skysight-inc/HackerNews huggingface dataset:
Kerckhoffs' principle applies to ciphers with keys. For the threat model the TSA is up against, security by obscurity is actually very close to reasonable.

Specifically, if you're talking about ciphers (as Kerckhoffs does), or system software (as NIST does), or anything else, you know in advance who's authorized and who's not. You've solved the hard problem; the rest is simply math, and we're fortunate to live in a time where the math is well-studied. You can give the secret key to the people who are authorized, and not to those who aren't, and your security rests on that key -- and your competence at figuring out who should have been given the key.

The TSA has no such luxury. They have no good way to distinguish me, a random person walking through the airport with a valid boarding pass and too many electronics, from a terrorist, also with a valid boarding pass and many electronics. If they could give me a key in advance, and not the terrorist, they would. (In fact, this is basically what Pre-Check is, and that works okay, although it only reduces the screening because they know Pre-Check can't be perfect.) But there's nothing that reliably distinguishes me and you and hundreds of millions of other non-terrorists from the small number of terrorists, and there's certainly no practical way to publish a key to us hundreds of millions, while keeping it away from terrorists.

So they rely on heuristics, because there is no better option. You cannot build a system that satisfies Kerckhoff's principle, because there is no key separate from the system itself. And any public, keyless system can be gamed trivially. (Think of, say, unkeyed SHA-256 checksums attesting to software integrity. Without a signature, i.e., without a key, anyone can tamper with both the software and the checksum, regardless of how good SHA-256 is.) So the system must be kept private in order for it to work at all... or we give up, and decide that the only people who can fly are those that we can conduct foolproof background checks on. That seems like a worse world.

It is rather like anti-spam and anti-virus. If you could just give a key to all legitimate email or legitimate software, you would. And in fact there are things that attempt to do that. But they can't be complete, and the remainder of the screening works on security-by-obscurity because there is no better option. Either we give up entirely on the ability to receive unsigned mail or run unsigned software (and even that won't be 100% reliable), or we go with the secret heuristics. It's not great, but it's the best we can do.
I agree. I'm making my way through the adaptation of SICP written for python currently and it has been an absolute game changer, but I never would have appreciated it without struggling to construct "larger" projects on my own with little abstraction.
Lol. Please. Let's avoid a discussion about how a useless site could be built better.
I can definitely do that. One of my good friends used to work in the kitchen at Applebee's. What are you expecting me to hear from him?
> The T.A.’s had to explain over, and over, and over again the simplest concepts.

As a TA, I want to say that this is literally my job. If that's what it takes, then that's what it takes. My entire purpose is to help students. If other people need my help, I might be limited in the amount of time I can spend, but I'll give you every bit of help I can in the time I have.

When I was an undergraduate, I worried about the TA judging me for not knowing things. I'd even skip tutorials if I was too far behind. Now as a TA, that seems so silly. My goal is to just get you the best mark I can, regardless of where you're starting from.

Anyways, this was a well-written post. Lots of great stuff in there. I think the issues it touches on are also something a lot of students can relate to.

I would caution, though, there's also 'that guy' who speaks instead of thinking. There is a balance to be struck. In lectures, at least. Listen, think, ask.
> I just need to be aware that when I'm done with a coherent unit of code, that I should switch to review mode and check if there are outstanding PR's

This is exactly what I have ended up doing. I'm not always successful (perhaps because it is not always possible), but I've definitely improved my reactivity.
This is a bigger problem than anyone realizes. The thermostat in my home had been here for probably 30 years and worked fine. Then some idiot went an bought a Nest and replaced it. Me.
Yeah, CSS lacking namespaces is a huge pain. You have to solve the hardest problem by hand - making sure no classes from different modules collide.
Two years ago? Strange, I worked with Android in PC form-factor 3 years ago and while I haven't been following it, I was sure they're everywhere already.
I'm not so sure - don't confuse the general consensus on HN with the wider public. Average Joe won't think twice about clicking "install" on that dialog that tells him to install Flash in order to watch the movie he's been looking forward to.
For anyone interested in learning more, Lawerence in Arabia by Scott Anderson is a pretty good book.
Call me naive, but I always put human lives as a first key to judging the success of any such "operation". Death, torture and general misery do not constitute a part of any solution. Specially when the solution is not a solution begin with.
I disagree. They won't get bought because VC will stay away from these companies.

