skysight-inc/HackerNews huggingface dataset:
I was surprised travelling across the US at a cultural difference - here in Australia, a 'national part' is a non-developed or little-developed area of land for everyone, free to enter, usually with campgrounds. In the US, a 'national park' is often a non-trivial payment to enter, with airconditioned visitors centers, good roads, staff everywhere, and sometimes even hotels and restaurants... Not all national parks are like that, but the first few I visited were. Bit of a shock.

I learned later in my trip about 'public lands' in the US, which were (basically) unmaintained and free for all to use, which was closer to national parks back home.
There is no ad hominem fallacy in that comment. You are probably misusing the term to refer to any negative comment about a person.

The ad hominem fallacy is a fallacy of irrelevance, of the form "the arguer's argument is invalid because the arguer has this negative quality," when the negative quality is irrelevant to the validity of the argument.
Or:

party\033[5D\033[Khack

Not as catchy, though :/
The story of Mandrillus Sphinx who needed glasses
i simple solution to cut down on this is never allow more than 2 or 3 failed card attempt from a single ip address. You have to link it by ip because they will just make a new account if you do it by account. Carder will move on to another site if running cards is not simple and fast
Good to hear!
I fondly recall her design patterns course, way back in '96!
It is secure, but it is much slower than AES and requires frequent rekeying because of small block size.
How about OTP-enabled credit cards? [1]

For every transaction the customer must enter the OTP.
It wouldn't serve much for subscriptions, though.

[1] http://web.deepnetsecurity.com/products2/PocketID.asp
Microsoft are now moving quickly to allow users to run .NET on all platforms. How long until they decide that Windows Server is no longer worth investing in?

Or are there too many Microsoft server products earning good profits (i.e. Exchange and BizTalk), to make that switch a realistic future expectation?

I'm genuinely interested to hear people's opinions on their thoughts of the future of Microsoft and Windows Server.
The falling out that led to him splitting from the company is the unexplained bit;it seems to me that's the root of the resentment and their later success is salt on the wound.
Also, the author's explicitly makes the assumption that Docker is only appropriate once an application surpasses a certain level of complexity. I don't think that's a very good assumption. I think that it's perfectly reasonable for any open source web app with any dependencies to support or even encourage development and installation via Docker. I don't see why the choice to use Docker has any relevance to the complexity of the application.
I commented this on yesterday's jsbin article, and I'll write it again.

Don't implement the payment processing code yourself. (And using Stripe is _still_ implementing it yourself - they supply only one part of the process.)

Writing this code will take time that you are not using to develop and market your product. (cf opportunity cost). Your code will be buggy. Your code will be weak. Your code will not support the various alternative payment options popular in, say, Holland. (Yes, this is a thing, and it is called iDEAL.) Your code will sooner or later be exposed to a campaign of fraudulent transactions.

Use FastSpring, or your alternative of choice. Yes, it costs more, if you don't put value on your weeks of time to create and support an alternative, and if are comfortable having a weak fraud detection, if any.

When your business becomes successful, when the fees to FastSpring start to dwarf the costs of implementing a payment system yourself, then - perhaps - consider re-doing it yourself.

There are indeed weaknesses in using FastSpring, which after seven years are becoming a pain for me. I'll be writing about that soon. But this is not an issue for a one-person endeavor getting started.
Here in Belgium 3D-Secure is also commonplace, and the experience provided by my bank has significantly improved throughout the years. I also don't think it hurts the conversion of webshops around here because everybody is used to performing these extra steps.

It works as follows:

- Merchant redirects me to his payment provider

- I enter my debit/credit card number into the payment provider screen

- I am redirected to my bank website, and am able to verify the URL (no iframes anymore!)

- My bank has two methods of verification: scanning a QR-code with the mobile banking app on my phone, or logging into the online banking website (with a Vasco DIGIPASS 836, which requires a debit card+pin to generate a OTP)

- I verify the amount and creditor in the mobile/online banking app, and sign the transaction with my mobile pin/digipass.

- I am redirected back to the merchant.

