skysight-inc/HackerNews huggingface dataset:
Except the NBBO was often stale (on purpose), so you were getting what was wrongly quoted as the NBBO by selling to an HFT who knew that the actual BBO was better, allowing them to arb on that knowledge.

That said, a substantial portion of your posting history consists of you being dishonest about the value extracted by HFT (value that is actually created by others), so I'm not surprised that you are lying about the results.
EA (and its peer competitors, e.g. Activision & Ubisoft) is also very diversified in terms of its product portfolio, which reduces risk. They publish games for PCs, all the different consoles, and all the different mobile platforms. They publish casual games and also hardcore games. They publish games based on licensed IP and games based on original IP. Etc.

This makes them a safer bet than companies like King or Zynga, which bet the farm on one particular quadrant of the overall gaming universe (casual games on mobile devices). If the world stopped playing games on their phone tomorrow, EA could survive that.
I have this library:

https://github.com/Chattered/ocaml-monad

and use it regularly when writing Ocaml. I'd like to get back to it and try to implement some MTL style interfaces (MonadState etc...). Edward Kmett says this is not likely to work, but that sounded like a wager to me.
Right, but it looks like the process listening on the port is running as the user.... what is to stop another process running as the same user from killing that process and then binding to the same port?
Would be curious to hear how app developers here are dealing with the saturation in the US market. How do you cut through the noise?
Surely encryption with a shared key is strictly better than sending in plaintext?

>In the extreme case, we could have some explicit pairing (sort of like Bluetooth) between 1Password mini and the extension. That is, the browser extension may display some number that you have to type into 1Password mini (or the other way around). With this user intervention we can provide solid mutual authentication, but that user action would need to be done every time either the browser or 1Password mini is launched.

Why every time? The first time, yes, and then each side stores its key. Future connections must handshake on that shared key, so you aren't talking to an imposter.

You still lose against root malware, but threat still seems to strictly decrease.
$ tcpdump -i lo0 -s 65535 -w info.pcap
tcpdump: lo0: You don't have permission to capture on that device
((cannot open BPF device) /dev/bpf0: Permission denied)

Looks like you're logged in on a superuser account or have otherwise somehow disable some security settings.
I don't know what to tell you. Normal users can't tcpdump loopback on OSX, or anywhere else.

> $ ls -l /dev/bpf*
crw------- 1 root wheel 23, 0 Feb 29 07:59 /dev/bpf0
crw------- 1 root wheel 23, 1 Feb 29 07:59 /dev/bpf1
crw------- 1 root wheel 23, 2 Mar 2 11:11 /dev/bpf2
crw------- 1 root wheel 23, 3 Mar 2 10:07 /dev/bpf3
crw------- 1 root wheel 23, 4 Feb 29 08:11 /dev/bpf4
They have replaced that motto. Which, I suppose, means that they can feel better about themselves now. (https://en.wikipedia.org/wiki/Don't_be_evil)
One of the reasons that I don't trust anything I can't put my own firmware on. Security problems, redirecting traffic (I think there was one that would filter NXDOMAINs to their own search page), playing with DNS, and god knows what else just make me way too paranoid about it if I can't either examine the firmware myself or replace it with something I can (openwrt, tomato, ddwrt, etc.)
Personally I found the EHK (ES, Heka, Kibana) stack much nicer than ELK. I especially like that each node can run Heka locally and ship directly to ES without having some intermediary server we have to maintain. On top of that, Heka is great for general event streams and can grow quite a bit more into your infrastructure as a general tool than logstash (at least last time I used logstash, which was a few years ago). Heka can also monitor and send you alerts via email ("Hey this server got 3 exceptions in the past 5 minutes!") on certain conditions.

We do use ES as a core part of our infrastructure, so our only real barrier was setting up Heka.
I mucked with this a while back. You can dump all your passwords over the websocket pretty easily (provided your 1password is unlocked):

https://gist.github.com/joevennix/438782cbe447e86f2506

It would be more interesting if an arbitrary website could do this, but they prevent that attack by checking the Origin header on the initial websocket request.
> So how can you say that moral opposition to drug use exists because of propaganda,

Because most of the opponents of legalization use the same talking points that the DARE and other school drug-abstinence programs use. Gateway drugs, etc. All the things we now know are nonsense. That's what makes it propaganda instead of information.

If these people didn't come to these opinions because of propaganda they'd use different terminology and different arguments.

> Moral opposition to drug usage is based on the need to establish social norms that discourage escapism and dependency.

No, because TV(, etc) is acceptable. Drugs are a problem because of our puritanical background. The issue isn't that you aren't being productive, it's that you're enjoying it.
>Two years passed before I finally decided to take legal action, in late 2014. Maybe it seems weird that I waited so long

What seems weird is it does not sound like she ever tried to actually confront him. Block after block, but not really confronting him. It seems she didn't want to hurt his feelings. But waited until police action? That seems like a terrible approach.

