skysight-inc/HackerNews huggingface dataset:
> the problem is, if you intend to use the data within the application, you need to be able to decrypt it

... which requires the encryption keys to be know at the point of use - but it doesn't mean that they need to be kept with the database. It doesn't necessitate asymmetric encryption either.

If you keep the keys in a different location, completely away from the database server(s), then a compromised database or backup does not compromise any of the information. Of course there are attack routes that would still give access to the keys too, but you have covered quite a few common attack vectors.
Fun fact. The deck size isn't limited by the rules in tournaments as long as you don't delay the game by shuffling/handling it. A deck with around a thousand cards would be quite a nightmare to deck-check by a judge, and still be fairly quick to shuffle.
I guess we could argue that if you get security seriously enough you don't get hacked.

EDIT: I was being sarcastic.

This is a good read: https://www.schneier.com/essays/archives/2000/04/the_process...
Read this - http://www.lexaloffle.com/bbs/?tid=2074
What if you use the email as extra bits of entropy? Like you can append the password to email then hash it. Of course you lose the ability to send emails and account recovery, but its an okay tradeoff for people who want more security.
This is the first time I've been Pwned (https://haveibeenpwned.com/)

Does anyone know a responsible way I can check WHICH of my data has leaked short of downloading the entire archive and searching for myself?
Amazon Will Ban Sales of Apple TV and Google Chromecast
I'm wondering what their setup is?

Are they running on their own machines? AWS? Heroku?

From looking at their careers the use PostgreSQL/MySQL, Python, Scala, Ruby, Node.

I am assuming because of the nature of the breach that they are running their own servers (either on AWS or their own machines), it's a completely compromised server which had access to everything.
Well. You can have as many cards as you like, but still just 4 copies of any card, apart from basic lands. So there's very little benefit to having 200 cards in your deck.
Crumbling, really? I find many of them quite beautiful.
Given hindsight, it's always easier to ask for more tests or code comments. I guess the rule of thumb is that if the code is there, it most probably is there for a reason.

When something like this happens, it's always a series of oversights.

1. Someone forgot to add comments or test cases while writing the code (or perhaps he wrote it but people are not running the test cases before commits).

2. Someone else thought that the code is dead and deleted it (and skipped the test cases if there were some covering that particular scenario).

3. Either the person deleting the code didn't wait for the code review or code reviewers missed that as well. (If code reviews are non-existent, it's a disaster waiting to happen).

So in the hindsight, write comments, write test cases, run test cases and do code reviews carefully.
Checking something out on some server does not require remapped keys or commands: you generally just browse some file and fix a couple of things. Tweaked configuration for more involved tasks is fine, to me.
Edge is not cross platform so those of us who don't have any devices running windows don't have any exposure to it in order to praise it. That said, nobody I know refers to Edge as "just IE"; in fact, it's not even considered IE (the name is Microsoft Edge, right?). In any case it's good news that Windows users will finally have decent browser by default. That is, when Edge adoption/usage is higher than all IE versions combined).

My point being: IE is just IE. Edge is Edge and we're happy about it.
Working late, responsibly
Mendeley: Free reference manager and academic social network
Show HN: TheJackStack – An easier way to develop and deploy static sites
You can use a hardware module with securely stored key to do that for you.

If the whole machine is owned, then I guess it would possible to set limits on these operations. Or at least it can trigger an early warning.
How exactly is this better than http://www.amazon.com/Tomy-Megasketcher-Magnetic-Drawing-Boa... ?
If you feel "Les Espaces d'Abraxas" is oddly familiar, it's because you've seen it before. It's one of the set of the Terry Gilliam movie Brazil ...

If you don't mind the French, http://www.lemonde.fr/societe/visuel/2014/02/08/en-seine-sai... has more.

