jkeisling/hacker-news-corpus-2007-2022 huggingface dataset:
They can't be read BUT the browser will send the cookie with every request. If you have an XSS, it is game over. The attacker can just send requests from your browser. Slightly less convenient. You are merely taking away the convenience of the attacker doing the attack manually on his own browser, which he probably doesn't want to do anyways. If he can inject js into your site, he will make your browser send the request(s) to do the actions with your credentials in an automated and quick way. Your browser will send the cookie automatically. From the attacker, it would merely be nice if he could read your tokens, but it is absolutely not necessary.

Like some here, I don't understand the hate around keeping tokens in localstorage. People immediately say "but js can read it!" but so what? If someone can put malicious js in my site, it is GAME OVER, secure http-only cookie or not. When that is the case, the saner option is doing away with an old and misused invention called cookies. The upside with ditching cookies is that you are an order of magnitude safer against CSRF since your browser does not send anything automatically. You don't need to keep CSRF token state in your server(s) either (helps with scale, one less state to worry about), it is a win.

http-only secure cookies do not give you any additional security. Ditching cookies does.
Well as long as it's low downside I'm fine with it
I have my backend on a different subdomain instead of a subdirectory because it solves issues at the dns level. This means I don't have to deal with setting up a reverse proxy or separate rules for cloudflare.

This applies not only to production but also for local testing. I used to have a reverse proxy for local development.

Moreover it gives you better security by default since different backends are now treated as different origins, so same-orign-policy, and same-site (for cookies) kicks in.
You can use forward slashes in paths in cmd and powershell. But yes, I agree with your main point.
It all really depends on whether or not the funds were siphoned out of Mt.Gox, or if they are still there in a (currently) inaccessible cold-storage wallet.

If they were siphoned out -- especially over a long timeline -- I agree with you completely. The cascade effect of a rollback would be fatal (not to mention the precedent set would be...interesting, even if the Bitcoin ecosystem survived).

On the other hand, if the coins never were spent, and are just sitting there because the private keys have been lost, it's more straight-forward to fix for the protocol. It certainly won't be easy, and would require a major rethinking on how to attack the problem.

Also, while people affected who have coins tied up in a "lost" wallet are interested in having those coins released, I'm sure that there are more than a few people who want the opposite. Having a known condition where ~6% of the existing coins have been removed, most likely permanently, from the monetary supply means that their proportion of current holdings would go up (and, in turn, would see a corresponding rise in market value).
QALYs are barely relevant in this discussion. Quality Adjusted Life Years are an attempt to allocate scarce resources in the absence of a pricing mechanism. It is by no means perfect, but thats not the point - it is used at the margins. Do we spend money on this cancer drug that will extend the life of 75 year old prostate cancer patients by 6 months or spend it on heart disease drugs for children giving them 50+ years. Unless you are one of the 75 year olds or children it is a pretty easy question.

But the question we do not ask ourselves is - do you have the means to pay now you are dying of a horribly expensive disease? No-one cares about QALYS here in the UK except when newspaper editors decide to go for a ratings pull
I hear you. I'm an unemployed land surveyor re-learning how to program with Python (I learned BASIC and C in high school). So far I'm loving it and wish I'd never been sidetracked into such a dead-end industry. One way of making lemonade from lemons for me is thinking that at least there is some engineering crossover between the two fields. That's what I tell myself on a good day.
Another good one:

http://jordanmechner.com/old-journals/page/4/

July 18, 1985

Driving me to the airport, Tomi said:

"I think you should pursue screenwriting. Go for it."

I was surprised and asked her why. She said that Broderbund is a really nice, warm, friendly place to work, but for programmers it’s actually not that great a deal. The older ones, like Chris and David, are starting to get scared, because programming’s the only marketable skill they have, and it’s a young man’s game. The new crop of kids coming up are willing to work harder and cheaper, and don’t have girlfriends or families yet to cut into their working hours. And nobody knows how long the games market will be around, or what it’ll be like next year.

