skysight-inc/HackerNews huggingface dataset:
1.

Banning a /64 prefix is not a bad idea if you are getting hit hard by botnets running on IPv6 that are within that same /64, maybe go up to /48 if required.

Officially a /64 is a single site, you can equate it to a single IPv4 address that is being used as NAT gateway.

2.

You mean the "fake" NTP servers that record the information? Clients should be running firewalls anyway, and endpoint security is as important as before. Also, CPE should be running an firewall that disallows all incoming traffic, and only allows outgoing. NAT-PMP or UPNP can be used to open up ports as necessary. Although the standard does need to get fleshed out a little more.

None of this has changed BTW, in IPv4 this was and is best practice too, NAT/Firewall on the edge does not protect devices, and devices inside should all be running firewalls and the like as necessary.

Clients like OS X/Windows/Linux that are running desktops should be using privacy addresses, this would allow them the ability to move from IP to IP over time thereby alleviating the "one static IP for life".

3.

Except that in a lot of cases ISP's will happily give you a lease for a DHCP that can be renewed over and over. I've had my current IP from Comcast for a little over 2 years now. No recycling going on there...

Recycling IP's is a false sense of security anyway. IPv6 with privacy addresses makes this simpler though. Hop away... now you can have a new IP address every 10 minutes...
I don't disagree that de facto it makes it easier to have a company sponsor you since they know who are a good worker. I just wanted to point out that in regards to the GC application it has no influence.

Do you happen to know if all your co-workers got their residency through employment ?

I only know one H1B who is attempting to get a GC through her company, she started the process 3 years ago and is not done yet.
> an audit log of all transactions it has authorized, that log should be cryptographically verifiable to be append-only (think blockchain but without all the Bitcoin connotations)

A blockchain related technology is overkill, you just need forward integrity: http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.111...
Windows works fine for me, if I have any issues with it. It's due some anti-virus slowing things down and windows search service
Are you aware that unlike musicians, academic researchers don't get paid royalties on their publications? A list of prestigious publications on one's cv leads to funding and job opportunities regardless of whether anyone pays to read them.
Sci-Fi Assault Rifle P.2 – 3DS Max – Speed Modeling – Meto Petkov
My favorite is the date, where you months are 0 to 11, and days are 1 - 31. Along with optional semicolons, and there's this[1]:

true == 1 → true

true == "1" → true

false == 0 → true

false == "0" → true

false == undefined → false

false == null → false

null == undefined → true

"\t\r\n" == 0 → true

"\t\r\n 16 \t\r\n" == 16 → true

"\t\r\n 16 \t\r\n" == "16" → false

var a = "foobar"

var b = typeof a → 'string'

var c = a instanceof String → false

[1] https://whydoesitsuck.com/why-does-javascript-suck/
Interestingly, family pressure to euthanize is a major practical concern for countries with euthanasia.

The point is actually that there is no distinction between taking your life own or someone else's. If consent is our metric, dueling is permissible (with societal pressure safeguards, if you'd like). Consent is irrelevant, the issue is that intentional killing should be a relic of a more barbaric past. The cure (resolving psychological distress over having a painful death by being willingly poisoned, often in front of your family) is worse than the disease.

Ultimately, you're saying that it's permissible to kill when a terminally ill patient would "live through misery", where someone who is not the patient defines what constitutes "misery". Am I understanding that correctly? On what grounds would that not apply to, for example, a severely depressed homeless person suffering from substance abuse, who a doctor might judge has much more suffering in store for them than a cancer patient with access to painkillers?
I completely agree. As I said in another response, it is de facto easier to find a company willing to invest in the GC application if they know you're a good employee. But it doesn't not simplify/expedite the GC application at all.
Not really.

Take the linked-list case for example. Let's say the allocator you have is a small-block allocator, of which most good malloc implementations use for linked-list style allocations.

