skysight-inc/HackerNews huggingface dataset:
Your architecture being microservices doesn't change the problems with using JWTs (or any "session" system based on signing things): you can't revoke them.

I am pretty confident being unable to revoke tokens will start to be a problem with any sufficiently large websites: you don't just need to scale in terms of traffic, but also in terms of people doing bad things.

If you're at this sort of scale, adding in another service that validates sessions is not a lot of work. Either your microservices that need authentication could have a library added to talk to this service, or you could put everything that needs auth behind something that validates the requests as they come in. Vulcand looks like it makes this easy (I haven't used it personally, but I've worked on a system that works similarly using an F5 device).

Sooner or later, you _will_ regret not being able to revoke sessions.
After further thought, it seems like having a reputation as difficult to hire for and a reputation for attracting smart people would be two very good reasons for people "only in it for money" to learn Haskell.
The whole thing has been deplorable since they un-P2P'd it. Terribly performance and call quality.
CS188 Intro to AI – Course Materials
I've done computer vision/machine learning with a much less powerful MBPRetina, you'll be fine even if you start now.
Because it's just kind of lazy and incorrect, that's why.

Apple did promise to open FaceTime, and was promptly sued – that's why it's not open. AFAIK there was no promise to open iMessage.
Blanket bans have costs for people, too, though. In this case, we're not talking about dumping toxic sludge in a river, either, but about a sonic boom.
It just needs to be smarter about the context. If a video is loading in chrome, 90% of the time the intent is to turn down the volume of the video, it's broken that it waits for it to start playing.

Honestly, the most intuitive option for me would the audio controls should never touch the ringer, bury that behind a menu, rather than switching based on context.
"Peter Schiff said back in January that the US would have a big recession this year. If we don’t have a recession this year, people will forget Schiff’s false prediction, as well as false predictions of major crises in the US in 2015 and 2013, and recall his correct prediction of the 2008 recession. (Insert broken clock analogy here.) Whenever I hear that someone has accurately predicted a recession, my evaluation of that person declines."

http://www.themoneyillusion.com/?p=31615
Those sorts of processes are great for requiring information with people might not be inclined to give if they had a real person they were conversing with, particularly past salary questions that only accept an integer value.
I pay 1 or 2 ATM fees per year, because I just look for credit unions, and the vast majority of CUs are in mutual networks where ATMs are fee-free for each other's members. Even while traveling -- finding a CU ATM in the Denver airport put a big grin on my face.

What ATMs do you use where you can only take out $20 at a time? I usually see caps of $200-300 and once in a while, on the nasty-fee ATMs they're $100 but I just find another one.

By your logic, when I'm out of cash and make a $300 withdrawal to buy a $3 snack with it, the other $297 evaporates instead of sitting in my wallet like real money.

It's weird to me that so many people refrain from carrying cash on the logic that they might be mugged or lose their wallet. Okay, those things could happen, but how often? I've been mugged zero times and lost my wallet once in the last 20 years. Assume I had $150, half my usual withdrawal amount, in the wallet at the time. How long does it take someone to rack up $150 in ATM fees while trying to avoid that exposure? Quite a bit less than 20 years! I'd wager most people spend more on fear fees than they'd potentially lose if they simply carried the cash, because the loss events are so very rare.

As for compulsively spending money in one's pocket, http://www.nbc.com/saturday-night-live/video/dont-buy-stuff/...
You cannot invalidate JWT tokens

This is simple not true. You ALWAYS will sign your tokens with a well known secret, you could eventually even add some salt from a database to it.

They are less secure

Compared to what? Actually JWT will have the same secureness like Bearer Tokens or Cookies, wherever you store it, its not `less` secure. Horrible article points here.

They are less secure

They take the same amount of storage than signed cookies, wuhu I use JWT so often and I NEVER exceeded the cookie limit, but I wouldn't store them there anyway.

JWT is as secure as any other solution and this article proves it since he isn't well informed, he just throws a bunch of stuff out and tries to be "an expert".
Btw. every other solution is really dangerous as well, especially Cookies could be a total mess of security problems.
The same could actually happen with Bearer Tokens.

