skysight-inc/HackerNews huggingface dataset:
The chip would not have the bank's private key - that'd be bad for the reason you mentioned. It'd have a unique private key signed by the bank. I.e. exactly how certificate systems work. (Still would have issues of cert management if the bank's key or system master keys are lost.)
I don't think anybody is saying that Amazon didn't check with their lawyers before doing this and determined that it was OK.
That looks a lot like C to me, which I wouldn't call a dynamic language.

typedef struct Foo {
int a;
int b;
} Foo;

Foo f = (Foo) { .a = 1 }; // This will initialize b to zero.
There are lots of libraries in C (and Java) but the question is which ones are essential for whatever you're trying to do? There are lots of Go programs you can write just using the standard library. That appeals to me since I'm generally in favor of avoiding unnecessary dependencies. But if you need it, you need it.
Suppose that it's a fabrication. You could hire some independent company (e.g. Gallup or whoever) to conduct a confidential company-wide survey to determine how many employees have seen someone crying at their desk (or did so themselves), and approximately how many times in the past N years for some N. If the survey turned up results close to zero, that would support a case that the former employee is making it up. (Of course, subject to the limitation that the survey would only include current employees.)

There is also the principle that the burden of proof is on the one making a claim, and not on those who disbelieve. Lots of people cried on their desks? A few names, or it didn't happen.
It looks very much like it is happening. I have to travel to another country to get a procedure done? Oh well. Medical tourism has been a thing for a while.
According to Wikipedia, a 300m+ impactor is indeed a serious threat. https://en.wikipedia.org/wiki/Impact_event
Comprehensive look at how to apply for section 8
Depending on how much you know about Tufte:

Tuftes basic principle is to use as little "ink" to show let the data provide as much information as possible. I would claim this is still his most important and fundamental principle.

With ink he normally means other elements (line divider, borders, gradients) than the data elements themselves.

Tufte is known for taking any kind of graph or visualization and trying to remove as many things from it and through the process make things clearer than they were.

In this essay he is looking at lists and going through different ways to think about lists and how they sometimes hide important information because of the way they are constructed. He is a known critic of PowerPoints bulleted lists.

Personally I belive he has several great points about information and have many great examples of his work.

But his basic theory I would claim is whats important to practice and once you understand that it really is just a question of practice to apply the principles.
Apparently, given that governments are cracking down on prediction markets. The conspiracy-theorist side of me could interpret it as intelligence agencies beating them quite directly.
Going for signature instead of pin is BRILLIANT ... for the banks, because any fraud is charged out of merchants pocket - he didnt verify card owner identity at the time of the transaction. Good luck asking every single customer for ID at the supermarket checkout.

Whole point of PIN was to move responsibility over to VISA and banks. This is why they kept claiming every transaction with chip&pin card is 100% valid and there is no chance of fraud.

Reading this article gave me LOL. Their super fraud prevention is asking the card for multiple pin verification before client enters real PIN, so if the card validates random bad PINs reader can flag fraud. This will stop scammers for ... one week? until they start programming shims to only validate one particular PIN making the card act like the real one.
> Building your own abstractions on top of AES directly is no less dangerous or prone to error.

You're telling me it's just as dangerous to implement a well-known library that has working AES-CFB as it is to roll your own AES-CFB implementation?

That's silly. Yes, it's dangerous to do any form of crypto. But there are really good resources on how to implement it correctly, and if you're using an existing library, the risks are significantly reduced.
Problem is the card is not valid unless signed. An attentive merchant will insist on the card being signed. This has only happened to me a couple of times but still.
It's much better than MSRs because online transactions aren't vulnerable to skimming / replay. This eliminates the ability to clone cards using an ATM skimmer or over-the-wire stolen track data, which by my understanding is one of the primary identity theft attacks against US cards.

This "yes-card" attack relied on having physically stolen the original card (not skimmed) and only worked against offline transactions using SDA, which, as far as I know, aren't supposed to happen in the US.

