skysight-inc/HackerNews huggingface dataset:
It's high time some of these compliance groups got together and had a good hard look at themselves.

It's been years since desktop signature-based antivirus provided a significant improvement to security. Every time there's a cryptolocker outbreak, I see people scrambling to make decisions like "we need to replace McAfee with Kaspersky", as though they feel that's their answer.

When you try telling an insurance auditor "we have a whitelisting application, nothing runs unless I've approved it, products like Symantec Endpoint are unnecessary in that environment", you first get a confused look, then you hear "ok, so you're DON'T meet the minimum basic security requirements, let me write that down".

It's gotten to a point that it's actively part of Intel Security's advertising, with a recent partner promotion pushing to "help your clients meet their compliancy requirements". The brochure never even mentioned actually securing anything, just how it ticked various boxes.
Matplotlib Tutorial: Plotting Tweets Mentioning Trump, Clinton and Sanders
>They say they are increasing the security by things like this: disabling user-loading of new firmware (which could be a bad actor loading bad firmware), using hardware with built-in side-channel countermeasures, and disabling JTAG ports (which could be used for key extraction).

Are all of those listed features only possible with secret code? And if yes, once someone unobscures the code or methods, they'll be able to defeat the security. Isn't that the exact definition of 'security through obscurity'?
my fear is that we see more plastics replacing glass/cans due to to the logistical issues of delivering the last mile
Introducing and Open Sourcing Ambry
Uber, Airbnb, SpaceX, Tesla are not unicorns any more than Google, Facebook, Netflix, Priceline and Amazon are.

Uber is seven years old, Airbnb is coming up on eight years old, SpaceX is 14 years old, Tesla is 13 years old. And they're all very substantial enterprises at this point.

I'd suggest that companies of that size and operational maturity should be considered to be well beyond the semi-early stage billion dollar valuation companies that have tended to get the unicorn tag. They were unicorns, now they're just like Netflix or any other established company.
Here are 6 Japanese hard tech startups with global ambitions
I fully agree with the sentiments here. For all intents and purposes, I think that block style languages might not be the best way to introduce programming - I'll have to say that Bret Victor's Learnable Programming makes much more sense (http://worrydream.com/LearnableProgramming/)

However, there is no (to my knowledge) better way to introduce programming in an easy 'non-keyboard' way than blocks. I ask this because I'm currently brainstorming ideas for tux4kids (an open source educational suite for kids - yes tux as in the linux mascot), and we've come to the conclusion of using block structures (since the game has to be playable for mobile too). Unfortunately, we've come no better than 'move here, use functions' a la Lightbot (lightbot.com)

It's quite timely that this has been posted here, since we're still brainstorming concepts and I wanted to take this opportunity to ask - what would you suggest for a 'programming game' for kids?
How the Soviets Stole the Space Shuttle
>> "You can't buy security, but you can learn it: http://decentsecurity.com/#/introduction/"

I think that's an incorrect standpoint to take when you factor in how technologically agnostic most folks are. I would better think of it as "security is default, but you can disable it if you really, really want it that way."
I believe they will compete more with Aldi and not regular grocery stores that offer everything.

As long as grocery stores still offer fresh fruit, meat, deli, florist etc...I will go there. If I need a box of cereal I will spend the extra $.50 for the convenience.

But on a day I just need basic necesities, Aldi or Amazon here I come!
This might be a far out question, but is there a connection/analogy between the SVD approximation and a fourier transform+low-pass filter.
>>Cisco and mobile manufacturers vs Huwei to see how big of a market share that can lead to.

Implying the Huawei is the "cheap knock off" and Cisco/Apple/Samsung/etc are the noble high quality product fighting the good fight....

My Hauwei Nexus 6P has been the best phone I have ever owned, far exceeding the quality and usability of every Motorola, Samsung, and other phones I have owned.