I never would have thought of it quite like that.
I like this list; thank you for taking the time to compile and annotate it.
What about an example of a major economy without a central bank that survived a major depression (say, the size of the Great Depression)? Or counterexamples? (I believe there are counter-examples -- nations with no central bank that took a worse beating than other nations that had a central bank during a major recession -- but I cannot remember them. Sorry.)
thanks Travis. I totally agree about focusing on improving vs. benchmarking against others. I was more just curious. The product is http://pinterest.com
For ethical reasons you should strive for (mostly) positive externalities. That means you need to add those 2000$ plus the externalities.
This may be just me but I've found Ultimate players to be by far the most competitive. It is almost as if people who know they have a problem are self selecting for a sport that is the most restraining in that particular way.
Did you report it to Facebook before publicizing it?
What about the other suggestions: Once you get up three goals, switch positions. Play with your weak foot. try different setups, like eight defenders and two strikers.

Sounds like fun to me.
http://news.ycombinator.com/best (Highest voted recent links.)

http://news.ycombinator.com/active (Most active current discussions.)
As a coder, I would enjoy those problems. Maybe its a framing issue-if you frame the jobs as you did here, rather than "work for an SEO company", maybe that would help?
If Google is using their toolbar and/or Chrome to report private URLs back to Google for indexing, then that's a much more serious privacy violation than what's being reported here.
There is a rather large spiritual aspect to mankind's creation of art.

If you look at the history of art, in the western world and elsewhere, it is strongly tied to some sort of religion.

Religious practice typically implements some sort of repetitive behavior or meditation, where the goal is not necessarily to get something done in the physical world.

If you run the process through some sort of reductionist approach, you wouldn't have art to begin with. Why even make a piece of art? What's the point?

While it is interesting to view the creation of art through the lens of an engineer, any attempt to criticize the work through only this lens is not going to stand up very well.
And the lovely newbies here at HN downvote you for that. Sheesh - I don't get what's happened here over the past 6-9 months.
Tamper evident is the correct description of what the parent comment is talking about. You can Google “tamper evident stickers” to see it’s how the phrase is widely used. I would say the epoxy in question is both tamper resistant and evident though. Because it’s both difficult to remove and you’d risk breaking the device if you tried it, and those seem like obvious tamper resistance controls to me.
Yes, and you can click them away but they will reappear whenever you click somewhere else. Bad.
I wish more people would talk about the goods of Firefox!!!

It's becoming so un-loved and so neglected by users (and specially developers!) this days that I fear that tomorrow there won't be an alternative to chrome at all :(.

Those who lived the Internet Explorer 6 should be the ones to rise up first.

But everyone seems to have forget how bad it was and how hard it was to destroy that monopoly.

Developers should be the first to rise for Mozilla.

I think we own Firefox the good things we still have on the web. They fought for standards, for example...

Please, create a movement or something... Make noise... But don't neglect Firefox.

We need alternatives and we all are responsible for allowing projects like Firefox to exist (by using them)...

It's very sad to be ungrateful!!!

Everyone should take clues on the post from the OP...
The cops are abusing copyright law in order to violate a citizen’s First Amendment rights. They’ve outsourced the censoring.

Censoring is indeed legal if companies do it, but this is functionally State censorship.
"Repo" makes it sound like it is a version control system.
The 2015 MBPs were the very last with removable storage[0]. The flash controller and NAND chips are soldered directly to the board on every newer MBP and are essentially non-replaceable, short of desoldering the raw NAND flash I suppose.