All in all, I think it costs me 30 seconds to complete the extra 3D-Secure steps when using my mobile banking app.
App summary, discovery search for ios app
You just got to love this sentence:
"Watch high-definition 1080p streams on Amazon Video, Netflix, Hulu and more, even without a 4K TV."

OMG, this is so great!
Sure, banks can do it really horribly (most of them), but some use it to force proper 2FA. For example, Nordea asks you to open their phone app and confirm the purchase (with a message that includes the total price) on there.
These verification mechanisms don't freak people out once people are used to them. Pretty much anyone who uses credit cards to buy anything online in Europe will have encountered this system before and will be more suspicious if they don't see it!

Using customers birthdate is indeed a very poor authentication mechanism, but even that is going to defeat the majority of fraudsters who are simply trying to bulk-authenticate a list of CC numbers. Personally, I don't give my real birthdate to any website unless they have a very good reason for knowing it.

My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers, etc.

But since the actual authentication mechanism is left up to the card issuer, there's nothing to prevent them using more advanced systems - like 2-factor authentication, hardware tokens, etc.
Android’s new ‘M’an – Marshmallow
Android Latest version 6.0 – Marshmallow - Google has finally unwrapped the guessing game of Android-M, Marshmallow is the new Android-M, Version 6.0. Not all the details are yet available
BBC to launch OTT service in the US
it is the website help people to search ios app in summary, help people to faster get information.
Well, Halifax (one of the bigger banks in the UK) has a similar config: https://www.ssllabs.com/ssltest/analyze.html?d=https%3A%2F%2...

I would have expected banks to have audits for things like these fairly regularly. Does anyone know why they are running such a broken configuration when a lot of these vulnerabilities have been around for months/years? Not to mention that even ignoring any vulnerabilities, their ciphersuite is dire.
Keep in mind that the Japanese Yen is a currency in Japan, but under US regulations, it is not.

For many purposes, yes, it is, especially in tax law, which is why people also wanted Bitcoins to be recognized as such.

Under Subtitle A of the Internal Revenue Code, foreign currency like the Yen has special rules vis-a-vis commodities. In particular, when you buy something with Yen (up to $200 in value), it is not considered a realization of capital gains and so it is not taxable, unlike if you used a commodity to pay.

https://www.law.cornell.edu/uscode/text/26/988
Well yes, the fact they chose to require that the webapp have a superuser database account is not docker-specific, but the manner (and it should be said: ease) with which docker is used to neatly package an opaque ball of string creates a trend of ever more difficult-to-untangle software making it way harder than it should be to properly deploy apps conforming to your environment's security, config management standards.

I mean, when I first evaluated this app, it didn't even have a sane launcher script. Instead, ~15 lines of ruby config and a ruby script that I had to follow just to discover it was a weird, idiosyncratic way of executing "docker run".

Edit: I am not saying that Docker is somehow inherently flawed in this respect. It's solved a lot of problems for me and you can build great, well-architected stuff with it. But there is a trend to use it to wallpaper over poor development and deployment practices.
Also a nice thing to do is to split the project into multiple repositories, each also split into multiple branches.

Then when a dev checkout a branch in one repo, they need to find and checkout the matching branches in the other repos in order to build the project.

To make it more fun you can name the branches slightly differently from one repo to another, like "mybranch3" in one, and "my_branch3" in another.

Sometime a feature only affects one repository. That's fine - just create a branch there, and leave the other repo to the default branch - "master" (or sometime "release", unless it's "current_test", or maybe "dev-temp", or...).
Microsoft Office 2016 Update: What Changes Will It Bring to Your Computers?
Alternatively, small companies started by developers should stop thinking they can implement the payment and order handling code themselves, and learn that instead they should use a service that does this for them.
Not really the full story. Bugzilla explicitly disables strict mode (due to another problem). Pretty stupid to have done that!

See for details https://bugzilla.mozilla.org/show_bug.cgi?id=321645#c20

PS: I wrote the patch to disable strict mode.
You might want to update your FAQ: https://support.coinbase.com/customer/en/portal/articles/182...

