skysight-inc/HackerNews huggingface dataset:
Next thing, your going to do is tell me that climate models are speculative. But you can't fool me -- I know that geologists are bought and paid for by the oil companies.
Windows 10 hosts running RDP services fail to prevent remote logon to accounts that have
no passwords set.

An attacker could exploit this vulnerability by using an older version of the RDP client
to connect to the Windows 10 host. Once connected, the attacker could generate a list of
user accounts on the host and attempt to log on as those users. If one of the user
accounts has no password set, then the attacker is allowed to log on as that user,
despite the default system setting that restricts access to accounts without passwords to
local logon only.

Is the user enumeration a feature and not a vulnerability of its own?
For software in medical devices, the process that's accepted by the regulatory authorities is ISO 62304 http://www.iso.org/iso/catalogue_detail.htm?csnumber=38421

That's a good start
Unfortunately, not in the Mac Store yet...
You work for HackerRank.

EDIT: HN user name was ritikatrikha, same as Twitter with employment info.
Ask HN: What do you think of my card game kickstarter?
http://kck.st/1JIBkpM

My best friend and I needed some more creativity in our lives, so we've just launched a card game kickstarter as a side project. We've played this a ton informally with our friends and many groups of people.

We've just launched to a few friends and family before our bigger launch Thursday. We can still edit any part of our pitch. Any feedback? Specifically, any ideas how to make the message to buy more compelling? Any concerns that we should address? Appreciate any and all comments!
Yes, I'm building a CMS, but it's not released yet. :(
I discovered you on HN several years ago and have been following your progress ever since. You are an inspiration to do-it-yourselfers everywhere. Rooting for you man!
You're not wrong that a correct process dramatically limits classes of issues (I've worked in a very high ceremony requirements-tracability shop). But it still requires the customer to have faith in source code they can not themselves see.

As a customer, you can claim what you like about your process and your glory: until I can actually verify the code as part of the deliverable, it's just faith on my part. I'd rather use an open source firewall rather than a closed source firewall, regardless of the claims made by the proprietary company. Again, this is about faith. I'd like to avoid having it when it comes to security.
Don't worry: your passion comes through in your work, if not in your voice.

EDIT. To give some unsolicited advice: From my experience giving presentations, if you want to give a demo that sounds good, I recommend around a dozen practice runs.
"Before it was bootstrapping, it was written in OCaml."

That's been my exact recommendation for getting compilers started in robust way. You people keep surprising me in pleasant ways. :)

Curious, did Ocaml's clean syntax and ease of decomposing functions make the transition to Rust easier vs a language like C++ or Java? I predicted ML languages should have that benefit but I couldn't test it on small projects.
So glad I kickstarted this. Very excited about the progress. Keep on with it. One of the projects I'm okay waiting a long time for because I know it's going to be worth the wait!
> community be damned

couldn't agree more. Yet all the evidence is that they're still using 3.x as their personal little hobby playground. Exhibit A: type annotations. Just because others are doing it. Nobody is asking for this. Even the PEP took ages to approve because even the yes-men had their doubts. Exhibit B: re-invent green threads. There are 15 solutions already.

Where is GPU? Where is multicore? Where is speed?

Where is the leadership?
It's crazy and upsetting to watch Canada squander the talent its great engineering schools produce, especially given the low cost.

I left Toronto 8 years ago for the US but have close ties to home and keep regular tabs on the labour market. Even at 1:1 CAD:USD, before factoring in increased cost of living in Toronto (vs. where I am, which is not SF), I'm making close to double what I'd hope to fetch back home. If I really bust my ass and kill it where I am, the disparity is only going to grow.

Once you account for other factors like the increased cost of everything and the general rarity of high-paying tech jobs, returning to Toronto feels like too much of a risk: even if I were to strike relative "gold" and make $120k-140k+ CAD as a senior engineer (a far cry from what I get how), what happens when I move on to something else? A close, highly-talented friend of mine has one of those jobs but feels trapped and doesn't even know where else he could go.

