skysight-inc/HackerNews huggingface dataset:
This is incorrect. Once data starts to flow, DTLS is used to encrypt the connection and verify each peer's identity. If the STUN server attempts to MITM, it will be detected.
One Man's Search for Smaller Codebases
Postcards from the post-XSS world
It's not the redirects that shouldn't happen. It's that if the content isn't yet published, it should not be available.

There are other ways unpublished urls may leak in - for example via sitemaps. Trying to lock them all down is lousy engineering. Instead just password protect the unpublished content and you're done.
TL;DR here: https://github.com/simonebrunozzi/MNMN/blob/master/Weekly-Su...
Refer to the product identified as having the bug:

> Product:	Tech Evangelism

> For reporting web pages that need to be upgraded to support web standards and Gecko-based browsers. And for reporting add-ons that exhibit common problems that make Firefox run sub-optimally.

It's not clear to me what the whitelist referred to is.
This is just good customer retention. If you haven't had a certain level of activity on apps, the smart move is to give you a bit of an incentive to come back. The fact that these two promos have come within a couple weeks of each other is probably coincidence, tbh.
The only reason I got a Starbucks card is for the reward. I actually didn't like the card since it tracked my visits. Now there's less reason to do so. When people are switching back to credit cards, those small transactions are going to hurt more with the per transaction fee.
FAQ indicates you'll get partial stars for the cents.

"What will happen in the new program if I spend an uneven amount? Do I get credit for the change?+

Yes, your change counts towards partial Stars. We’ll keep track of all your partial Stars and apply them to your total Stars.

For example, if you spend $6.20 (i.e., not including tax, tips, alcohol or other exceptions), you will earn 12.40 Stars.

The .40 is not always visible (we like to keep things simple), but you can always view your Stars and purchase history at starbucks.com/rewards or in the mobile app."

http://morestars.starbucks.com/#section1
Is it possible that the value derived from a hackathon depends largely on your age and nothing else? When I was 18 I loved this kind of stuff and would do it for fun, if nothing other to learn and make friends. Now you'd be hard pressed to get me there unless my team was people I know and worked with in the past. And it would be almost irresponsible to see parents there.
The author says this:

>If this sounds like advocacy for mediocrity, instead of merit, it is not. Keep in mind the following facts

And then follows up with a bunch of excuses about how they are not measuring merit by any means because traditional presentations and different project timelines are to difficult to compare for merit.

"it sounds like we don't want reward merit, and that's because we don't have the competence to measure it"
The best part of this change is the ridiculous email where they couched it by saying it was the "#1 request we heard from members."
Spend more time thinking about what to do instead of the “what if?”s.
I lump company hackatons in with company team building activities. Shallow attempts at making something happen.
Waiting for the Beautiful Spring – The Emporialist│„street Fashion” Magazine
Http://hitask.com - straightforward task manager that does not impose any framework or workflow on you. Easy but can be as powerful as you want it, with team features, Google sync, etc.
Ask HN: I'm thinking about creating 'Oscar' for IT. What do you think?
I've watched The Oscar 2016 and realized it will be nice to have similar for IT industry with following categories:

* best coder

* best tester

* best bug/issue

* best product/app

...

What do you think about this idea?
That nobody wants to hear excuses.

This as true for a CEO as it is for an entry-level employee. If you don't hit your deadline, your manager doesn't want to hear excuses. That doesn't solve their problem. They want to hear how you're going to fix it.
Yep. XSS isn’t at all hard to prevent if you’re using tools that are safe by default. Unfortunately, popular ones like jQuery aren’t. (This, more than any other, is a reason to prefer the DOM API.)
They wrote PowerPoint? If so, that's impressive enough to win a hackathon IMO. Lots of people use PowerPoint every day.
I've gotten into the habit of starting off every new project of mine with the header "Content-Security-Policy: script-src 'self'" on all pages, and whitelisting domains and 'unsafe-eval' as I need them. ('unsafe-eval' isn't so bad. 'unsafe-inline' is the really unsafe one that you want to avoid because it undoes the XSS protection. Eval has legitimate uses and eval-based vulnerabilities are not anywhere near as easy to accidentally create and never notice as a regular XSS vulnerability. I'd bet that everyone who has really written Javascript+HTML without CSP has created a regular XSS vulnerability at some point.)

