skysight-inc/HackerNews huggingface dataset:
generally from your broker (who borrows them from their other clients who own those shares). there's some institutional lending also
Seems to me that unless they are lucky and get under the protecting wings of Red Hat or something, most Open Source developers do it for free even if the work is worth good money.

I'm hoping that sandstorm or another hosting provider that makes a business out of reselling open source anyway can try out one or more models where a fraction of the revenue is fed back to the creators / the community to encourage more development.

Don't know if it would work but I can hope.
Yes it does mean that and I believe it is unavoidable, because you need to replace the coarse-grained GIL with a fine-grained locking instructions. However, I think the trade off is now worth it, since multi-core CPUs are ubiquitous. Besides, Python itself was never notable for its performance to begin with, so I've always found the argument very odd.
Factoring via Graph Three (vertex) Colouring
Yes! The internet needs more old people posting to it! No society is complete without people of all ages - people of all wisdoms you might say - sharing their knowledge and opinions. Our blogs are noticeably lacking the voice of the elderly, undoubtedly b/c the elderly use the tech less for sure, but it's unfortunate for us. Maybe in 50 years the internet will be a much more temperate place ;)
It should be much more explicit on the gift site itself that the site is a Y Combinator property. (I see the logo now, but it is easy to miss)

I honestly thought it was a fan page at first since there is no clarification on who the "We" is that selected the companies.
I'll gladly admit that I didn't get it.
If bringing unrelated parties to dialogue in the background is not harrasment, then what is?

Imagine I will contact your significant other over your comment on HN. Would not you be deeply disturbed even if I do it just once? Bonus points for frivolous legal threats on my side.
You believe that by increasing transparency and granularity, voters will punish or reward Congresscritters more effectively and efficiently.

I disagree strongly. I submit that most voters do not follow the legislative process very closely and vote accordingly. Rather, I submit that most voters make decisions emotionally using far less than the totality of the relevant information currently available to them. At this very moment, we have a batch of Congresscritters who gain the support of their constituents by obstructing their opposition by any means possible. Questions of frivolousness or caprice are not considered. This is the situation here, today, and now.

I think your notion fails because it adds extra information that voters will disregard. Because this information will be disregarded, it will not significantly impact the behavior of voters. The net result is likely to be an increased legislative overhead, more procedural tools to be wielded as partisan weapons, and voter behavior not shifting significantly. As a result, the failure mode of this proposal is everything wrong with the current (attaching bill-killing, shutdown-threatening riders) PLUS excessive bill-splitting for the sake of obstruction.

Might I suggest that your solutions should not hinge on sudden and dramatic shifts of voter behavior at a scale of many millions?
> Something about the financial industry's interest has really turned me off the blockchain and its possible implementations.

What exactly? And don't you think banks will be more apt to use Bitcoin once things like the lightning network roll out (offering much greater transaction volumes)?
It's a ridiculous timeframe if you consider that there are no driverless cars for sale right now. Even if Tesla or Ford or any other vendor started selling them tomorrow, the driverless cars would be too expensive and the factories could hardly pump out enough of them to put every Uber driver out of a job in just 5 years.

I'm looking forward to being able to order a driverless car from my phone, but in just 5 years, these cars might still be scarce, illegal in most places and they might suffer from limitations in their driving ability that prove problematic.
YES YES YES!!! OMG! THANK YOU <3 <3 <3
I've been waiting so long for this!
Maybe my dream of running native Lua on the browser will come true?
Will I already be able to run Lua's interpreter now? :D :D
Gonna look deeper into this as soon as I have time, omg so excited <3
Yes this reminded me of DabbleDB. It's just a shame (for everyone except the founders/employees) that they were acquired and shut down.

Because of what happened with DabbleDB, I worry about these awesome startups getting acquired. Again, great for the founders, but not for customers.
I think we may be surprised on how many actual qualified applicants there are. Hard to say though. I wouldn't feel it's an extreme amount. Though, it would probably be pretty difficult just because, as you said, probably not a ton of actual positions available.
The taxi-protecting laws and consumer-protecting laws are separate.

Uber could be regulated as a taxi service, just like pre-existing taxi services are. Consumer rights could be protected by the law.

However, in most places, there is a medallion system for officially-licensed taxis, which basically imposes a very high tax on anyone trying to operate as a taxi service.

Because Uber couldn't function within the medallion system, it was also shut out of consumer protection laws. But that doesn't mean things have to be that way. The problem is that allowing Uber around the medallion system essentially destroys a bunch of value already stored up in medallions.

