skysight-inc/HackerNews huggingface dataset:
> Which basically would mean that they are incompetent. A private IP address doesn't really do anything for you security-wise.

And yet is a requirement for many compliance policies.

For PCI Compliance (ie to store and transmit credit cards), any machines storing consumer info (ex the database) need to be in a private subnet that does not have direct access to or from the internet.

That's the sort of thing that private subnets and NAT in Amazon's VPC was really made to cover.

Could you give your database with millions of credit card records a public IP, and just firewall it to be secure? Sure. But you don't need to, and a core part of compliance is not taking risks you don't need to take. You can accidentally add a bad firewall rule, you can leave some sort of hole that makes it easy to punch through. It's much harder to accidentally make your database accessible from the public internet through a NAT.

What this new service means is that, instead of having a server in every region whose sole job it is to accept outgoing connection requests for package upgrades, I can use this service.

Why do I not just have those connections go through the web server? Because PCI requires one role per server.

Why do I not just use a micro instance instead of this more expensive service? Because then I have one more server I have to maintain and test for compliance.

For people that have security policies and compliance requirements to meet, this service makes life a small amount simpler, and is worth the price.
Those are the same reasons I've heard for why we have a young age distribution in tech relative to the age distribution of the general population.

Poor industry retention seems to be a problem across the board.
I see. So if you pay cash now you are vulnerable to interest rate swings. Whereas if you use leverage to spread the term of your investment out, you can average the interest rate across the business cycle and achieve more predictable behavior. Is that correct?
Big thread running - https://news.ycombinator.com/item?id=10754194
Sanders Campaign Fires Data Director After Breach of Clinton Files
I love it. I feel nice and cozy while I hack now.
>...(4th July, Bastille day) tends to be the statistical anomaly

While I think your statement is true, it's probably true because individuals and society can adapt to invasive governemnt behavior for a very long time. Historically we see the Tea Act, the Boston massacre and the Intolerable acts and think "Of course the colonies rose up"

But we often forget or don't take into account everything leading up to 1776 in the British Americas:

The British government prohibited settlement beyond the Appalachian mountains in the early 1760s, offending many colonists.

The currency act banning bills of credit issued by the colonies.

the sugar, stamp, townshend and tea acts - all tax acts on common consumer goods such as sugar, tea, newspapers, playing cards, glass, paper etc. Some of these were later repealed but only under intense pressure and economic reprisals from the colonies.

This was all just after the French and Indian war which the colonies bore the brunt of. Many in the colonies felt that they had proved themselves in the war as a capable independent military and economic force. So there were least 10 years of turmoil leading up to July 1776 and 20 if you count the start of the French and Indian War.

And the American Revolution got the ball rolling for the French. Starting with Louis the 16th going into debt to help the colonies and helped merrily along by, yet again, an unfair tax system.

Both of these examples and many more, are largely caused by economic turmoil (largely, not solely, of course there are many factors).

I think as long as governments watch what you spend and where you spend it, but don't decrease how much you can spend then everyone will go merrily along.
https://en.wikipedia.org/wiki/Operation_Aurora

> the attacks were "orchestrated by a senior member of the Politburo who typed his own name into the global version of the search engine and found articles criticising him personally

This is the aftermath.
I think it's incorrect to label it an "exam" scam. It's really a scam about recruitment to government jobs. India has this weird system where almost every good government job has an exam that you're supposed to take to get that job. These exams are held once a year or so and all that matters is your performance in that exam and maybe an interview. This makes it impossible for anyone from private industry to take such a job. So what you get instead is a bunch of lifers who continue the cycle of corruption.
From their splash page...

Launchpad Accelerator

Are you a challenger?

guess the copywriters in this department were born after 1986
In a one-off lottery scheme, the jackpot of a lottery should be less than or equal to the value of all of the contributions.

Did you introduce a central bank into the example some point? Is this a repeated game? Am I missing something? If not, this reddit comment makes no sense whatsoever.
Uh what about the most prevalent sex robot in existence, the vibrator? Is this not a product bought mainly by women?
Lehman went bust because liquidity in the credit markets dried up - i.e they were unable to roll short-term financing to fund longer-dated balance sheet. The markets thought Lehman had big exposure to the US residential and commercial mortgages, hence they couldn't borrow, hence they went bust.

A shame because they weren't actually bankrupt - PWC has now recovered 100% of liabilities with assets to spare.
Noise: a new expressive music app for iOS, from Roli
> If I'm buying my young niece a toy, and see two otherwise equal toys except one is blue and one is pink, is it sexist to choose the pink one?

It would be sexist if you bought the pink one thinking "She's a girl, she'll prefer pink to blue" because you would be assuming something based solely on her gender.

The best course of action might be to ask her "Do you want the blue one or the pink one?". But maybe you couldn't, and so you used your knowledge of your niece and of little girls in general, and you go with the pink one.

