skysight-inc/HackerNews huggingface dataset:
“More eyeballs == Secure code”: But is it just a theory or happens in practice?
Its one thing to say that "open source is secure because anyone can have a look in the source-code", and its totally different to expect lay users of Linux desktops to head over to the source repos of gnome, xfce, unity, etc. and scavenge the code like professional auditors.

Its the job of security auditors to ensure that this code is safe and doesn't contain any malware or adware, none of the lay users have that kind of expertise. And yet, I was astounded today when I came across a comment on reddit made by a senior xfce dev who says that the gnome project doesn't perform any extensive code audits at all[1]. To quote the user Sidnioulz:

> > Has there ever been a code audit for any of the more popular Linux DEs?

> There might have been for KDE? GNOME does not audit anything as far as I'm concerned. They state they review Shell extensions but the involved process has been discussed on their mailing list and it's essentially a "does the code look nice" review rather than a security audit.

[1] https://www.reddit.com/r/xfce/comments/47eoji/does_xfce_have_a_security_advisory_team/d0d93dk

A senior xfce developer saying this is a matter of grave concern. From what I get from this conversation is that some amount of transparency is needed in the auditing mechanism. In other words, a way to communicate to the lay users that the security audits are taking place all right, and a mechanism for them to ensure the same. This must happen if we want to avoid the next fiasco like that of linux mint. Granted that the mint fiasco doesn't relate directly to the source audits of gnome project, but the larger question here is the importance of security audits. Had their forum software (phpBB) been audited properly, they would have surely avoided a huge loss in trust, PR and reputation.

Moral of the story is: "Make security audits a part of the development process itself, not an afterthought."
I can't fault his analysis, there.
Maybe people run most things maximized because window management on Windows is so limited? With 8.1 and now 10 you can arrange up to four windows on the screen without using the mouse, but even that is too basic to be useful compared to tiling window managers.
I think Google could actually pull this off by "forcing" users to use a tiling concept (like a couple of different layouts to choose from and letting you launch/drag apps into the screen areas).
Ask HN: How do I get started with Algo trading?
I'm interested in getting started with Algo Trading, but I'm not really sure where to dig in. I have a BA in economics and finance and did a capstone in pricing derivatives. Any good recommendations on how to get started? Any good MOOCS or books?
In many cases, it really is that hard.
The response from a friend who works at apple was laughter and "if only".

personally, I'm the kind of guy with a "vim 4 life" tattoo, so I don't really know why people put up with crappy IDEs...
haha, you're on fire today
They sometimes make me giggle with their bombastic promises of teamwork and winning. Posters are just another kind of wallpaper.

Only thing I've ever seen work to raise productivity and motivate the workers is a sincere and firm handed bit of support from the higher ups. Leads, managers, and the rest that would act like regular people, make sure you had what you needed and could feel free to complain. Also higher ups that protected all the workers in the trenches from Client crazyness and subsequent fallout emotions.

The only kind of wall coverings I've seen that made a difference to the people working there was art from people working there, prints, paintings, photographs. Many people have side projects and they'd love to get some viewers.
U.S. Says It May Not Need Apple’s Help to Unlock iPhone
> If you believe that abortion is immoral...

Stronger: If you believe that abortion is murder. We don't deregulate the market for hit men just because we believe in the free market.
If by ages you mean a little over a year, then yes. But just because another device had it first doesn't mean it's not the killer app for 3D touch.
Yep, we update the available versions constantly and just serve them from GCS to reduce download time.

I'll get this documented somewhere.

Disclosure: I work on GCP.
I can see it happenning for weed though.
If you try to use the force-touch "trackpad" too soon after you've typed a character, the keyboard thinks you're still typing and refuses to do it. You have to pause for a bit or tap somewhere outside of the keyboard then try to force-touch. At least, that has been my experience. It's incredibly frustrating because I almost always want to use it to correct something in the word I just typed.