Since the SBA allocates in chunks your cache locality(driving your "constant-factor" performace) isn't linear any more. It'll change in jumps & starts as you break chunk boundraries. Also another class allocating in-between your linked list allocations(really common) will break up the chunk locality and now your real-world O(N) performance no longer scales linearly.
Lots of academics are collecting royalties on books.

Typically not large royalties, but they are collecting them.
Though it does not take RSUs into account, and in the SF/SV a huge chunk of the compensation tend to come in the form of RSUs.
yep I know about the "drawing as math" - it's often not that. I am not a happy bunny with their school work!
Its all good, but can Tesla deliver?

They were late with the Model X, and they're currently losing $280 million per quarter or so with only 1.4 Billion in cash remaining (a lot of it probably tied up in other short-term liabilities). And that was with 500k cars by 2020 as the plan. (Tesla has a few lines of credit that they can tap between now and then... but you can tell that the money is going to be tight)

If Tesla is accelerating plans, we can expect them to burn through even more money as they ramp up production even harder. It will be worth it of course, but this isn't an easy path for them to take. I'd expect that Tesla will need another stock offering to raise enough funds.
> I'd say the same but they've done just fine publishing anything to the App Store, which uses certs everywhere.

"Just fine" is a relative term here. It's still a shit show managing them—AFAIK XCode is the only realistic option, which makes me want to remove my eyes with forks.
Try turning off Windows search service and the default Windows anti-virus
Upwork raising their fees too high
I have yet to come across a healthcare provider -- physician, dentist, optemetrist -- who does NOT have a binding arbitration clause in their agreement. How do you avoid signing one when it has become the de facto standard?
This is a case of badly screwed-up incentives. No individual has incentives to fix the system, so they keep optimizing for how they're actually rewarded [academics --> tenure / prestige, journals --> make money, govt --> get lobbied].
Does anybody at all know what more than 2 buttons do on their microwave? I thought they were mostly there for decoration
Let's see some proof that it can't be done.
Goto in Scala (2009)
yes, i largely agree with this.

When i look at my note taking activity it works out as follows; (1) desktop use, when I'm sitting at my desk, I'll either type a note or cut from the Internet. (2) mobile use is mostly access, but creation here is usually by sharing something from another app. (3) dictation from Android Wear accounts for around 1/3 of all new notes.

(3) is quite important to me so that i can make new notes on the go. for example, today i met a friend for lunch. i dictated one note walking on the way and 3 on the way back from our chat - while these things were fresh in my mind.

Dictation from Wear works remarkably well. providing. you. say. each. word. clearly. it really helps to get around 99% correct.

Regarding organisation, you're right about this too. basically as the number of notes grows, the problem of organising them increases. People don't want to do the organising, so there needs to be a self-organising system. It's easy to see how this might be done with pictures, but for text notes, it's not so clear.

Of course, search needs to work really well too!
The other thing here IMO is if I'm a bank, and I have a 3rd party app making OAuth requests... I'll want to verify code before mass release. Or at least limit the amount of bearer tokens issued without approval (Nest does this for example).

Someone should internally want to review code, especially for a bank.
The basic issue is that Python do not have a UI lib of its own, so if you want to do anything beyond a CLI you need to introduce a third party.
(had to post this after seeing the Visual Basic post )
It's possible yes. But I think Canada is a special case considering all the special rules that exist between the US and Canada.

An H1B may be "simpler", but considering the lottery stats it's far from being a given. I surely am glad I got mine a while ago before the H1B program became so crazy, with the CAP being reached in literally hours.
MPs to review 'Boaty' [Boaty McBoatface] naming process
> It's a lottery, the most stupid way to pick who gets to enter you country.

Instead of a random lottery, rank the applications by salary (decreasing order) and take the top N. Everyone wins: company has to pay more, it ensures that the visas go to really hard-to-fill jobs, and workers get more.
Actually no. The certificate must be signed by Teller (or it's rejected) and associated with the same application as the auth token.
It's definitely a confusing situation: http://www.loopinsight.com/2015/07/24/i-got-my-music-back-at.... I wish we could get an accurate official explanation of when (if ever) local files will be moved/deleted/replaced with cloud versions.