My toughts are use the thing your most happy with and the thing you understand and the thing you can implement with code that is totally clear and especially code that is really really easy to understand. And actually JWT will mostly win this battle.

I've seen a lot of people just using Session Cookies from their Framework, but eventually have no idea about their risks, they have lots of CSRF all over the place, or using a too small ID or eventually the ID is not really random.
Eventually this could happen with JWT too, tough. As seen by this guy, that he generates the JWT without any well known secure string. that could be changed.
"the mass shootings are uniquely american thing"

I'm not sure whether we should praise Wikipedia for compiling such lists! but https://en.m.wikipedia.org/wiki/List_of_rampage_killers disagrees with that. Also, the claim isn't that private gun ownership causes all mass shootings, it is that it explains a large part of the difference in occurrence rate between the US and other countries.
I'd say this is now less likely. Much more natural to pick up and confirm on your iPhone or Apple Watch.
I'm sure you'll be able to toggle these settings via settings.

Currently, you can toggle off access to Siri, Notifications, Today View, Message/Relies to Message, and Wallet.
I know bandwidth is cheap these days but including a 14.9mb cover image on such a major story....?
Also lacking is support for queries that would open up other media apps. "Siri, can you play my podcast in Overcast?"
Apparently it doesn't even mean coexisting with people who have different beliefs.

You insist on brainwashing them or otherwise eliminating their beliefs from visibility. It's sort of strange.

There is no "right and wrong" or "good and evil".

Progress means change for the sake of change, because you all feel deprived that you weren't born early enough to do anything meaningful with your lives.
you need to do that because mobile won't autoplay video. A lot of landingpages use a gaming framework to do it.
The FreeBSD wiki (https://wiki.freebsd.org/ZFSTuningGuide) still claims:

> To use ZFS, at least 1 GB of memory is recommended (for all architectures) but more is helpful as ZFS needs lots of memory.

Is that inaccurate?
Sometimes I copy my private keys to the clipboard.

cat privatekey > pbcopy

Scary if it ends up on my mobile device clipboard.
YouTube: A place for killers and porn stars to build a brand
MacID is a much safer (and seemingly more powerful, from what I could tell from the keynote) implementation of this idea. I've been using it for a long time and it's really solid.

https://macid.co/
UX by elimination - mystery meat navigation (https://en.wikipedia.org/wiki/Mystery_meat_navigation) for your keyboard.
"Virtual Machines".

Take the blockchain out of Etheruem, and you still have a pretty cool deterministic state-transition machine. My understanding of Urbit is very limited, but I believe it has a similar concept of Ethereum without a consensus protocol.
The main one is that, at least with the providers I used (three, including Fedex) there was no api and no way to interface with their systems automatically, everything had to be done through archaic websites with a usability designed before the dot com boom or by phone. During busy times (christmas shopping, for example), we had several interns dedicated exclusively to handle sending the info (number of packages, destinations...) to the supplier and printing the shipping labels.

I think that when you reach the thousands of packages per day, you are offered those services, but as a small setup with 'only' hundreds of packages, the only option was to do it manually. We had a simple system to handle orders, inventory, manufacturing... It would have been a breeze to integrate an api with it to print the labels automatically to give the guys actually preparing the packages.

We didn't get a lot of issues that usually pop up when talking ecommerce (scammers, false orders), we didn't even get many returns (I only remember a couple of cases) but we did get a few packages that disappeared in transit with no explanation or, obviously, a refund. The process to report those was horrible, similar to cancelling a mobile phone contract and in most cases we had to simply write-off the package and send a new one to the customer (actually, we are waiting for the resolution of a case when a package worth a few thousand euros was lost, we might actually get back that money).

Another thing that was annoying, although I know it's understandable, is that to start getting discounts they require a volume that, as a new company or sole trader you are simply not going to get. Paying the normal rate for Fedex, for example, makes packages quite expensive when you are talking international (and the fact that I live in an island with a population of less than 10M people doesn't help). We basically kept shipping costs to a minimum by eating into our profit margin. We got less money, but helped improve the sales.
> I still have no idea what the option key is for

It's for "⌥".