I have the same problem with the dictation icon. Sometimes I'll start typing a message and then realize that I'd rather dictate it. Once you start typing, the keyboard goes into "typing" mode. If you try to tap the dictation icon, it thinks you're aiming for the space bar.

I think that the keyboard is trying to be "smart" by altering its behavior based on what it thinks you'll do next. The problem is that those changes aren't reflected in the UI, so there's no way for me to know about them. I'm sure I benefit from that intelligence some of the time, but I only notice it when it when the keyboard stubbornly refuses to do what I want.
Wow, thank you!
Maybe you could embellish your profile with an email address?
That's probably why I'm having so much success then. I scroll almost exclusively with the crown. I never have issues with taps being interpreted as scroll actions. My wife also got an Apple watch and kept having issues sending heartbeats and sketches until I gave her the same example ("deeper" not "harder" - giggity). Now, the only issues she ever has are when her nails get in the way.
Does anyone think XCode (or some version on it) could be available on iPad Pro someday soon? That would make me very interested in this thing.
I am baffled by the for loop removal thing.

I just spent a while reading about both stride and for ... in, and I feel like there are any number of cases where I would rather use a C-style for loop.
I've updated the list, thanks for the input!
A transcript of Donald Trump’s meeting with the Washington Post editorial board
Yes. The idea of "intellectual property" as such is nonexistent (and widely considered absurd) in those countries' cultures, combined with a pretty high level of technical sophistication among the general populace.
Well, getting the actual fingerprint is probably like getting the original message out of a hash function...

So they can want all day, at the end, entropy wins (by design in this case).
My point was that this "variation" is not big enough to alter the data, and can be counted as false-positives. I don't think the comparison to a religious select input without atheism is fair since atheists represent a fairly large chunk of the population.
It's too bad Signal isn't used more widely. I even deleted it from my iPhone because of its very high data usage for contact discovery: about ~5MB for every(!) change in my iPhone contacts. And after over six months, a fix has not been released yet [1] (and a new release doesn't seem planned for anytime soon).

[1] https://github.com/WhisperSystems/Signal-iOS/issues/866
oh yes very true. Had not thougth of that.
FBI says it might be able to break into seized iPhone, wants hearing vacated
DOJ may have found a way to hack into terrorist's iPhone
Are you a researcher or a practitioner? The last half of your answer was much more interesting than the slogans at twenty paces we exchanged in the early part of the discussion.
> Yale’s comparatively modest $26 billion endowment, for example, made hedge fund managers $480 million in 2014, while only $170 million was spent on things like tuition assistance and fellowships for students.

For context, Yale's endowment produced an investment gain of $4 billion that year. Seems like the $480 million was money well spent.
Endowment funds are accrued through donations. The vast majority of donors would have no interest in giving money towards operational costs; they are interested in something that can be seen as a legacy.
Perhaps he's more pointing out the hypocrisy of attaching a scale/range of ethical values to something he determines to be an unethical act entirely, regardless of the ethical value of the reasons behind it.
did software change to account for efficiencies?
Guns kill more users than others.
PG is, IMHO, probably one of the best code bases for this.

I'm far and away not a database hacker, but have read parts of the code at various times to better understand what I was seeing. The codebase is incredibly well written and organized, and the documentation (both developer and user) is top-notch.

The only problem I can think of with using it in a course would be choosing what to focus on with only a semester. Add in the long revision history and I think there are also multiple theses in there on the sociology of open source.
I've done close to 200 interviews for Facebook. If you're coding in Python, then presumably you think it's your best language. If you aren't sure how to increment in your best language, it looks a little funny.

But just that: a little funny. It's certainly not a deal-breaker; we don't expect perfect syntax at all. For all I know you often switch between Python and JS in your day-to-day work and could easily make such a small error in a high pressure situation. That said, I'll notice it and take note. If one of four or five interviewers says "<name> incremented funnily" nobody will care. If every interviewer is saying "<name> doesn't seem very fluent in their chosen language" then the red flags start coming out.
I imagine it also has something to do with convenience. Being such an old game, the technical requirements are quite low, which allows them to easily have that setup of multiple virtual machines on a few servers. Also, I believe they can use the same CD Key for each instance, and it doesn't require a connection to the internet, reducing variables and potential problems.