Maybe the answer is never, but I sure am not confident about that.
Goto walmart, buy a wallet. Put $1.50 inside the wallet. I will buy the wallet+cash from you for $2.

How much is just the wallet worth?
The original Siri app acquired by Apple was more useful than Siri in its current incarnation, so this headline doesn't really say much.
I don't really think GTK is that difficult to get a grasp on with composite templates. It's a little less "magic" than VB6 since I'm not just dumping code into a partial form class where the rest of the accessors to the COM controls are generated for me, but it's pretty straightforward in Vala right now (I use glade to design a UI, much like the classic WinForms designer - annotate a class with a GtkTemplate attribute and then put GtkChild attributes on class members to have the widgets automatically assigned there).

In Python it'd look like

@GtkTemplate("my_window.ui")
class MyWindow:
@GtkChild my_textbox

@GtkCallback
def button_clicked(self, btn):
my_textbox.text = "Hello, World!"
Could you elaborate? I'm honestly interested in how you came to that strong conclusion. What policies exactly are being applied towards boys?
I started with MBasic on a Superbrain running CP/M, a very early ancestor of GWBasic and QBasic.

I wouldn't start kids on Basic now. My daughter is learning Simple Basic at school, but we use Macs at home and the only way to run it is in a Silverlight container. All the variations of Basic I know of are too restricted. Don't get me wrong, Basic back in the day was is a fine learning tool. The fact you could PEEK and POKE memory and DIM arrays actually taught you low level programming and system concepts that are abstracted away by modern languages and environments. Those early Basics were truly suspended part way between high level languages and machine code.

I appreciate the advantages of JavaScript, but also it's flaws. Learning to pop up alert messages is a cool hack, but beyond that it gets messy fast.

Scratch is fantastic. It's cross platform, can run in the browser and specifically designed to be very visual and intuitive. You can watch the code run. Brilliant.

Beyond that though a learning language needs more. It needs to be cross platform, support both procedural and object oriented forms and be capable of text, graphics, UI and web programming. For me that means Python. It helps that I've got pythonista on my iPad and phone. On the desktop there's also Jupyter notebook.

At the end of the day though, teach what you know and what you enjoy. All the technical arguments in the world can't beat passion.
My understanding is that often the "public" job postings are posted to places where no qualified American tech worker would look, like newspaper classified sections.
HE loves you more than he loves himself? who?
[Question] Node.js Request – Can`t Decode HTML Page
The main complaint about OAuth 2.0 seems to be that bearer tokens are a bad idea. Well, you can implement OAuth 2.0 to use any kind of token you want, with any property you want. People do bearer tokens because it is easy, not because it is required.

The secondary complaint seems to be that OAuth 2.0 is a mess. That one I heartily agree with! A few years ago I wound up having to figure out OAuth 2.0 and wrote http://search.cpan.org/~tilly/LWP-Authen-OAuth2-0.07/lib/LWP... as the explanation that I wish I had to start. In the process I figured out why most of the complexity exists, and whose interests the specification serves.

The key point is this: OAuth 2 makes it easy for large service providers to write many APIs that users can securely authorize third party consumers to use on their behalf. Everything good (and bad!) about the specification comes from this fact.

In other words, it serves the need of service providers like Google and Facebook. API consumers use it because we want to access those APIs. And not because it is a good protocol for us. (It most emphatically is a mess for us!)
How to design HTML5 games
Grandpas know BASIC and they can teach any version of it to their grandkids in under 2 weeks tops, they don't necessarily know Jupyter notebooks or Mathematica (how much does that cost these days?).
Oh, I don't think the entire industry will be. There's a large class of necessary & billable activities that the blockchain doesn't impact. But transaction / settling fees aren't zero revenue either.