Sometimes we have no choice but to use our stereotypes, but whenever possible we should get more data rather than just making assumptions.
Show HN: Multichess – Massive Multiplayer Online Chess Game
Good news, everyone!

I am finally (confident enough for) releasing a first preview of a game called "multichess". It is more or less exactly what you would expect from the name: An online multiplayer chess game.

The code still has a few bugs and is not as pleasant to read as I'd want it to be.. but anyways - it's quite a lot of fun to play!

I am actively looking for suggestions. So I'd appreciate any kind of feedback.

You can play it on github: http://multichess.github.io
The practical outcome of that policy would be to lock out anyone below a certain income bracket from political office. Living as a politician can be expensive and lots of people will find it beyond their means. There is a reason it's forbidden for congressmen to forgo their salaries.
http://multichess.github.io
> 1. error/diagnostic messages: DDG still sucks at precision search, and quotes are not always the answer

Wow _this_ is interesting to hear. I would've thought that this would be the main area where the quality gap would be smallest, since there's such little wiggle room and most results are likely to be relevant. I wonder why this is the case.
Its laughable that you still think, despite this all, that you, a mere peasant, still has any kind of power in government, in policy/law making.

You should wake up.
> I could recount the time when a professor chose to replace her all twelve of her lectures with student presentations, then tested us on entirely untaught content; or perhaps the other time when submitted assignments and tests were not marked or discussed, at all, so that the only feedback was a numerical result at the end of the semester.

> I could choose to say that this is symptomatic of a system where research is king and teaching is for peons and undergraduates are lower than dirt.

> Or I could choose to say that perhaps some professors are just bad at their jobs. Or, even, they just had a bad semester. The advantage is that I could do this without cherry-picking the outliers.

Which is to say, you just did do all those things; you were just passive-agressive about it.
3 reasons why user research is crucial for your design
This Apple product launch was for consumers?

https://www.youtube.com/watch?v=w87fOAG8fjk

Again: if there are aspects of OS X you don't like, that's fine. There are certainly some things that I don't like. But the idea that it's somehow got "training wheels" and is therefore not suitable for developers, is just not supported by any evidence.
Fun mental experiment:

Should the world ever value the global stock of Bitcoin similarly to gold, Bitcoin's market capitalization would increase by around 1,300 times, from ~$6 billion to ~$7.8 trillion, and the price per Bitcoin would increase from around $460/BTC to around $600,000/BTC, give or take.

If this sounds "crazy," consider that in many ways, Bitcoin is more convenient than physical gold: it's cheaper to secure, transport, and hide; and unlike gold, it's backup-able.

--

On a related note, here are some additional thoughts on Bitcoin I wrote four years ago, when its price was $9/BTC:

https://cs702.wordpress.com/2011/05/29/on-the-potential-adop...
Actually no... most of his fortune is split in several other investment since a while ago. I guess being friends with	Warren Buffett helps :)
I have seen this discussion evolve from the early 90's from overwhelmingly freedom loving, rational and logical to now scaremongering, feeble justifications and often just self importance.

Isn't it time to have something like the Hippocratic Oath that commits developers to some ethical standards and not engage in activities that may have negative consequences for humanity in general.

The problem with Snowden is not what he has done but what thousands or maybe hundreds of thousands of others have not. And the way the freedom loving media, the EU and the US has treated him apart from being shameful doesn't help potential whistle blowers.

Given what we now know about the level of sophistication and ever growing number programs at play there needs to be more activism against the groups and individuals who enable this. And also more oversight of the level of involvement of security agencies and other vested interests in open source.
Teleport -simple SSH login and access management
I saw them present a while back and someone in the audience asked "why SQL" stating that all innovative projects like this end up coming up with their own query language. The response was that everyone knows SQL so it's easy to get started and that they want to enable access from environments like Python and R for more advanced querying.
> since my degrees are not in one of those three fields, I'm only tangentially involved in tech

That conclusion cannot reasonably be inferred from the post you are responding to.
>The point here is that dimensionality reduction does not need to be done by inferring higher level concepts like headlights.

I get that, and it is a very useful result.

But what I was wondering about is whether humans can ever "switch off" high level reasoning when they perceive sensory information. Even when the image is supposedly abstract, humans may be making stuff up, and that might influence perception and dimensionality reduction, similar to what's happening in a Rorschach test.

And that's why I don't believe that what the paper shows is actually "How the Brain Can Handle So Much Data" -- the title of the linked article.
Hey guys! :)

The source code is available at:
https://github.com/tonybeltramelli/Deep-Spying

And a video demo at:
https://youtu.be/ZBwSfvnoq5U
Last-Minute Budget Bill Allows New, Privacy-Invading Surveillance
My Complaints – ScamGuard
> If a female is attracted to the guy, things he says or does are considered "cute", "flirtatious", and/or "interesting".