For a more representative portfolio of Paris suburb "architecture", you can look http://www.thecinetourist.net/93---seine-saint-denis-la-cour... and it's bleak.
In the case of Patreon, you might at least assume some negligence, as they had their development servers accessible from the public using production data. In other cases it might be harder to tell. Shielding your dev and staging servers and using mock user data is pretty standard IMO.
I have already requested my Patreon account to be deleted, as they clearly don't understand how to protect customer data.
This is the funniest thing I read today on HN, congratulations
The same way you do it for medical negligence: courts.
is TaiG 2.4.3 jailbreak support with iOS 9.0.2? – iosjailbreak-download.com
Mentoring newcomers to the Rust ecosystem
I wonder how much they'll bring in from self driving cars? How about the longevity stuff?

Self driving cars definitely appear to be a when not if and have the power to revolutionise the world. Might cost them a few billion to get there but the revenue they can generate from the technology once mature is immense.

Again the longevity has similar prospects, though it's a lot less certain if it will actually work and if it does will face an uphill battle. I think many will have moral objections to it (it will allow the rich to keep living and keep getting richer), few will have moral objections to the self driving car.
Simple enough to ensure each transfer uses both a unique transfer id and then a simple packet sequence number counter. This would ensure every request is unique.
"The authors examined the dietary data of 36,400 Americans between 1971 and 2008 and the physical activity data of 14,419 people between 1988 and 2006. They grouped the data sets together by the amount of food and activity, age, and BMI."

^ The previous paragraph to the one I quoted above.

Methods

Dietary data from 36,377 U.S. adults from the National Health and Nutrition Survey (NHANES) between 1971 and 2008 was used. Physical activity frequency data was only available in 14,419 adults between 1988 and 2006. Generalised linear models were used to examine if the association between total caloric intake, percent dietary macronutrient intake and physical activity with body mass index (BMI) was different over time.

Results

Between 1971 and 2008, BMI, total caloric intake and carbohydrate intake increased 10–14%, and fat and protein intake decreased 5–9%. Between 1988 and 2006, frequency of leisure time physical activity increased 47–120%. However, for a given amount of caloric intake, macronutrient intake or leisure time physical activity, the predicted BMI was up to 2.3 kg/m2 higher in 2006 that in 1988 in the mutually adjusted model (P < 0.05).

Conclusions

Factors other than diet and physical activity may be contributing to the increase in BMI over time. Further research is necessary to identify these factors and to determine the mechanisms through which they affect body weight.

^ Copypasta from the referenced medical study: http://www.sciencedirect.com/science/article/pii/S1871403X15...

What I think I'm seeing is a confusion with the conclusions. What they found was:

1988: Daily calories = x, leisure play = y, observed BMI = z
2006: Daily calories = x, leisure play = (1.47 to 2.2)*y, observed BMI = 2.3 + z

The same amount of calories today results in greater BMI.

Either the average person's body composition today has a greater percentage of muscle and that's throwing things off, or something else is up with how we live that's making us heavier.

But, we see other studies out in the wild that suggest average fitness is lower, which leads me to think the former solution might not be the case.
I like it though. The Louvre may be a beautiful monument, but that doesn't mean we should still build in that style.

Many ugly, pointless buildings were constructed in the 17th century as well, but our ancestors have simply not felt a need to preserve those.

Most of these buildings you have a distaste for will reach the end of their useful life, be demolished and replaced with something new. I like to think that the nicest ones will be preserved, and will become the monuments to late 20th century architecture for our descendants to enjoy.
Most of those look really nice. He should pay a visit to Novokuznetsk or Chelyabinsk or whatever blank post-soviet blank industrial city for really degenerate high-rises.

http://my-magnit.ru/sites/my-img/st/tuls2.jpg something along those lines
The origin of a name is statically known in the location (i.e. file, expression, whatever). The origin of data is dynamic and can vary at runtime based on arbitrary previous evaluations. Unless you're going to propose making types unique (i.e., not compatible) depending on their origin and enforce never mixing them in the compiler.