As to Cisco, after their fasco with the NSA I would not trust them at all for security.
I find gitx is pretty good.
I feel really stupid when I try to read tweets because half the time I can't figure out what it actually being said because either there is context missing or there are odd abbreviations... or idk... :(
Security isn't the default, though. Specific example: SMTP.
just as a counterargument to the "unfairness of unattractiveness"... that attractiveness is desirable isn't "unfair", it's just the definition of attractiveness. If physical attractiveness didn't matter, "overall losers" (by whatever definition) would complain that wealth, intelligence, charm, IQ, education, social class, or whatever else shouldn't matter either.

It just seem like people are demanding a world where we'd all just screw whoever we bumped into, or nobody or... what, decide it by the roll of a 20 sided die?

That we have attractiveness might be seen as an interesting thing, like we have delicious foods and beautiful art. Of course, nobody wants to lose on any score, but people do like winning, and winning by its nature creates losers.
For the last part, having mixed-zone development is essential.

Put housing above supermarkets! Offices inside apartment complexes! Make it easy for people to walk around.

I think that people don't need convincing not to use their cars... it's more that the space needs to be built in a way to where cars are not necessary.
Maybe code on the REPL is being evaluated with strict mode on?
International Space Station Reaches 100,000 Orbits, Deploys Cubesats
Forget employers, most people's experience is with government employee unions. 35.2% of public sector workers in the US are in unions, only 6.7% of private sector workers. They are particularly powerful in local politics, and there is a history of negotiating benefits with the politicians they elect that become unaffordable in the future.
I've been hearing it's inevitable for all my life (my family left when I was 1 in 79). Who really knows and can say for sure? What's it going to take for minorities to enjoy freedom there, let alone any kind of regime failure as you alluded to.
The bona fide value of Technical SEO
I understand where they're coming from. Though it would be even braver for them to get into the IC design game, and make a chip with the properties they desire. They can then publish whatever they would like about that chip.
No, Warren Buffett didn't buy Apple shares, or bid for Yahoo
Life Is Beautiful: The Startling Consequences of Three Simple Rules
I'm also a happy user of SSL Labs and reader of Bulletproof SSL and TLS. One very cool thing about the book is that if you purchase the hard copy (I got it from Amazon, for example), they'll email you epub, PDF, and web versions for free. The web version is perfect for reference at work. And the book gets updates too (http://blog.ivanristic.com/2015/08/bulletproof-maintenance.h...).

Thanks Ivan!
The teachers and firefighters formed unions in the face of withering hostility from management? About half of US union members are local, state, or federal government employees.
You don't know why they use interpreters? It's for the combo of security and app development. Just like long ago, the development of a high-assurance MULTOS or JavaCard system means you certify the interface one time. Apps get to build on that into an ecosystem. Then, only new implementations of that have to be certified [in theory]. MULTOS requires it while I think it's optional with JavaCard. I have less clear answers than most since I don't sign the NDA's either. At least let me reverse engineer and post some answers. ;)

Regarding DES, the smartcards and HSM's were originally developed for use by both government and financial industry. They originally standardized on DES then used 3DES to reuse their HW and SW. It was one of few tradeoffs that made long-term sense given a three, key version of a 1975 algorithm is still secure in 2016. That's 41 years of security through variants of that algorithm. Unheard of in our industry. That you call 3DES, itself going strong almost 20 years, something that should be repellant shows the difference between security-critical sector and mainstream. Former prefers what's proven longest with latter preferring what's popular and good in theory. Both AES and 3DES are valid choices given peer review. That their money-makers came from 3DES customers made the best choice obvious.