Yes, that's not ideal, and it's a striking UX failure on Apple's part that the keycap says "option" while the menu says ⌥ - all the more striking given Apple's generally well deserved reputation for getting that kind of thing right.

Same goes for control and ^ - granted, Unices have represented Control as ^ since forever, but part of the appeal of a Mac is supposed to be that you don't have to be a grizzled hacker to understand it.

That said, how does it take (more than) a decade to learn these correspondences? Not that I don't understand your complaint here, and I agree it should be fixed, but...I mean, this stuff doesn't seem all that hard.
Setting all the details aside, there are about 30 years between the first column-oriented database and MonetDB. Databases are a really well and early researched area of computer science and many ideas existed at least in the academic area for decades before they saw widespread adoption. Another example is what we now label NoSQL databases, they also already existed in the 1960s.

MonetDB in its current form was first created in 2002 by doctoral student Peter Alexander Boncz and professor Martin L. Kersten as part of the 1990s' MAGNUM research project at University of Amsterdam. [1]

TAXIR was the first application of a column-oriented database storage system with focus on information-retrieval in biology in 1969. [2]

[1] https://en.wikipedia.org/wiki/MonetDB

[2] https://en.wikipedia.org/wiki/Column-oriented_DBMS
I do use facebook's Pusheen stickers. If there are people out there whose states of mind don't correspond as well with a cartoon cat, I suppose they should have the same communication opportunities.

Less the subtitle, my spirit animal: http://i1.kym-cdn.com/photos/images/original/000/383/574/c45...
> In my opinion, it is MUCH easier to get a CSRF vulnerability

It's simple (though perhaps non-trivial) to protect against XSRF these days, especially if you're securing a JSON API, with:

1. the SameSite cookie option (Chrome-only for now)

2. double submit cookies (mentioned in the article)

3. filtering by the Accept request header, i.e. blacklist application/x-www-form-urlencoded, multipart/form-data, and text/plain, or whitelist application/json (protects against non-XHR, form-based attacks; only appropriate for JSON APIs)

4. CORS, i.e. disallow cross-origin requests, which is the default when no Access-Control-Allow-Origin response header is present (protects against XHR attacks; only appropriate for JSON APIs)
Yes - the power and cooling is fundamental.
Useless fact of the day: the special characters Apple uses to represent keyboard shortcuts in the menu bar, with the exception of Ctrl (^)[1], are all part of an ISO standard [2]. I've never really understood why they stopped printing them on the keyboard, though-- it turns figuring out shortcuts like ⌥⌘⎋ into a game of trial and error for new users, rather than something that's relatively self-explanatory.

A few of the symbols are still printed on Apple's keyboards in a few locales, but it looks like the confusing ones (option, escape) are gone in all locales on their most recent keyboards.

[1] Apple follows the popular convention from *nix here, rather than the ISO standard, which is a sort of a dharma wheel thing that I can't find in Unicode.

[2] https://commons.wikimedia.org/wiki/Category:ISO_9995-7_symbo...
JWTs can be revoked if you sign them with application_key + some_user_revocation_string.

This is how password reset tokens work in Django, for example. They're signed with the app's secret key + the user's existing password hash. Once the user uses the token to change the password, the token is no longer valid.
It's apple reinventing the zfs and btrfs wheels. Which are already mature, useable and open source.

Google them and see what they do well, and you might get some ideas.
Other systems aren't immune to this problem. Permit me to introduce you to Dennett Pl, Delta, BC, Canada. Proud owner of the postal code V4G1N4.
I speak a weird hybrid of four Norwegian accents, and Siri + iOS dictation is indispensable in both using my phone faster, and operating it when my hands are occupied with other things. So there's clearly a variety of experiences here.
Rackspace Cloud tries to balance delivering the power of cloud with the simplicity/constructs of traditional infrastructure. It doesn't have the complexity of AWS, but that strength is also a weakness since it lacks the features and sophistication of AWS. So, depends on what is desired. The AWS complexity can absolutely be challenging for small teams. That's one of the reasons Rackspace created Fanatical Support for AWS (http://www.rackspace.com/aws). While AWS provides economies of infrastructure, Rackspace Fanatical AWS provides "economies of expertise" via management tools and hundreds of AWS devops engineers, architects, etc. The two services are very complimentary and even small teams can tap into expertise at scale to overcome the AWS complexity hurdle. One option worth considering for those who want the power of AWS and are concerned about complexity.
[Full disclosure: I work for Rackspace. I helped build the Rackspace Cloud and now work on our Fanatical AWS team.]
That's one I could get behind.

