skysight-inc/HackerNews huggingface dataset:
This seems a little odd.

Yes, Alan Turing looms large in the public consciousness; his various Polish contemporaries, not so much.

But to anyone who has looked into the history of these events, the work of the Polish is no secret, nor has their story been "lost".

For example, some years ago I visited the National Cryptologic Museum[1] in Fort Meade, MD. They were very clear that the enigma code was cracked primarily through the efforts of Polish cryptologists.

[1] Highly recommended. They have -- among many other interesting things -- an actual enigma machine, and they let you type on it! (Well, they let me type on it, anyway.)
One of the best interviews I've had as a candidate (didn't get that job - it's the one that got away) involved me explaining design choices I made while implementing my solution to the take-home test. That was a great discussion, and didn't feel like the traditional interview-style questioning.
With all due respect, in all likelihood, you are not the audience for this talk (I honestly don't know). For those who are in the field, who were at the talk, I'm sure there was more than enough information presented for them to judge the claims (one way or the other).

Think of this as a preprint for the paper. It's just a talk.

If you want to blame anyone here, you could blame the media for reporting on a talk. But then again, the public likes to hear good news about cancer research, so I think the media is okay on this one.
I thought that it might be a Secret Service detail of some sort but the timing with Tim's response to the FBI demand led me to jump to this conclusion. Well, that and that was the feeling I got from the source on campus...they were definitely intimidated and phrases like "I don't want to get deposed" were being bandied about in their department.
Exactly. Something replacing the mouse/trackpad I use for hours a day would have real value for me, too.
SEC Suspends Deutsche Bank Research Analyst for “Not Meaning What He Said”
I would recommend trying an upfront or recurring fee first. If that doesn't work then try advertising/referrals. It is easier to implement and will generate more revenue in the short term if it works.

Don't worry about scaring people away at this stage. You actually want to find the people who really need this service so you can figure out what they really want and care about and build those features. If someone pays, that means they really want it.
So, the issue template is just a default text that individual users can modify, delete, or otherwise disregard?
Didn't understand the reason behind...If Twitter stays the same, they are surely dead too. A big reason that Twitter get crushed is because they basically didn't change over the past 3 years.
Flying During Pregnancy? Here Are Regulations You Should Know About
Umm, you just found me $6000 that I have been over billed by one of the services that I requested deactivation....

1. Time to fix my accounting processes for this particular business
2. This is amazing!

How do you make money?
U.S. Marshals Forcibly Collecting Student Debt – NYMag
iPhone 7 Concept
The software is built so that we can ship an on-prem version at some point in the future, but we don't have the processes in place yet to make that a reality.

Nothing planned yet, but if there's enough interest we'll consider it.
It does sound like a bad interview experience, but I will say that I have very little interest in what a candidate writes on their resume. There are candidates with amazing resumes that can't do much and people without much that they can talk about publicly that are amazing. If the interview is low signal, the resume is even worse.
Especially when rents are rising 5-10% per year.
I did both folkstyle and freestyle wrestling for a time (similar), and have used the chess analogy to describe it before. Two equally weighted opponents on a level playing field, with only their limbs as the different pieces to be moved strategically across the board.
Very interesting. Is there a reference implementation or discussion you can link to?
> 1. If the candidate can't be bothered to complete a 2-4 hour (depending on claimed seniority) code test in the language of their choice, we can't be bothered to talk to them.

The approach you describe strikes me as shortsighted as well as to no small degree selfish. I don't do take-home tests, as a rule, for one overriding reason: my time is too valuable, and I have so much less of it to expend in discretionary fashion than any potential client or employer, to spend it on a one-way interaction such as a coding test. I have a Github profile with more than enough stuff on it to demonstrate proficiency in some areas and mastery in others, and I learn nothing about your company by completing your test that will help me better understand if I want to work for you. If I really want the gig, maybe then I'll do a little additional work to demonstrate, in good faith and after you have likewise established that you are acting in good faith and aren't just cattle-calling me, that yes, I'm interested. But before? No way. Your company is just not special.

Conversing with a potential client or employer, on the other hand, is a two-way street. I learn things useful to me both in terms of deciding on a gig and things that are more generally useful, like the war stories that inevitably get swapped during those conversations. It helps me decide whether your company is worth it to me and, right now and in this market (for clued-in people), that's the biggest question: not "do we want this person to work for me?", but "do I want to work for this company?". Not operating with that in mind seems like a very, very poor idea to me.
Where I live, if the landlord doesn't fix the problem within a reasonable amount of time, you can fix it yourself and deduct the repairs from your rent payment. You should educate yourself on your local laws surrounding rentals if you haven't already; there are likely similar terms where you live.
PVS-Studio delved into the FreeBSD kernel
This sounds like more 'enterprise' bureaucracy. Coming soon, overly complicated paperwork.
But... the firmware is stored in external storage. How does it even detect that an update was performed? You're saying that if the hardware had affirmative control over all the secure storage (e.g. the RPMB partitions on eMMC, etc...), then it could have been written to do this blanking.

