skysight-inc/HackerNews huggingface dataset:
> If you have the source then you can see what it does.

That is literally false. We have known from the 70s that you cannot know what an application will do from the source. I can't believe I'm actually having to reference "Reflections on Trusting Trust" but it is the entire point of one of the most seminal talks in our industry.

To defeat that style of attack you literally need 2 different compilers, I didn't pick that out of a hat, its also from the literature.

> If you only have the binary you have no idea what it does. You can observe what it does today, but what use is that if tomorrow it receives a short message from Facebook

Figuring out what a binary does without source is a very common task in our industry. I'm told there are people who do it for fun, and I know people that do it for money.

Regardless of whether you have the source or not, you have to verify the binaries behavior, both because of intentional trusting/trust attacks and for flaws that are non-obvious from the source.

I'm sure the source is helpful, and the source with repeatable builds is even better but its not a requirement nor does it seem to be a very high priority for the people that do this sort of work professionally.

>"what about this or that open source project with bugs in it"

I am certainly not making that argument.
Comics about hackers and their real life stories
Forbes' "Please turn off your adblocker" interstitial is a great reminder not to read Forbes' clickbait bullshit pseudo-journalism.
I noticed there are a lot more sites that can detect Ad Blockers. They hassle you about disabling the blocker.

Why not just make the ad inline into the content of the page. It would speed up the site as you would not have to make all the extra connections to these ad networks via thirdparty javascript.
QA is dead because Agile killed it? (quoth the article)
I work at a Fortune 10 company and this is just wrong.

Furthermore, leveraging QA in an Agile process is critical to continuously improving our software quality.
It very much can. Only a few months ago they were simply impossible. I tried to solve 30 of them while accessing a site and was still unable to. The current set are merely extremely annoying and time-consuming, but they can consistently be solved (at least by English speakers).
My process

1. Install https://github.com/reek/anti-adblock-killer

2. Laugh maniacally.
AI and Machine Learning Interview Resource
In before Shcmidhuber gets pissed he wasn't mentioned.

Edit: To be clear, I mean as one of the people who kept deep learning alive -- as a part of this "trio".
I have shitty internet and there are many times of the day when its hard for me to watch videos without them always buffering. youtube-dl lets me download the videos on the background so I can watch them later at a decent resolution and without all the buffering.

youtube-dl is also helpful for other video serivces. For example, twitch.tv doesn't have as good of a CDN on my country as youtube does so youtube-dl is sometimes the only way for me to watch a twitch.tv VOD at decent quality (even in those days when I can watch youtube videos just fine).
I'm one of these ML-derived ideologues this article disparages. I hate Go precisely because of the reasons outlined in this article. In my perspective, OCaml and occupies mainly the same niche that Go does (same balance between high-level and low-level, same skepticism of the object oriented orthodoxy, etc). OCaml is a much better language than Go for so many reasons that I will not go into here.

I'm also a Googler. Rather than inventing Go, if Google instead would have made OCaml its "Go", the world would be a better place than it is today. If the same tooling were built around OCaml, with some problems of its implementation fixed (multicore/parallelism, etc), there would be no complaints.
"Passing up the stack" is fairly minimalistic in an environment where you could be running thousands of goroutines, some (many?) of which may share memory.

If you do it that way, you seem to forego a lot of error encapsulation straight away and quickly find yourself into undefined territory.
I believe it still requires a Tampermonkey script in addition to the filter list to properly function. I'm not sure how I feel about having to use a Tampermonkey script for it (I currently don't use either the filter list or the script, I rely on uBlock Origin's built in functionality instead (see below)).

It's also worth noting that uBlock Origin has a separate redirection framework which includes certain anti-anti-adblock capabilities. uBlock Origin also recently introduced an overlay buster[1] which can work as a generic filter to block the kinds of overlays that the anti-adblockers show.

