skysight-inc/HackerNews huggingface dataset:
SHIFT | San Francisco, CA or Washington DC | Full-time, VISA, ONSITE

We’re a San Francisco-based startup that’s changing how car ownership works by rethinking the process of buying, selling, and owning pre-owned vehicles without ever owning them ourselves. When you look at the automotive landscape and realize that no one has ever applied big data or computer science to try and fix the problem, we're looking at a $500bn industry that’s ripe for disruption. We're a team of highly collaborative and product focused engineers who are passionate about bringing trust, transparency, and quality user experiences to this broken market, and have started the charge with a great mix of folks from Google, Dropbox, Facebook, LinkedIn, and other top companies.

Our backend is in Go running on Google App Engine and utilizing REST APIs. We're building our front end in React using ES2015 transpiled with Babel. We also have a CRM backend on Salesforce, with an iOS app built on top of this to help our ops team price, inspect, deal with contracts, and logistics. Our mobile presence is mainly iOS at the moment, which we’re using Swift for, and we do plan to venture into Android as we continue to build the team. We're running a Postgres database on RDS.

Current openings:
Mobile Engineers (iOS & Android) - SF & DC
Software Engineers - SF & DC
Front-end Engineer - SF
Infrastructure Engineer - SF
Engineering Manager - DC

To apply: http://shift.com/jobs OR send your CV to: enghiring [at] shift.com

More info: https://medium.com/job-portraits/shift-is-tackling-the-ultim...
http://time.com/4018160/shift-review-sell-your-car/
http://www.businessinsider.com/the-25-hottest-san-francisco-...
It says "how" but it doesn't actually provide any technical details at all.
> "descartes reset"

I love that word. Especially because studying Descartes in high school has also shaped my world view very strongly.
Continuations for web programming; Capabilities for security. False promise?
Looking at the limited success of capability-based security, and also at the perhaps limited actual utility of the neat "continuation-based web service" concept, I'm just wondering if anyone would agree that these are both examples of a simple concept that is initially appealing for its elegance, but actually doesn't quite solve the whole problem? Discuss...
True, but arguably whoever can access your email could just as well use password reset functionality for a given site you are using.

The generated url-login-tokens on the other hand will be long random strings and harder to impossible to crack.
They were able to have medium mobile successes with releases of Slots games and Farmville 2 Country Escape. The mobile games business is getting more mature and only a couple companies are really well positioned to execute and have actually proven they can make followup multiple big hits: Machine Zone, King, and Supercell. Zynga is not at their level and perhaps fighting to be in the next tier of mobile gaming companies (5-20), which isn't necessarily a big criticism that their not a top dog. But given their resources they should be able to compete better. The problem is their upper level management and C level execs, which have combined to produce a terrible company culture along with making poor strategic decisions. Their game development is driven mainly by MBA type Management consultants and East Coast ivy league graduates. Only on the shiny surface are they are Silicon Valley tech company- more of a stepping stone for opportunistic business types to get into tech. They have a great analytics infrastructure, but then they are not smart with how they use the data- and it's rather just used as a tool for Managers and execs to push their own agendas and to claim credit for various projects. Their are whole departments that are essentially useless and have no clue. Across the board- terrible management. If they empowered the people on the ground their who know what their doing, then they'd have a much better chance of success.
Thanks for the feedback! Right now I am just hoping to see if there's any kind of desire for a product like this.
Unfortunately, there is no way for browser extensions to create Unix sockets,

Also, code signing would prevent anyone from modifying the binaries to change the IP address.
There's no intentional link usually. It's just the best illegal source of income. If it dried up they'd be smuggling blood diamonds, etc.

Terrorism is a gateway crime. :D
This is a non-issue. The `!#/bin/bash` at the top of scripts will tell the interpreter which shell to run. And any one liner I've found online for bash has also worked on zsh (for me), but even if it didn't: `bash -c ls`
/me has commit access to pip-tools.
What We Can Learn from the Mismanagement of Zenefits
I don't agree that installing a key logger (of which there are hundreds out there) and stealing the encrypted password files is in any way harder than logging lo0 and waiting for passwords to slowly trickle in while they're being used.
Yeah, you should stop the turtle sequence. Maybe don't make it so easy that a script kid could exploit it, though...
> This falls into the question of what can we do to prevent attacks from malicious processes running on the user's machine.