Well, yeah. But then you'd have a system that couldn't be updated in the field without destroying the customer data (i.e. you'd have a secure boot implementation that couldn't receive bug fixes at all).

It's a chicken and egg problem. You're handling the problem of the "iPhone" not being a 100% snoop-and-tamper-proof device by positing the existence of an "interior" snoop-and-tamper-proof device. But that doesn't work, because it's turtles all the way down.

Ultimately you have to get to a situation where there is a piece of hardware (hardware on a single chip, even) making this determination in a way that has to be 100% right from the instant the devices go out the door. And that's not impossible, but it's asking too much, sorry. We're never going to get that.
Wow, that's a ton of $.

To answer the money question, right now we actually don't make money. In the future, we think we can make $ by making intelligent recommendations i.e. "you like x and y, try signing up for Z subscription service.
Hearthstone and Community: Blizzard's Approach to Working with Players
I'm using this extension (Safari and Chrome) to get this and more: http://hckrnews.com/about.html#extensions.
Url changed from https://github.com/dear-github/dear-github/issues/125 to the announcement post.
If Apple can update the firmware of the Secure Enclave, could they not also write one that leaks out all the data contained within it?

Presumably this could then be used for offline attacks against the image dumped from the phone's flash memory.
I read this, yes. In .github/ people will not see it, and is even more worrysome. It belongs to root, same as CONTRIBUTING.md
I have very often wondered the same. Someone somewhere said it, lots of people repeat it, nobody does it and nobody has fact checked it.
How are you going to calculate the scrypt hash, client-side?

Doesn't that scrypt hash then become the password, from the server-side application's perspective?

How are you storing the salt for the user if your server only knows about a SHA-256 hash.

> MITM attacks won't get access to unencrypted fields.

That's TLS's job. If you, for example, are building a web app and you're delivering Javascript to perform the scrypt calculation, a MitM can replace the code to exfiltrate the user's plaintext password. It doesn't make sense for the threat model.
Going with the safe analogy given reasonable suspicion and a court order its clearly within the governments powers to say drill the safe, it MIGHT be in the governments power to force the individual to open it depending on how they see it. It is hard to see how a 3rd party not involved in the crime ought to be compelled to work on the governments behalf just because they happen to have made the original safe and possess the know how to break into it.

Can you explain how that duty comes to be?
India's $7 Smartphone Set to Disrupt World's Third Largest Mobile Market
I've sorta turned my back on the standard american dream. Racing to new areas of growth, working to build someone else's dream, getting paid well immediately for performance, paying high rent, etc to afford the image of success, and making friends that participate in this same high ambition culture. Instead of making markets, markets start making you. All the rules, and "norms" we've collected around ourselves to participate are just foolish.

I ended up just buying and crashing in a van, exiting that mode of being, and am much happier because of it. Now I get to save money, research and build what I want when I want, and generally am very much less stressed. I'm no longer beholden to a landlord, or feel like I must participate in activities that just serve to entertain but not enlighten. I can spend the day at the beach just reading if I wish.

You start to look at time as something that you can control again, and you start seeing how much life truly is a gift, and that life itself should be nurtured and cherished. There is also a sense of independence and DIY that comes along with the lifestyle that feels like I'm leveling up in good ways.

Will this mode change for me? Sure. Change is inevitable. But for now I've found more peace and focus than I have in a long time. I'm now able to concentrate on longer stretches of time that hold bigger ideas, and then asking myself how I might use that time to start refocusing my energy making new markets.
Show HN: All-new Codenvy – on-demand developer workspaces
This kind of depends on where the candidate is coming from. Those who're applying directly are obviously already expressing some desire to work with us. Recruiters should be instructed to give a consistent narrative, too. Good recruiters will also pitch the code test as a sign that we're a serious employer and take people seriously.

I don't like phone conversations that serve as the first line of candidate triage. Many big-company HR departments will have engineers phone screen anyone who sounds marginally suitable. This is soul-crushing, pointless busy work. My personal rejection rate of such candidates is somewhere in the 90-95% range. These are cold leads, not candidates. They should be taking the code test before talking to anyone in engineering.
> In most other jobs, it's harder to earn a PhD in the field while not being able to perform basic skills competently. But not computer science.

I think that you are confusing "computer science" with "software development". It may be easy to get a Ph.D. in computer science and be poorly suited for work in the software development industry, but that's no more surprising than the fact that people can get Ph.D.'s in economics and be poorly suited for work in the finance industry.

