium to avoid the need to do the "hipster dance" and shade their screen (or just wait a bit to use their device)
The ideal would be for a retailer to set up a daylight viewing booth in all their spaces (expensive) and then convince folks to test/compare devices in what is essentially a suntan booth (health implications).
I wish that someone would revisit the Lenovo Yogabook which had a secondary e-ink display as keyboard/drawing area/e-ink tablet as a reasonable compromise.
EDIT: I will note that there are (or were?) some such devices available from specialty suppliers for nautical use, or in rugged devices intended for use on construction sites.
8. Ask HN: Any hope for removable, rechargable battery standards?
Top comment by solardev
It's not a standards problem but a market incentives one. Companies make too much money off expensive shitty proprietary batteries. It's the razor blade model + brand lock-in for powered goods, especially power tools and vacuums and such. They can sell you $5 worth of batteries inside a $80 plastic shell. No company is going to give that up willingly.
If you standardized them, it'd be a race to the bottom and China would win.
Maybe the EU would have that kind of willpower (like they did with micro usb) but it'd be politically impossible in the US, and every company from computer to power tool manufacturers would lobby against you.
9. Ask HN: How do you manage your prompts in ChatGPT?
Top comment by andix
This is actually one of my biggest issues with ChatGPT, that it's not really possible to create some kind of reusable workflows. The best option is Custom GPTs, to create a specific chat bot for one task.
There are many UI projects for LLMs, like openwebui.com for example. But even with the OpenAI API as backend they don't provide as many features as ChatGPT (Web search, Python processing of data, charting, image generation).
I think one of the most promising approach would be some kind of user scripts for extending the official ChatGPT UI. (user scripts in the browser with some tool like Violentmonkey, FireMonkey, or anything similar to the good old Greasemonkey). I don't use it though, and I don't know if there are any good extensions for ChatGPT.
10. Ask HN: How does my school block DoH?
Top comment by schoen
It's possible that they're now telling the firewall to block sites based on SNI or IP address, which is separate from the DNS mechanism.
If you know the correct IP address for a site, you can use curl or openssl to connect to the blocked site by IP address (but still sending SNI), like
openssl s_client -connect 93.184.215.14:443 -servername example.com
openssl s_client -connect 93.184.215.14:443 -noservername
GET / HTTP/1.1
Host: example.com
Connection: close
The output from the openssl s_client command will also show what certificate(s) were sent to you by the other end, and you can look at them using the openssl x509 command for more details about their contents. But you can see very quickly whether the purported issuer is Fortinet or a public certificate authority.
The curl version looks like
curl -v --resolve example.com:443:93.184.215.14 https://example.com/
> Is this some kind of MITM-Attack on me (I do not remember having had to install any special certificates, but I do not know how to check this)?
If the MITM attack were successful, you would not get a certificate error. The certificate error is the intended result of a failed attack, because it shows that you did not get a secure connection to the site you were trying to reach.
> Is there a convenient way to bypass this (i. e. not Tor et al.)?
If you have an account on a Unix server elsewhere, you can use ssh -D to create a local SOCKS proxy that forwards web requests through the remote server (assuming that the network doesn't also prevent you from making SSH connections to the server!).