At which point you have basically reinvented "newtype"
Patreon uses Stripe so I'm pretty sure the hackers expected to not get any credit card numbers.
1.2.: Business model for "horses" is to pay back shareholders by delivering a valuable service to actual customers at a reasonable price. Business model for "unicorns" is to build the largest possible user base to attract the largest possible investment inflows.

More information: Unicorns vs. Horses https://medium.com/@awilkinson/unicorns-vs-horses-f81d8dd61f...
On a related note, Knight Capital lost $440 million due to a software bug a few years ago.

http://www.bloomberg.com/news/articles/2012-08-02/knight-has...
Show HN: Orbiiit – Discover the social media world
> Promises are not the only way to do async work in JS, as much as some people like to say that. You have observables and channels, which are more powerful because they handle streaming.

Let me just try and translate that into sync-land: "Single value variables are not the only way to do work in JS, as much as some people like to say that. You have arrays and queues, which are more powerful because they handle multiple values"

(my point being, different abstractions are useful for different things and/or in different ways)

> There are proposals to make async/await more composable: https://github.com/jhusain/compositional-functions. TC39 is aware of this but I'm not sure if they are going to fix it or not.

I agree, but I don't think we need async/await at all.
http://spion.github.io/posts/es7-async-await-step-in-the-wro...

> You shouldn't be forced to run code inside a try/catch.

How is throwing on typos useful? The real solution for that isn't letting errors get through. Its having a type system like TypeScript or Flow plus using a sensible library like bluebird that reports rather than swallows up unhandled errors by default. Afaik errors from native promises are reported to the console in most browsers. And there are also tools like this: https://github.com/emberjs/ember-inspector/wiki/Promises-Tab

Allowing thrown errors to propagate synchronously will destroy many contractual guarantees that make promises useful in nodejs. For example, we would have to remove this entire section in Bluebird: https://github.com/petkaantonov/bluebird/blob/master/API.md#... and instead fall back to process crashing and restarting. Lack of error catching is what makes node unable to provide a safe solution to the crashing problem (and domains capture errors in both directions of the call stack which leads to problems inside node internals). Promises neatly solve that by providing a sensible error capturing and propagation model that isolates node internals from promise code: https://github.com/petkaantonov/bluebird/issues/51
I'm so sorry for the repost. Had to delete the previous post for some reason.
Shark detection sonar system from Australia
Have you seem some of the villages in the French mega huge ski areas - some are amazingly ugly.

Les Menuires in the 3 valleys is particularly bad.
Since their servers appear to run on AWS, and knowing that the breach was possible because their development servers were exposed to the public with production user data, it is safe to assume that they had their development servers on AWS as well.
Startup creates mocap suit for VR, gaming and animation
How to Walk Away with Millions of Bucks
Well, it is. Most startups fail, meaning someone's investment simply evaporates.

There are unicorns, sure, and some startups stabilize or cash out, but if you pick any startup at random, you're likely looking at something that's burning money and will fail eventually.
There are cards that allow for copying creatures, so that can be worked around.

A more glaring error is the usage of Time and Tide together with comes-into-play effects. At least earlier, comes into play effects did was NOT triggered by phasing.

I stopped playing a few years ago, so they might have changed that rule though.
No actually we don't.

Security, if taken seriously is a set of policies related to software and hardware (in the post-Snowden era).

Applying patches like grsecurity, running services through chroot jails, installing IDS systems and reporting tools makes a system (every system) extremely inflexible. Updates become nightmare.

Tuning a system to avoid false positives might take a forever and then the topology/setup/clients/users change. Back to square one again!

New tech like docker or any kind of virtualization are out of question. You probably don't want PHP, Python or Ruby applications. Do you really need JS. Can you debug all the libraries the developers used? Is their responsibility or no, to audit every new shiny framework for security?! Are they going to pay for it? Is it worth it?

The personnel, even the managers, must go through a lot when the systems are secure. More often then than not, people consider standard security measures exaggerations, so they more often than not try to avoid all the hassle. Can you cope with these people, time and again?