There's no excuse to not start new projects off with a CSP rule like that. Doing it from the start means you won't ever have to comb through your codebase later to remove all bits of inline javascript that you depend on to get the benefits.
I think declaring war against pot fit nicely into the puritanical history of America, and a few crazy controlling people like j edger hoover. We do seem to let those types get into power. Hopefully it won't happen with Trump. I would believe that some of those types of people would try things like that to control people.

But I think there's a lot larger group of conservative law enforcement and politicians that just go along with those restrictions.

Now I have even seen some republicans coming out against this national surveillance as they think about what it would be like if trump had access to that, instead of "their guy".

It will be hard to reverse the national surveillance state. The first step is contacting your representatives and reminding them of your objection.
I think he could've done a little bit better job of tying the Parcells story with his actual point unless I was reading it wrong. For a while I really thought he meant people don't care when things go wrong and I kept saying "the hell they don't, that's when they care the most!"

But then it turns and he's saying nobody cares about the story of why things are going wrong. That makes more sense.
Nobody cares why you fail, only that you did.
The one hackathon event that I regularly participate in (GovHack) generally closes down between 11pm and 7am or thereabouts.
Just need to make it the new normal, in Little Brother by Doctorow the main characters have a similar problem with encrypted traffic 'sticking out', they push an encrypted music service to change the proportion of encrypted vs unencrypted traffic.

The analog hole and the fact that phones are already compromised to unknown degree still an issue though, but still a good step in the right direction.
VR Is More Than Merely Improved Gaming
I'm painfully aware of the cost of my daily large triple-latte habit but I can't seem to motivate to do what it takes to replace my high-quality PNW coffee shop with homemade espresso. These are the obstacles, as I see them:

- The espresso machine. The $150 one you get off Amazon just isn't the same as the La Marzocco that they use at a good coffee shop. Count on spending a minimum of $2,000 for a machine, or as much as $5-6,000 for a commercial-quality machine that will last for years of use. The quality of the grind is one of the most important aspects of good espresso, so figure another $500-1000 on a high-quality grinder, and another hundred or so for accessories and such. Yes, there are cheaper devices but there are reasons that the good stuff cost so much: high-quality all-metal construction, consistent and accurate pressure and temperature, serviceability, etc.

- Learning to be a barista. Operating and maintaining the equipment, pouring technique, knowledge of coffee beans--these are all skills that I lack. I don't know where to learn them, either. I have a busy job and I don't have time to apprentice at a coffee shop. I wish there was some kind of class that I could take over a weekend where I could learn to be as good as the guys and girls working at my local shop.

Still, even with all of the hurdles, it's worth it. I'm spending $35/week--that's almost $1,900 a year--on espresso drinks. I could pay for a nice Faema or La Marzocco in only a few years of drinking at home.

EDIT: I spoke too soon. Look at this: https://a.zozi.com/#/express/seattlebaristaacademywa/product...
No worries, it's the title of the original article, and I'm criticising mainly that. But the article itself definitely has it's own share of problems/inaccuracies.
Scientists just 3D printed usable human bones and muscle
"It's amazing how much 'mature wisdom' resembles being too tired." - Robert A. Heinlein
The scope would not be very well defined, unless it's something like "Opensource JS Oscar", or similar. Otherwise you'd be excluding lots of people we don't know about and who do amazing work. Then there's difference of environments. Finally there's what does it even mean to be a coder?