That said, it would be cool to see SC2 for this, and maybe we'll see it eventually. But I think Blizzard would have to allow it in the end, considering they've been in direct contact with them about this.
No, the basic architecture hasn't changed, but the app does a lot, lot more than it did in the AWS days.
Ugh... Apple is so boring these days.
I pointed it out to be lighthearted, but it's true not sarcasm, and not only true, it's also meaningfully instructive to think about the benefits of lazy evaluation.

For example, a priority queue (list of tasks) does not need to be fully sorted, only sorted to the extent that the highest priorty item is quickly determinable, and there are algorithms and data structures designed for this behavior.

Sorting (other than to print a sorted list) doesn't pay for itself till you do a number of searches, and associative memory hashes are frequently better if you simply wish to find exact matches again. Even the lowly bubble sort has the not-insignificant benefit of finding the first value in O(n) time which may be the behavior you need: lazy evaluation can be the exact right way to go if you are instructed to sort, as you await more info as to what the appropriate technique might be.

I think humor is only funny when it's based on truthiness.
My iphone 5 and ipad Air are renewed for another season.
writing API library based on screen capping is what, 100? 200 man hours job?
Free mass education is a requirement in a democratic society. It would be national suicide for a government to give people the vote without giving them any competence to go with it.
HN Utility Suite for Firefox: https://addons.mozilla.org/en-US/firefox/addon/hn-utility-su...
HN Enhancement for Chrome: https://chrome.google.com/webstore/detail/hacker-news-enhanc...
How does it make a lot of sense? If Apple had a tool that was better than Xcode, why would they hide it from the public? They have proven themselves to be quite motivated to provide developers with good tools and frankly I find the idea that they keep a better tool hidden away ridiculous.
No, no, no.

This NEEDS to go forward. It needs to be decided, once and for all.
We're all hypocrites. Reality is stubborn in that way.
You have this entirely backwards. Sports team management, housing, construction, and especially investment operations are exactly what today's schools are good at!

The pesky problem that keeps popping up is those darned students and their education...
I'd read it as they really want to cancel but it looks better to judge to postpone now and they say later we hacked the phone ourselves or we broke the phone and now don't need Apple anymore.
The machine was rather difficult to operate. For years radios had been operated by means of pressing buttons and turning dials; then as the technology became more sophisticated the controls were made touch-sensitive—you merely had to brush the panels with your fingers; now all you had to do was wave your hand in the general direction of the components and hope. It saved a lot of muscular expenditure of course, but meant that you had to sit infuriatingly still if you wanted to keep listening to the same program.

Please no wave-at-me interfaces.
Wife really likes the big 4K monitor we have, and the Macbook Air's 13" screen is too small for her. To be honest, I really don't feel like buying a new PC to do what the iPad Pro could already do. Besides, she could use a new iPad and the 9.7" iPad Pro is only $599 vs the 13" MBA at $999. I wish iOS had a setting to drive a 4K monitor and turn the iPad into a multi-touch trackpad with mouse/cursor support.

Yes, I have the Surface Pro 3 w/Win 10 for work and the split-personality works pretty well for me.
Yes, they are being sarcastic. The list has to be fully materialized and iterated over. Further, the Haskell version probably doesn't have a concept of doing work in memory-sized batches with spill-to-disk, so the runtime would likely be much higher. Of course, I don't know enough Haskell so it's entirely possible they somehow figured this how to iterate over the input data in sorted order efficiently without materializing it.
My theory is that Apple does not want to be seen as trailing behind Microsoft
That's why I was waiting for the smaller iPad Pro: note taking! I'm glad you say it works well -- I did try the pencil in the apple store and it seemed pretty good.