the dot.com bust in ~2000 had lots of dead unicorns. Web van is a good example. It can and will happen again.
^ Skimming through the page I thought this was an example of a bad PR comment ;)
Why don't you look at a co-working space? You wouldn't need to give up any equity, but you would get access to some of the social aspects you seem to be after. They're probably better than simply working in a public setting like a coffee shop since you'll be mixing with people doing similar things to yourself.

One thing I would say is that you are wise not to ignore your mental health. If you already know you are prone to depression when working alone, make sure you never have to.

Lastly, can you talk to anyone where you sourced the funding? Do they have any mentors etc? They might have some ideas.
While this is a very moving story and I hope the author finds a rewarding career in CS, one big problem I have with this is that there is going to come a point in time where she has to figure out a hard problem on her own. It might be in grad school, it might be on the job, or in an interview, or for a side project. But there is going to come a time when there's a very difficult problem to solve and there is nobody there to turn to for advice because you are doing something new. And if you haven't built up the resources to research the problem on your own and work it out, that might be a very difficult experience.
Military radars and other high power electronics
I'd also be happy to set you up with a free account on www.farmshots.com. It's a neat project for processing/analyzing satellite imagery of farms.
Introduction to Boosted Trees [pdf]
It is really important to abandon your ego when learning programing. The "smart" students who get everything immediately have spent hours on their own learning the material. That probably is the best way to learn the basics but the next best thing is to do as the author did.
Just AAron Swartz it: don't follow the license at all and do what you want.
I use Mailwizz. It lacks the polish of MailChimp, but works well.

It is multi-tenant and you can have sub-accounts with their quotas.

You can even use it to roll your own SaaS with the included user management and billing features.
> I only want to move the button a few pixels to the right.

On mobile or on desktop? At what resolution/pixel density? Does this button need to be placed differently when the phone orientation changes? CSS is weird because it tries to solve a lot of problems, not just placing things a few pixels to the right. For that you can use absolute positioning with each element, if you want that level of control, and it's simple.
That sounds like Burundi to me. Incompetence is encouraged.
We have a company policy against signing contracts. Keeps it simple.

Occassionally someone says they need us to sign something and we ask why. 99% of the time the actual fear is that we'll break the law. So i just point out that since doing "x" would be against the law, they are no safer if we sign something. What written agreements do is muddy the waters because now you have to have a judge determine what the agreement says according to the law.
> That is a pretty big assumption.

Yes, it is - I am not at all confident in my understanding of the subject (so thanks for sharing your views with me).

>> at the cost of slightly degrading that of the high-wage workers

> How do you know it would be slight?

"Slight" was a bit of a red herring. Whether the impact on high-wage workers is slight of not, so long as it's negative, it is causing incomes to be more equal.

> If you however (correctly) believe the effect would be much bigger, then pay differentials would be preserved, because they are reflection of many structural and market conditions, none of which would be improved by it.

