skysight-inc/HackerNews huggingface dataset:
The issue is that local privilege escalation to root will always be a thing, even with seccomp limiting syscalls visible in a container. sVirt (SELinux as it relates to VMs and containers) can make sure that even with unintended root escalation you don't touch what you weren't intending to touch.

Full virtualization is preferred if this is a concern, trading off some overhead for increased isolation. But if the performance margins are thin for your containers (thus motivating the expected use of newer syscalls with increased likelihood of undiscovered/undisclosed escalations) and you're running something potentially adversarial, then take advantage of sVirt as a second layer.
I guess my problem is the information discovery. How does the average person buying bulbs in Target or Walmart know to look for this new thing? "Soft White" and "Daylight" are good terms but I wonder how you know the difference? Daylight bulbs had a bit of a different meaning in my mind, but I guess I grew up in a rural area.
As someone who hates mice and hopes one day to have this sort of tech, I'm trying to understand what you mean by "Eyes don't point at things we look at as accurate as a mouse does" - how is it that I can choose to "look at" an individual pixel on my screen, or an individual serif on a letter, and then choose another one far less than 1cm away, and my eye focus shifts to it? That shift is not detectable by a camera?

(Edit update: by "detectable" I mean theoretically detectable by a really good camera and software. In other words, it seems you are arguing the tech is impossible even theoretically due to some aspect of biology. Am I following you correctly there? Thanks)
I think you're missing the part where the money are coming from because that part does not make sense. "Who would donate money to people to not use a phone?"

What are the idea with the video above the fold? It would make more sense to use that section to explain what the app is about!

Just my two cents :)
Using Ada as an intermediate language is an interesting idea --- it's a richer language than C, and is more well-defined than C (although it still has undefined behaviour; plus an exciting thing where certain undefined values can be illegal to even look it). And it generates excellent machine code.

But getting hold of an Ada compiler is much harder than a C compiler. And in real life there's only one Ada compiler, which is gcc, and it's developed by Adacore. If they went under then I'm not sure there'd be enough people to maintain it. So you very much get toolchain lockin. (Plus of course there's Adacore's lawyerbomb in their Gnat distribution, but that's easily avoided by getting the one at getadanow.com.)

So... dunno. Try it! It'd be really interesting to know how well it works.
If you choose to use two space width tabs, and I choose to use eight space tabs, what does a one hundred and twenty column page width mean? What do your edits look like on my monitor? What do mine look like on yours?
Laravel 5 Friendships Package
Ruby is used in many other projects outside of Rails and some don't have anything to do with web development (Chef, Puppet, Homebrew, Vagrant, Metasploit, Logstash, Capistrano).
You need to be very self-conscious about how much stress you're putting on various parts of your body. All your muscles should be as relaxed as possible throughout the day. Always seemed common sense to me.
> Obviously Makinde's experience with the CEO is outrageous and abhorrent but race-related issues go very much beyond his personal negative experiences.

His personal experiences are what make the post concrete and therefore substantive. No one doubts that "race-related issues go very much beyond", but when you take a thread like this immediately into that "very much beyond", all you do is turn it into an ideological food fight.

Part of the art of thoughtful discussion is sticking to areas that one can actually say something substantive about. It's not impossible to make a more general comment on a post like this without pulling the discussion into pre-existing opinion and pre-existing emotion. But it's hard, and your comments aren't those of someone who's trying. Indeed, buzzwords like "identity politics and oppression olympics" are a sign that you're here for an ideological flamewar. That's not what this site is for.
> Controlling companies and making sure they understand clearly that they exist only at the pleasure and the whim of the government

Worked out well for the Soviet Bloc
People are much more pliable if you can convince them they have no agency.
Perhaps they meant that foreign (specifically Chinese) competition has done much better globally than those companies currently holding most of the US market.
For TheDAO itself, there's no possibility of such a dispute or resolution. There's a little bit of code that runs everything, and what it does can't be overridden. With this particular code, you get a vote in proportion to how many shares you own.

The companies employed by TheDAO will resolve things like any other company.
Ever looked into TMS?
http://www.rsi.deas.harvard.edu/mb_what_is.html

I don't have RSI but had a brief RSI-scare after some intensive typing and came across it. Seems like it helped a lot of people. Including Etherpad's founder http://aaroniba.net/articles/tmp/how-i-cured-my-rsi-pain.htm...
The speed of the zone is also in the maps database
We wrote an article about the same thing https://blog.wearewizards.io/why-docker-is-not-the-answer-to... (Tom has a background in physics as well)
Thankfully, my servers are in full appliance mode and I don't have to worry about users (they are on the FreeBSD / ZFS box or one of the OpenBSD machines). I still worry since they have pretty valuable data on them.
Hmm.. I've never tried pkg-src before. I'll give it a try.