If you reduce the scope a lot, then something like that already exists. For example Pwnie Awards (https://en.wikipedia.org/wiki/Pwnie_Awards) But it's more about fun and categories are made up as needed.
Sounds to me like there is or was a list of important sites that were known to only support older versions of SSL/TLS that Firefox would otherwise refuse to connect to.
Git submodules work pretty great for this IMO. Rather than incorporate a snapshot of the source, pick a commit hash. Still frozen at a point in time, but you get to move which one you're using (or point to your own fork!) whenever you like.
the NSA's infrastructure for the Whatsapp intercept system is probably more stable and better resourced. /s I hope.
I don't know what his point was that it was predictable. If you were closely following the field, sure. There were some super promising papers published at the end of 2014. Heck if you just saw the wave of deep learning results that were crushing various AI domains, you could have predicted Go would be on the chopping block soon. I was really sure that Go would be beaten by the end of 2015, which didn't happen. However almost everyone I spoke to was skeptical of that, and the outside world was totally unaware. And it still represents relatively fast progress, even if the progress is predictable.

Anyway I think drawing strong conclusions about AI progress from this single example is wrong. You need to look at general trends, which is definitely rapid improvement.

Here is a study about how fast algorithms are improving in general, after accounting for hardware speedups: https://intelligence.org/files/AlgorithmicProgress.pdf

>Chess programs have improved by around fifty Elo points per year over the last four
decades. Estimates for the significance of hardware improvements are very noisy but are
consistent with hardware improvements being responsible for approximately half of all
progress. Progress has been smooth on the scale of years since the 1960s, except for the
past five.

>Go programs have improved about one stone per year for the last three decades. Hardware
doublings produce diminishing Elo gains on a scale consistent with accounting for
around half of all progress.
The alternative, if you have no good way of testing the codepaths, or if you're running on a system with overcommitted VM, is basically segfaulting. And you're running on a system with overcommitted VM.

An abort with a reason is a far better choice.
Just exploit the identity-political zeitgeist that's overtaken universities lately: claim yourself genderqueer, non-binary presenting as male. With the right incantation, the organizers will fold like a house of cards, lest they suffer the blowback to excluding a "righteous" participant.
I'm not sure the DOM API is safer. innerHtml vs html()
Asian women are also statistically over represented. But that doesn't fit that narrative of this post so ignore.
Actually what your so-called "Healthy Hackatons" demonstrates to me is that not a lot of Khan Academy employees are married with kids. I know my wife would be annoyed if I was goofing off at the office until midnight for a week leaving her to feed our kids and put them to bed by herself. But, hey, it's all for the greater good of "disrupting" education!

It's ironic that obviously very few Khan Academy employees have children of their own, but that's probably because it's only a few years since they were children themselves...
Selling Out and the Death of Hacker Culture by Rodney Folz

https://medium.com/@folz/selling-out-and-the-death-of-hacker...

Previous discussion:

https://news.ycombinator.com/item?id=10249887
The surface.
It might be a reference to debugging Spring autowire.
Anyone have experience using this with Unity? What's the workflow like? Does it use much memory? How does it effect the framerate?
Seattle-Area Salmon Are Loaded with Anti-Depressants and Other Drugs
I'm so happy someone beat me to this joke.
Exclusive Coverage of Union Budget 2016 by Finance Minister Arun Jaitley
Wow. Can I have my 3 minutes back?
Consider for a moment the quote that the person or persons known as Satoshi put into the genesis block; many people feel that bitcoin is not broken and not in any danger from the current block size, and do not favor having a process - any process - wherein sufficiently agitated groups can change the basic rules of the game should they garner enough popular support.