If these assumptions hold, does that mean that pretty much any attempt at leveling the wage distribution within a capitalist system is destined to failure? i.e. negative income tax, basic income, etc. would also do nothing, as the wage distribution would adjust itself to revert the effects? The only workaround (in which workers are compensated only in cash) is to outright fix wages across the board? (Not that I am suggesting this). Or am I misinterpreting this?
This gadget wants to help you customize your life
> I start reading the code, and pretty soon it starts messing with the clipboard, and it even pulls in Flash

I admit to thinking the dependency overkill for random arrows was part the joke. A la https://github.com/jezen/is-thirteen
I wonder what the original leak looks like... Whether it would be as mineable as the Ashley Maddison leak, or whether you'd have to burrow down into each and investigate manually.
FYI, Safari on iOS will never send cookies cross-domain, regardless of how you configure the server or call your XmlHttpRequest (the user can enable 3rd-party cookies in Settings, but literally nobody will ever do this):

https://stackoverflow.com/questions/14206531/mobilesafari-wo...
Spies Rejoice Gmail, Facebook Messenger BREACHed Once Again
That's good to know, thank you. However, that doesn't seem like it'd fix the issues with a Racer plugin.
I finished reading "Bury My Heart at Wounded Knee" a few days ago. It was emotionally draining reading the history of the native Americans' extermination by the colonialism of the USA in the 19th century. It's surprising there are any left living today given how they were treated.

There are some books that I believe everybody should read, this is one of them.

R.I.P.
Dead link... someone cleaning up for you?
Sorry. Next time.
You don't want this becoming 4chan. Anonymous posting might not be the best idea.
I think you may have misunderstood me if you boiled down my point to an existential question.

My point was that directing to Google or documentation is a basic misunderstanding (or simple forgetfulness) of what it means to be a beginner in the field. It is that telling someone to "Google it" or "read the docs" fails to understand the fact that beginners often simply can't comprehend documentation and can't use Google effectively because they do not have the foundation necessary to understand the problem they are facing.

This isn't an existential question of "what is a programmer." It's the statement that if SO is exclusive to "beginners" then it is doing the field a disservice. And it's a statement that directing beginners to Google or documentation is elitist and inherently exclusionary in practice.
No, there isn't. I'm not complaining about the state of doing Rust in Vim, though. I'm complaining about the state of Racer.
Security is an illusion. You could be perfect and the company could go out of business for some strange reason.

The best advice is to stay upwind.
Not really - there's also OneBody [0].

[0]: https://church.io/
Switch to Vim or Emacs and you don't have to worry about remote editing plugins anymore!
> we had to deal with making CORS requests from app.example.com to api.example.com

What? If you share the same domain but a different sub domain then just set the document.domain property[1] so they trust each other and be done with it. You don't even need CORS...

Alternatively setup a proxy to keep everything behind the same domain. This is typically a best practice.

> In our case, since each CORs request makes a preflight check, it doubles this significant latency without adding any value.

Considering CORS contains no body and does no processing beyond asking what the client can and cannot do, it seems odd this would always "double" the latency here.

> After reading a great blog post and MDN’s CORS docs I realized there are circumstances where the browser does not make a preflight request, if conditions are met

Okay this is scaring me. Where are we going with this?

> In terms of security, all API calls should be using https and there is little difference in putting the token in headers or as part of the query string.

Yeah was afraid of that. Please don't do this especially if you use that URL in any way to give the user access to a link (e.g. downloading a file) because now it's part of their browser history and they can't completely log out.

> Thanks for reading this! I hope it helped, even if the conclusion is “preflight requests are too troublesome, I’m going proxy” :)

A proxy is the correct solution. Not this horrible hack fest of completely disregarding important HTTP headers. Sigh

[1] https://developer.mozilla.org/en-US/docs/Web/API/Document/do...
Hey...have you already tried back4app?
And that's a good thing - I'd rather skip half of the shows and truly enjoy the rest instead of having to endure an endless sea of mediocrity.
It was probably around the time when the latest Rust stable release was 1.3, so it's been some time.
Have you tried back4app? It is quite easy.
I have not used PS2 Linux but I am curious how was it possible to limit the low level graphics API? Did they not let you run VU1 code? The retail games were just writing registers on GS from VU1 (and few smart ones were also streaming textures directly to GS). There was no API involved other than kicking DMA chains to feed VU1 (and that was just writing a pointer into a user register anyway).
Javascript is getting freakishly absurd. What is wrong with the JS ecosystem? This feels like XML all over again.