> If not, the same actions are often considered "creepy", "jerkish", and yes even "sexist".

In my experience, the exact same thing is true with the sexes switched: behaviour which I find attractive in a woman I find attractive is awful in a woman I don't find attractive.

I think this is probably a universal constant: we all appreciate it when someone we'd like to get closer to gets closer to us, and we all are at the very best neutral when someone we don't wish to get closer to, moves closer in.

It's not even sexual: who hasn't experienced the phenomenon of the bore at a party who just. won't. go. away?
How gamification in software testing can boost your software quality?
This is an excellent point, but there's a good answer to it.

The purpose of a bug bounty is not to encourage a particular individual to report an issue rather than sell it. The purpose is to encourage more people to get into the business of finding and reporting bugs before the people who are in the business of selling bugs to criminals find them and sell them. If, in the process, some black hat researcher also decides to report some particular bug rather than facilitate a crime, so much the better - but you can't rely on that, and you shouldn't design a bug bounty program around it.

In other words, you're not competing with the black market. Instead, you're paying to improve your security, and accordingly, you want to get the most bang for your buck. Finding previously-unknown entry points is high-value. Finding internal pivots is extremely low-value because they are ubiquitous, and your infrastructure is already designed around the assumption that they are ubiquitous.

Which isn't to say that you aren't interested in finding the internal vulnerabilities and eliminating them. You are. Which is why you conduct penetration tests. But pen tests are big deals, with rules of engagement around them. You deliberately give the testers elevated internal access so they can test under the assumption that there may be an entry point you don't know about. You establish ongoing communication between the testers and the clients, especially at any potential pivot or escalation point prior to proceeding. You don't run a pen test by opening it up to anyone who wants to give it a whack and hoping that they'll tell you about it afterwards (i.e. a bug bounty program). That's an insanely high-risk, low-value way to discover your internal vulnerabilities.
> However, does GTK have much choice given the resources at hand?

Well, maybe I'll get some flack for saying this without providing much evidence. But they aren't a very welcoming group. They have been very insular and tied to RedHat which is driving a lot of the GTK development.

The GTK developers are also incredibly resistant to changes. For example, the code base is still required to follow c89 because some arcane compiler somewhere doesn't support c99 yet and because the greybeards at RedHat thinks it looks nicer with all the variables declared at the top. New developers also struggle with autotools and there has been several calls on the mailing list to replace it with something else (virtually anything) but those suggestions also get shot down because autotools is what the GTK developers know and use.

Just to be clear, I'm not blaming. It is not objectively wrong to be incredibly resistant to change. And GTK is a decent and very polished product. But it is one of the main reasons why GTK doesn't get a lot of new contributors, or resources as you call them.
Homelessness.
I'd dispute that. The human brain is, according to Marvin Minsky, a big bag of tricks, and we're finding ways to replicate those tricks one by one, including really difficult things like planning and vision. There are fewer left than you might think. I told my friends in 2007 that we were 20 years from true AI, and I'm standing by that now; I think we've got 10 to 15 years to go.
Google’s Quantum Dream Machine
Biases come into play even when judging supposedly objective things like technical merit. In a startup environment where every new hire has a huge impact on the outcome of the company, the subconsciously perceived 'safe bet' will always be to favor the person who talks and acts the most like a young Zuckerberg.
A Brief History of Online Terra Mystica
I wasn't aware of CBC at the time of writing this comment, thanks for pointing it out to me.

It seems if you lose any 32 bytes though you've lost the trail of encryption as you can't decrypt any subsequent pieces.

After reading other comments I think the only reliable solution is chacha20 where each packet can be encrypted/decrypted independently of others.
The Go dev's have noted they were happy they left default function parameters out of Go in the past--
Of course this project doesn't have those nasty hooks and a very small art asset collection.

I'd worked on a similar project to yours years ago and we ended up building a separate application for mobile after the web project. They are different form factors even if everything behind the scenes 'just worked'. I think we agree :)

I was just amazed at the progress unity's webgl target has made. You see with my original post that I was pretty dismissive of it until I gave it another try.
[Infographic] the Secrets Behind Successful Google AdSense Ads
I'm reading "Lisp in Small Pieces" by Christian Queinnec, which is a book that incrementally builds a scheme interpreter with increasing functionality. I could get away with using Guile to run the earlier examples, but by Chapter 3 I had to use one of the lisp interpreters that the author suggested in his code repo (https://pages.lip6.fr/Christian.Queinnec/Books/LiSP-2ndEditi...). I ended up settling on SCHEME->C and this presentation reminded me of this project and associated work by Joel Bartlett. Checkout the debian code repo (sudo apt-get install scheme2c scheme2c-doc) and the research report for the project:
* https://github.com/barak/scheme2c
* http://www.hpl.hp.com/techreports/Compaq-DEC/WRL-89-1.pdf

If this presentation appeals to you at all I highly recommend reading Lisp in Small Pieces. It provides a great balance between implementation and theory that you get something running in every chapter and lots of recommendations as to where to go if you want more information.