Step 1: I have to download a gig of stuff before I can install any packages? Even though my drive is big nowadays, that still seems like a bit of a waste...

Step 2: Let's try building a package, the last thing I installed with homebrew.

> cd math/minisat
> make install clean
Makefile:27: *** missing separator. Stop.
> make
Makefile:27: *** missing separator. Stop.

Hmm.. this isn't the most user-friendly system...

UPDATE: I have to use the bmake I bootstrapped, didn't realise (and the quick-start docs didn't mention it). Now building begins, but the executable doesn't link.
At least on Fedora, for a few releases now, the audit messages appear in the journal, which is the primary system log.
I'm not arguing that VMs are not an improvement in many areas. They are a MASSIVE improvement and I'd love the unikernel apps to become more popular and push it even further. QubesOS also shows the power of safe virtualisation.

But it doesn't mean "SELinux is not worth saving". Some kind of LSM (selinux/apparmor) is still a great safety net and protects us from an issue that VMs actually introduce. Once you break out of your VM, you have access not to a single host, but to a number of them in a way that no in-VM protection can stop or even detect. That's the reason we really need LSM protection. Not necessarily selinux, but something needs to be there.
I've run into a few bangs that no longer work. I tried reporting the broken bangs on Twitter and the DDG bug reporter, but I received no reply and they're still broken.

I'm surprised DDG doesn't have automated monitoring of every bang API they use. They should have daily or hourly health check queries to confirm valid HTTP responses or even expected search results.
Probably not if you factor in depreciation on an expensive self-driving electric car. Looks like SF to Chicago is at least 2000 miles.

(Which also makes me wonder how you can do that trip in 20 hours. Speeding indeed :)
Generally, the key already exists on your system, as it's coming through the official channels. If you decide to add the cert manually, you can inspect the key and see who has signed it, and decide your level of trust.

With HTTPS, you only ever have the choice of trusting the 1000+ CAs in your keyring.
How does this work with multiple-branching sub directories?
The public beta of OpenAI Gym, a toolkit for developing and comparing reinforcement learning algorithms, was released last month: https://openai.com/blog/openai-gym-beta/
In Australia at least, pretty much every single different bulb has its colour temperature printed on the box, as well as a usually having little bar chart thing showing where in the visible spectrum it sits.

They all have descriptions like "Cool White", "White" and "Warm White" too.

It works pretty well - I haven't been disappointed in LED globes I've bought, whereas I bought a few CFLs back in the day that I couldn't stand.
If you've never been murdered, your opinion on whether murder is right or wrong really isn't valid?
> interesting statistic - 85% of student loans in India is under water ( compared to 50% in america )

What does "loan under water" mean in this context? In a collateralized loan context (car or house), "under water" means that the borrower owes more than the market value of the collateral.
There is a fellow with my exact name that used to live in the same town as I did, had a son with the same name as my son. He ran a startup and sold it for large dollars, but ended up with a giant IRS bill on the order of 8 figures.

And one of the fellows on my team worked for him before working for me.

Which is hilarious, but what was not so funny is that the perscriptions at Walgreens for our respective sons ended up tangled up and it took 45 minutes on the phone to straighten it out. After that, Walgreens began verifying your address.

Fortunately my story is mostly positive, unlike this poor fellow.
>I immediately declined, citing “severe cultural differences.”"

a good guy. An opportunist in his place could most probably have scored a nice settlement for racial discrimination after few months on the job :)
I confess to using password "sex" everywhere and pinning it to my workstations' displays. Because making hard and secret passwords is hard.
You might expect it, but if you're blindly running `curl > sh` (as recommended), you can't be certain.
White men dont have a monopoly on racism.
Does something like this exist for Firefox/SeaMonkey/PaleMoon?
For me it works this way: when I think I'm sad/depressed I ask if I'm just hungry. I can easily forget to eat, and this has consequences for my state of mind. I need to reassure myself that I'm not depressed, I just need some nutrients. Then I eat and I find I'm no longer sad.
SELinux is not opt-in in RedHat-based distros AFAIK.
I've read at least three previous articles from Wolfram where someone dies and yet he makes it all about him.

I know 'dang' has come in and said "yeah yeah, he's a nut, we know... move on" on these threads before. But this article was so different -- and so interesting to boot -- that I felt the need to say something.

You cannot address Wolfram on HN without addressing the fact that people think he's a nut. I chose my words carefully. When I've moderated huge forums (gasp!) I used similar techniques to keep conversations on track. Specifically getting in early and defusing the boring, predictable, obvious wave that's coming with a touch of humor. If my post was actually flagged dead/shadowbanned or whatever, that speaks poorly to the current culture 'round these parts.
Nix uses rpaths on Linux (install names on OSX) to fix the precise location of dynamically linked dependencies, and it also patches the paths to executables (e.g. In string laterals or shebangs) needed at run time. To change the location of a binary, one would have to patch the dependents so that /nix/store is replaced with the new prefix, which is generally not possible to do, unless the new prefix has the same length as the old prefix - in which case you can just sed every file.