The more immediate explanation was probably "he or she or they knew the first use was going to be facilitating illegal transactions and didn't want to be associated."
From the first blog post:

> Files are represented by strings

I think it's especially true for make - looks like it was designed to efficiently express operations for transformations of the same type (like .cpp -> .o/.obj). So in different use case it may become a bit clumsy to use. Ninja should help a bit in this case - you can define a rule, and just use rule name when defining inputs and outputs of a build statement, though it still operates on files.

>[Problems with] combinatorial dependencies

Yes, partially this could be fixed with wildcards in make. Ninja doesn't have wildcard support, so I've created the buildfox [1] to fix it :)

>Non-representable dependency structures

I think it's a limitation of this type of build systems, their configuration language oriented on expressing "how" to achieve things, not "what" to achieve.

- [1] https://github.com/beardsvibe/buildfox/
This could be said about any new product, and is the basis of FUD. Characterising this merely as "honest even if self-interest" is a mistake. The balance of evidence is clearly that the known health benefits of switching from cigarettes to ecigs greatly outweigh the hypothetical unknown risks.
It's not so much the presence of those signs -- we are all at least a little selfish, it's the intensity of them.
The quota is set by Congress. It was 65K for many years, but I hear during the bubble it was temporarily increased.
I wish these guys worked on sounding less crazy. I agree with their point here: software does stuff we don't like and dot-gov has a responsibility to review third-party code. Linking that to an 'all software must be FOSS' argument starts to get nutty.

I make money by selling software. Does that make me a pariah to the FSF? I've never been sure. I still want to donate money to preserve their unique voice, so maybe the answer is that you have to be a little crazy to do their job.
Why bad news? Is basically irrelevant, now that he has turned out to not be Satoshi. The only way it would be relevant is if one of those early coins does indeed move, because that would drastically affect the number of coins on the market.
Yes. Unfortunately water desalination requires a ton of energy but you can use the sun directly.
does angular2 support preloading data/setting initial-state, such as by server-side templating?

if not, can i run angular2 in, say, nashorn to generate view data?
Isn't TK usually part of the standard library? Of course, then you have to build your UI in code, which can be a lot for a beginner - which I why I stated QML or GTK Composite Templates, both allow you to design your UI in the relevant tool (QtCreator, Glade) and then just wire it up. Speaking from experience, the trial and error of creating UI's in code instead of through a markup language with an editor that can preview it is a pain.
Interesting. I'd interpreted it as "we'll start small this time, and adjust things for next time, if there is a next time". Usually an experiment (in science) implies that you don't change the conditions of the experiment while it's running, you let it run and record the results, whether they're positive or negative. Otherwise, you limit your ability to be surprised, which is the whole point of science.

It gets a little more muddled with social experiments, where it's often hard to delineate an "ending point" of the experiment, and there's often real collateral damage in the process. Even with social experiments, though, you get a more accurate signal if you let them run past the point where your gut tells you it's a bad idea.
I get that the overhead of an individual message over an individual connection is lower, but for that efficiency you give up layer 7 routing capability, make load balancing difficult, have more long-lived connections to your servers. Does HN generally feel like these are worthwhile tradeoffs?
To be honest I don't think modern languages are all they are cracked up to be. Back in the day, very large and complex systems were managed quite well with languages like QBASIC, COBOL and FORTRAN, and ran rock solid for decades (hell, a few are still operational). But today, programming is such a polyglotic mess and conceptual navel-gazing nightmare -- it really is no wonder that so many projects end in failure.
but what if siblings do? or parents? aren't they basically giving out the rest of the family, too?
New and fast emulator to run Android apps and games on your computer
I don't much care for Angular, but this is some seriously beautiful documentation.
Their description of the MITM attack is entirely dependent upon how the authorization server validates redirects in the implicit and authorization code grant flows. This is tied to how client registration is performed. So, if you want to ensure that the authorization code or access token is only delivered to a redirect URI that is trusted, that should be part of the policy enforced in your infrastructure... More specifically, you can require domain verification and validation as part of the client registration process, and I would expect that at a minimum when dealing with delegated access to financials.