As long as merchants continue to accept magstripes the security benefit isn't really there, but, in the ideal world where they accept only chip-and-sig, it's still much more secure than MSR even without the added protection of a PIN.
It reminds me of using Zolpidem to wake up vegetative people: http://www.nytimes.com/2011/12/04/magazine/can-ambien-wake-m...
How to apply for section 8:
Applications are always free at your local housing authority. Anyone that is low income and over 18 that meets HUD's median low income level, can apply. Most housing authorities post their section 8 application on their website.
Male non-invasive birth control isn't happening right now. It wouldn't be viable to travel to other countries to get birth control pills monthly.
If you read the linked paper, this vulnerability is not limited to offline transactions.

Edit: clarification, there are sort of three types of transactions--

offline - vulnerable to this (and a simpler attack)
online w/ offline pin - vulnerable
online w/ online pin - not vulnerable
You're grossly misrepresenting what she actually said.
Merchants are constantly punished for all sorts of things, why not punish them (e.g. with a higher rate or more cumbersome chargeback) when they don't have network connections? Then you could have two slightly different protocols and the secure one would actually be somewhat secure.

Designing a protocol for the offline case sounds like a game of Whack-a-Mole and also like something we've all been advised against. However, ISTM that the attacks against a better offline protocol that included e.g. zero-knowledge proofs would be much more difficult than racing to say "yes".
You should probably mention that you're the main contributor to intercooler.js. I've noticed quite a few comments from you plugging intercooler.js but with no mention of the fact that it's your project.
If you've already built the infrastructure and practices to smuggle an illegal good, it is unlikely that you immediately start paying taxes once it becomes legal.
Bombly – Keep Talking and Nobody Explodes Robot
> A paper that calls itself liberal is not centrist unless they are not allowed to define themselves

By this argument, North Korea is democratic (Democratic Peoples Republic of Korea). Of course what people call themselves does not define their position if they act in opposition to it.

> It is my opinion that the general public has shifted so far to the left in the past 10-15 years

US voters still vote to the right of what they did during the Reagan years. It's not that long ago that Obama would have fit solidly in the Republican party. The idea that the general public in the US has shifted far to the left is just bizarre.

Consider that e.g. Obamas healthcare policies are not far off from policies proposed by Nixon 40 years ago, and that the level of horrified response to any kind of tax rises of Republicans these days would have had them up in arms over people like Reagan (and it's quite funny to see them try to explain away Reagan's various tax rises).
Is your startup about to die?
I'd be interested to know whether you understand what that usage is attempting to achieve. I'm fairly certain it's got nothing to do with victims or minorities for example.
>There are a few methods known since sixties, with less side effects than female hormonal contraception

Such as?
Well, that explains why the implementation seems brain-dead, it's because they wanted offline transactions. I'm not sure why they thought offline transactions would be a good idea given the near impossibility to do it securely (given enough incentive someone will completely reverse-engineer the chip), but the whole situation seems fairly ridiculous.
Here's a video of it in action: https://www.youtube.com/watch?v=ydQEb6zyAuE
5 Interesting Startups Who Are Hiring (Updated Weekly)
Certain organizations require cashiers to check ID 100% of the time. They generally deal with high value purchases (3-4 figures).

But outside of those? Almost never.
I would suspect something to do with farming, given that that was the usual job of the majority of the European population at the time.
permanent marker is not that permanent under IPA or acetone.
> they were underselling themselves, tending to err more than necessary on the side of uncertainty

That's not how it works. If you consistently misreport your calibration, you're still miscalibrated. Consumers of the intelligence would (should) notice the miscalibration and correct for it, regardless of direction.
Seeing as how the NRA signed off on a ban of new licensed "fully automatic weapons" in the FOPA of '86, and I can't recall them in my politically aware lifetime challenging the NFA of '34's licensing regime for full auto-weapons, perhaps you might want to study up on this.