Also, where else should someone editorialize, if not a comment on a social news site?
Google search indexing HTTPS by default. 6 tips for moving your website to HTTPS
I can tell you from experience working at another similar company that this is not surprising at all. Especially as startups transition into larger companies (with formal security controls and policies), a lot of things can get missed or forgotten. Your primary production servers may be completely up-to-date and secure, but somewhere along the way, there's a high chance that an engineer deployed an internal admin tool or a test build somewhere that ends up being public, but ultimately lost and forgotten. The problem is, that kind of "lost" infrastructure often contains keys, credentials, or network access to other more critical parts of the infrastructure, and no one realizes the severity of the mistake until it's too late.
I know what the author intended; my point still stands. The term for "non-personal belief" in English is "political belief." Anyone who says otherwise is usually either lying in an attempt to put their beliefs beyond criticism (which may be warranted,) or simply repeating what their culture has taught them to say. (This is only 2015, after all, and we are the cavemen of the future. We have many self-contradictory and damaging cultural norms.)

Politics is explicitly about controlling other people, and there's nothing personal about that.
The best part about it is the fact that they actually did make it! Which makes it all the better. There's a sense of anxiety while reading even if you know the outcome.
There are countless Show HNs that never make the front page. I'd guess far more don't make it than do. And I think the average Show HN is far better than the average HN submission.
No, that's the next step in an external penetration test, which is not the same thing as a vulnerability assessment.

In an external pentest, you get a set of netblocks and rules of engagement, and you get as far as you can. That's why it's called a "penetration test".

In a vulnerability assessment, you get a target (usually an application), and you find as many flaws in that target as you can.

Big annual pentests often have wide-open rules of engagements, where you (as a consultant) win big by, for instance, dumping the CEO's mail spool. But those projects also start with several meetings worth of negotiating rules of engagement.

Vulnerability assessments virtually never have those rules of engagement!

Nobody that I know of runs a bug bounty program on pentest norms. To do so would be grossly irresponsible, because on every network with more than 1000 hosts I've ever tested, ever, RCE behind the firewall is gameover for the whole test: you can get everything.
Thank you for sharing that information Animats. Very relative to the original post. I haven't read that, so I will make the time to do so.
To get there, reaching and coordinating demand density was a sufficiently difficult problem.
Wish this was posted a week ago :)
To ensure that this person deleted the credentials they had taken from the server they popped with the RCE, obviously.

Again: read the timeline. He submitted a finding with AWS creds taken from the server he popped on October 22 --- on December 1, more than a month after Facebook shut the server down. He took AWS creds from a Facebook server and saved them on his laptop for more than a month.

WHY?
3 ways Pair is transforming the design experience with Augmented Reality
In my opinion, the author is feigning shock...

He claims to have downloaded the content listed below. And he is surprised that Facebook responds coldly? Note the string "private keys" in this list... Doesn't the author know how long it will take them to recover from this breech? How much it will cost them?

On the other hand, it does sort of re-enforce the idea that he should be paid handsomely, doesn't it? :)

* Static content for Instagram.com websites. Write access was not tested, but seemed likely.
* Source code for fairly recent versions of the Instagram server backend, covering all API endpoints, some image processing libraries, etc.
* SSL certificates and private keys, including both instagram.com and *.instagram.com
* Secret keys used to sign authentication cookies for Instagram
* OAuth and other Instagram API keys
* Email server credentials
* iOS and Android app signing keys
* iOS Push Notifications keys
* Twitter API keys
* Facebook API keys
* Flickr API keys
* Tumblr API keys
* Foursquare API keys
* Recaptcha key-pair
> Suicides, homicides, and accidental deaths are three different things.

In terms of someone being killed by a gun, how so exactly?
So how does Uber benefit from pairing you with another commuter? Will you negotiate a price and then Uber takes a cut?
Did you read the whole post? He got paid on the RCE.
Right? If he left it at the RCE he would have gotten the $2,500 split between him and his friend... but he continued and was able to get access to all the S3 buckets which you would assume would warrant a much higher payout. Instead he got a huge amount of backlash.
Pointing out that this doesn't meet the legal definition of slander or criminal harrassment doesn't mean sticking up for Facebook or defending its motivation.
Anyone notice this statement? "We will be piloting a new program for drivers who want to share their commute and recoup the cost of the trip." (emphasis mine)

If we go with what is implied by this, I don't see how this is much different than using the destination filter, except for possibly paying the driver "costs" instead of the typical fare.
I started recently, but I find them fairly decent. And there is not much to it, really.