Another alternative to this would be to perform an OOB flow, wherein the redirect URI is actually hosted on the authorization sever itself and the client can scrape the access token from the Location header.
1. Is an awesome idea. Will it work for the tail-end of the log where most maliciousness will occur? The scenario I see is the hacker grabbing the log, and appending transactions to its copy of the log. When you go to contest those transactions, the bank will have a longer log than what your client has. Don't get me wrong there's a lot of use-cases for this: You received a confirmation that a transaction was cancelled but the bank said it didn't happen: In this case you have proof through the signed log that in fact it did happen.
But why just google the name of the office and find the correct link when I can throw my hands up and say "fuck this" on a pseudo-anonymous internet forum?
Apple Security Guards Kicked Cupertino’s Mayor Out of Its HQ
This is unnecessary. Many banks can and will enforce 2-factor authentication with their oauth flow, which sufficiently validates the client and would prevent a MITM attack.

Your whole premise is surrounded by the threat a client browser would not properly validate a server certificate... come on... really?
My first DDoS attack for a $200 ransom
After Moore's Law: Predicting the Future Beyond Silicon Chips
I'm not sure suburban density is enough. I live in Fairfax County, VA, which has a population density of 3,000 per square mile (about the same as Seattle). They recently extended the Metro out here. Getting to any of the stations, however, is impossible. There are more new Silver Line stations than apartment buildings within a safe and comfortable walk of them (they're surrounded by a scary wide major thoroughfare). I think you'd have to double or triple the surrounding density for them to be worthwhile. I think 8-10k per square mile is the magic number, and there aren't a lot of places in the U.S. that hit that.
Alternately, remove the need for highly skilled workers to get visas entirely, thereby completely preventing companies from abusing the system.
TeachCraft (Python) discussion https://news.ycombinator.com/item?id=11599714
In my opinion, having worked extensively with OAuth2 (mostly in the form of OIDC) and other modern AuthN/Z protocols, the author of this post does not truly understand OAuth 2, nor have they looked in any appropriate depth into supplements like OIDC or alternatives.

For one, bearer token [1] is only one type of "Access Token" described by the OAuth2 spec [2]. In fact, the OAuth2 spec is very vague on quite a few implementation details (such as how to obtain user info, how to validate an Access Token), which the author seems to just assume are part of the spec, as he does with bearer token. Other parts, like the client/user distinction, and the recommendation for separate validation of clients, the author ignores completely, generating his own (ironically mostly OAuth2-compliant [3]) spec.

> Shared secrets mean no non-repudiation.

Again, not true. Diffie-Hellman provides a great way to come to a shared secret that you can be cryptographically sure (the adversary's advantage is negligible) is shared between you and a single verifiable keyholder.

> Most importantly using JWT tokens make it basically impossible for you to experiment with an API using cURL.

sigh. If only there was a way to write one orthogonal program that can speak HTTP, and in a single cli command send that program's output to another program that can understand the output. Maybe we could call it a pipe. And use this symbol: |. If only.

> OAuth 2.0 is simply a security car crash from a bank's perspective. They have no way to prove that an API transaction is bona fide, exposing them to unlimited liability.

TL;DR: This article, led by comments like this ("unlimited", really?), strikes me as pure marketing (aimed at a naive audience) for a "spec" that probably would not exist had proper due diligence into alternatives, or perhaps some public discussion, occurred. At the very least, inconsistencies (a few of which I've mentioned above) could have been avoided.

[1] https://tools.ietf.org/html/rfc6750 [2] https://tools.ietf.org/html/rfc6749 [3] https://tools.ietf.org/html/rfc6749#section-2.3.2
OK yeah that does make sense. I had that on earlier but my google Drive quota ran out. So I switched to 'High Quality' (reduced). Maybe that's why I do not get the original pics.
Boaty McBoatface: MPs to quiz NERC head over ship naming competition
Consider using an HTML5 canvas (with a 2D rendering context) instead of DOM manipulation.
It makes programming very similar to QBasic's LINE, CIRCLE, PAINT.