skysight-inc/HackerNews huggingface dataset:
"Yes, it will be "one master process is a choke point" but it's only a problem when your tasks are so short that sending messages is slower than doing the work."

You're simply reiterating my point now, while still sounding like you think you're disagreeing. Yes, if you drop some of the requirements, the problem gets a lot easier. Unfortunately these are not such bizarre requirements, and Erlang tends to be positioned in exactly the spaces where they are most likely to come up.

"But then probably sending messages is the wrong way to do those tasks."

That translates to "Erlang is the wrong solution if that's your problem". Since my entire point all along here has been that Erlang is not the magic silver bullet, that's not a big problem for me.
At least on OSX 10.11 (not sure about others), you can't sniff loopback as a normal user.

So, if you could sniff this, you'd have elevated privs anyway, which means you could read the keyboard device, memory, etc.

Not ideal, but not sure it's a glaring hole. IMHO. I'd love to hear other thoughts on how to exploit this / how I'm underestimating this hole.
Like a lot of security researching blogs, this post doesn't have a good conclusion. This seems bad, and probably is bad, but there has to be details as to why it's bad, what is the danger, what is the threat model, etc.
no, it's a way to share the same templating syntax on the client and server but isn't a full server side rendering solution. It's pretty fast though, just about the fastest templating engine out there last time I checked.
http://ir.virtu.com/results.cfm

Actual results for 2015. Your numbers are a fair bit off of those. What you can see from the results is that their revenue/profit numbers are small in real terms, but their margins are big compared to other businesses, even technology ones.

Personally, I'm not offended by that and think that the entire conversation about HFT is funny given how little money is actually involved, but if you view profitability in any context as evil or rent seeking, then you have ammunition for that argument with Virtu.

[edit]

Another good one to look at is Knight (Getco) http://investors.kcg.com/phoenix.zhtml?c=105070&p=irol-SECTe....

Had a much better year last year vs the previous 2 and it still was a fundamentally little amount of money.

[edit again]

That Knight statement is very interesting because it shows that the vast amount of their profit came from execution services and that their market making business was very low margin. Now that could be because their market making business is taking the full shot of the infrastructure accounting that enables the execution services business, but its interesting none the less.
Looking back into when Slack really took off, it took off primarily because development teams were adopting it internally, and then in many cases evangelizing it enough to get organization wide adoption. To emphasize the point, developers were the primary ones driving Slack adoption at that time.

In order for Slack to move beyond the smaller companies and larger startups where developers have the power to do the above, Slack has to start targeting the people who have the power to change how a 10k person corporation communicates. To those people, usability and integrations are nice-to-haves, but more important are metrics and "process". The issues you have with this commercial are the exact kinds of things that high-level executives will think about when they want to get a new communications tool. "This will let me keep track of who's doing what", "this will let me reach whoever I want, whenever I want", "this will let me centralize ALL company communication".

For better or for worse, Slack is growing up and trying to target the biggest, and most traditional corporations, and some of that will look a bit ugly to its comparatively granola hippy early adopters.
AI and the Future of Civilization: A Conversation With Stephen Wolfram
So the argument is that people with technical jobs are likely to do technical stuff outside of work? Or at minimum, have the capacity to do so?

I'm skeptical that many recruiters and interviewers will buy into this. Even if you can show that you were contributing to open source projects or tinkering in your garage, there are still a lot of work skills that may have atrophied, like teamwork, writing & documentation, leadership, etc.
Your firewall vendor knowing all your passwords? Nothing. And that is the most benign entity that could listen on the interface.
He'll probably take credit for making Serum famous.
We've starting talking to content producers, and its an avenue we want to pursue further, but as you pointed out the hard data we're gathering here is going to be key to our negotiations.