This is the "if it ain't broke" crowd. It comprises the majority of early bitcoiners. The notable exceptions are the large, VC-funded businesses that have a specific vested interest in bitcoin being used for widespread retail transactions, a task it is horrendously suited for, even with any arbitrary block size.
Yes - in fact, because so few people use Signal, having two people who know each other who you also know appear in your Signal phone book probably means they are talking to each other. Which might be a problmeatic metadata leak in some cases.
My theory is that two people who each live to 40 will together experience more joy than one person who lives to 80. I remember the first time my daughter tasted chocolate. I could get filthy rich and buy a yacht and I don't think I could feel joy like that as an adult. If we maintain population at equilibrium, people living twice as long will mean half as many kids born each year. Half as many first tastes of chocolate. Life extension carries with it an enormous opportunity cost.
Where are you from? We are constantly told that there is no such thing as shadenfreude in the US.
1. Ben Horowitz likes football
2. Paul Graham can get you to analyze online rants for free
I did mention another common way to prevent this is to have a content staging site, where all your content is edited; this should ideally be _completely_ separate from the public site. When content is published, it's published to the main site from the staging site.

But in this case, the post seems to be unpublished ("accessible only to logged-in users with the proper credentials"), but the SEO redirect plugin the blog is using is likely hitting it's 302 redirect prior to Wordpress checking it's access on the post ID in question, leading to this URL information disclosure.
Mailbird – das beste Mailprogramm für Windows 10
Programmers also do that. This is somehow linked to survival in the long run.
Most of the good ad networks today (like Adsense) try very hard to do this already. The problem is that it's not easy. For instance, how do you stop a malicious advertiser from creating a legitimate looking ad that points to a legitimate looking page, then redirecting it to a different page after the ad is vetted? What if it only redirects for certain IP address ranges? And that's just one example of a technique a malicious advertiser could use. None of the top tier networks want malicious ads on their platforms. The problem is that it's difficult to remove them.

Also, even if you could catch everything with manual human vetting of every ad, it would be cost-prohibitive. (Either you would have to pay less to publishers, or charge more to advertisers. The latter would likely be a non-starter, because it is already difficult for most small advertisers to run positive ROI campaigns. The former would put further pressure on publishers, making them even less likely to accept the risk of these proposed lawsuits.)

I would love to see online advertising improved, and I think there are certainly possible ways to go about it. I'm just trying to illustrate that it's not as easy as, "don't let people publish or distribute bad ads."

To borrow the analogy from the article, we couldn't stop spam by going after the email providers for allowing it through.
I hate to rain on your parade by why not just teach basic math?

Its going to be much more useful than Web dev skills in the long run. Not all the kids will get into tech, but they'll all need some basic math later in life.
Seems another rewritten part from book "The Hard Thing About Hard Things" by Ben Horowitz.
Recursion really only works in languages that support it well. In some languages recursion is simply an unnatural act.
Denial? Isn't their statement true that the impact of 2008 on Silicon Valley was not as bad as the dot com crash?
I'll extend this.

Your customers don't care. Customers don't care that you only have two engineers. Customers don't care how little time you had. Customers don't care how you did so much with so little. Customers don't care that you're losing money every month. Customer's don't even care why you made a decision that negatively impacted them. Customers don't care about you. They care about the end result in their hands and nothing else.
Newbie here: for every one of my projects, I go out hunting for a decent way to do record IDs and still am coming up short. I dislike mightily UUIDs for the user-unfriendly lengths. My preference would be for something like airline codes or YouTube IDs: 6-10 alphanumeric IDs. Should I just be generating a hash and actually storing it in the DB after checking for collisions? Or is there a way to encrypt/decrypt to a specific length with a specific set of usable characters?
You might be interested in

https://en.wikipedia.org/wiki/Format-preserving_encryption
I'll go one further and say even if you have something amazing, nobody cares unless you can actually take a big market share - whether in niche or otherwise.

I see this a lot, and have done it myself. You will frequently see someone with "better" technology than the leader or "the best" [insert thing] - but because they were too early, too late, didn't have enough PR, or the right connections etc... can't take market share and inevitably closes down.