And sometimes even taking extreme measures might not be enough[1]. We keep adding layers upon layers at all levels: Development, Sys-admin (now Devops), etc. Can audit every piece of software that comes into the stack? Of course not.

You either have a security team that breaks everyone's balls with audits and strict policies that will cost you money and most startups or even corps can not afford the kind of inflexibility and cost that this brings in.

Security is a trade-off and truth is that most of the times is just additional cost and complexity and even when you're ready to make that trade-off, you're still not invulnerable by any means.

[1] http://www.cnet.com/news/report-of-fbi-back-door-roils-openb...
The centralisation of services like this has to stop. Why should giving money to creators be a centralised thing (many to many) instead of just a one to many relationship between the creator and their fans?
Crumbling? Some of those buildings are beautiful! If only we had had housing estates half as good as those in London...
7 Reasons Why Everyone Should Work at a Startup at Least Once
After a certain point "how hard is it to press ctrl-alt-l (or windows-l)?" becomes a competency question.
As a European, I must assume you're familiar with the ghettos of Eastern Europe, and those in Paris as well. The question applies equally to those locations, as it might to Rio, Manila, Mexico City, Delhi, Jakarta or Detroit.
Disclosure: I am a big fan of brutalism. I had no idea that there was stuff like this in Paris. I'm almost tempted to go out and tour it - it's beautiful.

In Britain, where I live, there is a general tendency to view older buildings as nicer buildings. Generally this is because only the stuff that's nice enough to keep/protect ends up surviving. This leads me to wonder what will we choose to keep from the 20th century. Which buildings will still be standing in 2500?

Buildings like those in the article make me sad. They are currently in horrifically poor condition after decades of neglect. On top of that, they are very unfashionable, brutalism seemingly suffering a similar fate in France to the UK: association with low-quality housing projects, a mid-century utopia that quickly became a dystopia. In London I am surrounded by treasured buildings nearly all of which had to fight against demolition at some point - for example the gothic hotel at St Pancras: https://en.wikipedia.org/wiki/St._Pancras_Renaissance_London.... I wonder, if we hung on to them for long enough for the associations to dissipate, would we come to treasure them?
Experian hack exposes 15M people's personal information
So what of importance is in their database that one could not find by otherwise searching the web?

From the email i received from patreon i reckon the only actual private thing is the exact sum i pay to who.

Some find addresses to be private, but at-least in my case any one can find where i live by looking on the local yellow pages website.
There is a lot we can do as programmers to make data leaks of that scope a lot harder to pull off. I think web apps of a certain magnitude should not be talking directly to the database, they should be talking to their internal data API that resides on a different server. The reason for this is that a completely separate data layer is easier to lock down, and also way easier to monitor for unusual activity. Ideally, that internal API server couldn't even communicate with the internet directly.

I've been doing web programming for a long time, and while direct DB access is both convenient and fast, I have to admit it's not easy to monitor these databases for breaches, or to stop them from spilling their entire contents if so requested.
Also, someone who was quite likely the guy that hacked them (he posted this data dump a day ago) was claiming on Twitter that they'd left a root console on that machine open and unprotected to the entire internet. Of course, he's a troll so he may well have been lying...
Why wouldn't the whole startup scene be money losing? Seems like a lot of hot money being spent on desperately acquiring customers for unsustainable and insufficiently differentiated or useful products.

If the hot angel money disappears the customers for all the dubious startups will too and you'll see some interesting times. Guess we'll really know how many log-parsing etc startups the world needs.
So content creators should use PayPal then for donations? That's also a centralized service. How do you propose a transaction takes place without a service to process the details?
Amazing product, amazing presentation music, amazing pictures.
Well, it's BI, so there's a 90% chance it's either overt stock manipulation or a press release. They don't exactly put out many substantive articles.
Seems stupid to call it flux
Looks like they use AWS, MySQL, and Python. They also use Stripe for payments (all their secret keys and source are in the dump).
Ah, development servers with real data.
This architecture and the ferocity with which they implemented it (No service calls!) seems very alien but they obviously thing the benefits outweigh the problems.