But do you have an app that takes notes and converts your handwriting to text? I haven't found reviews of apps that seem to do that well. That's the real point of taking them digitally instead of on paper.
> 2) Developers will add it to their apps anyway, to entice high end users -- it's a very competitive landscape for apps, so they can't afford not too, even if it's only in half the new iPhone models.

App developer here. Patently false. I actually haven't implemented 3D touch in any app. Want to guess how many support requests I've received for it? Zero.
How many upvotes do you have? I think this number could be interesting either way.
Assuming one gets in the fellowship program, would it still be beneficial to go to the US in person if almost every YCF is remote? Or doesn't it really matter whether other YCFs are remote?
I don't mind managed vms, I just wish they had the same pricing model as app engine.
If the Communist Party were actively trying to overthrow the United States government, you might see it enforced...
Adobe Opens up its API  launches adobe.io
I'm sorry, but the Monument Valley iOS piracy numbers from Dan Gray quoted in that article are positively nonsense.

> It’s impossible for us to track that data. The only thing we can do is, two bits of data: One, how many purchases we have and, two, how many installs we’ve got. And we just leave people to draw conclusions from that as they wish, because we can’t clarify any further than that.

Once you purchase an app on an iTunes account, you can install the app on any number of devices that you're logged into. So the fact that Monument Valley has 2.5x more installs than purchases is 100% consistent with zero piracy, and with the fact that as people replace their devices they want to redownload the apps with the greatest replay value. This is not some weird trick that Apple overlooked, either. They clearly want the user to believe that the apps and the data are tied to the account rather than the phone, because new hardware sales are where they make the lion's share of their profit.

(I thought his numbers were bogus, which is what motivated me to read the article. In recent years, jailbreaking iOS devices, which is a prerequisite for pirating apps, has become increasingly bothersome and decreasingly useful. So the thought that there were this many jailbreakers didn't coincide with my model of the world.)
WebRTC predictions for 2016
Harvard's history is longer than that of the United States. Planning for year 3000 seems perfectly prudent, and honestly, responsible behavior.
already submitted: https://news.ycombinator.com/item?id=11332760
https://news.ycombinator.com/item?id=11332965

https://news.ycombinator.com/item?id=11332760
FBI Moves to Vacate
Yes I would take the Yale endowment's 20 year risk adjusted returns in a heartbeat.
> Kind of funny statistic, but the U.S has more people incarcerated as a percentage of the population than the Soviet Union ever did.

Is that true? The number of Americans in prison is somewhat over two million. It's hard to find numbers for the USSR, but the conservative number I was able to find for the peak of the gulag system in 1950 is about 2.5 million, and that's out of a population a little over half the size of the current US population. Others claim the true numbers were much greater.

Note: not defending the US in any way here. Our prison population is absurd. The fact that the numbers are even this close is unacceptable. This is really just nitpicking.
One of three things is true:

1. The FBI is lying to save face,

2. Someone -- but probably needs to be some people -- from Apple is willing to help them,

3. There is an undisclosed vulnerability in iOS which Apple is unaware of.

I find it really hard to believe that someone would disclose a zero day exploit to the FBI without charging significant $ for it.

Am I missing something obvious?
FBI Motion to Vacate
Introduction to Literate Programming Using Org Mode
Correction: feds realise they have no chance of winning and back out to prevent a precedent that would hurt them in the future.
Any discussions of returns must necessarily consider the risk incurred to achieve that return.
The worst posts certainly get downvoted and flagged. The problem is the posts that sound reasonable but aren't. It gets tiring and somewhat depressing trying to educate people about the same things over and over again.
The Hidden Homescreen
Ah but that doesn't work, because it's not the 'original source', and people will replace your link entirely.
Is the outsourcing somewhat recent? I've been reading through the actual text in the Piketty book and he discusses the relative advantages of large university endowments vs smaller ones. He has a data table in it for 1980-2010 where the returns seem pretty reasonable (but much higher for larger account balances of Harvard-Yale-Princeton). http://piketty.pse.ens.fr/files/capital21c/en/pdf/T12.2.pdf

People can argue about his book's overall points, but few can argue that he's accumulated a lot of interesting data.