I know not all engineers do this, but this crap is what caused me to buy a new laptop. I was fine with my existing tools and workflow, but websites have gotten so slow and ridiculous. It's largely Javascript's fault.

I used to get angry about walled garden app stores, but lately I find myself hating the web. I don't dislike it, but I think we went on a really lame detour.

As an aside, Javascript ads are worse than Flash ads ever were.
> 1. Find a way to proxy requests so that there’s no CORS

Turns out this is really, really easy.

I tried this recently on a cookie-authenticated web api (after discovering that CORS cookies are useless because mobile Safari will always block them).
I'm never touching CORS again unless it's a blasting out a bunch of '*' Access-Control-Whatevers on a public API.
Yea I have recommended these kinds of changes to my university professors a couple times. I haven't cared enough to make noise about it, but it literally has everything to do with the intro course.

You need your best professors and resources on the first 2-3 courses and everyone who comes out of those courses needs to "get it." Otherwise, everything afterward suffers and waters down. And without that stuff after (algorithms, operating systems, OOP, etc.) most students leave completely unprepared and barely understanding the stuff from those first few classes. And whoops, it's 4 years later.
It's suspicious that North America is missing from this leak. Interesting timing given the election.
It is really an option. And I recommend it if you have a too complex application or too many users. But using a Parse Hosting solution like back4app can save your time of setup and manage servers.
Didn't know about that. Thanks for the info! Churchetto is different, though, as it doesn't require you to install on digital ocean or an ec2.
There's little practical difference between anonymous accounts and pseudonymous accounts in cases like this.
We're relying on fossil fuel to produce fertiliser for the vast majority of Earth's food.
> If I'm picking a technology stack for a business, I want to pick one that will last me 10 years.

What? Why wouldn't JavaScript last you 10 years? It's been around for over 20 already and is certainly not going anywhere...

You don't have to upgrade to the newest fad every 6 months like you seem to imply. Most modern languages have crazy fads (just maybe not as fast as JavaScript does) and no one jumps on them every single time they're released, why would JavaScript be different?
Can't upvote this comment enough. I have just started learning rust and the lack of debugging options are telling. I know it is early days for rust, but for some, this would be show stopper from picking up the language.
It might be in part to the differing goals of the W3C and WHATWG. To simplify, W3C wanted to stick with versioned specifications like they have always done and to finalise the HTML5 standard at some point and work on HTML6 or whatever came next. WHATWG saw HTML as transformative and wanted to create a standard that both established a future direction and took implementation specifics from vendors into a single "living" specification.

DTD's seem to concern XHTML more than HTML, and WHATWG seems to have mostly dismissed the issue of parity between XHTML and HTML. WHATWG wants to treat the DOCTYPE as optional anyway, and is only including it for legacy reasons.

This Stackoverflow answer goes into some good detail:
http://stackoverflow.com/a/15245834/132164
We took "the first" out of the title. (Standard practice in fact.)
I'm the same .. I keep wanting to switch to Atom from ST3, because all the cool kids are doing it, but every time I make the attempt I'm thwarted by the feeling that its just not a very well-written application if it can't handle my 500-line files without hitting swap - on a system with 16gigs of RAM and plenty of cores free.

It may be that its worth the effort - I wouldn't know. But the feeling that I'm not actually improving things by moving to an editor that can't handle big files is just too prevalent.

So I inevitable switch back to ST3 and go back to work, every single time. Sorry Atom guys, its just not working for me.
1. The website doesn't really explain what the software does. No screenshots.

2. Open-source? I didn't see any links about the source.

3. You ask me to create an account, but you do not indicate what I am agreeing to in so doing. Where's the TOS?
We changed it to the title of the article, which is what the HN guidelines ask submitters to use in the first place.