It's likely that I'm misunderstanding things here, but here's what I'm imagining:

* I use 1Password and presume that my plaintext password stays on my machine.

* I use HTTPS for traffic that I care to secure.

* I contract to a vendor, with whom I don't share trusted information, to provide a dumb (non-VPS) shell, which I use for a variety of purposes.

* Among these, I use a SOCKS proxy to VPN traffic for some reason (say, to circumvent state censorship). Again, I presume that the vendor in question can't read my HTTPS traffic or 1Password info.

Can't the vendor in this case, who presumably has root on the machine in question, now sniff the loopback and find my passwords?

If the answer is "yes," then it breaks the workflow of trustless use of a SOCKS proxy.
Are you suggesting simple DH without any long term secret?

Hmm. I'm fairly sure we thought through that option, but at moment I can't see see/recall why we rejected it.
Safeweb Cybersecurity Model: Developed in Collaboration with NNSA.gov
Beware of CrashPlan Retention Policy, which deletes your data without notice
I believe this already exist, and on top of that I believe it existed multiple times and failed multiple times.
So far, I love it... Great news, concise format. Always in your pocket.
The problem is that in this case both the server and the client are the same machine. And if you have root access to it then you have access to everything including the private keys of the server.
I know of at least one other NZ Mozillian (Nick Cameron, on the Rust project) but I'm not sure if he works remotely or at an office.
That's silly, because it's an universal truth. Yet they still close the exchange and the dumb traders go home to sleep.

You can design the rules to optimize for one thing or another, continuous world notwithstanding. I'm suggesting a way to optimize for something more useful.
> Adblock Plus comes off the worst of the lot. The company charges publishers fees to allow their ads through its filters, based on criteria about size and placement.

Lie. Adblock Plus is a FOSS ad-blocker.

It has a whitelist of "acceptable ads" that is enabled by default.

You can turn it off, and since the thing is open source, you can clone your own version in which that is the default.

I haven't heard that anyone has to pay ABP (or can pay) to be on this list.

There was/is some controversy, see here:

https://en.wikipedia.org/wiki/Adblock_Plus#Controversy_over_...
Great question, we are using similar tools!

Slack is where our conversations live, but trying to keep more persistent and organized information there didn't work well for us.

We are also using Google Drive, but mainly for file management and working on documents which require full control over the styling and layout (e.g. legal documents that need to be printed). For more dynamic content and ad-hoc information, it feels too heavy to us.

Github (Wiki) is great for static text content and fine grained change tracking. Besides that, it's rather hard to use for non-developers as you pointed out.

We use Nuclino for collaborating on rich content that is more persistent than conversations in Slack and which does not need the overhead of a system like Google Drive. We haven't used Quip too much, but feel that it's rather similar to Google Drive with the files, folders, documents, spreadsheets and the likes.

To keep the core experience lightweight in the long term, we plan on supporting integrations that extend Nuclino.
Open source 3D printing needs a new core philosophy before it gets left behind
nice approach to connecting all these different tools.
Show HN: Dejavu – a modern, open-source data browser for Elasticsearch
Really? Do you remember any of the names of the previous attempts? Or what went wrong?
http://www.nanex.net/NxResearch/ResearchPage/5/
Was he talking about all women, or just the median woman?
Pied Piper faced a serious threat that nearly ruined their business which stemmed from something like this, though you can't guarantee arbitration, and favorable treatment. Just use your own code/open source, and your own equipment in your own time, off site.

I haven't gotten an update on how their product is doing now though, but hopefully soon.
I responded to this question, but now I see that I was missing your point. (It doesn't help that the HN title changed to something other than the article title after it was posted.)