[0] The low tier 2016 and 2017 touchbar-less MBPs do, quixotically, have removable storage, but using a proprietary format vs the NVMe sticks in previous models. All touchbar MBPs (and M1 Macs) have soldered flash chips, and the TB-less ones were totally discontinued in 2018 IIRC.
I guess I was thinking in terms of 1D plus to minus line, I understand now. However, isn't almost everything like that? Even computers are used for evil.
Water resistant means some resistance to water. Water proof means full resistance to water. And that is a standard term that has been in use for decades to describe watches, tents, jackets, etc. When I read tamper resistant, I imagine the tamper equivalent of water resistant.
Glicko (1 and 2) don't handle complex matchups well (as in, anything that's not 1v1). Trueskill was specifically designed to extend the Bayesian concept of Glicko in a more general way which allowed this type of use-case.
Fine distinctions get lost on Twitter, unfortunately. Your points about hiring people in other countries are valid. Remote work is also an alternative to moving everyone in the US to Chicago, NYC, or San Francisco; I understand that PG's essay was about immigration, but PG is an on-going advocate of people working in the same office due to the "great ideas happen in chance meetings, and those are hard to replicate", which means that that only does he want great programmers to move to the USA, he also wants them to move to cities that are tech hubs.
For the lack of a visual editor to visualize how the scene would look like. In Unity3D you can play a game, pause it, make necessary changes to find out how would it effect your scene, and every thing is updated real-time in the scene (the changes are not saved though, so you need to remember what was changed and redo once you come out of Play mode). In short its a what-you-see-what-you get kind of tool.
What was your mindset like during that time period? It sounds almost adventurous, the way you wrote your post.
The world needs two things: a new Javascript framework and a new HN reader!
I feel like all this talk is nonsense and people should simply work at the temperature they feel comfortable at. Offices should be at a neutral temperature and provide personal heaters.

I keep my room around 28C during the winter and 35C in the summer. The office I work at is set to 21C. I hate it and feel like I work better when I'm hotter.

I doubt there is a magic number that would have everyone work faster.
"Expat: This is a lax, permissive non-copyleft free software license, compatible with the GNU GPL. It is sometimes ambiguously referred to as the MIT License."

In case anyone else wondered.
Didn't see the actual repo linked: https://github.com/joyent/sdc-docker

"A Docker Engine for SmartDataCenter, where the whole DC is exposed as a single docker host. The Docker remote API is served from a 'docker' core SDC zone (built from this repo). ...
Disclaimer: This is still very much alpha. Use at your own risk!"
LedgerX - New York, NY (Manhattan). Local or remote.

Join us to build the first US-based exchange for virtual currency derivatives.

Our culture is about compliance, quality and learning. Regulatory compliance is our top focus; we have a top-down culture of compliance. We value quality in software engineering. We operate at the intersection of law, finance and technology.

We have a Python, ZeroMQ and C++-based backend. We are looking for a software engineer who can build out features all the way to our React.js frontend.

Please email zach@ledgerx.com.
I was under the impression they were not entirely legal. I recall a movie theater saying they were going to install a 'deadzone' only to find out they weren't able to.
Aha, this confirms my long time suspicion that people can get drunk with non-alcoholic beer.
So if a shop signs up for the service, and on Monday morning they have one customer who comes into the shop and buys something ... then that customer goes to another shop and just browses. You'll likely have the name of the person because they paid by credit card. You'll also have the information that this customer went down the block to some other shop. And you'll know which customer it was because you only had one customer that day.

So tell me again how I can't use this information to identify who a specific individual is.
> DRM is handing a ciphertext, a decryptor, and keys over to someone else and asking them to use it only in the way that you want them to use it.

I think I have a new .sig.
forget dancing. Even simple human tasks like tying shoelaces is borderline impossible for machines.
Then you probably also want to hear about SpiderTest. http://github.com/courtenay/spider_test

It's more of a strict crawler but also runs prototype's Ajax.updater javascript calls — which can help hunt down AJAX-only actions that cause 404s or 500s.
Even a JS Corewars interpreter that can only compile "assembly" would be nice to have. Then people could compile their warriors with pmars and put fancy simulations on their web sites. Not saying that it is impossible to clone the pmars compiler, but it is a mess :-)
Still actually kind of sucks. There's not enough filters.