(Submitted title was "Introducing Echo v2 fast and highly customizable with many new features".)
Experiences on using ngComponentRouter in Angular 1.5
I was also a user of google.stanford.edu back then. Nobody then thought that Apple would be bigger than MS either.
Please read before continuing on to this site.

I've been messing around with this all morning, and the creators have a built a really cool math education product based on customized paths and gamification.

However, they specifically state that "at our prototype's present levels of scalability we prefer that you not post Arbital links to Hacker News or Reddit front-pages."

I don't want to flag because this such a cool product and I think a lot of people in the HN community can benefit from it, but I also don't want to upvote because it seems like a lot of people are getting a broken site due to these scalability issues, which is not fair to the creators.

So if you run into problems with the site, please keep this in mind, and come back to give it a fair run later.
There's a lot of stories like that caused by sloppiness. If you blast (https://blast.ncbi.nlm.nih.gov/Blast.cgi?PAGE_TYPE=BlastSear...) the sequence of essentially every organism with a sequenced genome, you'll find long stretches of the human genome.

Even worse are the genomes coming out of one specific lab... there are always stretches of the Chlamydia genome. I wonder if that tech knows?
Determining Gender of a Name with 80% Accuracy Using Only Three Features
> a specific kind of people that don't get anxious/frustrated when tackling complex systems

Eh, you learn to not let that get to you because you build up experience working through it over time. I think that's a learned skill, not an innate, immutable trait.

Also:

> Basic Cognitive Skills, as measured by standard cognitive ability tests, are not shown to be helpful in predicting programming proficiency

from http://pro.sagepub.com/content/27/7/647.short
> It is only nonsensical if you subscribe to theories of "rational" decision-making

Oh, dear lord, you have just fallen into a stereotype of a person that thinks they understand economics, but actually doesn't. So, we'll just leave it here. Not all economics assumes 100% rational decision making from an overall perspective, you make those assumptions so you can make a model to test. A basic game theory table can tell you that much; even with the simple example of the prisoner's dilemma.

You can make a "rational" decision without it being rational to an outside observer. For instance in the prisoner's dilemma it's in both people's interest to not cooperate, but since not all factors are known the "rational" decision is less apparent and both will betray one another. The field of economics, that generally is on the side of free trade (even from people like Krugman), is a much deeper field than the shallow picture you just painted. I basically already had your politics/understanding of economics picked from your previous post, but now I have a pretty clear picture.
To me this article relates to the idea of pair-programming. In pair-programming you should also pair lower-skilled with higher-skilled people to lift the beginner's skill. Empathy and Patience required. The problem with teamed-up programming is that it is very much relying on the groups culture and switching between cultures might turn into a hard challenge.
> Vizflow is a light-weight library for adding transition effects and interactive visualizations to HTML5 documents with a simpler design compared to other popular interactive visualization libraries like D3js.

This. It's not that d3.js is complicated when doing small demos, but it gets REALLY complex when doing anything non-trivial, like UI interaction (select, drag & drop, pan / tilt / zoom,... combined).

I don't know Vizflow yet, but the first paragraph of its description nailed it - will check it out.
But you have a fair min wage in Canada, right?
Yes. Six, possibly even six and a half, flights every five years.

The low rate of hijacking is due to the scarcity of people interested in doing it, not the difficulty. Same reason your house doesn't get burgled every day.
That's a good idea. I've filed it as a feature request: https://github.com/duckduckgo/zeroclickinfo-goodies/issues/2...
Thanks
Who edited that video? It literally stops/fades out the moment it gets to the point where you're supposed to look at the mural from.

Then it starts talking about the history of the oculus rift? Come on now.
Visual Studio Code seems much snappier than Atom, but is based on the same engine. So atom can be much faster.
From what I can tell, the redirects are all on popsci's side. It's pathetic. It's like they're saying the science is different country by country...
There's an increased cost (the time and effort required to make such a post) which deters it's casual use.