Hacker News Reader

JoshMandelon Show HN: Heardle Is a Phonemic Wordle

Yeah, I've really enjoyed the "remix culture" around Wordle. Gives me strong and positive vibes from an earlier stage of the Web. (And Glitch is a gem -- it made real-time collaboration from across the dining table a breeze).

JoshMandelon Show HN: Heardle Is a Phonemic Wordle

Interesting. Any chance you're accidentally transcribing the en sound as "n" instead of "ŋ"? This is an easy mistake to make, and perhaps one we could recognize proactively to display a more helpful error message.

To double check: if you type the word "blank" into the text entry box at the bottom of the screen, you should see it automatically transcribed (i.e., automatically "blæŋk" should appear in the grid).

FYI, the underlying JSON file derived from CMUdict is at https://github.com/jmandel/heardle/blob/main/words.json (it's, uh, 10MB, but it's hosted from a CDN that supports gzip encoding so "only" takes one megabyte to send over the wire.)

JoshMandelon CovidPass: Making it badass by drawing inside the QR code

What a delight! For sure would love to read the details.

JoshMandelon Digging into Quebec's electronic proof of vaccination

For reference, the SMART Health Cards Framework (https://spec.smarthealth.cards) is the underlying specification behind these QRs. I've had the privilege of working with a broad swath of the healthcare IT ecosystem (in the US and internationally) on these openly licensed, standards-based specifications for consumer access and data sharing.

The SMART Health Cards Framework is designed to dovetail with SMART on FHIR APIs for consumer access (which all Electronic Health Record vendors in the US are on the hook to support over the next year).

JoshMandelon Discovering Goroutine Leaks with Semgrep

GH keyboard shortcut: When viewing a file in GitHub, type "y" to update the URL so it explicitly pins to a commit (e.g., turning https://github.com/trailofbits/semgrep-rules/blob/main/hangi... into https://github.com/trailofbits/semgrep-rules/blob/385c42a/go...).

This has become part of my muscle memory when copying links for posterity, but it makes sense not to be the default, because sometimes you want to share an evergreen link (i.e., always pointing to the latest content) rather than an immutable link.

JoshMandelon Google plans to shut down Google Voice integration with classic Hangouts

Yes, I experience this too. Poor quality and latency in the Google Voice app (in a totally not subtle way) when calls initiated in Google Hangouts Dialer work fine.

JoshMandelon Show HN: Shift-Ctrl-F: Search a webpage with natural language and TensorFlowJS

I tried it just now; after "make develop" and installing the unpacked extension in Chrome developer mode, I can't get it to produce anything except "No Results," even when search for words and phrases that appear verbatim on a page. It took ~20 seconds to load the first time and ~1 second per kB of text each time I search, but no hits.

JoshMandelon OBS (macOS) Virtual Camera

I came here to say exactly this!

JoshMandelon Show HN: CCPA Compliance in a Box

Disclaimer: this is my brother's company :)

I love the following bit from the ToS (https://ccpatollfree.com/terms/), including GDocs for-comment link:

> ...we do not individually negotiate these terms. However, this site is made by lawyers for lawyers, and if something in these Terms prevents you from signing up, please comment here. If we find your comments compelling, we’ll upgrade these Terms for all our subscribers.

(ToS language rarely makes me smile -- at least non-sardonically.)

JoshMandelon Twitter funding a team to develop an open standard for social media

This can also seen as Twitter getting out ahead of https://www.congress.gov/116/bills/s2658/BILLS-116s2658is.pd... (press release at https://www.warner.senate.gov/public/index.cfm/2019/10/senat...) -- which would call for NIST to define:

model technical standards by which to make interoperable popular classes of communications or information services, including—

(1) online messaging;

(2) multimedia sharing; and

(3) social networking

(And all within 180 days ;-) No small feat.)

JoshMandelon One Man's Modus Ponens

I have a notation question: if I am reading correctly, the article uses "A ⊃ B" to mean "A implies B" -- but subset/superset notation defined at https://en.m.wikipedia.org/wiki/Subset seems to be just the opposite (i.e., "A implies B" should mean B is a superset of A, as in "B ⊃ A". Are these two conflicting notations, or am I just confused?

JoshMandelon Show HN: Meeting Stats – Show your boss how much of your life is in meetings

Very cool -- I love the focus and the amount of information you can glean from calendar analysis.