As to your idea of bundling an Ad Blocker, while we support ad block as a product, we don't want to be building two products, and there are plenty of great ad blockers out there already. We also think that there might be some people who, for whatever reason, don't want an ad blocker but do want to support creators, and we didn't want to limit Atri to only adblock users.
Encrypted or not, if 1Password is sending passwords to the browser extension, that means its keychain is unlocked and malware, should it really want to grab data out of the keychain, could just request it from the 1Password helper itself. No need to passively sniff for passwords.

I don't really see what the vulnerability is here.
You've misunderstood what I'm saying. I agree with you: timescales far below anything that provide any meaningful social value are an intrinsic figure of merit (usual definition: "often arbitrary-seeming number people compete over") of the market microstructure we have now.

I'm not saying the markets must function this way, only that they do, and it's not evidence of a giant conspiracy or grift that they do.

The rest of my comment suggests that while we could potentially quantize the markets, it doesn't seem like we have much to win from doing that, and, further, that it's likely that the problems we're trying to solve by doing that would persist.
Maybe the problem is that development is decentralized and done off-site? For each each website, or component is built by separate, often lucrative contract. On one hand developers re-invent the wheel knowing that they financially benifit from the bloat, on the other hand they feel little responsibility for their often weighty work.

Can we do something crazy like centralize our software development or have these administrative positions electable? If you can run for town dog catcher, maybe that asshole who made the WordPress site should also stand for office!
Interestingly, the separation was the main problem I encountered deploying a Rails application for the first time. I still prefer the PIP's approach, as it promotes always using latest versions.
Serious question: Why is this a bad thing, and how would you do it differently?

You need the password to be "plaintext" in the input field in the browser, so how do you get it there?

Give the extension access to your private keys and master password to do decryption there? Is the browser a safer environment than an app on your machine?
Flex is our product for contractors - where workers claim shifts.

Boss is our product for employees -where workers are assigned shifts.

They're very similar products, but we can't tell contractors when to work - they pick - and we don't have compliance built in for contractors (mainly because they pick when they work).

For the events company - we have timezone support for each location. As you start to add locations with different timezones, Staffjoy begins to show more localization information to aid in scheduling.
Soon nearly every pentagon employee will be social-engineered and compromised. People will begin to believe that every single system they access is a MITM or phishing attempt.
The Moral Threat of Bicycles in the 1890s
EUV Lithography's Prospects Are Brightening
I recently attended a workshop with Karsten (in fact, the last commit to geom was a small bugfix I authored there). He's a really smart guy and the amount of ground covered by the libraries is bewildering.

Probably worth checking out the main site for an overview if you haven't seen it before:

http://thi.ng/
Do you watch the new Silicon Valley TV show by Mike Judge? If not, do it now. In short, STEER CLEAR!! Or otherwise you will get your butt sued bigtime!
Distance learning, self-funded, non-selective MBA dropout is basically the worst possible case.

Pretty much the same as for-profit schools getting non-useful degrees (I might be ok with someone getting a medical tech degree or something like that, even at the cost of loans, from a non-selective for-profit school). Same as bottom-tier law schools for employability.
Saying No to Selling My Business
Well I did get a job feeler yesterday but from some of my HN comments, not this post.

This post was largely me entertaining myself on super Tuesday.
Or, there might end up being fewer cars on the road because it's so easy to jump on a self-driving bus, then transfer at the station (with no waiting time) to a small pooled ride...
Besides the obvious batshit craziness of those involved, that's not unique to unicode.

After all, the turkish encoding wasn't ASCII in the DOS/Unix years but ISO 8859-9 (and various other, e.g. an IBM one etc).
Short answer: Yes. It is exceedingly unlikely, however.

The Federal government can seize control of private companies through one of two mechanisms:

1. Seize ownership of Google and pay market value (the Takings Clause allows the government to seize private property so long as there is "just compensation.")