> I didn't think it had the equvalent of Reagent's reactions until I got towards the bottom of the react-redux page

Is that the subscription mechanism? I have yet to find a use for it...
https://gist.github.com/maxrice/2776900#gistcomment-1200768

"Here is the list without Delaware" almost made me spit-take.
> I won't lose any sleep when this guy goes to prison for a long time

What is the point of putting someone like this in prison? He wouldn't pose a threat to others if he were released immediately.
He should be sentenced to spend his time and energy giving back to society.
I have no idea why people still make this mistake. Clearly, way too many "adults" are telling high school kids that "college is the answer!" without providing more detail.

It's more like getting a profession is the answer. That can mean going to college (necessary for things like medicine, law, accounting), going to vo tech school, apprenticing (e.g. electricians, carpenters) or teaching yourself and gaining experience (e.g. coding).

The last route is a little problematic because there's no real barrier to entry (other than intelligence). We're in the midst of a demand boom for developers now, but eventually companies will start recouping their investments in code and start laying off developers or cutting pay simply because there's so many bright people who figured they can just teach themselves code.

Of course, if you really enjoy and are good at software engineering then you're going to have a career regardless. But the people who are doing it just because it's what pays well now will be washed out in the next recession.
his actual text is hit-and-miss, but his headlines are brilliant.
Ok, maybe it's too optimistic but I'd totally make a wager. I say it will take 5 years for the Bay, 10 for major cities and highways, 15 for the rest of the country and by 2050, human driving will be illegal on public roads.

any takers?
The other discussion:
https://news.ycombinator.com/item?id=10754194
The nice thing about the eastbay casual carpool (which I use every morning) is it runs on a universal first-come first-serve basis. Uberhop will not have this unless it is universally used.

Uberhop may succeed at creating new carpool routes but it will fail at breaking into established ones because of added friction.
Ask HN : Help with understand how to start a newspaper/magazine business.
I am planning to start publishing a newspaper/tabloid to a small audience of about 100 people. I need someone who can explain me how much it costs to print various sizes of newspapers/tabloid/magazine and help me with the decision process. I am new to print business.

If you have some knowledge and are willing to help me, please call or email me with your phone number.

You can get my phone number from craigslist post
http://sfbay.craigslist.org/sby/crg/5364784164.html

I am based in SF Bay area.
He is a sociopath. There are political and corporate leaders who are also sociopaths. But this guy, derived pleasure by showing off his misanthropy under the guise of "Greed is Good".
The depressed programmer
I think that's like saying: "I prefer to use the hammer instead of the screwdriver" for something with a helical ridge.

You are better off re-inventing Java or Python, but in a container and streamed over the Internet from an URL.
Pay the bounty and communicate with him directly to get the information deleted.
Then threaten him with legal action (not that I necessarily condone this - I will say that I did like your breakdown down thread to providing another perspective and balance).

It's neither harassment or slander, but it could be tortious business interference, where one party induces a second party to break a contract with a third party.

His contract employers are neither his parents or legal guardians - who have no more power to "ensure" this as anyone else.

As a corollary to this - this is exactly why it's illegal for debt collectors to call your friends and family to "encourage" them, or you by humiliation, to pay up.
Even if that is the case, why is it exposed to the public? They firewalled it off almost immediately, so I assume it didn't need to be...

Never expose anything that doesn't need to be, SSH tunnels, openvpn... heck, use HTTP authentication wrapped SSL tunnels if you have to. Web servers tend to be more secure than webapps.

Mistakes like this are far too easy to make. So anything that isn't part of your business application needs to be tunneled with authentication or isolated completely.
I'm not sure whether I'm sticking up for Facebook. I'm not just lawyering this thread. I think, if I was in Alex's shoes, I might have done something similar. I'm very glad I didn't have to make that call myself, because, what a nightmare this is.
You are too sensitive to this. Consider that sometimes, one engages in tightly layered banter, knowing that only some people will read through all layers. Which is fine because at minimum, the main sentiment (in this case, "this person's off the rails") is conveyed.

So, in this particular instance of individual expression of a common sentiment, universal and uniform reception of message is not crucial. Otherwise, rest assured, I'm well aware of the importance of clear communication.
Thanks. I adjusted the text slightly. Hopefully, it's more clear.
Remote Code Reviews
You say “easily” – what was your plan for getting the web to move from Flash video playback to something else?

The W3C choice to standardize the mechanism for requesting DRM but not the actual system seems to be about as good as we could hope for without a magic want to get content owners to stop requiring DRM.
The consumers who want the "rights" that taxis are supposedly providing are free to still use taxis. Of course, most consumers I've met think taxis are terrible (go figure, a monopoly leading to a terrible service).
"If bringing unrelated parties to dialogue in the background is not harrasment (sic), then what is?"

Exactly what parent said, " . . . a pattern of repeated contact intended to cause emotional distress". Yes, doing as you said would be deeply disturbing, but it wouldn't be harassment.
>Nobody has a problem with encode/decode when talking about, say, json.