On this topic, since I joined Microsoft this summer, one of the off-the-shelf tools I've been most impressed with is the MyAnalytics dashboard (https://docs.microsoft.com/en-us/workplace-analytics/myanaly...) built into Office online. I like that in addition to meetings, it also summarizes time spent on email and time spent working outside of "business hours" -- and decorates each stat with benchmarks to compare with company averages.

I also appreciate the claim that "Only you have access to your MyAnalytics dashboard. MyAnalytics does not provide your manager or anyone else in your organization access to your dashboard." (Of course if push comes to shove, this is all company data, but I like that it's only shown to me by policy.)

JoshMandelon Dandelion Seeds Fly Using ‘Impossible’ Method Never Before Seen in Nature

https://static-content.springer.com/esm/art%3A10.1038%2Fs415...

JoshMandelon Dandelion Seeds Fly Using ‘Impossible’ Method Never Before Seen in Nature

https://www.nature.com/articles/s41586-018-0604-2

JoshMandelon Notes Nearing Ninety: Learning to Write Less

I can hear "loss of ambition's fulfillment," in two ways, which gives it power in tight, poetic prose:

1. It is no longer fulfilling to be ambitious (i.e., a quiet home-centric, narrowing life can be fulfillment enough)

2. Ambitions are no longer fulfilled (i.e., there's not enough energy or time in the day to meet ambitious goals)

JoshMandelon Open Sourcing My Personal Medical Record

Thanks for this! Have you considered sharing DICOM files, too (i.e. the actual images from your MRI, in addition to the reports)? If so, what went into the decision not to include these?

JoshMandelon Show HN: A microservice that makes adding authentication to your app easy

I applaud the goal of simplifying authentication by wrapping with an easy-to-use service. But it's important to keep in mind that authentication is a subtle process, and a critical security component of many applications!

It's essential to follow best practices, and for developers to understand enough of the interaction to be confident in an implementation.

A few points to look out for after scanning the source for the project:

* if your goal is authentication (helping a user sign in to an app using an external identity) you should be sure to use an OpenID Connect flow (requesting a scope like "openid"), and be sure to convey the id_token back to the app so its signature can be verified.

* you should be sure to create a non-guessable "state" parameter when generating an OAuth authorization request, and to verify this parameter upon completion of the OAuth core flow.

* your design needs to prevent a session fixation attack where a malicious user injects her own token into the callback url (tricking a user into signing into an app using the attacker's account, and potentially submitting data that the attacker can then access the)

* it's best to avoid inserting an access token into a url (where it becomes part of a user's history, gets cached by proxies, etc) -- the OAuth code flow you're using avoids this, but then you turn around and inject the token into your own redirect

JoshMandelon SQL injections vulnerabilities in Stack Overflow PHP questions

StackOverflow accepts edits to posts, if you have the karma for it.

Somebody might enjoy writing a bot to propose updates that demonstrate better practices (like prepared SQL statements) for the 80% of bad examples where this is a pretty trivial manipulation.

JoshMandelon Introducing TAuth: Why OAuth 2.0 is bad for banking APIs and how we're fixing it

1. To my mind, the fundamental problem OAuth solves is "letting a user decide" to share data with an app, without making the user responsible for jumping back and forth between the app and her API provider (her bank, in this case). OAuth holds the user's hand through a series of redirects, and the user doesn't have to copy/paste tokens, or remember where she is in the flow, or know what comes next. Does TAuth have a similar capability? The blog post mentions "User Tokens" in passing, but doesn't define or describe them.

2. OAuth 2.0 is published as an RFC from IETF. It may be a bear to read (and yes, it's a framework rather than a protocol!), but the spec is open, easy to find, and carefully edited (https://tools.ietf.org/html/rfc6749). Is TAuth meant as a specification, or a one-off API design? If it's a specification, has there been an attempt to write it down as such?

JoshMandelon HIPAA 101 for Software Development Teams

Thanks for these guides.

You may want to re-word what you say about patient rights in https://catalyze.io/assets/media/HIPAA-Compliance-Guide.pdf -- you say that HIPAA "gives individuals ownership of their health records", but I don't think that's quite right. The Office for Civil Rights has a good overview on patient rights at http://www.hhs.gov/hipaa/for-individuals/medical-records/ind... and when it comes to the right to access, there's an excellent in-depth overview at http://www.hhs.gov/hipaa/for-professionals/privacy/guidance/... .

(Note: it would be nice if you made your PDFs searchable; currently they're images, which makes it hard to find and cite relevant content.)