2. Declare war, and essentially draft Google's workers into wartime production. This was done extensively during WWII.

For example, Ford motor company only built about 200 automobiles for private use during the entire course of the war because their assembly lines were devoted nearly entirely to wartime production.
____ __ ____ __
/\ _`\ /\ \/\ _`\ __ /\ \
\ \,\ \_\ __ ___ \_\ \ \ \ \_\ _ __ /\_\ \_\ \
\/_\__ \ /'__`\/' _ `\ /'_` \ \ \ _ /\`'__\/\ \ /'_` \
/\ \ \ \/\ __//\ \/\ \/\ \ \ \ \ \/, \ \ \/ \ \ \/\ \ \ \
\ `\____\ \____\ \_\ \_\ \___,_\ \____/\ \_\ \ \_\ \___,_\
\/_____/\/____/\/_/\/_/\/__,_ /\/___/ \/_/ \/_/\/__,_ /

SendGrid | Sr. Software Engineers (Security, Platform, Test, and DevOps) and more! | Denver, Boulder, Anaheim, Redwood City | Full Time, Remote Negotiable, Interns

At SendGrid, you'll help deliver a huge portion of the world's legitimate email. Our platform team works every day on tough scaling challenges, while our quality and security teams make sure we're delivering the most robust service possible. That receipt you instantly get after an Uber ride? Your Airbnb booking confirmation? That's us.

The team is absolutely fantastic - we hire great people and trust them to get the job done. We're a pre-IPO company of about 300 people, and we've been growing fast ever since we got started in 2009.

More info and a place to apply: http://grnh.se/xes14l. If you have questions, my email's in my profile!
No...? AFAIK (and based on my daily experience), pip processes setup.py, so it definitely installs the dependencies listed there.
In february 2015 I had contact with agilebits at support@agilebits.com and they answered me within a day. Seriously, you claim you tried to reach them, but I have a hard time believing that. What is 'not too long ago'?
CloudBoost: Open Source Parse and Firebase and Algolia Alternative
Strangely enough, I do too [interact in circles.. ]. I've started making more of an effort, because I've been called out on borderline jokes by people I respect.

Anyway, thanks for observing the feedback in the spirit it was given. Cheers.
I'm not one of the down votes, but I read their comment as missing the point of the question. These types of questions rarely are asking "should I use C or Javascript for a web front-end?" so saying "different languages are for different purposes" means nothing. The question, while admittedly unclear, is most likely asking "does it matter if I use Python or Ruby" or "Perl vs PHP" or "C++ or Swift" or "Clojure or Haskell".

There are a lot of languages that, for the most part, are completely interchangeable. That makes it nice for choice, but also makes it hard to decide which language to focus on.
Didn't the first version of Google emerge from a DARPA grant?
Every app that runs on your systems with enough privilege could sniff your username and password and send it out.

That means also apps installed by a person who has access to your systems or malicious code that you, or someone who as access to your system, launched on your system. I'm not sure where it put 1Password in terms of safely storing password, but it is probably in the area of a post-it on your monitor.

I don't know what's your opinion, but if I use a password manager, I'm expecting something more
Anyone with administrative access to the machine could run a capture on the loopback interface and gain access to the plain-text passwords. It's certainly an issue, albeit a limited one (the same user could sniff your keystrokes, etc.).

The author gives his justification for full disclosure in the last paragraph. As I wrote yesterday [0], opinions vary regarding "responsible" disclosure -- and the "discoverer" gets to decide how he wants to handle things.

[0]: https://news.ycombinator.com/item?id=11206955
Back in the early 2000's, I bought an off brand broadband router on sale that turned out to be sending my DNS requests to a server in China.
Google CSO Eschelbeck has a team of 600 people, half developers and product managers, project managers, administrators and operations. It runs 24X7 and around the world under the assumption that Google’s users and infrastructure are always under attack.
Either your event handlers are going to be called in a nondeterministic order, or they won't.

If they are going to be called in a nondeterministic order, you still have access control issues and can get yourself into all sorts of concurrency-style problems.

If they aren't going to be called in a nondeterministic order, perhaps because you just have a single cascade of events (open socket, write this, get that, close socket), then in a language like Go you just write the "synchronous"-looking code, and you don't have to write the code as if it's evented. You have only marginally more sharing problems than the event loop.