I love that the Toronto startup scene is growing and maturing and I have friends who are really working to, but I fear what's going to happen when funding in the US begins to contract. SF, NYC, and Seattle all have profitable "anchor" employers which will continue to bid for talent even when startup funding won't sustain high tech salaries. Toronto has small branch offices of American companies and some banks (I'm skeptical about the latter). Is there much else?

As far as I can tell there just isn't as much good work. I want to go home some day, but as someone who was fortunate enough to land a good tech job in the US: returning is a massive step down in pay for: fewer choices of work, a more fleeting labour market, a less ambitious environment, an expensive city with overpriced real estate, and a public transit/commute crisis which might not get materially better before I retire. I really do love the place though.

tl;dr I'm an exceptionally fortunate Canadian spoiled by great career prospects in a major American tech hub and find it hard to justify returning home :(
YouTube offline mode
These backdoors in the news lately - Juniper and now Fortigate - are scary, but thinking back on 10 years in IT I've never operated in a network where SSH on network equipment was accessible to anyone without intranet access through either physical location or VPN.

On top of that I am now in an organization where we're starting to implement security levels on networks, anything above level 0 requires 2FA to access and you can never connect a lower level to a higher level. So best practices are a good thing.
It involves a lot of manual work on both hired & triplebyte . For instance in triplebyte, you get interviewed by the triplebyte team AND then proceed for an interview. We are bypassing those steps and getting them connected directly to companies.
That would be a very cool offering.
Largest startup incubator in Paris
Some+Fascinating+“Firsts”+for+the+Film+Industry+over+Time
Hats what this article is about...
New hydrogen discovery could make room-temperature superconductors a reality
I think it's uncharitable to take Tran's interesting story and turn it into a criticism of him for not working on "harder stuff". You didn't phrase it that way, but it follows from what you're saying, and that's unfair. A person with his background is as free to work on what motivates him as anyone else is.

No one would disagree that "harder stuff" is important, but the trope of using this in arguments to belittle what others are working on comes across as finger-pointing. On an actions-speak-louder-than-words level, few of us are in a position to judge others about this, and I have the impression that those who are, tend not to.
I heard that a "no button" garage door remote control featured at CES was a phone app... that had a software button to open your door.
For readers who aren't already familiar with this, I'll note that this is in large part what Homotopy Type Theory is about making easy to work with. http://homotopytypetheory.org/book/ is a good introduction.
CVE-2016-0019 in particular is uninteresting and unlikely to be widely exploited.

Requires:

- Windows 10 Pro or higher.

- RDC to be enabled (not default).

- A non-Microsoft Account to be utilised (not default).

- That local account to have no password set.

Essentially you really need to TRY to get your machine exploitable with that one.
I know what I want it to look like, and I shall see if I can contribute to getting that created.

A Persona v2 if you will.

A few of us are chatting about it, look for letsauth on this page for details.
Wow. Many ideas and all of them seem really good.

For 6, what's the biggest problem will all the CRMs out there these days? What makes you cringe?

2. is something that I did think about but am unsure about the market for the tool. I'd also like to learn more about 1. and 4. in greater detail.

3. I know how you feel - I've been in BI and logging data accuracy is just a pain. You'll also have to balance to make sure that the UX is not affected by having all these logging events.
Plaid and Stripe Partner to Build an ACH API
Keep in mind that Amazon (and others) uses the "roach motel" model for networking. Easy to check in, not so easy to check out.

When we looked at S3 for some archiving use cases, that came up as a risk -- if strategically it made more sense for us to adopt Google, Microsoft, etc, we would need to negotiate significant concessions from a new vendor to transition away from Amazon or take a hit during that period. You always need to plan for the exit!