Does anyone else do this?
Different colour themes. I find it a lot easier working with light text on a dark background, others may differ in their preference. The Scratch editor written by the elementaryOS guys has some very nice themes, Gedit for the Gnome DE is not bad either.
People just won't sign up to a new service for each creator they come across it's that simple.
London VISA : Cinime is recruiting a Senior Java Developer, a JavaScript Developer, QA Testers (Junior and Seniors).
Please send me a mail if interested, johan.lajili@cinime.com
As others have said, this appears to be a total dump of the system and not just the database. It looks like the encryption keys were not kept with the database, but all of the SSL keys and everything are included inside the full dump. Seemingly it was another server with the keys that was dumped too.

The only way to protect against this would be some type of hardware key store with limited access to all employees and servers. I think there are a few (expensive) options which can do this, but nearly all services - especially startup services like this one - do not have this available to them.

Who knows if those hardware options aren't just as vulnerable to an experienced attacker though? I don't think they are generally well tested - probably half of the available options are snake oil.
Nice catch. They don't trigger according to the latest rules:

702.25d The phasing event doesn’t actually cause a permanent to change zones or control, even though it’s treated as though it’s not on the battlefield and not under its controller’s control while it’s phased out. Zone-change triggers don’t trigger when a permanent phases in or out. Counters remain on a permanent while it’s phased out. Effects that check a phased-in permanent’s history won’t treat the phasing event as having caused the permanent to leave or enter the battlefield or its controller’s control.

I don't think this is a problem because they don't use phasing to trigger comes-into-play effects, but only to change the color rules. This is clever because you can keep both parts of the machine, head and color, from interfering with each other.
I think it's a pretty common experience for people, as they age, to have something akin to the "impostor syndrome" and not really feel that they are older.

I'm only 30, but I certainly don't feel much different than at, say, 20, except for life situation.
Of course, because startup success is not a linear distribution. Most startups fail, only a minority succeed, so "randomly choosing one" is a wrong way to assess the whole market.

And that was my point about bankers looking at moonshot projects as "money loosing". They should looks at startup ecosystem as a whole and assess how much return on investment it has long term, and then look at Google's moonshot projects the same way (or more favourably, because Google is not a random startup - they can execute much better).
Might as well not use an email at all, no?
Traveling in Japan over the summer, I bought a powerbank. It was useful because I was moving a lot, taking a lot of pictures with my phone, using it a lot for other stuff without charging it. Plus I always had a 4G modem with me.

However, more than 25% of the Japanese I met were using Powerbanks too. Look around you at a smoking area, in the subway,... and those numbers may confirm themselves.
Recover password by email is a business requirement. You also need to be able to send users an email to alert them about numerous things such as credit card expiry or service termination, etc. It sounds like an option, but I don't think it's an option any real company will take.
Yep, similiar situation here. The getting started guides often just introduce a single concept and stops there. Many seems outdated as well. However, Spring Boot with whatever DB choice you make is a winner imho. Found it really easy to get going after just investigating a sample project.
It the whole startup ecosystem was loosing money (= not returning investment) then VCs would not exist.
Ways and reasons to run multiple mysql instances
I heavily disagree.

For one thing, not all of the things you said must be mastered, vim is plenty big enough to support various ways of working. E.g. I never use the arglist.

For another, from a pedagogical perspective, there's different levels of "mastery", and there's nothing worse we can do to scare off people trying to learn a new editor than to tell them "oh, no, to be considered a real master you need to put in months of learning".
Surely it's because it looks like a flux capacitor. Seems reasonable to me.
Maybe we should copy the brain design? Fold it and put cooling liquid around?
Facebook as well with TAO https://www.facebook.com/notes/facebook-engineering/tao-the-... I think they presented it at one of the @scale conferences.