Computer science is, obviously, related to software development, and in many cases its possible to take a CS degree that is focused on software development, but CS in general is not software development, and CS degrees in general are not vocational degrees in software development.

The best software developers may need to have extensive knowledge of CS, but merely having extensive knowledge of CS doesn't make you even a competent software developer.
Comments moved to https://news.ycombinator.com/item?id=11119411.
I would argue that expending resources is different from creating something entirely new though.
Covering areas far from the equator ?
If you've ever managed a big OSS project you'd not think of it like 'enterprise' bureaucracy but a time safer. If OSS users can't even be asked to fill out a minimum amount of information based on a template, then I have zero interest spending my free time helping out.
"submit a bugfix to our open source project" might be looked down upon as trying to get people to work for you for free
Thanks for the kind words. Definitely understand where you're coming from in terms of security. Our plan isn't really to monetize your data, it's moreso to make intelligent recommendations that we hope our users will follow. For instance, "you're paying $10 per month for Hulu, on average users are x% more satisfied with Netflix, click here to switch from Hulu to Netflix".

We've definitely discussed the idea of a manual export/import - we may get to that in the future.
The middle class is shrinking, but not because they are moving down but moving up, but that doesn't fit the doom narrative that whiney millenials love.
And 'npm install bcrypt' is the package linked to from the article.
As somebody who's terrible at monologuing, this scares me.
30 year mortgages make the monthly payment smaller, which reduces the monthly cost of housing, BUT you end up paying more interest since you aren't paying principal off as fast which means the total long term cost of the asset is more due to compound interest. A 15yr mortgage takes more out per month, but it's cheaper overall since you're paying off principal faster and interesting isn't accruing or compounding as quickly.

I think it's possible to "game" the system by getting a 30yr mortgage but set it up so any extra payments above and beyond the minimum amount get applied against principal - in effect reducing the amount of money they can leverage interest against. Then you make as many extra payments as possible over the life of the mortgage and pay it off ASAP.
Constantly confused by this, so much arguing back and forth, and yet the single easiest way to deal with this is a stripped down real world problem and then giving it to a whole bunch of different candidates. Some people adopt this some people don't some people argue that it's meaningless, and go back to the standard silly interview patterns of algorithm questions and meaningless complex fizzbuzz alternatives.

tptacek summarized this in his hiring post:

http://sockpuppet.org/blog/2015/03/06/the-hiring-post/

My personal conclusion is that most companies don't want this for two reasons:

1. culture fit is more important for people in a rigid hierarchical structure, partly because an out of the box thinker could be dangerous for that structure. too much questioning authority, too much pointing out flaws. It's much easier to have a good worker bee than wondering why you need 40 employees to build an automated gif platform.

2. in most companies everyone is very reluctant to make decisions. for example management struggles with clear direction because it opens them up to the question of liability. if they make a decision and it's wrong they might get fired. HR works the same way, if HR passes a resume along they want it to hit a list of keywords, so they can cover their asses if he turns out to be a bad hire.

Basically everyone is so scared to make a mistake that they make a lot more mistakes trying to avoid them.

The opening of the cracking the coding interview she talks about how they don't really care about false positives and negatives, they just want those to stay below a certain threshold. But consider the hiring scale of google compared to a small company and suddenly those things matter.

One bad hire can be toxic. And basing your hiring strategy on something a huge behemoth with infinite money does is kind of silly imho
Parse Open Source Community in Slack bit.ly/1SxTVIi
Google's fresh food delivery service becomes a reality
I learned very early on to never trust the client. An infected machine cold just not encrypt the password and now you have a database where infected clients just got sha256. That is if course easily broken with brute force or even rainbow tables.
How do you feel about the all day interview process some large companies are currently using? Keep in mind you probably had 1-3 phone + computer interviews before the in person interview.

A take home test seems like a less time intensive process as you at least don't need to take time off from your normal job to do it.
Will there be relevant ads on the side for gmailified email from other providers?
I've always gone with the concept that mountaineering starts where a rope is needed to prevent serious injury in case of a fall. Altitude or even protection is outside of the equation. A sidewalk, if beside a 100-foot drop, counts as mountaineering because the rope is needed.
> Large contracts might be on the line should Apple not play ball.

That almost certainly isn't the case. It is doubtful whether any other government organization cares about how they handle this case. Heck the FBI likely doesn't care as long as Apple doesn't do anything illegal.
and then what lose more money taking time off work to go to court when the landlord tries to evict you for not paying rent in full?
It really is. I believe I have been doing this for the past couple of months. Thanks for the insight.
you should look up "debt monetization" and investigate how it relates to quantitative easing and money printing.