I read a great quote from a rolling stone article, about Trump that I think is somewhat applicable to my point[1]:

Cheryl Donlon says she heard the tariff message loud and clear and she's fine with it, despite the fact that it clashes with traditional conservatism.

"We need someone who is just going to look at what's best for us," she says.

I mention that Trump's plan is virtually identical to Dick Gephardt's idea from way back in the 1988 Democratic presidential race, to fight the Korean Hyundai import wave with retaliatory tariffs.

Donlon says she didn't like that idea then.

Why not?

"I didn't like him," she says.

"Nobody" cared, about the Gephart's plan - and it even tanked him - but with the right spin and shine or however you want to put it, it sells.

[1] http://www.rollingstone.com/politics/news/how-america-made-d...
I play a college sport, and our coach pushed our team to adopt this exact mindset this past year. It completely changed our team culture and performance. Cold weather, injuries, lack of facilities, etc. previously served as excuses for why we weren't achieving our goals. Once we started focusing on the controllables and working around our challenges rather than hiding behind them, our performance drastically improved. We also started enjoying our training and time together much more.

I think people who just "get things done" are ones that possess this mindset, whether they know it or not. Instead of "I couldn't do X because of Y," they tend to say "I originally couldn't do X because of Y, but by doing Z I was able to make significant progress regardless."
I cultivated a taste for aeropress. You don't need an espresso grind so you can get a good grinder for under $200, and the aeropress itself is under $30 on amazon. With good coffee it tastes great! Not as good as a cortado, but way cheaper. And no need to stock milk.
The point is that nobody cares why you are failing, only that you are.
How to Target the Right Audience on Facebook
I think the takeaway was that nobody cares about the excuses, or reasons for the failure and not the failure itself. Investors, board members and employees would obviously care about the failure.
Well I was expecting an article about air traffic control :o
Estonia Embraces Uber and Taxify
Is that you R. Daneel?
How to Make a Stateless (Session-Less) Authentication with Spring
25 Powerful Eric Worre Quotes That’ll Inspire You to Succeed
I can't remember now, but this is the reddit thread about it:

https://www.reddit.com/r/sysadmin/comments/25mp2r/punch_card...
and again Flash is the scapegoat

"By converting unsafe flash-based ads to safe HTML5 ads, they lower the risk of infection from a hostile ad." is laughable at best

An Ad Network is one of the fastest way to deliver a payload to a lot of users

Don't fool yourself, Operating Systems, Browsers and HTML5/JS also have a hell lot of CVE that can be exploited

It's funny how a company like Google making Billions from ads, having ton of smart engineers, have never figured out during the last decade how to "scan ads for malware".

It's not like anyone can upload an ad to those big network, or that they don't QA the ads before delivering them ...

Imagine this unlikely scenario: malware delivered by HTML5/JS

I guess we'll all have to run for the hills if that happen
You can use CSP to prevent content exfiltration as well, not just script execution. There's a number of directives suited for that: img-src, form-action, child-src, etc. Full list on MDN: https://developer.mozilla.org/en-US/docs/Web/Security/CSP/CS...
Thanks for sharing. That's rather interesting. I hope you're doing well, now.
I hear this is done already with the race thing, I've heard of the "check Hispanic" trick a while back to make it easier to get into collge.
Except for C, Objective-C(++) and C++, all other programming languages, even systems programming ones do bounds checking.

And at least in C++, thanks to the STL or similar library there is the option to always enable bounds checking.

So even if the market didn't got hold of Algol, except for C and languages that offer copy-paste compatibility with it, all other ones do offer sane defaults in terms of security.
When times are tough, it's very easy and very common to bury your mind in a blanket of worry and excuses. These activities can absorb a large portion of your time and mental energy. But, they have no return on that investment.

Better to devote all of your energy to doing better. Even if you still fail, you'll fail no worse and probably a fair bit better if you stay focused on the work rather than the excuses.

This is much easier said than done.