[1] https://github.com/gorhill/uBlock/commit/ff8f0eb7a9c39e8941f...
Won't help performance, that's for sure. Anyway, the post doesn't mention Dart, so has no credibility whatsoever.
Wtf is cargo cult?
That's pretty much all you can do. Try to remove from search engines and complain online a lot until people (your clients) notice - so they are aware. Litigation in China... forget about that.
To me this feels like a false dichotomy. There are business models other than "literally distributing malware" and the only reason they're not pursued is because distributing malware is currently profitable. We need to make that not the case so we can move on.
I'm currently writing off Yahoo. No matter what happens, it's been managed to badly I just can't see how they can make a comeback.

Years ago they had a chance to claw their way back, but not any more.
I think you are mixing the concerns of configuration managers and package managers. They are at different abstraction points. Step one: install software and its dependencies (package manager). Step two: Have all the software services in your cluster talk to each other (configuration manager). Step three is profit.
Sounds like the best bet for a British developer (if possible) is move to the US or work remotely for a US company.
Film Dialogue from 2,000 Screenplays, Broken Down by Gender and Age
They're just moving the turtle lower. Now we'll have horror stories about devops outsourcing just like we have those about dev outsourcing :)
I'm willing enough to tolerate a moderate amount of ads on the page. This malware issue is a real problem though - I wouldn't know if an ad infected me with malware until it's already a big problem to deal with, possibly even including a ransomware infection. The only safe option is to block 'em all everywhere.
U.S. Senate Bill Seeks to Ban Effective Encryption, Making Security Illegal
In a proportional font. Ew.
I don't think US copyright law will be very helpful here.
You are misunderstands relationships between authors, packagers and users. Authors pays by code, packagers pays by maintenance, users pays by testing and with bug reports and patches. Testing of nginx at all distros and in all usage cases is not responsibility of nginx team. If you disagree, then demand your money back.
Burr-Feinstein Draft Bill to Compel Decryption And/or “Technical Assistance” [pdf]
ErgoDox EZ Launches Online Store
> It's not a dumb choice, but it's also not clear for either side. Running your own iron is much much cheaper. For my case (email service provider), our bill estimate on AWS would be about 300k€/year, while running our own servers costs 84k€/year (split at 48k€ depreciation and 36k€ operational costs).

Something to note about US orgs: New depreciation rules allow you to depreciate $500K/year in hardware, in that year. That means that gear is yours, forever, whereas that $500K/year in opex to AWS is recurring forever.
Wow, the language, "hold their content hostage". I hate ads probably more than most[1], but still, if Forbes doesn't want to give up their articles without fair compensation, that's their prerogative. They're not taking hostages.

--

[1] https://news.ycombinator.com/item?id=10939083
The 50 most amazing moments in pop history (that never actually happened)
They do, but it's very limited. Their private IPs only work within the same datacenter, so you lose the benefit of distributing your infrastructure globally.

The solution that worked well for me was using tinc to set up a VPN so all my servers, no matter what datacenter they're sitting in, can communicate with each other using private IP addresses (tinc has added benefit of encrypting, which DO's private network does not).

If you're needing help, I'm currently looking for more contract work :) Check my profile for contact information.
Writing Varnish modules in Rust
Yes. It's called a cease and desist.
Exactly. QA's role has definitely shifted (or should shift) toward being involved earlier in the process and helping to define requirements, but it is by no means dead.
Very recently I have begun to work as programmer, and having to work with PHP I looked at phpunit and unit testing (first time I do it semi-seriously).
The guidelines for mocking that I have found are about dependency injection (phpunit has some helpers, but I think that's it).