If by "modern NRA" you mean the post-"assault weapons" ban NRA, extremely notable because it was the first Federal gun control measure they didn't support, you need a better analogy, one I can't think of. We've already given up so much I can't think of any "extreme product" that would fit the bill.
https://en.wikipedia.org/wiki/Asteroid_impact_avoidance

Shoot it with an ICBM. Better to be hit with buckshot than with a slug.
> Basically they dismissed every implemented approach, despite generics obviously working in other systems.

But working at a price. And Go isn't willing to pay the price (especially in terms of compile time). If Go ever adds generics, it will be with a new approach that doesn't blow up compile times.
I know people who do that, and they tell me that most merchants don't actually ask for ID. Which is surprising, since the merchant bears the pain in the case of fraud.
The thing is, with an enemy actively shooting at you it's pretty clear they're guilty.

But when you go in later we need proof that it's the right person you've caught. Not just for their sake, but for ours.

Rule of law protects me, so I have in interest in offering it to others at any opportunity even if they're scum and don't "deserve" it.
In California, Singapore, British Columbia - I've never had any problem with having an unsigned card, other than being asked for ID a handful of times.
Sets vs. Dictionaries smackdown in Swift
pretty lame if the card can just say "yes" no matter what PIN is entered.

Away from being a proprietary tech, I'm not sure why fingerprinting the magnetic stripe never took off. It seems so much simpler, and if you cannot rearrange iron at the molecular level impossible to replicate.

http://www.magtek.com/V2/media/whitePapers/2012/MagTek-WP-An...
A bad reference to all these stories along the lines of "The Feds can't hire good hackers because they all have smoked weed" maybe?
> I wonder what activity it was.

I'm going to guess: tilling land, carrying stuff (like their equipment) everywhere, and soldier training drills. First guess could be off, I'm unable to read the article from where I am.
> Male non-invasive birth control isn't happening right now.

Research continues, no? Its going to be available sometime soon (3-5 years), even if I have to get pills mailed from India or China every month (or I go on a medical tourism trip to have the Vasalgel procedure done).

If I'm worried about the reversibility, I'd have some semen cryogenically preserved. I'm also not too worried with how quickly protocols are being developed to coax stem cells to grow into reproductive tissue.
You can actually see this happening today with abortion, which is becoming increasingly unobtainable in the U.S. despite being (theoretically) a Constitutional right.
I don't think I've signed the back of any of my cards in close to 10 years, and I've been asked for identification less than 10 times.
This is much better than the previous Go documentation, particularly in the concurrency area. The previous Go documentation introduced goroutines and channels, stated the mantra "share by communicating, not by sharing", and then gave examples with variables shared between goroutines.

It now seems to be recognized that, in Go, if you want to lock shared data, use the lock primitives. Don't try to construct locking primitives from channels; that's error-prone and hard to read. This new manual seems to recognize this. When they want a shared counter, they use a shared counter with traditional locks.
But after these huge, untaxed channels of getting alcohol to Americans were established, why would we expect all of them to go legal after repeal? Would that in fact make them more vulnerable to criminal charges, tax evasion at the least, from their past actions?
Makes me wonder if carder community has systems to protect from and/or punish idiots with poor OPSEC. It takes only one such idiot to ruin a perfectly good attack vector.
http://www.medscape.com/viewarticle/722423_5

google cache:
https://webcache.googleusercontent.com/search?q=cache:50H_2S...
If their facts are correct (and I think we would be remiss in our duty as citizens if we do not give serious attention to every negative thing said about the police at this point until proven otherwise), stating they were "disappeared" is neither journalism or demagoguery, it is fact. Journalism is the article that wraps itself around the word.
As a consumer that uses credit cards, I don't think of this as much of a problem. All the credit cards I've used have 0 liability for fraud. It's a nuisance if my card is used fraudulently because I'll be issued a new card with a new card number, but disputing and getting a fraudulent charge removed has never been difficult. In fact, in a lot of cases, the bank is proactive about trying to identify those up front and contacts me.
The biggest problem with SaaS for seniors is that they expect the buttons to not move. Anything with continuous deployment like Google anything, basically sucks for seniors.

