skysight-inc/HackerNews huggingface dataset:
I've been thinking how interesting (fun and a little mean) it would be to teach a Software Development class where you
- assign groups of students that don't really get along,
- have groups consume APIs written by previous groups,
- change the assignment (slightly or significantly) every week or so,
- constantly email students asking if they could "just make one little tweak"
- etc...

If you were completely up front about expectations (this is about learning the processes/pitfalls of software development, not about submitting a polished assignment at the end) maybe you could give students a sense of the skills needed to succeed not just at computer science, but software dev as well.
> "Our attack only covers users that click the “Store my password” option though so, don’t store your master password!"

> That seems a rather important detail.

It's also against LastPass's best practices. When you click that button (Remember my password) you get this:

"Are you sure you want to have LastPass remember your password? This will significantly decrease the security of your LastPass account!"
Unfortunately the popular sites like youtube have not-exactly-DMCA arrangements with large copyright holders, because otherwise they would (still) be indefinitely in court and spending millions upon millions (regardless of the merit of the cases).
Well. I missed that memo. Or rather I kinda sorta knew it was getting devalued, but a Padlock in my browser is something I trust. If it's not trust worthy or verified should we not go the whole hog, dump trusted public keys from all browsers and move to the web-of-trust / certificate pinning.

From the blog:

just too much of a hassle. The application process can be
confusing. It usually costs money. It’s tricky to install
correctly. It’s a pain to update.

If the reason there is not enough SSL around is because it's too much hassle for webmasters, I doubt there is a solution. If you want to take payments you get SSL. if that's too much hassle PCI compliance is going to really stretch you.
according to the tutorial "F* provides a facility to specify interfaces to external modules that are implemented elsewhere. For example, operations that perform file input/output are implemented by the operating system and made available to F* programs via the underlying framework, e.g., .NET or OCaml."
It lets Apple run ads that say "iPhone 6S: starting at $649."
All the business web apps I've worked on that use relational databases with an ORM layer, are already modeling the world as a half-baked graph. I'm reminded of https://en.wikipedia.org/wiki/Greenspun%27s_tenth_rule.
Yes: http://www.genetic-programming.org/hc2015/cfe2015.php
Doesn't LastPass encourage you to install their browser plugin though?

https://www.dropbox.com/s/pzmdqex81tsicyk/Screenshot%202015-...
Why? There's a market for it, and Gears of War is much different from a multiplayer standpoint (ie much more skill driven) than its descendants.
I thought the purpose of Relay is to get you to use a graph db. I think of GraphQL as a layer that sits between the REST API and web application, allowing you to specify custom queries that interact with the REST API behind the scene, so your REST layer can be application agnostic and you won't have to hardcode any application specific transformations between your REST API and your web or mobile or xbox etc app.
'Let's Go Crazy': Woman whose video was yanked from YouTube wins court ruling
I think part of your disagreement is that the original poster is from the UK and you're talking about US education. The systems are similar, but subtly different enough to cause talking past one another.

In the UK you don't pick universities based on price. The government imposes price controls on higher education and (as far as I know) ~all universities charge the maximum amount. Whenever the caps rise, they all raise their prices to the new caps simultaneously. So in effect universities do not compete on price, only on reputation. Students therefore all attempt to get into the "best" universities as determined by basically unchanging perceptions of reputation that exist on a global rather than per-subject level, and the admissions system ends up allocating people based on grades.

So your point about there being a healthy market isn't really on point. For the OP, there simply is no market.

As an additional point, in recent times there has been absolutely massive rises in the price caps and therefore prices. When I went to university it cost me about 10,000 GBP in total. The year I graduated the professors all went on a kind of pseudo-strike where they refused to mark exams (but they still did research and they still got paid their full salary). The strike was because the government had tripled the price caps in order to try and boost capacity, and the staff decided they wanted to keep capacity the same and all get a pay rise instead. Their strike was successful, the (unbelievably weak) administration caved and the entire tripling of their income was immediately passed straight through to higher pay.

The OP claims he paid around 60,000 (about $100k). This sounds plausible to me if it includes costs of living as well. This is a lot of money by anyone's standards, especially compared to the recent past when it was a lot cheaper.

So I sympathise with 1971genocide. I too went through the UK universities system, studying computer science, and had exactly the same frustrations. I went to a university that is considered to be in the tier just below Oxbridge, many of the students there were from very rich families. The universities reputation is good. Yet the staff were incompetent to a degree that was truly mind blowing. Very few of the people who graduated actually became software engineers full time (many went into e.g. generic consulting roles, consultancies, finance), partly because so many people graduated entirely unable to write even basic programs. Many who studied soft subjects there ended up in dead end jobs earning too little to even begin paying back their student loans.