It only lists 4 countries.
Hi Mark, CEO of Sift Science here. Thanks for giving us a shot. Please don't hesitate to ping me if you need any help or we're not delivering to your expectations. jason at siftscience dot com
How about obfuscated MUMPS?

P R I N T S (A,L)=1,(S,T)=I N G
G I V E N A
O F A=L:L:S Q:U=A R E S B=E L O W (A*A),!
I S (U,R,E)=T H 1 N K I T=S G O O D
The actual authentication mechanism is left up to the card issuer. But using the card's PIN would be considered insecure due to the risk of malware/key-loggers intercepting it.

My bank asks for three random characters from my online banking password (the same mechanism used to log in to my online banking) which provides enough security without risk of revealing the full password to key-loggers.
How to prevent misleading data usage
Some of these violations are common and ubiquitous. It's been well-known for decades that the UK train fares are not a metric, for a time even failing all three properties:

* Splitting tickets at an intermediate station sometimes reduced the total fare, so p(A,B)+p(B,C)<p(A,C);

* Reverse journeys are not always the same price, so p(A,B)!=p(B,A); and

* For a time it was necessary to purchase a platform ticket to enter the station proper, so p(A,A)!=0.

Even now I save thousands of pounds a year by finding optimal split ticket journeys, some of which take (partial) advantage of advance fare discounts.

So I'm not surprised, and no longer think of common sense as something to be expected from fare structures.
And I've just spent a bit of time playing with this service. I think that authors should be proud of their work and claim credit up front on HN.
> the laziness that it can enable

This is the entire value proposition of all successful technology. Dubious business practices notwithstanding, all successful yet imperfect technology is successful because more people found it let them be lazier than the competition. But in reality of course it's not laziness, it's efficiency. They can get on with other tasks sooner than before.
C++ Calculation at compile-time with help of constant expression
Yeah, I agree. I guess their argument is that it's difficult to catch every single fraud attempt, and in this case the behaviour was just not picked up by the processor's inbuilt fraud detection systems. Still, it should be the processor's responsibility.

GoCardless (Direct Debit, EU only at the moment) is one company that doesn't charge a fee for chargebacks. They take on all the risk themselves.
Impeccable Oven Cleaners in Melbourne
Thank you for the recommendation!
3D Secure can use 2 factor authentication, using a dongle supplied by your bank. Unfortunately there are so many other problems with 3D Secure that I wouldn't trust it except on high profile websites or for very technically competent users who are able to check the originating site and certificate of the iFrame used (ie. very few people indeed).
FLEX, an in-app debugging and exploration tool for iOS
We at Sift Science (http://siftscience.com) might be able to help. Feel free to email me at jason at siftscience dot com

Even if you don't use us, we published some articles to help merchants new to dealing with fraud:
* https://siftscience.com/sift-edu/fraud-basics
* https://siftscience.com/sift-edu/prevent-fraud
The big evilzone tutorial index (security and tech)
All the GitHub languages put in one place (with colors)
speaking of the ideal world one should be able to start any app, point it to any existing database, possibly a folder for storage and be done with it :D
Pozycjonowanie
> But in reality of course it's not laziness, it's efficiency. They can get on with other tasks sooner than before.

Indeed, and I use Docker myself to improve my own efficiency, and I've seen great stuff built with Docker that has been architected well.

However, it is painfully obvious that without the pressures that used to force most developers to keep their shit sane, there's now more workload for serious users that actually need to untangle this mess in order to support, secure and get stuff deployed.
Yes, but just before the last two big financial crises, Americans were buying houses they couldn't afford, second and third cars, taking loans etc...
I live in Macau, and the Chinese government's recent policy of cracking down on corruption, money laundering and their history of 'massaging' the news, leaves even the Macanese, Hong Kongers and coastal mainlanders suspicious of any economic statistics coming out of the government. Foreign worker quotas here, and the drop in gamblers, VIP especially have resulted in 36% drops from last year. Gambling/Casinos generate 80% of Macau's GDP. I hold out hope for a progressive, free China, but after observing the yellow umbrella movement in Hong Kong, and the mainland's actions and words, I am in despair. The people have been under this type of rule for so long, and the rumors are that the current administration is only going after corruption when done by political rivals, while saving face with their own party.
I truly believe consumerism is going to be humbled by a crash here, and hopefully a restructuring to head up with honest accounting by government if they want to be taken serious in the world currency market.
Show HN: Good looking radial graphs made easy in Swift
Downgradeable encryption is arguably better than none at all. It raises an attacker's prerequisites from just passive snooping to active tampering.