Raw usage of event loops are a false path. They solve very few problems and introduce far more.
> sign this or look like you got fired at 3 months

This seems like something that would be easy to explain during an interview with a different company.
It's the worst of both worlds.

If you don't do well and generate revenue/attention, nothing will happen.

If you do do well, then they might come after you with some lawyers, and at that point you have stuff to lose and are wondering why you spent all this time and effort and didn't spend 2k on a laptop of your own.
That is obviously sloppy work on the part of the developers. And bad. But anyone that can snoop on loopback already owns the machine and he could just cheat engine the passwords from the browser ram.

So it is not making safe situation bad, but bad situation worse. Of course with Blizzard Warden, Steam anti cheat, driver level firewalls and all the other little helpers that collect information about your system - this could lead to a leak to some entity's logs in the cloud.
They could at least encrypt it across the socket.
I believe this is the same issue that AgileBits has been aware of for some time.
https://blog.agilebits.com/2015/06/17/1password-inter-proces...
Practically, it is used to prevent newer versions of pip from complaining about "insecure platform" and have cleaner CI build logs.
While we're talking about 1Password: Why do they obscure the text editing area while I'm typing, but then de-obscure it when I'm done typing? The text I typed is visible when I'm done typing.
By no means an expert but is this even exploitable if the machine is not already otherwise compromised? Loopback is used for communication between two network applications on the same machine but it doesn't actually use the network device. Of course you'll be able to see it listening on your own computer but an outside computer can't sniff something that doesn't actually get transmitted over the network.

Also in order to populate the password/credit card fields at some point doesn't the information need to be decrypted? I'd be more concerned if 1Password was storing the keys to decrypt passwords in a browser plugin as that is a way easier attack vector
Thanks, that's what I've suspected.
In a way, yes. But what we found when building adieu.io was that people who were willing to support content creators want to have it done automatically, and Flattr required a considerable amount of work on the part of the donor. Atri does all the work for you, figuring out what content earned your attention, and then assigning funds appropriately.
Also, if you're working on open source, an outside probability is they might assert some sort of ownership on the open source project that you contributed to, and either force you to rip your pull requests out or sue the project for damages.
In a corporate environment, a system administrator with administrative access to employee/user machines could gain access to their credentials.

That's the big issue, I think, unless I'm missing something.
message sending has backpressure built in. as a mailbox's size increases it gets more and more expensive (in reductions, the currency erlang uses for scheduling processes) for a process to send a message to it
This seems to make urls themselves passwords, and your email a password safe.
>I'm not a counselor myself, but I have several in my family. It has been my impression that therapists would not be interested in committing you unless there was an immediate threat to you or someone else.

The threat of me using a gun, no matter how unlikely it actually is, leads to me being banned from having a gun in quite a lot of places. Also, people will often not accurate take into account the chance of something happening when deciding how they should act.
Messaging Startup Slack Seeks Up to $4B Valuation in Funding Round
How is the encryption key supposed to get into the Browser plugin?
The gallery ("See Inside Google's New York City Office") in that article is hilarious.

Conference rooms with themes such as "Subway" (featuring subway map wallpaper and a decorative pipe), "Apartment" (wacky furniture and wallstickers with household appliances, 'for those looking to “work from home” at work') and "Broadway" (red carpet, red curtains, lots of velvet).

Build-your-own desks, with as much customisation as you can do in your 2 m2 cubicle. A steel slide connecting the two lounge levels!

And, my favorite: 'A green themed micro kitchen emphasizes Google's commitment to sustainability.'
There is no modern OS on which you can sniff loopback without privileges.
It may be worth noting that some government-sponsored software is intended to get dropped as soon as version 1 gets released. Of course, this is a small fraction of government-produced software.

This happens for a variety of reasons. Often funds are allocated specifically to develop what industry calls a minimum viable product-- with the understanding that if the project is deemed successful, the research group can seek further funding to improve the tool.