Homebrew just assumes that the needed executables will be available on $PATH and that the dynamic linker will find libs in /usr/lib or /usr/local/lib.

So yes, you really would need to recompile everything if change the prefix from /nix/store to something else.

Edits: fixed spelling and structure from originally typing via phone.
Does it allow you to install several versions of a package and use everything down to compiler version and compilation flags as dependencies?
What would a thoughtful discussion about this particular story look like?

What you're advocating for here in terms of policing the type of discussion and the types of people that can contribute to the discussion here (based on your assumptions about their personal experiences) is incredibly Orwellian. Obviously this is a private forum and you can do whatever you want but, seriously what you're saying is a bit absurd.

Also FWIW (not much to me, but probably a lot to you) I have personally experienced racism many times in my life.
Working in Flow: The Secret to True Workplace Happiness
I feel reasonably secure that "Morgante Pell" is globally unique and "morgante" is only slightly less so.
>That’s what free means. Not “companies free to do whatever they please”.

The fact that you used the word "free" here to tell us what "freedom" doesn't mean implies otherwise, because I believe "free to do whatever they please" is exactly what it does mean. There are no "requirements" in a free market other than serving demand and making a profit.
I am not familiar with Fable but you might be interested n Haskelm[0] which helps you use Elm for the frontend and Haskell for the backend. I believe there are some other similar projects as well. I just recently started a new project in Elm (Clojure on the backend oddly enough... kind of opposite ends of the FP landscape) and I've got to say the experience has been fantastic so far.

[0] https://github.com/JoeyEremondi/haskelm
I have never heard of an Asian referred to as a person of color
> LinkedIn and similar firms aren't in the slave trade.

It's just a generalization that people use to describe a technology company that essentially requires users to bring value to a company's paying customers.
Sounds like pretty rubbish bulbs. Have you not tried replacing even one with a good quality brand?

Of course, it might also just be that the lighting design wasn't very good in the first place...
Show HN: Unified API for Facebook Google+ Slack Twitter GitHub (Android Library)
It is interesting to learn just how much "technical" debt USA has
911 that is falling apart
Nuclear weapons debacle (and a lot of other systems too)
The 7 trillion infrastructure problem
How Oracle made its case against Google, in pictures
I can only assume as autonomous travel increases and incidents decrease, the speed limit would increase. Obviously battery technology still has a ways to go to be able to last more than a couple hundred miles running 100 MPH+
>For desktop Linux, SELinux is indeed difficult to use on a day-to-day basis. To the point that there's no way I'd consider using it.

It's on by default in Fedora, has been for years. Most people never even know it's there.
I'm familiar with the pattern: I'm saying that its a bad description, and that there is a much better one available.
27 Actionable Insights and Resources for Employee Lifecycle Management
> The fine print: Due to the architecture of file system access in contemporary kernels (esp. file system caches), it's next to impossible for a user-space application to actually guarantee that writes are durable (i.e. synced to disk at a defined point in time), but most RDBMS manage well enough in practice.

While this doesn't relate to a specific file, you can always look at the size of Dirty and Writeback in /proc/meminfo. They correspond to the amount of dirty file page caches that have yet to be synced.
Fluorescent lights do use filaments. At each end of the tube there's a hot cathode - essentially a small incandescent filament designed to emit electrons rather than light. This is the source of the electrons that excite the gasses.

While there are some designs that use cold cathodes these are not the common type as they are less efficient.

Still won't make this filament treatment help though - sandwiching with layers would probably block the electrons.
Having stopped consuming processed sugar a few years ago, I can easily say this was the single change I've made with the largest impact on my health and quality of life.

When I started reading labels and stopped buying anything with sugar, corn syrup, evaporated cane juice etc., I automatically eliminated processed food.

As for food companies, their responsibility is to maximize profit which usually involves selling as much as possible at the highest profit margin possible.

Given that high profit margin excludes the possibility of expensive quality ingredients, the variables that remain are taste and perception. Thus, food commercials, stories, "healthy food fetishism" (and pushing same crap as such) and taste laboratories where scientists focus on making said crap palatable, tasty and if possible addictive.

Sugar is an addictive substance so it is almost always a part of this formula.
Vanadium
Not all jobs are created equal. NAFTA was great for destroying Unions and lowering costs, not sure if it created good jobs.

Of course it was just another attack on the middle class. http://www.theatlantic.com/business/archive/2012/06/are-unio...

PS: I don't 100% agree with this, but it's a viewpoint I rarely see on HN and fits the discussion.
I read that HOWTO, actually, and the stuff you're describing isn't really explained in it.