Cliff's notes is that quantitative easing is really money printing used to finance government spending, and is really just another form of taxation, although it goes through a slightly convoluted process to get there.
I don't know much about what sort of security compliance banks must implement, but surely that's in violation of something? What country?
The money you're not using to pay rent you mean?
I think there's always going to be a need for an authentication mechanism that relies on user memory only
I would say this dichotomy doesn't quite capture what's being discussed. To my mind, detail focused can still result in an ugly hack of a solution, merely with all corner cases covered.

I think one possible phrase closer to the heart of things would be "aesthetically focused" as well as detail focused -- they care not only about the details of the functionality, but about the "technical beauty" of their solution.
Hm, I've never thought of it this way, but you're entirely right.

This explains why many struggling families can "get" "reverse mortgages" in which they sell their earned equity back to the bank that has always owned the majority share. Until they have sold all their shares, and are evicted, that is.
What a dystopian future where what you go to school to learn is decided by the industrial job market...
death watch begins
Well, you can charge for the software as a whole, which I read your comment to claim you can't. I can absolutely say, hey, here's AwesomeDebianFork 1.0 with some custom patches on GPL code, you can get a CD set of binaries + source for $99. I don't have to resort to circumlocutions about service, and I don't have to make the source available to anyone else. (You are free to copy that source CD, though.)

The only thing I can't do is to say, the CD for AwesomeDebianFork 1.0 binaries is $9 and the CD for AwesomeDebianFork 1.0 sources is $90. (The GPL would reject this as not being "reasonable"; the DFSG would reject this outright for violating #2, "The program must include source code".)
Ok, so they're going to be 2% efficient at using that 20% that was gathered by PV cells. So it still seems like using 2% of all the light would be more efficient than using 2% of a fifth of the light.

I suspect that by 2% efficient, that means they use 2% of the energy of all light. Since they don't use green at all, going through the PV and then generating artificial light of the frequencies they need does seem to improve things. But probably not by so much as to make up for the 20% efficiency of PV.
You're not necessarily stuck, you're allowed to enjoy it :)

You mention kids a lot, several studies show that kids grow up happier in a house owned by their parents. Somehow it makes them feel safer or something. They have consistency in terms of going to school, etc.

Once the kids are gone, you are allowed to sell your house to downsize.
A 4h test when your still rejecting 90+% of people is ridiculous. You are basically rejecting anyone that is talented ahead of time.

I personally know two programmers that did not create a resume for 20 years and still got jobs offers. Remember anything more complex than a phone screen is going to start turning people away.
> MITM attacks won't get access to unencrypted fields.

A MITM would let you hijack the JS that controls scrypt/SHA-256, so you're already at game over. You've got to deliver that to the user in some fashion (TLS!); this isn't a real win for your approach.

> External brute force attackers will have to take the burden of heavy hashing.

If the attacker is trying targeted access to a site the only thing that's relevant is the time they have to expend - the hash is opaque. If they have the hash from, say, a DB theft, they're already going to have to take that burden. Your approach doesn't seem to add anything.

> Storing SHA256 hash instead of scrypt hash on DB means even if DB is stolen, attackers can't use stolen scrypt hashes to authenticate any client.

I'm not sure what that means. If you steal my scrypt hash for example.net, how do you use that to authenticate me to example.net?

Your approach pushes out complexity to the clients and doesn't seem to win us anything.
Or it could be their PCP's RN asking them to switch their ongoing Rx to a generic, because recent updates to their health plan means a higher co-pay or deductible.

This happens more than you realize, and doesn't mean their employer violated their privacy, which is why I ask.
Plus, cash plays no role in bribes like a free upgrade to the Presidential Suite, or "air routes that please an important member of Congress". (Quote from http://www.bloomberg.com/news/articles/2015-02-25/did-united... ).
The packages on those chips are usually designed to be melded to the underlying structures enough that opening them destroys the keys they're attempting to hide.
Bletchley Park has a memorial to the Polish codebreakers too. Another spot worth a visit. http://en.tracesofwar.com/article/11049/Polish-Memorial-Blet...
You're putting a lot of faith in the client.
Also the motorcade was there for a very short period of time...under an hour. Usually VIP visits involve meet-and-greets, etc... Maybe they were delivering an NSL as you hinted at?
It's a bummer they won't even respond. Do you have legal grounds to get an answer on renewing a lease within a reasonable amount of time before you get kicked out (1-2 months)?
Just one more symptom of runaway economic inequality...

The consumer has less and less real ownership/power. In good areas, the landlords have realized that year over year rent increases won't prevent units from being rented... and so, people are drained further unless they want to move away from where the jobs are.
I'm a little surprised that there hasn't been a populist rebellion over interest rates. Low rates have inflated pretty much every asset class. This is especially so in housing: The Fed needed to reinflate housing prices in order to make many systemically important players (banks, AIG) solvent again.

I have to wonder though: In re-inflating house prices, have we just off-loaded the bad investment to non-systemic institutions? ie, avg people?