Regarding NDA's. A HW guru that taught me what I initially knew on the subject mentioned patent suits. He said his company refuses to do business in the U.S. since those companies get sued into the ground. There are so many patents on HW, esp microarchitecture, that it's impossible to avoid all them. So, he said keeping things as trade secrets was a common strategy of smaller firms to reduce legal risks and ensure profits. Also, reduces copying and attacks by hobbyists. And of course they didn't say "hides infringement" in the datasheet. :P

I stopped there since I think these should address your concerns. At the least, it should start to make sense what those companies are doing whether we like it on our end or not. Personally, I'm more a fan of Caernarvon OS for smartcards as one of the inventors of INFOSEC (Paul Karger, grandmaster of high-security) made it. Look it up for interesting lessons on what smartcard OS's deal with in terms of development and certification difficulties.
Finally asp.net core RC2 released
A1: Yes, both of those behaviors are creepy.

A2: No, attractiveness would not make either interaction feel normal. In the first scenario a complete stranger in a business interaction is hitting on someone. Not just light flirting but implicitly inviting the person over to their house. Creepy even if the creep is attractive. In the second scenario the student is exhibiting deviant behavior by making a sexual advance on a married person. After that he tries to maximize forced contact with the TA, again, creepy no matter what you look like.

Since you mentioned witnessing creepiness: When you watched these scenarios play out, did you get creeped out yourself? I ask because I'm a man and the most I've ever felt creeped out would be when I was witness to an interaction a classmate of mine, a woman, had. Vicarious discomfort, if you will.
You have to account for the converse: conducting an operation can start many others.
It's true that a 2D discrete FFT can also be used to produce an orthogonal expansion of an input matrix, but a truncated reconstruction using it (like a band-pass filtering) won't have the rank properties (e.g. optimal low-rank approximation) of a truncated SVD-based approximation.

They are relatable in many ways if you are interested in data filtering and analysis (viewing matrices as data structures rather than as operators in a function space). Generally the SVD is nicer to have, but the FFT is easier to compute (O(n^3) vs O(n^2 log (n)).

Another way to think about them:

An FFT will describe your data in terms of a fixed orthonormal basis: sine and cosine functions of varying frequency.

An SVD will describe your data using a basis that is also orthonormal, but is entirely based on your data.
Untrue, at least in the case of my 9 year old. He loves writing Javascript "apps" from bitsbox (bitsbox.com). I learned by poke'ing on an Apple ][ because that was the tech of the day. Apps are the tech of the day for kids and he loves seeing the things he can create.
Good point to bring up. The threshold varies from person to person. In my case, it was the act of posting a comment that focused on one line of code and stating it not being pythonic. Without offering an explanation of why it's not pythonic or offering samples. The line would pass the PEP 8 guidelines because it used a wildcard import when an explicit import statement is preferred. Rather than:

from module import *

It should be:

from module import Foo, Bar
In this case the subjects were given substances in a lab and then used a driving simulator.
> disabling user-loading of new firmware

Am I understanding correctly that these devices can never have their firmware updated? That there is no update mechanism seems insane. They could prevent bad firmware updates by wiping keys on upgrade. The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever.
The code is BSD licensed but TrustZone and probably this reference firmware for it are mostly about DRM.
Http://www.bromium.com is a new take on security providing full sandboxes for applications.
A review of the Atlanta startup ecosystem
Maybe not drugs but I wouldn't bet against them on medical devices.
The author may be saying tabernac!
Isn't this like Kippt?
Digital wal mart is coming for our grocery stores.
A very good change i feel is asp.net core is now just a console application executing asp.net core libraries.Lot of benefits
we can easily self host
same .net cli tool chain *compiling your web application to native eventually
Cross platform isn't there yet though. I'll definitely give it more thought, especially if it does cross-platform GUIs (something Go does not have good libraries for).

That said, Go's tooling, documentation, and ecosystem are much friendlier than Swift's. And since most of us spend more time doing that stuff than actually typing code, it's an important point for me in the comparison.
> what's the point of explicitly declaring functions "async", and then explicitly saying "await". IMHO all this could be done automatically by language.

Not without Fibers. Javascript doesn't have Fibers though there an implementation in Nodejs.