Yeah, it's an illusion of security to an extent, it's imperfect, but between waiting a decade or two for SMTPS delivery to be widespread, and using STARTTLS today, I'll take STARTTLS.

T̶h̶e̶y̶ ̶w̶o̶u̶l̶d̶n̶'̶t̶ ̶t̶a̶k̶e̶ ̶a̶ ̶d̶e̶l̶i̶v̶e̶r̶y̶ ̶o̶n̶ ̶p̶o̶r̶t̶ ̶2̶5̶ ̶w̶i̶t̶h̶o̶u̶t̶ ̶S̶T̶A̶R̶T̶T̶L̶S̶.̶.̶.̶ ̶i̶n̶t̶e̶r̶e̶s̶t̶i̶n̶g̶.̶ ̶ ̶D̶o̶e̶s̶ ̶a̶n̶y̶o̶n̶e̶ ̶k̶n̶o̶w̶ ̶i̶f̶ ̶t̶h̶i̶s̶ ̶i̶s̶ ̶u̶n̶i̶v̶e̶r̶s̶a̶l̶?̶ (Edit: may have spoken too soon. smtp.gmail.com responds "530 5.7.0 Must issue a STARTTLS command first." to MAIL FROM, which is I think to force a Gmail user to auth over STARTTLS before sending mail for relaying. The gmail.com MX servers don't appear to force STARTTLS.) Gmail could basically strongarm everyone into using STARTTLS and valid certs, for both sending and receiving, at which point we can release a new RFC requiring immediate STARTTLS or the connection will be closed, and everyone will already be capable of obeying it to be able to interop with Gmail.
Move to iOSss app
Unhackable Kernel?
Then, I would recommend, through experiences of doing what I dont love long enough, to reconsider what is more important, money or doing what you love. Of course, sometimes it can be just the money, or the learning, or working with a great team, but to recognize when it turns into a struggle and just drains our energy is something that is important.

Working with software, it is such a toll on the mind and the body, that doing it just for the money seems really pointless at least for me.

But I understand that this realization may come through only going through enough work that is not really fulfilling us inside on a deep level.

On a superficial level programming can be good just to gather resources, but is this really the best we can do? I mean, what if Elon Musk, Nikolai Tesla, Newton or other brightest minds would just worked for money ? Would we have the inventions we have today ? This is my point I want to remind people everyday.

I have worked for 5 years (3 of those fulltime, and so that I have always managed) on a project (http://GeoKone.NET and now http://Geometrify.net) that is the product of my pure love, and at times it has been difficult, yes, eaten a lot of porridge during those days, but the Universe has a way of supporting those who really want to help others, and to provide something to support others in their quest too!

But you have to give back something too in order for it to work. I think this is also a big problem in our society right now, not giving back, but just gathering resources for selfish uses, like many big companies do.

This is why I am reminding to really think about what we are putting our energy into.
Thanks, added. Interesting that this article didn't appear on HN at the time.
This has never caused any problems before. I'd actually completely forgotten about it until RVM or Ruby or RubyGems (I haven't decided yet who to blame) choked.