EDIT: for an in-depth treatment of the "ownership" issue (in its nuanced glory) see http://www.healthinfolaw.org/comparative-analysis/who-owns-m...

JoshMandelon Tell HN: Full Hacker News dataset now available on BigQuery

Not an oversight — just a different use case for the data! And I wasn't sure if BigQuery had a generic approach here, but it looks like not.

JoshMandelon Tell HN: Full Hacker News dataset now available on BigQuery

This makes a really nice introduction to BigQuery (which is to say: BigQuery is nicely discoverable, given an easy-to-understand dataset).

Is there a good way to find the story to which a comment belongs? This dataset raises the issue of recursive query (e.g. "with recursive" in SQLite or PostgreSQL, or "connect by" in Oracle). The only approach I see in BigQuery is specifying a fixed level with something scary like:

  SELECT p0.text, s.id, s.title
  FROM
    [fh-bigquery:hackernews.comments] p0
  JOIN EACH [fh-bigquery:hackernews.comments] p1 ON p1.id=p0.parent
  JOIN EACH [fh-bigquery:hackernews.comments] p2 ON p2.id=p1.parent
  JOIN EACH [fh-bigquery:hackernews.comments] p3 ON p3.id=p2.parent
  JOIN EACH [fh-bigquery:hackernews.comments] p4 ON p4.id=p3.parent
  JOIN EACH [fh-bigquery:hackernews.stories] s ON s.id=p4.parent
  WHERE
    REGEXP_MATCH(p0.text, '(?i)bigquery')
  ORDER BY
    p0.time DESC

For this particular data set: linking each comment to its story might be a good denormalization.

JoshMandelon The most important API you’ve never heard of

I'd like to hope so. I think we've seen this kind of interaction play out on a much smaller scale in the commercial world, and we're seeing more of it. For example, when Intermountain Healthcare selected a Cerner EHR, they did so as part of a multi-year partnership [1], under the condition that Cerner would provide open interfaces to their EHR data so that Intermountain could continue developing (and begin porting their existing) home-grown decision support tools. Part of the arrangement was an innovation fund to support development of the specifications needed. And I think that's actually a great pattern, since we certainly won't have all the answers right out of the gate. With respect to DHMSM, the timeline is long enough that it's very hard to name relevant technologies on the way in, without the concern that they'll be out of date (or at least out of fashion) by the time implementation hits.

1. http://www.cerner.com/Intermountain_and_Cerner_announce_stra...

JoshMandelon The most important API you’ve never heard of

Just wanted to chime in here -- I'm the architect for SMART Platforms and happy to answer any questions. Over the past five years I've gotten much more deeply involved the healthcare standards development world than I ever would have imagined. I came at this space from the perspective of wanting to build applications that plug into real-world systems, but in some ways I've been digging lower and lower down the stack trying to lay firm groundwork. There's constant tension between laying groundwork and trying to get "real" work done.

JoshMandelon A typical day on the ward

When I was a med student in 2009, I did my surgery rotation at a community hospital outside of Boston. Each morning two students were responsible for copying down overnight vital signs from the EHR onto paper. The job took upwards of 45 minutes, and morning rounds were at 6am...

I didn't mind driving through icy Boston roads at five in the morning -- but I did mind the fact that I was doing a job that computers should be able to do far faster and more accurately.

The EHR was a terminal-based system, and I wound up routing traffic through a local proxy, analyzing the logs, and figuring out how the protocols worked. (I'm sure that reading about terminal emulators would have been more effective than reverse engineering them; I can only blame sleep deprivation.) I ultimately built a Python script to drive the terminal based on a list of medical record numbers, recording vital signs and slotting them into pre-formatted progress notes for printing. It even plotted sparklines for fever curves.

It worked. And the chief of surgery loved it. He wrote me a stellar evaluation that prominently mentioned my work with the computer system (I also did good clinical work and all).

Two months later when the medical school dean read my evaluation, I got a very angry phone call. She was horrified that I had "hacked" into the computer system and taken matters into my own hands. I tried my best to explain how the system worked, and why it wasn't a threat. But I didn't really get the message across.

The upshot, though: I realized just how broken healthcare information systems were -- and that I enjoyed working on solutions. After medical school I joined the research faculty at Boston Children's Hospital, where I'm working on open specs, tools, and standards that make it easier to integrate third-party health apps with clinical data and EHRs [1]. It's been an interesting ride -- and I've learned an incredible amount about health interoperability, politics, data, and security along the way.

1. http://smartplatforms.org/