There is also a model, in government research funding, that says the government's role is mainly to point the way, or to open up markets. In this model, if version 1 of the software proves itself useful, then an industry partner can step in and it take over. However, if nobody shows interest, then the government should _not_ sustain the effort, because the lack of interest implies a lack of utility to the public.

For example, the OpenEIS project [0] was funded specifically to produce "reference code" that a company can use to check the output of a professional implementation. The reference code is not at all intended to be fast or robust. It's intended to demonstrate the algorithms, and to document the expected output for a variety of reasonable inputs. As a programmer on the project, I knew from the start that my work would end with the first deliverable.

[0] http://eis.lbl.gov/openeis.html
Show HN: Customized Product Roadmaps
Ah, you spotted my deliberate mistake!

Er, yes. It's a stack. Oops. Ta.
Host a really nice dinner party every week. Start with a group of legit people you know. Do it at your home if it is big enough, or at a nice restaurant. Pay for the whole thing. Ask each guest that the only thing they need to do to pay you back is to introduce one new person to a future dinner party. If you've done your job right, they'd be overjoyed to refer someone (free dinner + awesome people = huge win)

Let's say you have 6 people at the dinner party. $60 per head = $360 per night, which is $37,440 over the course of two years, at which point you've made 520 really great connections.
I explained in a previous comment the problem.

As for the solution, without thinking too much, using TLS to encrypt the channel would do it. If we think the browser is not safe, well, all your stack is basically compromised. But if it could handle TLS correctly (and I guess it does it pretty well since it use it to send the info to your bank) it could get the password in a sfae way...
do no evil. muah ha ha ha ha ha!
The Lives Untold: Monica Pearson, Journalism Legend – She's Why Oprah IS Oprah
Didn't downvote but I can see why they got downvoted: they make a claim, but when asked for a specific argument, they go roundabout.

In what SPECIFIC way is an only-ascii string not a UTF-8 string for ALL intends and purposes?

You throw some words like "semantics" but no actual arguments.
Anyone else experience a psychosomatic reaction from this story? My eyes started to ache just reading it. What a terrifying prospect.
Don't forget that the Chinese (or any other country) are terrorists.
> Nobody becomes a drug addict by accident.

Not true. Many people reasonably take the pills their doctor gives them and end up with an addiction.

> That poses another moral question: if drugs are harmful and addictive, why can't society ban people from selling them

Because you can't. It failed. It's not a moral question. In fact, that's specifically the problem.

> but voters aren't driven by cost-benefit analysis.

So, what of it? We should keep doing things we know don't work because the uninformed don't understand?
Maybe I'm not understanding fully how this works, but couldn't any user with administrative access already gain access to this information anyway? It's obviously got to be stored unencrypted in the browser's memory, regardless of how it gets there; I'm not sure what the difference is here.
I got several paragraphs in before the discussion of the 1999 Christmas season made me realize that it wasn't from today.
> [...]I'm not the biggest fan of CoAP (because I think it's hardly possible to implement it correctly)[...]

Out of curiosity, do you have any more details on what you think is impossible to implement correctly?

I've been doing a lot with CoAP and I'd agree that the RFC isn't as clear as it could be about some behavior, but I haven't come across anything that I'd say is impossible to implement or implement correctly.
Though that may be true of that unit, my point is that you don't need broadband to be up to have Wi-Fi. The whole Wi-Fi based control should be contained within your LAN, which has no reason to be down, other than a power outage or equipment failure.

If someone's local Wi-Fi LAN dies when the broadband connection isn't up, they should buy their own Wi-Fi router and then get some fifth grader to set it up for them.
Log Compaction: Apache Kafka and Stream Processing Community Highlights March 2016
There's paying to lessen the challenge, but you can also pay for more gameplay options. I'm amazed at the amounts people have spent on "spaceships" in Star Citizen, for example.
They can do that anyways by sniffing the keyboard directly.