Looking back, I probably should have skipped university. It made me miserable too, and I got a job offer (from Google) before graduating there based on open source work I'd done. If I had gone straight into a job from 18 I'd have probably been much happier and healthier in those years.
Incorrect. Inclusion into the Firefox root store is being tracked in https://bugzil.la/1204656 and has not yet been resolved.

Firefox trusts the cert on TFA because letsencrypt.org itself is using a certificate signed by IdenTrust.
Thank you - bang on the nail there. Yes we like art, but we sell a lot more TV than theatre.
>It sounds like you and the person you responded to are saying that there were self-driving cars in the year 2000? There really aren't even self-driving cars now, in 2015.

No, I just dismissed it as close enough (the 15 year gap doesn't matter much if you predict in the 50's-60's -- it's just 20-30% off in the date, and they still got the technology right).

Today, besides multiple projects (Google, Apple, Tesla, GM, for self driving cars being demonstrated etc) we have mass market self-parking cars.

>I think the shift to self-driving cars will be more of a social/cultural/political challenge than a technical one. I might even go so far as to predict it will never happen

If it's slowly introduced as a feature to new models, then as soon as people see how convenient it is, they'll enabled it. Some people will resist because they want to "have control" and are afraid, but most will use it. They might start using it 20% of the time or so, when in a traffic jam, when talking on the phone, when tired, etc. Soon they'll just leave it on most of the time. 15 years after they become mass market, small kids will have known them all their life, so even easier for them to adopt.
Not to mention that (as I understand it), he wasn't even trying to play the Nuremberg defence so much as claiming he'd assumed it was OK because people that could have didn't try to stop him.
Yeah, the keychain is obviously encrypted, but I still feel uneasy about it being naked on Dropbox. The reason I'm leaning towards using encfs + Dropbox vs iCloud is that although I definitely trust Apple more with my data (compared to Dropbox), I feel that an encryption controlled by me at client side will be safer.
Not having used ReactNative before, how would that change? Wouldn't you still have to at least redeploy the app to the phone if you change the JS?
There is an account recovery mechanism available to those with a LastPass extension that is or was logged in to the account in question. Dropbox is the same way - if you forget your Dropbox password you can use your logged-in copy to get an authenticated session and change your password.

It will be news if there's an account recovery mechanism that can be exploited by a total stranger without access to your copy of Chrome/FF.

You would expect that 2FA could be bypassed for the locally cached password database, since AFAIK there is no such thing as requiring an OTP to decrypt the ciphertext that you have, only to prove to a server that you know the TOTP secret.

Lastpass discloses that you can turn off 2FA for new logins by proving ownership of an email address. You can set a separate email address for this purpose, and I believe also turn it off.
Yes, of course if your live machine is owned you lose.

However, this means you can potentially recover vaults from unattended / stolen / lost / unwiped hard drives, phones etc.
GoPro: Something Goes Wrong
Previous discussion: https://news.ycombinator.com/item?id=10216786
Please allow me to elaborate a bit.

Storing multiple passwords within a single master password means your security is only ever as strong as your master password is safe. Literally "putting all your eggs into one basket". Same with centralized email. One should separate accounts by email such that if a single email is compromised - not every account is compromised.

My argument (and practice) is to have individual emails for individual accounts. Using a dice selection method [0] they'll be as secure as any individual master password. The issue is burden of memory.

The argument in favor of password managers is that they relieve the user of burden of memory by exchanging a small chunk of security for a large chunk of convenience. Which is why I use a password manager.

The actual bet however is that somewhere in the implementation of password managers there will be found something that is so insecure it allows someone to "seize the basket" and more or less make the trade-off go from a "small chunk of security" to "all security". Specifically, any PM that doesn't require the device being compromised; though physical access is fine. (Physical access allows memory attacks but the device itself is not yet compromised.)

I hope that helped give my position some more nuance.

[0] http://world.std.com/~reinhold/diceware.html
Very similar to the strategy of community organizing used in politics and social movement building.
How China's Economic Woes Could Hurt the Revenues of American Universities
Suspected Delta State Gunman [pdf]
Ideally, you will learn from a bootcamp how to self-teach yourself, so you would not need to spend more money on a second bootcamp.
If you happen to know a browser developer
I have a strong dislike for these artificial THC drug pushes, because they ignore the real issue: the fact that marijuana helps people with a variety of medical ailments is largely because of the over 400+ cannabinoids, of which THC-cb1 and THC-cb2 are only two, while we are ignoring the other ones individually and as a compound/complementary effect.

For example, I know vets with PTSD who say mj is the only thing that helps them, but some of them are in states where the VA will stop providing care or withhold medication/treatment/payments if they test positive... but the VA has a deal with some pharmaceutical companies and it's legal to give two variations of synthetic THC, and every single one of the guys I know who have tried it have said it was nothing like mj, provided almost none of the benefits, and was often a very negative experience.