There are plenty of private industry shops maintaining software on a skeleton crew that needs no more features or a bigger market. Again, this article is assuming that all private industry only serves a growing market. There's plenty of software already written and being profitably maintained by skeleton crews to happy customers.
And I'm saying that your optimization wouldn't accomplish any goals that you might have.
There's currently a bug that forces you to hit Space after pasting a link, for it to be recognized as a link. We'll fix this soon, but for now you can just hit Space after the link.
You're not understanding. The only solution to this "problem" is to not give the computer access to the password, which defeats the purpose.

But the moment you trust the password to a compromised computer, it's game over.
Pretty much, as I recall. But the connections went much deeper than just pulling down DARPA money.
Just a comment on the landing page. Needlessly animating all the content into the page as it scrolls is terrible UX. I'm trying to read and just totally distracted by stuff flying into view - no thanks.
Mozilla is prototyping a feature called "WebReplay" to support reverse-debugging of JavaScript and DOM mutation:

https://developer.mozilla.org/en-US/docs/Mozilla/Projects/We...

https://bugzilla.mozilla.org/show_bug.cgi?id=1207696

It looks like Microsoft is implementing a similar time-travel feature in Chakra:

https://github.com/Microsoft/ChakraCore/commits/TimeTravelDe...
Udemy Simplifies Pricing Model
I have yet to get a cogent explanation of how this project is any better than hosting a mamp instance on your home computer, running an ecommerce package. Seemingly, the authors believe that their system will bring free sales in your door, because it 'doesn't need' google to index your site. :/
Completely agree.
My brother recently lost his sight. I've been working on tools to address some smaller, specific pain-points for him; but general purpose computing without vision is beyond frustrating...
I don't mind the lack of GC. Storage pools are reminiscent of Objective-C's autorelease pools, which I've always thought were a very nice way of handling a group of objects' lifetimes.

> And a less wacky OO system (invisible syntax, ugh).

Not sure what you mean by this one?

> And there are Ada compilers in Debian, it's still being maintained, it compiles really quickly into excellent code, it interoperates beautifully with C...

I came across http://www.getadanow.com the other day. Really easy way to get Ada going on OS X, too.
We originally built dejavu as a data viewer for Elasticsearch to scratch our own itch at appbase.io. It all started when we shifted our APIs to use Elasticsearch transparently and needed a way to display the DB data to users. We tried elasticsearch-head and a couple of other similar tools but found them to be lacking in Ux and stodgy. Others (like Kibana) were more geared towards visualization / charting than viewing raw data and even then, were hard to use outside the Elasticsearch ecosystem.

With dejavu, our goal has been to build an open-source data viewer with a modern UI and make it more widely available. You can get it from the chrome webstore, use it from a github hosted page or install it as a plugin with Elasticsearch.

(I am cross-posting this from Product Hunt as it got featured there, here's a link for those interested in following the discussion there - https://www.producthunt.com/tech/dejavu)
Remote-activated cable reel. Roll it up and get into position, then lower the skyhook. Pack it back up and fly off into the sunset! Now I want to do this. Yes you'd need a big wind screen (they make those and they're not crazy expensive) and a fairly large drone to deal with the extra weight of a condenser mic + XLR cable + 48v phantom power circuit + any reel mechanism, but considering the payload capacities of current drones in the 1-2kg range for a DJI Phantom 2 ( http://www.phantompilots.com/threads/flying-at-high-density-... ), it would require some engineering (and maybe removing the mic from the heavy casing or finding a really light mic), but definitely not impossible or even very challenging to do with off-the-shelf stuff and a bit of diddling.
Ah, that's why I wanted an example. Your answer is fairly obvious, but it's pretty absolute too so there's no way to ask questions like "is this information actually going to affect the bid size or price of a bidder?" or "is this event important but infrequent, like quarterly reporting?"

For example, infrequent important events will result in a race for people to submit at the last microsecond, but because they're infrequent 99% of the time the 10ms buffering will effectively change the behaviour of market participants.
In fact, the reason Server 2003 got an extra year of support is that they waited until after Vista SP1 to do Server 2008.
Insta mate
He edited it down an order of magnitude (and rightly so, it was clearly a typo).