The most confrontational she got was "I caved and sent him a message asking him to please stop messaging me so much or I’d block him." How surprising that didn't work.

You need to be more confrontational in a situation like this - either a heart to heart approach where you lay it on them, or something more aggressive. Blocking for the umpteenth time is not going to work.

You could call this critique victim blaming, but the my intent to encourage people to handle the situation better, without someone repeating her mistakes.
The price of a US stamp is set to fall in April for the first time in 97 years
Nothing, but if you own the user's account, you also have their /Library directory to play with.
Please Scan My Towel: How I turned my hotel towel into my RSA conference badge
Assuming you need a MBA to be on that higher career track, assuming you wouldn't make an order of magnitude more money anyway, assuming you wouldn't cap out at $200k or something, etc. etc.

You're not wrong, but if you're the kind of person who's going to be a CEO, a MBA credential might not move the needle that much. (I know lots of CEOs without advanced degrees.)
He's also very supportive of government surveillance and has spent a substantial amount of his career cultivating relationships with officials.

All this is thanks to the Microsoft anti-trust lawsuit which led Google to choose someone like Schmidt to ingratiate the company with lawmakers to prevent a similar lawsuit.
> Any kind of repeating lists (enum + a switch over all the values, for example) are best handled by define-include-undefine sequences.

> See how it is done in LLVM, see all the .def files there. I cannot think of a single viable alternative to this method.

I've seen x-macros. I'm not sure I've seen them used to good effect, but I'd definitely be curious how the llvm code uses them.

> If you want a dense, readable, maintainable code - you're out of options, you have to resort to the preprocessor.

I guess it wasn't entirely obvious from my comment, but I wasn't arguing against using the preprocessor. It's self-contained, mostly usable with common tools, etc.. Anything that's supported on more than one platform or has compile time options generally depends on it. Dense, readable, maintainable code is definitely a good thing, which is one of the reasons I'd personally like to see a usable reflection land in C++.
quote: "What makes us different from all these things? What makes us different is the particulars of our history, which gives us our notions of purpose and goals. That's a long way of saying when we have the box on the desk that thinks as well as any brain does, the thing it doesn't have, intrinsically, is the goals and purposes that we have. Those are defined by our particulars—our particular biology, our particular psychology, our particular cultural history."
How to Use LinkedIN PPC to Power a Whole Sales Staff
The probably of hitting someone while drunk driving on a given day are actually fairly low, as in under 1%. The real issue is people get into the habit of driving drunk and some people will drive drunk 3-4 days a week for a decade. It's the aggregate numbers that are a problem, when 10+ million people drive drunk at least once a month it was a huge issue even if most of them never get into an accident.

People like to pretend driving drunk is somehow different from driving tired, but the risks are actually similar. In fact a large chunk of 'drunk driving' accidents have more to do with people driving home late than intoxicated. Speeding, talking even just to passengers, and just flat out not paying attention also present major risks.

PS: 13x low odds are still generally low odds. http://pricetheory.uchicago.edu/levitt/Papers/LevittPorterHo...
> Every app that runs on your systems with enough privilege could sniff your username and password and send it out.

Every app that runs on your systems with enough privileges can dump the memory and extract information via that.
They are not related in any way. Responsible disclosure does not mean that what is being disclosed is a real threat or not.
Using the CLI, can templates import other html bits (classic header/content/footer for example) ?
Yeah, at worst a misconfigured system where non-root users have access to sniff it could be attacked.

Short of that level of extreme misconfiguration, you need admin, which means all bets are already off as you can keylog, inject libs, patch the executable, whatever you please really.

They could do more to protect this, but anything more would be a half-measure of no real use against a targetted attack at least.
I would gravitate toward using a Unix domain socket, like what saslauthd uses.

I use saslauthd in a web server I wrote. I have the user ID and password from the browser over HTTPS, open a socket to /var/run/saslauthd/mux, and send them as plain strings, then check the reply.

The problem with loopback is that the only thing which prevents the program from sending the data to a rogue socket is the IP address and port number.

If I have some program binary which authenticates plain text passwords over an IP socket, I can probably find the "struct sockaddr_in" image of that address and change it to something else with a hex editor, to have that communication go to another machine. I'm not saying that this is the exact exploit; that would be a strawman: rather that there is potentially a very small code or configuration difference between a secure program that sends plain text over an IP socket, and a misbehaving one.) Of course, the path in a unix socket could also be tampered with; at least it won't go off box, though. The rogue piece listening to for the connection has to be planted on the same machine.
That's a big assumption. LTV modeling and controlling Cost of Acquisition (which includes both salary/commission and sale rate) is hard.
If you get admitted to HBS & Stanford GSB, go there. Wharton: 50/50, many Wharton MBA grads call it a MBAFactory these days.