I wonder if it displays which app an image came from. Could I make my own fake dice extension that rolls whatever I tell it to?
> He just doesn't like everybody uses JWT instead of cookie in any case.

Why would anybody care about how you implement something in your application, unless they have a concrete reason that your implementation is less than ideal?

> What you need to do if the redis server cannot support so many users?

Scale up your infrastructure. You're need a LOT of users before this starts being an issue.

> So use JWT to keep stateless is a good choice.

The article explains why this is a bad idea... unless you can explain where the article is wrong?

EDIT: Got caught in the middle of a thought, apologies.
Answer: not that difficult. Knocked this shell script together just for you. Totally untested, and as it doesn't use the screensaver the Kindle itself might stomp on it going in and out of suspend, but it should get you started.

#!/bin/sh

sleeptime=600 #seconds
url="http://whatever/formatted-for-kindle.png"
tmp_image="/tmp/image.png"

wifienable() {lipc-set-prop com.lab126.cmd wirelessEnable 1}
wifidisable() {lipc-set-prop com.lab126.cmd wirelessEnable 0}
sleepfor() {lipc-set-prop -i com.lab126.powerd rtcWakeup $1}

wait_for_wifi() {return `lipc-get-prop com.lab126.wifid cmState | grep CONNECTED | wc -l`;} #return true if keyword not found
wait_for_ready_suspend() {return `powerd_test -s | grep Ready | wc -l`;}

while true;
do wifienable
while wait_for_wifi; do sleep 1; done
wget -O $tmp_image $url
eips -g $tmp_image
wifidisable
while wait_for_ready_suspend; do sleep 1; done
sleepfor $sleeptime
done
The workers are wrong, then. That is not the purpose of the H1B. Anyone who thinks it should lead to a green card should be barred from getting the visa.
This is much bigger than that. Linkedin has around 7k employees in the bay area, far more than Microsoft currently has down here.

This acquisition will transform Microsoft into a major bay area Employeer, with >10k people working in the region.
The WWDC app on HR new Apple TV has the live stream, starting shortly.
According to their documented "Current Limitations" (https://developer.apple.com/library/prerelease/content/docum...):

> Case Sensitivity: Filenames are currently case-sensitive only.

First thought: they have seen the light!

A moment later: wait...they consider this a "limitation", and it's only "currently" the case. So maybe they're going to perpetuate the brain-damage anyway.

Sigh.
Apples US keyboards are fine, the problem is their international keyboards are usually bizarre hybrids of the local layout and US layout.

Standard UK layout: https://en.wikipedia.org/wiki/File:KB_United_Kingdom.svg

Apple "UK" layout: http://i.imgur.com/pIGiilv.jpg (@€#@|\`~ are all wrong)
Odd - the sites I've been looking at say "pre-order June 30th"

Where can I get one for next week?
I don't think you have much to worry about. The airline industry has been focused on fuel efficiency for a long time now, and as a result, coast-to-coast flights already take significantly more time because they fly slower (for fuel efficiency). Unlike the 60s, air travel is no longer the domain of the upper-middle class and up, almost everyone does it, and the airlines profit through sheer volume, and live with a lot of competition. This is why they're always trying to weasel more profit with little fees for everything, because consumers are so price-conscious. They're not going to get that many takers if they start offering flights that are 2-3x the speed but 6x the ticket price.
“Gtk 4.0 is not Gtk 4”
To your last point, if you want to be able to expire "other" tokens for a user on, for example a password change, then you need to check/verify the token against a datastore on each request anyway... the same will go for access/api throttling. Which will negate some of the enhancements that "stateless" JWT gives you, as it's no longer stateless.