Also they seem to have conflated "Sportscar" with "Convertible" moving all high performance hardtops under "Sedan/Coupe". This provides the odd situation where an Anston Martin V8 Vantage shows up in the same results as a SMART car.
http://www.nytimes.com/2009/12/06/magazine/06fob-q4-t.html

Questions for Jeff Bezos

Q: What do you say to Kindle users who like to read in the bathtub?
A: I’ll tell you what I do. I take a one-gallon Ziploc bag, and I put my Kindle in my one-gallon Ziploc bag, and it works beautifully. It’s much better than a physical book, because obviously if you put your physical book in a Ziploc bag you can’t turn the pages. But with Kindle, you can just push the buttons.

Q: What if you dropped your Kindle in the bathtub?
A: If it’s sealed in a one-gallon Ziploc bag? Why don’t you try that experiment and let me know.
For me, the track "Time" from the Inception soundtrack is mind-blowing.

Listen to it with good quality earphones and tell me it doesn't send chills down your spine.

http://www.youtube.com/watch?v=Z0kGAz6HYM8

EDIT: link
I can't remember any Java examples at the moment, but I do recall a memory leak that I had created in C#.

Registering an event handler in .Net creates a reference to the handler. This means that an event handler that doesn't un-register itself from it's event will never be garbage collected. In the context of a GUI application, this means that you have to be careful to ensure that child windows remove their event handlers when they're closed. Otherwise, your application will leak memory, as the closed windows will never be garbage collected.
Yes, there are some category mis-matches. It's a work in progress.
That reminds me of a quote:

“I’ve been amazed at how often those outside the discipline of design assume that what designers do is decoration—likely because so much bad design simply is decoration. Good design isn’t. Good design is problem solving.” – Jeffrey Veen

It certainly wouldn't be worth hiring a designer just to get "pretty" pixel perfection. I would hope they could provide thinking as well. By doing the work in parallel with you, they should make it possible to go faster than doing it yourself.
That's what asterisks are for. You learned a lot from it, and it was popular; that's why you include it. You can acknowledge that its a steamy pile of shit and incidentally show that you've grown as a developer and are able to acknowledge your past mistakes. Those are the traits that will make you stand out from other candidates.
Categorization of cars is messed up. There's a BMW 5 series in the hatchback section. And a VW Beatle in the sports section ... and countless other examples.

Is "seeing cars in different colours" the only feature you are offering? If you are planning on adding more comparison features then I'd wait with "launching" as this is mostly useless and user's wont remember you. Pretty site tho :)
In recent years some evolved warriors were able to compete with human crafted warriors. Optimizing just parts of a warrior with GAs is also a popular method.
I saw the gif from your website and you are not touchtyping.
The opening paragraph of the article says " Amazon AWS announced Babelfish" and links to https://aws.amazon.com/blogs/opensource/want-more-postgresql... from the AWS blog. This all seems accurate to me. Is there some other reason why we should take AWS out of the title? Branding is not a reason that HN readers would support, and I think if we took AWS out for that reason, the community would accuse us of trying to obscure the origins of the project. Internet people are trigger-happy about this kind of thing, and too quick to accuse us of serving $BigCo agenda as it is.
Sure, that's fine. But I'm assuming GGP is talking about TensorFlow, since that's what this post is about. If you don't need TensorFlow, then this whole conversation is kinda moot, and you can use whatever you like.
Aaron Harris and Adora Cheung leaving YC the same day. I wonder if that means there’s internal changes happening or if they’re founding something together.
But anyone can still legally copy the recipe (the ingredients and how to combine them) and ignore the superfluous content.
I think this is just as muddy as the bits you pointed out.

You are of course right, I only wanted to given some scenario with opposite outcome for customers. My point was more that one will have to provide much better arguments or evidence than some random macroeconomic interaction to convince me that advertising has any net positive effect.
No, it's public, and Jack just posted it on his Twitter today.
I am excited to take a look at this especially as it doesn't seem to be an electron app which I try to avoid.
The reality is that geographic pay modifiers are part of the negotiation process whether it’s explicit or not. They only time it’s not is if a company goes out of their way to pay everyone the same, which is currently rare and only limited to small companies that haven’t tried to hire at scale yet.