What is the alternative to it?
Justinmind at Rocketspace Innovation Collective Summit 2016
Seems like in many cases, just trying many things on many tissues is whats needed to find solutions. I know there are groups like Opentrons and there are groups out there working on snythetic tissue generation, but I wonder is the bottle neck tissue availability, researcher examination time or studying long term effects. Seems like we need to open all these bottle necks up to really iterate.
"fifty prior arrests"
I really want a plug that will let me mark sites like Forbes and then decorate any links to it indicating I've already decided I don't want to go there. This way Forbes doesn't even get a +1 visit from me. I've had this thought several times over the last few months so last night I started work on a Chrome plugin that takes a regex pattern and css styles, finds the pattern in the markup and then applies the css to the first visible element containing the pattern. I'm hoping it will be useful for more than just reminding myself to not click links.
How I got my 5 year old to brush her teeth and learn programming in the process
https://en.m.wikipedia.org/wiki/The_king_is_dead,_long_live_...!
Ask HN: What should you do when a China-based startup clones your website?
Dear HN,

I'm CEO of a Germany-based eSports startup and we have a problem.

Today we were approached by a Chinese user of our website who told us that a China-based startup has launched a direct clone of our website aimed at the Chinese market.

Our website https://strivewire.com is a host of for-money eSports tournaments in the Hearthstone vertical, but we are working on expanding to other games as well.

The website in question is a very obvious clone of ours and has both .com and .cn domains:
- www.haogegebisai.com
- www.chosengamer.com

Basically they copied all the design and even our logo down to the actual URLs.

I've added their CEO on WeChat and inquired about this, and he said they are big fans of our startup. But he also mentioned that they already have investors. Their website launched two days ago and already has a bunch of activity.

We've talked about this internally and hope to be able to gain this startup as a Chinese subsidiary, but we are still unsure if this will actually work out.

From a legal standpoint we are very unsure how much you can actually do in such a case. Should we just wait it out? Our should we aim to litigate to put pressure on their investors? I have some experience in international litigation in cybercrime cases, but from a practical perspective it is very likely to bind a lot of resources and focus.

Another huge problem for us is that we are in talks with a very large Chinese IT company (triple-digit $Bn market cap), and if there is a clone growing in their backyard they might pass on us.

It'd be great if people with more experience in these things could give us some advice.

Thanks,
Benjamin

TL;DR: Chinese startup is cloning our business, unsure what to do
Try to figure out how they do it, and feed them with porn and anti chinese propaganda. If they do it manually then pray for them because they have a shitty life.
Works for me too, and I like to add 8.) Reflect for a moment on how much of human endeavor is wasted effort before it even began.
> My side of this discussion keeps saying C's design is bad because it avoided good attributes of (insert prior art here) and has no better design because it's foundations effectively weren't designed. The counters, from two or three of you, have been that the specific instances of the prior art were unsuitable for the project due to specific flaws, some you mention and some not.

No, my counter in the specific bit that you are replying to here is that your history is wrong. Specifically, you said that C was initially so bad that they couldn't even write Unix in it. That statement is historically false - except if you're calling BCPL and B as "part of C" in some sense, which, given your further comments, makes at least some sense, though I still think it's wrong.

I'm not familiar enough with Modula or Oberon to comment intelligently on them. My reference point is Pascal, which I have actually used professionally for low-level work. I'm presuming that Modula and Oberon and that "type" of languages are similar (perhaps somewhat like you lumping BCPL and C together). But I found it miserable to use such a language. It can protect you from making mistakes, but it gets in your way even when you're not making mistakes. I would guess that I could write the same code 50% to 100% faster in C than in Pascal. (Also, the short-circuit logical operators in C were vastly superior to anything Pascal had).

So that's anecdote rather than data, but it's the direction of my argument - that the "protect you from doing anything wrong" approach is mistaken as an overall direction. It doesn't need for later practitioners to re-discover it, it needs to die in a fire...

... until you're trying to build something secure, or safety-critical, and then, while painful to use, it still may be the right answer.

And I'm sure you could at least argue that writing an OS or a network-facing application is (at least now) a security situation.