Of course, you can selectively "verify" the token, only doing signature validation for most requests (semi-public, browse, ...), but security-sensitive requests validate the token hasn't been revoked (checkout, profile mgt, etc), or is otherwise still valid.
The irony, a case-insensitive fs on case-sensitive "macOS"
3D Touch... you aren't adding it to every app now? ;)
They're sitting on it and letting it invest. So pretty much nothing, except some stock buy back.

http://www.marketwatch.com/story/apple-isnt-really-sitting-o...
That wasn't what I was arguing.

Regardless of whether or not we're documening sex, why document gender if it is only "a set of expectations about how the designated person will appear or behave"?
I was searching for exactly the same stuff yesterday, and I found this:

http://lifehacker.com/five-best-paper-notebooks-1157038442

I usually keep notebooks, but I am ever more convinced of using one because of Rich hickey's talk: https://youtu.be/f84n5oFoZBc

and we have a better chance of remembering something if we write than
type. http://lifehacker.com/5738093/why-you-learn-more-effectively....

I have previously read that people like Martin Gardner had an awesome system of keeping notes. I would love to know more about your tips.

How do keep your notes? How do you organize stuff, while retaining the freedom to doodle. How do you find stuff again(which is the killer feature for typed notes). Would love to learn from the masters - do you have any books to recommend?
You know, I really think this line of argument on HN is getting old and needs to be relegated to the dustbin of intellectual discussion.

Saying "Well, but X did $similarthing" as a loose form of justification of whatever Z is doing, like some strange variation of the "not as bad" fallacy. (Though I understand you're point about industry modus operandi)

a cookie if anyone knows the actual fallacy this falls under
The next step is optimizing the plants to grow better in these greenhouse conditions - currently the plants waste lots of energy. For example my company, TAXA Biotechnologies[1], has identified a gene that doubles the rate of growth of lettuce per unit light energy. It wouldn't work in the wild as the cost is reduced pest-resistance but growing indoors there are other ways to control that.
[1]www.taxa.com
Ask HN: How do I keep learning while I am having a job?
I have 3 years experience of backend engineer. I get the things done at my job, though more often I am missing my deadlines by few days.

I always feel I am missing knowledge at the theoretical and practical level when I see myself compare to my co-workers.

I feel uncomfortable at understanding the dev-ops kind of work (how web servlets work, how Nginx works), coming up with good design solutions (which won't need much rework after new requirements come).

How do I make the best use of my surroundings (my coworker's knowledge, online resources) to fill this gap and be a better developer?
We just 'upgraded' from Lync to Skype for Business and as far as I can tell it's exactly the same program with slightly different UI chrome.
To add to what CarolineW posted, I remembered that the comment existed so I went to HN search and entered "by:kogir gc". (I then had to manually switch the results from stories to comments, though.)
Anyone know if Siri will still only respond when plugged in? I wish it were an option to turn on at all time. I realize battery would be drained considerably.
You can actually say "Hey Siri call Jennifer with the speaker on" or "...call Jennifer on speaker".

Buy yes, it makes total sense to do it automatically if not on the ear. The logic seems simple enough to program.
Hah, it does roman numerals up to 49

say Louis XLIX = Louis the 49th
say Louis L = Louis L
Hypernova by Airbnb: JavaScript Server Rendering (React in Ruby on Rails)
Isn't Haskell 20 years old though?
Website doesn't work at all on my Nexus 5x. Any other company would get lambasted for that kind of stuff.
Also, at the very least, they have a finished product.

http://techcrunch.com/2016/03/02/hands-on-with-the-949-mind-...

I don't know how big the market will be, but I already have potential customers lined up for some very crappy forms of AR.
Sure I should preface that - she has no fear of getting shot by random citizens.

The 6/4 issue is a separate thing. In fact many in her generation are unaware that it happened. First time I made a reference, she wouldn't believe me for like a week.

But still, the salient point is that there exist governments with no gun control and minimal gun murders, high gun control and minimal gun murders, as well as low gun control and low murders, and low gun control and high murders. I think any statement of causality needs some massive citation there...
One of the other great features is being able to send a snap to someone on an Android device.
> Using javascript to manage your sessions only the client side in any way is NOT secure.

And yet it's common practice, at least in the SPA communities with which I engage on a regular basis.