Don't misunderstand, I worked in biotech for a while and encourage the learning process of using methods like this to potentially produce and study certain drugs, but this is a drug that doesn't have a supply problem, because it's everywhere, it's easy to grow, it only has a legal problem. Synthetics seem like a way to capitalize legally on a black market that shouldn't exist.
Everyone repeat after me, wildcards, wildcards, wildcards.

(just hoping they will appear next year)

One more nail in the coffin of the ssl cert mafia.
It's not a search monopoly, it's an Android monopoly. And they're abusing that monopoly to increase their market share in search.

You're looking at the wrong monopoly!
That's a different functionality. You can use the plugin and not save the master password. The plugin is more secure than the webapp anyway. You do the decryption/search completely on your machine.
This has me breathing a sigh of relief. That said, why is this even an option??
See my response to other commenter on parent comment.
OpenBSD (U)EFI bootloader howto
Peter Thiel: A Biotech Education, in Progress
Yeah, I'm aware of some of those security issues (I understand that it can't help me if I am targeted. But, I may be safe in broad hack attempts). However, I just don't have any solution that has the convenience & stability of Dropbox + encfs. What do you use for syncing docs securely?
There are some scenarios in which compromising a machine once is much easier. A lost device is one example. Installing a keylogger won't provide any value there, but if this exploit can recover the Lastpass master password and disable 2FA authentication (if enabled), then they will have access to the entire vault.
Only if they told the browser plugin to "store my master password." That shouldn't surprise anyone -- if the master password is stored somewhere that the plugin can read it without any additional decryption keys, so can an attacker.
But the certificate is (supposed) to say we have verified that this person / organisation exists and is "allowed" this domain.

Now if we extend the idea of every business or even human having their own (sub)-domain (lots of good benefits there) then we are in the territory of ensuring the CA's track you from birth - that's what governments do, and boy are they expensive.

I think what I am saying is we either have CA we can trust or we dump the whole thing and go to web of trust
javascript:(%28function%28%29%7Bwindow.baseUrl%3D%27
https%3A//www.readability.com%27%3Bwindow.readabilityToken
%3D%27%27%3Bvar s%3Ddocument.createElement%28%27script
%27%29%3Bs.setAttribute%28%27type%27%2C%27text/javascript
%27%29%3Bs.setAttribute%28%27charset%27%2C%27UTF-8
%27%29%3Bs.setAttribute%28%27src%27%2CbaseUrl%2B
%27/bookmarklet/read.js%27%29%3B
document.documentElement.appendChild%28s%29%3B%7D%29%28%29)

Make a bookmark out of that (all on one line, newlines added to not kill page formatting), toss it in your browser's bookmarks bar, and click to convert. It's crazy awesome.
I think that's a really compelling viewpoint. Why should society have any rights to an artistic creation? I can have perpetual rights to some land that my ancestors (well not my ancestors since I'm an immigrant) stole from native Americans, which existed long before any human was alive, but somehow my right to something that I created that never existed before is subject to a social balancing? I don't buy it.
Alternately, it means that 95% of the CS students are in the wrong department.

I'm always confused when a well-respected university is criticized for not delivering a vocational education. How did people think that the university became respected in the first place? Hand-holding dummies through the other majors' equivalents of paint-by-numbers web application frameworks?
Do police body cameras protect the public?
Absolutely. I badly need a wildcard cert to do any of the SSL-ing I'd like to do.
I would just make the project a webapp, and make sure that the site works well on mobile. Later on, when you have traction, and probably users, you can code up a native app for it (or if you have a lull of things to do and get bored :P)
Because people still buy them. It's that simple.

For a parent buying for a smaller kid, a business/organization buying for its employees, or a senior citizen who just runs a few apps, it's ok.

It's obviously not for people wanting to record videos in 4K (or record videos in general -- lots of older people only record a few minutes or so a year, some grandchild's birthday or such).

If you do that a lot, you get a higher end model.
In 1983 2 million was a shit ton of money.
By comparison, in 2015, it would be around 5 million

I expected a difference of an order of magnitude or more...
Curious... If the Fourier transform can be 'calculated' by photons passing through an optical lens, has anyone ever produced a component that could capture the computation numerically? I.e., some sort of capsule/chip with:

* A digital-to-analog converter with pixel array on one end
* A lens in the center
* A sensor array with an analog-to-digital converter on the other end
Ugh, what a load of tripe.

First, there's no strong evidence that biological brains make use of quantum phenomena except insofar as those phenomena drive normal chemistry.

Second, if brains do make use of quantum phenomena in weird ways, the effect would not be visible at a level as abstract as decision making. Such processes operate at the level of hundreds of millions of neurons, at which point classical approximations are quite accurate. Any strange quantum phenomenon would operate at the level of single neurons, outside of which the quantum numbers grow so large as to approach classical statistics.