I'm about half way through and I look forward to my 2-3 hours every night that I spend on it.
No. It's a deliberate design choice: https://golang.org/doc/faq#Why_doesnt_Go_have_feature_X
That will be just as easy as enforcing gun control. No politician would survive - American society is predicated on everyone being able to drive anywhere, anytime.

In the vast majority of the US, if you can't or won't drive, you are regarded as abnormal, almost sub-human. A colleague of mine was eventually driven to the situation of having a non-drivers drivers license, because no one would accept checks without him showing his drivers license. And no, his passport wouldn't suffice, because the people behind the counter had never seen one and didn't accept that it was valid ID.

You'll never enforce stronger driving laws - driving is seen as a right, and you'll never take it away.
In Congress and my state, they control their own salary; however (in my state), the pay raise cannot take effect until after the next election, theoretically provided a buffer against last-minute or very large increases. I believe the same rule exists in Congress but I am not sure.
"A false wall rested on dusty display cases and was supported by sandbags. “This is not architecture,” he said, because the building’s historic status prevented any changes to the interior. And besides, according to the rules of the arrangement, Newcastle’s artisans could use vacant properties like this for free as long as they promised not to alter their interiors (and thus their tax statuses)."

The cities create burdensome regulations, in the form of historic building status or adhere to ADA compliance, driving up the cost of any remodel and thus driving away any business opportunities at these locations, then turn around after realizing the loss in taxes, allow for utilization of a building with a look-the-other-way mentality fraught with legal craziness.

If one of those buildings catch fire, will the insurer pay out for a non-stated use of the building. If the insurer does pay-out, it is a one-off option as they will most definitely increase premiums to handle the new risk of these "artisans."

It is a great concept, however, it just points to how regulatory burden price out competitive up-starts and defends entrenched players.
it was lame European pacifist politicians that let Hitler get so far

I'm not sure what gives certain Americans such a knack for injecting Anti-European sentiment. Is this what they're taught in history classes, or something else?
Web applets are terrible because

- The JVM takes forever to spin up
- The JVM tries to do too much with tons of class libraries
- The JVM is insecure
- The JVM is proprietary. While there are open source
implementations, it is still tethered to Sun and now
Oracle. They call the shots on the features and have
sued both Google and Microsoft for implementing their
own versions.

Similar arguments can be made against Flash.

We shouldn't expect WebAssembly to have the same pitfalls, since

- WebAssembly does not take forever to spin up
- WebAssembly doesn't try to do too much. There is no huge
standard library. For now it doesn't even include a GC.
- WebAssembly isn't insecure. Why would it be? I assume
applet exploits are a product of the large standard
library (more attack vectors) and privilege escalation
(certain exploits let you break out of its security
settings to gain control). All of this seems like it's
because web applets are monkeypatched on top of the
existing JVM.
- WebAssembly isn't proprietary.
> I personally find it a lot less stressful than living in Canada where every time I see a cop I get a little adrenaline rush of fear.

Well are moving back to Vietnam and Romania to live? Most people living in Canada or US would have that freedom. Most people form Vietnam or Romania can't just pick up and move to Canada if they want to.
the community is not tough on newbies; it is _harsh_ on those that do not read the documentation before asking questions. if something is not documented or documented incorrectly, that is a bug. too many folks who are new to OpenBSD do not bother to read any of the man pages or even the FAQ (which points to man pages) and then immediately hit the list, as if other people are supposed to do the reading and research for them.
The lack of any information about the Hailstorm device is notable. Hailstorm is the version that can break 3G/4G connections, supposedly. Breaking GSM is not anything remarkable because GSM was designed on the assumption that cell site simulators didn't exist. But 3G authenticates the tower. Whatever Hailstorm is doing, it's not just taking advantage of a missing design requirement, it's actually subverting the crypto itself.

Unfortunately it seems there's nearly nothing public about it.
As others have noted, lots of people question why there are so few male preschool teachers. Additionally, the fact is that there once were more women in tech than there are now. The book The Computer Boys Take Over and others have shown that early programmers were women and over time the concept of a programmer changed to our more modern conception.
Women really, really, don't want to be treated the way men treat each other when they get together without external sources of censure. Trust me on that.
OK so how do we setup a fresh ubuntu all with zfs?
Was that 100k to the NSW govt, or 100k on the secondary market?

I am not sure the govt should compensate beyond the initial sale price. Everything else is speculative inflation.
Show HN: Serverless-SlackBot: The cheap, open-source, programmable SlackBot
xkcd did it before

https://xkcd.com/980/