You'll have similar issues on-premises (ie. dealing with EMC/etc), but many people forget that cloud providers have their own gotchas too.
It's not always _users_, but requests. As companies embrace microservices, I think you'll see a moderately sized application pushing tons of requests over HTTP that would normally have used a different protocol
Try working at a research-based agency or research branch of an university. I've worked at NASA and Georgia Tech Research Institute as a Research Scientist when I only had my bachelors. Bonus is both place will pay for you to get a graduate degree if you want one.
Still really easy to trigger even by accident. All you need is to check a box to enable RDP while logged on with a local account with no password (though I hasn't tested, you may also need to uncheck another checkbox restricting logon to NLA).
Mozilla plans to ship ffvp9 in Firefox 46 (now in Nightly channel):

https://bugzil.la/ffvp9
What it sounds like you're describing is a way to filter out certain websites?
Build a Super Mario-Inspired Coin Cube
Actually, 100 points is an underestimate. At elite schools, there is a significant difference between the average SAT scores of admitted white students and admitted black students --- usually several hundred points. The average SAT scores of Asian students are about 30-50 points higher than those of admitted white students.

These are facts and easily verifiable.
Stalinist version of Python. That's a new one
Building Multiple User Personas to Segment Your Audience
> I would be shocked if near 50% of consumers ranked security as a concern without prompting.

I wouldn't doubt it, but consumers have no way to evaluate security. It ends up boiling down to which product has "Now with Added SECURITY!" on the box in the most convincing typeface.
West can match, only if it gets out of the clutches of the health insurance industry.

Doctors hate health insurance companies
Patients hate health insurance companies

only ones to love health insurance companies, are their share holders.
The interesting thing from that thread is that it appears it has been patched years ago. Then again, maybe they only changed the "password" in the newer versions.
This seems like an opportunity for hardware acceleration (CPU/GPU instructions / x265 accelerator) to reduce the power consumption on video playback for the majority of devices. Perhaps it's cheaper and simpler to make a co(+)dec chip that can encode too.
Love the way you catch her :). Just being curious, who will be interviewing those that pass the code challenges?
> Problem 2. Now you have to handle prompt. Some Cfg tools are capable but is quite painful for others, which means you can't automate 2nd auth. Actually you can automate like 2nd auth there are paid service out there offer API.

You can use ssh-agents for this. Some people consider that cheating though |;)
Is it wrong that I have zero interest in a new job, but want to sign up for a ready supply of interesting puzzles?
Here you go: RADIUS-enabled AD authentication of a VPN w/Google Authenticator 2nd factor. https://github.com/rharmonson/richtech/wiki/CentOS-7-Minimal...

You can also set up an SSH CA to validate clients by signed certificates, making managing a farm and its users' keys much easier. Then you don't even need an auth server online.
Right, in a perfect world, where all code deployed to production (including third-party libraries, legacy code that hasn't been touched in years, etc.) is free of security bugs, there's not much benefit to CSP.
Looks like Uber and VMware are already using this product. Can anyone from those teams tell us about their experience?
The final paragraph from the article:

'“Somebody has to get serious,” she added. “We’re spending billions of dollars on a status quo that doesn’t make us any safer.”'

That is nonsensical and as a matter of fact, indefensible.

Nuclear weapons are arguably the strongest force for peace in human history.
Something like this:

We develop a tool to verify Linux netfilter/iptables firewalls
rulesets. Then, we verify the verification tool itself.

Warning: involves math!

This talk is also an introduction to interactive theorem
proving and programming in Isabelle/HOL. We strongly suggest
that audience members have some familiarity with functional
programming. A strong mathematical background is NOT required.

TL;DR: Math is cool again, we now have the tools for "executable
math". Also: iptables!

https://media.ccc.de/v/32c3-7195-verified_firewall_ruleset_v...
Their point seems to be that inlining a class name means the class will only be defined once, but the case of an inlined style means the style information must be duplicated for each appearance. The style approach hits all the bad buttons -- the load is larger and slower, and its execution is slowed compared to a single class definition that's referred to multiple times.

Also, in the case of a defined class, you only need to change the class definition to change all the instances, rather than chasing down each explicit style instance.