For example, there's a httpd example changing a label right there in the HOWTO, and it doesn't explain where I'm supposed to discover the correct label. And the recommended audit-script-to-config doesn't show the correct labels, it prompts you to relax the rule instead of changing labels.

My procmail rules don't correspond to what you said procmail does. And how was I supposed to discover procmail_home_t ?

I'm not saying I'm Mr. Super Smart, I'm just saying that it's quite a bit of investment.
Google's cars have logged a lot of miles, but only over a few miles of actual road in Northern California--road for which Google has extremely detailed maps already in place.

It's going to be a long time before a Google car can just drive anywhere you tell it to.
Obviously it could happen for any number of reasons but my guess is that the most common reason is that someone encounters something for the first time and thinks "this is really cool" and wants to share it with someone, and then they think "I know, HN will love this!" and then they post it, and then they either get distracted and wander off, or they see everyone posting "why are you posting this, it's been around forever" type of stuff and they decide they have better stuff to do.
The AWS / Salesforce Partnership Just Got Stronger
Good. Hat off to the Duckduckgo team. It's my major search engine now.
I don't think android is really a special case, SELinux is still hard. The only thing that makes android special is that google engineers have put in a lot of work to make SELinux work. It's a powerful tool, but if you want the benefits of SELinux it takes significant effort somewhere in the development chain.
Aside from Erlang which is far too slow (most Erlang apps use C for the data plane) the others are far too risky choices in terms of hiring, future support and general maintainability. Also there are far too many unknowns about them. Rust shows a lot of promise and may very well be suitable for this kind of things, but it may still be too young for an important infrastructure project at Twitter. It is also harder to program than in Java, although for an infrastructure project such as this, this may not be a deal breaker.

Another reason to run on the JVM is that often your applications run on the JVM, and the JIT -- which is getting better and better, and will get incredibly good in Java 9 -- can really do cool stuff when it optimizes across the app/infrastructure line. I've just seen a paper[1] showing 3x performance boost when rewriting parts of SQLite in Python, and letting the JIT optimize the DB together with the app.

[1]: http://arxiv.org/abs/1512.03207
How to Make 3D NAND
Google+ (remember that) keeps asking me if I know myself. It's very existential but clearly idiotic.
why is this downvoted ? I didn't read this as an endorsement to upvote but rather as witty response to @argonaut , unless i'm missing something else entirely here and the downvotes are warranted.
I'm confused. If reflecting 90% of infrared radiation only produces a luminous efficiency of 6.6%, how can any further increase in reflection lead to 40% efficiency?
Isn't it kind of like "should you get insurance?"

We can be glad that Daniel, after a long bachelorhood, found someone to spend his remaining days with. But we can't evaluate anything at all about the future prospects of the relationship without more information. Over the years I've known people on both sides of the situation, where their spouse turned out to be just someone who wanted to marry a tech millionaire and then divorce them after getting control of a chunk of assets, and people who are still going strong seeing the world and enjoying life.

If your spouse stays at home with the kids while you work, its a great idea to have life insurance to cover their needs if something happened to you. If you're both retired and your kids are grown up and moved away? Well its nice to have something to cover funeral arrangements. Seems like the situation is everything here.
/nix is mounted readonly, only the special nix user can write to it. Data goes in /var or similar.
Beyond Functional Programming with Elixir and Erlang
> If you are installing software from scratch, you must trust the https server that serves it to you

This is incorrect - you are forced by `curl | sh` to trust all of the 1000+ CAs in your OS' keystore. And if you can't trust all of them (since some have given out Google certs before, you can't), how can you trust what you're getting over HTTPS?

With hashes, they are not typically served from the same domain. That's the minimum level of protection for the user.

Signing with a key is another level of protection; it lets the user (not the OS) decide the level of trust, and even verify the key with the author of the package via a completely separate channel.

Now the question really becomes, why doesn't the provider use the existing (secure) channels of software distribution? RPMs, DEBs, installer packages for Macs, MSAs for Windows?
Sure, but putting aside pranks and vandals, the question remains what the AI does when there is a small (or large!) discrepancy between 1) physically-signed and 2) mapped/stored speed limits.

I've driven roads where the GPS swore the speed limit was 20 clicks slower than the signed speed limit. It is not necessarily safer to drive significantly slower than the posted speed limit, since most traffic will be doing at least that and relative speed differences are a contributor to surprises/crashes/injuries on the road.
LinkedIn: Protecting Our Members (Regarding the recent 100M user dump)
>would that work with Nix?

Yes.

>Would the data live under /nix?

No, Datomic will be built with another default data directory.

>would that data get squashed because of some kind of idempotency assumptions that Nix might make?

No, since data is stored separately.