And it wasn't my choice — I started out 32-bit to save RAM on what used to be a fairly dinky plan. Some years later, Linode said I oughta switch to a 64-bit kernel for some obscure reason I can't remember.
Yes, odd issue with our dns, link corrected.
In the old days things were supposed to just work. `./configure && make && make install` should always have worked around any local peculiarities.
Yeah, WebGL -implementations seem to be really finicky still, and have the possibility of hard crashing machines, at least Macs.
More evidence of an impending black hole collision
All the docs refer to the legal entity, not the brand, which may be causing some confusion. Happy to chat more about specific use cases over a medium that's better suited to it; mind shooting me an email? pete at smyte dot com
Plenty of 9s for HA MySQL, MariaDB, MongoDB and Postgres Databases at Percona Live
Something similar was used in the UK for online banking, using a small reader [1]. It's a feature of EMV (chip) cards.

[1] https://c2.staticflickr.com/2/1218/1438197131_1e0d474266_b.j...
> Your genes programmed you to believe that your "own gene survival is of zero interest to [you] personally." They did that because they found that exhibiting that belief was a good way to get themselves into the next generation.

This is a compeltely meaningless statement, with no basis in fact. Genes do not consciously 'trick' you.

It's also a logically problematic. How would my developing to experience no paternal instinct actually lead me to have children? Short of me being irresponsible during sexual encounters (which I'm not) it won't happen.

> Some substantial number of people who go around thinking that they aren't just acting as machines to propagate their genes...

I never claimed otherwise and a I actually agree with that.

However the urge to have sex is very different from the urge desire to have children. You might want to look into that.

> ...find that their independence from gene control just happens to lead them to have a nice large family because their unselfish spirits love their spouses and children.

Again, no basis in fact.

This is very patronising and condescending as well. You're claiming to know my own mind better than I know it myself which is the asbsolute height of arrogance. You're also indicating people are selfish if they don't have children, which is competely contradicts what you said above about people just being machiens for genetic propagation.

I'm not even sure what to say to this other than you sound like a horribly shallow and judgemental person with a high degree of cognitive dissonance.

You might want to accept that fact that there are millions and millions of people across the globe that consciously decide to never have childre, for a variety of reasons. It may also come as a surprise to you that these people do not suddenly break down and end up with large families because their genes 'tricked' them into it.
My experience with card company fraud detection systems is that they were bafflingly useless. Maybe they've gotten better recently. But even Stripe seems to let through things that are obvious fraud, stuff that wouldn't pass a basic spam filter.

It's almost like they want to charge you those fees!
> But I still think that using docker is probably better than having the user do that manually

When it comes to deploying, supporting and securing complex web application software, it is very rare that an out-of-the-box reference image from the project or vendor will have much relevance to your own environment's security and configuration standards.

Unless you're paying for support, and the vendor insists you'll have to suck it up and accept whatever madness their support agreement entails.

I'm all for convenient docker images, it just frustrates me to see the total and utter lack of imagination demonstrated by some projects that can't imagine their users ever locking down their database access, or running with SELinux, or separately patching the software/service components they depend on, etc.

And again, I don't expect the reference docker image for a given project to allow all of that flexibility and configurability, it's more the fact that these possibilities seem to be actively sabotaged with reckless abandon.
Wow Kidz
Thanks for the clarifications regarding documents. To be precise, my confusion was due to not finding the Smyte brand mentioned anywhere in there, although I did admittedly only skim-read them.

>Happy to chat more about specific use cases over a medium that's better suited to it; mind shooting me an email?

Well, I could do that; I'm just not sure why you'd invite questions on a public forum and then quickly switch to email :-)
For additional 20 zloty on top of my normal plan I get unlimited LTE (i.e. about 100 GB with full speed, then it can slow down).
Was stunned two when hit the first time by such a tsunami. Your blog post is great, don't think this is common knowledge.
The Nintendo Guitar Boy
How I got 20,000 credits in my Shuttl App Account
I thought the same when I've stumbled on it.
Actually, the real point is that the average person doesn't need engineering precision which is my original point. Whether it's 60sec or 65sec to xfer a file doesn't matter to them. Engineers always like to argue precision to justify complexity and lose sight of the larger picture (eg. consumers/majority matter).

btw- how does expression it in bits v/s bytes help you with your desired calculations?
Realtime KVM