That said, whenever any trading entity talks about their trading income, be suspicious, because that is usually just the difference between bought/sold (and fees) and doesn't account for the infrastructure costs of trading.

Thats why I like these public SEC documents so much, because they have to use GAAP so you know exactly what they mean.
Read Dark Pools (http://smile.amazon.com/gp/product/B006OFHLG6/) and it will make the setup at least comprehensible.
Even on high-end hardware it's hard to hit 200ms first paint doing purely client rendering. Even when using a CDN. Would love to be proven wrong here.
I use red sunglasses for that (sometimes advertised as "UV protection"). The advantage is that it works on all devices, even analog ones. :)
Well, unauthenticated DH ("simple DH without any long term secret") is trivially MITM-able, so it could only be useful if you adversary could read but not write to the channel, which I doubt is the case in this context.
CFPB takes action against Dwolla for misrepresenting data security practices
Three things I use regularly, even in scripts:

1) Glob qualifiers:

ls *(.)

will only match files, not directories, symlinks etc.

ls **/*.jpg(.L-3000000on[1,5]) **/*.png(N)

will match .jpg files in the current and all subdirectories, which are:

. files
L-3000000 with "length" (size) under 3MB
on ordering them numerically
[1,5] and only the first five

plus any .png files, if they exist (N = it won't fail if they don't).

I have some scripts with expressions this complicated, but day-to-day it's useful for finding empty files (L0) or excluding directories. "man zshexpn" and search "Glob Qualifiers".

2) Glob operators:

ls DSC<100-200>.JPG

matches files with names between DSC100.JPG to DSC200.JPG.

setopt extended_glob
ls *.java~*Test*

matches all .java files, except those matching Test*. Same man page, search "Glob Operators".

3) Lazy for-loops (single command doesn't require do-done), and taking two variables:

echo "A 1" > tempfile
for i j in $(<tempfile); echo $i $j

4) Parameter expansion.

> x=EXAMPLE.jpg
> echo $x:r.png ${x:r:l}.png
EXAMPLE.png example.png

Interactively, shell history seems to be nicer, I use a couple of global aliases (alias -g L='| less'), and the completion system completes everything you can possibly think of, like usernames, hostnames, remote filenames, HTTP URLs, processes (for kill)...
From the manufacturer of the tags:

Target Applications

* Electronic ticketing in public transport
* Road tolling
* Airline tickets
* Access control
* Multiple applications

Do these have additional security features that the badge didn't use?
Even more reliable is to keep your programs small :)
I found myself using tox for managing the general case of this. But the spirit to the blog is in the same direction.
3-D Printing Maps to Help the Blind
I worked with Robert at Mozilla for many years. He might be the most talented software engineer I've ever met, and he's a strong candidate for nicest person as well. An absolute pleasure to work with. Mozilla will miss him dearly but some other project (apparently rr) just got really lucky.
Not that I am ok with it, but the collusion is a double edged sword. Let me explain myself: On one hand it is bad that the employee gets less than the market and the company is willing to pay. And that should absolutely be corrected somehow.
On the other hand, now that the salaries have exploded in SV, you can see the transfer happening towards the real estate owners. I can bet on it, that if the salaries go down, the real estate in SV/SF will take a hit.
So. the business owner has to face this: if I let the salaries go up, then it will be difficult to bring in entry level people since they won't be able to enter the market. And they'll have to go with shared apartments and other similar arrangements, which is untenable in the long run.
Plus, it is not sure the employee will be able to retain much of that salary increase.

I know, it sounds paternalistic for the employer to think this and maybe it is better to let the market settle the current salaries/living costs tussle. But my argument is that maybe Catmull had other considerations aside from the business bottom line. The employee pipeline is actually more important.
This seems really cool - would love to see a demo app I can play around with before handing over an email address.
Right. I'm sure that he knew better than they did, it was fine for him to limit their choices through collusion as long as he also took actions which helped some of them a little and himself a lot.
>People should not stalk or harass, period.