My position, though, is that these "safety-first" languages make everything slower and more expensive to write. There are places where that's appropriate, but if they had been used - if C hadn't won - we would be, I estimate, ten years further behind today in terms of what software had already been written, and in terms of general availability of computers to the population. The price of that has been 40 years of crashes and fighting against security issues. But I can't say that it was the wrong choice.
There are two things here: a) the app can take a snapshot of your phone book, upload it, associate it with your own WhatsApp account, and then keep the remote version synchronised; and b) the app can periodically perform disparate requests to the central directory server to query the profile information for each number. As far as I know, WhatsApp uses approach b. These two may seem similar but in approach b, WhatsApp the service wouldn't learn of any contact removals. WhatsApp the app would, of course, but the service wouldn't. Now, with some simple filtering and statistics, WhatsApp the service can deduce your phone book with some certainty, but I believe most would agree that it is materially different from actually uploading your phone book.
I'm a strong believer that the Russians are manipulating public opinion through social media (and infiltration of the upper echelons of society) to cause unrest in the United States to deteriorate our standing as a world power. The ultimate goal is either civil war or a society that the Europeans no longer are in alliance with (i.e. ultra-nationalist like Trump).

When a crazy person is in charge and European nations start to agree more with Russia and China than the US it will only be a matter of time before they create an Eastern alliance and come into America to take our nukes for fear that we'll elect another Trump.

We'll have Russian and Chinese troops leading an effort in America to reform our government and little pockets of resistance will form leading to a half century of war and the devastation of the world economy, but it will only effect the poor and middle class. China and Russia will prosper as they plunder our resources and the resources of Africa and other regions with no one to hold them in check.
Deadpooling LaunchHear (YC w2010)
Does anyone know if the proposed Hungarian law considers a web browser to be an "application intended for encrypted communication"?
I think the analogy with QA deserves some credit here. "Testing" as a part of software process has not gone away, but the people who solely did QA are now gone - either evolved into doing both dev and qa; or moved to companies where the older processes still exist.

Testing was more closer to writing-code - so that got absorbed into the dev side faster. Disappearing QA was a you-blink-and-you-miss revolution.

DevOps is a little farther. Several developers are not able to wrap their heads around the deployment systems, the implications of hardware and network etc. But they will. Eventually. Because they are smart people.

I think the message of the article is that people who solely have DevOps expertise, should look to evolve to developing code as well. That way we have smaller, well-knit teams with each member having an additional speciality other than writing code.
To add to this informative post: The original form of the phrase is "the king is dead, long live the king".

It was used when the king died in the sense of "the [old] king is dead, long live the [new] king".

So in that light it means "[the old way of] devops is dead, long live [the new way of] devops".
Exactly. Many people do not know how hard it is to improve on the current prelude, even though it's entirely possible. Most decisions and tradeoffs in Haskell weren't just done on a whim, there is an ideology and reasoning behind it (I am not sure if I want a maybe monad as a possible result of my list operations, though). My first thought when I read that headline was "Wow, good luck with that."

I do not know Stephen Diehl but I hope you're right about his capabilities, it would definitely be exciting to see that in Haskell!
What is an "adult language"?
FWIW, I have relaxed my opinion on web apps a bit ;) I do think that it's not a strong point, but there are places swhere it could make sense. Especially with some more libraries. I thought I made a comment more recently than https://news.ycombinator.com/item?id=10312354 , but whatever. :)

But the general point does stand: languages have different strengths, and that's totally okay.
I Am Robot: (Deep) Learning to Break Semantic Image CAPTCHAs [pdf]
Not really, it doesn't mean 'completely ignore your competitors and sell their products on your own store', it means 'Develop your products by listening to what customers tell you and not by watching and copying what your competitors do'.
My biggest concern with the precedent the Nest decision sets. What happens when a company disables devices with health and safety implications?