The reasoning is only valid if the defined style is used more than once. If the style is unique, the argument doesn't hold up.
For the uninitiated why is this exciting? The graphics look really washed out and jittery. Thanks!
Sounds like it was named by Jar Jar Binks.
The other thing is getting to BART - if you live in the Mission or within a handful of blocks of Market St; and your destination is in downtown Oakland or on the west side... you're fine. But if not, you need to coordinate your trip between BART and two different bus networks on either side of your train trip (or shell out for a car service / cab).

Not only are train lines between Manhattan and Brooklyn much more plentiful, they fan out to a much larger collection of destinations on either end. It can be a one-system trip, which makes a big difference.

BART isn't bad by any means, and SFMTA/AC Transit do a decent job, too. I've lived in Miami and around Tampa, two other large cities which do an almost immeasurably worse job with transit. But BART is still a very commuter-centric network for getting commuters from suburbs to downtowns, and isn't a substitute for a true local subway network. Thats where the stigma comes from, in my opinion.
The problem with shebangs used to be (don't know if it still is) that quite a few OS's had python 2.X, but no actual binary called `python2`, just `python`.
We can debate the intention as one topic, and we can debate improving the reality to make it closer to the intention as another topic.

An article which discusses the intention - and the implications of that - is perfectly valid.
AI for playing (and winning) in Dark Souls PvP
Can we stop? https://hn.algolia.com/?query=The%20Sad%20State%20of%20Web%2...
Who does the great job again?

https://www.reddit.com/r/BSD/comments/391nyj/pfsense_conside...
Wow, I was high sceptical that you would be able to scale this up past the short view distance.
But not only have you managed to get a good view distance, but you also added in a nice animation system.
Congrats to you! This is coming from someone who has spent years designing their own voxel platform.
Please get this out to users to let them start building things, you will be amazed at what they can create.
Yes. Lots of people. You basically have to if you want to support both Python2 and Python3. (And in some spaces, you really do want to support both.)
One could argue that the proof is just that all As are Xs where all Xs are Ds and therefore all As are Ds. This factors out the detail of choosing one path over the other. You have of course still to show that such an X exists and can use either pair of the axioms establishing this but as far as this proof is concerned both axiom pairs are really equivalent. So are this really two different proofs? How would one define equivalence between proofs to begin with? Isomorphic graphs of applied derivation rules?
A pastebinned version of WRITEUP.txt (for word-wrap): http://pastebin.com/FnwmPYUD
The author may be biased as a law professor from Emory.

It is clear to me, just from the history of the volume printing industry itself, that patents are now hindering progress rather than promoting it.

Stratasys, the patent-holder for the fused deposition modeling (FDM) method of volume printing, failed to produce a printer widely accessible to the hobbyist market. As soon as the patent expired, we got an explosion of open, affordable devices for that market, with varying levels of required customer expertise and professional hand-holding services.

I think a similar explosion will occur again when robocasting and laser sintering are fully liberated.

I think the major damage to patents will not occur because people will ignore them, but because people will be producing and sharing prior art before the patents can even be filed. So far, the open source community has been rather more scrupulous than I would have expected regarding avoidance of patented technologies.

It's almost as if they see patents as damage, and simply route around them.
Visualizing 2015 U.S. VC Activity in Boston, Los Angeles and the Midwest
See Pascal/P. Wirth wisely started with a stack machine (P-code) that could map efficiently to about any architecture and be re-implemented by non-compiler experts. He then targeted a Pascal compiler to that. I believe he targeted a standard library to it. The result was Pascal/P applications ran on 70+ architectures without modification outside of system-specific code like I/O.