At an individual scale, you have to pay enough to convince the person to join your company over their other options. Their set of other options is still heavily influenced by geography, so geography is a always factor in the negotiation.

On a global scale, developer compensation in the US is an outlier, and not just in expensive cities like SF. If you truly want pay equality, you have two options: Either raise everyone’s pay to That of the most expensive market you want to hire in, or simply exclude the expensive markets from your hiring plans so you can bring the number down.

Ignoring geography in compensation discussions sounds great, until you realize that they end game is reversion to the global mean, which means most US salaries would have to come down. Way down.
I think the issue is if you are going to order a million toilets, then moving all the risk to the contractor is fine. If you are asking for innovation and R&D, then the contractor already has a ton of risk. Add in requirements to make a fighter suitable for all branches of the military, and the risk is gigantic. In that environment, you need to remove risk from the contractor.

This is why R&D projects can't be treated in the same way as delivery of well understood tech that simply needs to be mass produced well and efficiently.
Hakiki is amazing. Get the chocolate baklava flavour, or the rose water flavour
Learning the general idea of system calls was a revelation to me since it implied that, in a sense, every language was ultimately a scripting language for the kernel.
There are racing teams with multi-million dollar budgets who would be interested in this sort of detection technology. For example, just a couple days ago one of the top competitors in the Sydney-Hobart abandoned the yacht race due to hull damage from hitting...something [1].

However, testing in waves is very important, and this article shows none of that (barely mentions it, in fact). But at least the big boats have the advantage of being able to put a sensor 50 meters up in the air, if that helps.

[1] http://www.smh.com.au/sport/sailing/sydney-to-hobart-comanch...
No surprise - lots of works of art have constraints that make them formulaic. Haiku. Greek tragedies. Sculpture. Oil painting. TV commercials. Its helpful to study the formula e.g. for teaching others how to succeed. No need to denigrate it.
Out of curiosity, what do you think of Akka running on top of Java or Scala?
I wonder how Paul Graham would feel about opening up immigration to more VC investors?

BTW... don't you think the "doom" thing is a bit over the top? I certainly do.
I mean, you can assert that baselessly, or you could read literally anything about the prevalence of "cancellation" in both the private and public spheres, especially among gen-z cohorts:

https://www.nytimes.com/2019/10/31/style/cancel-culture.html

Maybe it hasn't affected you or your circle, by name, but it's ridiculous to assert it "isn't really a thing"
Well it doesn't work on rk3399. Maybe it's fixed on the new ones
You're missing that they modeled all of those scenarios out, "do nothing" was just one of their models.

And even their best case scenarios overshot the mark -- and by a lot.

This isn't to criticize modeling -- it's only to point out how hard it is to get right.
Check out Peru for a few reasons:

July / August = peak season.

Peruvian food is delicious.

You can catch Peru's Independence day(s) at the end of July (http://en.wikipedia.org/wiki/Fiestas_Patrias_%28Peru%29)
Keychains, Vault, GPG, HSMs, password managers. It's solved, just requires effort and understanding to setup. It's neither "huge" nor "unsolved" as pks have to live somewhere and cannot exist in the aether.
While it's not a great tool to teach people the concepts of OOP...

I actually think it's a very good tool for teaching OOP. It doesn't have types to confuse the issue, it favours composition over inheritance by design, and it fully encapsulates state.

You could do much worse than JS as a teaching language. In fact, I'd say that it was only through practical application in JS that I fully appreciated the concepts extolled by Smalltalk, Self, and Lisp. Had I worked in a Java environment I may not have had those insights until much later.
Measles is pretty devastating in the approximately 0.3% of cases in which it's fatal, and that's in the US (according to http://en.wikipedia.org/wiki/Measles). It's (even) worse in less well-developed countries.
Fair point.

To be clear, I take nothing away from what you've done here: More tooling options are rarely—if ever—a bad thing and your presentation of riot is beautiful and clear, very well executed.