What it changes is that you don't have to rely on yet another library anymore to get the behavior people mostly use yield for. I'm talking about co/thunk . While it doesn't solve the red/blue function issue [1], it makes writing async code a bit less tedious.

At the end of the day it will force everybody to return promises from async functions, rather than requiring callbacks,which is a good thing.

[1] : http://journal.stuffwithstuff.com/2015/02/01/what-color-is-y...
>Increasing their market share relative to android in any significant way seems incredibly unlikely to me at this point. As technology stagnates (as is happening with smart phones), the premium products lose cachet and the lower-end products start to achieve parity with their premium competition.<

Counter-example in a mature industry: Porsche. When the GTR was launched 9 years ago, people were hyping it to be the death knell of all other performance cars. Instead, today we have a wider selection of very good cars and the GTR is no longer the no-brainer choice for performance enthusiasts. Yes, it still offers good performance-value, but there are other good choices out there as well. Of all the car makers, Porsche was thought to be the most severely impacted by the GTR and yet they have gone on to greater heights.

>The two markets where they could still theoretically hope to achieve more growth/penetration are China and India. But China has been antagonistic to them of late, and has demonstrated an interest in protecting its own incumbents who are now making phones that even Westerners will buy (e.g. Huawei)<

How much money is Huawei making from selling Android phones? What about that Google ad revenue in China, how's that doing?

>Not to mention that the CEOs of both Microsoft and Google (the only two competitor platforms to the iPhone) are currently Indian, and both companies have demonstrated a specific interest (especially Google) of expanding in the Indian market. And I think that gives them an advantage that's hard to overstate.<

Microsoft's chances at mobile at this stage are as good as Ted Cruz's winning the Republican nomination. Some number closer to zero. Again, how much is Google making from Android phone sales? How are the Nexus sales numbers?

Google's competitor is not Apple. Google's competitor is Facebook. Luckily for Google, Facebook is banned in China too.

>I certainly no longer feel compelled to have the latest and greatest phone right away, and it seems to me that most people feel the same.<

The smartphone is a very interesting product. It is used multiple times a day, is cheap enough to be ubiquitous yet still offers value to people who seek to differentiate. In my view this is only the beginning of the smartphone race. Technologies like NFC/Apple Pay are still in their infancy and are not widespread enough. There will be more sensors, better imaging technology, more features that people would desire.

How the differentiation is implemented, matters. You will not find someone cross-shopping Hermès with Coach. Similarly the large majority of people will not cross-shop a Ferrari with a Nissan. That is not to say anything about the value of the brand. It just means there are different markets being served.
What questions do you feel should be asked?

Lets Encrypt asks one question without you having to deal with it - the question where you prove you own the domain by placing a file in the webroot. This is just as much proof as the email verification you get from existing strategies. Except it involves less headache, because you aren't ordering from namecheap, then getting emails from @comodossl.com that fail SPF checks asking you to click links.
Indefinite prison for suspect who won’t decrypt hard drives, feds say
Got a link to those RISC-V based Arduino boards?

IIRC the RISC-V ISA itself isn't finalised so I would be surprised if people were manufacturing it already.
Might as well just read from /proc/cpuinfo
I'm sure there's good reason, but I have the same question. I also don't understand the need to use promises in the construct. I'd love some clarity here.
My opinion on this is that physical security is paramount. Your threat model can't possibly eliminate all threats from an adversary that has physical access.

No hardware is 100% secure and for Yubico to say this issue is about "Secure Hardware vs. Open Source" seems like a red herring. Perhaps they are just trying to protect their business model? After all, there isn't anything particularly unique about the hardware.
Yep, it's our plan to do something like that with community help - have a PR open for discussion at https://github.com/babel/babel/pull/3476.

Also https://twitter.com/samccone/status/722826060161617923.
how would that work?
>The Q promises API, to me, is the right way to reason about asynchrony. Once you understand closures and first class functions, so much about complex asynchronous flows (e.g. multiple concurrent calls via Q.all, multiple "returns" via callback arguments) become so simple.