Other schools: they have morning MBA, evening MBA, weekend MBA, Dubai MBA, San Francisco MBA, International MBA, Exec MBA, etc. These schools are just minting like thousands of MBAs every year. Next time, expect your scrum master to be an MBA.
What new information?

I think the above poster meant to imply that the 10ms delay would cover all market transactions, so if you put in an order now, then no one knows it till the next 10ms stop post.

Essentially its buffering all the data then releasing it at once, so it's not a truly continuous system anymore.
We invite candidates from Massachusetts, Minnesota, Montana, North Carolina, Oregon, and Canada only.
Is this really the reason? One keystroke? That just borders on bloat...

Just put "set -o vi" if you want to remove keystrokes, which this doesn't include.
https://news.ycombinator.com/item?id=11210212
Given that the potential is infinite, no. But it is certainly a useful point at which to have a scaling factor in place.

My main thought: This thing needs support for privacy-enabled cryptocurrencies.
Portugal did it and usage went down...
Like the punch line at the end. :)
Let's boil opportunity cost down to two things: 2 years of your time and ~$100k of out-of-pocket costs you wouldn't pay otherwise (e.g., tuition).

While a Stanford MBA might help you get funding, investing $100k + 2 years in your business and networking might get you just as far.

Just a thought...
"Let's throw encryption at the problem" isn't always wise.

For example: https://paragonie.com/blog/2015/09/comprehensive-guide-url-p...

What do you need to do before you can sniff a loopback interface?
"The "learning" is nonzero but seems underwhelming and not anywhere near worth the funds you need to put up. Frankly if you know what you want to be doing in the future, imo you'll learn more by actually spending those 2 years actually working and doing those things (which was my main reason for dropping out)."

I agree with most of your points, but in this case I think you should consider how your personal circumstances influence your opinion. You spent one quarter in an MBA program. That's neither enough time, nor enough depth, from which to draw categorical conclusions about the quality of all MBA classes. More likely than not, you encountered some intro/core classes. Maybe an elective or two? But really, you were just scratching the surface.

I'm not going to sit here with a straight face and claim that the MBA core curriculum offers the average intellectual depth and rigor of a graduate program in any of the hard sciences. Clearly it doesn't. But I do think there's depth to be found in an MBA program, provided you seek it out.

That's kind of the issue with MBA programs, too: they are catch-all programs designed to service any number of diverse career outcomes. You can enter an MBA program seeking to become an investment banker, load up on the necessary courses called for by the field, and graduate having received a wildly different education than a classmate who went in to become a CPG brand marketer. Or a classmate who went in to run a web publishing business. Or a classmate who went in to take the reins of a Coca Cola bottling plant. Or a classmate who went in to learn the business side of industrial design. Or a classmate who went in as part of a JD/MBA program and wanted depth in IP case law. Etc.

It's sort of like college that way. You get out of it what you put into it. MBA programs are notorious for graduating a number of people who took the path of least resistance: a bare-bones survey of a variety of topics, just enough to check the boxes for graduation. Nevertheless, you can wring plenty of depth and intellectual interest from the various subjects an MBA program has to offer. You just have to have the will to challenge yourself -- and for various reasons (many of them economically rational!), a lot of students choose not to.
already a running discussion here: https://news.ycombinator.com/item?id=11210212
Not if the shared key is present in the host computer already, which it'd have to be if the host process is to decrypt anything.
If NYSE wants to lobby for laws to be changed, then they're welcome to do that. Just like Uber or Airbnb when they get hit with fines.

But the law's the law. "It doesn't make sense" isn't a valid defense.
An Introduction to Parallel Acceleration in Julia
> which likely affected 15,000 software developers at most

Where does this number come from? When the wage fixing agreement was canceled, Google immediately issued an across the board raise, and compensation has increase very quickly since then. That's 15k software devs right there, not even considering the second-order effects, which are surely non-zero.
There are two main benefits to server-side rendering:

- time to first paint is faster on CPU-constrained devices (e.g. low-end phones), and

- interoperability with non-JS-powered UAs (like robots)

I believe a big part of the desire for server-side rendering is a fear that search performance may be penalized if a crawler doesn't speak JavaScript, or tries to crawl the page when it's not in a state a human user would consider stable. I know there's been work done on Googlebot to make it correctly interpret client-rendered pages. If you could confidently say "Using Web Components will not have a negative affect on your search ranking; Googlebot can crawl and understand Web Components at least as well as traditional HTML elements," it would allay many of the concerns about WC, especially with regard to server-side rendering.
On a side note I find 1Password Mini makes the browser extensions irrelevant. I think the extra steps that Mini requires are not a big deal, and you get a smaller surface area.
You can't just use some kind of Diffie–Hellman key exchange to agree on a key, instead of the user copying the key?
Works for me too on OS X. sudo is not needed to run tcpdump for any interfaces.