At the edges maybe a company disables a refrigerator -- or worse smoke alarms. At the core is bricking a medical device such as an insulin pump.
It is called provisioning. How you created 100s of hosts in first place? Use same tool.
Slide library solution featured on Product Hunt today
Nest and the Internet of Broken Promises (and how to fix it)
Airbnb's Brian Chesky on Y Combinator's Success Stories [video]
Burr and Feinstein: ‘To Hell with Encryption'
That is a false choice that the Clinton campaign would love for you to believe. In actuality, the FBI investigation alone would have derailed any other candidate, now this... For all the talk about Trump being teflon, it sure seems Hillary has the some of the same "teflon-ness"

Sanders has won 7 out of the last 8 primaries and yet Clinton, with all her legal baggage and ethical issues, is still the presumed frontrunner.
Apply HN: AskWhen – An Executive Assistant for Everyone
We’re building a calendaring system that treats people's schedules as a constraint satisfaction problem. Most calendaring software (gCal, Outlook, etc.) does an excellent job of ensuring people know when & where they are supposed to meet and aren't double booked. However, they do a poor job of ensuring that people are able to make the best use of their time. Indeed, one of the main tasks of executive assistants is to play "Calendar Tetris", actively managing the schedules of busy executives in response to new meeting requests and an exec's high level directive as to how they want their days to be structured.

In contrast, with our system, a user specifies with whom they want to meet and a time frame in which a meeting needs to happen. Our software will then automatically find an opening, adjusting participants' schedules as needed to make space for the meeting. More generally, our software takes the place of a calendaring assistant: users paint a broad picture of how they want their days, weeks, and months to look (ex. what gets priority, when meetings need to happen, who needs to be invited, where meetings should be held, etc) and we work out a specific schedule that best fits those needs.

By understanding the “who, what, when, where, and why” behind each calendar event, we’ll make sure people spend less time coordinating, and more time doing.
BMW launches ReachNow car-sharing service in Seattle
Out of curiosity, what makes "What to do when a Chinese startup clones your website?" different from "What to do when another startup clones your website?" Is it just a matter of legal jurisdiction? Or is there some other element here that makes it more nefarious?
PyPy: Warmup improvements: more efficient trace representation
I'm familiar with all of this. It's not necessary to run just a track day. Insurance is dealt with already, etc.

There are, however, almost no vehicles actually set up for this, so the first thing that is needed is a place to test the cars and for people doing this to talk to each other.
Cycle of Reincarnation
<i>We'll take a small portion of the investments we receive and put it toward paying operation/capital expenses. The rest of it goes toward boosting our USD reserves. I won't get into specifics because I don't have the specifics worked out. Even if I did, they'd be boring.</i>

OK, but this could get problematic. The costs of operation and infrastructure will not be trivial, especially as the project grows beyond the bootstrapping phase. Have you considered the option of a dedicated trust fund to maintain the project's infrastructure that is supported by a not-for-profit organization?

As I understand it, the principle behind this currency is that it decays, and thus people will prefer to spend it first, otherwise it will expire and convert into USD at the account's reserve rate. So say I have $100GD at an 80% reserve rate, when it expires I will then have $80 USD. But, I may also have a basic income of GD trickling into my account and I can buy GD with USD at the pegged 1 to 1 ratio, or buy FGD at the speculative market rate.
A pull request for Silicon Valley's broken hiring practices
One more point: We've applied for a trademark on our logo which includes the blue flash icon a couple of months ago, but the process is not completed yet by the government agency in charge.

Some background on our startup:
We have secured regulatory approval for real-money 1v1-matches and are rolling this out for US / EU in the coming weeks. We are working on an app aswell. The large US VCs think we suck, but we're doing it anyways.
Building a 32-Thread Xeon Monster PC for Cheaper Than a Haswell-E Core I7
For me, the breaking point were ads that expanded to fill the screen, or that autoplayed something loud. I hated searching a page for the little ad that was blasting me in the ears. Then, once you realize that seeing ads is actually a choice, why would you ever go back?

"We need you!" or "We're better now!" is a hard sell after all of that brutal, personal experience.
Toyota Partners with Microsoft Azure to Launch “Toyota Connect”