Being simple doesn't make them optimal.

Promises are a clutch for lack of a built-in language feature, and async/await is that.

They add extra visual clutter, they can eat exceptions [1], they break the intuitive flow of code, etc.

[1] Yes, only if they are used badly. That's kind of the point. C is an excellent language too if everybody never uses it badly. The thing is people do, and a feature/language that doesn't need a corner case or mental model to keep in mind is better than one that does in that regard.
Check out Tweetdeck's search columns.

You can still write scripts that use the API. But it's rate-limited.
I think what Yubico meant is that they aren't closing code for the sake of closing code, but since it can't be loaded onto the devices anyway, there's no need for the code to remain open.
we use it at Avant
I was asking if the things that they are buying are fairly described as buying innovations.
> The risk now is that some firmware version is discovered to have flaws, and that device is vulnerable forever.

This happened last year and they offered free replacements for affected users[1].

[1]: https://www.yubico.com/2015/04/yubikey-neo-openpgp-security-...
You don't have to actually post anything. I use Twitter to consume information, not to blast it. Sometimes I'll retweet a project or maybe post an interesting bit of code, but that's unlikely to attract any negative attention. Avoid posting or retweeting contentious information, you'll be fine.
That's an accusation and implication. The Chinese strategy, which isn't entirely secret, is to use their hackers to get trade secrets out of firms in all kinds of sectors to hand to their own firms. Each time, their firms leverage those as a head start on their own products which combine their own innovations, labor advantage, and money from vast market in China. It's a proven model. Far as Cisco and Samsung, it's been clear Huwei has been knocking them off the same way.

Besides, what are you even questioning given that Huawei admitted they had and removed Cisco source code? Of course they robbed them. :P

"As to Cisco, after their fasco with the NSA I would not trust them at all for security."

Which is totally irrelevant to my point that cloners... especially Chinese cloners... will make knock-offs of a hardware product in any country that hurt that company's business if the product is worth it to them. The NSA collecting secret information to determine if you're a terrorist, felon, or threat to foreign policy != Chinese intelligence giving your competition your I.P. who then operate in your market with cheaper labor. NSA is a hypothetical threat for most companies whereas Chinese tech and labor market have been doing my country (U.S.) in for decades with many companies achieving parity or dominance in some sector through stolen I.P.. It didn't help that idiots running our companies put R&D centers over there to reduce labor costs. (rolls eyes) Such stuff is an existential threat to small, hardware providers worth cloning given what Shenzhen can pull off.
To correct this a little, the proper way to catch with promises is .catch, not with a try-catch inside a .then - that is an antipattern. The promise examples as written are not proper promise usage.

I'm also in the boat of confused people of why is async-await requested by a good portion of the js community - wrapping the block within the function in a try-catch seems like a bad idea, a brute force mechanism. IMO this is language bloat, and does not really solve problems we have while introducing a more expensive vector for managing flow (try-catches).

One missed point about the .catch with promises is that it allows you to branch flow discretely - it is not a perfect solution for branching flow (it is awkward when branching due to more than just a binary outcome), but with await, one might end up writing repetitive code for certain flows where one expects common calls to be made downstream in async data fetching flows.
If you don't want to use regenerator and your environment supports generators already you can use the async-to-generator transform https://gist.github.com/rauchg/8199de60db48026a6670620a1c33b...
That just means low earnings. At zero earnings, P/E goes to infinity. For losses, P/E goes negative. (Negative values aren't usually considered numerically meaningful; it's customary to just indicate a loss.)
Would it?

IIRC Promise.all will run the two responses in parallel, but will not send the first into the map before both are finished.
Unicorns generally refer to pre-IPO billion+ dollar companies. Tesla is not a unicorn, since it's IPOed; Uber and Airbnb are.