So, it's definitely achievable. Was done by Wirth at least twice (Pascal/P & Lilith) plus System/38 (later AS/400) at microcode level. Just takes modularity and a good intermediate language. Your adage is still true in that most screw up portability by using ineffective practices or not using effective ones. I rarely believe it when I see the word in a feature list.
The first 3 bullet points seem like they would happen on corporate networks without really trying too hard.
What are you using for 2FA?
This is why U2F is a superior alternative to pin-based 2FA and hopefully will eventually replace it - you can use a single U2F device as a second factor for many different servers without either sharing keys or requiring a bunch of different authenticator entries.
Thanks! Don't tell anyone, but I was legitimately skeptical too. :)
Thank you for donating.
"or have I missed something?"

You've missed nearly every Android OEM build. The AOSP being open for Nexusis the exception, not the norm.
"Discount negotiated by insurers" is the mirage americans live in.

$10 pill is marked up to $100, charged to insurer. your health insurance with a premium of $250 per month, negotiates the price and enables you to buy it for $15, giving you a illusionary savings of "$85".

Same pill, is probably available in India, at a market rate of $5-$7.

People compare market rate of the pill in India $5 with the pre-negotiation sticker price in US of $100.

Q to the Pharmacist Business Manager: Do you think prices of these drugs would remain so high, if health insurance companies didn't exist and everyone paid for medicines and services out of pocket?
> patents should contain relevant CAD files to better describe the invention

Interestingly this could actually provide stronger legal protection for the patenting person. Under existing copyright law people are unwilling to work on open source projects that interact with closed source products for which there has been a source code leak because it is harder to prove that you've never seen the closed source code.

Currently one can make new CAD file without infringing copyright (patent law I'm not sure of) but if people published the CAD files with the patent the patent owner could claim that any files that floated around on the internet are copyright infringements (and hence crimes an an of themselves).

---
I am not a lawyer. I'm definitely not your lawyer. If you need legal advice pay someone that knows what they're talking about.
H1-B isn't exactly the only option. For example if you get a job with the Canadian branch of a multinational US company, after a year you can transfer to their US branch with an L1 visa.
Says right on top:

"Kate Del Castillo is thought to have been under surveillance since 2014"

All the encryption in the world won't help if you're being followed on foot.
I saw this once, c2002. Wish I could remember the name
> The very first person who suggested Node http server must be fired that very day for offensive incompetence.

I'm suspicious that it was an MBA who wanted to use cheaper JS developers on the project.
Switzerland's Radon Girls – decontamination of Watchmakers cost millions
Ask HN: Online learning
If you were going to do a side project or startup that focused on education / online learning, what age and topic would you focus on?
There a ways to formulate "the infinity of the prime numbers" without any recourse to a previously-constructed set of all prime numbers (or even all natural numbers). Two such ways are:

1. "For any natural number n, there is a prime number greater than n."

2. "For any natural number m, and for any list of m prime numbers p_1, ..., p_m, there exists a prime number not on that list."

Both statements have a perfectly fine constructive proof. The second statement is more or less precisely what Euclid proved. The first statement follows from the second one with a bit more work.
The developers in the company.
It was certainly said about the printing press.
Why not just use normal HackerRank then...?
I don't think it would hold up in court.
Mattermark’s Guest Post Guidelines
Have they done a similar talk about their use of Erlang for their Facebook chat (ejabberd) platform at scale?
Ansible 2.0 adds better exception, error handling
I'm not sure if you're confused about what Skyscanner does? Skyscanner, like flights.google.com, Kayak, etc. is free to the user - they make their money on referral fees, among other things.

And, for that matter, flights.google.com is based on their acquisition of ITA Software for $700M in 2010, so clearly there is a market for companies like this: http://www.google.com/press/ita/
Glad you like :)

For 6, all the tools despite promising minimal data entry don't actually deliver on their promise (at least not in my experience) and don't play as nice with other tools as they could. Customer journey automation is a growing market and CRM systems are not paying that area enough attention. It's not that they need to build something that can address automation itself -- they just need to play nice , very nice, with other tools.

For number 1 check out Stealth Seminar and EverWebinar. They're the two best in the business which says a lot.

For 4. What else would you like to know? What kind of detail would you like me to share?