I get a call from an old lady every time the AOL website moves a button, for serious.
I wonder how much developer time is spent due to a lack of generics.

Developer time costs more than compiler time.
Myths of the private prison industry
So they claim he had classified docs in his AOL account. Why didn't the person(s) emailing these docs to Brennan's AOL account raise a question?
It's possible to encode a card with a specific number, so as long as you know the number and cvv, you could conceivably create your own card, since you are bypassing the chip-and-pin system anyway.
DocuColor Tracking Dot Decoding Guide
Sure, if Apple banned Objective-C/C/C++ and assembly code (never mind that most games are written in C++), set up a new system where all developers had to upload Swift IR, removed all unsafe APIs (at a sometimes very high performance cost), and audited all the rest of the gazillions of APIs for memory unsafety in the face of deliberate misuse, then they could implement an in-process object capability system that had only a few thousand vulnerabilities, similar to WebKit.

Or they could continue with the current sandboxing system where security- and privacy-critical functionality is performed out of process, and plug the remaining leaks, of which there aren't that many.
I think it can fill a valuable niche telling you the "right way" to do things. Such as using an ide/linters, testing, a code repo, virtual servers, etc. When you first try to learn to program you often hack things together to get them working and that's good enough.

A good boot camp has the opportunity to instill good taste in a new programmer before they learn bad habits.
I don't think it is illegal to wear heels so probably in a similar way.
frakturfreund is responding to one of the release songs which dfc point to https://news.ycombinator.com/item?id=10408606

Didn't I see an extension that would change a reference to Comic Sans to some other font? People do go to the extremes.
no, afaik this article talks about super thin shim glued on top of real chip on real card

but I guess you could use cards you linked IF you drill them, cut real chip from real card, place it in drilled hole, cover hole so its not visible, print card over with authentic looking color scheme/logo, stamp number, sounds like a lot of work
> Basically my bank knows I have a long password, but they don’t want it all. They want only the selected letters. Why? Well, if somebody was to intercept the letters that I’ve typed on the keyboard, they would only get a part of my password. And if I refresh the page, it will ask for a different set of letters.

> I feel it’s fairly safe, yet I hate it.

You should hate it, and it undermines the argument that Poland's doing things any better. Being able to ask you for just certain characters in your password means the password is NOT stored securely. It's not being one-way hashed, it's being stored either as plain-text or with reversible encryption.
I'm not sure I understood your comment correctly, but I hardly think either group thinks a large black market would be good for their cause.

The difference I see is that the anti-saloon league obviously underestimated how large the black market would be for alcohol.

I would not be surprised (in fact, it seems to be a talking point) if the NRA is purposefully overestimating the size of a potential black market for firearms. But I'm totally speculating here.
Do you have a link that's not behind a paywall? Can you describe the abstract?
I think jdimov9 was trying to make a little joke. But it's a great TLDR
I'm currently reading it as I started to program in Golang only one month ago and I'd never heard of goimports, this is a nice tool! Mixing it with GoSublime and it does a really good job http://michaelwhatcott.com/gosublime-goimports/

The book is well written and it looks like it covers a lot of common topics, I think I'm gonna buy it.
On the bright side, this only affects offline PIN verification. Cards which are configured to require online PIN verification should be more secure. They will send a (triple DES encrypted) PIN block to the terminal, which sends it to the issuer, which decrypts and verifies it.
Other than the version number change, I don't think you need to download CURRENT anymore.
A resume can say anything. Some of it may even be true. So how are you telling the difference between a good resume and a faked good resume? It's just like spam filtering, both the candidates and companies are in an arms race to try to improve/bypass hiring filters.
> The downside is that because software developers don't have a formal system for demonstrating competence in a way that is widely respected by our peers, we essentially have to take our entrance exams over, and over, and over.