That's maybe because JSON is by the standard supposed to be utf-8, always.
Yes, we do. That's the whole point. You define what success means for you.

That's also why "what you believe shapes what you achieve".
> † (and, to be clear, a friend, though a pretty distant one; I am biased here.)

Alex is good friend of mine and I've known him since college. He's definitely a good guy and understands the ins and outs of security vulnerability research, having done it himself for many years. I'm sure he didn't take the action of calling the researcher's employer lightly, and probably had a really good reason to do so.

There has to be a side of this story we aren't hearing, and probably never will.
Do you see what a ridiculous no-win situation this is?

Option 1: Call the pentest firm he works for.

Option 2: Threaten legal action.

Option 3: This dude might still be walking around with god knows what shit he's pulled out of S3 buckets or lord knows what else was accessible with those AWS keys or what other keys were in other S3 buckets or

wow i'm having a small panic attack just trying to complete that sentence
Precisely - at the very least, taking care before bandying around legal action or calling someone's boss. Even without context, its a pretty weird sequence of events.
IIRC, there are two interesting clauses in the purchase contract:

1. It cannot be sold. Given away, yes, but the current owner doesn't seem like someone who will just release the tracks for the world to enjoy for free.

2. It can be stolen back. By Wu-Tang Clan. Or by Bill Murray.
> that does not change the fact that this article's headline is misinforming.

You haven't made any arguments in support of this claim.

> Further, the data is misleading as well. Suicides, homicides, and accidental deaths are three different things.

Yes, what is your point?

> This means that the data tells us nothing about whether tougher laws would help or hurt the state of gun-related death

Rates of gun ownership is tightly-correlated with rates of gun-related deaths, at whatever scale you cut it. This also holds true for gun suicides:

http://www.hsph.harvard.edu/news/magazine/spr08gunprevalence...
Fear in the Faceburbs: Comfort, Dread and Digital Fortresses in 2015
I'm glad people are working on better approaches to AI, but I don't think articles like this, based on sources like Marcus, contribute much.

Mostly because Marcus isn't willing to talk about what he's working on right now. Hand-wavy stuff about how children learn, a tired analogy that's been trotted out many times before. This article was too early, and it doesn't contain real news. Reproducible results, or it didn't happen...

Fwiw, the statement below is simply untrue.

> “If you want to get a robot to learn to walk, or an autonomous vehicle to learn to drive, you can’t present it with a data set of a million examples of it falling over and breaking or having accidents—that just doesn’t work.”

The entire premise of Deepmind's work combining DL and reinforcement learning shows that autonomous agents learn from millions of examples.

And in fact, data is not the limiting parameter here. Trying to create an AI that doesn't need big data will be great for edge computing -- but we're actually swimming in data and using it to set new records every year -- http://deeplearning4j.org/accuracy.html -- so we might as well rely on it. Ignoring big data in the pursuit of AI is like ignoring sunlight in the pursuit of clean energy.

Deep learning is one of the best ways we have to use that data. In a sense, deep is the new normal.
It's the plot to Sons of Anarchy.
Much more clear. Thanks!
The big difference is that WebAssembly can only do what Web APIs allows it to do. You'll have to do the same AJAX calls, the same DOM manipulations as with Javascript. There is no plugin here.

> I always feel like the most obvious use for it is to start writing truly hateful and abusive code.

Sure, but it will also developers to have a better experience by allowing them to chose the language they want, and not to be forced to use JavaScript. Choice is good, it's something you cannot deny.
Yes, in theory an offline supervised learner should never beat an online reinforcement learner. Adding a set of actions A that can be used to bias future examples in a predictable manner is certainly an advantage that will yield better convergence properties in almost all scenarios, simply because it lets you gain more information per observation.
Nobody is arguing that this person shouldn't be disturbed. But that doesn't make it "criminal harassment".

Unfortunately --- and this is not a normative argument, so please don't wig out --- the criminal action here is the researcher's. Nobody's been prosecuted, but could they have been? YES.
Why torture yourself? Because you don't want to get owned by evil javascript malware perhaps? There is an extension called NoScript that is quite popular with security-minded folks.
You're HN's anointed expert, so I suppose all I can say is that's not my experience.

Among the many reasons bug bounties are bad ideas is that they generally fail to write clear rules -- as Facebook did. As written, what he did is not against the rules and while it may fall into some best-practices bucket you assert to be universal, that's hardly sufficient for a field in which participants can come from any background. But please, continue to defend your friend whose multi-billion company had a month to cycle their popped keys and failed to do so, then responded by threatening a researcher's employment after multiple conciliatory e-mails.