And if they are, you're saying that women are completely incapable of handling the situation themselves and need to run to the police?

Suggesting that a woman solves her own problems is not the same as victim blaming.
No. Mozilla's Auckland office has other engineers working on Gecko video playback.
Theoretically, how would a company know if you don't talk about your project and don't take interviews with TechCrunch? As long as it doesn't blow up into a household name startup, no one will ever know to look?
That it hasn't been adopted as a core functionality doesn't there isn't one, zc.buildout first stable release predates bundler's 0.3.0 by at least one year:

https://pypi.python.org/pypi/zc.buildout/1.0.1
It's on their road map.
You are correct that we are vague about the threat model in this case. But please keep in mind that encrypting local data at rest defends against a whole category of "compromise" (i.e., the data stored long term on the local disk being captured) then the case of a malicious process running on the user's machine while the user is actively using 1Password.

Officially our view is "if a malicious process with user privileges is running on the users machine when they use 1Password, there is little we can do".

But sometimes we try to do better. The example I raise is the steps we take to make things harder for keystroke loggers. We won't go to extraordinary measures to enter a battle that we can't win, but when there are simple things that we can do to make things harder for malware, we will.

See the first three paragraphs of https://blog.agilebits.com/2014/08/21/watch-what-you-type-1p... for some sort of attempt to clarify our vagueness about this threat model.
Agree with all that you said and I have seen it first hand as I tend to be a poor negotiator and overly trust people. My main issue is the selling of the “mission” by investors and founders. Even in the first comment of the article you linked, Mark Suster talks about people obsessing about options. Certainly we should all be doing stuff for more than money, but if founders and investors weren’t concerned at all about the money why not make these companies non-profits. The reality is they use the information asymmetry for their benefit and then try to pretend it doesn’t matter and people should be about the mission. If you want a mission join the military or the peace corp. Your B2B app isn’t a “mission”.
I thought the point of the arxiv paper was that a non privileged app could effectively "sniff" by pretending to be the other app.

If I'm understanding correctly, that means that encrypting with a shared key helps. Am I missing something?
I'm curious if any evidence has ever been offered that the "Acceptable Ads" program is corrupt. It seems to me that literally the moment it was announced people characterized it as an offer to be bribed, but _as described_ I don't see anything wrong with the program.
Exotic quote types and being paid for making the cross is where this explanation seems to hit market realities. HFTs are able to make money on fees by having special access not only in terms of latency but in terms of ordering.
If I'm understanding this correctly, then Java has had it for ages now via the "Chronon" debugger. It's the only reason why I pay for an IntelliJ Ultimate Edition license, since it comes bundled.
It's probably the container. Nuke up some water and before using it, pour it into the same kettle where it would be heated by other means; see if it still tastes different.
It's not just civil servants who can't understand agile. Most non-software people can't. Which is totally normal and expected if you think about it: the agile movement started in software. You can't build a house or a plane using agile. It has to be waterfall.
How is this different than flippa et al?
1177 B.C. actually mentions droughts as one reason for the Sea peoples to attack the Empires.

It is however not the only reason.
27 Ways to Find Steady Freelance Work
The whole "drug users are victims" makes absolutely no more sense that "any criminal is a victim". You can't find a single person in the world who doesn't have bad circumstances. Even the people at Goldman-Sachs may have had a bad history of bullying, a difficult childhood because of divorce, a family that induced an unhealthy relation to competition or money, whatever. This example is not even a joke. Many "privileged" people had really bad psychological circumstances. But you won't say that any of the wall street crooks are victims.

I know a guy who spent 8 years of his life in prison, in many visits, mostly for petty theft and drug use/traffic (mostly cannabis). He had a really horrible life, and is a pretty cool guy, although he's obviously still struggling with addiction. He often says "there are only innocent people in prison, at least they all say that".
Saving the endangered dinner party (2012)