I don't think it's really possible to have a meaningful and useful standardized formal exam. The issue is that programming, as a profession, is so wide and diverse that it's really hard to formalize what you're good at.

Furthermore, even if you're quite specialized, a large part of your day-to-day work will still be "general" skills, e.g. debugging stuff, fixing other's bugs, taking care of backwards compatibility and working around system bugs. This requires a general level of knowledge of OSes, languages, implementations, databases, networking, ... At least in my experience, but I assume it's similar even in more specialized areas, like security.
> no default parameter values

This would seriously bum me out as I find the easiest to extend the functionality of an existing Python function is to add a new parameter with a default value. This way, regardless of whether the existing code base the calls the new or old version of the function, it performs the same way as it always has.
My own two cents, based on living for many years in Washington, DC: at low traffic volumes, traffic circles work well. At high volumes, they can become congested.

Am I wrong to be surprised that Minneapolis rates among the top 20 cities for bicycling? I would think that bicycling there would be uncomfortable in the winter, and that the loss of lane width to snow would might make it risky.
Daniel Okrent answers it in the first question. It has nothing to do with morality or similar organizations. He's saying the tactics are the same: find the minority of voters who feel strongly about your issue and get them to vote your way, and don't worry at all about their personal politics or morals.

Other organizations get too wrapped up in trying to coddle people with a certain political leaning. There may be plenty of anti-abortion Democrats, but because they are Democrats they don't really get much attention from anti-abortion activists.
But don't underestimate the power of teenage male bravado.
When Gas Becomes Cheaper, Americans Buy More Expensive Gas
To draw attention to myself.

If the norm is for people to put it back close to the same spot, I make sure to do it precisely, because it's incongruous and will draw attention.

My goal was to make them think "What's that guy doing?" as opposed to "I think that guy is trying to seal something."
> This is where people were held for a few hours

you probably just don't get it. People aren't held for 3 hours or until 5pm or until court appearance next morning... They are held for indeterminate period at the discretion of the police and without any communication with the outside world while being pressured into talking with the talking being the ticket out of this indeterminacy. Most people of course break easily in those conditions.

Such exclusion from law is that makes a site a "black" one. The knowledge and understanding by both sides that law doesn't apply here and that either side is aware that the other side is aware about the situation too - that is what makes it so powerful.
Sure: I am the main contributor to intercooler.js, I use it every day in production and, when it is relevant to a given article, I mention it.
Show HN: Rivet – Easy iTunes and Amazon affiliate links on iOS
Yes, I've assumed as much, but I don't understand why would that make the assistant help him? To get him out of the store quicker?

Also, why was he doing what he was (taking stuff, looking at it, putting it back where it was)?
The Bad Apple: Group Poison (2009)
Also on Product Hunt - https://www.producthunt.com/tech/rivet
retailers aren't supposed to accept unsigned cards though. And they can even force you to sign the card before they accept it. They are also not allowed to ask for Identification if your signature matches the back of the card (customer can complain to Visa/MC etc if they are asked). This is why the 'SEE ID' stuff is not really recommended. IT all comes back to fraud prevention though, and the point of the signature is not to protect you, but to protect the merchant in case you file a charge-back saying that you didn't actually authorize the purchase.
This is one heck of a rebuttal.
How Not to respond to an attack on your company
Try periodic emails to past clients - I hire quite a few contractors and I like it when they check in and am more likely to go for someone who has done something good and kept in touch periodically.
Thanks for your answer. I'm sorry I had to clarify my question more.

When I say the best, I mean for the overall experience. It should be reliable and easy to use. Price is important, but it's not my main concern.

The certificate type is a single-domain certificate. I'll check what you suggested, thanks :).