This quantum mysticism needs to stop. There are much better ways to explain psychological effects like indecision than a (horrifically tenuous) analogy to quantum physics.
Looking at http://helloworld.letsencrypt.org/ I see:

> Let's Encrypt hasn't yet been added as a trusted authority to the major browsers (that will be happening soon), so for now, you'll need to add the ISRG root certificate yourself. Specifics will depend on your browser. In Firefox, just click the link.
No, because it's an actual application. Edit this and submit a PR: https://github.com/jmapio/jmap-perl/blob/master/htdocs/index...
You can't just wave your hands and say "I think this number is small, so I'm going to call it zero". There's an infinite difference between any nonzero number and zero. And in fact, the economic value of an average piece of art is obviously not zero. I'm not going to bother to try to estimate it -- do any 3-year-old's scribblings count? -- but it's not zero.

You're also overlooking the rather obvious and important fact that the quality of different works varies tremendously. While it's true that appreciating art does require some time, the amount of value I receive in return, and therefore the price I'm willing to pay, is a function of (my perception of) the quality of the work. And it doesn't necessarily take me more time to experience a higher-quality work than a lower-quality one.
it looks like they are able to reference mscorlib https://github.com/FStarLang/FStar/blob/997b1f20f35142e65032... and F# with these externs https://github.com/FStarLang/FStar/blob/997b1f20f35142e65032...
Password manager file format comparison: https://news.ycombinator.com/item?id=9727522

According to this paper Password Safe is the best. But really bad it is mainly for Windows and only expensive 3rd party OS X client. So I'm stuck with KeepassX (btw. 2.0 beta 2 was recently released)
In other words, it's a terrible place to start a career in software engineering.
Just waiting for one of these companies to create a "Hack the Promotion" promotion. Customer who devises the most efficient hack wins (maybe double/triple miles?).
Except TFA is online, and the source is only online. The New Yorker is a grown-up capable organization; they could somehow handle linking to a tweet two sentences before. (I don't have the print version so I can't say whether the tweet URL/QR/etc is included in that.) SEO love would seem to have been the least they could have offered to little old Mashable for the helpful lead-in quote.
College is needed. College is needed because US highschools are horrible.

I see too many people in the tech community with zero useful communication skills. They don't know how to speak properly let alone write properly. The documents they produce are gibberish. Sure, they can spin up a cloud server and get it doing something useful, but they are totally unable to explain what they are doing to others. They then claim this lack of communication is rooted in those other people lacking tech knowledge.

College, university, provides bedrock standards through which educated people communicate effectively. Reading Shakespeare in english 101 isn't going to help you compile a new app, but it will help you communicate with someone on the other side of the planet who also studied Shakespeare in some other classroom. The ability to articulate not general feelings but specifics communicable to others without mistranslation is a skill very much lacking in the tech world.
Firefox doesn't trust the cert yet. The application to be added to the root store is here https://bugzilla.mozilla.org/show_bug.cgi?id=1204656
Thanks! I also disabled the plugin. As 1Password asks for my password every few hours anyway (I lock the screen every time I leave the desk), hopefully it won't be as inconvenient as I originally thought.
I'm not sure how that relates to the point being made.

The insecurity comes from someone already having physical control of your machine, and if you had alowed saving of your master password (which Lastpass and anyone sane encourages against).
It is who you sell to. My sister went to HS with two brothers who trained as sculptors. They had to hustle for dumb jobs (like gates or repairing dumpsters) for a long time until they began to get work making interactive sculptures for playgrounds. When city councils want to build a park they tender for contracts. The brothers built their portfolio up over time and kept submitting tenders for this sort of work. Nowdays it is a successful business for them and they win contracts overseas.

Etsy isn't selling to the market that artists need to target unfortunately.
Actually, IMHO, it's easier than ever. Supply can't keep up with demand, and anyone who can show demonstrable skills via a portfolio of relevant personal projects and the demonstrable practical knowledge is on the fast track.
It took them 10 years...
Great article, in my opinion it sums up the immense possibilities of data usage in modern research. Coming from a health science background I quite often get frustrated from how long it takes for a scientific paper to go from hypothesis to publication. I believe that the use of our immense computational power to process through large amounts of data will continue changing the traditional approach to research. Once we figure out how to reliably tackle the inevitable bias of these data sets traditional data collection will become a topic in statistics history.
Hmm, that's taking a long time assuming Mozilla itself is involved in the project.
He's represented by Yale's legal clinic.
The padlock means you are connecting to the owner of that domain. That's a very valuable guarantee.

EV validation and whatnot is essentially a nice way to burn a ton of money on borderline extortion.
Squeaky wheel gets the grease. There are too many people who make their living by producing squeaks rather than grease, or wheels for that matter.
Erythritol.
Fixing a bug in production