I've been trying to reconcile that data with the Buffet view of complex hedge funds not beating straight index funds for gain... and by some other data Buffet is correct.. but the risk profiles may differ (Though it often feels like "risk" is the financial industry equivalent of engineering fudge factors).
Thanks for the comment, quite out of the box. Nonetheless, my bet would be the opposite. I think people are getting addicted to things like social media and this is obviously bad for academic performance. I reckon that some educational platforms will do the opposite of what social media apps do: create an environment of focus. I can imagine khan academy having features like pomodoro's timers and extensions which would block "distractive" websites during exercises. I can see a future more of productivity apps, like "Rescue Time", joining educational platforms than education joining social media as "soft" content.
to sort by column use this link https://docs.google.com/spreadsheets/d/1a1Df6dg2Pby1UoNlZU2l...
Firstly you can run dart in checked mode which will catch all type errors. Secondly static type checks will catch most errors. Even if there were no type checking at all the types are still hugely useful for documentation, navigation and tooling. Gradual typing can be more productive than pure static typing in that you can play fast and loose when you want to prototype something and then tighten up later when you have arrived at a definition of the solution.

Most of your arguments could also be applied to typescript (which doesn't even have the option of runtime tour checking)
Legalize free trade!
I've seen a lot of APIs on ReadMe.io, and one thing I've noticed is that many APIs tend to be built as though replicating the main site is the only usecase. Before launching an API, you should come up with 5-10 compelling usecases that someone couldn't use your website for.

You should publicly post these usecases somewhere, too, as a type of "Request for Projects". It gives people ideas... after all, you spend more time thinking about your API than anyone else ever will.
The Cryptographic Doom principle strikes again! http://www.thoughtcrime.org/blog/the-cryptographic-doom-prin...

The article refers to it more precisely as "similar to the padding oracle attack discovered by Vaudenay", but this root problem -- malleability -- keeps coming up so often even in relatively mature attempts at crypto that the appeal-to-emotion "Doom" name seems worth using.
My speculation here is that the FBI realized it has a strong chance of losing the case and this is their way of backing out before the courts rule and there is a precedent.
New York senator proposes tax credit for open-source developers
"Since the aircraft can do nearly 3X as many trips in the same time"

Isn't that a bit optimistic? I would think it's closer to 2X. 2.6 times the airspeed, but why would turnaround time at the airport be any lower than for a comparably modern 'slow' airplane?

For example, 6 hour flight plus 1 hour turnaround time versus 2.3 hours plus 1 hour turnaround time is more or less a factor of 2. For longer flights, the ratio goes up a bit, but getting it over 2.5? I doubt it, at "the 2.6 times as fast as a typical passenger jet" level.
To address the title: It does not happen in practice, and the idea that "simply because code is open-source and viewable, it is more secure" needs to die. It is an open-source fantasy, like Linux on the Desktop.

Code becomes secure when you train your developers, when specialists audit your code, and when you consciously choose safe libraries and frameworks to build upon. Tasks like these all cost time and money and organizations that spend on security are ones with "skin in the game" who can afford to pay for it.
Guys, please check out our brand new Stripe SaaS metrics Slack Bot on ProductHunt today :) Thanks!
https://www.producthunt.com/search?q=revealytics
It needs to be decided, once and for all.

That's exactly why they are delaying. They don't want the decision to go against them.

The FBI is clearly abusing the All Writs Act. The decision in Apple's favor in Brooklyn spelled this out. It's very compelling reading, and I'm sure it would have influenced the California court. https://news.ycombinator.com/item?id=11199169
Completely agree. Just posted the exact same thing on a similar thread!
Valeant Sold Some Drugs Twice