$ ls -l /dev/bpf*

crw-rw---- 1 root access_bpf 23, 0 Mar 1 09:18 /dev/bpf0

Edit: Wireshark is installed
Did you install Wireshark? Did you let it reconfigure your system? Is your current user in the "access_bpf" group?

Later

Yes. Your system is misconfigured. Don't let Wireshark do that.
Vaultier – Encrypted Team Password Manager
I am using zsh + prezto.
https://github.com/sorin-ionescu/prezto

Tab completion is extremely powerful.
Even serious spelling mistakes are forgiven.

The prompt is Git-aware and this provides a lot of helpful information which saves me from having to query the git cli.

There are also plugins available for completion of other programs such as rake
I don't understand your reply. I'm familiar with private industry projects producing high-risk projects requiring lots of long term up front investment in capital and time and private industry projects working low-risk efforts where using the customers as testers is perfectly fine. Likewise there are small units of government entities that can iterate on low-risk projects in addition to the big infrastructure projects that larger government organizations work on.

I think the OP is painting with too broad a brush when talking about "private industry".
That's a good point that I was assuming it would be difficult. I've since done a little bit of reading up on what we know about how difficult it would be.

This is the best writeup I found: http://blog.trailofbits.com/2016/02/17/apple-can-comply-with...

So, you'd need an update to iOS/the phone firmware, and for newer devices you'd also need an update to the secure enclave firmware. You can't do anything about the 80ms delay, because that's baked into the hashing function (and changing the hashing function would generate invalid results). The FBI is also asking for the ability to enter passcodes electronically rather than via the touchscreen, which would be new code.

If iOS and the SE firmware are really nicely factored to disable security, and it's not hard to add the new functionality, then this might not be too much work. However I doubt that that is going to be the case. The whole point of the security system is to make it difficult to crack, so there might be other countermeasures involved, tricky dependencies, and low-level hardware hackery. If it were simple to do, why wouldn't it have already been done by others reverse-engineering the compiled code? There is certainly financial motivation to do so.
It's not a standalone program. It requires host software (e.g. Logic Pro) to work. See the third system requirement at [0].

[0] https://www.xferrecords.com/products/serum
It's not the quantity of money extracted by HFT that's offensive; it's that the value is created by others, and they pick the pockets of actual value-generating market participants (some of whom are also algorithmic).
I guess you can hold out for contacts or an eyeglasses form-factor, but I can't really wrap my head around a technology enthusiast thinking "I'd love for my sensory perception of reality to transcend the physical world, but I don't want to look like a dang nerd."

And even if that's the case, it looks pretty sleek & sci-fi IMO
Wonder if that's the end of Mozilla's only southern hemisphere office in Auckland.
I would love to have a modernised Ada. With case sensitivity. And garbage collection (a lot of the language semantics are obviously intended to be based around having a garbage collector. I'm very surprised that it never seemed to get one). And a less wacky OO system (invisible syntax, ugh).

But those are quibbles, and at it's heart it's still an excellent, excellent language. And there are Ada compilers in Debian, it's still being maintained, it compiles really quickly into excellent code, it interoperates beautifully with C...
In this case, client = server. If your computer is compromised then they can get access to both private and public keys of 1Password and 1Password Mini.

It also doesn't prevent MITM unless both the client & server. Nothing stops you from presenting a fake public key pair between the communication

How doe TLS work then? Because public keys are signed by central authorities. Who do we know what to trust? Browsers and OSes have default list of certificate authorities to trust. How do we know that we can trust them? Technically they should be communicated outside the internet. If the version of Chrome you download is compromised with a rogue certificate authority (ex: SuperFish) then you're hosed.

It's turtles all the way. Unless keys are communicated securely somehow you cannot guarantee secure communication.
The spirit of this is great, since tech companies have been welcoming hackers for years via bounty programs. However, from the article -- The contest is only for "vetted hackers" -- that is a little sketchy. Just doesn't seem like the same folks who hack systems for a living would be open to months-long scrutiny of DoD. Also, I wonder how many of those willing would actually "pass"?

Furthermore, "hackers will target a predetermined system that's not part of its critical operations" -- that's great, but what's the point? Why would somebody smart, ambitious, clever, and extremely good at what they do, would work on hacking a system that isn't even critical to the nation's operations?

"Last summer, the Office of Personnel Management revealed that the private information of more than 20 million U.S. government workers and others had been stolen in a massive security breach." -- Personally, if you recruit top of the line security experts to help you with problems like these, I would hope the first thing they work on would be problems like this.

Good intentions, definitely, but curious to see what the community here has to say.